From b33cc648d1e57fa6655e3c8d4519376751238059 Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Mon, 5 Oct 2026 19:38:47 +0800
Subject: [PATCH 01/37] feat(desktop): automatically render and archive chat
 images

Resolve assistant Markdown images through a session-scoped Host service,
save bounded replay copies without rewriting message text, and provide
lazy previews, zoom and retry through independent UI capabilities.

Share archived image payloads across deliveries and conversation copies,
reuse Read filesystem boundaries, and retain PublishImage for explicit
publication before temporary sources are removed.

Generated-by: Codex (GPT-6)
---
 .../check-renderer-architecture.test.mjs      |  10 +-
 .../scripts/vite-renderer-entry-contract.ts   |   9 +-
 .../main/runtime-host-artifacts-ipc-main.ts   |   1 +
 apps/desktop/src/main/runtime-host-client.ts  |   4 +
 apps/desktop/src/preload/bridge-contract.d.ts |   1 +
 apps/desktop/src/preload/preload.ts           |   1 +
 .../src/renderer/chat-message-surface.tsx     |   1 +
 .../features/conversation/staging-services.ts |   1 +
 .../ui/staged-quote-chat-view.tsx             |   6 +-
 .../src/renderer/features/workbar/ports.ts    |   1 +
 .../tools/side-chat/quote-companion-panel.tsx |   2 +-
 .../src/renderer/features/workhub/ports.ts    |   1 +
 .../features/workhub/ui/workhub-root.tsx      |   2 +-
 apps/desktop/src/renderer/index.html          |   3 +-
 .../desktop/create-workhub-services.ts        |   1 +
 package-lock.json                             |   3 +
 packages/core/package.json                    |   1 +
 packages/core/src/artifacts.ts                |   3 +
 packages/core/src/image-delivery.ts           |  81 ++++
 .../core/src/interaction-permission-review.ts |   8 +-
 packages/core/src/permission.ts               |   1 +
 packages/runtime-host/package.json            |   1 +
 .../src/__tests__/chat-image-delivery.test.ts | 348 ++++++++++++++++++
 .../src/__tests__/execution-artifacts.test.ts |  93 +++++
 .../__tests__/execution-composition.test.ts   |  98 +++++
 .../runtime-host/src/protocol/artifact.ts     |   2 +
 .../src/protocol/image-delivery.ts            |  98 +++++
 packages/runtime-host/src/protocol/index.ts   |   3 +-
 .../runtime-host/src/protocol/operations.ts   |   1 +
 .../src/server/artifact-coordinator.ts        |   9 +
 .../src/server/chat-image-delivery.ts         | 339 +++++++++++++++++
 .../src/server/chat-image-markdown.ts         |  38 ++
 .../src/server/chat-image-source.ts           | 157 ++++++++
 .../src/server/execution-artifacts.ts         |  46 ++-
 .../src/server/execution-composition.ts       |  87 +++++
 .../src/server/root-turn-coordinator.ts       |  18 +
 packages/runtime/package.json                 |   1 +
 .../builtin-tools-file-worker.test.ts         |  62 ++++
 .../src/__tests__/tool-availability.test.ts   |   6 +-
 packages/runtime/src/builtin-tools.ts         |  68 +++-
 packages/runtime/src/image-file-reader.ts     |  44 +++
 .../src/system-prompt/main-session-prompt.ts  |   3 +
 packages/runtime/src/tool-availability.ts     |   1 +
 .../storage/src/artifact-image-storage.ts     |  74 ++++
 .../storage/src/artifact-metadata-codec.ts    |   3 +
 packages/storage/src/artifact-store.ts        |  85 ++++-
 packages/storage/src/artifact-stores.ts       |   8 +
 .../storage/src/sqlite-artifact-metadata.ts   |  22 ++
 .../storage/src/sqlite-artifact-schema.ts     |   7 +-
 packages/ui/package.json                      |   5 +-
 .../scripts/markdown-images.browser.test.mjs  | 192 ++++++++++
 .../src/__tests__/attachment-image.test.tsx   |  32 +-
 .../ui/src/__tests__/markdown-body.test.ts    |  31 +-
 packages/ui/src/attachment-image.tsx          |  59 ++-
 packages/ui/src/chat-turn.tsx                 |  13 +-
 packages/ui/src/chat-view.tsx                 |   4 +
 packages/ui/src/image-delivery.tsx            |  74 ++++
 packages/ui/src/markdown-body.tsx             | 116 +++---
 packages/ui/src/markdown-image.tsx            |  94 +++++
 packages/ui/src/markdown.tsx                  |   2 +
 packages/ui/src/shared-ui-copy.ts             |  36 ++
 packages/ui/src/styles.css                    |  45 +++
 62 files changed, 2442 insertions(+), 124 deletions(-)
 create mode 100644 packages/core/src/image-delivery.ts
 create mode 100644 packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
 create mode 100644 packages/runtime-host/src/protocol/image-delivery.ts
 create mode 100644 packages/runtime-host/src/server/chat-image-delivery.ts
 create mode 100644 packages/runtime-host/src/server/chat-image-markdown.ts
 create mode 100644 packages/runtime-host/src/server/chat-image-source.ts
 create mode 100644 packages/runtime/src/image-file-reader.ts
 create mode 100644 packages/storage/src/artifact-image-storage.ts
 create mode 100644 packages/ui/scripts/markdown-images.browser.test.mjs
 create mode 100644 packages/ui/src/image-delivery.tsx
 create mode 100644 packages/ui/src/markdown-image.tsx

diff --git a/apps/desktop/scripts/check-renderer-architecture.test.mjs b/apps/desktop/scripts/check-renderer-architecture.test.mjs
index ea05128a170..c671c863e7d 100644
--- a/apps/desktop/scripts/check-renderer-architecture.test.mjs
+++ b/apps/desktop/scripts/check-renderer-architecture.test.mjs
@@ -314,9 +314,10 @@ function canonicalRendererEntryHtml(
       <head>
         <meta charset="UTF-8" />
         <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+        <meta name="referrer" content="no-referrer" />
         <meta
           http-equiv="Content-Security-Policy"
-          content="default-src 'self'; ${policy}; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; connect-src 'self'"
+          content="default-src 'self'; ${policy}; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; connect-src 'self'"
         />
         <title>Maka</title>
         <style>body { margin: 0; }</style>
@@ -1778,6 +1779,13 @@ describe('renderer architecture checker fixtures', () => {
     );
   });
 
+  it('rejects an HTML transform that changes the no-referrer policy', () => {
+    assert.throws(
+      () => assertRendererEntryHtml(canonicalRendererEntryHtml().replace('content="no-referrer"', 'content="unsafe-url"')),
+      /renderer entry HTML contract forbids transformed executable or navigation surfaces/u,
+    );
+  });
+
   it('rejects executable HTML injected around the canonical module entry', () => {
     assert.doesNotThrow(() => assertRendererEntryHtml(canonicalRendererEntryHtml()));
     const emittedHtml = canonicalRendererEntryHtml().replace(
diff --git a/apps/desktop/scripts/vite-renderer-entry-contract.ts b/apps/desktop/scripts/vite-renderer-entry-contract.ts
index a3327fd28b9..4e9ed2c98af 100644
--- a/apps/desktop/scripts/vite-renderer-entry-contract.ts
+++ b/apps/desktop/scripts/vite-renderer-entry-contract.ts
@@ -40,7 +40,7 @@ const ALLOWED_HTML_TAGS = new Set([
   'title',
 ]);
 const CONTENT_SECURITY_POLICY =
-  "default-src 'self'; script-src 'self' maka-client-plugin:; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; connect-src 'self'";
+  "default-src 'self'; script-src 'self' maka-client-plugin:; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; connect-src 'self'";
 
 function normalizePath(path: string): string {
   return path.split(sep).join('/');
@@ -88,8 +88,13 @@ export function assertRendererEntryHtml(html: string, expectedScriptSource?: str
       htmlAttribute(attributes, 'http-equiv')?.toLowerCase() === 'content-security-policy' &&
       htmlAttribute(attributes, 'content')?.trim().replace(/\s+/gu, ' ') === CONTENT_SECURITY_POLICY,
   );
+  const referrerMetas = metas.filter(
+    (attributes) => htmlAttribute(attributes, 'name')?.toLowerCase() === 'referrer' &&
+      htmlAttribute(attributes, 'content') === 'no-referrer',
+  );
   const validMetas =
-    metas.length === 3 &&
+    metas.length === 4 &&
+    referrerMetas.length === 1 &&
     charsetMetas.length === 1 &&
     viewportMetas.length === 1 &&
     policyMetas.length === 1;
diff --git a/apps/desktop/src/main/runtime-host-artifacts-ipc-main.ts b/apps/desktop/src/main/runtime-host-artifacts-ipc-main.ts
index 2d7b3b0911f..fa86e155c57 100644
--- a/apps/desktop/src/main/runtime-host-artifacts-ipc-main.ts
+++ b/apps/desktop/src/main/runtime-host-artifacts-ipc-main.ts
@@ -87,6 +87,7 @@ export function registerRuntimeHostArtifactsIpc(
       return result;
     },
   );
+  deps.ipcMain.handle('attachments:resolveImage', (_event, sessionId: string, request: import('@maka/core/image-delivery').ImageDeliveryRequest) => deps.client.resolveImageDelivery(sessionId, request));
   registerRuntimeHostAttachmentPreviewIpc(deps);
   const materializePresentationArtifact = async (
     sessionId: string,
diff --git a/apps/desktop/src/main/runtime-host-client.ts b/apps/desktop/src/main/runtime-host-client.ts
index e10f95b3acb..d408fa08224 100644
--- a/apps/desktop/src/main/runtime-host-client.ts
+++ b/apps/desktop/src/main/runtime-host-client.ts
@@ -861,6 +861,10 @@ export class DesktopRuntimeHostClient {
     return result.project;
   }
 
+  resolveImageDelivery(sessionId: string, request: import('@maka/core/image-delivery').ImageDeliveryRequest): Promise<import('@maka/core/image-delivery').ImageDeliveryResult> {
+    return this.request('artifact.image.resolve', { sessionId, ...request });
+  }
+
   async listArtifacts(sessionId: string): Promise<ArtifactProjection[]> {
     for (let attempt = 0; attempt < MAX_OPTIMISTIC_ATTEMPTS; attempt += 1) {
       const first = await this.request("artifact.query", {
diff --git a/apps/desktop/src/preload/bridge-contract.d.ts b/apps/desktop/src/preload/bridge-contract.d.ts
index db622bf457e..bb79bbb7bcd 100644
--- a/apps/desktop/src/preload/bridge-contract.d.ts
+++ b/apps/desktop/src/preload/bridge-contract.d.ts
@@ -1719,6 +1719,7 @@ export interface MakaBridge {
       | { ok: true; base64: string; mimeType: string }
       | { ok: false; reason: string }
     >;
+    resolveImage(sessionId: string, request: import('@maka/core/image-delivery').ImageDeliveryRequest): Promise<import('@maka/core/image-delivery').ImageDeliveryResult>;
     readBytes(sessionId: string, artifactId: string): Promise<ArtifactBinaryReadResult>;
   };
   search: {
diff --git a/apps/desktop/src/preload/preload.ts b/apps/desktop/src/preload/preload.ts
index 259b75b0795..13028b3a4a0 100644
--- a/apps/desktop/src/preload/preload.ts
+++ b/apps/desktop/src/preload/preload.ts
@@ -3379,6 +3379,7 @@ const makaBridge = {
     },
   },
   attachments: {
+    resolveImage: (sessionId, request) => invokeSessionRuntimeHost('attachments:resolveImage', sessionId, request),
     pickDirectory: () => invokeWhenReady('directories:pick'),
     // The renderer hands over the dropped or pasted File objects, never paths:
     // only a File backed by something the user dropped or pasted has a path,
diff --git a/apps/desktop/src/renderer/chat-message-surface.tsx b/apps/desktop/src/renderer/chat-message-surface.tsx
index 6b6597097c5..16d5b75b99f 100644
--- a/apps/desktop/src/renderer/chat-message-surface.tsx
+++ b/apps/desktop/src/renderer/chat-message-surface.tsx
@@ -58,6 +58,7 @@ interface ChatMessageSurfaceProps extends Omit<
   | 'pendingQuotes'
   | 'onQuoteAnnotationSubmit'
   | 'onReadAttachmentBytes'
+  | 'onResolveImageDelivery'
 > {
   /**
    * #1985: the live projection and the shell-run records are the only session
diff --git a/apps/desktop/src/renderer/features/conversation/staging-services.ts b/apps/desktop/src/renderer/features/conversation/staging-services.ts
index 98002392b88..d8bfc678748 100644
--- a/apps/desktop/src/renderer/features/conversation/staging-services.ts
+++ b/apps/desktop/src/renderer/features/conversation/staging-services.ts
@@ -23,6 +23,7 @@ import type { ArtifactBinaryReadResult } from '@maka/core/artifacts';
 
 /** One attachment port: the Composer stages through it and the transcript reads image bytes through it. */
 export interface ComposerStagingServices extends ComposerAttachmentService {
+  resolveImage?: (sessionId: string, request: import('@maka/core/image-delivery').ImageDeliveryRequest) => Promise<import('@maka/core/image-delivery').ImageDeliveryResult>;
   readBytes(sessionId: string, artifactId: string): Promise<ArtifactBinaryReadResult>;
 }
 const context = createServicesContext<ComposerStagingServices>('ComposerStagingServicesProvider');
diff --git a/apps/desktop/src/renderer/features/conversation/ui/staged-quote-chat-view.tsx b/apps/desktop/src/renderer/features/conversation/ui/staged-quote-chat-view.tsx
index 12c55d2a565..b81e97d9297 100644
--- a/apps/desktop/src/renderer/features/conversation/ui/staged-quote-chat-view.tsx
+++ b/apps/desktop/src/renderer/features/conversation/ui/staged-quote-chat-view.tsx
@@ -24,8 +24,8 @@ import { useComposerStagingServices } from '../staging-services.js';
 
 /** Transcript attachment reads come from the injected attachment port, never from the caller. */
 export function StagedQuoteChatView(props: Omit<ComponentProps<typeof PlanChatView>,
-  'handleRef' | 'pendingQuotes' | 'onQuoteAnnotationSubmit' | 'onReadAttachmentBytes'>) {
+  'handleRef' | 'pendingQuotes' | 'onQuoteAnnotationSubmit' | 'onReadAttachmentBytes' | 'onResolveImageDelivery'>) {
   const staging = useComposerStaging();
-  const { readBytes } = useComposerStagingServices();
-  return <PlanChatView {...props} {...staging.chatViewQuoteProps} onReadAttachmentBytes={readBytes} />;
+  const { readBytes, resolveImage } = useComposerStagingServices();
+  return <PlanChatView {...props} {...staging.chatViewQuoteProps} onReadAttachmentBytes={readBytes} onResolveImageDelivery={resolveImage} />;
 }
diff --git a/apps/desktop/src/renderer/features/workbar/ports.ts b/apps/desktop/src/renderer/features/workbar/ports.ts
index f74b022e461..8e8ed1af9bf 100644
--- a/apps/desktop/src/renderer/features/workbar/ports.ts
+++ b/apps/desktop/src/renderer/features/workbar/ports.ts
@@ -165,6 +165,7 @@ export interface WorkbarArtifactsService {
 }
 
 export interface WorkbarAttachmentsService {
+  resolveImage?: (sessionId: string, request: import('@maka/core/image-delivery').ImageDeliveryRequest) => Promise<import('@maka/core/image-delivery').ImageDeliveryResult>;
   readBytes(sessionId: string, artifactId: string): Promise<ArtifactBinaryReadResult>;
   pickFiles(): Promise<
     | {
diff --git a/apps/desktop/src/renderer/features/workbar/tools/side-chat/quote-companion-panel.tsx b/apps/desktop/src/renderer/features/workbar/tools/side-chat/quote-companion-panel.tsx
index bb71c37a9d3..68adc96a405 100644
--- a/apps/desktop/src/renderer/features/workbar/tools/side-chat/quote-companion-panel.tsx
+++ b/apps/desktop/src/renderer/features/workbar/tools/side-chat/quote-companion-panel.tsx
@@ -403,7 +403,7 @@ export function QuoteCompanionPanel(props: {
           liveTurns={companion.liveTurns}
           activeTurn={companion.activeTurn}
           activeSession={companion.companionSession}
-          onReadAttachmentBytes={attachments.readBytes}
+          onReadAttachmentBytes={attachments.readBytes} onResolveImageDelivery={attachments.resolveImage}
           deriveTurnPresentation={deriveTurnPresentation}
           onEditUserMessage={(turnId) => {
             const message = companion.messages.find(
diff --git a/apps/desktop/src/renderer/features/workhub/ports.ts b/apps/desktop/src/renderer/features/workhub/ports.ts
index d5efe30f223..545b23a5bcd 100644
--- a/apps/desktop/src/renderer/features/workhub/ports.ts
+++ b/apps/desktop/src/renderer/features/workhub/ports.ts
@@ -56,6 +56,7 @@ export interface WorkHubServices extends WorkHubWorkspaceServices {
     model: string;
   }): Promise<void>;
   readonly attachments: ComposerAttachmentService;
+  resolveImageDelivery?: (sessionId: string, request: import('@maka/core/image-delivery').ImageDeliveryRequest) => Promise<import('@maka/core/image-delivery').ImageDeliveryResult>;
   readAttachmentBytes(sessionId: string, artifactId: string): Promise<ArtifactBinaryReadResult>;
   prepareAttachments(sessionId: string, items: Array<{ approvalId: string; name: string; mimeType?: string } | { file: File }>): Promise<AttachmentRef[]>;
   listActiveInteractions(sessionId: string): Promise<import('@maka/core/events').ActiveInteractionRequestEvent[]>;
diff --git a/apps/desktop/src/renderer/features/workhub/ui/workhub-root.tsx b/apps/desktop/src/renderer/features/workhub/ui/workhub-root.tsx
index 3852f439565..091edfff8e3 100644
--- a/apps/desktop/src/renderer/features/workhub/ui/workhub-root.tsx
+++ b/apps/desktop/src/renderer/features/workhub/ui/workhub-root.tsx
@@ -396,7 +396,7 @@ export function WorkHubRoot() {
         <div ref={history} className="workHubHistory" aria-hidden={!showConversation} inert={!showConversation}>
         <WorkHubConversation
           workLinks={links}
-          onReadAttachmentBytes={services.readAttachmentBytes}
+          onReadAttachmentBytes={services.readAttachmentBytes} onResolveImageDelivery={services.resolveImageDelivery}
           onOpenWork={(id) => call(services.presentation.openSession(id))}
           scrollBehavior="auto"
           onNew={() => composer.current?.focus()}
diff --git a/apps/desktop/src/renderer/index.html b/apps/desktop/src/renderer/index.html
index 19950c7a2df..aa66e09e36c 100644
--- a/apps/desktop/src/renderer/index.html
+++ b/apps/desktop/src/renderer/index.html
@@ -21,10 +21,11 @@
 <html lang="en">
   <head>
     <meta charset="UTF-8" />
+    <meta name="referrer" content="no-referrer" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <meta
       http-equiv="Content-Security-Policy"
-      content="default-src 'self'; script-src 'self' maka-client-plugin:; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; connect-src 'self'"
+      content="default-src 'self'; script-src 'self' maka-client-plugin:; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; connect-src 'self'"
     />
     <title>Maka</title>
     <style>
diff --git a/apps/desktop/src/renderer/platform/desktop/create-workhub-services.ts b/apps/desktop/src/renderer/platform/desktop/create-workhub-services.ts
index 909c92a7056..9609793a2e6 100644
--- a/apps/desktop/src/renderer/platform/desktop/create-workhub-services.ts
+++ b/apps/desktop/src/renderer/platform/desktop/create-workhub-services.ts
@@ -93,6 +93,7 @@ export function createDesktopWorkHubServices(
       bridge.connections.setDefaultModel({ slug: llmConnectionSlug, model }),
     attachments: bridge.attachments,
     readAttachmentBytes: bridge.attachments.readBytes,
+    resolveImageDelivery: bridge.attachments.resolveImage,
     prepareAttachments: async (sessionId, items) => {
       const result = await bridge.workHub.prepareAttachments(sessionId, items);
       if (!result.ok) throw new AttachmentIngestBlockedError(result.code);
diff --git a/package-lock.json b/package-lock.json
index 4f9c96b1bfe..2c829c3a830 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -17420,6 +17420,7 @@
         "@maka/core": "0.1.0",
         "@maka/runtime": "0.1.0",
         "@maka/storage": "0.1.0",
+        "marked": "^18.0.11",
         "systeminformation": "^5.33.13",
         "ws": "^8.21.3",
         "yaml": "^2.9.1",
@@ -17516,8 +17517,10 @@
         "virtua": "0.52.7"
       },
       "devDependencies": {
+        "@playwright/test": "^1.63.0",
         "@types/react": "^19.3.0",
         "@types/react-dom": "^19.3.0",
+        "esbuild": "^0.28.2",
         "linkedom": "^0.18.13"
       }
     },
diff --git a/packages/core/package.json b/packages/core/package.json
index 33ba1939d9a..dfc6be42d83 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -63,6 +63,7 @@
     "./context-offload": "./dist/context-offload.js",
     "./tool-result-archive-evidence": "./dist/tool-result-archive-evidence.js",
     "./attachments": "./dist/attachments.js",
+    "./image-delivery": "./dist/image-delivery.js",
     "./artifacts": "./dist/artifacts.js",
     "./pet": "./dist/pet.js",
     "./skill-invocation": "./dist/skill-invocation.js",
diff --git a/packages/core/src/artifacts.ts b/packages/core/src/artifacts.ts
index 171a8b0c66a..1cd87adc5c0 100644
--- a/packages/core/src/artifacts.ts
+++ b/packages/core/src/artifacts.ts
@@ -117,6 +117,8 @@ export function isArtifactTurnKey(value: unknown): value is string {
   );
 }
 
+import type { ImageDeliveryMetadata } from './image-delivery.js';
+
 export interface ArtifactDescriptor {
   id: string;
   sessionId: string;
@@ -129,6 +131,7 @@ export interface ArtifactDescriptor {
   mimeType?: string;
   source: ArtifactSource;
   summary?: string;
+  imageDelivery?: ImageDeliveryMetadata;
 }
 
 export interface ArtifactRecord extends ArtifactDescriptor {
diff --git a/packages/core/src/image-delivery.ts b/packages/core/src/image-delivery.ts
new file mode 100644
index 00000000000..a949ab0b4af
--- /dev/null
+++ b/packages/core/src/image-delivery.ts
@@ -0,0 +1,81 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/** Client-safe delivery contract. No filesystem or networking capabilities live here. */
+export const IMAGE_DELIVERY_FAILURES = [
+  'not_found',
+  'not_allowed',
+  'too_large',
+  'unsupported_mime',
+  'quota_exceeded',
+  'download_failed',
+  'read_failed',
+  'queue_full',
+] as const;
+export type ImageDeliveryFailure = (typeof IMAGE_DELIVERY_FAILURES)[number];
+export interface ImageDeliveryRequest {
+  readonly turnId: string;
+  readonly messageId: string;
+  readonly source: string;
+  readonly retry?: boolean;
+}
+export type ImageDeliveryResult =
+  | { readonly status: 'pending' }
+  | { readonly status: 'ready'; readonly artifactId: string }
+  | { readonly status: 'failed'; readonly reason: ImageDeliveryFailure }
+  | { readonly status: 'unavailable' };
+/** Stored with its Artifact, so session copy/export carries both provenance and bytes. */
+export interface ImageDeliveryMetadata {
+  readonly messageId: string;
+  readonly source: string;
+  readonly status: 'pending' | 'ready' | 'failed';
+  readonly reason?: ImageDeliveryFailure;
+  readonly contentSha256?: string;
+}
+export interface ImageArchiveLimits {
+  readonly sessionBytes: number;
+  readonly workspaceBytes: number;
+}
+export const DEFAULT_IMAGE_ARCHIVE_LIMITS: ImageArchiveLimits = Object.freeze({
+  sessionBytes: 100 * 1024 * 1024,
+  workspaceBytes: 1024 * 1024 * 1024,
+});
+export function isImageDeliveryMetadata(value: unknown): value is ImageDeliveryMetadata {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
+  const v = value as Record<string, unknown>;
+  return (
+    Object.keys(v).every((k) =>
+      ['messageId', 'source', 'status', 'reason', 'contentSha256'].includes(k),
+    ) &&
+    typeof v.messageId === 'string' &&
+    v.messageId.length > 0 &&
+    v.messageId.length <= 512 &&
+    typeof v.source === 'string' &&
+    v.source.length > 0 &&
+    v.source.length <= 4096 &&
+    ['pending', 'ready', 'failed'].includes(String(v.status)) &&
+    (v.reason === undefined ||
+      IMAGE_DELIVERY_FAILURES.includes(v.reason as ImageDeliveryFailure)) &&
+    (v.contentSha256 === undefined ||
+      (typeof v.contentSha256 === 'string' && /^[a-f0-9]{64}$/.test(v.contentSha256))) &&
+    (v.status === 'failed' ? v.reason !== undefined : v.reason === undefined) &&
+    (v.status === 'ready' ? v.contentSha256 !== undefined : v.contentSha256 === undefined) &&
+    !/[\x00-\x1f\x7f]/.test(v.source as string)
+  );
+}
diff --git a/packages/core/src/interaction-permission-review.ts b/packages/core/src/interaction-permission-review.ts
index fc12008c162..de208488f88 100644
--- a/packages/core/src/interaction-permission-review.ts
+++ b/packages/core/src/interaction-permission-review.ts
@@ -523,6 +523,7 @@ function projectToolReview(
       };
     }
     case 'Read':
+    case 'PublishImage':
     case 'Write':
     case 'Edit': {
       const path = projectionStringFrom(
@@ -533,7 +534,12 @@ function projectToolReview(
       );
       return {
         kind: 'path',
-        operation: toolName === 'Read' ? 'read' : toolName === 'Write' ? 'write' : 'edit',
+        operation:
+          toolName === 'Read' || toolName === 'PublishImage'
+            ? 'read'
+            : toolName === 'Write'
+              ? 'write'
+              : 'edit',
         path: safeText(path, INTERACTION_PERMISSION_PATH_MAX_BYTES),
       };
     }
diff --git a/packages/core/src/permission.ts b/packages/core/src/permission.ts
index 96b23e99a05..d64264ce1b9 100644
--- a/packages/core/src/permission.ts
+++ b/packages/core/src/permission.ts
@@ -128,6 +128,7 @@ export interface ToolExecutionFacts {
 export const BUILTIN_TOOL_CATEGORY: Record<string, ToolCategory> = {
   // read
   Read: 'read',
+  PublishImage: 'read',
   search_files: 'read',
   Grep: 'read',
   Glob: 'read',
diff --git a/packages/runtime-host/package.json b/packages/runtime-host/package.json
index 90912442303..7e1a3344088 100644
--- a/packages/runtime-host/package.json
+++ b/packages/runtime-host/package.json
@@ -37,6 +37,7 @@
     "@maka/core": "0.1.0",
     "@maka/runtime": "0.1.0",
     "@maka/storage": "0.1.0",
+    "marked": "^18.0.11",
     "systeminformation": "^5.33.13",
     "ws": "^8.21.3",
     "yaml": "^2.9.1",
diff --git a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
new file mode 100644
index 00000000000..5437d9b46fb
--- /dev/null
+++ b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
@@ -0,0 +1,348 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { mkdtemp, readFile, writeFile, rm, stat } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createServer } from 'node:http';
+import { openInteractiveArtifactStoreForWrite } from '@maka/storage/artifact-stores';
+import { resolveStorageRoot, tryAcquireInteractiveRootOwner } from '@maka/storage/root-authority';
+import { ChatImageDeliveryService } from '../server/chat-image-delivery.js';
+import { chatImageSources } from '../server/chat-image-markdown.js';
+import { checkedChatImage, downloadChatImage } from '../server/chat-image-source.js';
+import { IMAGE_DELIVERY_OPERATION_SPECS } from '../protocol/image-delivery.js';
+import { SessionAdmissionGate } from '../server/session-admission-gate.js';
+const PNG = Buffer.from(
+  'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8DwHwAFBQIAX8jx0gAAAABJRU5ErkJggg==',
+  'base64',
+);
+const REQUEST = {
+  sessionId: 'session-1',
+  turnId: 'turn-1',
+  messageId: 'message-1',
+  source: '/tmp/image.png',
+};
+async function fixture(limits?: { sessionBytes: number; workspaceBytes: number }) {
+  const root = await mkdtemp(join(tmpdir(), 'maka-image-delivery-'));
+  const owner = await tryAcquireInteractiveRootOwner(
+    await resolveStorageRoot({ path: root, kind: 'interactive' }),
+  );
+  assert.ok(owner);
+  const store = await openInteractiveArtifactStoreForWrite(owner.lease);
+  const authority = { store, close: () => store.close() };
+  const errors: unknown[] = [];
+  let reads = 0;
+  let leases = 0;
+  const messages = new Map<string, string>();
+  let present = true;
+  const service = new ChatImageDeliveryService({
+    artifacts: authority.store,
+    admission: new SessionAdmissionGate(),
+    limits,
+    isPresent: async () => present,
+    readMessage: async (i) => messages.get(i.messageId),
+    readLocalImage: async (_sessionId, path) => {
+      reads++;
+      return checkedChatImage(await readFile(path));
+    },
+    acquireResidency: () => {
+      leases++;
+      return {
+        release: () => {
+          leases--;
+        },
+      };
+    },
+    persistenceFailed: (error) => errors.push(error),
+  });
+  return {
+    root,
+    owner,
+    authority,
+    service,
+    messages,
+    errors,
+    get reads() {
+      return reads;
+    },
+    get leases() {
+      return leases;
+    },
+    removeSession: () => {
+      present = false;
+    },
+    async close() {
+      await service.close();
+      authority.close();
+      await owner.close();
+      await rm(owner.controlDirectory, { recursive: true, force: true });
+      await rm(root, { recursive: true, force: true });
+    },
+  };
+}
+function observe(
+  service: ChatImageDeliveryService,
+  source: string,
+  sessionId = REQUEST.sessionId,
+  messageId = REQUEST.messageId,
+) {
+  service.observe(sessionId, {
+    id: 'text-event',
+    type: 'text_complete',
+    turnId: REQUEST.turnId,
+    ts: 1,
+    messageId,
+    text: `![Screenshot](<${source}>)`,
+  });
+}
+test('parses real Markdown image nodes, including references and balanced destinations, without scanning code or HTML', () => {
+  const text = [
+    '![one](</tmp/a (1).png>)',
+    '![two][pic]',
+    '',
+    '[pic]: https://example.com/a.png',
+    '`![code](/tmp/secret.png)`',
+    '```md',
+    '![fenced](/tmp/secret2.png)',
+    '```',
+    '<img src="/tmp/html.png">',
+    '![incomplete](https://example.com/',
+  ].join('\n');
+  assert.deepEqual(chatImageSources(text), ['/tmp/a (1).png', 'https://example.com/a.png']);
+});
+test('automatically saves a local delivery without any UI request; deletion and Host restart do not break replay', async () => {
+  const f = await fixture();
+  try {
+    const source = join(f.root, 'original.png');
+    await writeFile(source, PNG);
+    observe(f.service, source);
+    await f.service.waitForIdle();
+    assert.equal(f.reads, 1);
+    assert.equal(f.leases, 0);
+    assert.deepEqual(f.errors, []);
+    await rm(source);
+    const input = { ...REQUEST, source };
+    const result = await f.service.resolve(input);
+    assert.equal(result.status, 'ready');
+    if (result.status !== 'ready') return;
+    f.authority.close();
+    const reopenedStore = await openInteractiveArtifactStoreForWrite(f.owner.lease);
+    const reopened = { store: reopenedStore, close: () => reopenedStore.close() };
+    try {
+      const record = await reopened.store.findImageDelivery(
+        input.sessionId,
+        input.turnId,
+        input.messageId,
+        source,
+      );
+      assert.equal(record?.imageDelivery?.status, 'ready');
+      const bytes = await reopened.store.readBinaryInSession(input.sessionId, result.artifactId);
+      assert.equal(bytes.ok, true);
+      if (bytes.ok) assert.equal(bytes.base64, PNG.toString('base64'));
+    } finally {
+      reopened.close();
+    }
+  } finally {
+    await f.close();
+  }
+});
+test('remote delivery is downloaded once, remains replayable after the origin server disappears, and sends no credentials/referrer', async () => {
+  const f = await fixture();
+  let requests = 0;
+  const server = createServer((req, res) => {
+    requests++;
+    assert.equal(req.headers.referer, undefined);
+    assert.equal(req.headers.cookie, undefined);
+    assert.equal(req.headers.authorization, undefined);
+    res.setHeader('Content-Type', 'image/png');
+    res.end(PNG);
+  });
+  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+  const source = `http://127.0.0.1:${(server.address() as import('node:net').AddressInfo).port}/image.png`;
+  try {
+    observe(f.service, source);
+    await f.service.waitForIdle();
+    assert.deepEqual(f.errors, []);
+    assert.equal((await f.service.resolve({ ...REQUEST, source })).status, 'ready');
+    assert.equal(requests, 1);
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+    assert.equal((await f.service.resolve({ ...REQUEST, source })).status, 'ready');
+    assert.equal(requests, 1);
+  } finally {
+    server.close();
+    await f.close();
+  }
+});
+test('a supplied path is never a read grant; sources inside code cannot trigger archival', async () => {
+  const f = await fixture();
+  try {
+    f.messages.set(REQUEST.messageId, '`![secret](/tmp/image.png)`');
+    assert.deepEqual(await f.service.resolve(REQUEST), { status: 'unavailable' });
+    f.messages.set(REQUEST.messageId, 'plain text');
+    assert.deepEqual(await f.service.resolve(REQUEST), { status: 'unavailable' });
+    assert.equal(f.reads, 0);
+  } finally {
+    await f.close();
+  }
+});
+test('transient failure is persisted and is retried only on an explicit request', async () => {
+  const f = await fixture();
+  try {
+    const source = join(f.root, 'later.png');
+    observe(f.service, source);
+    await f.service.waitForIdle();
+    assert.deepEqual(await f.service.resolve({ ...REQUEST, source }), {
+      status: 'failed',
+      reason: 'not_found',
+    });
+    await writeFile(source, PNG);
+    assert.equal((await f.service.resolve({ ...REQUEST, source })).status, 'failed');
+    assert.equal(f.reads, 1);
+    assert.equal((await f.service.resolve({ ...REQUEST, source, retry: true })).status, 'pending');
+    await f.service.waitForIdle();
+    assert.equal((await f.service.resolve({ ...REQUEST, source })).status, 'ready');
+    assert.equal(f.reads, 2);
+  } finally {
+    await f.close();
+  }
+});
+test('quota admission is atomic under concurrent jobs and identical content shares bytes across sessions', async () => {
+  const f = await fixture({ sessionBytes: PNG.length, workspaceBytes: PNG.length });
+  try {
+    const source = join(f.root, 'same.png');
+    await writeFile(source, PNG);
+    observe(f.service, source);
+    observe(f.service, source, 'session-2');
+    await f.service.waitForIdle();
+    const a = await f.service.resolve({ ...REQUEST, source });
+    const b = await f.service.resolve({ ...REQUEST, sessionId: 'session-2', source });
+    assert.equal(a.status, 'ready');
+    assert.equal(b.status, 'ready');
+    if (a.status !== 'ready' || b.status !== 'ready') return;
+    const ra = (await f.authority.store.getInSession('session-1', a.artifactId)).record!;
+    const rb = (await f.authority.store.getInSession('session-2', b.artifactId)).record!;
+    assert.equal(
+      (await stat(join(f.root, 'artifacts', ra.relativePath))).ino,
+      (await stat(join(f.root, 'artifacts', rb.relativePath))).ino,
+    );
+    const different = join(f.root, 'different.png');
+    await writeFile(different, Buffer.concat([PNG, Buffer.from('different')]));
+    observe(f.service, different, 'session-1', 'message-2');
+    await f.service.waitForIdle();
+    assert.deepEqual(
+      await f.service.resolve({ ...REQUEST, source: different, messageId: 'message-2' }),
+      { status: 'failed', reason: 'quota_exceeded' },
+    );
+    await f.authority.store.purgeSessionArtifacts('session-1');
+    assert.equal((await f.authority.store.readBinaryInSession('session-2', b.artifactId)).ok, true);
+    assert.deepEqual(f.errors, []);
+  } finally {
+    await f.close();
+  }
+});
+test('copying a conversation carries delivery provenance and saved bytes; it does not read the original source', async () => {
+  const f = await fixture();
+  try {
+    const source = join(f.root, 'original.png');
+    await writeFile(source, PNG);
+    observe(f.service, source);
+    await f.service.waitForIdle();
+    await rm(source);
+    await f.authority.store.copyConversationArtifacts({
+      sourceSessionId: 'session-1',
+      targetSessionId: 'session-copy',
+      turnIds: ['turn-1'],
+    });
+    const original = await f.service.resolve({ ...REQUEST, source });
+    const copied = await f.service.resolve({ ...REQUEST, sessionId: 'session-copy', source });
+    assert.equal(copied.status, 'ready');
+    if (copied.status === 'ready' && original.status === 'ready') {
+      const sourceRecord = (await f.authority.store.getInSession('session-1', original.artifactId))
+        .record!;
+      const targetRecord = (await f.authority.store.getInSession('session-copy', copied.artifactId))
+        .record!;
+      assert.equal(
+        (await stat(join(f.root, 'artifacts', sourceRecord.relativePath))).ino,
+        (await stat(join(f.root, 'artifacts', targetRecord.relativePath))).ino,
+      );
+      await f.authority.store.purgeSessionArtifacts('session-1');
+      assert.equal(
+        (await f.authority.store.readBinaryInSession('session-copy', copied.artifactId)).ok,
+        true,
+      );
+    }
+    assert.equal(f.reads, 1);
+  } finally {
+    await f.close();
+  }
+});
+test('source readers reject oversized payloads, unsafe MIME and redirects to private networks', async () => {
+  assert.throws(() => checkedChatImage(Buffer.alloc(2 * 1024 * 1024 + 1)), /too_large/);
+  assert.throws(() => checkedChatImage(Buffer.from('<svg/>')), /unsupported_mime/);
+  const server = createServer((_req, res) => {
+    res.writeHead(302, { location: 'http://169.254.169.254/latest/meta-data/' });
+    res.end();
+  });
+  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+  try {
+    const source = `http://127.0.0.1:${(server.address() as import('node:net').AddressInfo).port}/redirect`;
+    await assert.rejects(downloadChatImage(source, AbortSignal.timeout(2000)), /not_allowed/);
+  } finally {
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+  }
+});
+test('resolver codec rejects excess fields and noncanonical artifact identities', () => {
+  const spec = IMAGE_DELIVERY_OPERATION_SPECS['artifact.image.resolve'];
+  assert.deepEqual(spec.decodeInput(REQUEST), REQUEST);
+  assert.throws(() => spec.decodeInput({ ...REQUEST, arbitraryRead: true }));
+  assert.throws(() => spec.decodeOutput({ status: 'ready', artifactId: '../private' }));
+});
+
+test('completed turns release unfinished stream slots without archiving partial messages', async () => {
+  const f = await fixture();
+  try {
+    for (let i = 0; i < 40; i++) {
+      f.service.observe('session-1', {
+        type: 'text_delta',
+        id: `delta-${i}`,
+        turnId: `turn-${i}`,
+        ts: 1,
+        messageId: `partial-${i}`,
+        text: '![partial](/tmp/missing.png)',
+      });
+      f.service.observe('session-1', {
+        type: 'complete',
+        id: `complete-${i}`,
+        turnId: `turn-${i}`,
+        ts: 2,
+        stopReason: 'end_turn',
+      });
+    }
+    const source = join(f.root, 'final.png');
+    await writeFile(source, PNG);
+    observe(f.service, source);
+    await f.service.waitForIdle();
+    assert.equal(f.reads, 1);
+    assert.equal((await f.service.resolve({ ...REQUEST, source })).status, 'ready');
+  } finally {
+    await f.close();
+  }
+});
diff --git a/packages/runtime-host/src/__tests__/execution-artifacts.test.ts b/packages/runtime-host/src/__tests__/execution-artifacts.test.ts
index b253ed09744..dc60f3bc48a 100644
--- a/packages/runtime-host/src/__tests__/execution-artifacts.test.ts
+++ b/packages/runtime-host/src/__tests__/execution-artifacts.test.ts
@@ -39,6 +39,9 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { test } from 'node:test';
 import { MAX_ATTACHMENT_BYTES } from '@maka/core/attachments';
+import { parseAttachmentResourceRef } from '@maka/core/attachments';
+import { ARTIFACT_IMAGE_PREVIEW_MAX_BYTES } from '@maka/core/artifacts';
+import { buildBuiltinTools } from '@maka/runtime/builtin-tools';
 import {
   openInteractiveArtifactStoreForWrite,
   createReadImageSnapshotPlanner,
@@ -54,6 +57,96 @@ import { createHostExecutionArtifactServices } from '../server/execution-artifac
 import { restoreArtifactV1Shape } from './fixtures/artifact-v1.js';
 import { SessionAdmissionGate } from '../server/session-admission-gate.js';
 
+test('PublishImage delivers a temporary screenshot as a durable, session-scoped Markdown image', async () => {
+  const base = await mkdtemp(join(tmpdir(), 'maka-publish-image-'));
+  const owner = await tryAcquireInteractiveRootOwner(
+    await resolveStorageRoot({ path: join(base, 'state'), kind: 'interactive' }),
+  );
+  assert.ok(owner);
+  let store = await openInteractiveArtifactStoreForWrite(owner.lease);
+  try {
+    const png = Buffer.from(
+      'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8DwHwAFBQIAX8jx0gAAAABJRU5ErkJggg==',
+      'base64',
+    );
+    const screenshot = join(base, 'screenshot.png');
+    await writeFile(screenshot, png);
+    const services = createHostExecutionArtifactServices({
+      artifacts: store,
+      sessionAdmission: new SessionAdmissionGate(),
+      sessions: { probeSessionRemoval: async () => ({ kind: 'present' }) },
+      requestDrain: () => assert.fail('successful publication must not drain'),
+    });
+    const quotaServices = createHostExecutionArtifactServices({
+      artifacts: store,
+      sessionAdmission: new SessionAdmissionGate(),
+      sessions: { probeSessionRemoval: async () => ({ kind: 'present' }) },
+      imageArchiveLimits: { sessionBytes: 0, workspaceBytes: 0 },
+      requestDrain: () => assert.fail('quota rejection must not drain'),
+    });
+    await assert.rejects(
+      quotaServices.publishImage({
+        sessionId: 'session',
+        turnId: 'turn',
+        toolCallId: 'quota-call',
+        name: 'image.png',
+        mimeType: 'image/png',
+        bytes: png,
+      }),
+      /quota exceeded/,
+    );
+    const tool = buildBuiltinTools({ publishImage: services.publishImage }).find(
+      (tool) => tool.name === 'PublishImage',
+    );
+    assert.ok(tool);
+    const context = {
+      sessionId: 'session',
+      turnId: 'turn',
+      toolCallId: 'publish-call',
+      cwd: join(base, 'state'),
+      permissionMode: 'bypass' as const,
+      executionBoundary: { kind: 'bypass' as const, revision: 0 },
+      abortSignal: new AbortController().signal,
+      emitOutput() {},
+    };
+    const result = (await tool.impl({ path: screenshot }, context)) as {
+      published: boolean;
+      resource: string;
+      markdown: string;
+    };
+    assert.equal(result.published, true);
+    const ref = parseAttachmentResourceRef(result.resource);
+    assert.ok(ref);
+    assert.equal(result.markdown, `![screenshot.png](${result.resource})`);
+    const projection = encodeDurableToolResultOutput({ type: 'json', value: result }, 'session');
+    assert.deepEqual(durableProjectionToToolResultOutput(projection), {
+      type: 'json',
+      value: result,
+    });
+    await rm(screenshot);
+    store.close();
+    store = await openInteractiveArtifactStoreForWrite(owner.lease);
+    const bytes = await store.readBinaryInSession('session', ref.artifactId);
+    assert.equal(bytes.ok, true);
+    if (bytes.ok) assert.equal(bytes.base64, png.toString('base64'));
+    assert.equal((await store.readBinaryInSession('other', ref.artifactId)).ok, false);
+    await assert.rejects(
+      services.publishImage({
+        ...context,
+        name: 'oversized.png',
+        mimeType: 'image/png',
+        bytes: new Uint8Array(ARTIFACT_IMAGE_PREVIEW_MAX_BYTES + 1),
+      }),
+      /at most 2 MiB/,
+    );
+  } finally {
+    store.close();
+    await owner.close();
+    await rm(base, { recursive: true, force: true });
+    await rm(owner.controlDirectory, { recursive: true, force: true });
+  }
+});
+
 for (const scenario of ['text', 'large raw MCP image', 'executor-sized Bash'] as const) {
   test(`production archives survive reopen (${scenario})`, async () => {
     const largeImage = scenario === 'large raw MCP image';
diff --git a/packages/runtime-host/src/__tests__/execution-composition.test.ts b/packages/runtime-host/src/__tests__/execution-composition.test.ts
index c41e34f2c6f..2aa42f27fbf 100644
--- a/packages/runtime-host/src/__tests__/execution-composition.test.ts
+++ b/packages/runtime-host/src/__tests__/execution-composition.test.ts
@@ -4423,3 +4423,101 @@ function routingDecisionForAction(
     candidateRef: action.proposal.candidateRef,
   };
 }
+
+test('production Host automatically archives assistant Markdown images and serves them after source deletion', async () => {
+  await withCompositionRoot(async ({ root, owner }) => {
+    const source = join(root, 'delivery.png');
+    const png = Buffer.from(
+      'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8DwHwAFBQIAX8jx0gAAAABJRU5ErkJggg==',
+      'base64',
+    );
+    await writeFile(source, png);
+    const captured = await createCapturedExecutionComposition(owner, {
+      primaryBackendFactory: (context) =>
+        new (class extends FakeBackend {
+          override async *send(input: BackendSendInput): AsyncIterable<SessionEvent> {
+            yield {
+              type: 'text_complete',
+              id: 'delivery-text-event',
+              turnId: input.turnId,
+              ts: Date.now(),
+              messageId: 'delivered-message',
+              text: `![Screenshot](<${source}>)`,
+            };
+            yield {
+              type: 'complete',
+              id: 'delivery-complete-event',
+              turnId: input.turnId,
+              ts: Date.now(),
+              stopReason: 'end_turn',
+            };
+          }
+        })(context),
+      context: {
+        retainUntilProcessExit: () => undefined,
+        requestDrain: () => assert.fail('image delivery must not drain Host'),
+      },
+    });
+    try {
+      const session = await captured.manager.createSession({
+        cwd: root,
+        llmConnectionId: FAKE_CONNECTION_ID,
+        llmConnectionSlug: 'fake',
+        model: 'fake-model',
+        permissionMode: 'bypass',
+      });
+      const context = {
+        hostEpoch: 'execution-composition-test',
+        connectionId: 'image-client',
+        principal: 'local_os_user',
+        acquireResidency: () => ({ release() {} }),
+      };
+      const started = await captured.composition.handlers['turn.start'](
+        {
+          sessionId: session.id,
+          turnId: 'image-delivery-turn',
+          content: { text: 'deliver screenshot' },
+        },
+        context,
+      );
+      assert.equal(started.ok, true, JSON.stringify(started));
+      const request = {
+        sessionId: session.id,
+        turnId: 'image-delivery-turn',
+        messageId: 'delivered-message',
+        source,
+      };
+      let artifactId: string | undefined;
+      await waitFor(async () => {
+        const result = await captured.composition.handlers['artifact.image.resolve'](
+          request,
+          context,
+        );
+        assert.equal(result.ok, true, JSON.stringify(result));
+        if (result.ok && result.result.status === 'ready') artifactId = result.result.artifactId;
+        return !!artifactId;
+      }, 5000);
+      await rm(source);
+      const replay = await captured.composition.handlers['artifact.image.resolve'](
+        request,
+        context,
+      );
+      assert.deepEqual(replay, { ok: true, result: { status: 'ready', artifactId } });
+      const binary = await captured.composition.handlers['artifact.query'](
+        { sessionId: session.id, kind: 'read_binary', artifactId: artifactId! },
+        context,
+      );
+      assert.equal(binary.ok, true, JSON.stringify(binary));
+      if (binary.ok && binary.result.kind === 'binary' && binary.result.preview.ok)
+        assert.equal(binary.result.preview.base64, png.toString('base64'));
+      const forged = await captured.composition.handlers['artifact.image.resolve'](
+        { ...request, source: '/tmp/private.png' },
+        context,
+      );
+      assert.deepEqual(forged, { ok: true, result: { status: 'unavailable' } });
+    } finally {
+      captured.composition.beginDrain();
+      await captured.composition.close();
+    }
+  });
+});
diff --git a/packages/runtime-host/src/protocol/artifact.ts b/packages/runtime-host/src/protocol/artifact.ts
index 08e45820c06..a5f2c254ce2 100644
--- a/packages/runtime-host/src/protocol/artifact.ts
+++ b/packages/runtime-host/src/protocol/artifact.ts
@@ -17,6 +17,7 @@
  * under the License.
  */
 
+import { IMAGE_DELIVERY_OPERATION_SPECS } from './image-delivery.js';
 import {
   ARTIFACT_KINDS,
   ARTIFACT_SOURCES,
@@ -184,6 +185,7 @@ export type ArtifactIngestResult =
   | { readonly kind: 'upload_aborted'; readonly uploadId: string };
 
 export const ARTIFACT_OPERATION_SPECS = {
+  ...IMAGE_DELIVERY_OPERATION_SPECS,
   'artifact.ingest': defineOperation<
     ArtifactIngestInput,
     ArtifactIngestResult,
diff --git a/packages/runtime-host/src/protocol/image-delivery.ts b/packages/runtime-host/src/protocol/image-delivery.ts
new file mode 100644
index 00000000000..7ac1d5a01e1
--- /dev/null
+++ b/packages/runtime-host/src/protocol/image-delivery.ts
@@ -0,0 +1,98 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import {
+  IMAGE_DELIVERY_FAILURES,
+  type ImageDeliveryRequest,
+  type ImageDeliveryResult,
+} from '@maka/core/image-delivery';
+import { isCanonicalArtifactEntityId } from '@maka/core/artifacts';
+import { requireExactRecord, requireEntityId, requireRecord } from './codec.js';
+import { invalidProtocolFrame } from './errors.js';
+import { defineOperation } from './operation-spec.js';
+export interface ResolveImageDeliveryInput extends ImageDeliveryRequest {
+  readonly sessionId: string;
+}
+export const IMAGE_DELIVERY_OPERATION_SPECS = {
+  'artifact.image.resolve': defineOperation<
+    ResolveImageDeliveryInput,
+    ImageDeliveryResult,
+    | 'host_not_ready'
+    | 'host_draining'
+    | 'operation_unavailable'
+    | 'invalid_request'
+    | 'not_found'
+    | 'internal_failure'
+  >({
+    mode: 'command',
+    availability: 'ready',
+    errors: [
+      'host_not_ready',
+      'host_draining',
+      'operation_unavailable',
+      'invalid_request',
+      'not_found',
+      'internal_failure',
+    ],
+    decodeInput(value) {
+      const v = requireExactRecord(value, 'image delivery request', [
+        'sessionId',
+        'turnId',
+        'messageId',
+        'source',
+        ...(Object.hasOwn(requireRecord(value, 'image delivery request'), 'retry')
+          ? ['retry']
+          : []),
+      ]);
+      const text = (s: unknown, max: number) => {
+        if (typeof s !== 'string' || !s.length || s.length > max || /[\u0000-\u001f\u007f]/.test(s))
+          throw invalidProtocolFrame('Invalid image delivery identity');
+        return s;
+      };
+      if (v.retry !== undefined && typeof v.retry !== 'boolean')
+        throw invalidProtocolFrame('Invalid image retry flag');
+      return {
+        sessionId: requireEntityId(v.sessionId, 'sessionId'),
+        turnId: text(v.turnId, 512),
+        messageId: text(v.messageId, 512),
+        source: text(v.source, 4096),
+        ...(v.retry === true ? { retry: true } : {}),
+      };
+    },
+    decodeOutput(value) {
+      const v = requireRecord(value, 'image delivery result');
+      if (v.status === 'pending' || v.status === 'unavailable') {
+        requireExactRecord(v, 'image delivery status', ['status']);
+        return { status: v.status };
+      }
+      if (v.status === 'ready' && isCanonicalArtifactEntityId(v.artifactId)) {
+        requireExactRecord(v, 'image delivery ready', ['status', 'artifactId']);
+        return { status: 'ready', artifactId: v.artifactId };
+      }
+      if (v.status === 'failed' && IMAGE_DELIVERY_FAILURES.includes(v.reason as never)) {
+        requireExactRecord(v, 'image delivery failure', ['status', 'reason']);
+        return {
+          status: 'failed',
+          reason: v.reason as Extract<ImageDeliveryResult, { status: 'failed' }>['reason'],
+        };
+      }
+      throw invalidProtocolFrame('Invalid image delivery result');
+    },
+  }),
+} as const;
diff --git a/packages/runtime-host/src/protocol/index.ts b/packages/runtime-host/src/protocol/index.ts
index 15b58eaf661..f4ba38b55e1 100644
--- a/packages/runtime-host/src/protocol/index.ts
+++ b/packages/runtime-host/src/protocol/index.ts
@@ -104,7 +104,8 @@ export const RUNTIME_HOST_REGISTRATION_SCHEMA_VERSION = 1 as const;
 export const RUNTIME_HOST_PROTOCOL_VERSION = 0 as const;
 // Increment when the same protocol version no longer guarantees safe Client-Host
 // interoperability. Mismatches are rejected before domain commands are admitted.
-export const RUNTIME_HOST_COMPATIBILITY_EPOCH = 212 as const;
+export const RUNTIME_HOST_COMPATIBILITY_EPOCH = 213 as const;
+// 213: Add assistant image delivery resolution and bounded automatic archival.
 // 212: Session catalogs carry `backgroundActivity` and `backgroundActivityVersion`
 // for Host-owned activity and generation-scoped ordering independent of Session
 // revisions and Turn epochs. Older closed decoders reject these fields.
diff --git a/packages/runtime-host/src/protocol/operations.ts b/packages/runtime-host/src/protocol/operations.ts
index fba841c427c..1f500dfca4d 100644
--- a/packages/runtime-host/src/protocol/operations.ts
+++ b/packages/runtime-host/src/protocol/operations.ts
@@ -262,6 +262,7 @@ export const REMOTE_OWNER_OPERATION_GRANTS = Object.freeze([
   'agent.graph.stop',
   'artifact.delete',
   'artifact.ingest',
+  'artifact.image.resolve',
   'artifact.query',
   'client.capability.replace',
   'client.capability.unregister',
diff --git a/packages/runtime-host/src/server/artifact-coordinator.ts b/packages/runtime-host/src/server/artifact-coordinator.ts
index f58585b6b23..ea8e5468605 100644
--- a/packages/runtime-host/src/server/artifact-coordinator.ts
+++ b/packages/runtime-host/src/server/artifact-coordinator.ts
@@ -17,6 +17,7 @@
  * under the License.
  */
 
+import type { ChatImageDeliveryService } from './chat-image-delivery.js';
 import { JsonArrayPageBudget } from './json-array-page-budget.js';
 
 import { createHash } from 'node:crypto';
@@ -63,6 +64,13 @@ interface ArtifactUploadMetadata {
 /** Session-scoped Host projection and deletion authority for Artifacts. */
 export class HostArtifactCoordinator {
   readonly handlers: ArtifactOperationHandlerMap = {
+    'artifact.image.resolve': async (input, context) => {
+      if (context.principalKind === 'session_guest' || !this.imageDelivery)
+        return { ok: true, result: { status: 'unavailable' } };
+      if ((await this.#sessions.probeSessionRemoval(input.sessionId)).kind !== 'present')
+        return { ok: false, error: { code: 'not_found', message: 'Session was not found' } };
+      return { ok: true, result: await this.imageDelivery.resolve(input) };
+    },
     'artifact.ingest': (input, context) =>
       this.#sessionAdmission.run(input.sessionId, () => this.#ingest(input, context)),
     'artifact.query': (input, context) =>
@@ -87,6 +95,7 @@ export class HostArtifactCoordinator {
     sessions: SessionPresenceReader,
     now: () => number = Date.now,
     sessionAccessAuthority?: Pick<RuntimeHostAccessAuthority, 'activeSessionGrant'>,
+    private readonly imageDelivery?: ChatImageDeliveryService,
   ) {
     this.#store = authenticateInteractiveArtifactStoreWriter(store);
     this.#requestDrain = requestDrain;
diff --git a/packages/runtime-host/src/server/chat-image-delivery.ts b/packages/runtime-host/src/server/chat-image-delivery.ts
new file mode 100644
index 00000000000..0fe5c2bd924
--- /dev/null
+++ b/packages/runtime-host/src/server/chat-image-delivery.ts
@@ -0,0 +1,339 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { createHash } from 'node:crypto';
+import type { CompleteEvent, TextCompleteEvent, TextDeltaEvent } from '@maka/core/events';
+import { foldAssistantDelta } from '@maka/core/events';
+import {
+  DEFAULT_IMAGE_ARCHIVE_LIMITS,
+  type ImageArchiveLimits,
+  type ImageDeliveryRequest,
+  type ImageDeliveryResult,
+  type ImageDeliveryFailure,
+} from '@maka/core/image-delivery';
+import {
+  ImageArchiveQuotaError,
+  type InteractiveArtifactStoreWriter,
+} from '@maka/storage/artifact-stores';
+import type { SessionAdmissionGate } from './session-admission-gate.js';
+import { chatImageSources } from './chat-image-markdown.js';
+import {
+  checkedChatImage,
+  downloadChatImage,
+  ImageSourceError,
+  localImagePath,
+  type ChatImageBytes,
+} from './chat-image-source.js';
+
+interface DeliveryIdentity extends ImageDeliveryRequest {
+  readonly sessionId: string;
+}
+interface DeliveryJob {
+  readonly identity: DeliveryIdentity;
+  readonly done: Promise<void>;
+  run(): Promise<void>;
+  cancel(): void;
+}
+export interface ChatImageDeliveryPorts {
+  readonly artifacts: Pick<
+    InteractiveArtifactStoreWriter,
+    'create' | 'findImageDelivery' | 'deleteOwnedArtifactInSession'
+  >;
+  readonly admission: SessionAdmissionGate;
+  isPresent(sessionId: string): Promise<boolean>;
+  readMessage(identity: DeliveryIdentity): Promise<string | undefined>;
+  readLocalImage(sessionId: string, path: string, signal: AbortSignal): Promise<ChatImageBytes>;
+  acquireResidency(): { release(): void };
+  persistenceFailed(error: unknown): void;
+  readonly limits?: ImageArchiveLimits;
+  readonly download?: typeof downloadChatImage;
+}
+/** Host owns capture and persistence; clients can only resolve sources already in an assistant message. */
+export class ChatImageDeliveryService {
+  readonly #jobs = new Map<string, DeliveryJob>();
+  readonly #queue: DeliveryJob[] = [];
+  readonly #streams = new Map<
+    string,
+    { turnId: string; text: string; seen: Set<string>; timer?: ReturnType<typeof setTimeout> }
+  >();
+  readonly #abort = new AbortController();
+  #running = 0;
+  #closed = false;
+  constructor(private readonly ports: ChatImageDeliveryPorts) {}
+
+  observe(sessionId: string, event: TextDeltaEvent | TextCompleteEvent | CompleteEvent): void {
+    if (this.#closed) return;
+    if (event.type === 'complete') {
+      for (const [key, stream] of this.#streams) {
+        if (key.startsWith(`${sessionId}\0`) && stream.turnId === event.turnId) {
+          clearTimeout(stream.timer);
+          this.#streams.delete(key);
+        }
+      }
+      return;
+    }
+    const key = `${sessionId}\0${event.messageId}`;
+    let stream = this.#streams.get(key);
+    if (!stream) {
+      if (this.#streams.size >= 32) return;
+      stream = { turnId: event.turnId, text: '', seen: new Set() };
+      this.#streams.set(key, stream);
+    }
+    if (event.type === 'text_complete') stream.text = event.text;
+    else {
+      const folded = foldAssistantDelta(stream.text.length, event);
+      if (!folded) return;
+      stream.text += folded.tail;
+    }
+    if (stream.text.length > 1024 * 1024) {
+      clearTimeout(stream.timer);
+      this.#streams.delete(key);
+      return;
+    }
+    const capture = () => {
+      stream!.timer = undefined;
+      for (const source of chatImageSources(stream!.text)) {
+        if (stream!.seen.has(source)) continue;
+        stream!.seen.add(source);
+        this.#enqueue({ sessionId, turnId: event.turnId, messageId: event.messageId, source });
+      }
+    };
+    if (event.type === 'text_complete') {
+      clearTimeout(stream.timer);
+      capture();
+      this.#streams.delete(key);
+    } else if (!stream.timer)
+      stream.timer = setTimeout(() => {
+        try {
+          capture();
+        } catch (error) {
+          if (!this.#closed) this.ports.persistenceFailed(error);
+        }
+      }, 250);
+  }
+
+  async resolve(identity: DeliveryIdentity): Promise<ImageDeliveryResult> {
+    if (this.#closed) return { status: 'unavailable' };
+    const record = await this.ports.artifacts.findImageDelivery(
+      identity.sessionId,
+      identity.turnId,
+      identity.messageId,
+      identity.source,
+    );
+    const metadata = record?.imageDelivery;
+    if (metadata?.status === 'ready') return { status: 'ready', artifactId: record!.id };
+    if (metadata?.status === 'failed' && !identity.retry)
+      return { status: 'failed', reason: metadata.reason! };
+    if (this.#jobs.has(deliveryKey(identity))) return { status: 'pending' };
+    // A client-provided path is never a read grant. Legacy/restarted deliveries
+    // must be found in canonical assistant text before any source is opened.
+    if (!metadata) {
+      const text = await this.ports.readMessage(identity);
+      if (text === undefined || !chatImageSources(text).includes(identity.source))
+        return { status: 'unavailable' };
+    }
+    if (metadata?.status === 'failed') {
+      await this.ports.admission.runOrJoin(identity.sessionId, () =>
+        this.ports.artifacts.deleteOwnedArtifactInSession(
+          identity.sessionId,
+          record!.id,
+          'tool_result_projection',
+        ),
+      );
+    }
+    return this.#enqueue(identity)
+      ? { status: 'pending' }
+      : { status: 'failed', reason: 'queue_full' };
+  }
+
+  #enqueue(identity: DeliveryIdentity): boolean {
+    const key = deliveryKey(identity);
+    if (this.#jobs.has(key)) return true;
+    if (this.#closed || this.#jobs.size >= 128) return false;
+    let settle!: () => void;
+    const done = new Promise<void>((resolve) => {
+      settle = resolve;
+    });
+    const residency = this.ports.acquireResidency();
+    const finish = () => {
+      this.#jobs.delete(key);
+      residency.release();
+      settle();
+    };
+    const job: DeliveryJob = {
+      identity,
+      done,
+      cancel: finish,
+      run: async () => {
+        try {
+          await this.#capture(identity);
+        } catch (error) {
+          if (!this.#abort.signal.aborted) this.ports.persistenceFailed(error);
+        } finally {
+          finish();
+        }
+      },
+    };
+    this.#jobs.set(key, job);
+    this.#queue.push(job);
+    this.#pump();
+    return true;
+  }
+  #pump(): void {
+    while (!this.#closed && this.#running < 2 && this.#queue.length) {
+      const job = this.#queue.shift()!;
+      this.#running++;
+      void job.run().finally(() => {
+        this.#running--;
+        this.#pump();
+      });
+    }
+  }
+  async #capture(identity: DeliveryIdentity): Promise<void> {
+    const { sessionId, turnId, messageId, source } = identity;
+    const existing = await this.ports.artifacts.findImageDelivery(
+      sessionId,
+      turnId,
+      messageId,
+      source,
+    );
+    if (existing?.imageDelivery?.status !== 'pending' && existing) return;
+    const metadata = { messageId, source };
+    const base = {
+      sessionId,
+      turnId,
+      name: 'chat-image',
+      source: 'tool_result_projection' as const,
+    };
+    const publish = async (input: Parameters<InteractiveArtifactStoreWriter['create']>[0]) =>
+      this.ports.admission.runOrJoin(sessionId, async () => {
+        if (this.#abort.signal.aborted || !(await this.ports.isPresent(sessionId))) return;
+        await this.ports.artifacts.create(input);
+      });
+    await publish({
+      ...base,
+      id: `chat_image_request_${deliveryKey(identity)}`,
+      kind: 'file',
+      content: '',
+      imageDelivery: { ...metadata, status: 'pending' },
+    });
+    if (this.#abort.signal.aborted || !(await this.ports.isPresent(sessionId))) return;
+    const signal = AbortSignal.any([this.#abort.signal, AbortSignal.timeout(10_000)]);
+    let image: ChatImageBytes;
+    try {
+      const path = localImagePath(source);
+      if (path !== undefined)
+        image = checkedChatImage((await this.ports.readLocalImage(sessionId, path, signal)).bytes);
+      else {
+        try {
+          image = await (this.ports.download ?? downloadChatImage)(source, signal);
+        } catch (error) {
+          if (
+            signal.aborted ||
+            (error instanceof ImageSourceError && error.reason !== 'download_failed')
+          )
+            throw error;
+          image = await (this.ports.download ?? downloadChatImage)(source, signal);
+        }
+      }
+    } catch (error) {
+      if (this.#abort.signal.aborted) return;
+      await publish({
+        ...base,
+        id: `chat_image_result_${deliveryKey(identity)}`,
+        kind: 'file',
+        content: '',
+        imageDelivery: { ...metadata, status: 'failed', reason: failureReason(error, source) },
+      });
+      return;
+    }
+    if (this.#abort.signal.aborted) return;
+    if (signal.aborted) {
+      await publish({
+        ...base,
+        id: `chat_image_result_${deliveryKey(identity)}`,
+        kind: 'file',
+        content: '',
+        imageDelivery: {
+          ...metadata,
+          status: 'failed',
+          reason: failureReason(signal.reason, source),
+        },
+      });
+      return;
+    }
+    try {
+      await publish({
+        ...base,
+        id: `chat_image_result_${deliveryKey(identity)}`,
+        kind: 'image',
+        content: image.bytes,
+        mimeType: image.mimeType,
+        imageDelivery: {
+          ...metadata,
+          status: 'ready',
+          contentSha256: createHash('sha256').update(image.bytes).digest('hex'),
+        },
+        imageArchiveLimits: this.ports.limits ?? DEFAULT_IMAGE_ARCHIVE_LIMITS,
+      });
+    } catch (error) {
+      if (!(error instanceof ImageArchiveQuotaError)) throw error;
+      await publish({
+        ...base,
+        id: `chat_image_result_${deliveryKey(identity)}`,
+        kind: 'file',
+        content: '',
+        imageDelivery: { ...metadata, status: 'failed', reason: 'quota_exceeded' },
+      });
+    }
+  }
+  beginDrain(): void {
+    this.#closed = true;
+    this.#abort.abort();
+    for (const stream of this.#streams.values()) clearTimeout(stream.timer);
+    this.#streams.clear();
+    for (const job of this.#queue.splice(0)) job.cancel();
+  }
+  async close(): Promise<void> {
+    this.beginDrain();
+    await this.waitForIdle();
+  }
+  async waitForIdle(): Promise<void> {
+    await Promise.all([...this.#jobs.values()].map((job) => job.done));
+  }
+}
+function deliveryKey(i: DeliveryIdentity): string {
+  return createHash('sha256')
+    .update(JSON.stringify([i.sessionId, i.turnId, i.messageId, i.source]))
+    .digest('hex');
+}
+function failureReason(error: unknown, source: string): ImageDeliveryFailure {
+  if (error instanceof ImageSourceError) return error.reason;
+  const code = (error as NodeJS.ErrnoException | undefined)?.code;
+  if (error instanceof Error && /supported raster|requires a PNG|not.*image/i.test(error.message))
+    return 'unsupported_mime';
+  if (code === 'ENOENT' || code === 'ENOTDIR') return 'not_found';
+  if (
+    code === 'EACCES' ||
+    code === 'EPERM' ||
+    (error instanceof Error && /sandbox|outside|permission/i.test(error.message))
+  )
+    return 'not_allowed';
+  return /^https?:/i.test(source) ? 'download_failed' : 'read_failed';
+}
diff --git a/packages/runtime-host/src/server/chat-image-markdown.ts b/packages/runtime-host/src/server/chat-image-markdown.ts
new file mode 100644
index 00000000000..0675689f675
--- /dev/null
+++ b/packages/runtime-host/src/server/chat-image-markdown.ts
@@ -0,0 +1,38 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { Marked } from 'marked';
+const parser = new Marked({ gfm: true });
+/** Parse actual Markdown nodes, excluding code, HTML and incomplete destinations. */
+export function chatImageSources(text: string): string[] {
+  if (!text.includes('![') || text.length > 1024 * 1024) return [];
+  const sources = new Set<string>();
+  parser.walkTokens(parser.lexer(text), (token) => {
+    if (token.type !== 'image') return;
+    const source = token.href;
+    if (
+      source.length > 0 &&
+      source.length <= 4096 &&
+      !/[\u0000-\u001f\u007f]/.test(source) &&
+      !source.startsWith('maka:')
+    )
+      sources.add(source);
+  });
+  return [...sources].slice(0, 64);
+}
diff --git a/packages/runtime-host/src/server/chat-image-source.ts b/packages/runtime-host/src/server/chat-image-source.ts
new file mode 100644
index 00000000000..ce271573ccb
--- /dev/null
+++ b/packages/runtime-host/src/server/chat-image-source.ts
@@ -0,0 +1,157 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { lookup } from 'node:dns/promises';
+import { request as httpRequest } from 'node:http';
+import { request as httpsRequest } from 'node:https';
+import { isIP } from 'node:net';
+import { fileURLToPath } from 'node:url';
+import { sniffAttachmentMimeType } from '@maka/core/attachments';
+import {
+  ARTIFACT_IMAGE_PREVIEW_MAX_BYTES,
+  normalizeArtifactImagePreviewMime,
+} from '@maka/core/artifacts';
+import type { ImageDeliveryFailure } from '@maka/core/image-delivery';
+export class ImageSourceError extends Error {
+  constructor(readonly reason: ImageDeliveryFailure) {
+    super(reason);
+  }
+}
+export interface ChatImageBytes {
+  readonly bytes: Uint8Array;
+  readonly mimeType: string;
+}
+export function checkedChatImage(bytes: Uint8Array): ChatImageBytes {
+  if (bytes.byteLength > ARTIFACT_IMAGE_PREVIEW_MAX_BYTES) throw new ImageSourceError('too_large');
+  const mimeType = sniffAttachmentMimeType(bytes);
+  if (
+    !mimeType ||
+    !normalizeArtifactImagePreviewMime(mimeType) ||
+    !['image/png', 'image/jpeg', 'image/webp', 'image/gif'].includes(mimeType)
+  )
+    throw new ImageSourceError('unsupported_mime');
+  return { bytes, mimeType };
+}
+export function localImagePath(source: string): string | undefined {
+  if (/^https?:/i.test(source)) return undefined;
+  if (source.startsWith('file:')) {
+    try {
+      return fileURLToPath(source);
+    } catch {
+      throw new ImageSourceError('not_allowed');
+    }
+  }
+  if (/^[a-z][a-z0-9+.-]*:/i.test(source) && !/^[a-z]:[\\/]/i.test(source))
+    throw new ImageSourceError('not_allowed');
+  return source;
+}
+/** Pin DNS at connection time and check each redirect; never send cookies, auth or referer. */
+export async function downloadChatImage(
+  source: string,
+  signal: AbortSignal,
+): Promise<ChatImageBytes> {
+  let url = new URL(source);
+  for (let redirect = 0; redirect <= 3; redirect++) {
+    signal.throwIfAborted();
+    if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password)
+      throw new ImageSourceError('not_allowed');
+    const host = url.hostname.replace(/^\[|\]$/g, '');
+    // Literal loopback supports images served by this execution Host. Other private
+    // networks and DNS names resolving to them are never automatically fetched.
+    const literalLoopback = host === '127.0.0.1' || host === '::1';
+    const addresses = isIP(host)
+      ? [{ address: host, family: isIP(host) }]
+      : await abortableLookup(host, signal);
+    if (!addresses.length || (!literalLoopback && addresses.some((a) => !publicAddress(a.address))))
+      throw new ImageSourceError('not_allowed');
+    const target = addresses[0]!;
+    const response = await new Promise<import('node:http').IncomingMessage>((resolve, reject) => {
+      const req = (url.protocol === 'https:' ? httpsRequest : httpRequest)(
+        url,
+        {
+          signal,
+          headers: { accept: 'image/png,image/jpeg,image/webp,image/gif' },
+          lookup: (_host, options, callback) =>
+            options.all ? callback(null, [target]) : callback(null, target.address, target.family),
+        },
+        resolve,
+      );
+      req.on('error', reject);
+      req.end();
+    });
+    if ([301, 302, 303, 307, 308].includes(response.statusCode ?? 0) && response.headers.location) {
+      response.destroy();
+      const next = new URL(response.headers.location, url);
+      if (url.protocol === 'https:' && next.protocol !== 'https:')
+        throw new ImageSourceError('not_allowed');
+      url = next;
+      continue;
+    }
+    if (response.statusCode !== 200) {
+      response.destroy();
+      throw new ImageSourceError('download_failed');
+    }
+    const length = Number(response.headers['content-length']);
+    if (length > ARTIFACT_IMAGE_PREVIEW_MAX_BYTES) {
+      response.destroy();
+      throw new ImageSourceError('too_large');
+    }
+    const chunks: Buffer[] = [];
+    let size = 0;
+    for await (const chunk of response) {
+      size += chunk.length;
+      if (size > ARTIFACT_IMAGE_PREVIEW_MAX_BYTES) {
+        response.destroy();
+        throw new ImageSourceError('too_large');
+      }
+      chunks.push(Buffer.from(chunk));
+    }
+    return checkedChatImage(Buffer.concat(chunks, size));
+  }
+  throw new ImageSourceError('download_failed');
+}
+function publicAddress(address: string): boolean {
+  if (isIP(address) === 4) {
+    const [a = 0, b = 0] = address.split('.').map(Number);
+    return (
+      a > 0 &&
+      a !== 10 &&
+      a !== 127 &&
+      a < 224 &&
+      !(a === 169 && b === 254) &&
+      !(a === 172 && b >= 16 && b <= 31) &&
+      !(a === 192 && b === 168) &&
+      !(a === 100 && b >= 64 && b <= 127) &&
+      !(a === 198 && (b === 18 || b === 19))
+    );
+  }
+  // Only global-unicast IPv6 is eligible. Mapped IPv4/ULA/link-local are excluded.
+  return /^[23][0-9a-f]{3}:/i.test(address);
+}
+
+function abortableLookup(host: string, signal: AbortSignal) {
+  signal.throwIfAborted();
+  return new Promise<import('node:dns').LookupAddress[]>((resolve, reject) => {
+    const abort = () => reject(signal.reason);
+    signal.addEventListener('abort', abort, { once: true });
+    void lookup(host, { all: true })
+      .then(resolve, reject)
+      .finally(() => signal.removeEventListener('abort', abort));
+  });
+}
diff --git a/packages/runtime-host/src/server/execution-artifacts.ts b/packages/runtime-host/src/server/execution-artifacts.ts
index 9e63f59e940..9dc11f953e2 100644
--- a/packages/runtime-host/src/server/execution-artifacts.ts
+++ b/packages/runtime-host/src/server/execution-artifacts.ts
@@ -17,10 +17,16 @@
  * under the License.
  */
 
+import { DEFAULT_IMAGE_ARCHIVE_LIMITS } from '@maka/core/image-delivery';
 import { createHash } from 'node:crypto';
 import { open, realpath, stat } from 'node:fs/promises';
 import { isAbsolute, resolve } from 'node:path';
 import { MAX_ATTACHMENT_BYTES } from '@maka/core/attachments';
+import {
+  ARTIFACT_IMAGE_PREVIEW_MAX_BYTES,
+  normalizeArtifactImagePreviewMime,
+} from '@maka/core/artifacts';
+import type { BuildBuiltinToolsOptions } from '@maka/runtime/builtin-tools';
 import {
   createToolResultArchiveCapability,
   type ToolResultArchiveCapability,
@@ -35,13 +41,17 @@ import type { ToolResultArchiveEvidenceReader } from '@maka/core/tool-result-arc
 import { type ToolArtifactRecorderInput } from '@maka/runtime/tool-artifacts';
 import type { ToolResultArchiveReaderInput } from '@maka/runtime/context-budget';
 import { type ToolResultArchiveResourceReadInput } from '@maka/runtime/tool-result-archive-resource';
-import type { InteractiveArtifactStoreWriter } from '@maka/storage/artifact-stores';
+import {
+  ImageArchiveQuotaError,
+  type InteractiveArtifactStoreWriter,
+} from '@maka/storage/artifact-stores';
 import type { SessionManagerDeps } from '@maka/runtime/session-manager';
 import type { SessionAdmissionGate } from './session-admission-gate.js';
 import type { SessionPresenceReader } from './session-presence.js';
 
 export interface HostExecutionArtifactServices {
   recordToolArtifacts(event: ToolArtifactRecorderInput): Promise<void>;
+  publishImage: NonNullable<BuildBuiltinToolsOptions['publishImage']>;
   publishChildWorkspacePatch: NonNullable<SessionManagerDeps['publishChildWorkspacePatch']>;
   /**
    * New archives use the Session ledger. Legacy Artifact refs are retained as
@@ -56,12 +66,13 @@ export function createHostExecutionArtifactServices(input: {
   sessionAdmission: SessionAdmissionGate;
   sessions: SessionPresenceReader;
   archiveEvidence?: ToolResultArchiveEvidenceReader;
+  imageArchiveLimits?: import('@maka/core/image-delivery').ImageArchiveLimits;
 }): HostExecutionArtifactServices {
   const runWrite = async <T>(operation: () => Promise<T>): Promise<T> => {
     try {
       return await operation();
     } catch (error) {
-      input.requestDrain();
+      if (!(error instanceof ImageArchiveQuotaError)) input.requestDrain();
       throw error;
     }
   };
@@ -118,6 +129,37 @@ export function createHostExecutionArtifactServices(input: {
   };
   const services: HostExecutionArtifactServices = {
     recordToolArtifacts,
+    publishImage: async (image) => {
+      const mimeType = normalizeArtifactImagePreviewMime(image.mimeType);
+      if (!mimeType || image.bytes.byteLength > ARTIFACT_IMAGE_PREVIEW_MAX_BYTES)
+        throw new Error(
+          'Image cannot be displayed in chat; use a PNG/JPEG/GIF/WebP of at most 2 MiB.',
+        );
+      const id = `published_image_${createHash('sha256')
+        .update(JSON.stringify([image.sessionId, image.turnId, image.toolCallId]))
+        .digest('hex')}`;
+      const artifact = await publish({
+        id,
+        sessionId: image.sessionId,
+        turnId: image.turnId,
+        name: image.name,
+        kind: 'image',
+        content: image.bytes,
+        mimeType,
+        source: 'tool_result_projection',
+        summary: 'Published chat image',
+        imageDelivery: {
+          messageId: image.toolCallId,
+          source: `published:${image.toolCallId}`,
+          status: 'ready',
+          contentSha256: createHash('sha256').update(image.bytes).digest('hex'),
+        },
+        imageArchiveLimits: input.imageArchiveLimits ?? DEFAULT_IMAGE_ARCHIVE_LIMITS,
+      });
+      if (!artifact)
+        throw new Error('The session was removed before the image could be published.');
+      return { kind: 'session_file', sessionId: image.sessionId, relativePath: artifact.id };
+    },
     publishChildWorkspacePatch: async ({ sessionId, turnId, binding, patch }) => {
       const artifact = await publish({
         id: subagentWritebackArtifactId(sessionId, turnId),
diff --git a/packages/runtime-host/src/server/execution-composition.ts b/packages/runtime-host/src/server/execution-composition.ts
index 82a82fd1422..cfd2b0e4b62 100644
--- a/packages/runtime-host/src/server/execution-composition.ts
+++ b/packages/runtime-host/src/server/execution-composition.ts
@@ -17,6 +17,9 @@
  * under the License.
  */
 
+import { createImageFileReader } from '@maka/runtime/image-file-reader';
+import { ChatImageDeliveryService } from './chat-image-delivery.js';
+import { checkedChatImage } from './chat-image-source.js';
 import { createWorkHubResultRuntime } from './workhub-result-runtime.js';
 import { createWorkHubInspectionTool } from './workhub-inspection-tool.js';
 import { createJevRoutingModel } from './jev-routing-model.js';
@@ -312,6 +315,7 @@ export interface CreateExecutionRuntimeHostCompositionOptions {
   readonly bootstrapRuntimePolicy?: boolean;
   readonly skillHomeDirectory?: string;
   readonly projectDirectoryRoots?: readonly PublishedProjectDirectoryRoot[];
+  readonly imageArchiveLimits?: import('@maka/core/image-delivery').ImageArchiveLimits;
 }
 
 export interface ExecutionRuntimeHostCompositionDependencies {
@@ -364,6 +368,7 @@ export async function createExecutionRuntimeHostComposition(
   let sessionEffects: HostSessionEffectCoordinator | undefined;
   let promptSuggestions: HostPromptSuggestionCoordinator | undefined;
   let memoryExtraction: HostMemoryExtractionCoordinator | undefined;
+  let imageDelivery: ChatImageDeliveryService | undefined;
   let unsubscribeTranscriptChanges: (() => void) | undefined;
   let unsubscribeRuntimeEventCommits: (() => void) | undefined;
   let transcriptReader: SessionTranscriptReader | undefined;
@@ -566,18 +571,95 @@ export async function createExecutionRuntimeHostComposition(
     });
     archiveEvidence = await openToolResultArchiveEvidenceReader(context.owner.lease);
     const executionArtifacts = createHostExecutionArtifactServices({
+      ...(options.imageArchiveLimits ? { imageArchiveLimits: options.imageArchiveLimits } : {}),
       archiveEvidence,
       artifacts: openedArtifactStore,
       requestDrain: context.requestDrain,
       sessionAdmission,
       sessions: stores.sessionStore,
     });
+    const localImageReader = createImageFileReader({
+      ...(filesystemWorker ? { filesystemWorker } : {}),
+    });
+    imageDelivery = new ChatImageDeliveryService({
+      artifacts: openedArtifactStore,
+      ...(options.imageArchiveLimits ? { limits: options.imageArchiveLimits } : {}),
+      admission: sessionAdmission,
+      isPresent: async (sessionId) =>
+        (await stores.sessionStore.probeSessionRemoval(sessionId)).kind === 'present',
+      acquireResidency: () => context.acquireResidency('chat-image-delivery'),
+      persistenceFailed: (error) => {
+        console.warn('[runtime-host] Image delivery persistence failed', error);
+        context.requestDrain();
+      },
+      readLocalImage: async (sessionId, path, abortSignal) => {
+        const [header, boundary] = await Promise.all([
+          stores.sessionStore.readHeaderSnapshot(sessionId),
+          stores.sessionStore.readExecutionBoundary(sessionId),
+        ]);
+        const result = await localImageReader({
+          path,
+          cwd: header.cwd,
+          permissionMode: header.permissionMode,
+          executionBoundary: boundary,
+          abortSignal,
+        });
+        return checkedChatImage(result.bytes);
+      },
+      readMessage: async (identity) => {
+        await requireSessionManager(manager).ensureTranscriptLedgerForRead(identity.sessionId);
+        const [turn] = await stores.runtimeEventStore.readTranscriptTurns(identity.sessionId, {
+          turnId: identity.turnId,
+        });
+        if (!turn) return undefined;
+        for (
+          let position = turn.firstOrdinal, runs = 0;
+          position <= turn.lastOrdinal && runs < 16;
+          runs++
+        ) {
+          const found = await stores.runtimeEventStore.readTranscriptRun(
+            identity.sessionId,
+            {
+              direction: 'newer',
+              throughOrdinal: turn.lastOrdinal,
+              position,
+              maxEvents: 4096,
+              maxBytes: 16 * 1024 * 1024,
+              maxRecordBytes: 8 * 1024 * 1024,
+            },
+            (run, events) => {
+              let text: string | undefined;
+              for (const { event } of events) {
+                if (
+                  event.partial ||
+                  event.turnId !== identity.turnId ||
+                  event.role !== 'model' ||
+                  event.content?.kind !== 'text'
+                )
+                  continue;
+                if (
+                  (event.refs?.storedMessageId ?? event.refs?.providerEventId ?? event.id) ===
+                  identity.messageId
+                )
+                  text = event.content.text;
+              }
+              return { text, next: run.lastOrdinal + 1 };
+            },
+          );
+          if (!found) break;
+          if (found.text !== undefined) return found.text;
+          position = found.next;
+        }
+        return undefined;
+      },
+    });
     // Shared with recall's material fetch, so a file brought in from another
     // Session is answered by the same reader that answers one stored here.
     const attachmentResources = createArtifactAttachmentResourceReader({
       artifactStore: openedArtifactStore,
     });
     const builtinTools = {
+      publishImage: executionArtifacts.publishImage,
       shellRuns: runtimeResources,
       runtimeResources,
       attachmentResources,
@@ -1774,6 +1856,7 @@ export async function createExecutionRuntimeHostComposition(
       stores.sessionStore,
       Date.now,
       context.sessionAccessAuthority,
+      imageDelivery,
     );
     rootCoordinator = new RootTurnCoordinator(
       manager,
@@ -1852,6 +1935,7 @@ export async function createExecutionRuntimeHostComposition(
           return undefined;
         }
       },
+      (sessionId, event) => imageDelivery?.observe(sessionId, event),
     );
     const coordinator = rootCoordinator;
     const pluginModel = createHostPluginModel({
@@ -3135,6 +3219,7 @@ export async function createExecutionRuntimeHostComposition(
           () => workspaceExecution?.beginDrain(),
           () => runtimeResources?.beginDrain(),
           () => messages.beginDrain(),
+          () => imageDelivery?.beginDrain(),
           () => interactions.beginDrain(),
           () => sessionEffects?.beginDrain(),
           () => promptSuggestions?.beginDrain(),
@@ -3147,6 +3232,7 @@ export async function createExecutionRuntimeHostComposition(
             await rootCloseTask;
           },
           () => workHubResults?.coordinator.close(),
+          () => imageDelivery?.close(),
           () => runtimeResources?.close(),
           () => workspaceExecution?.close(),
           () => sessionEffects?.close(),
@@ -3329,6 +3415,7 @@ export async function createExecutionRuntimeHostComposition(
     }
     goalExecutions?.beginDrain();
     try {
+      await imageDelivery?.close();
       await workspaceExecution?.close();
     } catch (closeError) {
       errors.push(closeError);
diff --git a/packages/runtime-host/src/server/root-turn-coordinator.ts b/packages/runtime-host/src/server/root-turn-coordinator.ts
index 1b3f59f4586..3c5bb04eff2 100644
--- a/packages/runtime-host/src/server/root-turn-coordinator.ts
+++ b/packages/runtime-host/src/server/root-turn-coordinator.ts
@@ -386,6 +386,13 @@ export class RootTurnCoordinator implements HostedExecutionAuthority {
     private readonly prepareWorkHubRoutingDecision?: (
       input: HostWorkHubRoutingDecisionPreparation,
     ) => Promise<WorkHubRoutingDecision | undefined>,
+    private readonly observeAssistantText?: (
+      sessionId: string,
+      event:
+        | import('@maka/core/events').TextDeltaEvent
+        | import('@maka/core/events').TextCompleteEvent
+        | import('@maka/core/events').CompleteEvent,
+    ) => void,
   ) {
     this.stores = authenticateExecutionStoresWriter(stores, 'interactive');
     this.executionProjection = new HostedExecutionProjectionReader(this.stores);
@@ -3085,6 +3092,17 @@ export class RootTurnCoordinator implements HostedExecutionAuthority {
               // Presentation observers do not participate in execution authority.
             }
           }
+          if (
+            event.type === 'text_delta' ||
+            event.type === 'text_complete' ||
+            event.type === 'complete'
+          ) {
+            try {
+              this.observeAssistantText?.(input.sessionId, event);
+            } catch {
+              // Image presentation must never interrupt canonical execution.
+            }
+          }
           if (isRuntimeSessionForwardedEvent(event)) {
             await this.continuity.acceptRuntimeEvent(input.sessionId, active.runId, event);
           } else if (isInteractionAnswerAck(event)) {
diff --git a/packages/runtime/package.json b/packages/runtime/package.json
index 0367cf3a1df..3c4841a2dfd 100644
--- a/packages/runtime/package.json
+++ b/packages/runtime/package.json
@@ -11,6 +11,7 @@
     "./ai-sdk-backend": "./dist/ai-sdk-backend.js",
     "./mcp-tools": "./dist/mcp-tools.js",
     "./read-page": "./dist/read-page.js",
+    "./image-file-reader": "./dist/image-file-reader.js",
     "./builtin-tools": "./dist/builtin-tools.js",
     "./shell-tools": "./dist/shell-tools.js",
     "./shell-run-manager": "./dist/shell-run-manager.js",
diff --git a/packages/runtime/src/__tests__/builtin-tools-file-worker.test.ts b/packages/runtime/src/__tests__/builtin-tools-file-worker.test.ts
index 23ffb578401..cd8793c884b 100644
--- a/packages/runtime/src/__tests__/builtin-tools-file-worker.test.ts
+++ b/packages/runtime/src/__tests__/builtin-tools-file-worker.test.ts
@@ -26,6 +26,7 @@ import { createManagedExecutionBoundary } from '@maka/core/sandbox-boundary';
 import { createWorkspaceWritePermissionProfile } from '@maka/core/permission-profile';
 import { createReadOnlyPermissionProfile } from '@maka/core/permission-profile';
 
+import { createImageFileReader } from '../image-file-reader.js';
 import { buildBuiltinTools } from '../builtin-tools.js';
 import { createBoundaryFilesystemExecutor } from '../filesystem-executor.js';
 import { createLocalWorkspaceExecutor } from '../workspace-executor.js';
@@ -41,6 +42,42 @@ afterEach(async () => {
 });
 
 describe('builtin file tools use the sandboxed worker', () => {
+  test('PublishImage never publishes when the image read is refused or invalid', async () => {
+    const cwd = await temporaryDirectory('maka-publish-image-admission-');
+    let published = 0;
+    const tools = buildBuiltinTools({
+      publishImage: async () => {
+        published++;
+        return { kind: 'session_file', sessionId: 'session-1', relativePath: 'image-1' };
+      },
+    });
+    // The same managed boundary as Read: no fallback to an unsandboxed host read.
+    await assert.rejects(
+      runTool(tools, 'PublishImage', { path: 'private.png' }, cwd),
+      /worker|sandbox/i,
+    );
+    assert.equal(published, 0);
+    await writeFile(join(cwd, 'text.txt'), 'not an image');
+    const tool = tools.find((tool) => tool.name === 'PublishImage')!;
+    await assert.rejects(
+      async () =>
+        tool.impl(
+          { path: 'text.txt' },
+          {
+            sessionId: 'session-1',
+            turnId: 'turn-1',
+            toolCallId: 'publish',
+            cwd,
+            permissionMode: 'bypass',
+            executionBoundary: { kind: 'bypass', revision: 0 },
+            abortSignal: new AbortController().signal,
+            emitOutput() {},
+          },
+        ),
+      /requires a PNG/,
+    );
+    assert.equal(published, 0);
+  });
   test('direct Read rejects invalid coordinates before selecting any backend', async () => {
     const cwd = await temporaryDirectory('maka-read-coordinates-');
     await writeFile(join(cwd, 'sample.txt'), 'one\ntwo\nthree');
@@ -613,3 +650,28 @@ async function temporaryDirectory(prefix: string): Promise<string> {
   cleanup.push(path);
   return await realpath(path);
 }
+
+test('chat image reader uses the managed Read boundary and never falls back to host filesystem', async () => {
+  const cwd = await temporaryDirectory('maka-delivery-reader-');
+  const executionBoundary = createManagedExecutionBoundary(createReadOnlyPermissionProfile(), 0);
+  await assert.rejects(
+    createImageFileReader()({ path: 'private.png', cwd, executionBoundary }),
+    /worker|sandbox/i,
+  );
+  let calls = 0;
+  const reader = createImageFileReader({
+    filesystemWorker: {
+      execute: async (input) => {
+        calls++;
+        assert.deepEqual(input.executionBoundary, executionBoundary);
+        assert.deepEqual(input.operation, { kind: 'read', path: 'private.png' });
+        throw new Error('sandbox permission refused');
+      },
+    },
+  });
+  await assert.rejects(
+    reader({ path: 'private.png', cwd, executionBoundary }),
+    /permission refused/,
+  );
+  assert.equal(calls, 1);
+});
diff --git a/packages/runtime/src/__tests__/tool-availability.test.ts b/packages/runtime/src/__tests__/tool-availability.test.ts
index 6c343410e69..4002b1a57bd 100644
--- a/packages/runtime/src/__tests__/tool-availability.test.ts
+++ b/packages/runtime/src/__tests__/tool-availability.test.ts
@@ -124,13 +124,15 @@ describe('ToolAvailabilityRuntime — search activation', () => {
 
   test('a group cannot defer the fixed direct baseline', () => {
     const plan = new ToolAvailabilityRuntime(
-      [tool('Read'), tool('browser_click')],
-      { groups: [{ id: 'bad-source', toolNames: ['Read', 'browser_click'] }] },
+      [tool('Read'), tool('PublishImage'), tool('browser_click')],
+      { groups: [{ id: 'bad-source', toolNames: ['Read', 'PublishImage', 'browser_click'] }] },
       invalid,
     ).prepare(new Map());
     assert.ok(plan.activeTools.includes('Read'));
+    assert.ok(plan.activeTools.includes('PublishImage'));
     assert.ok(!plan.activeTools.includes('browser_click'));
     assert.doesNotMatch(searchTool(plan).description, /- Read/);
+    assert.doesNotMatch(searchTool(plan).description, /- PublishImage/);
   });
 
   test('skill discovery tools stay direct while search is enabled', () => {
diff --git a/packages/runtime/src/builtin-tools.ts b/packages/runtime/src/builtin-tools.ts
index df4d176468c..3ec9a9de73f 100644
--- a/packages/runtime/src/builtin-tools.ts
+++ b/packages/runtime/src/builtin-tools.ts
@@ -43,7 +43,11 @@ import {
 import { tmpdir } from 'node:os';
 import { basename, dirname, isAbsolute } from 'node:path';
 import { compilePermissionProfile } from '@maka/core/permission-profile-compiler';
-import { parseAttachmentResourceRef } from '@maka/core/attachments';
+import { formatAttachmentResourceRef, parseAttachmentResourceRef } from '@maka/core/attachments';
+import {
+  ARTIFACT_IMAGE_PREVIEW_MAX_BYTES,
+  normalizeArtifactImagePreviewMime,
+} from '@maka/core/artifacts';
 import { type SandboxBoundaryExpansion } from '@maka/core/sandbox-boundary';
 import { isStorageRef, type StorageRef, type ToolResultContent } from '@maka/core/events';
 import { type PermissionProfile } from '@maka/core/permission-profile';
@@ -205,6 +209,15 @@ export interface BuildBuiltinToolsOptions {
     mimeType: string;
   }) => Promise<Extract<StorageRef, { kind: 'session_context' }>>;
   releaseImageSnapshot?: (input: { sessionId: string; refId: string }) => Promise<void>;
+  /** Publish bytes already admitted by the filesystem read boundary. */
+  publishImage?: (input: {
+    sessionId: string;
+    turnId: string;
+    toolCallId: string;
+    name: string;
+    bytes: Uint8Array;
+    mimeType: string;
+  }) => Promise<Extract<StorageRef, { kind: 'session_file' }>>;
 }
 
 export function buildBuiltinTools(options: BuildBuiltinToolsOptions = {}): MakaTool[] {
@@ -295,6 +308,59 @@ export function buildBuiltinTools(options: BuildBuiltinToolsOptions = {}): MakaT
   const tools: MakaTool[] = [
     ...bashTools,
     ...backgroundTools,
+    ...(options.publishImage
+      ? [
+          {
+            name: 'PublishImage',
+            activityKind: 'read' as const,
+            description:
+              'Publish a local PNG/JPEG/GIF/WebP image as a durable attachment in the current chat. ' +
+              'Use this after generating a screenshot or image to show it to the user. ' +
+              'Returns a resource URL and ready-to-use Markdown. Use this to save a copy before deleting or replacing the source; ordinary image Markdown is captured automatically by the Host. ' +
+              'Images must be at most 2 MiB; resize larger images first. File access uses the same permissions as Read.',
+            parameters: z.object({
+              path: z
+                .string()
+                .describe('Local image path; relative paths resolve from the session cwd.'),
+            }),
+            executionFacts,
+            impl: async ({ path }: { path: string }, ctx: MakaToolContext) => {
+              const result = await filesystem.execute({
+                operation: { kind: 'read', path },
+                ...filesystemCall(ctx),
+              });
+              if (
+                result.kind !== 'read_image' ||
+                !normalizeArtifactImagePreviewMime(result.mimeType)
+              )
+                throw new Error('PublishImage requires a PNG, JPEG, GIF, or WebP image.');
+              if (result.bytes.byteLength > ARTIFACT_IMAGE_PREVIEW_MAX_BYTES)
+                throw new Error(
+                  'Image exceeds the 2 MiB chat preview limit; resize it before publishing.',
+                );
+              ctx.abortSignal.throwIfAborted();
+              const ref = await options.publishImage!({
+                sessionId: ctx.sessionId,
+                turnId: ctx.turnId,
+                toolCallId: ctx.toolCallId,
+                name: basename(path),
+                bytes: result.bytes,
+                mimeType: result.mimeType,
+              });
+              const resource =
+                ref.sessionId === ctx.sessionId ? formatAttachmentResourceRef(ref) : null;
+              if (!resource)
+                throw new Error('Image publication did not return a valid session attachment.');
+              const name = basename(path).replace(/[\[\]\\\r\n]/g, '_');
+              return {
+                published: true,
+                resource,
+                markdown: `![${name}](${resource})`,
+              };
+            },
+          } satisfies MakaTool,
+        ]
+      : []),
     {
       name: 'Read',
       activityKind: 'read',
diff --git a/packages/runtime/src/image-file-reader.ts b/packages/runtime/src/image-file-reader.ts
new file mode 100644
index 00000000000..e283c0f5064
--- /dev/null
+++ b/packages/runtime/src/image-file-reader.ts
@@ -0,0 +1,44 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import type { BuildBuiltinToolsOptions } from './builtin-tools.js';
+import {
+  createBoundaryFilesystemExecutor,
+  type FilesystemExecuteInput,
+} from './filesystem-executor.js';
+import { createLocalWorkspaceExecutor } from './workspace-executor.js';
+/** The same filesystem boundary as Read, without model snapshots or tool execution. */
+export function createImageFileReader(
+  options: Pick<
+    BuildBuiltinToolsOptions,
+    'executor' | 'filesystemWorker' | 'permissionProfile'
+  > = {},
+) {
+  const filesystem = createBoundaryFilesystemExecutor({
+    workspace: options.executor ?? createLocalWorkspaceExecutor(),
+    ...(options.filesystemWorker ? { worker: options.filesystemWorker } : {}),
+    ...(options.permissionProfile ? { permissionProfile: options.permissionProfile } : {}),
+  });
+  return async (input: Omit<FilesystemExecuteInput, 'operation'> & { path: string }) => {
+    const { path, ...context } = input;
+    const result = await filesystem.execute({ ...context, operation: { kind: 'read', path } });
+    if (result.kind !== 'read_image') throw new Error('Not a supported raster image');
+    return { bytes: result.bytes, mimeType: result.mimeType };
+  };
+}
diff --git a/packages/runtime/src/system-prompt/main-session-prompt.ts b/packages/runtime/src/system-prompt/main-session-prompt.ts
index d7fc83a0d44..eab9df35ad7 100644
--- a/packages/runtime/src/system-prompt/main-session-prompt.ts
+++ b/packages/runtime/src/system-prompt/main-session-prompt.ts
@@ -52,6 +52,9 @@ Keep simple answers simple; do not add headings or lists to simple answers.
 Use short headings and flat lists to organize longer answers.
 Use fenced code blocks for multiline code and backticks for inline commands, paths, identifiers, and literal values.
 Prefer descriptive link text for external sources when it is available.
+To deliver a generated screenshot or local image, include a Markdown image with its absolute path. The Host automatically saves supported images referenced in assistant messages as session attachments; HTTP/HTTPS images can also be embedded directly. Reading an image for your own inspection does not deliver it.
+If you need to delete or replace the source file immediately, use PublishImage when available first and include its returned Markdown. Keep source files available until capture finishes. Images above the automatic save limit may be displayed without a saved copy.
+Only claim an image was saved after publication succeeds. Saving does not confirm that the client displayed it.
 Follow a more specific format requested by the user or task.`;
 }
 
diff --git a/packages/runtime/src/tool-availability.ts b/packages/runtime/src/tool-availability.ts
index 671f66954b8..714774f69fd 100644
--- a/packages/runtime/src/tool-availability.ts
+++ b/packages/runtime/src/tool-availability.ts
@@ -39,6 +39,7 @@ export const TOOL_SEARCH_MAX_SCHEMA_CHARS = 64 * 1024;
 const DIRECT_TOOL_NAMES: ReadonlySet<string> = new Set([
   'Bash',
   'Read',
+  'PublishImage',
   'Write',
   'Edit',
   'Glob',
diff --git a/packages/storage/src/artifact-image-storage.ts b/packages/storage/src/artifact-image-storage.ts
new file mode 100644
index 00000000000..a24ec5540d9
--- /dev/null
+++ b/packages/storage/src/artifact-image-storage.ts
@@ -0,0 +1,74 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import type { ArtifactRecord } from '@maka/core/artifacts';
+import type { ImageArchiveLimits, ImageDeliveryMetadata } from '@maka/core/image-delivery';
+
+export class ImageArchiveQuotaError extends Error {
+  readonly name = 'ImageArchiveQuotaError';
+  constructor() {
+    super('Image archive quota exceeded');
+  }
+}
+
+/** Pure policy, evaluated by ArtifactStore while holding its writer lock.
+ * Budgets count unique archived content; the store shares payloads with hard links. */
+export function planImageArchive(
+  records: readonly ArtifactRecord[],
+  input: {
+    sessionId: string;
+    content: string | Uint8Array;
+    imageDelivery?: ImageDeliveryMetadata;
+    imageArchiveLimits?: ImageArchiveLimits;
+  },
+) {
+  const digest =
+    input.imageDelivery?.status === 'ready' ? input.imageDelivery.contentSha256 : undefined;
+  const size = Buffer.byteLength(input.content);
+  const limits = input.imageArchiveLimits;
+  if (digest && limits) {
+    if (
+      ![limits.sessionBytes, limits.workspaceBytes].every((v) => Number.isSafeInteger(v) && v >= 0)
+    )
+      throw new Error('Invalid image archive limits');
+    const unique = new Map<string, number>();
+    const sessionUnique = new Map<string, number>();
+    for (const record of records) {
+      const hash = record.imageDelivery?.contentSha256;
+      if (record.imageDelivery?.status !== 'ready' || !hash) continue;
+      unique.set(hash, record.sizeBytes);
+      if (record.sessionId === input.sessionId) sessionUnique.set(hash, record.sizeBytes);
+    }
+    const sum = (values: Map<string, number>) => [...values.values()].reduce((a, b) => a + b, 0);
+    if (
+      sum(unique) + (unique.has(digest) ? 0 : size) > limits.workspaceBytes ||
+      sum(sessionUnique) + (sessionUnique.has(digest) ? 0 : size) > limits.sessionBytes
+    )
+      throw new ImageArchiveQuotaError();
+  }
+  const sameContent = digest
+    ? records.find(
+        (r) =>
+          r.imageDelivery?.status === 'ready' &&
+          r.imageDelivery.contentSha256 === digest &&
+          r.sizeBytes === size,
+      )
+    : undefined;
+  return { digest, sameContent };
+}
diff --git a/packages/storage/src/artifact-metadata-codec.ts b/packages/storage/src/artifact-metadata-codec.ts
index adabf324a5c..c559baba2e2 100644
--- a/packages/storage/src/artifact-metadata-codec.ts
+++ b/packages/storage/src/artifact-metadata-codec.ts
@@ -17,6 +17,7 @@
  * under the License.
  */
 
+import { isImageDeliveryMetadata } from '@maka/core/image-delivery';
 import { isAbsolute } from 'node:path';
 import {
   ARTIFACT_KINDS,
@@ -42,6 +43,7 @@ const ARTIFACT_RECORD_KEYS = new Set([
   'mimeType',
   'source',
   'summary',
+  'imageDelivery',
   'deepResearchRole',
 ]);
 
@@ -111,6 +113,7 @@ function decodeArtifactRecord(value: unknown, index: number): ArtifactRecord {
     value.sizeBytes < 0 ||
     !isOptionalNonEmptyString(value.mimeType) ||
     !isOptionalNonEmptyString(value.summary) ||
+    (value.imageDelivery !== undefined && !isImageDeliveryMetadata(value.imageDelivery)) ||
     typeof value.source !== 'string'
   ) {
     throw invalidMetadataRecord(index);
diff --git a/packages/storage/src/artifact-store.ts b/packages/storage/src/artifact-store.ts
index 151a2b7a2a7..13806e76163 100644
--- a/packages/storage/src/artifact-store.ts
+++ b/packages/storage/src/artifact-store.ts
@@ -17,6 +17,12 @@
  * under the License.
  */
 
+import { planImageArchive } from './artifact-image-storage.js';
+import {
+  isImageDeliveryMetadata,
+  type ImageDeliveryMetadata,
+  type ImageArchiveLimits,
+} from '@maka/core/image-delivery';
 import { createHash, randomUUID } from 'node:crypto';
 import { isDeepStrictEqual } from 'node:util';
 import { type BigIntStats, constants as fsConstants } from 'node:fs';
@@ -24,6 +30,7 @@ import {
   access,
   copyFile,
   lstat,
+  link,
   mkdir,
   open,
   readFile,
@@ -104,6 +111,8 @@ export interface CreateArtifactInput {
   summary?: string;
   now?: number;
   id?: string;
+  imageDelivery?: ImageDeliveryMetadata;
+  imageArchiveLimits?: ImageArchiveLimits;
 }
 
 export type ArtifactListRevision = `sha256:${string}`;
@@ -189,6 +198,12 @@ export interface ArtifactUpgradeCleanupResult {
 
 export interface ArtifactAuthorityStore extends DurableArtifactAttachmentReader {
   create(input: CreateArtifactInput): Promise<ArtifactRecord>;
+  findImageDelivery(
+    sessionId: string,
+    turnId: string,
+    messageId: string,
+    source: string,
+  ): Promise<ArtifactRecord | undefined>;
   close(): void;
   copyConversationArtifacts(
     input: ConversationArtifactCopyInput,
@@ -269,11 +284,36 @@ class SqliteArtifactStore implements ArtifactAuthorityStore {
     this.metadataRepository.close();
   }
 
+  async findImageDelivery(
+    sessionId: string,
+    turnId: string,
+    messageId: string,
+    source: string,
+  ): Promise<ArtifactRecord | undefined> {
+    return this.enqueue(async () =>
+      this.metadataRepository.findImageDelivery(sessionId, turnId, messageId, source),
+    );
+  }
+
   async create(input: CreateArtifactInput): Promise<ArtifactRecord> {
     const acceptedInput: CreateArtifactInput = Object.freeze({
       ...input,
+      ...(input.imageDelivery ? { imageDelivery: Object.freeze({ ...input.imageDelivery }) } : {}),
+      ...(input.imageArchiveLimits
+        ? { imageArchiveLimits: Object.freeze({ ...input.imageArchiveLimits }) }
+        : {}),
       content: typeof input.content === 'string' ? input.content : new Uint8Array(input.content),
     });
+    if (
+      acceptedInput.imageDelivery !== undefined &&
+      !isImageDeliveryMetadata(acceptedInput.imageDelivery)
+    )
+      throw new Error('Invalid image delivery metadata');
+    if (
+      acceptedInput.imageDelivery?.status === 'ready' &&
+      acceptedInput.imageDelivery.contentSha256 !== sha256(Buffer.from(acceptedInput.content))
+    )
+      throw new Error('Image delivery digest does not match its bytes');
     const id = acceptedInput.id ?? randomUUID();
     if (!ARTIFACT_KIND_SET.has(acceptedInput.kind)) throw new Error('Invalid Artifact kind');
     if (!ARTIFACT_SOURCE_SET.has(acceptedInput.source)) {
@@ -301,6 +341,7 @@ class SqliteArtifactStore implements ArtifactAuthorityStore {
           relativePath,
         });
       }
+      const { digest, sameContent } = planImageArchive(this.records, acceptedInput);
       return this.publishNewArtifactUnlocked(
         {
           id,
@@ -313,8 +354,20 @@ class SqliteArtifactStore implements ArtifactAuthorityStore {
           ...(acceptedInput.mimeType ? { mimeType: acceptedInput.mimeType } : {}),
           source: acceptedInput.source,
           ...(acceptedInput.summary ? { summary: acceptedInput.summary } : {}),
+          ...(acceptedInput.imageDelivery ? { imageDelivery: acceptedInput.imageDelivery } : {}),
+        },
+        async (targetPath) => {
+          if (sameContent) {
+            const source = await this.prepareRecordRead(sameContent, sameContent.sizeBytes);
+            if (
+              source.ok &&
+              (await hashPreparedArtifact(source)) === digest &&
+              (await tryLinkImagePayload(source.path, targetPath))
+            )
+              return;
+          }
+          await writeFile(targetPath, acceptedInput.content, { flag: 'wx' });
         },
-        (targetPath) => writeFile(targetPath, acceptedInput.content, { flag: 'wx' }),
       );
     });
   }
@@ -444,7 +497,18 @@ class SqliteArtifactStore implements ArtifactAuthorityStore {
       }
       return this.publishNewArtifactUnlocked(
         expected,
-        (targetPath) => copyFile(prepared.path, targetPath, fsConstants.COPYFILE_EXCL),
+        async (targetPath) => {
+          if (source.imageDelivery?.status === 'ready') {
+            const current = await this.prepareRecordRead(source, source.sizeBytes);
+            if (
+              !current.ok ||
+              (await hashPreparedArtifact(current)) !== source.imageDelivery.contentSha256
+            )
+              throw artifactReplayConflict(source.id);
+            if (await tryLinkImagePayload(current.path, targetPath)) return;
+          }
+          await copyFile(prepared.path, targetPath, fsConstants.COPYFILE_EXCL);
+        },
         source.sizeBytes,
       );
     });
@@ -600,6 +664,7 @@ class SqliteArtifactStore implements ArtifactAuthorityStore {
       existing.mimeType !== optionalCanonicalText(input.mimeType) ||
       existing.source !== input.source ||
       existing.summary !== optionalCanonicalText(input.summary) ||
+      !isDeepStrictEqual(existing.imageDelivery, input.imageDelivery) ||
       (input.now !== undefined && existing.createdAt !== input.now)
     ) {
       throw artifactReplayConflict(canonical.id);
@@ -1331,3 +1396,19 @@ function sniffAllowedBinaryMime(bytes: Uint8Array): string | null {
     return 'image/svg+xml';
   return null;
 }
+
+async function tryLinkImagePayload(source: string, target: string): Promise<boolean> {
+  try {
+    await link(source, target);
+    return true;
+  } catch (error) {
+    // Filesystems without hard links retain the regular write/copy fallback.
+    if (
+      !['ENOTSUP', 'EPERM', 'EXDEV', 'EACCES'].includes(
+        String((error as NodeJS.ErrnoException).code),
+      )
+    )
+      throw error;
+    return false;
+  }
+}
diff --git a/packages/storage/src/artifact-stores.ts b/packages/storage/src/artifact-stores.ts
index bf950c22e71..86874feed74 100644
--- a/packages/storage/src/artifact-stores.ts
+++ b/packages/storage/src/artifact-stores.ts
@@ -28,6 +28,7 @@ import {
   type DurableArtifactAttachmentReader,
 } from './artifact-store.js';
 
+export { ImageArchiveQuotaError } from './artifact-image-storage.js';
 export { sanitizeArtifactName } from './artifact-store.js';
 import {
   assertStorageRootLease,
@@ -57,6 +58,7 @@ export interface InteractiveArtifactStoreWriter extends DurableArtifactAttachmen
   readonly access: 'write';
   readonly [writerBrand]: true;
   create(input: CreateArtifactInput): Promise<ArtifactRecord>;
+  findImageDelivery: ArtifactAuthorityStore['findImageDelivery'];
   /**
    * Narrow system delete for one Session-owned artifact of a declared source.
    *
@@ -136,6 +138,8 @@ function createWriterFacade(
     kind: 'interactive',
     access: 'write',
     [writerBrand]: true,
+    findImageDelivery: (sessionId, turnId, messageId, source) =>
+      run(() => store.findImageDelivery(sessionId, turnId, messageId, source)),
     listPage: (sessionId, options) => run(() => store.listPage(sessionId, options)),
     listTurnArtifacts: (sessionId, turnId) => run(() => store.listTurnArtifacts(sessionId, turnId)),
     getInSession: (sessionId, artifactId) => run(() => store.getInSession(sessionId, artifactId)),
@@ -189,6 +193,10 @@ function createWriterFacade(
 function snapshotCreateInput(input: CreateArtifactInput): CreateArtifactInput {
   return Object.freeze({
     ...input,
+    ...(input.imageDelivery ? { imageDelivery: Object.freeze({ ...input.imageDelivery }) } : {}),
+    ...(input.imageArchiveLimits
+      ? { imageArchiveLimits: Object.freeze({ ...input.imageArchiveLimits }) }
+      : {}),
     content: typeof input.content === 'string' ? input.content : new Uint8Array(input.content),
   });
 }
diff --git a/packages/storage/src/sqlite-artifact-metadata.ts b/packages/storage/src/sqlite-artifact-metadata.ts
index df4094ef66e..c29e65abeba 100644
--- a/packages/storage/src/sqlite-artifact-metadata.ts
+++ b/packages/storage/src/sqlite-artifact-metadata.ts
@@ -42,6 +42,28 @@ class SqliteArtifactMetadataRepository {
     this.#lease = acquireOperationalStateDatabase(resolve(workspaceRoot));
   }
 
+  findImageDelivery(
+    sessionId: string,
+    turnId: string,
+    messageId: string,
+    source: string,
+  ): ArtifactRecord | undefined {
+    this.assertOpen();
+    const rows = this.#lease.database
+      .prepare(`
+      SELECT record_json FROM artifact_records
+      WHERE session_id = ? AND json_valid(record_json)
+        AND json_type(record_json, '$.imageDelivery') = 'object'
+        AND json_extract(record_json, '$.turnId') = ?
+        AND json_extract(record_json, '$.imageDelivery.messageId') = ?
+        AND json_extract(record_json, '$.imageDelivery.source') = ?
+      ORDER BY CASE json_extract(record_json, '$.imageDelivery.status') WHEN 'pending' THEN 1 ELSE 0 END,
+        created_at DESC, artifact_id DESC LIMIT 1
+    `)
+      .all(sessionId, turnId, messageId, source) as Array<{ record_json: string }>;
+    return decodeRows(rows)[0];
+  }
+
   readAll(): ArtifactRecord[] {
     this.assertOpen();
     const rows = this.#lease.database
diff --git a/packages/storage/src/sqlite-artifact-schema.ts b/packages/storage/src/sqlite-artifact-schema.ts
index 84a880ed8b0..9d90a4eb44b 100644
--- a/packages/storage/src/sqlite-artifact-schema.ts
+++ b/packages/storage/src/sqlite-artifact-schema.ts
@@ -23,7 +23,7 @@ import {
   isSafeRelativeArtifactPath,
 } from './artifact-metadata-codec.js';
 
-export const SQLITE_ARTIFACT_SCHEMA_VERSION = 3;
+export const SQLITE_ARTIFACT_SCHEMA_VERSION = 4;
 
 export function migrateSqliteArtifactDatabase(db: DatabaseSync): void {
   const columns = db.prepare('PRAGMA table_info(artifact_records)').all() as Array<{
@@ -79,6 +79,11 @@ export function migrateSqliteArtifactDatabase(db: DatabaseSync): void {
     CREATE UNIQUE INDEX IF NOT EXISTS artifact_records_relative_path
       ON artifact_records(relative_path);
 
+    CREATE INDEX IF NOT EXISTS artifact_image_delivery_lookup
+      ON artifact_records(session_id, json_extract(record_json, '$.turnId'),
+        json_extract(record_json, '$.imageDelivery.messageId'), json_extract(record_json, '$.imageDelivery.source'))
+      WHERE json_valid(record_json) AND json_type(record_json, '$.imageDelivery') = 'object';
+
     CREATE TABLE IF NOT EXISTS artifact_upgrade_orphan_paths (
       relative_path TEXT PRIMARY KEY
     );
diff --git a/packages/ui/package.json b/packages/ui/package.json
index d94cfb38499..8de5e24cdb8 100644
--- a/packages/ui/package.json
+++ b/packages/ui/package.json
@@ -24,7 +24,8 @@
     "build": "tsc -p tsconfig.json",
     "benchmark:redaction": "npm run build && node scripts/benchmark-streaming-redaction.mjs",
     "typecheck": "tsc -p tsconfig.json --noEmit",
-    "test:dist": "node --test \"dist/**/*.test.js\""
+    "test:dist": "node --test \"dist/**/*.test.js\"",
+    "test:images:browser": "npm run build && node --test scripts/markdown-images.browser.test.mjs"
   },
   "dependencies": {
     "@astryxdesign/core": "0.6.3",
@@ -38,8 +39,10 @@
     "virtua": "0.52.7"
   },
   "devDependencies": {
+    "@playwright/test": "^1.63.0",
     "@types/react": "^19.3.0",
     "@types/react-dom": "^19.3.0",
+    "esbuild": "^0.28.2",
     "linkedom": "^0.18.13"
   }
 }
diff --git a/packages/ui/scripts/markdown-images.browser.test.mjs b/packages/ui/scripts/markdown-images.browser.test.mjs
new file mode 100644
index 00000000000..abfca5e0509
--- /dev/null
+++ b/packages/ui/scripts/markdown-images.browser.test.mjs
@@ -0,0 +1,192 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+// Chromium owns image requests and CSP enforcement; fake DOM tests cannot
+// detect an allowed Markdown URL that the desktop policy blocks.
+// Run after building @maka/ui: node --test packages/ui/scripts/markdown-images.browser.test.mjs
+import assert from 'node:assert/strict';
+import { before, after, test } from 'node:test';
+import { createServer } from 'node:http';
+import { readFile } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+import { build } from 'esbuild';
+import { chromium } from '@playwright/test';
+
+const root = fileURLToPath(new URL('../../../', import.meta.url));
+const png = Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8DwHwAFBQIAX8jx0gAAAABJRU5ErkJggg==', 'base64');
+let appServer, imageServer, browser, appUrl, imageUrl;
+let requests = [], failedOnce = false;
+
+before(async () => {
+  imageServer = createServer((req, res) => {
+    requests.push({ path: req.url, referer: req.headers.referer });
+    if (req.url === '/retry.png' && !failedOnce) {
+      failedOnce = true;
+      res.writeHead(404).end();
+    } else {
+      res.setHeader('Content-Type', 'image/png');
+      res.end(png);
+    }
+  });
+  await new Promise(resolve => imageServer.listen(0, '127.0.0.1', resolve));
+  imageUrl = `http://127.0.0.1:${imageServer.address().port}`;
+  const bundle = await build({
+    stdin: { contents: `
+      import React from 'react';
+      import {createRoot} from 'react-dom/client';
+      import {Theme} from '@astryxdesign/core';
+      import {makaTheme} from './apps/desktop/src/renderer/astryx-theme/maka.js';
+      import {MarkdownBody} from './packages/ui/dist/markdown-body.js';
+      import {LocaleProvider} from './packages/ui/dist/locale-context.js';
+      import {ImageDeliveryProvider} from './packages/ui/dist/image-delivery.js';
+      import {SessionAttachmentProvider} from './packages/ui/dist/attachment-image.js';
+      import './apps/desktop/src/renderer/styles.css';
+      const mode=new URLSearchParams(location.search).get('case') || 'remote';
+      let reads=0; window.imageReads=0; window.deliveryQueries=0;
+      const text=mode==='attachment' ? '![Screenshot](maka://runtime/attachments/image-1)' :
+        mode==='local' || mode==='local-saved' ? '![Screenshot](/tmp/private.png)' :
+        '![Screenshot](${imageUrl}/'+(mode==='retry' ? 'retry.png' : 'image.png')+')';
+      createRoot(document.getElementById('root')).render(
+        React.createElement(Theme,{theme:makaTheme,mode:'light'},
+          React.createElement(LocaleProvider,{locale:'en'},
+            React.createElement(SessionAttachmentProvider,{sessionId:'session',readBytes:async()=>{
+              reads++; window.imageReads=reads; return mode==='attachment' && reads===1 ? {ok:false,reason:'read_failed'} :
+                {ok:true,base64:'${png.toString('base64')}',mimeType:'image/png'};
+            }},React.createElement(ImageDeliveryProvider,{sessionId:'session',resolve:mode.endsWith('saved') || mode==='saving' ? async()=>{
+              window.deliveryQueries++;
+              await new Promise(resolve=>setTimeout(resolve,100));
+              return mode==='saving' && window.deliveryQueries===1 ? {status:'pending'} : {status:'ready',artifactId:'saved-image'};
+            } : undefined},
+              React.createElement('div',{style:mode==='offscreen' ? {paddingTop:'2500px'} : {}},
+                React.createElement(MarkdownBody,{text,imageIdentity:{turnId:'turn',messageId:'message'}})))))));
+    `, resolveDir: root, loader: 'js' },
+    bundle: true, write: false, outdir: '/virtual', format: 'iife',
+    loader: { '.woff2': 'dataurl', '.woff': 'dataurl', '.ttf': 'dataurl', '.svg': 'dataurl' },
+    define: { 'process.env.NODE_ENV': '"production"' },
+  });
+  const js = bundle.outputFiles.find(file => file.path.endsWith('.js')).text;
+  const css = bundle.outputFiles.find(file => file.path.endsWith('.css')).text;
+  const index = await readFile(new URL('../../../apps/desktop/src/renderer/index.html', import.meta.url), 'utf8');
+  const csp = index.match(/http-equiv="Content-Security-Policy"\s+content="([^"]+)"/)[1];
+  appServer = createServer((req, res) => {
+    if (req.url === '/app.js') { res.setHeader('Content-Type', 'text/javascript'); res.end(js); }
+    else if (req.url === '/app.css') { res.setHeader('Content-Type', 'text/css'); res.end(css); }
+    else {
+      res.setHeader('Content-Type', 'text/html');
+      res.end(`<!doctype html><html><head><meta name="referrer" content="no-referrer"><meta http-equiv="Content-Security-Policy" content="${csp}"><link rel="stylesheet" href="/app.css"></head><body><main id="root"></main><script src="/app.js"></script></body></html>`);
+    }
+  });
+  await new Promise(resolve => appServer.listen(0, '127.0.0.1', resolve));
+  appUrl = `http://127.0.0.1:${appServer.address().port}`;
+  browser = await chromium.launch({ headless: true });
+});
+
+after(async () => {
+  await browser?.close();
+  for (const server of [appServer, imageServer]) if (server) await new Promise(resolve => server.close(resolve));
+});
+
+async function pageFor(scenario) {
+  const page = await browser.newPage({ viewport: { width: 720, height: 600 } });
+  page.setDefaultTimeout(5000);
+  await page.goto(`${appUrl}/?case=${scenario}`);
+  return page;
+}
+
+async function loaded(page) {
+  await page.waitForFunction(() => [...document.images].some(image => image.naturalWidth === 1));
+}
+
+test('remote image loads automatically under the actual desktop CSP, without sending a referrer', async () => {
+  requests = [];
+  const page = await pageFor('remote');
+  try {
+    assert.equal(await page.getByRole('button', { name: 'Load image', exact: true }).count(), 0);
+    await loaded(page);
+    assert.deepEqual(requests, [{ path: '/image.png', referer: undefined }]);
+    assert.equal(await page.getByRole('status').count(), 0);
+  } finally { await page.close(); }
+});
+
+test('failed remote image has a working retry control instead of a broken image icon', async () => {
+  failedOnce = false;
+  const page = await pageFor('retry');
+  try {
+    await page.getByText('Could not load the image. Try again.').waitFor();
+    assert.equal(await page.locator('img').count(), 0);
+    await page.getByRole('button', { name: 'Retry', exact: true }).click();
+    await loaded(page);
+  } finally { await page.close(); }
+});
+
+test('attachment read failure recovers in place, and local paths explain how to provide an image', async () => {
+  const page = await pageFor('attachment');
+  try {
+    await page.getByRole('button', { name: 'Retry', exact: true }).click();
+    await loaded(page);
+    assert.match(await page.locator('img').getAttribute('src'), /^data:image\/png;base64,/);
+    await page.goto(`${appUrl}/?case=local`);
+    await page.getByText('This image address cannot be displayed. Send the image as a chat attachment.').waitFor();
+    assert.equal(await page.locator('img').count(), 0);
+    assert.equal(await page.getByRole('button', { name: 'Load image' }).count(), 0);
+  } finally { await page.close(); }
+});
+
+for (const scenario of ['remote-saved', 'local-saved']) {
+  test(`${scenario}: saved mapping avoids the original source and the image supports zoom`, async () => {
+    requests = [];
+    const page = await pageFor(scenario);
+    try {
+      await loaded(page);
+      assert.deepEqual(requests, []);
+      assert.equal(await page.evaluate(() => window.imageReads), 1);
+      assert.equal(await page.locator('img').count(), 1);
+      assert.match(await page.locator('img').getAttribute('src'), /^data:image\/png;base64,/);
+      await page.getByRole('button', { name: 'Enlarge image: Screenshot', exact: true }).click();
+      await page.waitForFunction(() => document.images.length > 1);
+    } finally { await page.close(); }
+  });
+}
+test('offscreen image performs no image request until it approaches the viewport', async () => {
+  requests = [];
+  const page = await pageFor('offscreen');
+  try {
+    // Let React effects and the initial IntersectionObserver callback complete.
+    await page.getByText('Loading image…').waitFor();
+    assert.deepEqual(requests, []);
+    assert.equal(await page.locator('img').count(), 0);
+    await page.locator('[data-maka-image-state]').scrollIntoViewIfNeeded();
+    await loaded(page);
+    assert.deepEqual(requests, [{ path: '/image.png', referer: undefined }]);
+  } finally { await page.close(); }
+});
+
+test('a new remote image previews during archival and switches to saved bytes after background completion', async () => {
+  requests = [];
+  const page = await pageFor('saving');
+  try {
+    await loaded(page);
+    await page.getByText('Saving image…').waitFor();
+    assert.equal(requests.length, 1);
+    await page.waitForFunction(() => [...document.images].some(img=>img.src.startsWith('data:image/png;') && img.naturalWidth===1));
+    assert.equal(await page.getByRole('status').count(), 0);
+    assert.equal(await page.evaluate(() => window.deliveryQueries), 2);
+    assert.equal(requests.length, 1);
+  } finally { await page.close(); }
+});
diff --git a/packages/ui/src/__tests__/attachment-image.test.tsx b/packages/ui/src/__tests__/attachment-image.test.tsx
index df3208c456e..1203e69db4b 100644
--- a/packages/ui/src/__tests__/attachment-image.test.tsx
+++ b/packages/ui/src/__tests__/attachment-image.test.tsx
@@ -72,9 +72,11 @@ async function renderAttachmentMarkdown(text: string, readBytes: ReadAttachmentB
   const { container, root } = domRoot();
   await act(async () => {
     root.render(
-      <SessionAttachmentProvider sessionId="session-1" readBytes={readBytes}>
+      <LocaleProvider locale="en">
+        <SessionAttachmentProvider sessionId="session-1" readBytes={readBytes}>
         <MarkdownBody text={text} />
-      </SessionAttachmentProvider>,
+      </SessionAttachmentProvider>
+      </LocaleProvider>,
     );
   });
   return { container, root };
@@ -169,7 +171,7 @@ test('renders a session attachment referenced by assistant Markdown', async () =
   assert.deepEqual(readRef, { sessionId: 'session-1', artifactId: 'attachment-123' });
 });
 
-test('keeps unreadable assistant attachments as named placeholders', async () => {
+test('explains unreadable assistant attachments and offers retry', async () => {
   const cases: Array<[string, ReadAttachmentBytes]> = [
     ['missing', async () => ({ ok: false, reason: 'not_found' })],
     ['document', async () => ({ ok: true, base64: 'cGRm', mimeType: 'application/pdf' })],
@@ -188,7 +190,9 @@ test('keeps unreadable assistant attachments as named placeholders', async () =>
       readBytes,
     );
     assert.equal(container.querySelector('img'), null);
-    assert.ok(container.textContent.includes(`[${name}]`));
+    assert.ok(container.textContent.includes(name));
+    assert.ok(container.textContent.includes("Could not load the image"));
+    assert.equal(container.querySelector("button")?.textContent, "Retry");
   }
 });
 
@@ -218,14 +222,10 @@ test('retries an attachment image after a transient read failure', async () => {
       ? { ok: false, reason: 'read_failed' }
       : { ok: true, base64: 'cmVjb3ZlcmVk', mimeType: 'image/png' };
   };
-  const { container, root } = await renderAttachmentMarkdown(markdown, readBytes);
+  const { container } = await renderAttachmentMarkdown(markdown, readBytes);
   assert.equal(container.querySelector('img'), null);
   await act(async () => {
-    root.render(
-      <SessionAttachmentProvider sessionId="session-1" readBytes={readBytes}>
-        <MarkdownBody key="retry" text={markdown} />
-      </SessionAttachmentProvider>,
-    );
+    container.querySelector('button')!.click();
   });
 
   const image = container.querySelector('img[alt="preview"]');
@@ -244,22 +244,26 @@ test('renders an attachment when a streaming Markdown image becomes complete', a
   });
   await act(async () => {
     root.render(
-      <SessionAttachmentProvider sessionId="session-1" readBytes={readBytes}>
+      <LocaleProvider locale="en">
+        <SessionAttachmentProvider sessionId="session-1" readBytes={readBytes}>
         <MarkdownBody
           text="![preview](maka://runtime/attachments/attachment-"
           streaming
           settledText=""
         />
-      </SessionAttachmentProvider>,
+      </SessionAttachmentProvider>
+      </LocaleProvider>,
     );
   });
   assert.equal(container.querySelector('img'), null);
 
   await act(async () => {
     root.render(
-      <SessionAttachmentProvider sessionId="session-1" readBytes={readBytes}>
+      <LocaleProvider locale="en">
+        <SessionAttachmentProvider sessionId="session-1" readBytes={readBytes}>
         <MarkdownBody text={markdown} streaming settledText={markdown} />
-      </SessionAttachmentProvider>,
+      </SessionAttachmentProvider>
+      </LocaleProvider>,
     );
   });
 
diff --git a/packages/ui/src/__tests__/markdown-body.test.ts b/packages/ui/src/__tests__/markdown-body.test.ts
index eca7a03013f..edd696513a3 100644
--- a/packages/ui/src/__tests__/markdown-body.test.ts
+++ b/packages/ui/src/__tests__/markdown-body.test.ts
@@ -436,7 +436,7 @@ it('keeps non-allowlisted external schemes inert', () => {
 });
 
 it('never loads non-allowlisted Markdown image sources', () => {
-  const markup = renderToStaticMarkup(createElement(MarkdownBody, {
+  const markup = renderImageMarkdown({
     text: [
       '![standalone](file:///Users/example/.ssh/id_rsa)',
       '',
@@ -448,7 +448,7 @@ it('never loads non-allowlisted Markdown image sources', () => {
       '',
       '[avatar]: file:///Users/example/private.png',
     ].join('\n'),
-  }));
+  });
 
   assert.doesNotMatch(markup, /<img\b/);
   assert.doesNotMatch(markup, /\bsrc="(?:file|custom):/);
@@ -464,9 +464,9 @@ it('does not treat navigation and communication schemes as image resources', ()
     'maka://runtime/attachments/not-an-artifact',
     'mailto:user@example.com',
   ]) {
-    const markup = renderToStaticMarkup(createElement(MarkdownBody, {
+    const markup = renderImageMarkdown({
       text: `![not-an-image](${src})`,
-    }));
+    });
 
     assert.doesNotMatch(markup, /<img\b/, src);
     assert.doesNotMatch(markup, /\bsrc=/, src);
@@ -474,15 +474,32 @@ it('does not treat navigation and communication schemes as image resources', ()
 });
 
 it('shows an attachment placeholder when no session reader is installed', () => {
-  const markup = renderToStaticMarkup(createElement(MarkdownBody, {
+  const markup = renderImageMarkdown({
     text: '![preview](maka://runtime/attachments/attachment-123)',
-  }));
+  });
 
-  assert.match(markup, />\[preview\]</);
+  assert.match(markup, />preview</);
+  assert.match(markup, /This image attachment is unavailable here/);
   assert.doesNotMatch(markup, /maka:\/\/runtime\/attachments/);
   assert.doesNotMatch(markup, /<img\b/);
 });
 
+function renderImageMarkdown(props: { text: string }) {
+  return renderToStaticMarkup(createElement(LocaleProvider, {
+    locale: 'en',
+    children: createElement(MarkdownBody, props),
+  }));
+}
+
+it('renders remote images automatically with lazy decoding and no referrer', () => {
+  const markup = renderImageMarkdown({ text: '![preview](https://example.com/image.png)' });
+  assert.match(markup, /<img\b/);
+  assert.match(markup, /src="https:\/\/example\.com\/image\.png"/);
+  assert.match(markup, /loading="lazy"/);
+  assert.match(markup, /referrerPolicy="no-referrer"|referrerpolicy="no-referrer"/);
+  assert.doesNotMatch(markup, /Load image|rel="preload"/);
+});
+
 it('defers Mermaid fences beyond the per-Markdown automatic diagram budget', () => {
   const fence = (index: number) => [
     '```mermaid',
diff --git a/packages/ui/src/attachment-image.tsx b/packages/ui/src/attachment-image.tsx
index 19b88e9a64c..66511959f60 100644
--- a/packages/ui/src/attachment-image.tsx
+++ b/packages/ui/src/attachment-image.tsx
@@ -19,6 +19,7 @@
 
 import {
   createContext,
+  useCallback,
   useContext,
   useEffect,
   useMemo,
@@ -37,6 +38,7 @@ export type ReadAttachmentBytes = (
 type SessionAttachmentContextValue = {
   sessionId: string;
   loadImage: (sessionId: string, artifactId: string) => Promise<string | undefined>;
+  invalidate(sessionId: string, artifactId: string): void;
 };
 
 const SessionAttachmentContext = createContext<SessionAttachmentContextValue | undefined>(undefined);
@@ -52,10 +54,19 @@ export function SessionAttachmentProvider(props: {
       const readBytes = props.readBytes;
       if (!readBytes) return undefined;
       const pending = new Map<string, Promise<string | undefined>>();
+      const ready = new Map<string, string>();
+      let cachedBytes = 0;
       return {
         sessionId: props.sessionId,
+        invalidate(sessionId: string, artifactId: string) {
+          const key = `${sessionId}\0${artifactId}`;
+          const cached = ready.get(key);
+          if (cached) { cachedBytes -= cached.length * 2; ready.delete(key); }
+        },
         loadImage(sessionId: string, artifactId: string) {
           const key = `${sessionId}\0${artifactId}`;
+          const cached = ready.get(key);
+          if (cached) { ready.delete(key); ready.set(key, cached); return Promise.resolve(cached); }
           const existing = pending.get(key);
           if (existing) return existing;
           const loaded = readBytes(sessionId, artifactId)
@@ -67,6 +78,14 @@ export function SessionAttachmentProvider(props: {
             })
             .catch(() => undefined);
           pending.set(key, loaded);
+          void loaded.then(src => {
+            if (!src) return;
+            ready.set(key, src); cachedBytes += src.length * 2;
+            while (cachedBytes > 32 * 1024 * 1024 && ready.size) {
+              const oldest = ready.keys().next().value!;
+              cachedBytes -= ready.get(oldest)!.length * 2; ready.delete(oldest);
+            }
+          });
           void loaded.finally(() => {
             if (pending.get(key) === loaded) pending.delete(key);
           });
@@ -88,24 +107,48 @@ export function useAttachmentImageSource(ref: {
   artifactId: string;
   sessionId?: string;
 } | undefined): string | undefined {
+  return useAttachmentImage(ref).src;
+}
+
+export function useAttachmentImage(ref: {
+  artifactId: string;
+  sessionId?: string;
+} | undefined) {
   const context = useContext(SessionAttachmentContext);
   const artifactId = ref?.artifactId;
   const sessionId = ref?.sessionId ?? context?.sessionId;
   const loadImage = context?.loadImage;
-  const [src, setSrc] = useState<string | undefined>(undefined);
+  const [attempt, setAttempt] = useState(0);
+  const retry = useCallback(() => {
+    if (artifactId && sessionId) context?.invalidate(sessionId, artifactId);
+    setAttempt((value) => value + 1);
+  }, [artifactId, sessionId, context]);
+  const request = useMemo(
+    () => artifactId && sessionId && loadImage
+      ? { artifactId, sessionId, loadImage, attempt }
+      : undefined,
+    [artifactId, sessionId, loadImage, attempt],
+  );
+  const [result, setResult] = useState<{
+    request: typeof request;
+    status: 'loading' | 'ready' | 'failed';
+    src?: string;
+  }>();
 
   useEffect(() => {
-    setSrc(undefined);
-    if (!artifactId || !sessionId || !loadImage) return;
+    if (!request) return;
+    setResult({ request, status: 'loading' });
     let cancelled = false;
-    loadImage(sessionId, artifactId)
+    request.loadImage(request.sessionId, request.artifactId)
       .then((loaded) => {
-        if (!cancelled) setSrc(loaded);
-      })
+        if (!cancelled) setResult({ request, status: loaded ? 'ready' : 'failed', src: loaded });
+      });
     return () => {
       cancelled = true;
     };
-  }, [artifactId, loadImage, sessionId]);
+  }, [request]);
 
-  return src;
+  if (!request) return { status: 'unavailable' as const, src: undefined, retry };
+  if (result?.request !== request) return { status: 'loading' as const, src: undefined, retry };
+  return { status: result.status, src: result.src, retry };
 }
diff --git a/packages/ui/src/chat-turn.tsx b/packages/ui/src/chat-turn.tsx
index 2d29af49c60..34a4fa565a4 100644
--- a/packages/ui/src/chat-turn.tsx
+++ b/packages/ui/src/chat-turn.tsx
@@ -752,6 +752,7 @@ export const TurnView = memo(function TurnView(props: {
                     key={`processing-${item.id}`}
                     activityObserved={props.activityObserved}
                     entries={item.children}
+                    turnId={turn.turnId}
                     running={!!props.liveStreaming}
                     statusRow={
                       index === activityProcessIndex && hasLiveStatus
@@ -767,6 +768,7 @@ export const TurnView = memo(function TurnView(props: {
                     key={timelineEntryKey(item, index)}
                     activityObserved={props.activityObserved}
                     item={item}
+                    turnId={turn.turnId}
                     onStreamingSettled={props.liveStreaming?.onStreamingSettled}
                     onOpenLinkedSession={props.onOpenLinkedSession}
                     initialLiveContent={props.liveStreaming?.initialLiveContent}
@@ -1288,7 +1290,7 @@ export function ModelProviderRetryIndicator(props: { retry: LiveProviderRetry })
  */
 type AssistantAnswerPhase = 'historical' | 'streaming' | 'settled';
 
-type AssistantAnswerBubbleProps =
+type AssistantAnswerBubbleProps = { imageIdentity?: { turnId: string; messageId: string } } & (
   | { text: string; phase: 'historical'; interrupted?: true }
   | {
       text: string;
@@ -1299,7 +1301,7 @@ type AssistantAnswerBubbleProps =
       truncated?: boolean;
       /** Called once when this answer's stream closes. */
       onSettled?: () => void;
-    };
+    });
 
 /**
  * The assistant's answer, in every state it can be in.
@@ -1346,6 +1348,7 @@ const AssistantAnswerBubble = memo(function AssistantAnswerBubble(props: Assista
     >
       <Markdown
         text={props.text}
+        imageIdentity={props.imageIdentity}
         streaming={props.phase === 'streaming'}
         settledText={settledText}
         // Names the surface, and not exclusively: the desktop Artifact
@@ -1399,6 +1402,7 @@ function timelineEntryKey(item: TurnTimelineItem, index: number): string {
 
 /** Render one timeline entry: reasoning disclosure / answer bubble / tool group. */
 const TurnTimelineEntry = memo(function TurnTimelineEntry(props: {
+  turnId?: string;
   activityObserved?: boolean;
   item: Exclude<TurnTimelineItem, { kind: 'user' }>;
   onStreamingSettled?: (messageId?: string) => void;
@@ -1426,9 +1430,10 @@ const TurnTimelineEntry = memo(function TurnTimelineEntry(props: {
     );
   }
   // Same component either way — a type swap here would remount the answer.
-  if (item.live !== true) return <AssistantAnswerBubble text={item.text} interrupted={item.interrupted} phase="historical" />;
+  if (item.live !== true) return <AssistantAnswerBubble imageIdentity={props.turnId ? { turnId: props.turnId, messageId: item.messageId } : undefined} text={item.text} interrupted={item.interrupted} phase="historical" />;
   return (
     <AssistantAnswerBubble
+      imageIdentity={props.turnId ? { turnId: props.turnId, messageId: item.messageId } : undefined}
       text={item.text}
       interrupted={item.interrupted}
       phase={item.complete === true ? 'settled' : 'streaming'}
@@ -1450,6 +1455,7 @@ const TurnTimelineEntry = memo(function TurnTimelineEntry(props: {
  * owns no chrome — keep the plain process label.
  */
 const ProcessingBlock = memo(function ProcessingBlock(props: {
+  turnId?: string;
   activityObserved?: boolean;
   entries: FoldedTimelineChild[];
   running: boolean;
@@ -1502,6 +1508,7 @@ const ProcessingBlock = memo(function ProcessingBlock(props: {
             key={timelineEntryKey(entry, index)}
             activityObserved={open && props.activityObserved !== false}
             item={entry}
+            turnId={props.turnId}
             onStreamingSettled={props.onStreamingSettled}
             onOpenLinkedSession={props.onOpenLinkedSession}
             initialLiveContent={props.initialLiveContent}
diff --git a/packages/ui/src/chat-view.tsx b/packages/ui/src/chat-view.tsx
index f59203a2152..3a3f0725721 100644
--- a/packages/ui/src/chat-view.tsx
+++ b/packages/ui/src/chat-view.tsx
@@ -17,6 +17,7 @@
  * under the License.
  */
 
+import { ImageDeliveryProvider } from './image-delivery.js';
 import {
   Fragment,
   useCallback,
@@ -294,6 +295,7 @@ export function ChatView(props: {
    * host-agnostic with no direct host-global access.
    */
   onReadAttachmentBytes?: ReadAttachmentBytes;
+  onResolveImageDelivery?: import('./image-delivery.js').ResolveImageDelivery;
   /**
    * Open a linked subagent child session in the main chat column (option A).
    * Threaded into linked subagent rows inside ToolTrow.
@@ -903,6 +905,7 @@ export function ChatView(props: {
 
   return (
     <MakaClientSessionScope sessionId={props.activeSession.id}>
+      <ImageDeliveryProvider sessionId={props.activeSession.id} resolve={props.onResolveImageDelivery}>
       <SessionAttachmentProvider
         sessionId={props.activeSession.id}
         readBytes={props.onReadAttachmentBytes}
@@ -1148,6 +1151,7 @@ export function ChatView(props: {
       </div>
       </section>
       </SessionAttachmentProvider>
+      </ImageDeliveryProvider>
     </MakaClientSessionScope>
   );
 }
diff --git a/packages/ui/src/image-delivery.tsx b/packages/ui/src/image-delivery.tsx
new file mode 100644
index 00000000000..22d31eab2a2
--- /dev/null
+++ b/packages/ui/src/image-delivery.tsx
@@ -0,0 +1,74 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { createContext, useCallback, useContext, useEffect, useMemo, useState, type ReactNode } from 'react';
+import type { ImageDeliveryRequest, ImageDeliveryResult } from '@maka/core/image-delivery';
+export type ResolveImageDelivery = (sessionId: string, request: ImageDeliveryRequest) => Promise<ImageDeliveryResult>;
+export const ImageMessageScope = createContext<{ turnId: string; messageId: string } | undefined>(undefined);
+const DeliveryContext = createContext<{ resolve(request: ImageDeliveryRequest): Promise<ImageDeliveryResult> } | undefined>(undefined);
+export function ImageDeliveryProvider(props: { sessionId: string; resolve?: ResolveImageDelivery; children: ReactNode }) {
+  const value = useMemo(() => {
+    if (!props.resolve) return undefined;
+    const resolve = props.resolve;
+    const pending = new Map<string, Promise<ImageDeliveryResult>>();
+    const ready = new Map<string, ImageDeliveryResult>();
+    return { resolve(request: ImageDeliveryRequest) {
+      const key = JSON.stringify([request.turnId, request.messageId, request.source]);
+      const cached = ready.get(key); if (cached) return Promise.resolve(cached);
+      const running = pending.get(key); if (running) return running;
+      const job = resolve(props.sessionId, request).catch((): ImageDeliveryResult => ({ status: 'failed', reason: 'read_failed' }));
+      pending.set(key, job);
+      void job.then(result => {
+        pending.delete(key);
+        if (result.status === 'ready') {
+          ready.set(key, result); if (ready.size > 128) ready.delete(ready.keys().next().value!);
+        }
+      });
+      return job;
+    }};
+  }, [props.resolve, props.sessionId]);
+  return <DeliveryContext.Provider value={value}>{props.children}</DeliveryContext.Provider>;
+}
+export function useImageDelivery(source: string, enabled: boolean) {
+  const scope = useContext(ImageMessageScope);
+  const context = useContext(DeliveryContext);
+  const [attempt, setAttempt] = useState(0);
+  const identity = useMemo(() => context && scope?.turnId && scope.messageId && enabled
+    ? { context, turnId: scope.turnId, messageId: scope.messageId, source, attempt } : undefined,
+    [context, scope?.turnId, scope?.messageId, source, attempt, enabled]);
+  const [settled, setSettled] = useState<{ identity: typeof identity; result: ImageDeliveryResult }>();
+  const retry = useCallback(() => setAttempt(a => a + 1), []);
+  useEffect(() => {
+    if (!identity) return;
+    let cancelled = false; let timer: ReturnType<typeof setTimeout> | undefined; let delay = 500;
+    const query = async (retry: boolean) => {
+      const result = await identity.context.resolve({ turnId: identity.turnId, messageId: identity.messageId, source: identity.source, ...(retry ? { retry: true } : {}) });
+      if (cancelled) return;
+      setSettled({ identity, result });
+      if (result.status === 'pending') {
+        timer = setTimeout(() => { void query(false); }, delay); delay = Math.min(5000, delay * 2);
+      }
+    };
+    void query(attempt > 0);
+    return () => { cancelled = true; clearTimeout(timer); };
+  }, [identity, attempt]);
+  const result: ImageDeliveryResult = !identity ? { status: 'unavailable' }
+    : settled?.identity === identity ? settled.result : { status: 'pending' };
+  return { ...result, retry, available: !!identity, checked: settled?.identity === identity };
+}
diff --git a/packages/ui/src/markdown-body.tsx b/packages/ui/src/markdown-body.tsx
index af17e36ee64..75203095778 100644
--- a/packages/ui/src/markdown-body.tsx
+++ b/packages/ui/src/markdown-body.tsx
@@ -29,6 +29,8 @@
  * product-specific trust boundaries around that renderer.
  */
 
+import { MarkdownImage } from './markdown-image.js';
+import { ImageMessageScope } from './image-delivery.js';
 import { useCallback, useContext, useRef, type ReactNode } from 'react';
 import {
   Markdown as AstryxMarkdown,
@@ -51,8 +53,6 @@ import {
   MarkdownMath,
   prepareMarkdownMath,
 } from './markdown-math.js';
-import { parseAttachmentResourceRef } from '@maka/core/attachments';
-import { useAttachmentImageSource } from './attachment-image.js';
 
 const BASE_MARKDOWN_COMPONENTS = {
   link: MarkdownLink,
@@ -144,6 +144,7 @@ const MARKDOWN_COMPONENTS = {
 
 export function MarkdownBody(props: {
   text: string;
+  imageIdentity?: { turnId: string; messageId: string };
   streaming?: boolean;
   settledText?: string;
   density?: 'default' | 'compact';
@@ -162,46 +163,48 @@ export function MarkdownBody(props: {
     : MARKDOWN_COMPONENTS[density];
 
   return (
-    <div
-      data-maka-contract="markdown"
-      data-maka-script={hasHanProse(props.text) ? 'han' : undefined}
-      // Migration-only identity wrapper. `display: contents` gives the
-      // contract harness a stable declared subtree without adding a layout
-      // box or interfering with Astryx's document root.
-      style={{ display: 'contents' }}
-    >
-      <AstryxMarkdown
-        autolink="gfm"
-        // Markdown holds no reading measure; the container it lands in does.
-        //
-        // Astryx caps prose at 680px by default but renders a supplied
-        // `components.code` bare — no spacing, no width, no alignment. Maka
-        // always supplies one, so any container that leans on the default gets
-        // prose at 680 and code blocks at whatever the container is: two right
-        // edges, which is the defect this whole change exists to remove. One
-        // authority per column, and it is the container.
-        contentWidth="100%"
-        // Chosen by the caller, and defaulting to document rhythm.
-        //
-        // The transcript passes `compact`: Astryx's default heading spacing
-        // assumes a page with a handful of sections, while an agent turn
-        // emits headings every few lines, so the default margins push each
-        // one into its own visual slab. That is the same argument that
-        // flattens transcript heading SIZES in styles/chat-message.css — and
-        // that rule is scoped to `.maka-turn` precisely because the other
-        // caller, the Daily Review panel, renders a report, which is a
-        // document. Hardcoding `compact` here contradicted that scoping: the
-        // review kept full heading sizes but got transcript block spacing,
-        // the one combination neither half of the argument asks for.
-        density={density}
-        components={components}
-        isStreaming={props.streaming}
-        settledText={props.settledText}
-        transformSource={transformMathSource}
+    <ImageMessageScope.Provider value={props.imageIdentity}>
+      <div
+        data-maka-contract="markdown"
+        data-maka-script={hasHanProse(props.text) ? 'han' : undefined}
+        // Migration-only identity wrapper. `display: contents` gives the
+        // contract harness a stable declared subtree without adding a layout
+        // box or interfering with Astryx's document root.
+        style={{ display: 'contents' }}
       >
-        {budgetedText}
-      </AstryxMarkdown>
-    </div>
+        <AstryxMarkdown
+          autolink="gfm"
+          // Markdown holds no reading measure; the container it lands in does.
+          //
+          // Astryx caps prose at 680px by default but renders a supplied
+          // `components.code` bare — no spacing, no width, no alignment. Maka
+          // always supplies one, so any container that leans on the default gets
+          // prose at 680 and code blocks at whatever the container is: two right
+          // edges, which is the defect this whole change exists to remove. One
+          // authority per column, and it is the container.
+          contentWidth="100%"
+          // Chosen by the caller, and defaulting to document rhythm.
+          //
+          // The transcript passes `compact`: Astryx's default heading spacing
+          // assumes a page with a handful of sections, while an agent turn
+          // emits headings every few lines, so the default margins push each
+          // one into its own visual slab. That is the same argument that
+          // flattens transcript heading SIZES in styles/chat-message.css — and
+          // that rule is scoped to `.maka-turn` precisely because the other
+          // caller, the Daily Review panel, renders a report, which is a
+          // document. Hardcoding `compact` here contradicted that scoping: the
+          // review kept full heading sizes but got transcript block spacing,
+          // the one combination neither half of the argument asks for.
+          density={density}
+          components={components}
+          isStreaming={props.streaming}
+          settledText={props.settledText}
+          transformSource={transformMathSource}
+        >
+          {budgetedText}
+        </AstryxMarkdown>
+      </div>
+    </ImageMessageScope.Provider>
   );
 }
 
@@ -271,37 +274,6 @@ function MarkdownCode(props: {
   );
 }
 
-function MarkdownImage(props: { src: string; alt: string }) {
-  const attachment = parseAttachmentResourceRef(props.src);
-  const attachmentSrc = useAttachmentImageSource(
-    attachment ? { artifactId: attachment.artifactId } : undefined,
-  );
-  if (attachment) {
-    if (!attachmentSrc) return <span>[{props.alt}]</span>;
-    return (
-      <img
-        className="maka-markdown-attachment-image"
-        src={attachmentSrc}
-        alt={props.alt}
-      />
-    );
-  }
-  if (!isSafeMarkdownImageUrl(props.src)) return <span>[{props.alt}]</span>;
-  // Remote images can be badges or sentence-level icons, so preserve Maka's
-  // existing inline presentation. Session attachments above are content
-  // previews and deliberately own a block presentation instead.
-  return <img src={props.src} alt={props.alt} style={{ display: 'inline-block' }} />;
-}
-
-function isSafeMarkdownImageUrl(url: string): boolean {
-  try {
-    const protocol = new URL(url).protocol;
-    return protocol === 'http:' || protocol === 'https:';
-  } catch {
-    return false;
-  }
-}
-
 /**
  * Route internal Markdown navigation through Maka's typed allowlist. Invalid
  * internal destinations never fall through to the operating system, and
diff --git a/packages/ui/src/markdown-image.tsx b/packages/ui/src/markdown-image.tsx
new file mode 100644
index 00000000000..46121a69ff6
--- /dev/null
+++ b/packages/ui/src/markdown-image.tsx
@@ -0,0 +1,94 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { useEffect, useRef, useState } from 'react';
+import { useLightbox } from '@astryxdesign/core';
+import { Link } from '@astryxdesign/core/Link';
+import { parseAttachmentResourceRef } from '@maka/core/attachments';
+import { useAttachmentImage } from './attachment-image.js';
+import { useImageDelivery } from './image-delivery.js';
+import { getSharedUiCopy } from './shared-ui-copy.js';
+import { useUiLocale } from './locale-context.js';
+
+/** Presentation only: Host resolves local addresses and archives; UI receives artifact identities. */
+export function MarkdownImage(props: { src: string; alt: string }) {
+  return <ImageResource key={props.src} {...props} />;
+}
+function ImageResource(props: { src: string; alt: string }) {
+  const copy = getSharedUiCopy(useUiLocale()).markdown;
+  const anchor = useRef<HTMLSpanElement>(null);
+  const [visible, setVisible] = useState(typeof IntersectionObserver === 'undefined');
+  useEffect(() => {
+    if (visible || !anchor.current) return;
+    const observer = new IntersectionObserver(entries => {
+      if (entries.some(entry => entry.isIntersecting)) { setVisible(true); observer.disconnect(); }
+    }, { rootMargin: '300px' });
+    observer.observe(anchor.current); return () => observer.disconnect();
+  }, [visible]);
+  const explicit = parseAttachmentResourceRef(props.src);
+  const delivery = useImageDelivery(props.src, visible && !explicit);
+  const artifactId = explicit?.artifactId ?? (delivery.status === 'ready' ? delivery.artifactId : undefined);
+  const image = useAttachmentImage(visible && artifactId ? { artifactId } : undefined);
+  const [failedSource, setFailedSource] = useState<string>();
+  const [attempt, setAttempt] = useState(0);
+  const remote = isWebImage(props.src);
+  const source = artifactId ? image.src : visible && remote && (!delivery.available || delivery.checked) ? props.src : undefined;
+  const failed = !!source && failedSource === source || !!artifactId && image.status === 'failed';
+  const retry = () => {
+    setFailedSource(undefined); setAttempt(a => a + 1);
+    if (artifactId) image.retry(); else delivery.retry();
+  };
+  const sourceActions = <span className="maka-markdown-image-actions">
+    <button type="button" onClick={retry}>{copy.imageRetry}</button>
+    {remote && <Link href={props.src} isExternalLink type="inherit" hasUnderline>{copy.imageOpen}</Link>}
+  </span>;
+  let message: string | undefined;
+  if (failed) message = copy.imageLoadFailed;
+  else if (!source) message = !visible ? copy.imageLoading
+    : explicit && image.status === 'unavailable' ? copy.imageUnavailable
+    : delivery.status === 'failed' ? copy.imageArchiveFailure(delivery.reason)
+    : delivery.status === 'pending' || artifactId ? copy.imageLoading : copy.imageUnsupported;
+  return <span ref={anchor} className="maka-markdown-image-resource" data-maka-image-state={message ? failed ? 'failed' : 'loading' : 'ready'}>
+    {message ? <span className="maka-markdown-image-placeholder">
+      {props.alt && <span className="maka-markdown-image-caption">{props.alt}</span>}
+      <span role="status">{message}</span>
+      {(failed || delivery.status === 'failed') && sourceActions}
+    </span> : source && <DisplayImage key={`${source}\0${attempt}`} src={source} alt={props.alt} onError={() => setFailedSource(source)} />}
+    {!explicit && delivery.status === 'pending' && remote && source && <span className="maka-markdown-image-saving" role="status">{copy.imageSaving}</span>}
+    {!explicit && delivery.status === 'failed' && remote && source && !failed && <span className="maka-markdown-image-saving" role="status">
+      {copy.imageArchiveFailure(delivery.reason)} {sourceActions}
+    </span>}
+  </span>;
+}
+function DisplayImage(props: { src: string; alt: string; onError(): void }) {
+  const copy = getSharedUiCopy(useUiLocale()).markdown;
+  const [loaded, setLoaded] = useState(false);
+  const lightbox = useLightbox({ media: { src: props.src, alt: props.alt }, hasZoom: true });
+  return <>
+    {!loaded && <span className="maka-markdown-image-loading" role="status">{copy.imageLoading}</span>}
+    <button type="button" className="maka-markdown-image-preview" aria-label={copy.imageExpand(props.alt)} onClick={() => lightbox.open()}>
+      <img src={props.src} alt={props.alt} loading="lazy" decoding="async" referrerPolicy="no-referrer"
+        className="maka-markdown-attachment-image" onLoad={() => setLoaded(true)} onError={props.onError} />
+    </button>
+    {lightbox.isOpen && lightbox.element}
+  </>;
+}
+function isWebImage(source: string): boolean {
+  try { return ['http:', 'https:'].includes(new URL(source).protocol); } catch { return false; }
+}
diff --git a/packages/ui/src/markdown.tsx b/packages/ui/src/markdown.tsx
index 529795332f8..3cb73d1f1eb 100644
--- a/packages/ui/src/markdown.tsx
+++ b/packages/ui/src/markdown.tsx
@@ -55,6 +55,7 @@ const MarkdownBody = lazy(() => import('./markdown-body.js').then((m) => ({ defa
 
 export function Markdown(props: {
   text: string;
+  imageIdentity?: { turnId: string; messageId: string };
   streaming?: boolean;
   settledText?: string;
   /** Block rhythm. Transcript turns pass `compact`; documents leave it. */
@@ -78,6 +79,7 @@ export function Markdown(props: {
     >
       <MarkdownBody
         text={safeText}
+        imageIdentity={props.imageIdentity}
         streaming={streaming}
         settledText={safeSettledText}
         density={props.density}
diff --git a/packages/ui/src/shared-ui-copy.ts b/packages/ui/src/shared-ui-copy.ts
index 74d2aed6366..5f85e840e95 100644
--- a/packages/ui/src/shared-ui-copy.ts
+++ b/packages/ui/src/shared-ui-copy.ts
@@ -30,6 +30,15 @@ export interface SharedUiCopy {
   markdown: {
     invalidInternalLink: string;
     unsafeLink: string;
+    imageLoading: string;
+    imageSaving: string;
+    imageExpand: (alt: string) => string;
+    imageArchiveFailure: (reason: import('@maka/core/image-delivery').ImageDeliveryFailure) => string;
+    imageUnavailable: string;
+    imageLoadFailed: string;
+    imageUnsupported: string;
+    imageRetry: string;
+    imageOpen: string;
     taskList: string;
     table: string;
     checkbox: string;
@@ -125,6 +134,15 @@ const SHARED_UI_COPY = {
     markdown: {
       invalidInternalLink: '内部链接无效',
       unsafeLink: '链接不安全',
+      imageLoading: '正在加载图片…',
+      imageSaving: '正在保存图片…',
+      imageExpand: (alt) => alt ? `放大图片：${alt}` : '放大图片',
+      imageArchiveFailure: (reason) => reason === 'quota_exceeded' ? '图片未保存：存储配额已满。' : reason === 'too_large' ? '图片未保存：超过 2 MiB 自动保存上限。' : reason === 'not_allowed' ? '图片未保存：当前权限不允许读取。' : '图片未保存，原文件或链接失效后可能无法查看。',
+      imageUnavailable: '当前无法读取图片附件。',
+      imageLoadFailed: '图片加载失败，请重试。',
+      imageUnsupported: '此图片地址无法直接显示，请将图片作为会话附件发送。',
+      imageRetry: '重试',
+      imageOpen: '在浏览器中打开',
       taskList: '任务列表',
       table: '表格',
       checkbox: '复选框',
@@ -205,6 +223,15 @@ const SHARED_UI_COPY = {
     markdown: {
       invalidInternalLink: '內部連結無效',
       unsafeLink: '連結不安全',
+      imageLoading: '正在載入圖片…',
+      imageSaving: '正在儲存圖片…',
+      imageExpand: (alt) => alt ? `放大圖片：${alt}` : '放大圖片',
+      imageArchiveFailure: (reason) => reason === 'quota_exceeded' ? '圖片未儲存：儲存配額已滿。' : reason === 'too_large' ? '圖片未儲存：超過 2 MiB 自動儲存上限。' : reason === 'not_allowed' ? '圖片未儲存：目前權限不允許讀取。' : '圖片未儲存，原檔案或連結失效後可能無法查看。',
+      imageUnavailable: '目前無法讀取圖片附件。',
+      imageLoadFailed: '圖片載入失敗，請重試。',
+      imageUnsupported: '此圖片位址無法直接顯示，請將圖片作為對話附件傳送。',
+      imageRetry: '重試',
+      imageOpen: '在瀏覽器中開啟',
       taskList: '任務列表',
       table: '表格',
       checkbox: '核取方塊',
@@ -285,6 +312,15 @@ const SHARED_UI_COPY = {
     markdown: {
       invalidInternalLink: 'Invalid internal link',
       unsafeLink: 'Unsafe link',
+      imageLoading: 'Loading image…',
+      imageSaving: 'Saving image…',
+      imageExpand: (alt) => alt ? `Enlarge image: ${alt}` : 'Enlarge image',
+      imageArchiveFailure: (reason) => reason === 'quota_exceeded' ? 'Image not saved: storage quota reached.' : reason === 'too_large' ? 'Image not saved: exceeds the 2 MiB automatic save limit.' : reason === 'not_allowed' ? 'Image not saved: current permissions do not allow reading it.' : 'Image not saved. It may become unavailable if the original file or link expires.',
+      imageUnavailable: 'This image attachment is unavailable here.',
+      imageLoadFailed: 'Could not load the image. Try again.',
+      imageUnsupported: 'This image address cannot be displayed. Send the image as a chat attachment.',
+      imageRetry: 'Retry',
+      imageOpen: 'Open in browser',
       taskList: 'Task list',
       table: 'Table',
       checkbox: 'Checkbox',
diff --git a/packages/ui/src/styles.css b/packages/ui/src/styles.css
index 65ee07adba2..8241c40bb3c 100644
--- a/packages/ui/src/styles.css
+++ b/packages/ui/src/styles.css
@@ -613,6 +613,51 @@
   margin-block: var(--space-3) var(--space-4);
 }
 
+.maka-markdown-image-placeholder {
+  display: inline-flex;
+  flex-direction: column;
+  gap: var(--space-2);
+  max-width: 100%;
+  padding: var(--space-3);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-surface);
+  color: var(--muted-foreground);
+  overflow-wrap: anywhere;
+}
+.maka-markdown-image-caption { color: var(--foreground); }
+.maka-markdown-image-actions {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: var(--space-3);
+}
+.maka-markdown-image-actions button {
+  align-self: start;
+  border: 1px solid var(--border);
+  border-radius: var(--radius-control);
+  padding: var(--space-1) var(--space-2);
+  background: var(--background);
+  color: var(--foreground);
+  font: inherit;
+  cursor: pointer;
+}
+
+.maka-markdown-image-resource { display: inline-block; position: relative; max-width: 100%; }
+.maka-markdown-image-preview {
+  display: inline-block;
+  max-width: 100%;
+  padding: 0;
+  border: 0;
+  border-radius: var(--radius-control);
+  background: transparent;
+  cursor: zoom-in;
+  overflow: hidden;
+}
+.maka-markdown-image-preview:focus-visible { outline: 2px solid var(--ring); outline-offset: 2px; }
+.maka-markdown-image-preview img { margin: 0; max-height: 480px; object-fit: contain; }
+.maka-markdown-image-loading { display: block; color: var(--muted-foreground); font-size: var(--maka-font-size-sm); }
+.maka-markdown-image-saving { display: block; color: var(--muted-foreground); font-size: var(--maka-font-size-sm); margin-block-start: var(--space-1); }
+
 /* Markdown code renderers are custom components so Mermaid can be loaded only
    for settled Mermaid fences. Astryx skips its own spacing wrapper when
    `components.code` is set, so the custom block sits directly in the document

From a48ea29151624b9dfef8b5b58377ec6a9c52b49b Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Mon, 5 Oct 2026 23:38:11 +0800
Subject: [PATCH 02/37] fix(ci): use Astryx image controls and update
 dependency notices

Generated-by: Codex (GPT-6)
---
 .../licenses/npm/THIRD_PARTY_NOTICES.txt      | 53 +++++++++++++++++++
 docs/astryx-surface-file-inventory.md         |  4 +-
 docs/astryx-surface-file-inventory.paths      |  2 +
 .../scripts/markdown-images.browser.test.mjs  |  8 ++-
 packages/ui/src/markdown-image.tsx            | 14 ++---
 packages/ui/src/styles.css                    | 22 ++------
 6 files changed, 77 insertions(+), 26 deletions(-)

diff --git a/apps/desktop/resources/licenses/npm/THIRD_PARTY_NOTICES.txt b/apps/desktop/resources/licenses/npm/THIRD_PARTY_NOTICES.txt
index 7e62f8d604c..dbe751bc9b9 100644
--- a/apps/desktop/resources/licenses/npm/THIRD_PARTY_NOTICES.txt
+++ b/apps/desktop/resources/licenses/npm/THIRD_PARTY_NOTICES.txt
@@ -12696,6 +12696,59 @@ This software is provided by the copyright holders and contributors “as is”
 
 ================================================================================
 
+Package: marked@18.0.11
+Declared license: MIT
+Selected license: MIT
+Repository: git+https://github.com/markedjs/marked.git
+
+--- LICENSE ---
+# License information
+
+## Contribution License Agreement
+
+If you contribute code to this project, you are implicitly allowing your code
+to be distributed under the MIT license. You are also implicitly verifying that
+all code is your original work. `</legalese>`
+
+## Marked
+
+Copyright (c) 2018+, MarkedJS (https://github.com/markedjs/)
+Copyright (c) 2011-2018, Christopher Jeffrey (https://github.com/chjj/)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+
+## Markdown
+
+Copyright © 2004, John Gruber
+http://daringfireball.net/
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+
+* Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+* Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+* Neither the name “Markdown” nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+
+This software is provided by the copyright holders and contributors “as is” and any express or implied warranties, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose are disclaimed. In no event shall the copyright owner or contributors be liable for any direct, indirect, incidental, special, exemplary, or consequential damages (including, but not limited to, procurement of substitute goods or services; loss of use, data, or profits; or business interruption) however caused and on any theory of liability, whether in contract, strict liability, or tort (including negligence or otherwise) arising in any way out of the use of this software, even if advised of the possibility of such damage.
+
+================================================================================
+
 Package: math-intrinsics@1.1.0
 Declared license: MIT
 Selected license: MIT
diff --git a/docs/astryx-surface-file-inventory.md b/docs/astryx-surface-file-inventory.md
index 3fa17e25700..ba228067207 100644
--- a/docs/astryx-surface-file-inventory.md
+++ b/docs/astryx-surface-file-inventory.md
@@ -6,7 +6,7 @@ Generated against `@astryxdesign/core@0.6.3` (195 component exports).
 
 Wiki bar: Design Conventions · API Use-the-System · Theming · Container Padding.
 
-**Totals:** 331 files — blocker 0, reimplementation 0, polish 4, aligned 327.
+**Totals:** 333 files — blocker 0, reimplementation 0, polish 4, aligned 329.
 
 ## Exclusions (explicit)
 
@@ -306,11 +306,13 @@ Wiki bar: Design Conventions · API Use-the-System · Theming · Container Paddi
 | `packages/ui/src/executor-model-picker.tsx` | ui-composition | Button, Popover | aligned — uses Astryx (Button, Popover) | aligned |
 | `packages/ui/src/form-interaction-prompt.tsx` | ui-composition | Button, CheckboxInput, RadioList, RadioListItem, Selector, Text, TextInput | aligned — uses Astryx (Button, CheckboxInput, RadioList, RadioListItem, Selector, Text, TextInput) | aligned |
 | `packages/ui/src/icons.tsx` | ui-composition | none | aligned — no raw controls; no Astryx JSX usage | aligned |
+| `packages/ui/src/image-delivery.tsx` | ui-composition | none | aligned — no raw controls; no Astryx JSX usage | aligned |
 | `packages/ui/src/inline-reference.tsx` | ui-composition | ChatTokenizedText | aligned — uses Astryx (ChatTokenizedText) | aligned |
 | `packages/ui/src/inline-rename-input.tsx` | ui-composition | TextInput | aligned — uses Astryx (TextInput) | aligned |
 | `packages/ui/src/locale-context.tsx` | ui-composition | none | aligned — no raw controls; no Astryx JSX usage | aligned |
 | `packages/ui/src/maka-wordmark.tsx` | ui-composition | none | aligned — no raw controls; no Astryx JSX usage | aligned |
 | `packages/ui/src/markdown-body.tsx` | ui-composition | CodeBlock, Link, Markdown | aligned — uses Astryx (CodeBlock, Link, Markdown) | aligned |
+| `packages/ui/src/markdown-image.tsx` | ui-composition | Button, Link | aligned — uses Astryx (Button, Link) | aligned |
 | `packages/ui/src/markdown-math.tsx` | ui-composition | none | aligned — no raw controls; no Astryx JSX usage | aligned |
 | `packages/ui/src/markdown.tsx` | ui-composition | none | aligned — no raw controls; no Astryx JSX usage | aligned |
 | `packages/ui/src/mermaid-diagram.tsx` | ui-composition | Button, CodeBlock, Collapsible, Dialog, IconButton, Toolbar | aligned — uses Astryx (Button, CodeBlock, Collapsible, Dialog, IconButton, Toolbar) | aligned |
diff --git a/docs/astryx-surface-file-inventory.paths b/docs/astryx-surface-file-inventory.paths
index ea0a82ee5ac..ac4629e2d4b 100644
--- a/docs/astryx-surface-file-inventory.paths
+++ b/docs/astryx-surface-file-inventory.paths
@@ -276,11 +276,13 @@ packages/ui/src/directory-reference-chip.tsx
 packages/ui/src/executor-model-picker.tsx
 packages/ui/src/form-interaction-prompt.tsx
 packages/ui/src/icons.tsx
+packages/ui/src/image-delivery.tsx
 packages/ui/src/inline-reference.tsx
 packages/ui/src/inline-rename-input.tsx
 packages/ui/src/locale-context.tsx
 packages/ui/src/maka-wordmark.tsx
 packages/ui/src/markdown-body.tsx
+packages/ui/src/markdown-image.tsx
 packages/ui/src/markdown-math.tsx
 packages/ui/src/markdown.tsx
 packages/ui/src/mermaid-diagram.tsx
diff --git a/packages/ui/scripts/markdown-images.browser.test.mjs b/packages/ui/scripts/markdown-images.browser.test.mjs
index abfca5e0509..fd6f964a6b0 100644
--- a/packages/ui/scripts/markdown-images.browser.test.mjs
+++ b/packages/ui/scripts/markdown-images.browser.test.mjs
@@ -120,7 +120,9 @@ test('remote image loads automatically under the actual desktop CSP, without sen
     assert.equal(await page.getByRole('button', { name: 'Load image', exact: true }).count(), 0);
     await loaded(page);
     assert.deepEqual(requests, [{ path: '/image.png', referer: undefined }]);
-    assert.equal(await page.getByRole('status').count(), 0);
+    // Astryx Button keeps an empty live region for asynchronous actions.
+    await page.getByText('Loading image…', { exact: true }).waitFor({ state: 'hidden' });
+    assert.equal(await page.getByRole('status').filter({ hasText: /\S/ }).count(), 0);
   } finally { await page.close(); }
 });
 
@@ -185,7 +187,9 @@ test('a new remote image previews during archival and switches to saved bytes af
     await page.getByText('Saving image…').waitFor();
     assert.equal(requests.length, 1);
     await page.waitForFunction(() => [...document.images].some(img=>img.src.startsWith('data:image/png;') && img.naturalWidth===1));
-    assert.equal(await page.getByRole('status').count(), 0);
+    await page.getByText('Loading image…', { exact: true }).waitFor({ state: 'hidden' });
+    await page.getByText('Saving image…', { exact: true }).waitFor({ state: 'hidden' });
+    assert.equal(await page.getByRole('status').filter({ hasText: /\S/ }).count(), 0);
     assert.equal(await page.evaluate(() => window.deliveryQueries), 2);
     assert.equal(requests.length, 1);
   } finally { await page.close(); }
diff --git a/packages/ui/src/markdown-image.tsx b/packages/ui/src/markdown-image.tsx
index 46121a69ff6..a7a8911ae64 100644
--- a/packages/ui/src/markdown-image.tsx
+++ b/packages/ui/src/markdown-image.tsx
@@ -18,7 +18,7 @@
  */
 
 import { useEffect, useRef, useState } from 'react';
-import { useLightbox } from '@astryxdesign/core';
+import { Button, useLightbox } from '@astryxdesign/core';
 import { Link } from '@astryxdesign/core/Link';
 import { parseAttachmentResourceRef } from '@maka/core/attachments';
 import { useAttachmentImage } from './attachment-image.js';
@@ -55,7 +55,7 @@ function ImageResource(props: { src: string; alt: string }) {
     if (artifactId) image.retry(); else delivery.retry();
   };
   const sourceActions = <span className="maka-markdown-image-actions">
-    <button type="button" onClick={retry}>{copy.imageRetry}</button>
+    <Button variant="ghost" size="sm" label={copy.imageRetry} onClick={retry} />
     {remote && <Link href={props.src} isExternalLink type="inherit" hasUnderline>{copy.imageOpen}</Link>}
   </span>;
   let message: string | undefined;
@@ -82,10 +82,12 @@ function DisplayImage(props: { src: string; alt: string; onError(): void }) {
   const lightbox = useLightbox({ media: { src: props.src, alt: props.alt }, hasZoom: true });
   return <>
     {!loaded && <span className="maka-markdown-image-loading" role="status">{copy.imageLoading}</span>}
-    <button type="button" className="maka-markdown-image-preview" aria-label={copy.imageExpand(props.alt)} onClick={() => lightbox.open()}>
-      <img src={props.src} alt={props.alt} loading="lazy" decoding="async" referrerPolicy="no-referrer"
-        className="maka-markdown-attachment-image" onLoad={() => setLoaded(true)} onError={props.onError} />
-    </button>
+    <span className="maka-markdown-image-preview">
+      <Button variant="ghost" label={copy.imageExpand(props.alt)} onClick={() => lightbox.open()}>
+        <img src={props.src} alt={props.alt} loading="lazy" decoding="async" referrerPolicy="no-referrer"
+          className="maka-markdown-attachment-image" onLoad={() => setLoaded(true)} onError={props.onError} />
+      </Button>
+    </span>
     {lightbox.isOpen && lightbox.element}
   </>;
 }
diff --git a/packages/ui/src/styles.css b/packages/ui/src/styles.css
index 8241c40bb3c..3fe1137b8b3 100644
--- a/packages/ui/src/styles.css
+++ b/packages/ui/src/styles.css
@@ -631,29 +631,17 @@
   align-items: center;
   gap: var(--space-3);
 }
-.maka-markdown-image-actions button {
-  align-self: start;
-  border: 1px solid var(--border);
-  border-radius: var(--radius-control);
-  padding: var(--space-1) var(--space-2);
-  background: var(--background);
-  color: var(--foreground);
-  font: inherit;
-  cursor: pointer;
-}
-
 .maka-markdown-image-resource { display: inline-block; position: relative; max-width: 100%; }
 .maka-markdown-image-preview {
   display: inline-block;
   max-width: 100%;
+}
+/* Keep the image's natural dimensions; Astryx owns interaction and focus styling. */
+.maka-markdown-image-preview .astryx-button {
+  max-width: 100%;
+  height: auto;
   padding: 0;
-  border: 0;
-  border-radius: var(--radius-control);
-  background: transparent;
-  cursor: zoom-in;
-  overflow: hidden;
 }
-.maka-markdown-image-preview:focus-visible { outline: 2px solid var(--ring); outline-offset: 2px; }
 .maka-markdown-image-preview img { margin: 0; max-height: 480px; object-fit: contain; }
 .maka-markdown-image-loading { display: block; color: var(--muted-foreground); font-size: var(--maka-font-size-sm); }
 .maka-markdown-image-saving { display: block; color: var(--muted-foreground); font-size: var(--maka-font-size-sm); margin-block-start: var(--space-1); }

From 30fa271a3156787eb22348bff9683209f5a19d74 Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Tue, 6 Oct 2026 00:03:36 +0800
Subject: [PATCH 03/37] fix(chat): recover streamed images and bound local
 capture

Reuse existing image controls and filesystem permissions, separate chat image validation from model input limits, and honor capture deadlines and Host drain. Add regression coverage for streaming, wide images, FIFOs and cancellation.

Generated-by: Codex (GPT-6)
---
 docs/astryx-surface-file-inventory.md         |  2 +-
 .../src/__tests__/chat-image-delivery.test.ts | 50 ++++++++++-
 .../src/server/chat-image-delivery.ts         | 10 ++-
 .../builtin-tools-file-worker.test.ts         |  8 +-
 .../runtime/src/__tests__/image-file.test.ts  | 89 +++++++++++++++++++
 packages/runtime/src/builtin-tools.ts         |  2 +-
 packages/runtime/src/filesystem-executor.ts   |  2 +
 .../src/filesystem-worker/operations.ts       |  4 +-
 .../runtime/src/filesystem-worker/protocol.ts |  8 +-
 packages/runtime/src/image-file-reader.ts     |  5 +-
 packages/runtime/src/image-file.ts            | 43 +++++++--
 packages/runtime/src/workspace-executor.ts    |  6 +-
 .../scripts/markdown-images.browser.test.mjs  | 50 ++++++++---
 packages/ui/src/image-delivery.tsx            | 12 +--
 packages/ui/src/markdown-body.tsx             |  2 +-
 packages/ui/src/markdown-image.tsx            | 10 ++-
 packages/ui/src/styles.css                    | 12 +--
 17 files changed, 265 insertions(+), 50 deletions(-)

diff --git a/docs/astryx-surface-file-inventory.md b/docs/astryx-surface-file-inventory.md
index ba228067207..cd1242c9b15 100644
--- a/docs/astryx-surface-file-inventory.md
+++ b/docs/astryx-surface-file-inventory.md
@@ -312,7 +312,7 @@ Wiki bar: Design Conventions · API Use-the-System · Theming · Container Paddi
 | `packages/ui/src/locale-context.tsx` | ui-composition | none | aligned — no raw controls; no Astryx JSX usage | aligned |
 | `packages/ui/src/maka-wordmark.tsx` | ui-composition | none | aligned — no raw controls; no Astryx JSX usage | aligned |
 | `packages/ui/src/markdown-body.tsx` | ui-composition | CodeBlock, Link, Markdown | aligned — uses Astryx (CodeBlock, Link, Markdown) | aligned |
-| `packages/ui/src/markdown-image.tsx` | ui-composition | Button, Link | aligned — uses Astryx (Button, Link) | aligned |
+| `packages/ui/src/markdown-image.tsx` | ui-composition | Button, IconButton, Link | aligned — uses Astryx (Button, IconButton, Link) | aligned |
 | `packages/ui/src/markdown-math.tsx` | ui-composition | none | aligned — no raw controls; no Astryx JSX usage | aligned |
 | `packages/ui/src/markdown.tsx` | ui-composition | none | aligned — no raw controls; no Astryx JSX usage | aligned |
 | `packages/ui/src/mermaid-diagram.tsx` | ui-composition | Button, CodeBlock, Collapsible, Dialog, IconButton, Toolbar | aligned — uses Astryx (Button, CodeBlock, Collapsible, Dialog, IconButton, Toolbar) | aligned |
diff --git a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
index 5437d9b46fb..dcc1bc2d94a 100644
--- a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
+++ b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
@@ -25,7 +25,10 @@ import { join } from 'node:path';
 import { createServer } from 'node:http';
 import { openInteractiveArtifactStoreForWrite } from '@maka/storage/artifact-stores';
 import { resolveStorageRoot, tryAcquireInteractiveRootOwner } from '@maka/storage/root-authority';
-import { ChatImageDeliveryService } from '../server/chat-image-delivery.js';
+import {
+  ChatImageDeliveryService,
+  type ChatImageDeliveryPorts,
+} from '../server/chat-image-delivery.js';
 import { chatImageSources } from '../server/chat-image-markdown.js';
 import { checkedChatImage, downloadChatImage } from '../server/chat-image-source.js';
 import { IMAGE_DELIVERY_OPERATION_SPECS } from '../protocol/image-delivery.js';
@@ -40,7 +43,10 @@ const REQUEST = {
   messageId: 'message-1',
   source: '/tmp/image.png',
 };
-async function fixture(limits?: { sessionBytes: number; workspaceBytes: number }) {
+async function fixture(
+  limits?: { sessionBytes: number; workspaceBytes: number },
+  readLocalImage?: ChatImageDeliveryPorts['readLocalImage'],
+) {
   const root = await mkdtemp(join(tmpdir(), 'maka-image-delivery-'));
   const owner = await tryAcquireInteractiveRootOwner(
     await resolveStorageRoot({ path: root, kind: 'interactive' }),
@@ -59,8 +65,9 @@ async function fixture(limits?: { sessionBytes: number; workspaceBytes: number }
     limits,
     isPresent: async () => present,
     readMessage: async (i) => messages.get(i.messageId),
-    readLocalImage: async (_sessionId, path) => {
+    readLocalImage: async (sessionId, path, signal) => {
       reads++;
+      if (readLocalImage) return readLocalImage(sessionId, path, signal);
       return checkedChatImage(await readFile(path));
     },
     acquireResidency: () => {
@@ -98,6 +105,43 @@ async function fixture(limits?: { sessionBytes: number; workspaceBytes: number }
     },
   };
 }
+
+test('Host drain releases both capture slots even when a source reader ignores cancellation', {
+  timeout: 2000,
+}, async () => {
+  const f = await fixture(undefined, () => new Promise(() => {}));
+  try {
+    observe(f.service, '/tmp/blocked-1.png');
+    observe(f.service, '/tmp/blocked-2.png', 'session-1', 'message-2');
+    while (f.reads < 2) await new Promise((resolve) => setImmediate(resolve));
+    await f.service.close();
+    assert.equal(f.leases, 0);
+    assert.deepEqual(f.errors, []);
+  } finally {
+    await f.close();
+  }
+});
+test('a stalled local source expires within its read budget and can be retried', {
+  timeout: 15000,
+}, async () => {
+  let reads = 0;
+  const f = await fixture(undefined, async () => {
+    if (++reads === 1) return new Promise(() => {});
+    return checkedChatImage(PNG);
+  });
+  try {
+    observe(f.service, REQUEST.source);
+    await f.service.waitForIdle();
+    assert.deepEqual(await f.service.resolve(REQUEST), { status: 'failed', reason: 'read_failed' });
+    assert.equal(f.leases, 0);
+    assert.equal((await f.service.resolve({ ...REQUEST, retry: true })).status, 'pending');
+    await f.service.waitForIdle();
+    assert.equal((await f.service.resolve(REQUEST)).status, 'ready');
+    assert.deepEqual(f.errors, []);
+  } finally {
+    await f.close();
+  }
+});
 function observe(
   service: ChatImageDeliveryService,
   source: string,
diff --git a/packages/runtime-host/src/server/chat-image-delivery.ts b/packages/runtime-host/src/server/chat-image-delivery.ts
index 0fe5c2bd924..44fafa879ac 100644
--- a/packages/runtime-host/src/server/chat-image-delivery.ts
+++ b/packages/runtime-host/src/server/chat-image-delivery.ts
@@ -33,6 +33,7 @@ import {
 } from '@maka/storage/artifact-stores';
 import type { SessionAdmissionGate } from './session-admission-gate.js';
 import { chatImageSources } from './chat-image-markdown.js';
+import { abortable } from '../client/wait-for-ready.js';
 import {
   checkedChatImage,
   downloadChatImage,
@@ -239,7 +240,9 @@ export class ChatImageDeliveryService {
     try {
       const path = localImagePath(source);
       if (path !== undefined)
-        image = checkedChatImage((await this.ports.readLocalImage(sessionId, path, signal)).bytes);
+        image = checkedChatImage(
+          (await abortable(() => this.ports.readLocalImage(sessionId, path, signal), signal)).bytes,
+        );
       else {
         try {
           image = await (this.ports.download ?? downloadChatImage)(source, signal);
@@ -326,6 +329,11 @@ function deliveryKey(i: DeliveryIdentity): string {
 function failureReason(error: unknown, source: string): ImageDeliveryFailure {
   if (error instanceof ImageSourceError) return error.reason;
   const code = (error as NodeJS.ErrnoException | undefined)?.code;
+  if (
+    code === 'ERR_IMAGE_TOO_LARGE' ||
+    (error instanceof Error && /exceeds.*(?:MiB|MB)/i.test(error.message))
+  )
+    return 'too_large';
   if (error instanceof Error && /supported raster|requires a PNG|not.*image/i.test(error.message))
     return 'unsupported_mime';
   if (code === 'ENOENT' || code === 'ENOTDIR') return 'not_found';
diff --git a/packages/runtime/src/__tests__/builtin-tools-file-worker.test.ts b/packages/runtime/src/__tests__/builtin-tools-file-worker.test.ts
index cd8793c884b..b7d34f4e571 100644
--- a/packages/runtime/src/__tests__/builtin-tools-file-worker.test.ts
+++ b/packages/runtime/src/__tests__/builtin-tools-file-worker.test.ts
@@ -74,7 +74,7 @@ describe('builtin file tools use the sandboxed worker', () => {
             emitOutput() {},
           },
         ),
-      /requires a PNG/,
+      /not a supported.*PNG/,
     );
     assert.equal(published, 0);
   });
@@ -664,7 +664,11 @@ test('chat image reader uses the managed Read boundary and never falls back to h
       execute: async (input) => {
         calls++;
         assert.deepEqual(input.executionBoundary, executionBoundary);
-        assert.deepEqual(input.operation, { kind: 'read', path: 'private.png' });
+        assert.deepEqual(input.operation, {
+          kind: 'read',
+          path: 'private.png',
+          imagePurpose: 'chat',
+        });
         throw new Error('sandbox permission refused');
       },
     },
diff --git a/packages/runtime/src/__tests__/image-file.test.ts b/packages/runtime/src/__tests__/image-file.test.ts
index c8e2636ca32..1efe9cc674f 100644
--- a/packages/runtime/src/__tests__/image-file.test.ts
+++ b/packages/runtime/src/__tests__/image-file.test.ts
@@ -18,6 +18,7 @@
  */
 
 import { test } from 'node:test';
+import { execFileSync } from 'node:child_process';
 import assert from 'node:assert/strict';
 import { mkdtemp, realpath, rm, writeFile, truncate } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
@@ -26,11 +27,99 @@ import { readWorkspaceFile, validateImageBytes } from '../image-file.js';
 import { LocalWorkspaceExecutor } from '../workspace-executor.js';
 import { executeFilesystemOperation } from '../filesystem-worker/operations.js';
 import { MAX_READ_IMAGE_BYTES } from '@maka/core/attachments';
+import { ARTIFACT_IMAGE_PREVIEW_MAX_BYTES } from '@maka/core/artifacts';
+import { createImageFileReader } from '../image-file-reader.js';
+import { buildBuiltinTools } from '../builtin-tools.js';
 
 const ONE_PIXEL_PNG = Buffer.from(
   'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8DwHwAFBQIAX8jx0gAAAABJRU5ErkJggg==',
   'base64',
 );
+// Valid 2560x1 PNG, wider than the model input limit but within chat's byte budget.
+const WIDE_PNG = Buffer.from(
+  'iVBORw0KGgoAAAANSUhEUgAACgAAAAABCAYAAAASePczAAAAIUlEQVR4nO3BAQ0AAADCoPdPbQ43oAAAAAAAAAAAAIA7AygBAAEQnI5pAAAAAElFTkSuQmCC',
+  'base64',
+);
+
+for (const route of ['workspace', 'worker'] as const) {
+  test(`${route} chat reads admit wide screenshots without relaxing ordinary Read`, async (t) => {
+    const cwd = await realpath(await mkdtemp(join(tmpdir(), 'maka-chat-image-policy-')));
+    t.after(() => rm(cwd, { recursive: true, force: true }));
+    const path = join(cwd, 'wide.png');
+    const read = (imagePurpose?: 'chat') =>
+      route === 'workspace'
+        ? new LocalWorkspaceExecutor().readFile({
+            cwd,
+            path,
+            ...(imagePurpose ? { imagePurpose } : {}),
+          })
+        : executeFilesystemOperation(
+            { kind: 'read', cwd, path, ...(imagePurpose ? { imagePurpose } : {}) },
+            {
+              filesystem: { entries: [{ path: cwd, access: 'read', scope: 'subtree' }] },
+            },
+          );
+    await writeFile(path, WIDE_PNG);
+    await assert.rejects(read(), /dimensions.*model input limit/i);
+    const result = await read('chat');
+    if ('base64' in result) assert.deepEqual(Buffer.from(result.base64, 'base64'), WIDE_PNG);
+    else {
+      assert.ok('bytes' in result && result.bytes instanceof Uint8Array);
+      assert.deepEqual(Buffer.from(result.bytes), WIDE_PNG);
+    }
+    await truncate(path, ARTIFACT_IMAGE_PREVIEW_MAX_BYTES + 1);
+    await assert.rejects(read('chat'), /2 MiB/);
+    await writeFile(path, 'not an image');
+    await assert.rejects(read('chat'), /not a supported/i);
+  });
+}
+
+test('PublishImage saves a wide screenshot through the same chat read policy', async (t) => {
+  const cwd = await mkdtemp(join(tmpdir(), 'maka-publish-wide-'));
+  t.after(() => rm(cwd, { recursive: true, force: true }));
+  await writeFile(join(cwd, 'wide.png'), WIDE_PNG);
+  let published = false;
+  const tool = buildBuiltinTools({
+    publishImage: async ({ bytes }) => {
+      assert.deepEqual(Buffer.from(bytes), WIDE_PNG);
+      published = true;
+      return { kind: 'session_file', sessionId: 'session', relativePath: 'saved-image' };
+    },
+  }).find((tool) => tool.name === 'PublishImage')!;
+  await tool.impl(
+    { path: 'wide.png' },
+    {
+      sessionId: 'session',
+      turnId: 'turn',
+      toolCallId: 'publish',
+      cwd,
+      permissionMode: 'bypass',
+      executionBoundary: { kind: 'bypass', revision: 0 },
+      abortSignal: new AbortController().signal,
+      emitOutput() {},
+    },
+  );
+  assert.equal(published, true);
+});
+
+test('chat reads reject FIFOs without waiting for a writer', {
+  skip: process.platform === 'win32',
+  timeout: 1000,
+}, async (t) => {
+  const cwd = await mkdtemp(join(tmpdir(), 'maka-image-fifo-'));
+  t.after(() => rm(cwd, { recursive: true, force: true }));
+  const path = join(cwd, 'blocked.png');
+  execFileSync('mkfifo', [path]);
+  await assert.rejects(createImageFileReader()({ path, cwd }), /not a file/i);
+});
+
+test('chat reads honor cancellation before opening the source', async () => {
+  const abortSignal = AbortSignal.abort(new Error('capture cancelled'));
+  await assert.rejects(
+    readWorkspaceFile('/missing.png', { imagePurpose: 'chat', abortSignal }),
+    /capture cancelled/,
+  );
+});
 
 for (const route of ['workspace', 'worker']) {
   for (const name of ['image.png', 'image', 'image.bin']) {
diff --git a/packages/runtime/src/builtin-tools.ts b/packages/runtime/src/builtin-tools.ts
index 3ec9a9de73f..7fc64924051 100644
--- a/packages/runtime/src/builtin-tools.ts
+++ b/packages/runtime/src/builtin-tools.ts
@@ -326,7 +326,7 @@ export function buildBuiltinTools(options: BuildBuiltinToolsOptions = {}): MakaT
             executionFacts,
             impl: async ({ path }: { path: string }, ctx: MakaToolContext) => {
               const result = await filesystem.execute({
-                operation: { kind: 'read', path },
+                operation: { kind: 'read', path, imagePurpose: 'chat' },
                 ...filesystemCall(ctx),
               });
               if (
diff --git a/packages/runtime/src/filesystem-executor.ts b/packages/runtime/src/filesystem-executor.ts
index 4875f97f2ba..99921db8dc2 100644
--- a/packages/runtime/src/filesystem-executor.ts
+++ b/packages/runtime/src/filesystem-executor.ts
@@ -394,6 +394,8 @@ function createWorkspaceFilesystemExecutor(
           const result = await workspace.readFile({
             cwd,
             path,
+            ...(operation.imagePurpose ? { imagePurpose: operation.imagePurpose } : {}),
+            ...(abortSignal ? { abortSignal } : {}),
           });
           if ('bytes' in result) {
             return { kind: 'read_image', bytes: result.bytes, mimeType: result.mimeType };
diff --git a/packages/runtime/src/filesystem-worker/operations.ts b/packages/runtime/src/filesystem-worker/operations.ts
index bc2dcfbfe24..eedd55ab8b7 100644
--- a/packages/runtime/src/filesystem-worker/operations.ts
+++ b/packages/runtime/src/filesystem-worker/operations.ts
@@ -124,7 +124,9 @@ export async function executeFilesystemOperation(
         'read',
         operationBoundary,
       );
-      const file = await readWorkspaceFile(path).catch((error: unknown) => {
+      const file = await readWorkspaceFile(path, {
+        ...(operation.imagePurpose ? { imagePurpose: operation.imagePurpose } : {}),
+      }).catch((error: unknown) => {
         throw operationError(
           'filesystem_error',
           error instanceof Error ? error.message : 'File could not be read.',
diff --git a/packages/runtime/src/filesystem-worker/protocol.ts b/packages/runtime/src/filesystem-worker/protocol.ts
index efacffe3bc1..3c3a07a61ef 100644
--- a/packages/runtime/src/filesystem-worker/protocol.ts
+++ b/packages/runtime/src/filesystem-worker/protocol.ts
@@ -22,10 +22,9 @@ import { readContinuationSchema, readPageSchema } from '../read-page.js';
 import { validateSandboxBoundaryExpansion } from '@maka/core/sandbox-boundary';
 import { GREP_MAX_LINES, GREP_MAX_LINES_PER_FILE, GREP_MAX_MATCH_BYTES } from '../grep-search.js';
 
-// v10 adds bounded Read pages to v9's exact Grep counts; v11 adds Glob's
-// truncation flag to v10's result contract. Older workers cannot satisfy the
-// combined result contract and must be rejected at the handshake.
-export const FILESYSTEM_WORKER_PROTOCOL_VERSION = 11 as const;
+// v12 adds chat image reads with a bounded payload and no model dimension limit.
+// Older workers cannot satisfy this read policy and must be rejected at the handshake.
+export const FILESYSTEM_WORKER_PROTOCOL_VERSION = 12 as const;
 
 /** The single authority on which operation kinds are writes. Shared by the
  * client (permission/identity decisions) and the worker (operation guards) so
@@ -107,6 +106,7 @@ export const FilesystemWorkerOperationSchema = z.union([
       kind: z.literal('read'),
       cwd,
       path,
+      imagePurpose: z.literal('chat').optional(),
       offset: z.number().int().nonnegative().optional(),
       limit: z.number().int().positive().optional(),
       continuation: readContinuationSchema.optional(),
diff --git a/packages/runtime/src/image-file-reader.ts b/packages/runtime/src/image-file-reader.ts
index e283c0f5064..c219de848c0 100644
--- a/packages/runtime/src/image-file-reader.ts
+++ b/packages/runtime/src/image-file-reader.ts
@@ -37,7 +37,10 @@ export function createImageFileReader(
   });
   return async (input: Omit<FilesystemExecuteInput, 'operation'> & { path: string }) => {
     const { path, ...context } = input;
-    const result = await filesystem.execute({ ...context, operation: { kind: 'read', path } });
+    const result = await filesystem.execute({
+      ...context,
+      operation: { kind: 'read', path, imagePurpose: 'chat' },
+    });
     if (result.kind !== 'read_image') throw new Error('Not a supported raster image');
     return { bytes: result.bytes, mimeType: result.mimeType };
   };
diff --git a/packages/runtime/src/image-file.ts b/packages/runtime/src/image-file.ts
index 38f56809d44..37148928918 100644
--- a/packages/runtime/src/image-file.ts
+++ b/packages/runtime/src/image-file.ts
@@ -17,6 +17,7 @@
  * under the License.
  */
 
+import { constants } from 'node:fs';
 import { open } from 'node:fs/promises';
 import { extname } from 'node:path';
 import { imageDimensionsFromData } from 'image-dimensions';
@@ -27,6 +28,12 @@ import {
   READ_IMAGE_TOO_LARGE_MESSAGE,
   sniffAttachmentMimeType,
 } from '@maka/core/attachments';
+import { ARTIFACT_IMAGE_PREVIEW_MAX_BYTES } from '@maka/core/artifacts';
+
+export interface WorkspaceFileReadOptions {
+  imagePurpose?: 'chat';
+  abortSignal?: AbortSignal;
+}
 
 const IMAGE_EXTENSIONS = new Set(['.png', '.jpg', '.jpeg', '.gif', '.webp']);
 export type ImageMimeType = 'image/png' | 'image/jpeg' | 'image/gif' | 'image/webp';
@@ -38,9 +45,22 @@ export function isSupportedImagePath(path: string): boolean {
 /** Classify a bounded prefix before decoding text or allocating an image body. */
 export async function readWorkspaceFile(
   path: string,
+  options: WorkspaceFileReadOptions = {},
 ): Promise<{ content: string } | { bytes: Uint8Array; mimeType: ImageMimeType }> {
-  const file = await open(path, 'r');
+  options.abortSignal?.throwIfAborted();
+  // Chat capture must never block opening a FIFO or read an unbounded text file.
+  const file = await open(
+    path,
+    options.imagePurpose === 'chat' ? constants.O_RDONLY | constants.O_NONBLOCK : 'r',
+  );
   try {
+    options.abortSignal?.throwIfAborted();
+    if (options.imagePurpose === 'chat') {
+      const size = await file.stat();
+      if (!size.isFile()) throw new Error('Image path is not a file.');
+      if (size.size > ARTIFACT_IMAGE_PREVIEW_MAX_BYTES) throw imageTooLargeError('chat');
+      return validateImageBytes(await file.readFile({ signal: options.abortSignal }), 'chat');
+    }
     const prefix = Buffer.alloc(ATTACHMENT_MIME_SNIFF_BYTES);
     // A positioned read leaves the descriptor's offset at zero for readFile.
     const { bytesRead } = await file.read(prefix, 0, prefix.length, 0);
@@ -56,11 +76,15 @@ export async function readWorkspaceFile(
   }
 }
 
-export function validateImageBytes(bytes: Uint8Array): {
+export function validateImageBytes(
+  bytes: Uint8Array,
+  purpose: 'model' | 'chat' = 'model',
+): {
   bytes: Uint8Array;
   mimeType: ImageMimeType;
 } {
-  if (bytes.length > MAX_READ_IMAGE_BYTES) throw imageTooLargeError();
+  if (bytes.length > (purpose === 'chat' ? ARTIFACT_IMAGE_PREVIEW_MAX_BYTES : MAX_READ_IMAGE_BYTES))
+    throw imageTooLargeError(purpose);
   const mimeType = sniffImageMime(bytes);
   if (!mimeType) throw new Error('Image content is not a supported PNG, JPEG, GIF, or WebP file.');
   const dimensions = imageDimensionsFromData(bytes);
@@ -75,7 +99,7 @@ export function validateImageBytes(bytes: Uint8Array): {
   ) {
     throw new Error('Image dimensions could not be read; verify the image file is valid.');
   }
-  if (Math.max(dimensions.width, dimensions.height) > MAX_MODEL_IMAGE_EDGE) {
+  if (purpose === 'model' && Math.max(dimensions.width, dimensions.height) > MAX_MODEL_IMAGE_EDGE) {
     throw new Error(
       `Image dimensions ${dimensions.width}x${dimensions.height} exceed the ${MAX_MODEL_IMAGE_EDGE}px model input limit; downscale it and try again.`,
     );
@@ -83,8 +107,15 @@ export function validateImageBytes(bytes: Uint8Array): {
   return { bytes, mimeType };
 }
 
-function imageTooLargeError(): Error {
-  return new Error(READ_IMAGE_TOO_LARGE_MESSAGE);
+function imageTooLargeError(purpose: 'model' | 'chat' = 'model'): Error {
+  return Object.assign(
+    new Error(
+      purpose === 'chat'
+        ? 'Image exceeds the 2 MiB chat preview limit; resize it before publishing.'
+        : READ_IMAGE_TOO_LARGE_MESSAGE,
+    ),
+    { code: 'ERR_IMAGE_TOO_LARGE' },
+  );
 }
 
 function sniffImageMime(bytes: Uint8Array): ImageMimeType | undefined {
diff --git a/packages/runtime/src/workspace-executor.ts b/packages/runtime/src/workspace-executor.ts
index 28a4a07fcee..5a3f5495830 100644
--- a/packages/runtime/src/workspace-executor.ts
+++ b/packages/runtime/src/workspace-executor.ts
@@ -44,7 +44,7 @@ import { runProcessWithBoundedTail, runShellWithBoundedTail } from './shell-exec
 import type { ChildFdInput } from './child-fd-input.js';
 import type { ShellPlan } from './shell-detect.js';
 import { isSupportedImagePath, readWorkspaceFile } from './image-file.js';
-import type { ImageMimeType } from './image-file.js';
+import type { ImageMimeType, WorkspaceFileReadOptions } from './image-file.js';
 import { readTextLineWindow } from './text-line-window.js';
 import { searchFiles, type GrepResult } from './grep-search.js';
 import { defaultRipgrepCandidates, resolveRipgrepExecutable } from './ripgrep-executable.js';
@@ -85,7 +85,7 @@ export interface WorkspaceExecResult {
   aborted: boolean;
 }
 
-export interface WorkspaceReadFileInput {
+export interface WorkspaceReadFileInput extends WorkspaceFileReadOptions {
   cwd: string;
   path: string;
   offset?: number;
@@ -337,7 +337,7 @@ export class LocalWorkspaceExecutor implements WorkspaceExecutor {
   }
 
   async readFile(input: WorkspaceReadFileInput): Promise<WorkspaceReadFileResult> {
-    const file = await readWorkspaceFile(input.path);
+    const file = await readWorkspaceFile(input.path, input);
     if ('bytes' in file) return file;
     return { content: readTextLineWindow(file.content, input.offset, input.limit) };
   }
diff --git a/packages/ui/scripts/markdown-images.browser.test.mjs b/packages/ui/scripts/markdown-images.browser.test.mjs
index fd6f964a6b0..c46675e6ece 100644
--- a/packages/ui/scripts/markdown-images.browser.test.mjs
+++ b/packages/ui/scripts/markdown-images.browser.test.mjs
@@ -58,23 +58,31 @@ before(async () => {
       import {SessionAttachmentProvider} from './packages/ui/dist/attachment-image.js';
       import './apps/desktop/src/renderer/styles.css';
       const mode=new URLSearchParams(location.search).get('case') || 'remote';
-      let reads=0; window.imageReads=0; window.deliveryQueries=0;
+      let reads=0; window.imageReads=0; window.deliveryQueries=0; window.deliveryReady=false;
+      const race=mode.endsWith('-race');
       const text=mode==='attachment' ? '![Screenshot](maka://runtime/attachments/image-1)' :
-        mode==='local' || mode==='local-saved' ? '![Screenshot](/tmp/private.png)' :
+        mode==='local' || mode==='local-saved' || race ? '![Screenshot](/tmp/private.png)' :
         '![Screenshot](${imageUrl}/'+(mode==='retry' ? 'retry.png' : 'image.png')+')';
-      createRoot(document.getElementById('root')).render(
+      const root=createRoot(document.getElementById('root'));
+      const readBytes=async()=>{
+        reads++; window.imageReads=reads; return mode==='attachment' && reads===1 ? {ok:false,reason:'read_failed'} :
+          {ok:true,base64:'${png.toString('base64')}',mimeType:'image/png'};
+      };
+      const resolveDelivery=mode.endsWith('saved') || mode==='saving' || race ? async()=>{
+        window.deliveryQueries++;
+        if(race) return window.deliveryReady ? {status:'ready',artifactId:'saved-image'} : {status:'unavailable'};
+        await new Promise(resolve=>setTimeout(resolve,100));
+        return mode==='saving' && window.deliveryQueries===1 ? {status:'pending'} : {status:'ready',artifactId:'saved-image'};
+      } : undefined;
+      const render=(streaming=race)=>root.render(
         React.createElement(Theme,{theme:makaTheme,mode:'light'},
           React.createElement(LocaleProvider,{locale:'en'},
-            React.createElement(SessionAttachmentProvider,{sessionId:'session',readBytes:async()=>{
-              reads++; window.imageReads=reads; return mode==='attachment' && reads===1 ? {ok:false,reason:'read_failed'} :
-                {ok:true,base64:'${png.toString('base64')}',mimeType:'image/png'};
-            }},React.createElement(ImageDeliveryProvider,{sessionId:'session',resolve:mode.endsWith('saved') || mode==='saving' ? async()=>{
-              window.deliveryQueries++;
-              await new Promise(resolve=>setTimeout(resolve,100));
-              return mode==='saving' && window.deliveryQueries===1 ? {status:'pending'} : {status:'ready',artifactId:'saved-image'};
-            } : undefined},
+            React.createElement(SessionAttachmentProvider,{sessionId:'session',readBytes},
+              React.createElement(ImageDeliveryProvider,{sessionId:'session',resolve:resolveDelivery},
               React.createElement('div',{style:mode==='offscreen' ? {paddingTop:'2500px'} : {}},
-                React.createElement(MarkdownBody,{text,imageIdentity:{turnId:'turn',messageId:'message'}})))))));
+                React.createElement(MarkdownBody,{text,streaming,settledText:race ? text : undefined,imageIdentity:{turnId:'turn',messageId:'message'}})))))));
+      window.finishStream=()=>render(false);
+      render();
     `, resolveDir: root, loader: 'js' },
     bundle: true, write: false, outdir: '/virtual', format: 'iife',
     loader: { '.woff2': 'dataurl', '.woff': 'dataurl', '.ttf': 'dataurl', '.svg': 'dataurl' },
@@ -194,3 +202,21 @@ test('a new remote image previews during archival and switches to saved bytes af
     assert.equal(requests.length, 1);
   } finally { await page.close(); }
 });
+
+for (const scenario of ['streaming-race', 'settled-race']) {
+  test(`${scenario}: an unavailable live source recovers in place once Host archival completes`, async () => {
+    const page = await pageFor(scenario);
+    try {
+      await page.waitForFunction(() => window.deliveryQueries === 1);
+      if (scenario === 'settled-race') {
+        await page.evaluate(() => window.finishStream());
+        await page.waitForFunction(() => window.deliveryQueries >= 2);
+      }
+      await page.evaluate(() => { window.deliveryReady = true; });
+      await loaded(page);
+      assert.equal(await page.evaluate(() => window.imageReads), 1);
+      assert.match(await page.locator('img').getAttribute('src'), /^data:image\/png;base64,/);
+      assert.equal(await page.locator('img').count(), 1);
+    } finally { await page.close(); }
+  });
+}
diff --git a/packages/ui/src/image-delivery.tsx b/packages/ui/src/image-delivery.tsx
index 22d31eab2a2..3c92daeb973 100644
--- a/packages/ui/src/image-delivery.tsx
+++ b/packages/ui/src/image-delivery.tsx
@@ -20,7 +20,7 @@
 import { createContext, useCallback, useContext, useEffect, useMemo, useState, type ReactNode } from 'react';
 import type { ImageDeliveryRequest, ImageDeliveryResult } from '@maka/core/image-delivery';
 export type ResolveImageDelivery = (sessionId: string, request: ImageDeliveryRequest) => Promise<ImageDeliveryResult>;
-export const ImageMessageScope = createContext<{ turnId: string; messageId: string } | undefined>(undefined);
+export const ImageMessageScope = createContext<{ turnId: string; messageId: string; streaming?: boolean } | undefined>(undefined);
 const DeliveryContext = createContext<{ resolve(request: ImageDeliveryRequest): Promise<ImageDeliveryResult> } | undefined>(undefined);
 export function ImageDeliveryProvider(props: { sessionId: string; resolve?: ResolveImageDelivery; children: ReactNode }) {
   const value = useMemo(() => {
@@ -50,18 +50,20 @@ export function useImageDelivery(source: string, enabled: boolean) {
   const context = useContext(DeliveryContext);
   const [attempt, setAttempt] = useState(0);
   const identity = useMemo(() => context && scope?.turnId && scope.messageId && enabled
-    ? { context, turnId: scope.turnId, messageId: scope.messageId, source, attempt } : undefined,
-    [context, scope?.turnId, scope?.messageId, source, attempt, enabled]);
+    ? { context, turnId: scope.turnId, messageId: scope.messageId, streaming: scope.streaming === true, source, attempt } : undefined,
+    [context, scope?.turnId, scope?.messageId, scope?.streaming, source, attempt, enabled]);
   const [settled, setSettled] = useState<{ identity: typeof identity; result: ImageDeliveryResult }>();
   const retry = useCallback(() => setAttempt(a => a + 1), []);
   useEffect(() => {
     if (!identity) return;
-    let cancelled = false; let timer: ReturnType<typeof setTimeout> | undefined; let delay = 500;
+    let cancelled = false; let timer: ReturnType<typeof setTimeout> | undefined; let delay = 500; let unavailableRetries = 0;
     const query = async (retry: boolean) => {
       const result = await identity.context.resolve({ turnId: identity.turnId, messageId: identity.messageId, source: identity.source, ...(retry ? { retry: true } : {}) });
       if (cancelled) return;
       setSettled({ identity, result });
-      if (result.status === 'pending') {
+      // Canonical text can lag the displayed stream. Retry briefly after settlement,
+      // but do not poll permanently unsupported sources forever.
+      if (result.status === 'pending' || result.status === 'unavailable' && (identity.streaming || unavailableRetries++ < 3)) {
         timer = setTimeout(() => { void query(false); }, delay); delay = Math.min(5000, delay * 2);
       }
     };
diff --git a/packages/ui/src/markdown-body.tsx b/packages/ui/src/markdown-body.tsx
index 75203095778..f864e2c3cbc 100644
--- a/packages/ui/src/markdown-body.tsx
+++ b/packages/ui/src/markdown-body.tsx
@@ -163,7 +163,7 @@ export function MarkdownBody(props: {
     : MARKDOWN_COMPONENTS[density];
 
   return (
-    <ImageMessageScope.Provider value={props.imageIdentity}>
+    <ImageMessageScope.Provider value={props.imageIdentity ? { ...props.imageIdentity, streaming: props.streaming } : undefined}>
       <div
         data-maka-contract="markdown"
         data-maka-script={hasHanProse(props.text) ? 'han' : undefined}
diff --git a/packages/ui/src/markdown-image.tsx b/packages/ui/src/markdown-image.tsx
index a7a8911ae64..07594687e92 100644
--- a/packages/ui/src/markdown-image.tsx
+++ b/packages/ui/src/markdown-image.tsx
@@ -18,7 +18,8 @@
  */
 
 import { useEffect, useRef, useState } from 'react';
-import { Button, useLightbox } from '@astryxdesign/core';
+import { Button, IconButton, useLightbox } from '@astryxdesign/core';
+import { Maximize2 } from './icons.js';
 import { Link } from '@astryxdesign/core/Link';
 import { parseAttachmentResourceRef } from '@maka/core/attachments';
 import { useAttachmentImage } from './attachment-image.js';
@@ -83,10 +84,11 @@ function DisplayImage(props: { src: string; alt: string; onError(): void }) {
   return <>
     {!loaded && <span className="maka-markdown-image-loading" role="status">{copy.imageLoading}</span>}
     <span className="maka-markdown-image-preview">
-      <Button variant="ghost" label={copy.imageExpand(props.alt)} onClick={() => lightbox.open()}>
-        <img src={props.src} alt={props.alt} loading="lazy" decoding="async" referrerPolicy="no-referrer"
+      <img src={props.src} alt={props.alt} loading="lazy" decoding="async" referrerPolicy="no-referrer"
           className="maka-markdown-attachment-image" onLoad={() => setLoaded(true)} onError={props.onError} />
-      </Button>
+      <span className="maka-markdown-image-expand">
+        <IconButton icon={<Maximize2 size={16} />} size="sm" label={copy.imageExpand(props.alt)} onClick={() => lightbox.open()} />
+      </span>
     </span>
     {lightbox.isOpen && lightbox.element}
   </>;
diff --git a/packages/ui/src/styles.css b/packages/ui/src/styles.css
index 3fe1137b8b3..ebf93774871 100644
--- a/packages/ui/src/styles.css
+++ b/packages/ui/src/styles.css
@@ -634,13 +634,15 @@
 .maka-markdown-image-resource { display: inline-block; position: relative; max-width: 100%; }
 .maka-markdown-image-preview {
   display: inline-block;
+  position: relative;
+  min-inline-size: var(--space-10);
+  min-block-size: var(--space-10);
   max-width: 100%;
 }
-/* Keep the image's natural dimensions; Astryx owns interaction and focus styling. */
-.maka-markdown-image-preview .astryx-button {
-  max-width: 100%;
-  height: auto;
-  padding: 0;
+.maka-markdown-image-expand {
+  position: absolute;
+  inset-block-end: var(--space-2);
+  inset-inline-end: var(--space-2);
 }
 .maka-markdown-image-preview img { margin: 0; max-height: 480px; object-fit: contain; }
 .maka-markdown-image-loading { display: block; color: var(--muted-foreground); font-size: var(--maka-font-size-sm); }

From 8dee867ce3e9491efb7b1dff070d930a163be562 Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Tue, 6 Oct 2026 00:12:06 +0800
Subject: [PATCH 04/37] fix(runtime): launch filesystem worker as explicit ESM

Avoid parent package.json reads outside the worker sandbox grant by shipping the bundled entry as .mjs. Update desktop and CLI packaging and add regression tests for invalid and CommonJS parent package configurations.

Generated-by: Codex (GPT-6)
---
 .../filesystem-worker-launch-spec.test.ts     | 34 +++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/packages/runtime/src/__tests__/filesystem-worker-launch-spec.test.ts b/packages/runtime/src/__tests__/filesystem-worker-launch-spec.test.ts
index 2c38163babd..ae91d8e2f03 100644
--- a/packages/runtime/src/__tests__/filesystem-worker-launch-spec.test.ts
+++ b/packages/runtime/src/__tests__/filesystem-worker-launch-spec.test.ts
@@ -18,12 +18,46 @@
  */
 
 import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
 import { chmod, copyFile, mkdir, mkdtemp, realpath, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { test } from 'node:test';
 
 import { createFilesystemWorkerLaunchSpecProvider } from '../filesystem-worker/launch-spec.js';
+import {
+  FILESYSTEM_WORKER_BUNDLE_NAME,
+  resolveFilesystemWorkerBundle,
+} from '../filesystem-worker/resource-resolver.js';
+import { FilesystemWorkerResponseSchema } from '../filesystem-worker/protocol.js';
+
+for (const packageConfig of ['{invalid JSON', '{"type":"commonjs"}']) {
+  test(`worker startup does not consult parent package config: ${packageConfig}`, async (t) => {
+    const root = await mkdtemp(join(tmpdir(), 'maka-worker-module-boundary-'));
+    t.after(() => rm(root, { recursive: true, force: true }));
+    const source = await resolveFilesystemWorkerBundle({ kind: 'runtime' });
+    assert.ok(source.ok);
+    const workers = join(root, 'workers');
+    await mkdir(workers);
+    const bundle = join(workers, FILESYSTEM_WORKER_BUNDLE_NAME);
+    await copyFile(source.path, bundle);
+    await writeFile(join(root, 'package.json'), packageConfig);
+    const result = spawnSync(process.execPath, ['--preserve-symlinks-main', bundle], {
+      cwd: root,
+      input: '{}',
+      encoding: 'utf8',
+      timeout: 5000,
+    });
+    assert.equal(
+      result.status,
+      0,
+      result.stderr || result.error?.message || 'Worker did not exit successfully',
+    );
+    const response = FilesystemWorkerResponseSchema.parse(JSON.parse(result.stdout));
+    assert.equal(response.ok, false);
+    if (!response.ok) assert.equal(response.error.code, 'invalid_request');
+  });
+}
 
 test('Linux Electron worker launch does not require a macOS Frameworks directory', async () => {
   const getLaunchSpec = createFilesystemWorkerLaunchSpecProvider({

From 17a1aa8013971c8862ec13e37ac7da40e41fd2f5 Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Tue, 6 Oct 2026 13:26:26 +0800
Subject: [PATCH 05/37] fix(test): include PublishImage in the root provider
 tool contract

---
 .../src/__tests__/execution-model-composition.test.ts            | 1 +
 1 file changed, 1 insertion(+)

diff --git a/packages/runtime-host/src/__tests__/execution-model-composition.test.ts b/packages/runtime-host/src/__tests__/execution-model-composition.test.ts
index ed22c912667..7f0a1331128 100644
--- a/packages/runtime-host/src/__tests__/execution-model-composition.test.ts
+++ b/packages/runtime-host/src/__tests__/execution-model-composition.test.ts
@@ -2926,6 +2926,7 @@ test('production Host executes a canonical ai-sdk Session against a real provide
       'Edit',
       'Glob',
       'Grep',
+      'PublishImage',
       'Read',
       'Skill',
       'SkillSearch',

From 51de6bb424e6d4bb9867b6229b5bc9b1a54a9965 Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Tue, 6 Oct 2026 15:15:43 +0800
Subject: [PATCH 06/37] fix(chat): harden image validation and delivery retries

Reuse shared image validation, preserve structured filesystem failures, recapture invalid saved images on retry, and clean up pending artifacts after terminal persistence. Add regression coverage for validation, retry, recovery, and browser image failures.

Generated-by: Codex (GPT-6)
---
 .../src/__tests__/chat-image-delivery.test.ts | 219 +++++++++++++++++-
 .../src/server/chat-image-delivery.ts         |  52 +++--
 .../src/server/chat-image-source.ts           |  24 +-
 .../src/server/execution-composition.ts       |   3 +-
 packages/runtime/package.json                 |   1 +
 .../runtime/src/__tests__/image-file.test.ts  |  76 +++++-
 .../src/filesystem-worker/operations.ts       |   9 +-
 .../runtime/src/filesystem-worker/protocol.ts |   2 +
 packages/runtime/src/image-file-reader.ts     |  64 ++++-
 packages/runtime/src/image-file.ts            |  32 ++-
 packages/runtime/src/workspace-executor.ts    |   9 +-
 .../scripts/markdown-images.browser.test.mjs  |  36 ++-
 packages/ui/src/image-delivery.tsx            |   1 +
 packages/ui/src/markdown-image.tsx            |   5 +-
 14 files changed, 467 insertions(+), 66 deletions(-)

diff --git a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
index dcc1bc2d94a..75f83e299fa 100644
--- a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
+++ b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
@@ -23,6 +23,9 @@ import { mkdtemp, readFile, writeFile, rm, stat } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { createServer } from 'node:http';
+import { createHash } from 'node:crypto';
+import { createImageFileReader } from '@maka/runtime/image-file-reader';
+import { FilesystemWorkerClientError } from '@maka/runtime/filesystem-worker';
 import { openInteractiveArtifactStoreForWrite } from '@maka/storage/artifact-stores';
 import { resolveStorageRoot, tryAcquireInteractiveRootOwner } from '@maka/storage/root-authority';
 import {
@@ -46,6 +49,7 @@ const REQUEST = {
 async function fixture(
   limits?: { sessionBytes: number; workspaceBytes: number },
   readLocalImage?: ChatImageDeliveryPorts['readLocalImage'],
+  beforeCreate?: (input: Parameters<ChatImageDeliveryPorts['artifacts']['create']>[0]) => void,
 ) {
   const root = await mkdtemp(join(tmpdir(), 'maka-image-delivery-'));
   const owner = await tryAcquireInteractiveRootOwner(
@@ -60,7 +64,14 @@ async function fixture(
   const messages = new Map<string, string>();
   let present = true;
   const service = new ChatImageDeliveryService({
-    artifacts: authority.store,
+    artifacts: {
+      create: async (input) => {
+        beforeCreate?.(input);
+        return authority.store.create(input);
+      },
+      findImageDelivery: authority.store.findImageDelivery,
+      deleteOwnedArtifactInSession: authority.store.deleteOwnedArtifactInSession,
+    },
     admission: new SessionAdmissionGate(),
     limits,
     isPresent: async () => present,
@@ -268,6 +279,212 @@ test('transient failure is persisted and is retried only on an explicit request'
     await f.close();
   }
 });
+
+test('truncated HTTP images are rejected, and an explicit retry archives the repaired source', async () => {
+  const f = await fixture();
+  let content = PNG.subarray(0, 8);
+  let requests = 0;
+  const server = createServer((_req, res) => {
+    requests++;
+    res.setHeader('Content-Type', 'image/png');
+    res.end(content);
+  });
+  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+  const source = `http://127.0.0.1:${(server.address() as import('node:net').AddressInfo).port}/image.png`;
+  const identity = { ...REQUEST, source };
+  try {
+    observe(f.service, source);
+    await f.service.waitForIdle();
+    assert.deepEqual(await f.service.resolve(identity), {
+      status: 'failed',
+      reason: 'unsupported_mime',
+    });
+    assert.equal(requests, 1);
+    const failed = await f.authority.store.listPage(REQUEST.sessionId, { offset: 0, limit: 10 });
+    assert.equal(failed.total, 1);
+    assert.equal(failed.records[0]?.imageDelivery?.status, 'failed');
+    content = PNG;
+    assert.equal((await f.service.resolve({ ...identity, retry: true })).status, 'pending');
+    await f.service.waitForIdle();
+    const ready = await f.service.resolve(identity);
+    assert.equal(ready.status, 'ready');
+    assert.equal(requests, 2);
+    if (ready.status === 'ready') {
+      const bytes = await f.authority.store.readBinaryInSession(
+        identity.sessionId,
+        ready.artifactId,
+      );
+      assert.ok(bytes.ok);
+      if (bytes.ok) assert.equal(bytes.base64, PNG.toString('base64'));
+    }
+    assert.equal(
+      (await f.authority.store.listPage(identity.sessionId, { offset: 0, limit: 10 })).total,
+      1,
+    );
+    assert.deepEqual(f.errors, []);
+  } finally {
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+    await f.close();
+  }
+});
+
+test('explicit decode retries replace a legacy ready image and share concurrent capture', async () => {
+  const f = await fixture();
+  let requests = 0;
+  let release!: () => void;
+  const gate = new Promise<void>((resolve) => {
+    release = resolve;
+  });
+  const server = createServer((_req, res) => {
+    requests++;
+    void gate.then(() => {
+      res.setHeader('Content-Type', 'image/png');
+      res.end(PNG);
+    });
+  });
+  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+  const source = `http://127.0.0.1:${(server.address() as import('node:net').AddressInfo).port}/image.png`;
+  const identity = { ...REQUEST, source };
+  try {
+    const broken = PNG.subarray(0, 8);
+    await f.authority.store.create({
+      id: 'legacy-image',
+      sessionId: identity.sessionId,
+      turnId: identity.turnId,
+      kind: 'image',
+      name: 'chat-image',
+      source: 'tool_result_projection',
+      content: broken,
+      mimeType: 'image/png',
+      imageDelivery: {
+        messageId: identity.messageId,
+        source,
+        status: 'ready',
+        contentSha256: createHash('sha256').update(broken).digest('hex'),
+      },
+    });
+    assert.deepEqual(await f.service.resolve(identity), {
+      status: 'ready',
+      artifactId: 'legacy-image',
+    });
+    assert.equal(requests, 0);
+    const retries = await Promise.all([
+      f.service.resolve({ ...identity, retry: true }),
+      f.service.resolve({ ...identity, retry: true }),
+    ]);
+    assert.deepEqual(retries, [{ status: 'pending' }, { status: 'pending' }]);
+    release();
+    await f.service.waitForIdle();
+    const ready = await f.service.resolve(identity);
+    assert.equal(ready.status, 'ready');
+    assert.equal(requests, 1);
+    const page = await f.authority.store.listPage(identity.sessionId, { offset: 0, limit: 10 });
+    assert.equal(page.total, 1);
+    assert.equal(page.records[0]?.sizeBytes, PNG.length);
+    assert.deepEqual(f.errors, []);
+  } finally {
+    release();
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+    await f.close();
+  }
+});
+
+test('Worker read errors retain their image delivery reasons in persisted failures', async () => {
+  for (const [reason, expected] of [
+    ['not_found', 'not_found'],
+    ['filesystem_denied', 'not_allowed'],
+    ['image_too_large', 'too_large'],
+    ['invalid_image', 'unsupported_mime'],
+  ] as const) {
+    const reader = createImageFileReader({
+      filesystemWorker: {
+        execute: async () => {
+          throw new FilesystemWorkerClientError({
+            reason,
+            stage: 'operation',
+            message: '读取失败',
+          });
+        },
+      },
+    });
+    const f = await fixture(undefined, (_session, path, abortSignal) =>
+      reader({ path, cwd: process.cwd(), abortSignal }),
+    );
+    try {
+      observe(f.service, REQUEST.source);
+      await f.service.waitForIdle();
+      assert.deepEqual(await f.service.resolve(REQUEST), { status: 'failed', reason: expected });
+      assert.deepEqual(f.errors, []);
+    } finally {
+      await f.close();
+    }
+  }
+});
+
+test('pending capture survives persistence failure and is removed only after a durable terminal record', async () => {
+  let failPublication = true;
+  const f = await fixture(
+    undefined,
+    async () => checkedChatImage(PNG),
+    (input) => {
+      if (failPublication && input.imageDelivery?.status === 'ready')
+        throw new Error('publication failed');
+    },
+  );
+  try {
+    observe(f.service, REQUEST.source);
+    await f.service.waitForIdle();
+    const pending = await f.authority.store.listPage(REQUEST.sessionId, { offset: 0, limit: 10 });
+    assert.equal(pending.total, 1);
+    assert.equal(pending.records[0]?.imageDelivery?.status, 'pending');
+    assert.equal(f.errors.length, 1);
+    failPublication = false;
+    assert.equal((await f.service.resolve(REQUEST)).status, 'pending');
+    await f.service.waitForIdle();
+    const ready = await f.authority.store.listPage(REQUEST.sessionId, { offset: 0, limit: 10 });
+    assert.equal(ready.total, 1);
+    assert.equal(ready.records[0]?.imageDelivery?.status, 'ready');
+    assert.equal(f.errors.length, 1);
+  } finally {
+    await f.close();
+  }
+});
+
+test('a conversation copied during capture resumes and cleans its copied pending record', async () => {
+  let release!: () => void;
+  const gate = new Promise<void>((resolve) => {
+    release = resolve;
+  });
+  const f = await fixture(undefined, async () => {
+    await gate;
+    return checkedChatImage(PNG);
+  });
+  try {
+    observe(f.service, REQUEST.source);
+    while (!f.reads) await new Promise<void>((resolve) => setImmediate(resolve));
+    await f.authority.store.copyConversationArtifacts({
+      sourceSessionId: REQUEST.sessionId,
+      targetSessionId: 'session-copy',
+      turnIds: [REQUEST.turnId],
+    });
+    const copied = { ...REQUEST, sessionId: 'session-copy' };
+    assert.equal((await f.service.resolve(copied)).status, 'pending');
+    release();
+    await f.service.waitForIdle();
+    for (const sessionId of [REQUEST.sessionId, copied.sessionId]) {
+      const page = await f.authority.store.listPage(sessionId, { offset: 0, limit: 10 });
+      assert.equal(page.total, 1);
+      assert.equal(page.records[0]?.imageDelivery?.status, 'ready');
+      const bytes = await f.authority.store.readBinaryInSession(sessionId, page.records[0]!.id);
+      assert.ok(bytes.ok);
+      if (bytes.ok) assert.equal(bytes.base64, PNG.toString('base64'));
+    }
+    assert.deepEqual(f.errors, []);
+  } finally {
+    release();
+    await f.close();
+  }
+});
 test('quota admission is atomic under concurrent jobs and identical content shares bytes across sessions', async () => {
   const f = await fixture({ sessionBytes: PNG.length, workspaceBytes: PNG.length });
   try {
diff --git a/packages/runtime-host/src/server/chat-image-delivery.ts b/packages/runtime-host/src/server/chat-image-delivery.ts
index 44fafa879ac..95649a5c6c5 100644
--- a/packages/runtime-host/src/server/chat-image-delivery.ts
+++ b/packages/runtime-host/src/server/chat-image-delivery.ts
@@ -18,6 +18,7 @@
  */
 
 import { createHash } from 'node:crypto';
+import { ImageFileReadError } from '@maka/runtime/image-file-reader';
 import type { CompleteEvent, TextCompleteEvent, TextDeltaEvent } from '@maka/core/events';
 import { foldAssistantDelta } from '@maka/core/events';
 import {
@@ -35,7 +36,6 @@ import type { SessionAdmissionGate } from './session-admission-gate.js';
 import { chatImageSources } from './chat-image-markdown.js';
 import { abortable } from '../client/wait-for-ready.js';
 import {
-  checkedChatImage,
   downloadChatImage,
   ImageSourceError,
   localImagePath,
@@ -138,7 +138,8 @@ export class ChatImageDeliveryService {
       identity.source,
     );
     const metadata = record?.imageDelivery;
-    if (metadata?.status === 'ready') return { status: 'ready', artifactId: record!.id };
+    if (metadata?.status === 'ready' && !identity.retry)
+      return { status: 'ready', artifactId: record!.id };
     if (metadata?.status === 'failed' && !identity.retry)
       return { status: 'failed', reason: metadata.reason! };
     if (this.#jobs.has(deliveryKey(identity))) return { status: 'pending' };
@@ -149,14 +150,21 @@ export class ChatImageDeliveryService {
       if (text === undefined || !chatImageSources(text).includes(identity.source))
         return { status: 'unavailable' };
     }
-    if (metadata?.status === 'failed') {
-      await this.ports.admission.runOrJoin(identity.sessionId, () =>
-        this.ports.artifacts.deleteOwnedArtifactInSession(
+    if (metadata?.status === 'failed' || metadata?.status === 'ready') {
+      return this.ports.admission.runOrJoin(identity.sessionId, async () => {
+        if (this.#closed) return { status: 'unavailable' };
+        if (this.#jobs.has(deliveryKey(identity))) return { status: 'pending' };
+        if (this.#jobs.size >= 128) return { status: 'failed', reason: 'queue_full' };
+        await this.ports.artifacts.deleteOwnedArtifactInSession(
           identity.sessionId,
           record!.id,
           'tool_result_projection',
-        ),
-      );
+        );
+        // Capture outlives this admission and takes its own write admissions.
+        return this.ports.admission.detach(() => this.#enqueue(identity))
+          ? { status: 'pending' }
+          : { status: 'failed', reason: 'queue_full' };
+      });
     }
     return this.#enqueue(identity)
       ? { status: 'pending' }
@@ -216,6 +224,7 @@ export class ChatImageDeliveryService {
     );
     if (existing?.imageDelivery?.status !== 'pending' && existing) return;
     const metadata = { messageId, source };
+    const pendingId = existing?.id ?? `chat_image_request_${deliveryKey(identity)}`;
     const base = {
       sessionId,
       turnId,
@@ -226,10 +235,18 @@ export class ChatImageDeliveryService {
       this.ports.admission.runOrJoin(sessionId, async () => {
         if (this.#abort.signal.aborted || !(await this.ports.isPresent(sessionId))) return;
         await this.ports.artifacts.create(input);
+        // Retain a pending request only until a terminal record is durable.
+        // A crash between these writes still replays the terminal record.
+        if (input.imageDelivery?.status !== 'pending')
+          await this.ports.artifacts.deleteOwnedArtifactInSession(
+            sessionId,
+            pendingId,
+            'tool_result_projection',
+          );
       });
     await publish({
       ...base,
-      id: `chat_image_request_${deliveryKey(identity)}`,
+      id: pendingId,
       kind: 'file',
       content: '',
       imageDelivery: { ...metadata, status: 'pending' },
@@ -240,9 +257,7 @@ export class ChatImageDeliveryService {
     try {
       const path = localImagePath(source);
       if (path !== undefined)
-        image = checkedChatImage(
-          (await abortable(() => this.ports.readLocalImage(sessionId, path, signal), signal)).bytes,
-        );
+        image = await abortable(() => this.ports.readLocalImage(sessionId, path, signal), signal);
       else {
         try {
           image = await (this.ports.download ?? downloadChatImage)(source, signal);
@@ -328,20 +343,9 @@ function deliveryKey(i: DeliveryIdentity): string {
 }
 function failureReason(error: unknown, source: string): ImageDeliveryFailure {
   if (error instanceof ImageSourceError) return error.reason;
+  if (error instanceof ImageFileReadError) return error.reason;
   const code = (error as NodeJS.ErrnoException | undefined)?.code;
-  if (
-    code === 'ERR_IMAGE_TOO_LARGE' ||
-    (error instanceof Error && /exceeds.*(?:MiB|MB)/i.test(error.message))
-  )
-    return 'too_large';
-  if (error instanceof Error && /supported raster|requires a PNG|not.*image/i.test(error.message))
-    return 'unsupported_mime';
   if (code === 'ENOENT' || code === 'ENOTDIR') return 'not_found';
-  if (
-    code === 'EACCES' ||
-    code === 'EPERM' ||
-    (error instanceof Error && /sandbox|outside|permission/i.test(error.message))
-  )
-    return 'not_allowed';
+  if (code === 'EACCES' || code === 'EPERM') return 'not_allowed';
   return /^https?:/i.test(source) ? 'download_failed' : 'read_failed';
 }
diff --git a/packages/runtime-host/src/server/chat-image-source.ts b/packages/runtime-host/src/server/chat-image-source.ts
index ce271573ccb..3fde63293c2 100644
--- a/packages/runtime-host/src/server/chat-image-source.ts
+++ b/packages/runtime-host/src/server/chat-image-source.ts
@@ -22,11 +22,8 @@ import { request as httpRequest } from 'node:http';
 import { request as httpsRequest } from 'node:https';
 import { isIP } from 'node:net';
 import { fileURLToPath } from 'node:url';
-import { sniffAttachmentMimeType } from '@maka/core/attachments';
-import {
-  ARTIFACT_IMAGE_PREVIEW_MAX_BYTES,
-  normalizeArtifactImagePreviewMime,
-} from '@maka/core/artifacts';
+import { ARTIFACT_IMAGE_PREVIEW_MAX_BYTES } from '@maka/core/artifacts';
+import { ImageFileError, validateImageBytes } from '@maka/runtime/image-file';
 import type { ImageDeliveryFailure } from '@maka/core/image-delivery';
 export class ImageSourceError extends Error {
   constructor(readonly reason: ImageDeliveryFailure) {
@@ -38,15 +35,14 @@ export interface ChatImageBytes {
   readonly mimeType: string;
 }
 export function checkedChatImage(bytes: Uint8Array): ChatImageBytes {
-  if (bytes.byteLength > ARTIFACT_IMAGE_PREVIEW_MAX_BYTES) throw new ImageSourceError('too_large');
-  const mimeType = sniffAttachmentMimeType(bytes);
-  if (
-    !mimeType ||
-    !normalizeArtifactImagePreviewMime(mimeType) ||
-    !['image/png', 'image/jpeg', 'image/webp', 'image/gif'].includes(mimeType)
-  )
-    throw new ImageSourceError('unsupported_mime');
-  return { bytes, mimeType };
+  try {
+    return validateImageBytes(bytes, 'chat');
+  } catch (error) {
+    if (!(error instanceof ImageFileError)) throw error;
+    throw new ImageSourceError(
+      error.code === 'ERR_IMAGE_TOO_LARGE' ? 'too_large' : 'unsupported_mime',
+    );
+  }
 }
 export function localImagePath(source: string): string | undefined {
   if (/^https?:/i.test(source)) return undefined;
diff --git a/packages/runtime-host/src/server/execution-composition.ts b/packages/runtime-host/src/server/execution-composition.ts
index cfd2b0e4b62..dc7f880d280 100644
--- a/packages/runtime-host/src/server/execution-composition.ts
+++ b/packages/runtime-host/src/server/execution-composition.ts
@@ -19,7 +19,6 @@
 
 import { createImageFileReader } from '@maka/runtime/image-file-reader';
 import { ChatImageDeliveryService } from './chat-image-delivery.js';
-import { checkedChatImage } from './chat-image-source.js';
 import { createWorkHubResultRuntime } from './workhub-result-runtime.js';
 import { createWorkHubInspectionTool } from './workhub-inspection-tool.js';
 import { createJevRoutingModel } from './jev-routing-model.js';
@@ -604,7 +603,7 @@ export async function createExecutionRuntimeHostComposition(
           executionBoundary: boundary,
           abortSignal,
         });
-        return checkedChatImage(result.bytes);
+        return result;
       },
       readMessage: async (identity) => {
         await requireSessionManager(manager).ensureTranscriptLedgerForRead(identity.sessionId);
diff --git a/packages/runtime/package.json b/packages/runtime/package.json
index 3c4841a2dfd..206a249ee6f 100644
--- a/packages/runtime/package.json
+++ b/packages/runtime/package.json
@@ -12,6 +12,7 @@
     "./mcp-tools": "./dist/mcp-tools.js",
     "./read-page": "./dist/read-page.js",
     "./image-file-reader": "./dist/image-file-reader.js",
+    "./image-file": "./dist/image-file.js",
     "./builtin-tools": "./dist/builtin-tools.js",
     "./shell-tools": "./dist/shell-tools.js",
     "./shell-run-manager": "./dist/shell-run-manager.js",
diff --git a/packages/runtime/src/__tests__/image-file.test.ts b/packages/runtime/src/__tests__/image-file.test.ts
index 1efe9cc674f..9bc0d1f9a06 100644
--- a/packages/runtime/src/__tests__/image-file.test.ts
+++ b/packages/runtime/src/__tests__/image-file.test.ts
@@ -28,7 +28,10 @@ import { LocalWorkspaceExecutor } from '../workspace-executor.js';
 import { executeFilesystemOperation } from '../filesystem-worker/operations.js';
 import { MAX_READ_IMAGE_BYTES } from '@maka/core/attachments';
 import { ARTIFACT_IMAGE_PREVIEW_MAX_BYTES } from '@maka/core/artifacts';
-import { createImageFileReader } from '../image-file-reader.js';
+import { createImageFileReader, ImageFileReadError } from '../image-file-reader.js';
+import { FilesystemWorkerClientError } from '../filesystem-worker/client.js';
+import { executeFilesystemWorkerRequest } from '../filesystem-worker/operations.js';
+import { FILESYSTEM_WORKER_PROTOCOL_VERSION } from '../filesystem-worker/protocol.js';
 import { buildBuiltinTools } from '../builtin-tools.js';
 
 const ONE_PIXEL_PNG = Buffer.from(
@@ -41,6 +44,77 @@ const WIDE_PNG = Buffer.from(
   'base64',
 );
 
+test('chat reader preserves structured Worker failures independently of message wording', async () => {
+  for (const [reason, expected] of [
+    ['not_found', 'not_found'],
+    ['filesystem_denied', 'not_allowed'],
+    ['path_denied', 'not_allowed'],
+    ['sandbox_denied', 'not_allowed'],
+    ['image_too_large', 'too_large'],
+    ['invalid_image', 'unsupported_mime'],
+    ['worker_io_incomplete', 'read_failed'],
+  ] as const) {
+    const reader = createImageFileReader({
+      filesystemWorker: {
+        execute: async () => {
+          throw new FilesystemWorkerClientError({
+            reason,
+            stage: 'operation',
+            message: '读取失败',
+          });
+        },
+      },
+    });
+    await assert.rejects(
+      reader({ path: 'image.png', cwd: process.cwd() }),
+      (error: unknown) => error instanceof ImageFileReadError && error.reason === expected,
+    );
+  }
+});
+
+test('chat reader preserves local missing paths and workspace boundary denials', async (t) => {
+  const cwd = await realpath(await mkdtemp(join(tmpdir(), 'maka-chat-read-errors-')));
+  t.after(() => rm(cwd, { recursive: true, force: true }));
+  const reader = createImageFileReader();
+  await assert.rejects(
+    reader({ path: 'missing.png', cwd }),
+    (error: unknown) => error instanceof ImageFileReadError && error.reason === 'not_found',
+  );
+  await assert.rejects(
+    reader({ path: join(cwd, '..', 'outside.png'), cwd }),
+    (error: unknown) => error instanceof ImageFileReadError && error.reason === 'not_allowed',
+  );
+});
+
+test('Worker transports typed image validation failures instead of generic filesystem errors', async (t) => {
+  const cwd = await realpath(await mkdtemp(join(tmpdir(), 'maka-chat-image-wire-')));
+  t.after(() => rm(cwd, { recursive: true, force: true }));
+  const path = join(cwd, 'image.png');
+  for (const [content, expected] of [
+    [ONE_PIXEL_PNG.subarray(0, 8), 'invalid_image'],
+    [Buffer.alloc(ARTIFACT_IMAGE_PREVIEW_MAX_BYTES + 1), 'image_too_large'],
+  ] as const) {
+    await writeFile(path, content);
+    const response = await executeFilesystemWorkerRequest({
+      version: FILESYSTEM_WORKER_PROTOCOL_VERSION,
+      requestId: 'read-image',
+      operation: { kind: 'read', cwd, path, imagePurpose: 'chat' },
+      operationBoundary: {
+        filesystem: { entries: [{ path: cwd, access: 'read', scope: 'subtree' }] },
+      },
+      expectedTarget: {
+        enforcementPath: path,
+        access: 'read',
+        scope: 'exact',
+        targetType: 'file',
+        identity: 'unchecked',
+      },
+    });
+    assert.equal(response.ok, false);
+    if (!response.ok) assert.equal(response.error.code, expected);
+  }
+});
+
 for (const route of ['workspace', 'worker'] as const) {
   test(`${route} chat reads admit wide screenshots without relaxing ordinary Read`, async (t) => {
     const cwd = await realpath(await mkdtemp(join(tmpdir(), 'maka-chat-image-policy-')));
diff --git a/packages/runtime/src/filesystem-worker/operations.ts b/packages/runtime/src/filesystem-worker/operations.ts
index eedd55ab8b7..75fcdb9f77c 100644
--- a/packages/runtime/src/filesystem-worker/operations.ts
+++ b/packages/runtime/src/filesystem-worker/operations.ts
@@ -47,7 +47,7 @@ import {
   StableWriteFailure,
   writeThroughHandle,
 } from '../file-stable-write.js';
-import { readWorkspaceFile } from '../image-file.js';
+import { ImageFileError, readWorkspaceFile } from '../image-file.js';
 import {
   FILESYSTEM_WORKER_PROTOCOL_VERSION,
   operationAccess,
@@ -128,7 +128,7 @@ export async function executeFilesystemOperation(
         ...(operation.imagePurpose ? { imagePurpose: operation.imagePurpose } : {}),
       }).catch((error: unknown) => {
         throw operationError(
-          'filesystem_error',
+          normalizeOperationError(error).code,
           error instanceof Error ? error.message : 'File could not be read.',
         );
       });
@@ -453,6 +453,11 @@ function operationError(
 
 function normalizeOperationError(error: unknown): FilesystemOperationError {
   if (error instanceof FilesystemOperationError) return error;
+  if (error instanceof ImageFileError)
+    return operationError(
+      error.code === 'ERR_IMAGE_TOO_LARGE' ? 'image_too_large' : 'invalid_image',
+      error.message,
+    );
   if (error instanceof StableWriteFailure) {
     return operationError(error.code, error.message);
   }
diff --git a/packages/runtime/src/filesystem-worker/protocol.ts b/packages/runtime/src/filesystem-worker/protocol.ts
index 3c3a07a61ef..bf1512c4fe5 100644
--- a/packages/runtime/src/filesystem-worker/protocol.ts
+++ b/packages/runtime/src/filesystem-worker/protocol.ts
@@ -251,6 +251,8 @@ export const FilesystemWorkerErrorCodeSchema = z.enum([
   'grep_unavailable',
   'sandbox_denied',
   'filesystem_denied',
+  'image_too_large',
+  'invalid_image',
   'filesystem_error',
   // The worker may have applied the mutation before it lost the ability to
   // report back (e.g. it wrote the file then the post-write identity check
diff --git a/packages/runtime/src/image-file-reader.ts b/packages/runtime/src/image-file-reader.ts
index c219de848c0..6d5e7984767 100644
--- a/packages/runtime/src/image-file-reader.ts
+++ b/packages/runtime/src/image-file-reader.ts
@@ -23,6 +23,56 @@ import {
   type FilesystemExecuteInput,
 } from './filesystem-executor.js';
 import { createLocalWorkspaceExecutor } from './workspace-executor.js';
+import { ImageFileError } from './image-file.js';
+import { FilesystemWorkerClientError } from './filesystem-worker/client.js';
+import { SandboxCommandError } from './sandbox/errors.js';
+
+type ImageFileReadFailure =
+  | 'not_found'
+  | 'not_allowed'
+  | 'too_large'
+  | 'unsupported_mime'
+  | 'read_failed';
+/** Normalizes filesystem backends at the image reader boundary. */
+export class ImageFileReadError extends Error {
+  constructor(
+    readonly reason: ImageFileReadFailure,
+    cause?: unknown,
+  ) {
+    super(cause instanceof Error ? cause.message : `Image read failed: ${reason}`, { cause });
+    this.name = 'ImageFileReadError';
+  }
+}
+
+function readFailure(error: unknown): ImageFileReadFailure {
+  if (error instanceof ImageFileError)
+    return error.code === 'ERR_IMAGE_TOO_LARGE' ? 'too_large' : 'unsupported_mime';
+  if (error instanceof SandboxCommandError) return 'not_allowed';
+  const code =
+    error instanceof FilesystemWorkerClientError
+      ? error.reason
+      : (error as NodeJS.ErrnoException | undefined)?.code;
+  switch (code) {
+    case 'image_too_large':
+      return 'too_large';
+    case 'invalid_image':
+      return 'unsupported_mime';
+    case 'ENOENT':
+    case 'ENOTDIR':
+    case 'not_found':
+      return 'not_found';
+    case 'EACCES':
+    case 'EPERM':
+    case 'filesystem_denied':
+    case 'path_denied':
+    case 'sandbox_denied':
+    case 'sandbox_required':
+    case 'sandbox_boundary_required':
+      return 'not_allowed';
+    default:
+      return 'read_failed';
+  }
+}
 /** The same filesystem boundary as Read, without model snapshots or tool execution. */
 export function createImageFileReader(
   options: Pick<
@@ -37,11 +87,15 @@ export function createImageFileReader(
   });
   return async (input: Omit<FilesystemExecuteInput, 'operation'> & { path: string }) => {
     const { path, ...context } = input;
-    const result = await filesystem.execute({
-      ...context,
-      operation: { kind: 'read', path, imagePurpose: 'chat' },
-    });
-    if (result.kind !== 'read_image') throw new Error('Not a supported raster image');
+    const result = await filesystem
+      .execute({
+        ...context,
+        operation: { kind: 'read', path, imagePurpose: 'chat' },
+      })
+      .catch((error: unknown) => {
+        throw new ImageFileReadError(readFailure(error), error);
+      });
+    if (result.kind !== 'read_image') throw new ImageFileReadError('unsupported_mime');
     return { bytes: result.bytes, mimeType: result.mimeType };
   };
 }
diff --git a/packages/runtime/src/image-file.ts b/packages/runtime/src/image-file.ts
index 37148928918..361e33ed6c4 100644
--- a/packages/runtime/src/image-file.ts
+++ b/packages/runtime/src/image-file.ts
@@ -38,6 +38,15 @@ export interface WorkspaceFileReadOptions {
 const IMAGE_EXTENSIONS = new Set(['.png', '.jpg', '.jpeg', '.gif', '.webp']);
 export type ImageMimeType = 'image/png' | 'image/jpeg' | 'image/gif' | 'image/webp';
 
+export class ImageFileError extends Error {
+  constructor(
+    readonly code: 'ERR_IMAGE_TOO_LARGE' | 'ERR_INVALID_IMAGE',
+    message: string,
+  ) {
+    super(message);
+  }
+}
+
 export function isSupportedImagePath(path: string): boolean {
   return IMAGE_EXTENSIONS.has(extname(path).toLowerCase());
 }
@@ -86,7 +95,11 @@ export function validateImageBytes(
   if (bytes.length > (purpose === 'chat' ? ARTIFACT_IMAGE_PREVIEW_MAX_BYTES : MAX_READ_IMAGE_BYTES))
     throw imageTooLargeError(purpose);
   const mimeType = sniffImageMime(bytes);
-  if (!mimeType) throw new Error('Image content is not a supported PNG, JPEG, GIF, or WebP file.');
+  if (!mimeType)
+    throw new ImageFileError(
+      'ERR_INVALID_IMAGE',
+      'Image content is not a supported PNG, JPEG, GIF, or WebP file.',
+    );
   const dimensions = imageDimensionsFromData(bytes);
   if (
     !dimensions ||
@@ -97,7 +110,10 @@ export function validateImageBytes(
     dimensions.width <= 0 ||
     dimensions.height <= 0
   ) {
-    throw new Error('Image dimensions could not be read; verify the image file is valid.');
+    throw new ImageFileError(
+      'ERR_INVALID_IMAGE',
+      'Image dimensions could not be read; verify the image file is valid.',
+    );
   }
   if (purpose === 'model' && Math.max(dimensions.width, dimensions.height) > MAX_MODEL_IMAGE_EDGE) {
     throw new Error(
@@ -108,13 +124,11 @@ export function validateImageBytes(
 }
 
 function imageTooLargeError(purpose: 'model' | 'chat' = 'model'): Error {
-  return Object.assign(
-    new Error(
-      purpose === 'chat'
-        ? 'Image exceeds the 2 MiB chat preview limit; resize it before publishing.'
-        : READ_IMAGE_TOO_LARGE_MESSAGE,
-    ),
-    { code: 'ERR_IMAGE_TOO_LARGE' },
+  return new ImageFileError(
+    'ERR_IMAGE_TOO_LARGE',
+    purpose === 'chat'
+      ? 'Image exceeds the 2 MiB chat preview limit; resize it before publishing.'
+      : READ_IMAGE_TOO_LARGE_MESSAGE,
   );
 }
 
diff --git a/packages/runtime/src/workspace-executor.ts b/packages/runtime/src/workspace-executor.ts
index 5a3f5495830..fc09a8507bc 100644
--- a/packages/runtime/src/workspace-executor.ts
+++ b/packages/runtime/src/workspace-executor.ts
@@ -561,9 +561,12 @@ function assertInsideCwd(
   label: string,
 ): string {
   if (!isPathInside(root, candidate)) {
-    throw new Error(
-      `${label} path must stay inside session cwd ${JSON.stringify(root)}; ` +
-        `received ${JSON.stringify(inputPath)}, which resolves to ${JSON.stringify(candidate)}.`,
+    throw Object.assign(
+      new Error(
+        `${label} path must stay inside session cwd ${JSON.stringify(root)}; ` +
+          `received ${JSON.stringify(inputPath)}, which resolves to ${JSON.stringify(candidate)}.`,
+      ),
+      { code: 'EACCES' },
     );
   }
   return candidate;
diff --git a/packages/ui/scripts/markdown-images.browser.test.mjs b/packages/ui/scripts/markdown-images.browser.test.mjs
index c46675e6ece..147cfe61890 100644
--- a/packages/ui/scripts/markdown-images.browser.test.mjs
+++ b/packages/ui/scripts/markdown-images.browser.test.mjs
@@ -58,18 +58,19 @@ before(async () => {
       import {SessionAttachmentProvider} from './packages/ui/dist/attachment-image.js';
       import './apps/desktop/src/renderer/styles.css';
       const mode=new URLSearchParams(location.search).get('case') || 'remote';
-      let reads=0; window.imageReads=0; window.deliveryQueries=0; window.deliveryReady=false;
+      let reads=0; window.imageReads=0; window.deliveryQueries=0; window.deliveryReady=false; window.deliveryRetries=0;
       const race=mode.endsWith('-race');
       const text=mode==='attachment' ? '![Screenshot](maka://runtime/attachments/image-1)' :
         mode==='local' || mode==='local-saved' || race ? '![Screenshot](/tmp/private.png)' :
         '![Screenshot](${imageUrl}/'+(mode==='retry' ? 'retry.png' : 'image.png')+')';
       const root=createRoot(document.getElementById('root'));
       const readBytes=async()=>{
-        reads++; window.imageReads=reads; return mode==='attachment' && reads===1 ? {ok:false,reason:'read_failed'} :
-          {ok:true,base64:'${png.toString('base64')}',mimeType:'image/png'};
+        reads++; window.imageReads=reads; return (mode==='attachment' || mode==='read-retry-saved') && reads===1 ? {ok:false,reason:'read_failed'} :
+          {ok:true,base64:mode==='corrupt-saved' && !window.deliveryRetries ? 'iVBORw0KGgo=' : '${png.toString('base64')}',mimeType:'image/png'};
       };
-      const resolveDelivery=mode.endsWith('saved') || mode==='saving' || race ? async()=>{
+      const resolveDelivery=mode.endsWith('saved') || mode==='saving' || race ? async(_session,request)=>{
         window.deliveryQueries++;
+        if(request.retry) window.deliveryRetries++;
         if(race) return window.deliveryReady ? {status:'ready',artifactId:'saved-image'} : {status:'unavailable'};
         await new Promise(resolve=>setTimeout(resolve,100));
         return mode==='saving' && window.deliveryQueries===1 ? {status:'pending'} : {status:'ready',artifactId:'saved-image'};
@@ -158,6 +159,33 @@ test('attachment read failure recovers in place, and local paths explain how to
   } finally { await page.close(); }
 });
 
+test('a saved image decode failure invalidates both caches and recaptures its source on retry', async () => {
+  const page = await pageFor('corrupt-saved');
+  try {
+    await page.getByText('Could not load the image. Try again.').waitFor();
+    assert.equal(await page.evaluate(() => window.imageReads), 1);
+    await page.getByRole('button', { name: 'Retry', exact: true }).click();
+    await page.waitForFunction(() => [...document.images].some(img => img.src.startsWith('data:image/png;') && img.naturalWidth === 1));
+    assert.equal(await page.evaluate(() => window.deliveryRetries), 1);
+    assert.equal(await page.evaluate(() => window.deliveryQueries), 2);
+    assert.equal(await page.evaluate(() => window.imageReads), 2);
+  } finally { await page.close(); }
+});
+
+test('a transient saved attachment read retries its bytes without invalidating archival or touching origin', async () => {
+  requests = [];
+  const page = await pageFor('read-retry-saved');
+  try {
+    await page.getByText('Could not load the image. Try again.').waitFor();
+    await page.getByRole('button', { name: 'Retry', exact: true }).click();
+    await loaded(page);
+    assert.equal(await page.evaluate(() => window.deliveryRetries), 0);
+    assert.equal(await page.evaluate(() => window.deliveryQueries), 1);
+    assert.equal(await page.evaluate(() => window.imageReads), 2);
+    assert.deepEqual(requests, []);
+  } finally { await page.close(); }
+});
+
 for (const scenario of ['remote-saved', 'local-saved']) {
   test(`${scenario}: saved mapping avoids the original source and the image supports zoom`, async () => {
     requests = [];
diff --git a/packages/ui/src/image-delivery.tsx b/packages/ui/src/image-delivery.tsx
index 3c92daeb973..558e95059ad 100644
--- a/packages/ui/src/image-delivery.tsx
+++ b/packages/ui/src/image-delivery.tsx
@@ -30,6 +30,7 @@ export function ImageDeliveryProvider(props: { sessionId: string; resolve?: Reso
     const ready = new Map<string, ImageDeliveryResult>();
     return { resolve(request: ImageDeliveryRequest) {
       const key = JSON.stringify([request.turnId, request.messageId, request.source]);
+      if (request.retry) ready.delete(key);
       const cached = ready.get(key); if (cached) return Promise.resolve(cached);
       const running = pending.get(key); if (running) return running;
       const job = resolve(props.sessionId, request).catch((): ImageDeliveryResult => ({ status: 'failed', reason: 'read_failed' }));
diff --git a/packages/ui/src/markdown-image.tsx b/packages/ui/src/markdown-image.tsx
index 07594687e92..9a98ab6d519 100644
--- a/packages/ui/src/markdown-image.tsx
+++ b/packages/ui/src/markdown-image.tsx
@@ -53,7 +53,10 @@ function ImageResource(props: { src: string; alt: string }) {
   const failed = !!source && failedSource === source || !!artifactId && image.status === 'failed';
   const retry = () => {
     setFailedSource(undefined); setAttempt(a => a + 1);
-    if (artifactId) image.retry(); else delivery.retry();
+    if (artifactId) image.retry();
+    // A transient byte-read failure retries the saved attachment. Only a
+    // browser decode failure invalidates automatic capture and rereads origin.
+    if (!artifactId || (!explicit && source && failedSource === source)) delivery.retry();
   };
   const sourceActions = <span className="maka-markdown-image-actions">
     <Button variant="ghost" size="sm" label={copy.imageRetry} onClick={retry} />

From f0d501952b5aad840fc72dbf4de47c189cfd8528 Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Tue, 6 Oct 2026 17:01:50 +0800
Subject: [PATCH 07/37] fix(chat): normalize image destinations and preserve
 preview layout

Resolve rendered image destinations with the Host Markdown parser, preserve canonical reference paths, and reserve a responsive preview frame through capture and decoding. Add browser regressions for destination identity, streaming recovery, layout stability, narrow screens, and zoom.

Generated-by: Codex (GPT-6)
---
 docs/astryx-surface-file-inventory.md         |   2 +-
 package-lock.json                             |   1 +
 .../src/__tests__/chat-image-delivery.test.ts |   9 +-
 packages/ui/package.json                      |   1 +
 .../scripts/markdown-images.browser.test.mjs  | 106 +++++++++++++++++-
 .../__tests__/markdown-image-source.test.ts   |  54 +++++++++
 packages/ui/src/markdown-body.tsx             |  86 +++++++-------
 packages/ui/src/markdown-image-source.ts      |  49 ++++++++
 packages/ui/src/markdown-image.tsx            |  25 +++--
 packages/ui/src/styles.css                    |  49 ++++++--
 10 files changed, 319 insertions(+), 63 deletions(-)
 create mode 100644 packages/ui/src/__tests__/markdown-image-source.test.ts
 create mode 100644 packages/ui/src/markdown-image-source.ts

diff --git a/docs/astryx-surface-file-inventory.md b/docs/astryx-surface-file-inventory.md
index cd1242c9b15..adcb5599521 100644
--- a/docs/astryx-surface-file-inventory.md
+++ b/docs/astryx-surface-file-inventory.md
@@ -312,7 +312,7 @@ Wiki bar: Design Conventions · API Use-the-System · Theming · Container Paddi
 | `packages/ui/src/locale-context.tsx` | ui-composition | none | aligned — no raw controls; no Astryx JSX usage | aligned |
 | `packages/ui/src/maka-wordmark.tsx` | ui-composition | none | aligned — no raw controls; no Astryx JSX usage | aligned |
 | `packages/ui/src/markdown-body.tsx` | ui-composition | CodeBlock, Link, Markdown | aligned — uses Astryx (CodeBlock, Link, Markdown) | aligned |
-| `packages/ui/src/markdown-image.tsx` | ui-composition | Button, IconButton, Link | aligned — uses Astryx (Button, IconButton, Link) | aligned |
+| `packages/ui/src/markdown-image.tsx` | ui-composition | Button, IconButton, Link, Spinner | aligned — uses Astryx (Button, IconButton, Link, Spinner) | aligned |
 | `packages/ui/src/markdown-math.tsx` | ui-composition | none | aligned — no raw controls; no Astryx JSX usage | aligned |
 | `packages/ui/src/markdown.tsx` | ui-composition | none | aligned — no raw controls; no Astryx JSX usage | aligned |
 | `packages/ui/src/mermaid-diagram.tsx` | ui-composition | Button, CodeBlock, Collapsible, Dialog, IconButton, Toolbar | aligned — uses Astryx (Button, CodeBlock, Collapsible, Dialog, IconButton, Toolbar) | aligned |
diff --git a/package-lock.json b/package-lock.json
index 2c829c3a830..51acca210b5 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -17511,6 +17511,7 @@
         "clsx": "^2.1.1",
         "katex": "0.18.9",
         "lucide-react": "^1.48.0",
+        "marked": "^18.0.11",
         "mermaid": "^11.17.2",
         "react": "^19.3.0",
         "react-dom": "^19.3.0",
diff --git a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
index 75f83e299fa..2d77d5a7966 100644
--- a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
+++ b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
@@ -172,6 +172,8 @@ test('parses real Markdown image nodes, including references and balanced destin
   const text = [
     '![one](</tmp/a (1).png>)',
     '![two][pic]',
+    '![titled](https://example.com/titled.png "Screenshot title")',
+    String.raw`![escaped](/tmp/a\(1\).png)`,
     '',
     '[pic]: https://example.com/a.png',
     '`![code](/tmp/secret.png)`',
@@ -181,7 +183,12 @@ test('parses real Markdown image nodes, including references and balanced destin
     '<img src="/tmp/html.png">',
     '![incomplete](https://example.com/',
   ].join('\n');
-  assert.deepEqual(chatImageSources(text), ['/tmp/a (1).png', 'https://example.com/a.png']);
+  assert.deepEqual(chatImageSources(text), [
+    '/tmp/a (1).png',
+    'https://example.com/a.png',
+    'https://example.com/titled.png',
+    '/tmp/a(1).png',
+  ]);
 });
 test('automatically saves a local delivery without any UI request; deletion and Host restart do not break replay', async () => {
   const f = await fixture();
diff --git a/packages/ui/package.json b/packages/ui/package.json
index 8de5e24cdb8..563f59710b9 100644
--- a/packages/ui/package.json
+++ b/packages/ui/package.json
@@ -33,6 +33,7 @@
     "clsx": "^2.1.1",
     "katex": "0.18.9",
     "lucide-react": "^1.48.0",
+    "marked": "^18.0.11",
     "mermaid": "^11.17.2",
     "react": "^19.3.0",
     "react-dom": "^19.3.0",
diff --git a/packages/ui/scripts/markdown-images.browser.test.mjs b/packages/ui/scripts/markdown-images.browser.test.mjs
index 147cfe61890..3f911d05e8e 100644
--- a/packages/ui/scripts/markdown-images.browser.test.mjs
+++ b/packages/ui/scripts/markdown-images.browser.test.mjs
@@ -32,10 +32,22 @@ const root = fileURLToPath(new URL('../../../', import.meta.url));
 const png = Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8DwHwAFBQIAX8jx0gAAAABJRU5ErkJggg==', 'base64');
 let appServer, imageServer, browser, appUrl, imageUrl;
 let requests = [], failedOnce = false;
+let releaseImage;
+let releaseAttachment;
+const delayedImage = new Promise(resolve => { releaseImage = resolve; });
+const delayedAttachment = new Promise(resolve => { releaseAttachment = resolve; });
 
 before(async () => {
+  const screenshot = await readFile(new URL('../../../docs/images/pr/chat-image-delivery/after.png', import.meta.url));
   imageServer = createServer((req, res) => {
     requests.push({ path: req.url, referer: req.headers.referer });
+    if (req.url === '/delayed.png') {
+      void delayedImage.then(() => { res.setHeader('Content-Type', 'image/png'); res.end(png); });
+      return;
+    }
+    if (req.url === '/screenshot.png') {
+      res.setHeader('Content-Type', 'image/png'); res.end(screenshot); return;
+    }
     if (req.url === '/retry.png' && !failedOnce) {
       failedOnce = true;
       res.writeHead(404).end();
@@ -46,6 +58,25 @@ before(async () => {
   });
   await new Promise(resolve => imageServer.listen(0, '127.0.0.1', resolve));
   imageUrl = `http://127.0.0.1:${imageServer.address().port}`;
+  const destinations = {
+    'angle-saved': '![Screenshot](</tmp/my image.png>)',
+    'title-saved': `![Screenshot](${imageUrl}/image.png "Screenshot title")`,
+    'escaped-saved': String.raw`![Screenshot](/tmp/a\(1\).png)`,
+    'reference-saved': '![Screenshot][picture]\n\n[picture]: </tmp/my "image".png>',
+    'attachment-title': '![Screenshot](maka://runtime/attachments/image-1 "Screenshot title")',
+    'geometry-remote': `![Screenshot](${imageUrl}/delayed.png)\n\nFollowing paragraph`,
+    'geometry-saved': '![Screenshot](/tmp/private.png)\n\nFollowing paragraph',
+    'streaming-angle-race': '![Screenshot](</tmp/my image.png>)',
+    screenshot: `![Screenshot](${imageUrl}/screenshot.png)`,
+  };
+  const canonicalSources = {
+    'angle-saved': ['/tmp/my image.png'],
+    'title-saved': [`${imageUrl}/image.png`],
+    'escaped-saved': ['/tmp/a(1).png'],
+    'reference-saved': ['/tmp/my "image".png'],
+    'geometry-saved': ['/tmp/private.png'],
+    'streaming-angle-race': ['/tmp/my image.png'],
+  };
   const bundle = await build({
     stdin: { contents: `
       import React from 'react';
@@ -58,18 +89,23 @@ before(async () => {
       import {SessionAttachmentProvider} from './packages/ui/dist/attachment-image.js';
       import './apps/desktop/src/renderer/styles.css';
       const mode=new URLSearchParams(location.search).get('case') || 'remote';
+      const destinations=${JSON.stringify(destinations)};
+      const canonicalSources=${JSON.stringify(canonicalSources)};
       let reads=0; window.imageReads=0; window.deliveryQueries=0; window.deliveryReady=false; window.deliveryRetries=0;
       const race=mode.endsWith('-race');
-      const text=mode==='attachment' ? '![Screenshot](maka://runtime/attachments/image-1)' :
+      const text=destinations[mode] ?? (mode==='attachment' ? '![Screenshot](maka://runtime/attachments/image-1)' :
         mode==='local' || mode==='local-saved' || race ? '![Screenshot](/tmp/private.png)' :
-        '![Screenshot](${imageUrl}/'+(mode==='retry' ? 'retry.png' : 'image.png')+')';
+        '![Screenshot](${imageUrl}/'+(mode==='retry' ? 'retry.png' : 'image.png')+')');
       const root=createRoot(document.getElementById('root'));
       const readBytes=async()=>{
+        if(mode==='geometry-saved') await fetch('/release-attachment');
         reads++; window.imageReads=reads; return (mode==='attachment' || mode==='read-retry-saved') && reads===1 ? {ok:false,reason:'read_failed'} :
           {ok:true,base64:mode==='corrupt-saved' && !window.deliveryRetries ? 'iVBORw0KGgo=' : '${png.toString('base64')}',mimeType:'image/png'};
       };
       const resolveDelivery=mode.endsWith('saved') || mode==='saving' || race ? async(_session,request)=>{
         window.deliveryQueries++;
+        window.deliverySource=request.source;
+        if(canonicalSources[mode] && !canonicalSources[mode].includes(request.source)) return {status:'unavailable'};
         if(request.retry) window.deliveryRetries++;
         if(race) return window.deliveryReady ? {status:'ready',artifactId:'saved-image'} : {status:'unavailable'};
         await new Promise(resolve=>setTimeout(resolve,100));
@@ -94,6 +130,7 @@ before(async () => {
   const index = await readFile(new URL('../../../apps/desktop/src/renderer/index.html', import.meta.url), 'utf8');
   const csp = index.match(/http-equiv="Content-Security-Policy"\s+content="([^"]+)"/)[1];
   appServer = createServer((req, res) => {
+    if (req.url === '/release-attachment') { void delayedAttachment.then(() => res.end()); return; }
     if (req.url === '/app.js') { res.setHeader('Content-Type', 'text/javascript'); res.end(js); }
     else if (req.url === '/app.css') { res.setHeader('Content-Type', 'text/css'); res.end(css); }
     else {
@@ -107,6 +144,7 @@ before(async () => {
 });
 
 after(async () => {
+  releaseImage(); releaseAttachment();
   await browser?.close();
   for (const server of [appServer, imageServer]) if (server) await new Promise(resolve => server.close(resolve));
 });
@@ -231,7 +269,7 @@ test('a new remote image previews during archival and switches to saved bytes af
   } finally { await page.close(); }
 });
 
-for (const scenario of ['streaming-race', 'settled-race']) {
+for (const scenario of ['streaming-race', 'settled-race', 'streaming-angle-race']) {
   test(`${scenario}: an unavailable live source recovers in place once Host archival completes`, async () => {
     const page = await pageFor(scenario);
     try {
@@ -248,3 +286,65 @@ for (const scenario of ['streaming-race', 'settled-race']) {
     } finally { await page.close(); }
   });
 }
+
+for (const scenario of ['angle-saved', 'title-saved', 'escaped-saved', 'reference-saved', 'attachment-title']) {
+  test(`${scenario}: standard Markdown destinations resolve to saved bytes without origin requests`, async () => {
+    requests = [];
+    const page = await pageFor(scenario);
+    try {
+      await loaded(page);
+      assert.match(await page.locator('img').getAttribute('src'), /^data:image\/png;base64,/);
+      assert.deepEqual(requests, []);
+      assert.equal(await page.evaluate(() => window.imageReads), 1);
+      if (scenario !== 'attachment-title') {
+        assert.equal(await page.evaluate(() => window.deliveryQueries), 1);
+      }
+    } finally { await page.close(); }
+  });
+}
+
+for (const scenario of ['geometry-remote', 'geometry-saved']) {
+  test(`${scenario}: loading and ready images preserve the position of subsequent content`, async () => {
+    const page = await pageFor(scenario);
+    try {
+      await page.getByText('Loading image…', { exact: true }).waitFor();
+      const before = await page.getByText('Following paragraph', { exact: true }).boundingBox();
+      if (scenario === 'geometry-remote') releaseImage(); else releaseAttachment();
+      await loaded(page);
+      await page.getByText('Loading image…', { exact: true }).waitFor({ state: 'hidden' });
+      const after = await page.getByText('Following paragraph', { exact: true }).boundingBox();
+      assert.equal(after.y, before.y);
+    } finally {
+      if (scenario === 'geometry-remote') releaseImage(); else releaseAttachment();
+      await page.close();
+    }
+  });
+}
+
+test('image frames fit narrow viewports without distorting screenshots or limiting the enlarged preview', async () => {
+  const page = await pageFor('screenshot');
+  try {
+    await page.waitForFunction(() => [...document.images].some(image => image.naturalWidth > 1));
+    for (const width of [720, 360]) {
+      await page.setViewportSize({ width, height: 600 });
+      const geometry = await page.locator('.maka-markdown-image-preview img').evaluate(image => {
+        const frame = image.closest('.maka-markdown-image-frame').getBoundingClientRect();
+        const box = image.getBoundingClientRect();
+        return { frame: { x: frame.x, y: frame.y, right: frame.right, bottom: frame.bottom },
+          box: { x: box.x, y: box.y, right: box.right, bottom: box.bottom, width: box.width, height: box.height },
+          ratio: image.naturalWidth / image.naturalHeight };
+      });
+      assert.ok(Math.abs(geometry.box.width / geometry.box.height - geometry.ratio) < 0.01);
+      assert.ok(geometry.box.x >= geometry.frame.x && geometry.box.right <= geometry.frame.right + 1);
+      assert.ok(geometry.box.y >= geometry.frame.y && geometry.box.bottom <= geometry.frame.bottom + 1);
+      assert.ok(geometry.frame.right <= width);
+    }
+    await page.getByRole('button', { name: 'Enlarge image: Screenshot', exact: true }).click();
+    await page.waitForFunction(() => document.images.length > 1);
+    assert.equal(await page.locator('.maka-markdown-image-preview > img').count(), 1);
+    const dialog = await page.getByRole('dialog').boundingBox();
+    const frame = await page.locator('.maka-markdown-image-frame').boundingBox();
+    assert.ok(dialog.height > frame.height);
+    assert.equal(await page.getByRole('dialog').locator('img').getAttribute('src'), await page.locator('.maka-markdown-image-preview > img').getAttribute('src'));
+  } finally { await page.close(); }
+});
diff --git a/packages/ui/src/__tests__/markdown-image-source.test.ts b/packages/ui/src/__tests__/markdown-image-source.test.ts
new file mode 100644
index 00000000000..f6abd597f5e
--- /dev/null
+++ b/packages/ui/src/__tests__/markdown-image-source.test.ts
@@ -0,0 +1,54 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createMarkdownImageSourceResolver } from '../markdown-image-source.js';
+
+test('normalizes only complete image destinations present in canonical Markdown', () => {
+  const resolve = createMarkdownImageSourceResolver([
+    '![space](</tmp/my image.png>)',
+    '![title](https://example.com/image.png "Screenshot title")',
+    String.raw`![escaped](/tmp/a\(1\).png)`,
+    '![attachment](maka://runtime/attachments/image-1 "Preview")',
+  ].join('\n\n'));
+  assert.equal(resolve('</tmp/my image.png>'), '/tmp/my image.png');
+  assert.equal(resolve('https://example.com/image.png "Screenshot title"'), 'https://example.com/image.png');
+  assert.equal(resolve(String.raw`/tmp/a\(1\).png`), '/tmp/a(1).png');
+  assert.equal(resolve('maka://runtime/attachments/image-1 "Preview"'), 'maka://runtime/attachments/image-1');
+  assert.equal(resolve('/tmp/plain.png'), '/tmp/plain.png');
+});
+
+test('preserves literal title-like filenames resolved from image references', () => {
+  const source = '/tmp/my "image".png';
+  const resolve = createMarkdownImageSourceResolver(`![reference][picture]\n\n[picture]: <${source}>`);
+  assert.equal(resolve(source), source);
+});
+
+test('code, raw HTML, incomplete syntax and unrelated destinations do not become image grants', () => {
+  for (const text of [
+    '`![code](</tmp/my image.png>)`',
+    '```md\n![code](</tmp/my image.png>)\n```',
+    '<img src="/tmp/my image.png">',
+    '![incomplete](</tmp/my image.png>',
+    '![different](</tmp/other image.png>)',
+  ]) {
+    assert.equal(createMarkdownImageSourceResolver(text)('</tmp/my image.png>'), '</tmp/my image.png>');
+  }
+});
diff --git a/packages/ui/src/markdown-body.tsx b/packages/ui/src/markdown-body.tsx
index f864e2c3cbc..47aea1c0240 100644
--- a/packages/ui/src/markdown-body.tsx
+++ b/packages/ui/src/markdown-body.tsx
@@ -29,7 +29,7 @@
  * product-specific trust boundaries around that renderer.
  */
 
-import { MarkdownImage } from './markdown-image.js';
+import { MarkdownImage, MarkdownImageSourceProvider } from './markdown-image.js';
 import { ImageMessageScope } from './image-delivery.js';
 import { useCallback, useContext, useRef, type ReactNode } from 'react';
 import {
@@ -163,48 +163,50 @@ export function MarkdownBody(props: {
     : MARKDOWN_COMPONENTS[density];
 
   return (
-    <ImageMessageScope.Provider value={props.imageIdentity ? { ...props.imageIdentity, streaming: props.streaming } : undefined}>
-      <div
-        data-maka-contract="markdown"
-        data-maka-script={hasHanProse(props.text) ? 'han' : undefined}
-        // Migration-only identity wrapper. `display: contents` gives the
-        // contract harness a stable declared subtree without adding a layout
-        // box or interfering with Astryx's document root.
-        style={{ display: 'contents' }}
-      >
-        <AstryxMarkdown
-          autolink="gfm"
-          // Markdown holds no reading measure; the container it lands in does.
-          //
-          // Astryx caps prose at 680px by default but renders a supplied
-          // `components.code` bare — no spacing, no width, no alignment. Maka
-          // always supplies one, so any container that leans on the default gets
-          // prose at 680 and code blocks at whatever the container is: two right
-          // edges, which is the defect this whole change exists to remove. One
-          // authority per column, and it is the container.
-          contentWidth="100%"
-          // Chosen by the caller, and defaulting to document rhythm.
-          //
-          // The transcript passes `compact`: Astryx's default heading spacing
-          // assumes a page with a handful of sections, while an agent turn
-          // emits headings every few lines, so the default margins push each
-          // one into its own visual slab. That is the same argument that
-          // flattens transcript heading SIZES in styles/chat-message.css — and
-          // that rule is scoped to `.maka-turn` precisely because the other
-          // caller, the Daily Review panel, renders a report, which is a
-          // document. Hardcoding `compact` here contradicted that scoping: the
-          // review kept full heading sizes but got transcript block spacing,
-          // the one combination neither half of the argument asks for.
-          density={density}
-          components={components}
-          isStreaming={props.streaming}
-          settledText={props.settledText}
-          transformSource={transformMathSource}
+    <MarkdownImageSourceProvider text={budgetedText}>
+      <ImageMessageScope.Provider value={props.imageIdentity ? { ...props.imageIdentity, streaming: props.streaming } : undefined}>
+        <div
+          data-maka-contract="markdown"
+          data-maka-script={hasHanProse(props.text) ? 'han' : undefined}
+          // Migration-only identity wrapper. `display: contents` gives the
+          // contract harness a stable declared subtree without adding a layout
+          // box or interfering with Astryx's document root.
+          style={{ display: 'contents' }}
         >
-          {budgetedText}
-        </AstryxMarkdown>
-      </div>
-    </ImageMessageScope.Provider>
+          <AstryxMarkdown
+            autolink="gfm"
+            // Markdown holds no reading measure; the container it lands in does.
+            //
+            // Astryx caps prose at 680px by default but renders a supplied
+            // `components.code` bare — no spacing, no width, no alignment. Maka
+            // always supplies one, so any container that leans on the default gets
+            // prose at 680 and code blocks at whatever the container is: two right
+            // edges, which is the defect this whole change exists to remove. One
+            // authority per column, and it is the container.
+            contentWidth="100%"
+            // Chosen by the caller, and defaulting to document rhythm.
+            //
+            // The transcript passes `compact`: Astryx's default heading spacing
+            // assumes a page with a handful of sections, while an agent turn
+            // emits headings every few lines, so the default margins push each
+            // one into its own visual slab. That is the same argument that
+            // flattens transcript heading SIZES in styles/chat-message.css — and
+            // that rule is scoped to `.maka-turn` precisely because the other
+            // caller, the Daily Review panel, renders a report, which is a
+            // document. Hardcoding `compact` here contradicted that scoping: the
+            // review kept full heading sizes but got transcript block spacing,
+            // the one combination neither half of the argument asks for.
+            density={density}
+            components={components}
+            isStreaming={props.streaming}
+            settledText={props.settledText}
+            transformSource={transformMathSource}
+          >
+            {budgetedText}
+          </AstryxMarkdown>
+        </div>
+      </ImageMessageScope.Provider>
+    </MarkdownImageSourceProvider>
   );
 }
 
diff --git a/packages/ui/src/markdown-image-source.ts b/packages/ui/src/markdown-image-source.ts
new file mode 100644
index 00000000000..1fef771f8b9
--- /dev/null
+++ b/packages/ui/src/markdown-image-source.ts
@@ -0,0 +1,49 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { Lexer, Marked } from 'marked';
+
+const parser = new Marked({ gfm: true });
+
+/** Astryx can pass destination syntax through its image slot. Resolve it with
+ * the Host's Markdown parser, without changing the text rendered or stored.
+ * Parse the document lazily, once, only for destinations needing normalization.
+ */
+export function createMarkdownImageSourceResolver(text: string): (source: string) => string {
+  let canonicalSources: Set<string> | undefined;
+  return (source) => {
+    if (!/[<>"'\\\s&]/.test(source) || source.length > 4096 || text.length > 1024 * 1024)
+      return source;
+    if (!canonicalSources) {
+      const sources = new Set<string>();
+      parser.walkTokens(parser.lexer(text), (token) => {
+        if (token.type === 'image') sources.add(token.href);
+      });
+      canonicalSources = sources;
+    }
+    // Reference destinations already arrive without brackets/title syntax.
+    // Preserve a canonical path containing literal quotes or whitespace.
+    if (canonicalSources.has(source)) return source;
+    const markdown = `![](${source})`;
+    const [token] = Lexer.lexInline(markdown, { gfm: true });
+    return token?.type === 'image' && token.raw === markdown && canonicalSources.has(token.href)
+      ? token.href
+      : source;
+  };
+}
diff --git a/packages/ui/src/markdown-image.tsx b/packages/ui/src/markdown-image.tsx
index 9a98ab6d519..b5e93d9eb49 100644
--- a/packages/ui/src/markdown-image.tsx
+++ b/packages/ui/src/markdown-image.tsx
@@ -17,8 +17,8 @@
  * under the License.
  */
 
-import { useEffect, useRef, useState } from 'react';
-import { Button, IconButton, useLightbox } from '@astryxdesign/core';
+import { createContext, useContext, useEffect, useMemo, useRef, useState, type ReactNode } from 'react';
+import { Button, IconButton, Spinner, useLightbox } from '@astryxdesign/core';
 import { Maximize2 } from './icons.js';
 import { Link } from '@astryxdesign/core/Link';
 import { parseAttachmentResourceRef } from '@maka/core/attachments';
@@ -26,10 +26,18 @@ import { useAttachmentImage } from './attachment-image.js';
 import { useImageDelivery } from './image-delivery.js';
 import { getSharedUiCopy } from './shared-ui-copy.js';
 import { useUiLocale } from './locale-context.js';
+import { createMarkdownImageSourceResolver } from './markdown-image-source.js';
+
+const ImageSourceContext = createContext<(source: string) => string>((source) => source);
+export function MarkdownImageSourceProvider(props: { text: string; children: ReactNode }) {
+  const resolve = useMemo(() => createMarkdownImageSourceResolver(props.text), [props.text]);
+  return <ImageSourceContext.Provider value={resolve}>{props.children}</ImageSourceContext.Provider>;
+}
 
 /** Presentation only: Host resolves local addresses and archives; UI receives artifact identities. */
 export function MarkdownImage(props: { src: string; alt: string }) {
-  return <ImageResource key={props.src} {...props} />;
+  const source = useContext(ImageSourceContext)(props.src);
+  return <ImageResource key={source} src={source} alt={props.alt} />;
 }
 function ImageResource(props: { src: string; alt: string }) {
   const copy = getSharedUiCopy(useUiLocale()).markdown;
@@ -68,10 +76,11 @@ function ImageResource(props: { src: string; alt: string }) {
     : explicit && image.status === 'unavailable' ? copy.imageUnavailable
     : delivery.status === 'failed' ? copy.imageArchiveFailure(delivery.reason)
     : delivery.status === 'pending' || artifactId ? copy.imageLoading : copy.imageUnsupported;
-  return <span ref={anchor} className="maka-markdown-image-resource" data-maka-image-state={message ? failed ? 'failed' : 'loading' : 'ready'}>
+  const hasFrame = !visible || !!source || !!artifactId || delivery.status === 'pending';
+  return <span ref={anchor} className={`maka-markdown-image-resource${hasFrame ? ' maka-markdown-image-frame' : ''}`} data-maka-image-state={message ? failed ? 'failed' : 'loading' : 'ready'}>
     {message ? <span className="maka-markdown-image-placeholder">
       {props.alt && <span className="maka-markdown-image-caption">{props.alt}</span>}
-      <span role="status">{message}</span>
+      <span role="status">{hasFrame && !failed && delivery.status !== 'failed' && <Spinner size="sm" shade="subtle" aria-hidden="true" />} {message}</span>
       {(failed || delivery.status === 'failed') && sourceActions}
     </span> : source && <DisplayImage key={`${source}\0${attempt}`} src={source} alt={props.alt} onError={() => setFailedSource(source)} />}
     {!explicit && delivery.status === 'pending' && remote && source && <span className="maka-markdown-image-saving" role="status">{copy.imageSaving}</span>}
@@ -85,13 +94,13 @@ function DisplayImage(props: { src: string; alt: string; onError(): void }) {
   const [loaded, setLoaded] = useState(false);
   const lightbox = useLightbox({ media: { src: props.src, alt: props.alt }, hasZoom: true });
   return <>
-    {!loaded && <span className="maka-markdown-image-loading" role="status">{copy.imageLoading}</span>}
     <span className="maka-markdown-image-preview">
+      {!loaded && <span className="maka-markdown-image-loading" role="status"><Spinner size="sm" shade="subtle" aria-hidden="true" /> {copy.imageLoading}</span>}
       <img src={props.src} alt={props.alt} loading="lazy" decoding="async" referrerPolicy="no-referrer"
           className="maka-markdown-attachment-image" onLoad={() => setLoaded(true)} onError={props.onError} />
-      <span className="maka-markdown-image-expand">
+      {loaded && <span className="maka-markdown-image-expand">
         <IconButton icon={<Maximize2 size={16} />} size="sm" label={copy.imageExpand(props.alt)} onClick={() => lightbox.open()} />
-      </span>
+      </span>}
     </span>
     {lightbox.isOpen && lightbox.element}
   </>;
diff --git a/packages/ui/src/styles.css b/packages/ui/src/styles.css
index ebf93774871..0ea3665a5f8 100644
--- a/packages/ui/src/styles.css
+++ b/packages/ui/src/styles.css
@@ -632,21 +632,54 @@
   gap: var(--space-3);
 }
 .maka-markdown-image-resource { display: inline-block; position: relative; max-width: 100%; }
+/* Source resolution and decoding share one responsive frame. Transient status
+   overlays never add a row or move the transcript when they disappear. */
+.maka-markdown-image-frame {
+  display: block;
+  width: 640px;
+  aspect-ratio: 4 / 3;
+}
+.maka-markdown-image-frame > .maka-markdown-image-placeholder {
+  position: absolute;
+  inset: 0;
+  align-items: center;
+  justify-content: center;
+  border: 0;
+}
 .maka-markdown-image-preview {
-  display: inline-block;
-  position: relative;
-  min-inline-size: var(--space-10);
-  min-block-size: var(--space-10);
-  max-width: 100%;
+  display: flex;
+  position: absolute;
+  inset: 0;
+  align-items: center;
+  justify-content: center;
 }
 .maka-markdown-image-expand {
   position: absolute;
   inset-block-end: var(--space-2);
   inset-inline-end: var(--space-2);
 }
-.maka-markdown-image-preview img { margin: 0; max-height: 480px; object-fit: contain; }
-.maka-markdown-image-loading { display: block; color: var(--muted-foreground); font-size: var(--maka-font-size-sm); }
-.maka-markdown-image-saving { display: block; color: var(--muted-foreground); font-size: var(--maka-font-size-sm); margin-block-start: var(--space-1); }
+.maka-markdown-image-preview img { margin: 0; max-height: 100%; max-width: 100%; object-fit: contain; }
+.maka-markdown-image-loading {
+  position: absolute;
+  inset: 0;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  gap: var(--space-2);
+  color: var(--muted-foreground);
+  font-size: var(--maka-font-size-sm);
+}
+.maka-markdown-image-saving {
+  position: absolute;
+  inset-inline-start: var(--space-2);
+  inset-block-end: var(--space-2);
+  max-width: calc(100% - var(--space-10));
+  padding: var(--space-1) var(--space-2);
+  background: var(--background);
+  border-radius: var(--radius-surface);
+  color: var(--muted-foreground);
+  font-size: var(--maka-font-size-sm);
+}
 
 /* Markdown code renderers are custom components so Mermaid can be loaded only
    for settled Mermaid fences. Astryx skips its own spacing wrapper when

From fc9b9f701bd30d726340993ee693b007067cdc32 Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Tue, 6 Oct 2026 17:15:51 +0800
Subject: [PATCH 08/37] refactor(chat): share image parsing and archive
 contracts

Generated-by: Codex (GPT-6)
---
 package-lock.json                             |  5 +-
 packages/core/package.json                    |  4 +-
 .../core/src/__tests__/image-markdown.test.ts | 70 +++++++++++++
 packages/core/src/image-delivery.ts           | 21 ++--
 packages/core/src/image-markdown.ts           | 42 ++++++++
 packages/runtime-host/package.json            |  1 -
 .../chat-image-contract-share.json            |  5 +
 .../src/__tests__/chat-image-delivery.test.ts | 98 +++++++++++++++++++
 .../src/protocol/image-delivery.ts            | 13 ++-
 .../src/server/chat-image-artifact.ts         | 55 +++++++++++
 .../src/server/chat-image-delivery.ts         | 27 +++--
 .../src/server/chat-image-markdown.ts         | 24 ++---
 .../src/server/chat-image-source.ts           | 10 +-
 .../src/server/execution-artifacts.ts         | 29 +++---
 packages/runtime/src/image-file-reader.ts     |  5 +-
 packages/runtime/src/image-file.ts            |  5 +
 packages/ui/package.json                      |  1 -
 packages/ui/src/markdown-image-source.ts      | 29 +++---
 18 files changed, 358 insertions(+), 86 deletions(-)
 create mode 100644 packages/core/src/__tests__/image-markdown.test.ts
 create mode 100644 packages/core/src/image-markdown.ts
 create mode 100644 packages/runtime-host/protocol-compatible-changes/chat-image-contract-share.json
 create mode 100644 packages/runtime-host/src/server/chat-image-artifact.ts

diff --git a/package-lock.json b/package-lock.json
index 51acca210b5..b01ea74dee6 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -17304,7 +17304,8 @@
       "version": "0.1.0",
       "license": "Apache-2.0",
       "dependencies": {
-        "intl-messageformat": "11.2.15"
+        "intl-messageformat": "11.2.15",
+        "marked": "^18.0.11"
       }
     },
     "packages/core/node_modules/@formatjs/icu-messageformat-parser": {
@@ -17420,7 +17421,6 @@
         "@maka/core": "0.1.0",
         "@maka/runtime": "0.1.0",
         "@maka/storage": "0.1.0",
-        "marked": "^18.0.11",
         "systeminformation": "^5.33.13",
         "ws": "^8.21.3",
         "yaml": "^2.9.1",
@@ -17511,7 +17511,6 @@
         "clsx": "^2.1.1",
         "katex": "0.18.9",
         "lucide-react": "^1.48.0",
-        "marked": "^18.0.11",
         "mermaid": "^11.17.2",
         "react": "^19.3.0",
         "react-dom": "^19.3.0",
diff --git a/packages/core/package.json b/packages/core/package.json
index dfc6be42d83..4ea43dd7051 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -64,6 +64,7 @@
     "./tool-result-archive-evidence": "./dist/tool-result-archive-evidence.js",
     "./attachments": "./dist/attachments.js",
     "./image-delivery": "./dist/image-delivery.js",
+    "./image-markdown": "./dist/image-markdown.js",
     "./artifacts": "./dist/artifacts.js",
     "./pet": "./dist/pet.js",
     "./skill-invocation": "./dist/skill-invocation.js",
@@ -178,6 +179,7 @@
     "test:dist": "node --test \"dist/**/*.test.js\""
   },
   "dependencies": {
-    "intl-messageformat": "11.2.15"
+    "intl-messageformat": "11.2.15",
+    "marked": "^18.0.11"
   }
 }
diff --git a/packages/core/src/__tests__/image-markdown.test.ts b/packages/core/src/__tests__/image-markdown.test.ts
new file mode 100644
index 00000000000..c983b397ab1
--- /dev/null
+++ b/packages/core/src/__tests__/image-markdown.test.ts
@@ -0,0 +1,70 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { markdownImageSources, parseMarkdownImageDestination } from '../image-markdown.js';
+import { IMAGE_MARKDOWN_MAX_LENGTH } from '../image-delivery.js';
+
+test('canonical destinations retain document order, references and explicit attachments', () => {
+  assert.deepEqual(
+    markdownImageSources(
+      [
+        '![space](</tmp/a (1).png> "Title")',
+        '![reference][pic]',
+        '![duplicate](</tmp/a (1).png>)',
+        '![attachment](maka://runtime/attachments/image-1 "Preview")',
+        String.raw`![escaped](/tmp/a\(1\).png)`,
+        '',
+        '[pic]: </tmp/my "image".png>',
+        '`![code](/tmp/secret.png)`',
+        '```md',
+        '![fenced](/tmp/secret2.png)',
+        '```',
+        '<img src="/tmp/html.png">',
+        '![incomplete](</tmp/partial.png>',
+      ].join('\n'),
+    ),
+    [
+      '/tmp/a (1).png',
+      '/tmp/my "image".png',
+      'maka://runtime/attachments/image-1',
+      '/tmp/a(1).png',
+    ],
+  );
+});
+
+test('document budget is measured in UTF-16 code units and accepts the boundary', () => {
+  const image = '![x](/tmp/a.png)';
+  const text = image + '\n\n' + '中'.repeat(IMAGE_MARKDOWN_MAX_LENGTH - image.length - 2);
+  assert.equal(text.length, IMAGE_MARKDOWN_MAX_LENGTH);
+  assert.deepEqual(markdownImageSources(text), ['/tmp/a.png']);
+  assert.deepEqual(markdownImageSources(text + '中'), []);
+});
+
+test('inline destinations require one complete image token with no trailing syntax', () => {
+  assert.equal(parseMarkdownImageDestination('</tmp/my image.png> "Title"'), '/tmp/my image.png');
+  assert.equal(parseMarkdownImageDestination(String.raw`/tmp/a\(1\).png`), '/tmp/a(1).png');
+  for (const source of [
+    '</tmp/incomplete.png',
+    '/tmp/a.png) trailing',
+    '/tmp/a.png) ![b](/tmp/b.png',
+  ])
+    assert.equal(parseMarkdownImageDestination(source), undefined);
+});
diff --git a/packages/core/src/image-delivery.ts b/packages/core/src/image-delivery.ts
index a949ab0b4af..f320d6a9d8e 100644
--- a/packages/core/src/image-delivery.ts
+++ b/packages/core/src/image-delivery.ts
@@ -18,6 +18,18 @@
  */
 
 /** Client-safe delivery contract. No filesystem or networking capabilities live here. */
+export const IMAGE_DELIVERY_IDENTITY_MAX_LENGTH = 512;
+export const IMAGE_DELIVERY_SOURCE_MAX_LENGTH = 4096;
+/** JavaScript string length, shared by stream capture and Markdown consumers. */
+export const IMAGE_MARKDOWN_MAX_LENGTH = 1024 * 1024;
+export function isImageDeliverySource(value: unknown): value is string {
+  return (
+    typeof value === 'string' &&
+    value.length > 0 &&
+    value.length <= IMAGE_DELIVERY_SOURCE_MAX_LENGTH &&
+    !/[\x00-\x1f\x7f]/.test(value)
+  );
+}
 export const IMAGE_DELIVERY_FAILURES = [
   'not_found',
   'not_allowed',
@@ -65,17 +77,14 @@ export function isImageDeliveryMetadata(value: unknown): value is ImageDeliveryM
     ) &&
     typeof v.messageId === 'string' &&
     v.messageId.length > 0 &&
-    v.messageId.length <= 512 &&
-    typeof v.source === 'string' &&
-    v.source.length > 0 &&
-    v.source.length <= 4096 &&
+    v.messageId.length <= IMAGE_DELIVERY_IDENTITY_MAX_LENGTH &&
+    isImageDeliverySource(v.source) &&
     ['pending', 'ready', 'failed'].includes(String(v.status)) &&
     (v.reason === undefined ||
       IMAGE_DELIVERY_FAILURES.includes(v.reason as ImageDeliveryFailure)) &&
     (v.contentSha256 === undefined ||
       (typeof v.contentSha256 === 'string' && /^[a-f0-9]{64}$/.test(v.contentSha256))) &&
     (v.status === 'failed' ? v.reason !== undefined : v.reason === undefined) &&
-    (v.status === 'ready' ? v.contentSha256 !== undefined : v.contentSha256 === undefined) &&
-    !/[\x00-\x1f\x7f]/.test(v.source as string)
+    (v.status === 'ready' ? v.contentSha256 !== undefined : v.contentSha256 === undefined)
   );
 }
diff --git a/packages/core/src/image-markdown.ts b/packages/core/src/image-markdown.ts
new file mode 100644
index 00000000000..ebbdec6db57
--- /dev/null
+++ b/packages/core/src/image-markdown.ts
@@ -0,0 +1,42 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { Lexer, Marked } from 'marked';
+import { IMAGE_MARKDOWN_MAX_LENGTH } from './image-delivery.js';
+
+const parser = new Marked({ gfm: true });
+
+/** Canonical image destinations in real Markdown nodes, including attachment refs.
+ * Consumers own their source policy; parsing grants no filesystem or network access.
+ */
+export function markdownImageSources(text: string): string[] {
+  if (!text.includes('![') || text.length > IMAGE_MARKDOWN_MAX_LENGTH) return [];
+  const sources = new Set<string>();
+  parser.walkTokens(parser.lexer(text), (token) => {
+    if (token.type === 'image') sources.add(token.href);
+  });
+  return [...sources];
+}
+
+/** Resolve a complete inline destination, rejecting trailing or partial syntax. */
+export function parseMarkdownImageDestination(source: string): string | undefined {
+  const markdown = `![](${source})`;
+  const [token] = Lexer.lexInline(markdown, { gfm: true });
+  return token?.type === 'image' && token.raw === markdown ? token.href : undefined;
+}
diff --git a/packages/runtime-host/package.json b/packages/runtime-host/package.json
index 7e1a3344088..90912442303 100644
--- a/packages/runtime-host/package.json
+++ b/packages/runtime-host/package.json
@@ -37,7 +37,6 @@
     "@maka/core": "0.1.0",
     "@maka/runtime": "0.1.0",
     "@maka/storage": "0.1.0",
-    "marked": "^18.0.11",
     "systeminformation": "^5.33.13",
     "ws": "^8.21.3",
     "yaml": "^2.9.1",
diff --git a/packages/runtime-host/protocol-compatible-changes/chat-image-contract-share.json b/packages/runtime-host/protocol-compatible-changes/chat-image-contract-share.json
new file mode 100644
index 00000000000..3a050d31b6c
--- /dev/null
+++ b/packages/runtime-host/protocol-compatible-changes/chat-image-contract-share.json
@@ -0,0 +1,5 @@
+{
+  "epoch": 206,
+  "files": ["packages/runtime-host/src/protocol/image-delivery.ts"],
+  "reason": "Shares the existing 512-character identity bound and 4096-character non-empty, control-free source validation with the core image delivery contract. Accepted and rejected request values, validation order, frame keys, output decoding and protocol errors are unchanged."
+}
diff --git a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
index 2d77d5a7966..51b577fc8f5 100644
--- a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
+++ b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
@@ -36,6 +36,8 @@ import { chatImageSources } from '../server/chat-image-markdown.js';
 import { checkedChatImage, downloadChatImage } from '../server/chat-image-source.js';
 import { IMAGE_DELIVERY_OPERATION_SPECS } from '../protocol/image-delivery.js';
 import { SessionAdmissionGate } from '../server/session-admission-gate.js';
+import { createHostExecutionArtifactServices } from '../server/execution-artifacts.js';
+import { isImageDeliveryMetadata, isImageDeliverySource } from '@maka/core/image-delivery';
 const PNG = Buffer.from(
   'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8DwHwAFBQIAX8jx0gAAAABJRU5ErkJggg==',
   'base64',
@@ -614,3 +616,99 @@ test('completed turns release unfinished stream slots without archiving partial
     await f.close();
   }
 });
+
+test('capture, wire and stored metadata share source limits while retaining boundary policies', () => {
+  const decode = IMAGE_DELIVERY_OPERATION_SPECS['artifact.image.resolve'].decodeInput;
+  const source = '/' + 'a'.repeat(4095);
+  assert.deepEqual(chatImageSources(`![x](<${source}>)`), [source]);
+  assert.equal(decode({ ...REQUEST, source, messageId: 'm'.repeat(512) }).source, source);
+  assert.throws(() => decode({ ...REQUEST, messageId: 'm'.repeat(513) }));
+  for (const source of ['', '/' + 'a'.repeat(4096), '/tmp/a\x01.png', '/tmp/a\x7f.png']) {
+    assert.equal(isImageDeliverySource(source), false);
+    assert.equal(isImageDeliveryMetadata({ messageId: 'm', source, status: 'pending' }), false);
+    assert.throws(() => decode({ ...REQUEST, source }));
+    assert.deepEqual(chatImageSources(`![x](<${source}>)`), []);
+  }
+  // Explicit attachment refs belong to UI resolution, not automatic source capture.
+  assert.deepEqual(chatImageSources('![x](maka://runtime/attachments/image-1)'), []);
+  assert.equal(
+    isImageDeliveryMetadata({ messageId: 'm\x01', source: REQUEST.source, status: 'pending' }),
+    true,
+  );
+  assert.throws(() => decode({ ...REQUEST, messageId: 'm\x01' }));
+  assert.equal(
+    chatImageSources(Array.from({ length: 70 }, (_, i) => `![x](/tmp/${i}.png)`).join('\n')).length,
+    64,
+  );
+});
+
+test('local and downloaded invalid image bytes retain identical failure reasons', async () => {
+  const f = await fixture();
+  try {
+    for (const [bytes, reason] of [
+      [PNG.subarray(0, 8), 'unsupported_mime'],
+      [new Uint8Array(2 * 1024 * 1024 + 1), 'too_large'],
+    ] as const) {
+      assert.throws(
+        () => checkedChatImage(bytes),
+        (error: unknown) => error instanceof Error && 'reason' in error && error.reason === reason,
+      );
+      const source = join(f.root, 'invalid.png');
+      await writeFile(source, bytes);
+      await assert.rejects(
+        createImageFileReader()({ path: source, cwd: f.root }),
+        (error: unknown) => error instanceof Error && 'reason' in error && error.reason === reason,
+      );
+    }
+  } finally {
+    await f.close();
+  }
+});
+
+test('automatic capture and PublishImage share content quota without merging their identities', async () => {
+  const limits = { sessionBytes: PNG.length, workspaceBytes: PNG.length };
+  const f = await fixture(limits, async () => checkedChatImage(PNG));
+  try {
+    observe(f.service, REQUEST.source);
+    await f.service.waitForIdle();
+    const automatic = await f.service.resolve(REQUEST);
+    assert.equal(automatic.status, 'ready');
+    if (automatic.status !== 'ready') return;
+    const services = createHostExecutionArtifactServices({
+      artifacts: f.authority.store,
+      sessionAdmission: new SessionAdmissionGate(),
+      sessions: { probeSessionRemoval: async () => ({ kind: 'present' }) },
+      imageArchiveLimits: limits,
+      requestDrain: () => assert.fail('shared bytes must not exceed quota or drain'),
+    });
+    const explicit = await services.publishImage({
+      sessionId: REQUEST.sessionId,
+      turnId: REQUEST.turnId,
+      toolCallId: 'publish-call',
+      name: 'published.png',
+      bytes: PNG,
+      mimeType: 'image/png',
+    });
+    assert.notEqual(explicit.relativePath, automatic.artifactId);
+    const captured = (await f.authority.store.getInSession(REQUEST.sessionId, automatic.artifactId))
+      .record!;
+    const published = (
+      await f.authority.store.getInSession(REQUEST.sessionId, explicit.relativePath)
+    ).record!;
+    assert.equal(captured.imageDelivery?.contentSha256, published.imageDelivery?.contentSha256);
+    assert.equal(captured.imageDelivery?.source, REQUEST.source);
+    assert.equal(published.imageDelivery?.source, 'published:publish-call');
+    assert.equal(published.imageDelivery?.messageId, 'publish-call');
+    assert.equal(published.summary, 'Published chat image');
+    assert.equal(
+      (await stat(join(f.root, 'artifacts', captured.relativePath))).ino,
+      (await stat(join(f.root, 'artifacts', published.relativePath))).ino,
+    );
+    const page = await f.authority.store.listPage(REQUEST.sessionId, { offset: 0, limit: 10 });
+    assert.equal(page.total, 2);
+    assert.ok(page.records.every((record) => record.imageDelivery?.status === 'ready'));
+    assert.deepEqual(f.errors, []);
+  } finally {
+    await f.close();
+  }
+});
diff --git a/packages/runtime-host/src/protocol/image-delivery.ts b/packages/runtime-host/src/protocol/image-delivery.ts
index 7ac1d5a01e1..c22ec6826ca 100644
--- a/packages/runtime-host/src/protocol/image-delivery.ts
+++ b/packages/runtime-host/src/protocol/image-delivery.ts
@@ -19,6 +19,8 @@
 
 import {
   IMAGE_DELIVERY_FAILURES,
+  IMAGE_DELIVERY_IDENTITY_MAX_LENGTH,
+  isImageDeliverySource,
   type ImageDeliveryRequest,
   type ImageDeliveryResult,
 } from '@maka/core/image-delivery';
@@ -67,11 +69,16 @@ export const IMAGE_DELIVERY_OPERATION_SPECS = {
       };
       if (v.retry !== undefined && typeof v.retry !== 'boolean')
         throw invalidProtocolFrame('Invalid image retry flag');
+      const source = (s: unknown) => {
+        if (!isImageDeliverySource(s))
+          throw invalidProtocolFrame('Invalid image delivery identity');
+        return s;
+      };
       return {
         sessionId: requireEntityId(v.sessionId, 'sessionId'),
-        turnId: text(v.turnId, 512),
-        messageId: text(v.messageId, 512),
-        source: text(v.source, 4096),
+        turnId: text(v.turnId, IMAGE_DELIVERY_IDENTITY_MAX_LENGTH),
+        messageId: text(v.messageId, IMAGE_DELIVERY_IDENTITY_MAX_LENGTH),
+        source: source(v.source),
         ...(v.retry === true ? { retry: true } : {}),
       };
     },
diff --git a/packages/runtime-host/src/server/chat-image-artifact.ts b/packages/runtime-host/src/server/chat-image-artifact.ts
new file mode 100644
index 00000000000..b2ee0b7a1af
--- /dev/null
+++ b/packages/runtime-host/src/server/chat-image-artifact.ts
@@ -0,0 +1,55 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { createHash } from 'node:crypto';
+import { DEFAULT_IMAGE_ARCHIVE_LIMITS, type ImageArchiveLimits } from '@maka/core/image-delivery';
+import type { InteractiveArtifactStoreWriter } from '@maka/storage/artifact-stores';
+import type { ChatImageBytes } from './chat-image-source.js';
+
+/** Build the shared ready record; callers own admission, identity and failures. */
+export function readyChatImageArtifact(input: {
+  id: string;
+  sessionId: string;
+  turnId: string;
+  name: string;
+  messageId: string;
+  source: string;
+  image: ChatImageBytes;
+  summary?: string;
+  limits?: ImageArchiveLimits;
+}): Parameters<InteractiveArtifactStoreWriter['create']>[0] {
+  return {
+    id: input.id,
+    sessionId: input.sessionId,
+    turnId: input.turnId,
+    name: input.name,
+    kind: 'image',
+    content: input.image.bytes,
+    mimeType: input.image.mimeType,
+    source: 'tool_result_projection',
+    ...(input.summary !== undefined ? { summary: input.summary } : {}),
+    imageDelivery: {
+      messageId: input.messageId,
+      source: input.source,
+      status: 'ready',
+      contentSha256: createHash('sha256').update(input.image.bytes).digest('hex'),
+    },
+    imageArchiveLimits: input.limits ?? DEFAULT_IMAGE_ARCHIVE_LIMITS,
+  };
+}
diff --git a/packages/runtime-host/src/server/chat-image-delivery.ts b/packages/runtime-host/src/server/chat-image-delivery.ts
index 95649a5c6c5..9c6b88dd3a9 100644
--- a/packages/runtime-host/src/server/chat-image-delivery.ts
+++ b/packages/runtime-host/src/server/chat-image-delivery.ts
@@ -22,7 +22,7 @@ import { ImageFileReadError } from '@maka/runtime/image-file-reader';
 import type { CompleteEvent, TextCompleteEvent, TextDeltaEvent } from '@maka/core/events';
 import { foldAssistantDelta } from '@maka/core/events';
 import {
-  DEFAULT_IMAGE_ARCHIVE_LIMITS,
+  IMAGE_MARKDOWN_MAX_LENGTH,
   type ImageArchiveLimits,
   type ImageDeliveryRequest,
   type ImageDeliveryResult,
@@ -34,6 +34,7 @@ import {
 } from '@maka/storage/artifact-stores';
 import type { SessionAdmissionGate } from './session-admission-gate.js';
 import { chatImageSources } from './chat-image-markdown.js';
+import { readyChatImageArtifact } from './chat-image-artifact.js';
 import { abortable } from '../client/wait-for-ready.js';
 import {
   downloadChatImage,
@@ -102,7 +103,7 @@ export class ChatImageDeliveryService {
       if (!folded) return;
       stream.text += folded.tail;
     }
-    if (stream.text.length > 1024 * 1024) {
+    if (stream.text.length > IMAGE_MARKDOWN_MAX_LENGTH) {
       clearTimeout(stream.timer);
       this.#streams.delete(key);
       return;
@@ -297,19 +298,17 @@ export class ChatImageDeliveryService {
       return;
     }
     try {
-      await publish({
-        ...base,
-        id: `chat_image_result_${deliveryKey(identity)}`,
-        kind: 'image',
-        content: image.bytes,
-        mimeType: image.mimeType,
-        imageDelivery: {
+      await publish(
+        readyChatImageArtifact({
+          id: `chat_image_result_${deliveryKey(identity)}`,
+          sessionId,
+          turnId,
+          name: base.name,
           ...metadata,
-          status: 'ready',
-          contentSha256: createHash('sha256').update(image.bytes).digest('hex'),
-        },
-        imageArchiveLimits: this.ports.limits ?? DEFAULT_IMAGE_ARCHIVE_LIMITS,
-      });
+          image,
+          limits: this.ports.limits,
+        }),
+      );
     } catch (error) {
       if (!(error instanceof ImageArchiveQuotaError)) throw error;
       await publish({
diff --git a/packages/runtime-host/src/server/chat-image-markdown.ts b/packages/runtime-host/src/server/chat-image-markdown.ts
index 0675689f675..82ca33b020b 100644
--- a/packages/runtime-host/src/server/chat-image-markdown.ts
+++ b/packages/runtime-host/src/server/chat-image-markdown.ts
@@ -17,22 +17,12 @@
  * under the License.
  */
 
-import { Marked } from 'marked';
-const parser = new Marked({ gfm: true });
-/** Parse actual Markdown nodes, excluding code, HTML and incomplete destinations. */
+import { isImageDeliverySource } from '@maka/core/image-delivery';
+import { markdownImageSources } from '@maka/core/image-markdown';
+
+/** Capture policy excludes explicit attachments and limits jobs per message. */
 export function chatImageSources(text: string): string[] {
-  if (!text.includes('![') || text.length > 1024 * 1024) return [];
-  const sources = new Set<string>();
-  parser.walkTokens(parser.lexer(text), (token) => {
-    if (token.type !== 'image') return;
-    const source = token.href;
-    if (
-      source.length > 0 &&
-      source.length <= 4096 &&
-      !/[\u0000-\u001f\u007f]/.test(source) &&
-      !source.startsWith('maka:')
-    )
-      sources.add(source);
-  });
-  return [...sources].slice(0, 64);
+  return markdownImageSources(text)
+    .filter((source) => isImageDeliverySource(source) && !source.startsWith('maka:'))
+    .slice(0, 64);
 }
diff --git a/packages/runtime-host/src/server/chat-image-source.ts b/packages/runtime-host/src/server/chat-image-source.ts
index 3fde63293c2..97d30b319df 100644
--- a/packages/runtime-host/src/server/chat-image-source.ts
+++ b/packages/runtime-host/src/server/chat-image-source.ts
@@ -23,7 +23,11 @@ import { request as httpsRequest } from 'node:https';
 import { isIP } from 'node:net';
 import { fileURLToPath } from 'node:url';
 import { ARTIFACT_IMAGE_PREVIEW_MAX_BYTES } from '@maka/core/artifacts';
-import { ImageFileError, validateImageBytes } from '@maka/runtime/image-file';
+import {
+  ImageFileError,
+  imageFileFailureReason,
+  validateImageBytes,
+} from '@maka/runtime/image-file';
 import type { ImageDeliveryFailure } from '@maka/core/image-delivery';
 export class ImageSourceError extends Error {
   constructor(readonly reason: ImageDeliveryFailure) {
@@ -39,9 +43,7 @@ export function checkedChatImage(bytes: Uint8Array): ChatImageBytes {
     return validateImageBytes(bytes, 'chat');
   } catch (error) {
     if (!(error instanceof ImageFileError)) throw error;
-    throw new ImageSourceError(
-      error.code === 'ERR_IMAGE_TOO_LARGE' ? 'too_large' : 'unsupported_mime',
-    );
+    throw new ImageSourceError(imageFileFailureReason(error));
   }
 }
 export function localImagePath(source: string): string | undefined {
diff --git a/packages/runtime-host/src/server/execution-artifacts.ts b/packages/runtime-host/src/server/execution-artifacts.ts
index 9dc11f953e2..b3a08d8d81a 100644
--- a/packages/runtime-host/src/server/execution-artifacts.ts
+++ b/packages/runtime-host/src/server/execution-artifacts.ts
@@ -17,7 +17,6 @@
  * under the License.
  */
 
-import { DEFAULT_IMAGE_ARCHIVE_LIMITS } from '@maka/core/image-delivery';
 import { createHash } from 'node:crypto';
 import { open, realpath, stat } from 'node:fs/promises';
 import { isAbsolute, resolve } from 'node:path';
@@ -48,6 +47,7 @@ import {
 import type { SessionManagerDeps } from '@maka/runtime/session-manager';
 import type { SessionAdmissionGate } from './session-admission-gate.js';
 import type { SessionPresenceReader } from './session-presence.js';
+import { readyChatImageArtifact } from './chat-image-artifact.js';
 
 export interface HostExecutionArtifactServices {
   recordToolArtifacts(event: ToolArtifactRecorderInput): Promise<void>;
@@ -138,24 +138,19 @@ export function createHostExecutionArtifactServices(input: {
       const id = `published_image_${createHash('sha256')
         .update(JSON.stringify([image.sessionId, image.turnId, image.toolCallId]))
         .digest('hex')}`;
-      const artifact = await publish({
-        id,
-        sessionId: image.sessionId,
-        turnId: image.turnId,
-        name: image.name,
-        kind: 'image',
-        content: image.bytes,
-        mimeType,
-        source: 'tool_result_projection',
-        summary: 'Published chat image',
-        imageDelivery: {
+      const artifact = await publish(
+        readyChatImageArtifact({
+          id,
+          sessionId: image.sessionId,
+          turnId: image.turnId,
+          name: image.name,
           messageId: image.toolCallId,
           source: `published:${image.toolCallId}`,
-          status: 'ready',
-          contentSha256: createHash('sha256').update(image.bytes).digest('hex'),
-        },
-        imageArchiveLimits: input.imageArchiveLimits ?? DEFAULT_IMAGE_ARCHIVE_LIMITS,
-      });
+          image: { bytes: image.bytes, mimeType },
+          summary: 'Published chat image',
+          limits: input.imageArchiveLimits,
+        }),
+      );
       if (!artifact)
         throw new Error('The session was removed before the image could be published.');
       return { kind: 'session_file', sessionId: image.sessionId, relativePath: artifact.id };
diff --git a/packages/runtime/src/image-file-reader.ts b/packages/runtime/src/image-file-reader.ts
index 6d5e7984767..5be80181fc3 100644
--- a/packages/runtime/src/image-file-reader.ts
+++ b/packages/runtime/src/image-file-reader.ts
@@ -23,7 +23,7 @@ import {
   type FilesystemExecuteInput,
 } from './filesystem-executor.js';
 import { createLocalWorkspaceExecutor } from './workspace-executor.js';
-import { ImageFileError } from './image-file.js';
+import { ImageFileError, imageFileFailureReason } from './image-file.js';
 import { FilesystemWorkerClientError } from './filesystem-worker/client.js';
 import { SandboxCommandError } from './sandbox/errors.js';
 
@@ -45,8 +45,7 @@ export class ImageFileReadError extends Error {
 }
 
 function readFailure(error: unknown): ImageFileReadFailure {
-  if (error instanceof ImageFileError)
-    return error.code === 'ERR_IMAGE_TOO_LARGE' ? 'too_large' : 'unsupported_mime';
+  if (error instanceof ImageFileError) return imageFileFailureReason(error);
   if (error instanceof SandboxCommandError) return 'not_allowed';
   const code =
     error instanceof FilesystemWorkerClientError
diff --git a/packages/runtime/src/image-file.ts b/packages/runtime/src/image-file.ts
index 361e33ed6c4..cda689e2785 100644
--- a/packages/runtime/src/image-file.ts
+++ b/packages/runtime/src/image-file.ts
@@ -47,6 +47,11 @@ export class ImageFileError extends Error {
   }
 }
 
+/** Translate validated image failures without changing backend/transport errors. */
+export function imageFileFailureReason(error: ImageFileError): 'too_large' | 'unsupported_mime' {
+  return error.code === 'ERR_IMAGE_TOO_LARGE' ? 'too_large' : 'unsupported_mime';
+}
+
 export function isSupportedImagePath(path: string): boolean {
   return IMAGE_EXTENSIONS.has(extname(path).toLowerCase());
 }
diff --git a/packages/ui/package.json b/packages/ui/package.json
index 563f59710b9..8de5e24cdb8 100644
--- a/packages/ui/package.json
+++ b/packages/ui/package.json
@@ -33,7 +33,6 @@
     "clsx": "^2.1.1",
     "katex": "0.18.9",
     "lucide-react": "^1.48.0",
-    "marked": "^18.0.11",
     "mermaid": "^11.17.2",
     "react": "^19.3.0",
     "react-dom": "^19.3.0",
diff --git a/packages/ui/src/markdown-image-source.ts b/packages/ui/src/markdown-image-source.ts
index 1fef771f8b9..12cfc8627c6 100644
--- a/packages/ui/src/markdown-image-source.ts
+++ b/packages/ui/src/markdown-image-source.ts
@@ -17,9 +17,11 @@
  * under the License.
  */
 
-import { Lexer, Marked } from 'marked';
-
-const parser = new Marked({ gfm: true });
+import {
+  IMAGE_DELIVERY_SOURCE_MAX_LENGTH,
+  IMAGE_MARKDOWN_MAX_LENGTH,
+} from '@maka/core/image-delivery';
+import { markdownImageSources, parseMarkdownImageDestination } from '@maka/core/image-markdown';
 
 /** Astryx can pass destination syntax through its image slot. Resolve it with
  * the Host's Markdown parser, without changing the text rendered or stored.
@@ -28,22 +30,17 @@ const parser = new Marked({ gfm: true });
 export function createMarkdownImageSourceResolver(text: string): (source: string) => string {
   let canonicalSources: Set<string> | undefined;
   return (source) => {
-    if (!/[<>"'\\\s&]/.test(source) || source.length > 4096 || text.length > 1024 * 1024)
+    if (
+      !/[<>"'\\\s&]/.test(source) ||
+      source.length > IMAGE_DELIVERY_SOURCE_MAX_LENGTH ||
+      text.length > IMAGE_MARKDOWN_MAX_LENGTH
+    )
       return source;
-    if (!canonicalSources) {
-      const sources = new Set<string>();
-      parser.walkTokens(parser.lexer(text), (token) => {
-        if (token.type === 'image') sources.add(token.href);
-      });
-      canonicalSources = sources;
-    }
+    canonicalSources ??= new Set(markdownImageSources(text));
     // Reference destinations already arrive without brackets/title syntax.
     // Preserve a canonical path containing literal quotes or whitespace.
     if (canonicalSources.has(source)) return source;
-    const markdown = `![](${source})`;
-    const [token] = Lexer.lexInline(markdown, { gfm: true });
-    return token?.type === 'image' && token.raw === markdown && canonicalSources.has(token.href)
-      ? token.href
-      : source;
+    const destination = parseMarkdownImageDestination(source);
+    return destination !== undefined && canonicalSources.has(destination) ? destination : source;
   };
 }

From 74004758b4d1ac674574259a56d6c516793e3fc3 Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Tue, 6 Oct 2026 19:33:57 +0800
Subject: [PATCH 09/37] fix(chat): resolve encoded local image paths without
 breaking literal names

Retry missing local Markdown image paths with one percent-decoding pass through the same filesystem boundary and source-read budget. Preserve literal percent filenames, file URL semantics, and original delivery identities. Add capture, replay, validation, and permission regression coverage.

Generated-by: Codex (GPT-6)
---
 .../src/__tests__/chat-image-delivery.test.ts | 136 +++++++++++++++++-
 .../src/server/chat-image-delivery.ts         |  23 ++-
 .../src/server/chat-image-source.ts           |  15 +-
 3 files changed, 168 insertions(+), 6 deletions(-)

diff --git a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
index 51b577fc8f5..ae04f90635a 100644
--- a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
+++ b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
@@ -19,12 +19,13 @@
 
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
-import { mkdtemp, readFile, writeFile, rm, stat } from 'node:fs/promises';
+import { mkdtemp, mkdir, readFile, writeFile, rm, stat } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+import { pathToFileURL } from 'node:url';
 import { createServer } from 'node:http';
 import { createHash } from 'node:crypto';
-import { createImageFileReader } from '@maka/runtime/image-file-reader';
+import { createImageFileReader, ImageFileReadError } from '@maka/runtime/image-file-reader';
 import { FilesystemWorkerClientError } from '@maka/runtime/filesystem-worker';
 import { openInteractiveArtifactStoreForWrite } from '@maka/storage/artifact-stores';
 import { resolveStorageRoot, tryAcquireInteractiveRootOwner } from '@maka/storage/root-authority';
@@ -228,6 +229,137 @@ test('automatically saves a local delivery without any UI request; deletion and
     await f.close();
   }
 });
+test('encoded local Markdown images are archived under the original source and replay after deletion', async () => {
+  const reader = createImageFileReader();
+  const f = await fixture(undefined, (_session, path, abortSignal) =>
+    reader({ path, cwd: f.root, abortSignal }),
+  );
+  try {
+    const directory = join(f.root, 'My Project');
+    await mkdir(directory);
+    for (const name of ['screen shot.png', '截图.png', 'literal%20name.png']) {
+      const path = join(directory, name);
+      const source = `${f.root}/My%20Project/${encodeURIComponent(name)}`;
+      await writeFile(path, PNG);
+      observe(f.service, source);
+      await f.service.waitForIdle();
+      await rm(path);
+      const result = await f.service.resolve({ ...REQUEST, source });
+      assert.equal(result.status, 'ready', source);
+      if (result.status !== 'ready') continue;
+      const bytes = await f.authority.store.readBinaryInSession(
+        REQUEST.sessionId,
+        result.artifactId,
+      );
+      assert.equal(bytes.ok, true);
+      if (bytes.ok) assert.equal(bytes.base64, PNG.toString('base64'));
+    }
+    assert.deepEqual(f.errors, []);
+  } finally {
+    await f.close();
+  }
+});
+
+test('literal percent filenames retain precedence and file URLs are decoded only once', async () => {
+  const paths: string[] = [];
+  const reader = createImageFileReader();
+  const f = await fixture(undefined, (_session, path, abortSignal) => {
+    paths.push(path);
+    return reader({ path, cwd: f.root, abortSignal });
+  });
+  try {
+    for (const name of ['literal%20name.png', '100%.png', 'invalid%E4.png']) {
+      const path = join(f.root, name);
+      await writeFile(path, PNG);
+      if (name.includes('%20')) await writeFile(path.replace('%20', ' '), 'wrong source');
+      for (const source of [path, pathToFileURL(path).href]) {
+        paths.length = 0;
+        observe(f.service, source);
+        await f.service.waitForIdle();
+        assert.equal((await f.service.resolve({ ...REQUEST, source })).status, 'ready', source);
+        assert.deepEqual(paths, [path]);
+      }
+    }
+    assert.deepEqual(f.errors, []);
+  } finally {
+    await f.close();
+  }
+});
+
+test('encoded local fallback preserves filesystem denial and validation failures', async () => {
+  for (const reason of ['not_allowed', 'too_large', 'unsupported_mime', 'read_failed'] as const) {
+    const paths: string[] = [];
+    const f = await fixture(undefined, async (_session, path) => {
+      paths.push(path);
+      throw new ImageFileReadError(reason);
+    });
+    try {
+      const source = '/tmp/My%20Project/image.png';
+      observe(f.service, source);
+      await f.service.waitForIdle();
+      assert.deepEqual(await f.service.resolve({ ...REQUEST, source }), {
+        status: 'failed',
+        reason,
+      });
+      assert.deepEqual(paths, [source]);
+      assert.deepEqual(f.errors, []);
+    } finally {
+      await f.close();
+    }
+  }
+});
+
+test('decoded local images still pass through the Read workspace boundary', async () => {
+  const reader = createImageFileReader();
+  const paths: string[] = [];
+  const f = await fixture(undefined, (_session, path, abortSignal) => {
+    paths.push(path);
+    return reader({ path, cwd: join(f.root, 'workspace'), abortSignal });
+  });
+  try {
+    await mkdir(join(f.root, 'workspace'));
+    await writeFile(join(f.root, 'private image.png'), PNG);
+    const source = '%2e%2e/private%20image.png';
+    observe(f.service, source);
+    await f.service.waitForIdle();
+    assert.deepEqual(await f.service.resolve({ ...REQUEST, source }), {
+      status: 'failed',
+      reason: 'not_allowed',
+    });
+    assert.deepEqual(paths, [source, '../private image.png']);
+    assert.deepEqual(f.errors, []);
+  } finally {
+    await f.close();
+  }
+});
+
+test('missing encoded sources never double-decode file URLs or retry invalid escapes', async () => {
+  for (const source of [
+    'file:///tmp/missing%2520image.png',
+    '/tmp/missing%.png',
+    '/tmp/missing%E4.png',
+    '/tmp/missing%00.png',
+  ]) {
+    const paths: string[] = [];
+    const f = await fixture(undefined, async (_session, path) => {
+      paths.push(path);
+      throw new ImageFileReadError('not_found');
+    });
+    try {
+      observe(f.service, source);
+      await f.service.waitForIdle();
+      assert.deepEqual(await f.service.resolve({ ...REQUEST, source }), {
+        status: 'failed',
+        reason: 'not_found',
+      });
+      assert.equal(paths.length, 1, source);
+      assert.deepEqual(f.errors, []);
+    } finally {
+      await f.close();
+    }
+  }
+});
+
 test('remote delivery is downloaded once, remains replayable after the origin server disappears, and sends no credentials/referrer', async () => {
   const f = await fixture();
   let requests = 0;
diff --git a/packages/runtime-host/src/server/chat-image-delivery.ts b/packages/runtime-host/src/server/chat-image-delivery.ts
index 9c6b88dd3a9..3780c437b4b 100644
--- a/packages/runtime-host/src/server/chat-image-delivery.ts
+++ b/packages/runtime-host/src/server/chat-image-delivery.ts
@@ -38,6 +38,7 @@ import { readyChatImageArtifact } from './chat-image-artifact.js';
 import { abortable } from '../client/wait-for-ready.js';
 import {
   downloadChatImage,
+  decodedLocalImagePath,
   ImageSourceError,
   localImagePath,
   type ChatImageBytes,
@@ -257,9 +258,25 @@ export class ChatImageDeliveryService {
     let image: ChatImageBytes;
     try {
       const path = localImagePath(source);
-      if (path !== undefined)
-        image = await abortable(() => this.ports.readLocalImage(sessionId, path, signal), signal);
-      else {
+      if (path !== undefined) {
+        try {
+          image = await abortable(() => this.ports.readLocalImage(sessionId, path, signal), signal);
+        } catch (error) {
+          // Keep literal percent filenames authoritative. Only a missing path
+          // gets one decoding attempt, through the same Read boundary and budget.
+          const decoded = decodedLocalImagePath(source);
+          if (
+            signal.aborted ||
+            failureReason(error, source) !== 'not_found' ||
+            decoded === undefined
+          )
+            throw error;
+          image = await abortable(
+            () => this.ports.readLocalImage(sessionId, decoded, signal),
+            signal,
+          );
+        }
+      } else {
         try {
           image = await (this.ports.download ?? downloadChatImage)(source, signal);
         } catch (error) {
diff --git a/packages/runtime-host/src/server/chat-image-source.ts b/packages/runtime-host/src/server/chat-image-source.ts
index 97d30b319df..6ba53189441 100644
--- a/packages/runtime-host/src/server/chat-image-source.ts
+++ b/packages/runtime-host/src/server/chat-image-source.ts
@@ -28,7 +28,7 @@ import {
   imageFileFailureReason,
   validateImageBytes,
 } from '@maka/runtime/image-file';
-import type { ImageDeliveryFailure } from '@maka/core/image-delivery';
+import { isImageDeliverySource, type ImageDeliveryFailure } from '@maka/core/image-delivery';
 export class ImageSourceError extends Error {
   constructor(readonly reason: ImageDeliveryFailure) {
     super(reason);
@@ -59,6 +59,19 @@ export function localImagePath(source: string): string | undefined {
     throw new ImageSourceError('not_allowed');
   return source;
 }
+
+/** A missing literal path may be a URL-encoded Markdown destination. File URLs
+ * already went through fileURLToPath; never decode them a second time. */
+export function decodedLocalImagePath(source: string): string | undefined {
+  if (source.startsWith('file:') || /^https?:/i.test(source)) return undefined;
+  try {
+    const decoded = decodeURIComponent(source);
+    return decoded !== source && isImageDeliverySource(decoded) ? decoded : undefined;
+  } catch {
+    // A literal percent sign or incomplete escape is a valid filesystem name.
+    return undefined;
+  }
+}
 /** Pin DNS at connection time and check each redirect; never send cookies, auth or referer. */
 export async function downloadChatImage(
   source: string,

From 92354a6a394fff711b4f4bdc3633a080bc12d40e Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Tue, 6 Oct 2026 19:59:42 +0800
Subject: [PATCH 10/37] fix(chat): preserve inline image badge dimensions

Keep small images at their intrinsic size across remote previews and saved attachment replay. Preserve large preview frames and accessible zoom controls, and cover badge layout in browser regression tests.

Generated-by: Codex (GPT-6)
---
 .../scripts/markdown-images.browser.test.mjs  | 55 +++++++++++++++++--
 packages/ui/src/markdown-image.tsx            | 19 +++++--
 packages/ui/src/styles.css                    | 19 ++++++-
 3 files changed, 80 insertions(+), 13 deletions(-)

diff --git a/packages/ui/scripts/markdown-images.browser.test.mjs b/packages/ui/scripts/markdown-images.browser.test.mjs
index 3f911d05e8e..f0285bbb05b 100644
--- a/packages/ui/scripts/markdown-images.browser.test.mjs
+++ b/packages/ui/scripts/markdown-images.browser.test.mjs
@@ -30,6 +30,7 @@ import { chromium } from '@playwright/test';
 
 const root = fileURLToPath(new URL('../../../', import.meta.url));
 const png = Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8DwHwAFBQIAX8jx0gAAAABJRU5ErkJggg==', 'base64');
+const badge = Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAFAAAAAUCAYAAAAa2LrXAAAATklEQVR4nO3OsQ0AIAzAsJ7O5/QIhsgSg3fPnLnfgzygywO6PKDLA7o8oMsDujygywO6PKDLA7o8oMsDujygywO6PKDLA7o8oMsDujyAW5KWWkgoVkkSAAAAAElFTkSuQmCC', 'base64');
 let appServer, imageServer, browser, appUrl, imageUrl;
 let requests = [], failedOnce = false;
 let releaseImage;
@@ -42,12 +43,15 @@ before(async () => {
   imageServer = createServer((req, res) => {
     requests.push({ path: req.url, referer: req.headers.referer });
     if (req.url === '/delayed.png') {
-      void delayedImage.then(() => { res.setHeader('Content-Type', 'image/png'); res.end(png); });
+      void delayedImage.then(() => { res.setHeader('Content-Type', 'image/png'); res.end(screenshot); });
       return;
     }
     if (req.url === '/screenshot.png') {
       res.setHeader('Content-Type', 'image/png'); res.end(screenshot); return;
     }
+    if (req.url === '/badge.png') {
+      res.setHeader('Content-Type', 'image/png'); res.end(badge); return;
+    }
     if (req.url === '/retry.png' && !failedOnce) {
       failedOnce = true;
       res.writeHead(404).end();
@@ -59,6 +63,9 @@ before(async () => {
   await new Promise(resolve => imageServer.listen(0, '127.0.0.1', resolve));
   imageUrl = `http://127.0.0.1:${imageServer.address().port}`;
   const destinations = {
+    'badge-remote': `Build ![Badge](${imageUrl}/badge.png) passing.`,
+    'badge-saved': `Build ![Badge](${imageUrl}/badge.png) passing.`,
+    'badge-saving': `Build ![Badge](${imageUrl}/badge.png) passing.`,
     'angle-saved': '![Screenshot](</tmp/my image.png>)',
     'title-saved': `![Screenshot](${imageUrl}/image.png "Screenshot title")`,
     'escaped-saved': String.raw`![Screenshot](/tmp/a\(1\).png)`,
@@ -100,16 +107,16 @@ before(async () => {
       const readBytes=async()=>{
         if(mode==='geometry-saved') await fetch('/release-attachment');
         reads++; window.imageReads=reads; return (mode==='attachment' || mode==='read-retry-saved') && reads===1 ? {ok:false,reason:'read_failed'} :
-          {ok:true,base64:mode==='corrupt-saved' && !window.deliveryRetries ? 'iVBORw0KGgo=' : '${png.toString('base64')}',mimeType:'image/png'};
+          {ok:true,base64:mode.startsWith('badge-') ? '${badge.toString('base64')}' : mode==='geometry-saved' ? '${screenshot.toString('base64')}' : mode==='corrupt-saved' && !window.deliveryRetries ? 'iVBORw0KGgo=' : '${png.toString('base64')}',mimeType:'image/png'};
       };
-      const resolveDelivery=mode.endsWith('saved') || mode==='saving' || race ? async(_session,request)=>{
+      const resolveDelivery=mode.endsWith('saved') || mode.endsWith('saving') || race ? async(_session,request)=>{
         window.deliveryQueries++;
         window.deliverySource=request.source;
         if(canonicalSources[mode] && !canonicalSources[mode].includes(request.source)) return {status:'unavailable'};
         if(request.retry) window.deliveryRetries++;
         if(race) return window.deliveryReady ? {status:'ready',artifactId:'saved-image'} : {status:'unavailable'};
         await new Promise(resolve=>setTimeout(resolve,100));
-        return mode==='saving' && window.deliveryQueries===1 ? {status:'pending'} : {status:'ready',artifactId:'saved-image'};
+        return mode.endsWith('saving') && window.deliveryQueries===1 ? {status:'pending'} : {status:'ready',artifactId:'saved-image'};
       } : undefined;
       const render=(streaming=race)=>root.render(
         React.createElement(Theme,{theme:makaTheme,mode:'light'},
@@ -234,7 +241,8 @@ for (const scenario of ['remote-saved', 'local-saved']) {
       assert.equal(await page.evaluate(() => window.imageReads), 1);
       assert.equal(await page.locator('img').count(), 1);
       assert.match(await page.locator('img').getAttribute('src'), /^data:image\/png;base64,/);
-      await page.getByRole('button', { name: 'Enlarge image: Screenshot', exact: true }).click();
+      await page.getByRole('button', { name: 'Enlarge image: Screenshot', exact: true }).focus();
+      await page.keyboard.press('Enter');
       await page.waitForFunction(() => document.images.length > 1);
     } finally { await page.close(); }
   });
@@ -310,7 +318,7 @@ for (const scenario of ['geometry-remote', 'geometry-saved']) {
       await page.getByText('Loading image…', { exact: true }).waitFor();
       const before = await page.getByText('Following paragraph', { exact: true }).boundingBox();
       if (scenario === 'geometry-remote') releaseImage(); else releaseAttachment();
-      await loaded(page);
+      await page.waitForFunction(() => [...document.images].some(image => image.naturalWidth > 1));
       await page.getByText('Loading image…', { exact: true }).waitFor({ state: 'hidden' });
       const after = await page.getByText('Following paragraph', { exact: true }).boundingBox();
       assert.equal(after.y, before.y);
@@ -348,3 +356,38 @@ test('image frames fit narrow viewports without distorting screenshots or limiti
     assert.equal(await page.getByRole('dialog').locator('img').getAttribute('src'), await page.locator('.maka-markdown-image-preview > img').getAttribute('src'));
   } finally { await page.close(); }
 });
+
+for (const scenario of ['badge-remote', 'badge-saved', 'badge-saving']) {
+  test(`${scenario}: a badge keeps its intrinsic size and surrounding text on one line`, async () => {
+    requests = [];
+    const page = await pageFor(scenario);
+    try {
+      await page.waitForFunction(() => [...document.images].some(image => image.naturalWidth === 80));
+      if (scenario === 'badge-saving') {
+        await page.waitForFunction(() => [...document.images].some(image => image.src.startsWith('data:') && image.naturalWidth === 80));
+      }
+      const geometry = await page.locator('.maka-markdown-image-resource').evaluate(element => {
+        const box = element.getBoundingClientRect();
+        const paragraph = element.closest('[role="paragraph"]');
+        const textBoxes = [...paragraph.childNodes].filter(node => node.nodeType === Node.TEXT_NODE && node.textContent.trim()).map(node => {
+          const range = document.createRange(); range.selectNodeContents(node);
+          return range.getBoundingClientRect().y;
+        });
+        return { width: box.width, height: box.height, textBoxes };
+      });
+      assert.equal(geometry.width, 80);
+      assert.equal(geometry.height, 20);
+      assert.equal(geometry.textBoxes.length, 2);
+      assert.equal(geometry.textBoxes[0], geometry.textBoxes[1]);
+      if (scenario === 'badge-saved') assert.deepEqual(requests, []);
+      if (scenario === 'badge-remote') {
+        await page.locator('.maka-markdown-image-preview').hover();
+        await page.getByRole('button', { name: 'Enlarge image: Badge', exact: true }).click();
+      } else {
+        await page.getByRole('button', { name: 'Enlarge image: Badge', exact: true }).focus();
+        await page.keyboard.press('Enter');
+      }
+      await page.getByRole('dialog').waitFor();
+    } finally { await page.close(); }
+  });
+}
diff --git a/packages/ui/src/markdown-image.tsx b/packages/ui/src/markdown-image.tsx
index b5e93d9eb49..06239351df2 100644
--- a/packages/ui/src/markdown-image.tsx
+++ b/packages/ui/src/markdown-image.tsx
@@ -55,6 +55,8 @@ function ImageResource(props: { src: string; alt: string }) {
   const artifactId = explicit?.artifactId ?? (delivery.status === 'ready' ? delivery.artifactId : undefined);
   const image = useAttachmentImage(visible && artifactId ? { artifactId } : undefined);
   const [failedSource, setFailedSource] = useState<string>();
+  // Keep measured badge geometry across URL-to-attachment switches and retries.
+  const [compactSize, setCompactSize] = useState<{ width: number; height: number }>();
   const [attempt, setAttempt] = useState(0);
   const remote = isWebImage(props.src);
   const source = artifactId ? image.src : visible && remote && (!delivery.available || delivery.checked) ? props.src : undefined;
@@ -76,28 +78,33 @@ function ImageResource(props: { src: string; alt: string }) {
     : explicit && image.status === 'unavailable' ? copy.imageUnavailable
     : delivery.status === 'failed' ? copy.imageArchiveFailure(delivery.reason)
     : delivery.status === 'pending' || artifactId ? copy.imageLoading : copy.imageUnsupported;
-  const hasFrame = !visible || !!source || !!artifactId || delivery.status === 'pending';
-  return <span ref={anchor} className={`maka-markdown-image-resource${hasFrame ? ' maka-markdown-image-frame' : ''}`} data-maka-image-state={message ? failed ? 'failed' : 'loading' : 'ready'}>
+  const hasFrame = (!visible || !!source || !!artifactId || delivery.status === 'pending') && !(compactSize && failed);
+  return <span ref={anchor} className={`maka-markdown-image-resource${hasFrame ? compactSize ? ' maka-markdown-image-compact' : ' maka-markdown-image-frame' : ''}`}
+    style={hasFrame && compactSize ? { minWidth: compactSize.width, minHeight: compactSize.height } : undefined}
+    data-maka-image-state={message ? failed ? 'failed' : 'loading' : 'ready'}>
     {message ? <span className="maka-markdown-image-placeholder">
       {props.alt && <span className="maka-markdown-image-caption">{props.alt}</span>}
       <span role="status">{hasFrame && !failed && delivery.status !== 'failed' && <Spinner size="sm" shade="subtle" aria-hidden="true" />} {message}</span>
       {(failed || delivery.status === 'failed') && sourceActions}
-    </span> : source && <DisplayImage key={`${source}\0${attempt}`} src={source} alt={props.alt} onError={() => setFailedSource(source)} />}
+    </span> : source && <DisplayImage key={`${source}\0${attempt}`} src={source} alt={props.alt} compactSize={compactSize} onError={() => setFailedSource(source)}
+      onLoad={(width, height) => setCompactSize(width <= 320 && height <= 64 ? { width, height } : undefined)} />}
     {!explicit && delivery.status === 'pending' && remote && source && <span className="maka-markdown-image-saving" role="status">{copy.imageSaving}</span>}
     {!explicit && delivery.status === 'failed' && remote && source && !failed && <span className="maka-markdown-image-saving" role="status">
       {copy.imageArchiveFailure(delivery.reason)} {sourceActions}
     </span>}
   </span>;
 }
-function DisplayImage(props: { src: string; alt: string; onError(): void }) {
+function DisplayImage(props: { src: string; alt: string; compactSize?: { width: number; height: number }; onError(): void; onLoad(width: number, height: number): void }) {
   const copy = getSharedUiCopy(useUiLocale()).markdown;
   const [loaded, setLoaded] = useState(false);
   const lightbox = useLightbox({ media: { src: props.src, alt: props.alt }, hasZoom: true });
   return <>
-    <span className="maka-markdown-image-preview">
+    <span className="maka-markdown-image-preview" style={props.compactSize ? { width: props.compactSize.width, height: props.compactSize.height } : undefined}>
       {!loaded && <span className="maka-markdown-image-loading" role="status"><Spinner size="sm" shade="subtle" aria-hidden="true" /> {copy.imageLoading}</span>}
       <img src={props.src} alt={props.alt} loading="lazy" decoding="async" referrerPolicy="no-referrer"
-          className="maka-markdown-attachment-image" onLoad={() => setLoaded(true)} onError={props.onError} />
+          className="maka-markdown-attachment-image" onLoad={event => {
+            setLoaded(true); props.onLoad(event.currentTarget.naturalWidth, event.currentTarget.naturalHeight);
+          }} onError={props.onError} />
       {loaded && <span className="maka-markdown-image-expand">
         <IconButton icon={<Maximize2 size={16} />} size="sm" label={copy.imageExpand(props.alt)} onClick={() => lightbox.open()} />
       </span>}
diff --git a/packages/ui/src/styles.css b/packages/ui/src/styles.css
index 0ea3665a5f8..ca22fc6b72f 100644
--- a/packages/ui/src/styles.css
+++ b/packages/ui/src/styles.css
@@ -639,7 +639,9 @@
   width: 640px;
   aspect-ratio: 4 / 3;
 }
-.maka-markdown-image-frame > .maka-markdown-image-placeholder {
+.maka-markdown-image-compact { display: inline-flex; align-items: center; vertical-align: middle; }
+.maka-markdown-image-frame > .maka-markdown-image-placeholder,
+.maka-markdown-image-compact > .maka-markdown-image-placeholder {
   position: absolute;
   inset: 0;
   align-items: center;
@@ -653,11 +655,22 @@
   align-items: center;
   justify-content: center;
 }
+.maka-markdown-image-compact > .maka-markdown-image-preview { position: relative; flex-shrink: 0; }
 .maka-markdown-image-expand {
   position: absolute;
   inset-block-end: var(--space-2);
   inset-inline-end: var(--space-2);
 }
+/* Badge controls remain keyboard reachable without covering the badge at rest. */
+.maka-markdown-image-compact .maka-markdown-image-expand {
+  inset: auto 0 0 auto;
+  opacity: 0;
+  pointer-events: none;
+}
+.maka-markdown-image-compact:is(:hover, :focus-within) .maka-markdown-image-expand {
+  opacity: 1;
+  pointer-events: auto;
+}
 .maka-markdown-image-preview img { margin: 0; max-height: 100%; max-width: 100%; object-fit: contain; }
 .maka-markdown-image-loading {
   position: absolute;
@@ -680,6 +693,10 @@
   color: var(--muted-foreground);
   font-size: var(--maka-font-size-sm);
 }
+.maka-markdown-image-compact > .maka-markdown-image-saving {
+  position: static;
+  max-width: none;
+}
 
 /* Markdown code renderers are custom components so Mermaid can be loaded only
    for settled Mermaid fences. Astryx skips its own spacing wrapper when

From b57a1e90f8410606688ad6abce9615aaa6641ab6 Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Tue, 6 Oct 2026 20:20:50 +0800
Subject: [PATCH 11/37] fix(chat): stabilize image layout and resolve encoded
 workspace paths

Reserve image geometry from Markdown placement before loading, size previews to the conversation column, and retry encoded paths through the same Read boundary. Cover delayed badge loading, responsive chat layouts, and workspace boundary enforcement.

Generated-by: Codex (GPT-6)
---
 .../src/__tests__/chat-image-delivery.test.ts |  55 ++++++++-
 .../src/server/chat-image-delivery.ts         |   7 +-
 .../scripts/markdown-images.browser.test.mjs  | 110 +++++++++++++++++-
 packages/ui/src/markdown-body.tsx             |   3 +-
 packages/ui/src/markdown-image.tsx            |  90 ++++++++++----
 packages/ui/src/styles.css                    |  34 ++++--
 6 files changed, 252 insertions(+), 47 deletions(-)

diff --git a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
index ae04f90635a..bff2fff7bb9 100644
--- a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
+++ b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
@@ -260,6 +260,57 @@ test('encoded local Markdown images are archived under the original source and r
   }
 });
 
+test('encoded project roots are retried through the same workspace boundary', async () => {
+  const reader = createImageFileReader();
+  const paths: string[] = [];
+  const f = await fixture(undefined, (_session, path, abortSignal) => {
+    paths.push(path);
+    return reader({ path, cwd: join(f.root, 'My Project 中文'), abortSignal });
+  });
+  try {
+    const directory = join(f.root, 'My Project 中文');
+    await mkdir(directory);
+    const path = join(directory, 'image.png');
+    await writeFile(path, PNG);
+    const source = `${f.root}/${encodeURIComponent('My Project 中文')}/image.png`;
+    observe(f.service, source);
+    await f.service.waitForIdle();
+    assert.equal((await f.service.resolve({ ...REQUEST, source })).status, 'ready');
+    assert.deepEqual(paths, [source, path]);
+    await rm(path);
+    assert.equal((await f.service.resolve({ ...REQUEST, source })).status, 'ready');
+    assert.equal(paths.length, 2);
+    assert.deepEqual(f.errors, []);
+  } finally {
+    await f.close();
+  }
+});
+
+test('decoding a denied source cannot grant access outside the Read boundary', async () => {
+  const reader = createImageFileReader();
+  const paths: string[] = [];
+  const f = await fixture(undefined, (_session, path, abortSignal) => {
+    paths.push(path);
+    return reader({ path, cwd: join(f.root, 'workspace'), abortSignal });
+  });
+  try {
+    await mkdir(join(f.root, 'workspace'));
+    const path = join(f.root, 'private image.png');
+    await writeFile(path, PNG);
+    const source = `${f.root}/private%20image.png`;
+    observe(f.service, source);
+    await f.service.waitForIdle();
+    assert.deepEqual(await f.service.resolve({ ...REQUEST, source }), {
+      status: 'failed',
+      reason: 'not_allowed',
+    });
+    assert.deepEqual(paths, [source, path]);
+    assert.deepEqual(f.errors, []);
+  } finally {
+    await f.close();
+  }
+});
+
 test('literal percent filenames retain precedence and file URLs are decoded only once', async () => {
   const paths: string[] = [];
   const reader = createImageFileReader();
@@ -286,8 +337,8 @@ test('literal percent filenames retain precedence and file URLs are decoded only
   }
 });
 
-test('encoded local fallback preserves filesystem denial and validation failures', async () => {
-  for (const reason of ['not_allowed', 'too_large', 'unsupported_mime', 'read_failed'] as const) {
+test('encoded local fallback preserves validation and non-path read failures', async () => {
+  for (const reason of ['too_large', 'unsupported_mime', 'read_failed'] as const) {
     const paths: string[] = [];
     const f = await fixture(undefined, async (_session, path) => {
       paths.push(path);
diff --git a/packages/runtime-host/src/server/chat-image-delivery.ts b/packages/runtime-host/src/server/chat-image-delivery.ts
index 3780c437b4b..e9eb6900987 100644
--- a/packages/runtime-host/src/server/chat-image-delivery.ts
+++ b/packages/runtime-host/src/server/chat-image-delivery.ts
@@ -262,12 +262,13 @@ export class ChatImageDeliveryService {
         try {
           image = await abortable(() => this.ports.readLocalImage(sessionId, path, signal), signal);
         } catch (error) {
-          // Keep literal percent filenames authoritative. Only a missing path
-          // gets one decoding attempt, through the same Read boundary and budget.
+          // Keep readable literal percent filenames authoritative. An encoded cwd
+          // can look outside the workspace before decoding, so both missing and
+          // denied candidates get one retry through the same Read boundary/budget.
           const decoded = decodedLocalImagePath(source);
           if (
             signal.aborted ||
-            failureReason(error, source) !== 'not_found' ||
+            !['not_found', 'not_allowed'].includes(failureReason(error, source)) ||
             decoded === undefined
           )
             throw error;
diff --git a/packages/ui/scripts/markdown-images.browser.test.mjs b/packages/ui/scripts/markdown-images.browser.test.mjs
index f0285bbb05b..e5cc1d13821 100644
--- a/packages/ui/scripts/markdown-images.browser.test.mjs
+++ b/packages/ui/scripts/markdown-images.browser.test.mjs
@@ -23,7 +23,8 @@
 import assert from 'node:assert/strict';
 import { before, after, test } from 'node:test';
 import { createServer } from 'node:http';
-import { readFile } from 'node:fs/promises';
+import { readFile, mkdir } from 'node:fs/promises';
+import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { build } from 'esbuild';
 import { chromium } from '@playwright/test';
@@ -66,6 +67,11 @@ before(async () => {
     'badge-remote': `Build ![Badge](${imageUrl}/badge.png) passing.`,
     'badge-saved': `Build ![Badge](${imageUrl}/badge.png) passing.`,
     'badge-saving': `Build ![Badge](${imageUrl}/badge.png) passing.`,
+    'badge-list': `- Build ![Badge](${imageUrl}/badge.png) passing.`,
+    'badge-table': `| Build | Result |\n| --- | --- |\n| ![Badge](${imageUrl}/badge.png) | passing |`,
+    'badge-strip': `![Badge](${imageUrl}/badge.png) ![Badge](${imageUrl}/badge.png)`,
+    'layout-main': `## Image delivery\n\nBuild ![Badge](${imageUrl}/badge.png) passing.\n\n![Screenshot](${imageUrl}/screenshot.png)\n\nFollowing paragraph stays in place.`,
+    'layout-side': `## Image delivery\n\nBuild ![Badge](${imageUrl}/badge.png) passing.\n\n![Screenshot](${imageUrl}/screenshot.png)\n\nFollowing paragraph stays in place.`,
     'angle-saved': '![Screenshot](</tmp/my image.png>)',
     'title-saved': `![Screenshot](${imageUrl}/image.png "Screenshot title")`,
     'escaped-saved': String.raw`![Screenshot](/tmp/a\(1\).png)`,
@@ -88,7 +94,7 @@ before(async () => {
     stdin: { contents: `
       import React from 'react';
       import {createRoot} from 'react-dom/client';
-      import {Theme} from '@astryxdesign/core';
+      import {Theme, ChatMessageList, ChatMessage, ChatMessageBubble} from '@astryxdesign/core';
       import {makaTheme} from './apps/desktop/src/renderer/astryx-theme/maka.js';
       import {MarkdownBody} from './packages/ui/dist/markdown-body.js';
       import {LocaleProvider} from './packages/ui/dist/locale-context.js';
@@ -105,6 +111,7 @@ before(async () => {
         '![Screenshot](${imageUrl}/'+(mode==='retry' ? 'retry.png' : 'image.png')+')');
       const root=createRoot(document.getElementById('root'));
       const readBytes=async()=>{
+        if(mode.startsWith('badge-')) await fetch('/badge-attachment');
         if(mode==='geometry-saved') await fetch('/release-attachment');
         reads++; window.imageReads=reads; return (mode==='attachment' || mode==='read-retry-saved') && reads===1 ? {ok:false,reason:'read_failed'} :
           {ok:true,base64:mode.startsWith('badge-') ? '${badge.toString('base64')}' : mode==='geometry-saved' ? '${screenshot.toString('base64')}' : mode==='corrupt-saved' && !window.deliveryRetries ? 'iVBORw0KGgo=' : '${png.toString('base64')}',mimeType:'image/png'};
@@ -118,13 +125,18 @@ before(async () => {
         await new Promise(resolve=>setTimeout(resolve,100));
         return mode.endsWith('saving') && window.deliveryQueries===1 ? {status:'pending'} : {status:'ready',artifactId:'saved-image'};
       } : undefined;
+      const markdown=(streaming)=>React.createElement(MarkdownBody,{text,streaming,settledText:race ? text : undefined,density:'compact',imageIdentity:{turnId:'turn',messageId:'message'}});
+      const surface=(streaming)=>mode.startsWith('layout-') ? React.createElement('section',{className:mode==='layout-side' ? 'maka-quote-companion' : '',style:{width:mode==='layout-side' ? '360px' : '100%',maxWidth:'100%'}},
+        React.createElement(ChatMessageList,{className:'maka-chat-message-list maka-chatContent',align:'top'},
+          React.createElement('div',{className:'maka-transcript-turn maka-turn',style:{width:'100%',maxWidth:'var(--maka-reading-measure)',marginInline:'auto'}},
+            React.createElement(ChatMessage,{sender:'assistant'},React.createElement(ChatMessageBubble,{variant:'ghost',width:'100%',className:'maka-chat-message-bubble maka-chat-message-bubble-assistant'},markdown(streaming)))))) : markdown(streaming);
       const render=(streaming=race)=>root.render(
         React.createElement(Theme,{theme:makaTheme,mode:'light'},
           React.createElement(LocaleProvider,{locale:'en'},
             React.createElement(SessionAttachmentProvider,{sessionId:'session',readBytes},
               React.createElement(ImageDeliveryProvider,{sessionId:'session',resolve:resolveDelivery},
               React.createElement('div',{style:mode==='offscreen' ? {paddingTop:'2500px'} : {}},
-                React.createElement(MarkdownBody,{text,streaming,settledText:race ? text : undefined,imageIdentity:{turnId:'turn',messageId:'message'}})))))));
+                surface(streaming)))))));
       window.finishStream=()=>render(false);
       render();
     `, resolveDir: root, loader: 'js' },
@@ -137,6 +149,7 @@ before(async () => {
   const index = await readFile(new URL('../../../apps/desktop/src/renderer/index.html', import.meta.url), 'utf8');
   const csp = index.match(/http-equiv="Content-Security-Policy"\s+content="([^"]+)"/)[1];
   appServer = createServer((req, res) => {
+    if (req.url === '/badge-attachment') { res.end(); return; }
     if (req.url === '/release-attachment') { void delayedAttachment.then(() => res.end()); return; }
     if (req.url === '/app.js') { res.setHeader('Content-Type', 'text/javascript'); res.end(js); }
     else if (req.url === '/app.css') { res.setHeader('Content-Type', 'text/css'); res.end(css); }
@@ -159,7 +172,7 @@ after(async () => {
 async function pageFor(scenario) {
   const page = await browser.newPage({ viewport: { width: 720, height: 600 } });
   page.setDefaultTimeout(5000);
-  await page.goto(`${appUrl}/?case=${scenario}`);
+  await page.goto(`${appUrl}/?case=${scenario}`, { waitUntil: 'domcontentloaded' });
   return page;
 }
 
@@ -375,8 +388,11 @@ for (const scenario of ['badge-remote', 'badge-saved', 'badge-saving']) {
         });
         return { width: box.width, height: box.height, textBoxes };
       });
-      assert.equal(geometry.width, 80);
-      assert.equal(geometry.height, 20);
+      assert.ok(geometry.width <= 120);
+      assert.ok(geometry.height <= 32);
+      const pixels = await page.locator('img').boundingBox();
+      assert.equal(pixels.width, 80);
+      assert.equal(pixels.height, 20);
       assert.equal(geometry.textBoxes.length, 2);
       assert.equal(geometry.textBoxes[0], geometry.textBoxes[1]);
       if (scenario === 'badge-saved') assert.deepEqual(requests, []);
@@ -391,3 +407,85 @@ for (const scenario of ['badge-remote', 'badge-saved', 'badge-saving']) {
     } finally { await page.close(); }
   });
 }
+
+for (const scenario of ['badge-saved', 'badge-saving']) {
+  test(`${scenario}: delayed saved bytes never change the inline placeholder geometry`, async () => {
+    const page = await browser.newPage({ viewport: { width: 720, height: 600 } });
+    page.setDefaultTimeout(5000);
+    let release;
+    const gate = new Promise(resolve => { release = resolve; });
+    await page.route('**/badge-attachment', async route => { await gate; await route.continue(); });
+    try {
+      await page.goto(`${appUrl}/?case=${scenario}`, { waitUntil: 'domcontentloaded' });
+      await page.waitForFunction(() => window.imageReads === 0 && !!document.querySelector('.maka-markdown-image-inline'));
+      const before = await page.locator('[role="paragraph"]').boundingBox();
+      const slotBefore = await page.locator('.maka-markdown-image-resource').boundingBox();
+      await page.waitForFunction(() => window.deliveryQueries >= (new URLSearchParams(location.search).get('case') === 'badge-saving' ? 2 : 1));
+      release();
+      await page.waitForFunction(() => [...document.images].some(image => image.src.startsWith('data:') && image.naturalWidth === 80));
+      assert.deepEqual(await page.locator('.maka-markdown-image-resource').boundingBox(), slotBefore);
+      assert.deepEqual(await page.locator('[role="paragraph"]').boundingBox(), before);
+    } finally { release(); await page.close(); }
+  });
+}
+
+for (const scenario of ['badge-list', 'badge-table', 'badge-strip']) {
+  test(`${scenario}: inline Markdown context is known before the image arrives`, async () => {
+    const page = await browser.newPage({ viewport: { width: 360, height: 600 } });
+    page.setDefaultTimeout(5000);
+    let release;
+    const gate = new Promise(resolve => { release = resolve; });
+    await page.route(`${imageUrl}/badge.png`, async route => { await gate; await route.continue(); });
+    try {
+      await page.goto(`${appUrl}/?case=${scenario}`, { waitUntil: 'domcontentloaded' });
+      await page.locator('.maka-markdown-image-inline').first().waitFor();
+      assert.equal(await page.locator('.maka-markdown-image-frame').count(), 0);
+      const before = await page.locator('.maka-markdown-image-resource').first().boundingBox();
+      assert.ok(before.width <= 120 && before.height <= 32);
+      release();
+      await page.waitForFunction(() => [...document.images].every(image => image.naturalWidth === 80));
+      assert.deepEqual(await page.locator('.maka-markdown-image-resource').first().boundingBox(), before);
+    } finally { release(); await page.close(); }
+  });
+}
+
+for (const [scenario, width, height] of [
+  ['layout-main', 1280, 900], ['layout-main', 480, 700],
+  ['layout-side', 720, 700], ['layout-side', 320, 600],
+]) {
+  test(`${scenario} ${width}x${height}: production chat columns preserve image geometry through loading`, async () => {
+    const page = await browser.newPage({ viewport: { width, height } });
+    page.setDefaultTimeout(5000);
+    let release;
+    const gate = new Promise(resolve => { release = resolve; });
+    await page.route(`${imageUrl}/**`, async route => { await gate; await route.continue(); });
+    const measure = () => page.locator('.maka-markdown-image-resource').evaluateAll(elements => elements.map(element => {
+      const r = element.getBoundingClientRect();
+      return { x: r.x, y: r.y, width: r.width, height: r.height };
+    }));
+    try {
+      await page.goto(`${appUrl}/?case=${scenario}`, { waitUntil: 'domcontentloaded' });
+      await page.getByText('Following paragraph stays in place.').waitFor();
+      const before = await measure();
+      const followingBefore = await page.getByText('Following paragraph stays in place.').boundingBox();
+      assert.equal(before.length, 2);
+      assert.ok(before[0].width <= 120 && before[0].height <= 32);
+      assert.ok(before[1].width <= 800 && before[1].height <= Math.min(480, height * 0.6));
+      for (const box of before) assert.ok(box.x >= 0 && box.x + box.width <= width);
+      const evidence = process.env.MAKA_IMAGE_LAYOUT_EVIDENCE_DIR;
+      if (evidence) {
+        await mkdir(evidence, { recursive: true });
+        await page.screenshot({ path: join(evidence, `${scenario}-${width}-loading.png`), fullPage: true });
+      }
+      release();
+      await page.waitForFunction(() => document.images.length === 2 && [...document.images].every(image => image.complete && image.naturalWidth > 0));
+      assert.deepEqual(await measure(), before);
+      assert.deepEqual(await page.getByText('Following paragraph stays in place.').boundingBox(), followingBefore);
+      assert.equal(await page.evaluate(() => document.documentElement.scrollWidth > innerWidth), false);
+      if (evidence) {
+        await page.screenshot({ path: join(evidence, `${scenario}-${width}-ready.png`), fullPage: true });
+        console.log(JSON.stringify({ scenario, viewport: { width, height }, images: before, layoutShift: 0 }));
+      }
+    } finally { release(); await page.close(); }
+  });
+}
diff --git a/packages/ui/src/markdown-body.tsx b/packages/ui/src/markdown-body.tsx
index 47aea1c0240..eb1b24a5ef6 100644
--- a/packages/ui/src/markdown-body.tsx
+++ b/packages/ui/src/markdown-body.tsx
@@ -29,7 +29,7 @@
  * product-specific trust boundaries around that renderer.
  */
 
-import { MarkdownImage, MarkdownImageSourceProvider } from './markdown-image.js';
+import { MarkdownImage, MarkdownImageSourceProvider, MARKDOWN_IMAGE_PLUGINS } from './markdown-image.js';
 import { ImageMessageScope } from './image-delivery.js';
 import { useCallback, useContext, useRef, type ReactNode } from 'react';
 import {
@@ -198,6 +198,7 @@ export function MarkdownBody(props: {
             // the one combination neither half of the argument asks for.
             density={density}
             components={components}
+            plugins={MARKDOWN_IMAGE_PLUGINS}
             isStreaming={props.streaming}
             settledText={props.settledText}
             transformSource={transformMathSource}
diff --git a/packages/ui/src/markdown-image.tsx b/packages/ui/src/markdown-image.tsx
index 06239351df2..bd44cfbb513 100644
--- a/packages/ui/src/markdown-image.tsx
+++ b/packages/ui/src/markdown-image.tsx
@@ -18,8 +18,10 @@
  */
 
 import { createContext, useContext, useEffect, useMemo, useRef, useState, type ReactNode } from 'react';
-import { Button, IconButton, Spinner, useLightbox } from '@astryxdesign/core';
-import { Maximize2 } from './icons.js';
+import { Button, IconButton, Spinner, Tooltip, useLightbox } from '@astryxdesign/core';
+import { createMarkdownPlugin, type MarkdownExtensionNode } from '@astryxdesign/core/Markdown/plugins';
+import type { MarkdownAstNode, MarkdownAstRoot } from '@astryxdesign/core/Markdown';
+import { Maximize2, RotateCw, AlertTriangle } from './icons.js';
 import { Link } from '@astryxdesign/core/Link';
 import { parseAttachmentResourceRef } from '@maka/core/attachments';
 import { useAttachmentImage } from './attachment-image.js';
@@ -29,17 +31,52 @@ import { useUiLocale } from './locale-context.js';
 import { createMarkdownImageSourceResolver } from './markdown-image-source.js';
 
 const ImageSourceContext = createContext<(source: string) => string>((source) => source);
+
+type PlacedImage = MarkdownExtensionNode<'maka-images', 'image', { src: string; alt: string; inline: boolean }>;
+// Placement comes from Markdown structure before bytes arrive. Never change a
+// message's geometry in response to network/decode timing or archive resolution.
+export const MARKDOWN_IMAGE_PLUGINS = [createMarkdownPlugin<'maka-images', PlacedImage>({
+  name: 'maka-images', apiVersion: 1,
+  transform(document, context) {
+    if (!context.source.includes('![')) return document;
+    const rewrite = (node: MarkdownAstNode, inline = false, phrasing = false): MarkdownAstNode => {
+      if (node.type === 'image') return {
+        type: 'extension', plugin: 'maka-images', name: 'image',
+        display: phrasing ? 'inline' : 'block',
+        data: { src: node.url, alt: node.alt, inline },
+      } satisfies PlacedImage;
+      if (!('children' in node)) return node;
+      const childInline = node.type === 'paragraph' ? !isSingleImage(node.children)
+        : node.type === 'heading' || node.type === 'tableCell' ? true : inline;
+      const childPhrasing = ['paragraph', 'heading', 'tableCell', 'link', 'strong', 'emphasis', 'delete'].includes(node.type);
+      return { ...node, children: node.children.map(child => rewrite(child, childInline, childPhrasing)) } as MarkdownAstNode;
+    };
+    return rewrite(document) as MarkdownAstRoot<MarkdownExtensionNode>;
+  },
+  renderers: { image: {
+    render: ({ node }) => <MarkdownImage {...node.data} />,
+    toText: node => node.data.alt,
+  } },
+})];
+
+function isSingleImage(nodes: readonly MarkdownAstNode[]): boolean {
+  const meaningful = nodes.filter(node => node.type !== 'text' || node.value.trim());
+  if (meaningful.length !== 1) return false;
+  const node = meaningful[0]!;
+  return node.type === 'image' || (['link', 'strong', 'emphasis', 'delete'].includes(node.type)
+    && 'children' in node && isSingleImage(node.children));
+}
 export function MarkdownImageSourceProvider(props: { text: string; children: ReactNode }) {
   const resolve = useMemo(() => createMarkdownImageSourceResolver(props.text), [props.text]);
   return <ImageSourceContext.Provider value={resolve}>{props.children}</ImageSourceContext.Provider>;
 }
 
 /** Presentation only: Host resolves local addresses and archives; UI receives artifact identities. */
-export function MarkdownImage(props: { src: string; alt: string }) {
+export function MarkdownImage(props: { src: string; alt: string; inline?: boolean }) {
   const source = useContext(ImageSourceContext)(props.src);
-  return <ImageResource key={source} src={source} alt={props.alt} />;
+  return <ImageResource key={source} src={source} alt={props.alt} inline={props.inline} />;
 }
-function ImageResource(props: { src: string; alt: string }) {
+function ImageResource(props: { src: string; alt: string; inline?: boolean }) {
   const copy = getSharedUiCopy(useUiLocale()).markdown;
   const anchor = useRef<HTMLSpanElement>(null);
   const [visible, setVisible] = useState(typeof IntersectionObserver === 'undefined');
@@ -55,8 +92,6 @@ function ImageResource(props: { src: string; alt: string }) {
   const artifactId = explicit?.artifactId ?? (delivery.status === 'ready' ? delivery.artifactId : undefined);
   const image = useAttachmentImage(visible && artifactId ? { artifactId } : undefined);
   const [failedSource, setFailedSource] = useState<string>();
-  // Keep measured badge geometry across URL-to-attachment switches and retries.
-  const [compactSize, setCompactSize] = useState<{ width: number; height: number }>();
   const [attempt, setAttempt] = useState(0);
   const remote = isWebImage(props.src);
   const source = artifactId ? image.src : visible && remote && (!delivery.available || delivery.checked) ? props.src : undefined;
@@ -78,35 +113,44 @@ function ImageResource(props: { src: string; alt: string }) {
     : explicit && image.status === 'unavailable' ? copy.imageUnavailable
     : delivery.status === 'failed' ? copy.imageArchiveFailure(delivery.reason)
     : delivery.status === 'pending' || artifactId ? copy.imageLoading : copy.imageUnsupported;
-  const hasFrame = (!visible || !!source || !!artifactId || delivery.status === 'pending') && !(compactSize && failed);
-  return <span ref={anchor} className={`maka-markdown-image-resource${hasFrame ? compactSize ? ' maka-markdown-image-compact' : ' maka-markdown-image-frame' : ''}`}
-    style={hasFrame && compactSize ? { minWidth: compactSize.width, minHeight: compactSize.height } : undefined}
+  const hasFrame = props.inline || !visible || !!source || !!artifactId || delivery.status === 'pending';
+  return <span ref={anchor} className={`maka-markdown-image-resource${hasFrame ? props.inline ? ' maka-markdown-image-inline' : ' maka-markdown-image-frame' : ''}`}
     data-maka-image-state={message ? failed ? 'failed' : 'loading' : 'ready'}>
-    {message ? <span className="maka-markdown-image-placeholder">
+    {message && props.inline ? <Tooltip content={message}>
+      <span className="maka-markdown-image-placeholder" role="status" aria-label={message}>
+        {failed || delivery.status === 'failed'
+          ? <IconButton icon={<RotateCw size={14} />} size="sm" label={copy.imageRetry} onClick={retry} />
+          : delivery.status === 'unavailable' && visible
+            ? <AlertTriangle size={14} aria-hidden="true" /> : <Spinner size="sm" shade="subtle" aria-hidden="true" />}
+      </span>
+    </Tooltip> : message ? <span className="maka-markdown-image-placeholder">
       {props.alt && <span className="maka-markdown-image-caption">{props.alt}</span>}
       <span role="status">{hasFrame && !failed && delivery.status !== 'failed' && <Spinner size="sm" shade="subtle" aria-hidden="true" />} {message}</span>
       {(failed || delivery.status === 'failed') && sourceActions}
-    </span> : source && <DisplayImage key={`${source}\0${attempt}`} src={source} alt={props.alt} compactSize={compactSize} onError={() => setFailedSource(source)}
-      onLoad={(width, height) => setCompactSize(width <= 320 && height <= 64 ? { width, height } : undefined)} />}
-    {!explicit && delivery.status === 'pending' && remote && source && <span className="maka-markdown-image-saving" role="status">{copy.imageSaving}</span>}
-    {!explicit && delivery.status === 'failed' && remote && source && !failed && <span className="maka-markdown-image-saving" role="status">
+    </span> : source && <DisplayImage key={`${source}\0${attempt}`} src={source} alt={props.alt} onError={() => setFailedSource(source)} />}
+    {!explicit && delivery.status === 'pending' && remote && source && (props.inline ? <Tooltip content={copy.imageSaving}>
+      <span className="maka-markdown-image-saving" role="status" aria-label={copy.imageSaving}><Spinner size="sm" aria-hidden="true" /></span>
+    </Tooltip> : <span className="maka-markdown-image-saving" role="status">{copy.imageSaving}</span>)}
+    {!explicit && delivery.status === 'failed' && remote && source && !failed && (props.inline ? <Tooltip content={copy.imageArchiveFailure(delivery.reason)}>
+      <span className="maka-markdown-image-saving" role="status" aria-label={copy.imageArchiveFailure(delivery.reason)}>
+        <IconButton icon={<AlertTriangle size={14} />} size="sm" label={copy.imageRetry} onClick={retry} />
+      </span>
+    </Tooltip> : <span className="maka-markdown-image-saving" role="status">
       {copy.imageArchiveFailure(delivery.reason)} {sourceActions}
-    </span>}
+    </span>)}
   </span>;
 }
-function DisplayImage(props: { src: string; alt: string; compactSize?: { width: number; height: number }; onError(): void; onLoad(width: number, height: number): void }) {
+function DisplayImage(props: { src: string; alt: string; onError(): void }) {
   const copy = getSharedUiCopy(useUiLocale()).markdown;
   const [loaded, setLoaded] = useState(false);
   const lightbox = useLightbox({ media: { src: props.src, alt: props.alt }, hasZoom: true });
   return <>
-    <span className="maka-markdown-image-preview" style={props.compactSize ? { width: props.compactSize.width, height: props.compactSize.height } : undefined}>
-      {!loaded && <span className="maka-markdown-image-loading" role="status"><Spinner size="sm" shade="subtle" aria-hidden="true" /> {copy.imageLoading}</span>}
+    <span className="maka-markdown-image-preview">
+      {!loaded && <span className="maka-markdown-image-loading" role="status" aria-label={copy.imageLoading}><Spinner size="sm" shade="subtle" aria-hidden="true" /> <span className="maka-markdown-image-loading-label">{copy.imageLoading}</span></span>}
       <img src={props.src} alt={props.alt} loading="lazy" decoding="async" referrerPolicy="no-referrer"
-          className="maka-markdown-attachment-image" onLoad={event => {
-            setLoaded(true); props.onLoad(event.currentTarget.naturalWidth, event.currentTarget.naturalHeight);
-          }} onError={props.onError} />
+          className="maka-markdown-attachment-image" onLoad={() => setLoaded(true)} onError={props.onError} />
       {loaded && <span className="maka-markdown-image-expand">
-        <IconButton icon={<Maximize2 size={16} />} size="sm" label={copy.imageExpand(props.alt)} onClick={() => lightbox.open()} />
+        <IconButton icon={<Maximize2 size={16} />} size="sm" label={copy.imageExpand(props.alt)} onClick={event => { event.preventDefault(); event.stopPropagation(); lightbox.open(); }} />
       </span>}
     </span>
     {lightbox.isOpen && lightbox.element}
diff --git a/packages/ui/src/styles.css b/packages/ui/src/styles.css
index ca22fc6b72f..cf463d534a5 100644
--- a/packages/ui/src/styles.css
+++ b/packages/ui/src/styles.css
@@ -632,16 +632,24 @@
   gap: var(--space-3);
 }
 .maka-markdown-image-resource { display: inline-block; position: relative; max-width: 100%; }
-/* Source resolution and decoding share one responsive frame. Transient status
-   overlays never add a row or move the transcript when they disappear. */
+/* The conversation owns the width (up to the 800px reading measure). A preview
+   fits that column, but cannot consume more than 60% of a short viewport.
+   Markdown placement, not decoded dimensions, fixes the loading/ready box. */
 .maka-markdown-image-frame {
   display: block;
-  width: 640px;
-  aspect-ratio: 4 / 3;
+  width: 100%;
+  aspect-ratio: 16 / 10;
+  max-height: min(480px, 60vh);
+}
+/* Six text ems leave room for a typical badge; one inherited line keeps it in
+   the prose rhythm. Scale down wider images and use the lightbox for detail. */
+.maka-markdown-image-inline {
+  width: 6em;
+  height: 1lh;
+  vertical-align: middle;
 }
-.maka-markdown-image-compact { display: inline-flex; align-items: center; vertical-align: middle; }
 .maka-markdown-image-frame > .maka-markdown-image-placeholder,
-.maka-markdown-image-compact > .maka-markdown-image-placeholder {
+.maka-markdown-image-inline .maka-markdown-image-placeholder {
   position: absolute;
   inset: 0;
   align-items: center;
@@ -655,19 +663,20 @@
   align-items: center;
   justify-content: center;
 }
-.maka-markdown-image-compact > .maka-markdown-image-preview { position: relative; flex-shrink: 0; }
+.maka-markdown-image-inline .maka-markdown-image-placeholder { padding: 0; }
+.maka-markdown-image-inline .maka-markdown-image-loading-label { display: none; }
 .maka-markdown-image-expand {
   position: absolute;
   inset-block-end: var(--space-2);
   inset-inline-end: var(--space-2);
 }
 /* Badge controls remain keyboard reachable without covering the badge at rest. */
-.maka-markdown-image-compact .maka-markdown-image-expand {
+.maka-markdown-image-inline .maka-markdown-image-expand {
   inset: auto 0 0 auto;
   opacity: 0;
   pointer-events: none;
 }
-.maka-markdown-image-compact:is(:hover, :focus-within) .maka-markdown-image-expand {
+.maka-markdown-image-inline:is(:hover, :focus-within) .maka-markdown-image-expand {
   opacity: 1;
   pointer-events: auto;
 }
@@ -693,9 +702,10 @@
   color: var(--muted-foreground);
   font-size: var(--maka-font-size-sm);
 }
-.maka-markdown-image-compact > .maka-markdown-image-saving {
-  position: static;
-  max-width: none;
+.maka-markdown-image-inline .maka-markdown-image-saving {
+  inset: auto auto 0 0;
+  max-width: 100%;
+  padding: 0;
 }
 
 /* Markdown code renderers are custom components so Mermaid can be loaded only

From b0c4a19cd4cec5bbcafdd79540a855b00d8289f6 Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Tue, 6 Oct 2026 20:30:15 +0800
Subject: [PATCH 12/37] test(ui): generate image fixture without committed
 screenshots

Remove PR evidence images and generate a deterministic PNG with matching dimensions for browser coverage.

Generated-by: Codex (GPT-6)
---
 .../scripts/markdown-images.browser.test.mjs  | 28 ++++++++++++++++++-
 1 file changed, 27 insertions(+), 1 deletion(-)

diff --git a/packages/ui/scripts/markdown-images.browser.test.mjs b/packages/ui/scripts/markdown-images.browser.test.mjs
index e5cc1d13821..a7120265a9f 100644
--- a/packages/ui/scripts/markdown-images.browser.test.mjs
+++ b/packages/ui/scripts/markdown-images.browser.test.mjs
@@ -26,6 +26,7 @@ import { createServer } from 'node:http';
 import { readFile, mkdir } from 'node:fs/promises';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { crc32, deflateSync } from 'node:zlib';
 import { build } from 'esbuild';
 import { chromium } from '@playwright/test';
 
@@ -39,8 +40,33 @@ let releaseAttachment;
 const delayedImage = new Promise(resolve => { releaseImage = resolve; });
 const delayedAttachment = new Promise(resolve => { releaseAttachment = resolve; });
 
+// Keep the screenshot's original dimensions without committing evidence images.
+function screenshotFixture() {
+  const width = 900, height = 730;
+  const header = Buffer.alloc(13);
+  header.writeUInt32BE(width, 0); header.writeUInt32BE(height, 4);
+  header[8] = 8; header[9] = 2; // 8-bit RGB.
+  const stride = 1 + width * 3;
+  const pixels = Buffer.alloc(stride * height, 220);
+  for (let row = 0; row < height; row++) {
+    pixels.fill(row < height / 2 ? 120 : 220, row * stride, (row + 1) * stride);
+    pixels[row * stride] = 0; // PNG filter: None.
+  }
+  const chunk = (type, data) => {
+    const result = Buffer.alloc(data.length + 12);
+    result.writeUInt32BE(data.length, 0); result.write(type, 4, 'ascii');
+    data.copy(result, 8);
+    result.writeUInt32BE(crc32(result.subarray(4, data.length + 8)), data.length + 8);
+    return result;
+  };
+  return Buffer.concat([
+    Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]),
+    chunk('IHDR', header), chunk('IDAT', deflateSync(pixels)), chunk('IEND', Buffer.alloc(0)),
+  ]);
+}
+
 before(async () => {
-  const screenshot = await readFile(new URL('../../../docs/images/pr/chat-image-delivery/after.png', import.meta.url));
+  const screenshot = screenshotFixture();
   imageServer = createServer((req, res) => {
     requests.push({ path: req.url, referer: req.headers.referer });
     if (req.url === '/delayed.png') {

From 82f55eca0731fa7971c741fd21eb20a3f2b26dc8 Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Tue, 6 Oct 2026 20:33:51 +0800
Subject: [PATCH 13/37] fix(ci): refresh image Tooltip surface inventory

Regenerate the Astryx inventory to include Tooltip used by MarkdownImage.

Generated-by: Codex (GPT-6)
---
 docs/astryx-surface-file-inventory.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/astryx-surface-file-inventory.md b/docs/astryx-surface-file-inventory.md
index adcb5599521..1535c7f1b66 100644
--- a/docs/astryx-surface-file-inventory.md
+++ b/docs/astryx-surface-file-inventory.md
@@ -312,7 +312,7 @@ Wiki bar: Design Conventions · API Use-the-System · Theming · Container Paddi
 | `packages/ui/src/locale-context.tsx` | ui-composition | none | aligned — no raw controls; no Astryx JSX usage | aligned |
 | `packages/ui/src/maka-wordmark.tsx` | ui-composition | none | aligned — no raw controls; no Astryx JSX usage | aligned |
 | `packages/ui/src/markdown-body.tsx` | ui-composition | CodeBlock, Link, Markdown | aligned — uses Astryx (CodeBlock, Link, Markdown) | aligned |
-| `packages/ui/src/markdown-image.tsx` | ui-composition | Button, IconButton, Link, Spinner | aligned — uses Astryx (Button, IconButton, Link, Spinner) | aligned |
+| `packages/ui/src/markdown-image.tsx` | ui-composition | Button, IconButton, Link, Spinner, Tooltip | aligned — uses Astryx (Button, IconButton, Link, Spinner, Tooltip) | aligned |
 | `packages/ui/src/markdown-math.tsx` | ui-composition | none | aligned — no raw controls; no Astryx JSX usage | aligned |
 | `packages/ui/src/markdown.tsx` | ui-composition | none | aligned — no raw controls; no Astryx JSX usage | aligned |
 | `packages/ui/src/mermaid-diagram.tsx` | ui-composition | Button, CodeBlock, Collapsible, Dialog, IconButton, Toolbar | aligned — uses Astryx (Button, CodeBlock, Collapsible, Dialog, IconButton, Toolbar) | aligned |

From 35fbd3be08811e6b7c97e11906f6edc212358d3f Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Wed, 7 Oct 2026 13:09:57 +0800
Subject: [PATCH 14/37] fix(ui): preserve image destinations through display
 redaction

Keep signed URLs and hashed image paths behind image-only aliases while redacting prose and lazy fallbacks. Exercise the complete Markdown entry in browser regressions, including saved replay, duplicate signatures, streaming and layout.

Generated-by: Codex (GPT-6)
---
 .../licenses/npm/THIRD_PARTY_NOTICES.txt      | 1060 ++++++++++++++++-
 package-lock.json                             |  453 ++++++-
 packages/core/src/image-markdown.ts           |   11 +-
 packages/ui/package.json                      |    1 +
 .../scripts/markdown-images.browser.test.mjs  |   71 +-
 .../ui/src/__tests__/markdown-body.test.ts    |   11 +
 .../markdown-image-redaction.test.ts          |  114 ++
 packages/ui/src/markdown-body.tsx             |   15 +-
 packages/ui/src/markdown-image-redaction.ts   |   83 ++
 packages/ui/src/markdown-image.tsx            |   10 +-
 packages/ui/src/markdown.tsx                  |   14 +-
 11 files changed, 1784 insertions(+), 59 deletions(-)
 create mode 100644 packages/ui/src/__tests__/markdown-image-redaction.test.ts
 create mode 100644 packages/ui/src/markdown-image-redaction.ts

diff --git a/apps/desktop/resources/licenses/npm/THIRD_PARTY_NOTICES.txt b/apps/desktop/resources/licenses/npm/THIRD_PARTY_NOTICES.txt
index dbe751bc9b9..d5b17eab680 100644
--- a/apps/desktop/resources/licenses/npm/THIRD_PARTY_NOTICES.txt
+++ b/apps/desktop/resources/licenses/npm/THIRD_PARTY_NOTICES.txt
@@ -5395,6 +5395,36 @@ MIT License
 
 ================================================================================
 
+Package: @types/debug@4.1.13
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/DefinitelyTyped/DefinitelyTyped.git#types/debug
+
+--- LICENSE ---
+MIT License
+
+    Copyright (c) Microsoft Corporation.
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE
+
+================================================================================
+
 Package: @types/geojson@7946.0.16
 Declared license: MIT
 Selected license: MIT
@@ -5425,6 +5455,66 @@ MIT License
 
 ================================================================================
 
+Package: @types/mdast@4.0.4
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/DefinitelyTyped/DefinitelyTyped.git#types/mdast
+
+--- LICENSE ---
+MIT License
+
+    Copyright (c) Microsoft Corporation.
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE
+
+================================================================================
+
+Package: @types/ms@2.1.0
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/DefinitelyTyped/DefinitelyTyped.git#types/ms
+
+--- LICENSE ---
+MIT License
+
+    Copyright (c) Microsoft Corporation.
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE
+
+================================================================================
+
 Package: @types/node@26.6.3
 Declared license: MIT
 Selected license: MIT
@@ -5545,6 +5635,36 @@ MIT License
 
 ================================================================================
 
+Package: @types/unist@3.0.3
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/DefinitelyTyped/DefinitelyTyped.git#types/unist
+
+--- LICENSE ---
+MIT License
+
+    Copyright (c) Microsoft Corporation.
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE
+
+================================================================================
+
 Package: @upsetjs/venn.js@2.0.0
 Declared license: MIT
 Selected license: MIT
@@ -7256,6 +7376,37 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 
 ================================================================================
 
+Package: character-entities@2.0.2
+Declared license: MIT
+Selected license: MIT
+Repository: wooorm/character-entities
+
+--- license ---
+(The MIT License)
+
+Copyright (c) 2015 Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
 Package: cli-table3@0.6.5
 Declared license: MIT
 Selected license: MIT
@@ -8836,6 +8987,37 @@ THE SOFTWARE.
 
 ================================================================================
 
+Package: decode-named-character-reference@1.3.0
+Declared license: MIT
+Selected license: MIT
+Repository: wooorm/decode-named-character-reference
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
 Package: delaunator@5.1.0
 Declared license: ISC
 Selected license: ISC
@@ -8888,6 +9070,67 @@ THE SOFTWARE.
 
 ================================================================================
 
+Package: dequal@2.0.3
+Declared license: MIT
+Selected license: MIT
+Repository: lukeed/dequal
+
+--- license ---
+The MIT License (MIT)
+
+Copyright (c) Luke Edwards <luke.edwards05@gmail.com> (lukeed.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+
+================================================================================
+
+Package: devlop@1.1.0
+Declared license: MIT
+Selected license: MIT
+Repository: wooorm/devlop
+
+--- license ---
+(The MIT License)
+
+Copyright (c) 2023 Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
 Package: dijkstrajs@1.0.3
 Declared license: MIT
 Selected license: MIT
@@ -12779,33 +13022,777 @@ SOFTWARE.
 
 ================================================================================
 
-Package: mermaid@11.17.2
+Package: mdast-util-from-markdown@2.1.0
 Declared license: MIT
 Selected license: MIT
-Repository: https://github.com/mermaid-js/mermaid
-
---- LICENSE ---
-The MIT License (MIT)
+Repository: syntax-tree/mdast-util-from-markdown
 
-Copyright (c) 2014 - 2022 Knut Sveidqvist
+--- license ---
+(The MIT License)
 
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
 
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
 
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: mdast-util-to-string@4.0.0
+Declared license: MIT
+Selected license: MIT
+Repository: syntax-tree/mdast-util-to-string
+
+--- license ---
+(The MIT License)
+
+Copyright (c) 2015 Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: mermaid@11.17.2
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/mermaid-js/mermaid
+
+--- LICENSE ---
+The MIT License (MIT)
+
+Copyright (c) 2014 - 2022 Knut Sveidqvist
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+================================================================================
+
+Package: micromark@4.0.3
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-core-commonmark@2.0.4
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-core-commonmark
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-factory-destination@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-factory-destination
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-factory-label@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-factory-label
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-factory-space@2.1.0
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-factory-space
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-factory-title@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-factory-title
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-factory-whitespace@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-factory-whitespace
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-character@2.1.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-character
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-chunked@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-chunked
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-classify-character@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-classify-character
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-combine-extensions@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-combine-extensions
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-decode-numeric-character-reference@2.0.2
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-decode-numeric-character-reference
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-decode-string@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-decode-string
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-edit-map@1.0.0
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-edit-map
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-encode@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-encode
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-html-tag-name@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-html-tag-name
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-normalize-identifier@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-normalize-identifier
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-resolve-all@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-resolve-all
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-sanitize-uri@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-sanitize-uri
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-subtokenize@2.1.0
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-subtokenize
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-symbol@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-symbol
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-types@2.0.3
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-types
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ================================================================================
 
@@ -15697,6 +16684,37 @@ SOFTWARE.
 
 ================================================================================
 
+Package: unist-util-stringify-position@4.0.0
+Declared license: MIT
+Selected license: MIT
+Repository: syntax-tree/unist-util-stringify-position
+
+--- license ---
+(The MIT License)
+
+Copyright (c) 2016 Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
 Package: universalify@2.0.1
 Declared license: MIT
 Selected license: MIT
diff --git a/package-lock.json b/package-lock.json
index b01ea74dee6..0d002cbc260 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -5715,7 +5715,6 @@
       "version": "4.1.13",
       "resolved": "https://registry.npmjs.org/@types/debug/-/debug-4.1.13.tgz",
       "integrity": "sha512-KSVgmQmzMwPlmtljOomayoR89W4FynCAi3E8PPs7vmDVPe84hT+vGPKkJfThkmXs0x0jAaa9U8uW8bbfyS2fWw==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/ms": "*"
@@ -5799,7 +5798,6 @@
       "version": "4.0.4",
       "resolved": "https://registry.npmjs.org/@types/mdast/-/mdast-4.0.4.tgz",
       "integrity": "sha512-kGaNbPh1k7AFzgpud/gMdvIm5xuECykRR+JnWKQno9TAXVa6WIVCGTPvYGekIDL4uwCZQSYbUxNBSb1aUo79oA==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/unist": "*"
@@ -5809,7 +5807,6 @@
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/@types/ms/-/ms-2.1.0.tgz",
       "integrity": "sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA==",
-      "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/nlcst": {
@@ -5892,7 +5889,6 @@
       "version": "3.0.3",
       "resolved": "https://registry.npmjs.org/@types/unist/-/unist-3.0.3.tgz",
       "integrity": "sha512-ko/gIFJRv177XgZsZcBwnqJN5x/Gien8qNOn0D5bQU/zAzVf9Zt3BlcUiLqhV9y4ARk0GbT3tnUiPNgnTXzc/Q==",
-      "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/ws": {
@@ -7650,6 +7646,16 @@
         "url": "https://github.com/chalk/chalk?sponsor=1"
       }
     },
+    "node_modules/character-entities": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/character-entities/-/character-entities-2.0.2.tgz",
+      "integrity": "sha512-shx7oQ0Awen/BRIdkjkvz54PnEEI/EjwXDSIZp86/KKdbafHh1Df/RYGBhn4hbe2+uKC9FnT5UCEdyPz3ai9hQ==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
     "node_modules/character-entities-html4": {
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/character-entities-html4/-/character-entities-html4-2.1.0.tgz",
@@ -8666,6 +8672,19 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/decode-named-character-reference": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/decode-named-character-reference/-/decode-named-character-reference-1.3.0.tgz",
+      "integrity": "sha512-GtpQYB283KrPp6nRw50q3U9/VfOutZOe103qlN7BPP6Ad27xYnOIWv4lPzo8HCAL+mMZofJ9KEy30fq6MfaK6Q==",
+      "license": "MIT",
+      "dependencies": {
+        "character-entities": "^2.0.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
     "node_modules/decompress-response": {
       "version": "6.0.0",
       "resolved": "https://registry.npmjs.org/decompress-response/-/decompress-response-6.0.0.tgz",
@@ -8834,7 +8853,6 @@
       "version": "2.0.3",
       "resolved": "https://registry.npmjs.org/dequal/-/dequal-2.0.3.tgz",
       "integrity": "sha512-0je+qPKHEMohvfRTCEo3CrPG6cAzAYgmzKyxRiYSSDkS6eGJdyVJm7WaYA5ECaAD9wLB2T4EEeymA5aFVcYXCA==",
-      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=6"
@@ -8876,7 +8894,6 @@
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/devlop/-/devlop-1.1.0.tgz",
       "integrity": "sha512-RWmIqhcFf1lRYBvNmr7qTNuyCt/7/ns2jbpp1+PalgE/rDQcBT0fioSMUpJ93irlUhC5hrg4cYqe6U+0ImW0rA==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "dequal": "^2.0.0"
@@ -12374,6 +12391,30 @@
         "node": ">= 0.4"
       }
     },
+    "node_modules/mdast-util-from-markdown": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/mdast-util-from-markdown/-/mdast-util-from-markdown-2.1.0.tgz",
+      "integrity": "sha512-KRLgmPaP2H1ul2bpoJkOS+9pAcDAAj9Nu1mqLnh8NLeJG5tlvj42TH80PIGBpROWlRXLk0lDrWNuZCFy/tsB4A==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/mdast": "^4.0.0",
+        "@types/unist": "^3.0.0",
+        "decode-named-character-reference": "^1.0.0",
+        "devlop": "^1.0.0",
+        "mdast-util-to-string": "^4.0.0",
+        "micromark": "^4.0.0",
+        "micromark-util-decode-numeric-character-reference": "^2.0.0",
+        "micromark-util-decode-string": "^2.0.0",
+        "micromark-util-normalize-identifier": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0",
+        "unist-util-stringify-position": "^4.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
     "node_modules/mdast-util-to-hast": {
       "version": "13.2.1",
       "resolved": "https://registry.npmjs.org/mdast-util-to-hast/-/mdast-util-to-hast-13.2.1.tgz",
@@ -12396,6 +12437,19 @@
         "url": "https://opencollective.com/unified"
       }
     },
+    "node_modules/mdast-util-to-string": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/mdast-util-to-string/-/mdast-util-to-string-4.0.0.tgz",
+      "integrity": "sha512-0H44vDimn51F0YwvxSJSm0eCDOJTRlmN0R1yBh4HLj9wiV1Dn0QoXGbvFAWj2hSItVTlCmBF1hqKlIyUBVFLPg==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/mdast": "^4.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
     "node_modules/mdn-data": {
       "version": "2.27.1",
       "resolved": "https://registry.npmjs.org/mdn-data/-/mdn-data-2.27.1.tgz",
@@ -12468,11 +12522,188 @@
         "node": ">= 20"
       }
     },
+    "node_modules/micromark": {
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/micromark/-/micromark-4.0.3.tgz",
+      "integrity": "sha512-oGYfQzHSG5dOMovQcJ3fyTmZlWAWpi0XA0sJwJs+i6OT88o1+Jtw/8z0CmdowSLxGhhFK89rQ/oXph/wN02PNw==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "@types/debug": "^4.0.0",
+        "debug": "^4.0.0",
+        "decode-named-character-reference": "^1.0.0",
+        "devlop": "^1.0.0",
+        "micromark-core-commonmark": "^2.0.0",
+        "micromark-factory-space": "^2.0.0",
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-chunked": "^2.0.0",
+        "micromark-util-combine-extensions": "^2.0.0",
+        "micromark-util-decode-numeric-character-reference": "^2.0.0",
+        "micromark-util-edit-map": "^1.0.0",
+        "micromark-util-encode": "^2.0.0",
+        "micromark-util-normalize-identifier": "^2.0.0",
+        "micromark-util-resolve-all": "^2.0.0",
+        "micromark-util-sanitize-uri": "^2.0.0",
+        "micromark-util-subtokenize": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-core-commonmark": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/micromark-core-commonmark/-/micromark-core-commonmark-2.0.4.tgz",
+      "integrity": "sha512-wxEeE8v8XVvOrxn1TZj74qYhAtTQsSqufHVS3uNVyT1MupXxhyaHk8/9xDNPh9BmL77QNDgWTkZ3RsYHB2ry7w==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "decode-named-character-reference": "^1.0.0",
+        "devlop": "^1.0.0",
+        "micromark-factory-destination": "^2.0.0",
+        "micromark-factory-label": "^2.0.0",
+        "micromark-factory-space": "^2.1.0",
+        "micromark-factory-title": "^2.0.0",
+        "micromark-factory-whitespace": "^2.0.0",
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-chunked": "^2.0.0",
+        "micromark-util-classify-character": "^2.0.0",
+        "micromark-util-edit-map": "^1.0.0",
+        "micromark-util-html-tag-name": "^2.0.0",
+        "micromark-util-normalize-identifier": "^2.0.0",
+        "micromark-util-resolve-all": "^2.0.0",
+        "micromark-util-subtokenize": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.3"
+      }
+    },
+    "node_modules/micromark-factory-destination": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-factory-destination/-/micromark-factory-destination-2.0.1.tgz",
+      "integrity": "sha512-Xe6rDdJlkmbFRExpTOmRj9N3MaWmbAgdpSrBQvCFqhezUn4AHqJHbaEnfbVYYiexVSs//tqOdY/DxhjdCiJnIA==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-factory-label": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-factory-label/-/micromark-factory-label-2.0.1.tgz",
+      "integrity": "sha512-VFMekyQExqIW7xIChcXn4ok29YE3rnuyveW3wZQWWqF4Nv9Wk5rgJ99KzPvHjkmPXF93FXIbBp6YdW3t71/7Vg==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "devlop": "^1.0.0",
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-factory-space": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/micromark-factory-space/-/micromark-factory-space-2.1.0.tgz",
+      "integrity": "sha512-fS8hnLIjnjvdQIj39Geug8wWsR0HrYZ43KShKxNfwT7t2LOHo/LbWZEzEaSOjwtjdCsjoE6syHhonEzW0zv0+Q==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-factory-title": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-factory-title/-/micromark-factory-title-2.0.1.tgz",
+      "integrity": "sha512-5bZ+3CjhAd9eChYTHsjy6TGxpOFSKgKKJPJxr293jTbfry2KDoWkhBb6TcPVB4NmzaPhMs1Frm9AZH7OD4Cjzw==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-factory-space": "^2.0.0",
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-factory-whitespace": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-factory-whitespace/-/micromark-factory-whitespace-2.0.1.tgz",
+      "integrity": "sha512-Ob0nuZ3PKt/n0hORHyvoD9uZhr+Za8sFoP+OnMcnWK5lngSzALgQYKMr9RJVOWLqQYuyn6ulqGWSXdwf6F80lQ==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-factory-space": "^2.0.0",
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
     "node_modules/micromark-util-character": {
       "version": "2.1.1",
       "resolved": "https://registry.npmjs.org/micromark-util-character/-/micromark-util-character-2.1.1.tgz",
       "integrity": "sha512-wv8tdUTJ3thSFFFJKtpYKOYiGP2+v96Hvk4Tu8KpCAsTMs6yi+nVmGh1syvSCsaxz45J6Jbw+9DD6g97+NV67Q==",
-      "dev": true,
       "funding": [
         {
           "type": "GitHub Sponsors",
@@ -12489,11 +12720,130 @@
         "micromark-util-types": "^2.0.0"
       }
     },
+    "node_modules/micromark-util-chunked": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-chunked/-/micromark-util-chunked-2.0.1.tgz",
+      "integrity": "sha512-QUNFEOPELfmvv+4xiNg2sRYeS/P84pTW0TCgP5zc9FpXetHY0ab7SxKyAQCNCc1eK0459uoLI1y5oO5Vc1dbhA==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-util-symbol": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-util-classify-character": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-classify-character/-/micromark-util-classify-character-2.0.1.tgz",
+      "integrity": "sha512-K0kHzM6afW/MbeWYWLjoHQv1sgg2Q9EccHEDzSkxiP/EaagNzCm7T/WMKZ3rjMbvIpvBiZgwR3dKMygtA4mG1Q==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-util-combine-extensions": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-combine-extensions/-/micromark-util-combine-extensions-2.0.1.tgz",
+      "integrity": "sha512-OnAnH8Ujmy59JcyZw8JSbK9cGpdVY44NKgSM7E9Eh7DiLS2E9RNQf0dONaGDzEG9yjEl5hcqeIsj4hfRkLH/Bg==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-util-chunked": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-util-decode-numeric-character-reference": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/micromark-util-decode-numeric-character-reference/-/micromark-util-decode-numeric-character-reference-2.0.2.tgz",
+      "integrity": "sha512-ccUbYk6CwVdkmCQMyr64dXz42EfHGkPQlBj5p7YVGzq8I7CtjXZJrubAYezf7Rp+bjPseiROqe7G6foFd+lEuw==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-util-symbol": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-util-decode-string": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-decode-string/-/micromark-util-decode-string-2.0.1.tgz",
+      "integrity": "sha512-nDV/77Fj6eH1ynwscYTOsbK7rR//Uj0bZXBwJZRfaLEJ1iGBR6kIfNmlNqaqJf649EP0F3NWNdeJi03elllNUQ==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "decode-named-character-reference": "^1.0.0",
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-decode-numeric-character-reference": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-util-edit-map": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/micromark-util-edit-map/-/micromark-util-edit-map-1.0.0.tgz",
+      "integrity": "sha512-Pa2ljlsEL6sVwFaYeyrOLSYbQt73JvGbPOYFq+9AElXiSnfI5Q4465RRZ1sHv7lDjDOnGRDDaqPXqClqWK/q1Q==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-util-types": "^2.0.0"
+      }
+    },
     "node_modules/micromark-util-encode": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/micromark-util-encode/-/micromark-util-encode-2.0.1.tgz",
       "integrity": "sha512-c3cVx2y4KqUnwopcO9b/SCdo2O67LwJJ/UyqGfbigahfegL9myoEFoDYZgkT7f36T0bLrM9hZTAaAyH+PCAXjw==",
-      "dev": true,
       "funding": [
         {
           "type": "GitHub Sponsors",
@@ -12506,11 +12856,64 @@
       ],
       "license": "MIT"
     },
+    "node_modules/micromark-util-html-tag-name": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-html-tag-name/-/micromark-util-html-tag-name-2.0.1.tgz",
+      "integrity": "sha512-2cNEiYDhCWKI+Gs9T0Tiysk136SnR13hhO8yW6BGNyhOC4qYFnwF1nKfD3HFAIXA5c45RrIG1ub11GiXeYd1xA==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/micromark-util-normalize-identifier": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-normalize-identifier/-/micromark-util-normalize-identifier-2.0.1.tgz",
+      "integrity": "sha512-sxPqmo70LyARJs0w2UclACPUUEqltCkJ6PhKdMIDuJ3gSf/Q+/GIe3WKl0Ijb/GyH9lOpUkRAO2wp0GVkLvS9Q==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-util-symbol": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-util-resolve-all": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-resolve-all/-/micromark-util-resolve-all-2.0.1.tgz",
+      "integrity": "sha512-VdQyxFWFT2/FGJgwQnJYbe1jjQoNTS4RjglmSjTUlpUMa95Htx9NHeYW4rGDJzbjvCsl9eLjMQwGeElsqmzcHg==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-util-types": "^2.0.0"
+      }
+    },
     "node_modules/micromark-util-sanitize-uri": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/micromark-util-sanitize-uri/-/micromark-util-sanitize-uri-2.0.1.tgz",
       "integrity": "sha512-9N9IomZ/YuGGZZmQec1MbgxtlgougxTodVwDzzEouPKo3qFWvymFHWcnDi2vzV1ff6kas9ucW+o3yzJK9YB1AQ==",
-      "dev": true,
       "funding": [
         {
           "type": "GitHub Sponsors",
@@ -12528,11 +12931,32 @@
         "micromark-util-symbol": "^2.0.0"
       }
     },
+    "node_modules/micromark-util-subtokenize": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/micromark-util-subtokenize/-/micromark-util-subtokenize-2.1.0.tgz",
+      "integrity": "sha512-XQLu552iSctvnEcgXw6+Sx75GflAPNED1qx7eBJ+wydBb2KCbRZe+NwvIEEMM83uml1+2WSXpBAcp9IUCgCYWA==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "devlop": "^1.0.0",
+        "micromark-util-chunked": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
     "node_modules/micromark-util-symbol": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/micromark-util-symbol/-/micromark-util-symbol-2.0.1.tgz",
       "integrity": "sha512-vs5t8Apaud9N28kgCrRUdEed4UJ+wWNvicHLPxCa9ENlYuAY31M0ETy5y1vA33YoNPDFTghEbnh6efaE8h4x0Q==",
-      "dev": true,
       "funding": [
         {
           "type": "GitHub Sponsors",
@@ -12546,10 +12970,9 @@
       "license": "MIT"
     },
     "node_modules/micromark-util-types": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/micromark-util-types/-/micromark-util-types-2.0.2.tgz",
-      "integrity": "sha512-Yw0ECSpJoViF1qTU4DC6NwtC4aWGt1EkzaQB8KPPyCRR8z9TWeV0HbEFGTO+ZY1wB22zmxnJqhPyTpOVCpeHTA==",
-      "dev": true,
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/micromark-util-types/-/micromark-util-types-2.0.3.tgz",
+      "integrity": "sha512-oxB2Ik03hI0gv+VNn9tnh1t1YEe9MDPptViAEgfdf3YQHsn0pzGTgCdlSCJXcwhqm8phaEuM7zeEu3QQzVBrPg==",
       "funding": [
         {
           "type": "GitHub Sponsors",
@@ -16529,7 +16952,6 @@
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/unist-util-stringify-position/-/unist-util-stringify-position-4.0.0.tgz",
       "integrity": "sha512-0ASV06AAoKCDkS2+xw5RXJywruurpbC4JZSm7nr7MOt1ojAzvyyaO+UxZf18j8FCF6kmzCZKcAgN/yu2gm2XgQ==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/unist": "^3.0.0"
@@ -17511,6 +17933,7 @@
         "clsx": "^2.1.1",
         "katex": "0.18.9",
         "lucide-react": "^1.48.0",
+        "mdast-util-from-markdown": "^2.1.0",
         "mermaid": "^11.17.2",
         "react": "^19.3.0",
         "react-dom": "^19.3.0",
diff --git a/packages/core/src/image-markdown.ts b/packages/core/src/image-markdown.ts
index ebbdec6db57..5d823080c69 100644
--- a/packages/core/src/image-markdown.ts
+++ b/packages/core/src/image-markdown.ts
@@ -26,12 +26,17 @@ const parser = new Marked({ gfm: true });
  * Consumers own their source policy; parsing grants no filesystem or network access.
  */
 export function markdownImageSources(text: string): string[] {
+  return [...new Set(markdownImages(text).map((image) => image.source))];
+}
+
+/** Original token spelling and canonical destination, including reference images. */
+export function markdownImages(text: string): { raw: string; source: string }[] {
   if (!text.includes('![') || text.length > IMAGE_MARKDOWN_MAX_LENGTH) return [];
-  const sources = new Set<string>();
+  const images: { raw: string; source: string }[] = [];
   parser.walkTokens(parser.lexer(text), (token) => {
-    if (token.type === 'image') sources.add(token.href);
+    if (token.type === 'image') images.push({ raw: token.raw, source: token.href });
   });
-  return [...sources];
+  return images;
 }
 
 /** Resolve a complete inline destination, rejecting trailing or partial syntax. */
diff --git a/packages/ui/package.json b/packages/ui/package.json
index 8de5e24cdb8..a1d61c248bb 100644
--- a/packages/ui/package.json
+++ b/packages/ui/package.json
@@ -33,6 +33,7 @@
     "clsx": "^2.1.1",
     "katex": "0.18.9",
     "lucide-react": "^1.48.0",
+    "mdast-util-from-markdown": "^2.1.0",
     "mermaid": "^11.17.2",
     "react": "^19.3.0",
     "react-dom": "^19.3.0",
diff --git a/packages/ui/scripts/markdown-images.browser.test.mjs b/packages/ui/scripts/markdown-images.browser.test.mjs
index a7120265a9f..fec2172f842 100644
--- a/packages/ui/scripts/markdown-images.browser.test.mjs
+++ b/packages/ui/scripts/markdown-images.browser.test.mjs
@@ -106,6 +106,14 @@ before(async () => {
     'geometry-remote': `![Screenshot](${imageUrl}/delayed.png)\n\nFollowing paragraph`,
     'geometry-saved': '![Screenshot](/tmp/private.png)\n\nFollowing paragraph',
     'streaming-angle-race': '![Screenshot](</tmp/my image.png>)',
+    'signed-saved': `![Screenshot](${imageUrl}/image.png?token=first-secret)`,
+    'signature-saved': `![Screenshot](${imageUrl}/image.png?signature=second-secret&expires=123)`,
+    'hash-saved': `![Screenshot](/tmp/${'a'.repeat(48)}.png)`,
+    'secret-reference-saved': `![Screenshot][picture]\n\n[picture]: ${imageUrl}/image.png?token=reference-secret`,
+    'signed-streaming-race': `![Screenshot](${imageUrl}/image.png?token=stream-secret)`,
+    'signed-preview': `![Screenshot](${imageUrl}/image.png?token=preview-secret)`,
+    'signed-duplicates-saved': `![First](${imageUrl}/image.png?token=first-secret) ![Second](${imageUrl}/image.png?token=second-secret)`,
+    'signed-live-saved': `![Screenshot](${imageUrl}/image.png?token=live-`,
     screenshot: `![Screenshot](${imageUrl}/screenshot.png)`,
   };
   const canonicalSources = {
@@ -115,6 +123,13 @@ before(async () => {
     'reference-saved': ['/tmp/my "image".png'],
     'geometry-saved': ['/tmp/private.png'],
     'streaming-angle-race': ['/tmp/my image.png'],
+    'signed-saved': [`${imageUrl}/image.png?token=first-secret`],
+    'signature-saved': [`${imageUrl}/image.png?signature=second-secret&expires=123`],
+    'hash-saved': [`/tmp/${'a'.repeat(48)}.png`],
+    'secret-reference-saved': [`${imageUrl}/image.png?token=reference-secret`],
+    'signed-streaming-race': [`${imageUrl}/image.png?token=stream-secret`],
+    'signed-duplicates-saved': [`${imageUrl}/image.png?token=first-secret`, `${imageUrl}/image.png?token=second-secret`],
+    'signed-live-saved': [`${imageUrl}/image.png?token=live-secret`],
   };
   const bundle = await build({
     stdin: { contents: `
@@ -122,7 +137,7 @@ before(async () => {
       import {createRoot} from 'react-dom/client';
       import {Theme, ChatMessageList, ChatMessage, ChatMessageBubble} from '@astryxdesign/core';
       import {makaTheme} from './apps/desktop/src/renderer/astryx-theme/maka.js';
-      import {MarkdownBody} from './packages/ui/dist/markdown-body.js';
+      import {Markdown} from './packages/ui/dist/markdown.js';
       import {LocaleProvider} from './packages/ui/dist/locale-context.js';
       import {ImageDeliveryProvider} from './packages/ui/dist/image-delivery.js';
       import {SessionAttachmentProvider} from './packages/ui/dist/attachment-image.js';
@@ -130,9 +145,9 @@ before(async () => {
       const mode=new URLSearchParams(location.search).get('case') || 'remote';
       const destinations=${JSON.stringify(destinations)};
       const canonicalSources=${JSON.stringify(canonicalSources)};
-      let reads=0; window.imageReads=0; window.deliveryQueries=0; window.deliveryReady=false; window.deliveryRetries=0;
+      let reads=0; window.imageReads=0; window.deliveryQueries=0; window.deliverySources=[]; window.deliveryReady=false; window.deliveryRetries=0;
       const race=mode.endsWith('-race');
-      const text=destinations[mode] ?? (mode==='attachment' ? '![Screenshot](maka://runtime/attachments/image-1)' :
+      let text=destinations[mode] ?? (mode==='attachment' ? '![Screenshot](maka://runtime/attachments/image-1)' :
         mode==='local' || mode==='local-saved' || race ? '![Screenshot](/tmp/private.png)' :
         '![Screenshot](${imageUrl}/'+(mode==='retry' ? 'retry.png' : 'image.png')+')');
       const root=createRoot(document.getElementById('root'));
@@ -145,13 +160,14 @@ before(async () => {
       const resolveDelivery=mode.endsWith('saved') || mode.endsWith('saving') || race ? async(_session,request)=>{
         window.deliveryQueries++;
         window.deliverySource=request.source;
+        window.deliverySources.push(request.source);
         if(canonicalSources[mode] && !canonicalSources[mode].includes(request.source)) return {status:'unavailable'};
         if(request.retry) window.deliveryRetries++;
         if(race) return window.deliveryReady ? {status:'ready',artifactId:'saved-image'} : {status:'unavailable'};
         await new Promise(resolve=>setTimeout(resolve,100));
         return mode.endsWith('saving') && window.deliveryQueries===1 ? {status:'pending'} : {status:'ready',artifactId:'saved-image'};
       } : undefined;
-      const markdown=(streaming)=>React.createElement(MarkdownBody,{text,streaming,settledText:race ? text : undefined,density:'compact',imageIdentity:{turnId:'turn',messageId:'message'}});
+      const markdown=(streaming)=>React.createElement(Markdown,{text,streaming,settledText:race ? text : undefined,density:'compact',imageIdentity:{turnId:'turn',messageId:'message'}});
       const surface=(streaming)=>mode.startsWith('layout-') ? React.createElement('section',{className:mode==='layout-side' ? 'maka-quote-companion' : '',style:{width:mode==='layout-side' ? '360px' : '100%',maxWidth:'100%'}},
         React.createElement(ChatMessageList,{className:'maka-chat-message-list maka-chatContent',align:'top'},
           React.createElement('div',{className:'maka-transcript-turn maka-turn',style:{width:'100%',maxWidth:'var(--maka-reading-measure)',marginInline:'auto'}},
@@ -164,6 +180,7 @@ before(async () => {
               React.createElement('div',{style:mode==='offscreen' ? {paddingTop:'2500px'} : {}},
                 surface(streaming)))))));
       window.finishStream=()=>render(false);
+      window.appendText=value=>{text+=value; render(true);};
       render();
     `, resolveDir: root, loader: 'js' },
     bundle: true, write: false, outdir: '/virtual', format: 'iife',
@@ -219,6 +236,45 @@ test('remote image loads automatically under the actual desktop CSP, without sen
   } finally { await page.close(); }
 });
 
+test('a signed image previews using its original URL without putting the token in visible text', async () => {
+  requests = [];
+  const page = await pageFor('signed-preview');
+  try {
+    await loaded(page);
+    assert.deepEqual(requests, [{ path: '/image.png?token=preview-secret', referer: undefined }]);
+    assert.ok(!(await page.locator('body').innerText()).includes('preview-secret'));
+  } finally { await page.close(); }
+});
+
+test('two signed destinations which redact alike replay their own saved attachments', async () => {
+  requests = [];
+  const page = await pageFor('signed-duplicates-saved');
+  try {
+    await page.waitForFunction(() => document.images.length === 2 && [...document.images].every(image => image.src.startsWith('data:') && image.naturalWidth === 1));
+    assert.deepEqual(await page.evaluate(() => window.deliverySources), [
+      `${imageUrl}/image.png?token=first-secret`, `${imageUrl}/image.png?token=second-secret`,
+    ]);
+    assert.deepEqual(requests, []);
+    assert.doesNotMatch(await page.locator('body').innerText(), /first-secret|second-secret/);
+  } finally { await page.close(); }
+});
+
+test('a signed image completed by a later text delta resolves its original destination', async () => {
+  requests = [];
+  const page = await pageFor('signed-live-saved');
+  try {
+    await page.waitForFunction(() => typeof window.appendText === 'function');
+    assert.equal(await page.locator('img').count(), 0);
+    await page.evaluate(() => window.appendText('secret)'));
+    await loaded(page);
+    assert.equal(await page.evaluate(() => window.deliverySource), `${imageUrl}/image.png?token=live-secret`);
+    await page.evaluate(() => window.finishStream());
+    await loaded(page);
+    assert.deepEqual(requests, []);
+    assert.doesNotMatch(await page.locator('body').innerText(), /live-secret/);
+  } finally { await page.close(); }
+});
+
 test('failed remote image has a working retry control instead of a broken image icon', async () => {
   failedOnce = false;
   const page = await pageFor('retry');
@@ -316,7 +372,7 @@ test('a new remote image previews during archival and switches to saved bytes af
   } finally { await page.close(); }
 });
 
-for (const scenario of ['streaming-race', 'settled-race', 'streaming-angle-race']) {
+for (const scenario of ['streaming-race', 'settled-race', 'streaming-angle-race', 'signed-streaming-race']) {
   test(`${scenario}: an unavailable live source recovers in place once Host archival completes`, async () => {
     const page = await pageFor(scenario);
     try {
@@ -326,7 +382,7 @@ for (const scenario of ['streaming-race', 'settled-race', 'streaming-angle-race'
         await page.waitForFunction(() => window.deliveryQueries >= 2);
       }
       await page.evaluate(() => { window.deliveryReady = true; });
-      await loaded(page);
+      await page.waitForFunction(() => [...document.images].some(image => image.src.startsWith('data:') && image.naturalWidth === 1));
       assert.equal(await page.evaluate(() => window.imageReads), 1);
       assert.match(await page.locator('img').getAttribute('src'), /^data:image\/png;base64,/);
       assert.equal(await page.locator('img').count(), 1);
@@ -334,7 +390,7 @@ for (const scenario of ['streaming-race', 'settled-race', 'streaming-angle-race'
   });
 }
 
-for (const scenario of ['angle-saved', 'title-saved', 'escaped-saved', 'reference-saved', 'attachment-title']) {
+for (const scenario of ['angle-saved', 'title-saved', 'escaped-saved', 'reference-saved', 'attachment-title', 'signed-saved', 'signature-saved', 'hash-saved', 'secret-reference-saved']) {
   test(`${scenario}: standard Markdown destinations resolve to saved bytes without origin requests`, async () => {
     requests = [];
     const page = await pageFor(scenario);
@@ -491,6 +547,7 @@ for (const [scenario, width, height] of [
     }));
     try {
       await page.goto(`${appUrl}/?case=${scenario}`, { waitUntil: 'domcontentloaded' });
+      await page.waitForFunction(() => document.querySelectorAll('.maka-markdown-image-resource').length === 2);
       await page.getByText('Following paragraph stays in place.').waitFor();
       const before = await measure();
       const followingBefore = await page.getByText('Following paragraph stays in place.').boundingBox();
diff --git a/packages/ui/src/__tests__/markdown-body.test.ts b/packages/ui/src/__tests__/markdown-body.test.ts
index edd696513a3..abb4a21afc5 100644
--- a/packages/ui/src/__tests__/markdown-body.test.ts
+++ b/packages/ui/src/__tests__/markdown-body.test.ts
@@ -380,6 +380,17 @@ it('redacts secrets before even the lazy Markdown fallback reaches the rendered
   assert.match(markup, /&lt;redacted&gt;/);
 });
 
+it('keeps signed image destinations out of the lazy fallback and rendered prose', () => {
+  const text = '![Screenshot](https://example.com/image.png?token=image-secret)\n\nAuthorization: Bearer prose-secret';
+  for (const markup of [
+    renderToStaticMarkup(createElement(Markdown, { text })),
+    renderToStaticMarkup(createElement(MarkdownBody, { text, redact: true })),
+  ]) {
+    assert.doesNotMatch(markup, /image-secret|prose-secret/);
+    assert.match(markup, /&lt;redacted&gt;/);
+  }
+});
+
 
 
 it('preserves allowlisted Maka navigation links through sanitization', () => {
diff --git a/packages/ui/src/__tests__/markdown-image-redaction.test.ts b/packages/ui/src/__tests__/markdown-image-redaction.test.ts
new file mode 100644
index 00000000000..74b10f9d78f
--- /dev/null
+++ b/packages/ui/src/__tests__/markdown-image-redaction.test.ts
@@ -0,0 +1,114 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { markdownImageSources } from '@maka/core/image-markdown';
+import { IMAGE_MARKDOWN_MAX_LENGTH } from '@maka/core/image-delivery';
+import { redactMarkdownImages } from '../markdown-image-redaction.js';
+import { redactSecrets } from '../redact.js';
+
+const signed = 'https://example.com/image.png?token=private-value';
+function resolved(text: string) {
+  const result = redactMarkdownImages(text);
+  return { ...result, destinations: markdownImageSources(result.text).map(source => result.sources.get(source) ?? source) };
+}
+
+test('signed URLs and hashed paths retain their exact Host identities without exposing them as text', () => {
+  for (const source of [signed, signed + '&expires=123', signed.replace('token=', 'signature='), `/tmp/${'a'.repeat(48)}.png`]) {
+    const result = resolved(`![Screenshot](${source})`);
+    assert.deepEqual(result.destinations, [source]);
+    assert.ok(!result.text.includes(source));
+  }
+});
+
+test('destinations which redact to the same text retain separate identities', () => {
+  const other = signed.replace('private-value', 'another-value');
+  const result = resolved(`![one](${signed}) ![two](${other}) ![one again](${signed})`);
+  assert.deepEqual(result.destinations, [signed, other]);
+  assert.equal(result.sources.size, 2);
+});
+
+test('reference images retain original identity while shared ordinary links stay redacted', () => {
+  const result = resolved(`![Screenshot][pic]\n\n[ordinary link][pic]\n\n[pic]: ${signed}`);
+  assert.deepEqual(result.destinations, [signed]);
+  assert.ok(!result.text.includes('private-value'));
+  assert.ok(result.text.includes('[ordinary link][pic]'));
+  assert.ok(result.text.includes(redactSecrets(`[pic]: ${signed}`)));
+});
+
+test('code, HTML, prose and ordinary links remain identical to normal display redaction', () => {
+  const example = `![Screenshot](${signed})`;
+  const nonImages = [
+    '`' + example + '`',
+    '```md\n' + example + '\n```',
+    '<pre>\n' + example + '\n</pre>',
+    `<img src="${signed}">`,
+    `[ordinary](${signed})`,
+    `Prose ${signed}`,
+  ];
+  for (const text of nonImages) {
+    const result = redactMarkdownImages(text);
+    assert.equal(result.text, redactSecrets(text));
+    assert.equal(result.sources.size, 0);
+    const together = redactMarkdownImages(text + '\n\n' + example);
+    assert.ok(together.text.startsWith(redactSecrets(text) + '\n\n'));
+    assert.equal(together.sources.size, 1);
+  }
+});
+
+test('nested Markdown, escaped paths, entities, angle destinations and CRLF keep canonical identities', () => {
+  for (const text of [
+    `> ![Screenshot](${signed})`,
+    `- **![Screenshot](${signed})**`,
+    `| Image |\n| --- |\n| ![Screenshot](${signed}) |`,
+    `[![Screenshot](${signed})](https://example.com)`,
+    `![Screenshot](<${signed}> "title")`,
+    `![Screenshot](https://example.com/i?token=a&amp;expires=123)`,
+    String.raw`![Screenshot](/tmp/a\(1\)-${'a'.repeat(48)}.png)`,
+    `Before\r\n\r\n![Screenshot](${signed})\r\n`,
+  ]) {
+    assert.deepEqual(resolved(text).destinations, markdownImageSources(text), text);
+  }
+});
+
+test('image labels, titles and surrounding secrets are still redacted', () => {
+  const result = resolved(`Authorization: Bearer prose-secret\n\n![sk-1234567890abcdef](${signed} "token=title")`);
+  assert.deepEqual(result.destinations, [signed]);
+  assert.ok(!result.text.includes('prose-secret'));
+  assert.ok(!result.text.includes('sk-1234567890abcdef'));
+  assert.ok(!result.text.includes('private-value'));
+});
+
+test('settled and live sources share aliases without accepting source-authored aliases', () => {
+  const settled = `![Screenshot](${signed})`;
+  const authored = '![fake](maka-image-display:0)';
+  const result = redactMarkdownImages(`${settled}\n\n${authored}`, settled);
+  assert.equal(result.sources.has('maka-image-display:0'), false);
+  assert.equal(markdownImageSources(result.text)[0], markdownImageSources(result.settledText!)[0]);
+  assert.ok(!result.text.includes('private-value'));
+});
+
+test('plain messages and oversized or incomplete images retain existing redaction', () => {
+  for (const text of ['Plain **text**', `![x](${signed}`, 'x'.repeat(IMAGE_MARKDOWN_MAX_LENGTH) + `![x](${signed})`]) {
+    const result = redactMarkdownImages(text);
+    assert.equal(result.text, redactSecrets(text));
+    assert.equal(result.sources.size, 0);
+  }
+});
diff --git a/packages/ui/src/markdown-body.tsx b/packages/ui/src/markdown-body.tsx
index eb1b24a5ef6..f9ecab9d3f6 100644
--- a/packages/ui/src/markdown-body.tsx
+++ b/packages/ui/src/markdown-body.tsx
@@ -31,7 +31,8 @@
 
 import { MarkdownImage, MarkdownImageSourceProvider, MARKDOWN_IMAGE_PLUGINS } from './markdown-image.js';
 import { ImageMessageScope } from './image-delivery.js';
-import { useCallback, useContext, useRef, type ReactNode } from 'react';
+import { useCallback, useContext, useMemo, useRef, type ReactNode } from 'react';
+import { redactMarkdownImages } from './markdown-image-redaction.js';
 import {
   Markdown as AstryxMarkdown,
   type MarkdownComponents,
@@ -144,6 +145,8 @@ const MARKDOWN_COMPONENTS = {
 
 export function MarkdownBody(props: {
   text: string;
+  /** The lazy entry redacts its fallback; the body also preserves image identities. */
+  redact?: boolean;
   imageIdentity?: { turnId: string; messageId: string };
   streaming?: boolean;
   settledText?: string;
@@ -154,7 +157,11 @@ export function MarkdownBody(props: {
     (source: string) => prepareMarkdownMath(source, mathCache.current),
     [],
   );
-  const budgetedText = props.streaming ? props.text : applyMermaidRenderBudget(props.text);
+  const presentation = useMemo(() => props.redact
+    ? redactMarkdownImages(props.text, props.settledText)
+    : { text: props.text, settledText: props.settledText, sources: undefined },
+  [props.redact, props.text, props.settledText]);
+  const budgetedText = props.streaming ? presentation.text : applyMermaidRenderBudget(presentation.text);
   const density = props.density ?? 'default';
   const components = props.streaming
     ? density === 'compact'
@@ -163,7 +170,7 @@ export function MarkdownBody(props: {
     : MARKDOWN_COMPONENTS[density];
 
   return (
-    <MarkdownImageSourceProvider text={budgetedText}>
+    <MarkdownImageSourceProvider text={budgetedText} sources={presentation.sources}>
       <ImageMessageScope.Provider value={props.imageIdentity ? { ...props.imageIdentity, streaming: props.streaming } : undefined}>
         <div
           data-maka-contract="markdown"
@@ -200,7 +207,7 @@ export function MarkdownBody(props: {
             components={components}
             plugins={MARKDOWN_IMAGE_PLUGINS}
             isStreaming={props.streaming}
-            settledText={props.settledText}
+            settledText={presentation.settledText}
             transformSource={transformMathSource}
           >
             {budgetedText}
diff --git a/packages/ui/src/markdown-image-redaction.ts b/packages/ui/src/markdown-image-redaction.ts
new file mode 100644
index 00000000000..efaebe2b3a1
--- /dev/null
+++ b/packages/ui/src/markdown-image-redaction.ts
@@ -0,0 +1,83 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { fromMarkdown } from 'mdast-util-from-markdown';
+import { markdownImages } from '@maka/core/image-markdown';
+import { redactSecrets } from './redact.js';
+
+interface PositionedNode {
+  type: string;
+  position?: { start: { offset?: number }; end: { offset?: number } };
+  children?: readonly PositionedNode[];
+  url?: string;
+  alt?: string | null;
+}
+
+/** Hide destinations behind opaque image-only aliases before redacting prose.
+ * Source positions keep identical examples in code, links and HTML untouched.
+ * Marked remains the authority for the destinations sent to the Host; mdast
+ * supplies only source ranges, which Marked does not expose.
+ */
+export function redactMarkdownImages(text: string, settledText?: string) {
+  let prefix = 'maka-image-display:';
+  while (text.includes(prefix) || settledText?.includes(prefix)) prefix += 'x';
+  const sources = new Map<string, string>();
+  const aliases = new Map<string, string>();
+  const prepare = (original: string): string => {
+    const redacted = redactSecrets(original);
+    if (redacted === original) return redacted;
+    const images = markdownImages(original).filter(image =>
+      redactSecrets(image.source) !== image.source || redactSecrets(image.raw) !== image.raw);
+    if (!images.length) return redacted;
+    const destinations = new Map(images.map(image => [image.raw, image.source]));
+    const canonical = new Set(images.map(image => image.source));
+    const replacements: { start: number; end: number; value: string }[] = [];
+    const visit = (node: PositionedNode) => {
+      if (node.type === 'image' || node.type === 'imageReference') {
+        const start = node.position?.start.offset;
+        const end = node.position?.end.offset;
+        if (start === undefined || end === undefined) return;
+        const raw = original.slice(start, end);
+        const source = destinations.get(raw) ?? (node.url && canonical.has(node.url) ? node.url : undefined);
+        if (!source || (redactSecrets(source) === source && redactSecrets(raw) === raw)) return;
+        let alias = aliases.get(source);
+        if (!alias) {
+          alias = `${prefix}${aliases.size}`;
+          aliases.set(source, alias);
+          sources.set(alias, source);
+        }
+        const alt = redactSecrets(node.alt ?? '').replace(/[\\[\]`*_<>|]/g, '\\$&');
+        replacements.push({ start, end, value: `![${alt}](${alias})` });
+        return;
+      }
+      node.children?.forEach(visit);
+    };
+    visit(fromMarkdown(original));
+    let protectedText = original;
+    for (const replacement of replacements.sort((a, b) => b.start - a.start)) {
+      protectedText = protectedText.slice(0, replacement.start) + replacement.value + protectedText.slice(replacement.end);
+    }
+    return redactSecrets(protectedText);
+  };
+  return {
+    text: prepare(text),
+    settledText: settledText === undefined ? undefined : prepare(settledText),
+    sources,
+  };
+}
diff --git a/packages/ui/src/markdown-image.tsx b/packages/ui/src/markdown-image.tsx
index bd44cfbb513..fa3811ba379 100644
--- a/packages/ui/src/markdown-image.tsx
+++ b/packages/ui/src/markdown-image.tsx
@@ -66,8 +66,14 @@ function isSingleImage(nodes: readonly MarkdownAstNode[]): boolean {
   return node.type === 'image' || (['link', 'strong', 'emphasis', 'delete'].includes(node.type)
     && 'children' in node && isSingleImage(node.children));
 }
-export function MarkdownImageSourceProvider(props: { text: string; children: ReactNode }) {
-  const resolve = useMemo(() => createMarkdownImageSourceResolver(props.text), [props.text]);
+export function MarkdownImageSourceProvider(props: { text: string; sources?: ReadonlyMap<string, string>; children: ReactNode }) {
+  const resolve = useMemo(() => {
+    const canonical = createMarkdownImageSourceResolver(props.text);
+    return (source: string) => {
+      const resolved = canonical(source);
+      return props.sources?.get(resolved) ?? resolved;
+    };
+  }, [props.text, props.sources]);
   return <ImageSourceContext.Provider value={resolve}>{props.children}</ImageSourceContext.Provider>;
 }
 
diff --git a/packages/ui/src/markdown.tsx b/packages/ui/src/markdown.tsx
index 3cb73d1f1eb..57ef8fb3dea 100644
--- a/packages/ui/src/markdown.tsx
+++ b/packages/ui/src/markdown.tsx
@@ -33,8 +33,10 @@
  * lazy split, that code is parsed on demand the first time a message appears,
  * and cached for every subsequent render.
  *
- * Secret redaction happens eagerly in this wrapper so the Suspense fallback
- * is safe. The remaining trust-boundary contract (URI allowlist, safe-scheme
+ * Secret redaction happens eagerly here for the Suspense fallback. The lazy
+ * body redacts prose after protecting original image destinations behind opaque
+ * aliases, so signed image URLs remain usable without becoming visible text.
+ * The remaining trust-boundary contract (URI allowlist, safe-scheme
  * external gate, broken-link inline errors) lives in `markdown-body.tsx`;
  * see that file for the routing rationale.
  *
@@ -62,9 +64,6 @@ export function Markdown(props: {
   density?: 'default' | 'compact';
 }) {
   const safeText = redactSecrets(props.text);
-  const safeSettledText = props.settledText === undefined
-    ? undefined
-    : redactSecrets(props.settledText);
   const streaming = isProgressiveStreamingEnabled(props.streaming);
   return (
     <Suspense
@@ -78,10 +77,11 @@ export function Markdown(props: {
       )}
     >
       <MarkdownBody
-        text={safeText}
+        text={props.text}
+        redact
         imageIdentity={props.imageIdentity}
         streaming={streaming}
-        settledText={safeSettledText}
+        settledText={props.settledText}
         density={props.density}
       />
     </Suspense>

From 08545a3254f5bcb16df2d9dddb87d6ed5bd98e07 Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Wed, 7 Oct 2026 13:13:05 +0800
Subject: [PATCH 15/37] test(ui): cover signed image resolution in the CI suite

Exercise the lazy Markdown entry with signed URLs, distinct tokens and hashed local paths through the saved attachment ports.

Generated-by: Codex (GPT-6)
---
 .../src/__tests__/attachment-image.test.tsx   | 35 +++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/packages/ui/src/__tests__/attachment-image.test.tsx b/packages/ui/src/__tests__/attachment-image.test.tsx
index 1203e69db4b..ad59683d76c 100644
--- a/packages/ui/src/__tests__/attachment-image.test.tsx
+++ b/packages/ui/src/__tests__/attachment-image.test.tsx
@@ -29,6 +29,8 @@ import {
 } from '../attachment-image.js';
 import { LocaleProvider } from '../locale-context.js';
 import { MarkdownBody } from '../markdown-body.js';
+import { Markdown } from '../markdown.js';
+import { ImageDeliveryProvider } from '../image-delivery.js';
 import type { TurnViewModel } from '../materialize.js';
 
 const originalGlobals = {
@@ -82,6 +84,39 @@ async function renderAttachmentMarkdown(text: string, readBytes: ReadAttachmentB
   return { container, root };
 }
 
+test('the complete Markdown entry resolves original signed and hashed destinations after redacting display text', async () => {
+  const sources = [
+    'https://example.com/image.png?token=first-secret',
+    'https://example.com/image.png?token=second-secret',
+    `/tmp/${'a'.repeat(48)}.png`,
+  ];
+  const { container, root } = domRoot();
+  const requested: string[] = [];
+  await act(async () => {
+    root.render(
+      <LocaleProvider locale="en">
+        <SessionAttachmentProvider sessionId="session-1" readBytes={async () => ({ ok: true, base64: 'aW1n', mimeType: 'image/png' })}>
+          <ImageDeliveryProvider sessionId="session-1" resolve={async (sessionId, request) => {
+            assert.equal(sessionId, 'session-1');
+            assert.equal(request.turnId, 'turn-1');
+            assert.equal(request.messageId, 'message-1');
+            requested.push(request.source);
+            assert.ok(sources.includes(request.source));
+            return { status: 'ready', artifactId: `saved-${sources.indexOf(request.source)}` };
+          }}>
+            <Markdown text={sources.map(source => `![Screenshot](${source})`).join('\n\n') + '\n\nAuthorization: Bearer prose-secret'} imageIdentity={{ turnId: 'turn-1', messageId: 'message-1' }} />
+          </ImageDeliveryProvider>
+        </SessionAttachmentProvider>
+      </LocaleProvider>,
+    );
+  });
+  await act(async () => { await import('../markdown-body.js'); });
+  assert.deepEqual(requested, sources);
+  assert.equal(container.querySelectorAll('img').length, sources.length);
+  for (const image of container.querySelectorAll('img')) assert.equal(image.getAttribute('src'), 'data:image/png;base64,aW1n');
+  assert.doesNotMatch(container.textContent ?? '', /first-secret|second-secret|prose-secret|a{48}/);
+});
+
 const TURN_WITH_IMAGE: TurnViewModel = {
   turnId: 'turn-1',
   status: 'completed',

From 62996dfe93f14dbf3eb2a0609705f5c8152a3195 Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Wed, 7 Oct 2026 13:50:51 +0800
Subject: [PATCH 16/37] fix(images): require remote consent and preserve saved
 archives

Harden image loading permissions, source validation, renderer isolation, and retry behavior. Add regression coverage and update the protocol contract and browser CI.

Generated-by: Codex (GPT-6)
---
 .github/workflows/ci.yml                      |   6 +-
 .../check-renderer-architecture.test.mjs      |   2 +-
 .../scripts/vite-renderer-entry-contract.ts   |   2 +-
 .../runtime-host-artifacts-ipc-main.test.ts   |  22 ++
 .../runtime-host-client-operations.test.ts    |  12 +
 .../main/runtime-host-artifacts-ipc-main.ts   |   6 +-
 apps/desktop/src/main/runtime-host-client.ts  |   2 +-
 apps/desktop/src/renderer/index.html          |   2 +-
 package-lock.json                             |   2 +-
 packages/core/package.json                    |   2 +-
 packages/core/src/__tests__/artifacts.test.ts |  23 ++
 packages/core/src/artifacts.ts                |   6 +-
 packages/core/src/image-delivery.ts           |  25 ++
 .../chat-image-contract-share.json            |   5 -
 .../src/__tests__/chat-image-delivery.test.ts | 270 ++++++++++++++----
 .../__tests__/execution-composition.test.ts   |  85 ++++++
 .../src/__tests__/protocol.test.ts            |   3 +
 .../src/protocol/image-delivery.ts            |  12 +-
 packages/runtime-host/src/protocol/index.ts   |   4 +-
 .../src/server/chat-image-delivery.ts         | 129 ++++-----
 .../src/server/chat-image-source.ts           |   9 +-
 .../src/server/execution-composition.ts       |  25 +-
 .../runtime/src/__tests__/image-file.test.ts  |  12 +
 packages/runtime/src/image-file.ts            |  11 +-
 .../src/system-prompt/main-session-prompt.ts  |   4 +-
 .../scripts/markdown-images.browser.test.mjs  | 112 ++++++--
 .../ui/src/__tests__/markdown-body.test.ts    |   8 +-
 packages/ui/src/image-delivery.tsx            |  12 +-
 packages/ui/src/markdown-image.tsx            |  17 +-
 packages/ui/src/shared-ui-copy.ts             |  47 ++-
 packages/ui/stories/attachment.stories.tsx    |  31 ++
 31 files changed, 705 insertions(+), 203 deletions(-)
 delete mode 100644 packages/runtime-host/protocol-compatible-changes/chat-image-contract-share.json

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 38f50174318..850760db73d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -450,9 +450,13 @@ jobs:
       # The smoke only launches headless; the full Chrome build was downloaded
       # and never opened. The headed consumer (perf/storybook.mjs) self-installs.
       - name: Install Playwright Chromium
-        if: steps.plan.outputs.storybook == 'true'
+        if: steps.plan.outputs.storybook == 'true' || contains(steps.plan.outputs.standard_workspaces, 'packages/ui')
         run: npx playwright install --with-deps --only-shell chromium
 
+      - name: Markdown image security and layout
+        if: steps.plan.outputs.storybook == 'true' || contains(steps.plan.outputs.standard_workspaces, 'packages/ui')
+        run: node --test packages/ui/scripts/markdown-images.browser.test.mjs
+
       - name: Build Storybook
         if: steps.plan.outputs.storybook == 'true'
         run: npm --workspace @maka/desktop run build-storybook
diff --git a/apps/desktop/scripts/check-renderer-architecture.test.mjs b/apps/desktop/scripts/check-renderer-architecture.test.mjs
index c671c863e7d..254ec76bad7 100644
--- a/apps/desktop/scripts/check-renderer-architecture.test.mjs
+++ b/apps/desktop/scripts/check-renderer-architecture.test.mjs
@@ -317,7 +317,7 @@ function canonicalRendererEntryHtml(
         <meta name="referrer" content="no-referrer" />
         <meta
           http-equiv="Content-Security-Policy"
-          content="default-src 'self'; ${policy}; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; connect-src 'self'"
+          content="default-src 'self'; ${policy}; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; connect-src 'self'"
         />
         <title>Maka</title>
         <style>body { margin: 0; }</style>
diff --git a/apps/desktop/scripts/vite-renderer-entry-contract.ts b/apps/desktop/scripts/vite-renderer-entry-contract.ts
index 4e9ed2c98af..0a1403043ab 100644
--- a/apps/desktop/scripts/vite-renderer-entry-contract.ts
+++ b/apps/desktop/scripts/vite-renderer-entry-contract.ts
@@ -40,7 +40,7 @@ const ALLOWED_HTML_TAGS = new Set([
   'title',
 ]);
 const CONTENT_SECURITY_POLICY =
-  "default-src 'self'; script-src 'self' maka-client-plugin:; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; connect-src 'self'";
+  "default-src 'self'; script-src 'self' maka-client-plugin:; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; connect-src 'self'";
 
 function normalizePath(path: string): string {
   return path.split(sep).join('/');
diff --git a/apps/desktop/src/main/__tests__/runtime-host-artifacts-ipc-main.test.ts b/apps/desktop/src/main/__tests__/runtime-host-artifacts-ipc-main.test.ts
index 420765c7e0d..5d7619bb042 100644
--- a/apps/desktop/src/main/__tests__/runtime-host-artifacts-ipc-main.test.ts
+++ b/apps/desktop/src/main/__tests__/runtime-host-artifacts-ipc-main.test.ts
@@ -26,6 +26,28 @@ import { test } from "node:test";
 import { registerRuntimeHostArtifactsIpc } from "../runtime-host-artifacts-ipc-main.js";
 import { ManagedArtifactPreview } from '../managed-artifact-preview.js';
 
+test('image resolution validates renderer requests before forwarding them', async () => {
+  const handlers = new Map<string, Handler>();
+  const forwarded: unknown[] = [];
+  registerRuntimeHostArtifactsIpc({
+    uiLocale: () => 'en',
+    ipcMain: { handle: (channel, handler) => handlers.set(channel, handler as Handler) },
+    client: { hostEpoch: 'host', resolveImageDelivery: async (...args: unknown[]) => {
+      forwarded.push(args); return { status: 'requires_confirmation' };
+    } } as never,
+    mainWindowController: {} as never,
+    showItemInFolder() {},
+  });
+  const resolve = handlers.get('attachments:resolveImage')!;
+  const request = { turnId: 'turn', messageId: 'message', source: 'https://example.invalid/image.png', loadRemote: true };
+  await resolve({}, 'session', request);
+  assert.deepEqual(forwarded, [['session', request]]);
+  for (const invalid of [null, { ...request, sessionId: 'other' }, { ...request, loadRemote: 'yes' }, { ...request, source: 'bad\nurl' }]) {
+    await assert.rejects(async () => resolve({}, 'session', invalid), /Invalid image delivery request/);
+  }
+  assert.equal(forwarded.length, 1);
+});
+
 for (const launchFails of [false, true]) {
   test(`HTML external open uses the managed endpoint and reports launch failure=${launchFails}`, async () => {
     const service = new ManagedArtifactPreview();
diff --git a/apps/desktop/src/main/__tests__/runtime-host-client-operations.test.ts b/apps/desktop/src/main/__tests__/runtime-host-client-operations.test.ts
index d852e9f8d1f..c577a7cfd36 100644
--- a/apps/desktop/src/main/__tests__/runtime-host-client-operations.test.ts
+++ b/apps/desktop/src/main/__tests__/runtime-host-client-operations.test.ts
@@ -34,6 +34,18 @@ import {
   DesktopRuntimeHostClientError,
 } from '../runtime-host-client.js';
 
+test('image resolution keeps the routed session even if a request carries another id', async () => {
+  const { client, requests } = clientWithResponses([{ status: 'requires_confirmation' }]);
+  await client.resolveImageDelivery('routed-session', {
+    sessionId: 'injected-session', turnId: 'turn', messageId: 'message',
+    source: 'https://example.invalid/image.png', loadRemote: true,
+  } as import('@maka/core/image-delivery').ImageDeliveryRequest);
+  assert.deepEqual(requests, [{ operation: 'artifact.image.resolve', input: {
+    sessionId: 'routed-session', turnId: 'turn', messageId: 'message',
+    source: 'https://example.invalid/image.png', loadRemote: true,
+  } }]);
+});
+
 test('restarts a paginated catalog read instead of mixing revisions', async () => {
   const revisionOne = catalogRevision('1');
   const revisionTwo = catalogRevision('2');
diff --git a/apps/desktop/src/main/runtime-host-artifacts-ipc-main.ts b/apps/desktop/src/main/runtime-host-artifacts-ipc-main.ts
index fa86e155c57..28542053838 100644
--- a/apps/desktop/src/main/runtime-host-artifacts-ipc-main.ts
+++ b/apps/desktop/src/main/runtime-host-artifacts-ipc-main.ts
@@ -18,6 +18,7 @@
  */
 
 import type { UiCatalog, UiLocale } from '@maka/core/ui-locale';
+import { isImageDeliveryRequest } from '@maka/core/image-delivery';
 import { randomUUID } from "node:crypto";
 import { open, mkdir, rename, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
@@ -87,7 +88,10 @@ export function registerRuntimeHostArtifactsIpc(
       return result;
     },
   );
-  deps.ipcMain.handle('attachments:resolveImage', (_event, sessionId: string, request: import('@maka/core/image-delivery').ImageDeliveryRequest) => deps.client.resolveImageDelivery(sessionId, request));
+  deps.ipcMain.handle('attachments:resolveImage', (_event, sessionId: string, request: unknown) => {
+    if (!isImageDeliveryRequest(request)) throw new Error('Invalid image delivery request');
+    return deps.client.resolveImageDelivery(sessionId, request);
+  });
   registerRuntimeHostAttachmentPreviewIpc(deps);
   const materializePresentationArtifact = async (
     sessionId: string,
diff --git a/apps/desktop/src/main/runtime-host-client.ts b/apps/desktop/src/main/runtime-host-client.ts
index d408fa08224..be4c826c3a1 100644
--- a/apps/desktop/src/main/runtime-host-client.ts
+++ b/apps/desktop/src/main/runtime-host-client.ts
@@ -862,7 +862,7 @@ export class DesktopRuntimeHostClient {
   }
 
   resolveImageDelivery(sessionId: string, request: import('@maka/core/image-delivery').ImageDeliveryRequest): Promise<import('@maka/core/image-delivery').ImageDeliveryResult> {
-    return this.request('artifact.image.resolve', { sessionId, ...request });
+    return this.request('artifact.image.resolve', { ...request, sessionId });
   }
 
   async listArtifacts(sessionId: string): Promise<ArtifactProjection[]> {
diff --git a/apps/desktop/src/renderer/index.html b/apps/desktop/src/renderer/index.html
index aa66e09e36c..ad98a582beb 100644
--- a/apps/desktop/src/renderer/index.html
+++ b/apps/desktop/src/renderer/index.html
@@ -25,7 +25,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <meta
       http-equiv="Content-Security-Policy"
-      content="default-src 'self'; script-src 'self' maka-client-plugin:; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; connect-src 'self'"
+      content="default-src 'self'; script-src 'self' maka-client-plugin:; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; connect-src 'self'"
     />
     <title>Maka</title>
     <style>
diff --git a/package-lock.json b/package-lock.json
index 0d002cbc260..6549b9357a2 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -17727,7 +17727,7 @@
       "license": "Apache-2.0",
       "dependencies": {
         "intl-messageformat": "11.2.15",
-        "marked": "^18.0.11"
+        "marked": "18.0.11"
       }
     },
     "packages/core/node_modules/@formatjs/icu-messageformat-parser": {
diff --git a/packages/core/package.json b/packages/core/package.json
index 4ea43dd7051..61739d9608a 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -180,6 +180,6 @@
   },
   "dependencies": {
     "intl-messageformat": "11.2.15",
-    "marked": "^18.0.11"
+    "marked": "18.0.11"
   }
 }
diff --git a/packages/core/src/__tests__/artifacts.test.ts b/packages/core/src/__tests__/artifacts.test.ts
index 66fd52cb004..b2489ad63a2 100644
--- a/packages/core/src/__tests__/artifacts.test.ts
+++ b/packages/core/src/__tests__/artifacts.test.ts
@@ -59,6 +59,29 @@ describe('Artifact turn key', () => {
 });
 
 describe('Artifact source policy', () => {
+  test('image delivery placeholders are not child-result outputs', () => {
+    for (const status of ['pending', 'failed'] as const) {
+      assert.equal(
+        isArtifactChildResultOutput({
+          source: 'tool_result_projection',
+          imageDelivery: { messageId: 'message', source: '/tmp/image.png', status },
+        }),
+        false,
+      );
+    }
+    assert.equal(
+      isArtifactChildResultOutput({
+        source: 'tool_result_projection',
+        imageDelivery: {
+          messageId: 'message',
+          source: '/tmp/image.png',
+          status: 'ready',
+          contentSha256: 'a'.repeat(64),
+        },
+      }),
+      true,
+    );
+  });
   test('keeps workflow-owned evidence out of independent user deletion', () => {
     for (const source of ARTIFACT_SOURCES) {
       assert.equal(
diff --git a/packages/core/src/artifacts.ts b/packages/core/src/artifacts.ts
index 1cd87adc5c0..6a0e99e1021 100644
--- a/packages/core/src/artifacts.ts
+++ b/packages/core/src/artifacts.ts
@@ -186,7 +186,11 @@ export function isArtifactSharedSessionReadable(record: Pick<ArtifactRecord, 'so
   return ARTIFACT_SOURCE_POLICIES[record.source].sharedReadable;
 }
 
-export function isArtifactChildResultOutput(record: Pick<ArtifactRecord, 'source'>): boolean {
+export function isArtifactChildResultOutput(
+  record: Pick<ArtifactRecord, 'source'> & Partial<Pick<ArtifactRecord, 'imageDelivery'>>,
+): boolean {
+  if (record.imageDelivery?.status === 'pending' || record.imageDelivery?.status === 'failed')
+    return false;
   return CHILD_RESULT_OUTPUT_SOURCES.has(record.source);
 }
 
diff --git a/packages/core/src/image-delivery.ts b/packages/core/src/image-delivery.ts
index f320d6a9d8e..d1193b9c3fa 100644
--- a/packages/core/src/image-delivery.ts
+++ b/packages/core/src/image-delivery.ts
@@ -30,6 +30,28 @@ export function isImageDeliverySource(value: unknown): value is string {
     !/[\x00-\x1f\x7f]/.test(value)
   );
 }
+export function isRemoteImageSource(source: string): boolean {
+  return /^https?:/i.test(source);
+}
+export function isImageDeliveryRequest(value: unknown): value is ImageDeliveryRequest {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
+  const v = value as Record<string, unknown>;
+  const identity = (s: unknown) =>
+    typeof s === 'string' &&
+    s.length > 0 &&
+    s.length <= IMAGE_DELIVERY_IDENTITY_MAX_LENGTH &&
+    !/[\x00-\x1f\x7f]/.test(s);
+  return (
+    Object.keys(v).every((k) =>
+      ['turnId', 'messageId', 'source', 'retry', 'loadRemote'].includes(k),
+    ) &&
+    identity(v.turnId) &&
+    identity(v.messageId) &&
+    isImageDeliverySource(v.source) &&
+    (v.retry === undefined || typeof v.retry === 'boolean') &&
+    (v.loadRemote === undefined || typeof v.loadRemote === 'boolean')
+  );
+}
 export const IMAGE_DELIVERY_FAILURES = [
   'not_found',
   'not_allowed',
@@ -46,8 +68,11 @@ export interface ImageDeliveryRequest {
   readonly messageId: string;
   readonly source: string;
   readonly retry?: boolean;
+  /** Explicit user action; the Host must also allow networking for this session. */
+  readonly loadRemote?: boolean;
 }
 export type ImageDeliveryResult =
+  | { readonly status: 'requires_confirmation' }
   | { readonly status: 'pending' }
   | { readonly status: 'ready'; readonly artifactId: string }
   | { readonly status: 'failed'; readonly reason: ImageDeliveryFailure }
diff --git a/packages/runtime-host/protocol-compatible-changes/chat-image-contract-share.json b/packages/runtime-host/protocol-compatible-changes/chat-image-contract-share.json
deleted file mode 100644
index 3a050d31b6c..00000000000
--- a/packages/runtime-host/protocol-compatible-changes/chat-image-contract-share.json
+++ /dev/null
@@ -1,5 +0,0 @@
-{
-  "epoch": 206,
-  "files": ["packages/runtime-host/src/protocol/image-delivery.ts"],
-  "reason": "Shares the existing 512-character identity bound and 4096-character non-empty, control-free source validation with the core image delivery contract. Accepted and rejected request values, validation order, frame keys, output decoding and protocol errors are unchanged."
-}
diff --git a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
index bff2fff7bb9..409b6039511 100644
--- a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
+++ b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
@@ -53,6 +53,7 @@ async function fixture(
   limits?: { sessionBytes: number; workspaceBytes: number },
   readLocalImage?: ChatImageDeliveryPorts['readLocalImage'],
   beforeCreate?: (input: Parameters<ChatImageDeliveryPorts['artifacts']['create']>[0]) => void,
+  download?: ChatImageDeliveryPorts['download'],
 ) {
   const root = await mkdtemp(join(tmpdir(), 'maka-image-delivery-'));
   const owner = await tryAcquireInteractiveRootOwner(
@@ -62,6 +63,9 @@ async function fixture(
   const store = await openInteractiveArtifactStoreForWrite(owner.lease);
   const authority = { store, close: () => store.close() };
   const errors: unknown[] = [];
+  const presentationErrors: unknown[] = [];
+  let remoteAllowed = true;
+  let loopbackOrigin: string | undefined;
   let reads = 0;
   let leases = 0;
   const messages = new Map<string, string>();
@@ -77,6 +81,10 @@ async function fixture(
     },
     admission: new SessionAdmissionGate(),
     limits,
+    sourceReadTimeoutMs: 1000,
+    canLoadRemote: async () => remoteAllowed,
+    download:
+      download ?? ((source, signal) => downloadChatImage(source, signal, { loopbackOrigin })),
     isPresent: async () => present,
     readMessage: async (i) => messages.get(i.messageId),
     readLocalImage: async (sessionId, path, signal) => {
@@ -93,6 +101,7 @@ async function fixture(
       };
     },
     persistenceFailed: (error) => errors.push(error),
+    presentationFailed: (error) => presentationErrors.push(error),
   });
   return {
     root,
@@ -101,6 +110,13 @@ async function fixture(
     service,
     messages,
     errors,
+    presentationErrors,
+    allowRemote(value: boolean) {
+      remoteAllowed = value;
+    },
+    trustRemoteOrigin(source: string) {
+      loopbackOrigin = new URL(source).origin;
+    },
     get reads() {
       return reads;
     },
@@ -425,8 +441,19 @@ test('remote delivery is downloaded once, remains replayable after the origin se
   await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
   const source = `http://127.0.0.1:${(server.address() as import('node:net').AddressInfo).port}/image.png`;
   try {
+    f.trustRemoteOrigin(source);
+    f.messages.set(REQUEST.messageId, `![Screenshot](${source})`);
     observe(f.service, source);
     await f.service.waitForIdle();
+    assert.equal(requests, 0);
+    assert.deepEqual(await f.service.resolve({ ...REQUEST, source }), {
+      status: 'requires_confirmation',
+    });
+    assert.equal(
+      (await f.service.resolve({ ...REQUEST, source, loadRemote: true })).status,
+      'pending',
+    );
+    await f.service.waitForIdle();
     assert.deepEqual(f.errors, []);
     assert.equal((await f.service.resolve({ ...REQUEST, source })).status, 'ready');
     assert.equal(requests, 1);
@@ -483,9 +510,11 @@ test('truncated HTTP images are rejected, and an explicit retry archives the rep
   });
   await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
   const source = `http://127.0.0.1:${(server.address() as import('node:net').AddressInfo).port}/image.png`;
-  const identity = { ...REQUEST, source };
+  const identity = { ...REQUEST, source, loadRemote: true };
   try {
-    observe(f.service, source);
+    f.trustRemoteOrigin(source);
+    f.messages.set(REQUEST.messageId, `![Screenshot](${source})`);
+    await f.service.resolve(identity);
     await f.service.waitForIdle();
     assert.deepEqual(await f.service.resolve(identity), {
       status: 'failed',
@@ -520,63 +549,37 @@ test('truncated HTTP images are rejected, and an explicit retry archives the rep
   }
 });
 
-test('explicit decode retries replace a legacy ready image and share concurrent capture', async () => {
+test('ready image retries retain the only saved copy after its source is deleted', async () => {
   const f = await fixture();
-  let requests = 0;
-  let release!: () => void;
-  const gate = new Promise<void>((resolve) => {
-    release = resolve;
-  });
-  const server = createServer((_req, res) => {
-    requests++;
-    void gate.then(() => {
-      res.setHeader('Content-Type', 'image/png');
-      res.end(PNG);
-    });
-  });
-  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
-  const source = `http://127.0.0.1:${(server.address() as import('node:net').AddressInfo).port}/image.png`;
-  const identity = { ...REQUEST, source };
+  const source = join(f.root, 'temporary.png');
   try {
-    const broken = PNG.subarray(0, 8);
-    await f.authority.store.create({
-      id: 'legacy-image',
-      sessionId: identity.sessionId,
-      turnId: identity.turnId,
-      kind: 'image',
-      name: 'chat-image',
-      source: 'tool_result_projection',
-      content: broken,
-      mimeType: 'image/png',
-      imageDelivery: {
-        messageId: identity.messageId,
-        source,
-        status: 'ready',
-        contentSha256: createHash('sha256').update(broken).digest('hex'),
-      },
-    });
-    assert.deepEqual(await f.service.resolve(identity), {
-      status: 'ready',
-      artifactId: 'legacy-image',
-    });
-    assert.equal(requests, 0);
+    await writeFile(source, PNG);
+    observe(f.service, source);
+    await f.service.waitForIdle();
+    const identity = { ...REQUEST, source };
+    const ready = await f.service.resolve(identity);
+    assert.equal(ready.status, 'ready');
+    await rm(source);
     const retries = await Promise.all([
       f.service.resolve({ ...identity, retry: true }),
       f.service.resolve({ ...identity, retry: true }),
     ]);
-    assert.deepEqual(retries, [{ status: 'pending' }, { status: 'pending' }]);
-    release();
-    await f.service.waitForIdle();
-    const ready = await f.service.resolve(identity);
-    assert.equal(ready.status, 'ready');
-    assert.equal(requests, 1);
-    const page = await f.authority.store.listPage(identity.sessionId, { offset: 0, limit: 10 });
-    assert.equal(page.total, 1);
-    assert.equal(page.records[0]?.sizeBytes, PNG.length);
+    assert.deepEqual(retries, [ready, ready]);
+    assert.equal(f.reads, 1);
+    assert.equal(
+      (await f.authority.store.listPage(REQUEST.sessionId, { offset: 0, limit: 10 })).total,
+      1,
+    );
+    if (ready.status === 'ready') {
+      const bytes = await f.authority.store.readBinaryInSession(
+        REQUEST.sessionId,
+        ready.artifactId,
+      );
+      assert.ok(bytes.ok);
+      if (bytes.ok) assert.equal(bytes.base64, PNG.toString('base64'));
+    }
     assert.deepEqual(f.errors, []);
   } finally {
-    release();
-    await new Promise<void>((resolve) => server.close(() => resolve()));
     await f.close();
   }
 });
@@ -757,7 +760,12 @@ test('source readers reject oversized payloads, unsafe MIME and redirects to pri
   await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
   try {
     const source = `http://127.0.0.1:${(server.address() as import('node:net').AddressInfo).port}/redirect`;
-    await assert.rejects(downloadChatImage(source, AbortSignal.timeout(2000)), /not_allowed/);
+    await assert.rejects(
+      downloadChatImage(source, AbortSignal.timeout(2000), {
+        loopbackOrigin: new URL(source).origin,
+      }),
+      /not_allowed/,
+    );
   } finally {
     await new Promise<void>((resolve) => server.close(() => resolve()));
   }
@@ -767,6 +775,164 @@ test('resolver codec rejects excess fields and noncanonical artifact identities'
   assert.deepEqual(spec.decodeInput(REQUEST), REQUEST);
   assert.throws(() => spec.decodeInput({ ...REQUEST, arbitraryRead: true }));
   assert.throws(() => spec.decodeOutput({ status: 'ready', artifactId: '../private' }));
+  assert.deepEqual(spec.decodeInput({ ...REQUEST, loadRemote: true }), {
+    ...REQUEST,
+    loadRemote: true,
+  });
+  assert.deepEqual(spec.decodeOutput({ status: 'requires_confirmation' }), {
+    status: 'requires_confirmation',
+  });
+  assert.throws(() => spec.decodeInput({ ...REQUEST, loadRemote: 'true' }));
+  assert.throws(() => spec.decodeOutput({ status: 'requires_confirmation', source: '/private' }));
+});
+
+test('remote capture requires a user action and current network authority, including on retry', async () => {
+  let downloads = 0;
+  const f = await fixture(undefined, undefined, undefined, async () => {
+    downloads++;
+    return checkedChatImage(PNG);
+  });
+  const source = 'https://example.invalid/image.png?data=secret';
+  const identity = { ...REQUEST, source };
+  f.messages.set(REQUEST.messageId, `![](${source})`);
+  try {
+    observe(f.service, source);
+    await f.service.waitForIdle();
+    assert.equal(downloads, 0);
+    assert.deepEqual(await f.service.resolve(identity), { status: 'requires_confirmation' });
+    f.allowRemote(false);
+    assert.deepEqual(await f.service.resolve({ ...identity, loadRemote: true }), {
+      status: 'failed',
+      reason: 'not_allowed',
+    });
+    assert.equal(downloads, 0);
+    assert.equal(
+      (await f.authority.store.listPage(REQUEST.sessionId, { offset: 0, limit: 10 })).total,
+      0,
+    );
+    f.allowRemote(true);
+    assert.deepEqual(await f.service.resolve({ ...identity, loadRemote: true }), {
+      status: 'pending',
+    });
+    await f.service.waitForIdle();
+    assert.equal(downloads, 1);
+    const ready = await f.service.resolve(identity);
+    assert.equal(ready.status, 'ready');
+    f.allowRemote(false);
+    assert.deepEqual(await f.service.resolve({ ...identity, retry: true }), ready);
+    assert.equal(downloads, 1, 'saved replay/retry never contacts origin');
+    assert.deepEqual(
+      await f.service.resolve({
+        ...identity,
+        source: 'https://example.invalid/forged',
+        loadRemote: true,
+      }),
+      { status: 'unavailable' },
+    );
+  } finally {
+    await f.close();
+  }
+});
+
+test('failed remote downloads issue one request and require explicit retry consent', async () => {
+  let downloads = 0;
+  const f = await fixture(undefined, undefined, undefined, async () => {
+    downloads++;
+    throw new Error('offline');
+  });
+  const source = 'https://example.invalid/image.png';
+  const identity = { ...REQUEST, source };
+  f.messages.set(REQUEST.messageId, `![](${source})`);
+  try {
+    await f.service.resolve({ ...identity, loadRemote: true });
+    await f.service.waitForIdle();
+    assert.equal(downloads, 1);
+    assert.deepEqual(await f.service.resolve({ ...identity, retry: true }), {
+      status: 'requires_confirmation',
+    });
+    assert.equal(downloads, 1);
+    await f.service.resolve({ ...identity, retry: true, loadRemote: true });
+    await f.service.waitForIdle();
+    assert.equal(downloads, 2);
+  } finally {
+    await f.close();
+  }
+});
+
+test('unsettled reference destinations never open half-written local paths', async () => {
+  const f = await fixture(undefined, async () => checkedChatImage(PNG));
+  try {
+    f.service.observe(REQUEST.sessionId, {
+      type: 'text_delta',
+      id: 'delta',
+      ts: 1,
+      turnId: REQUEST.turnId,
+      messageId: REQUEST.messageId,
+      text: '![image][ref]\n\n[ref]: /tmp/partial',
+    });
+    await new Promise((resolve) => setTimeout(resolve, 300));
+    assert.equal(f.reads, 0);
+    observe(f.service, '/tmp/partial-complete.png');
+    await f.service.waitForIdle();
+    assert.equal(f.reads, 1);
+  } finally {
+    await f.close();
+  }
+});
+
+test('a Markdown parser failure stays in presentation and subsequent images still capture', async () => {
+  const f = await fixture(undefined, async () => checkedChatImage(PNG));
+  try {
+    f.service.observe(REQUEST.sessionId, {
+      type: 'text_complete',
+      id: 'deep-text',
+      ts: 1,
+      turnId: REQUEST.turnId,
+      messageId: REQUEST.messageId,
+      text: '> '.repeat(5000) + '![](/tmp/image.png)',
+    });
+    assert.equal(f.presentationErrors.length, 1);
+    assert.ok(f.presentationErrors[0] instanceof RangeError);
+    assert.deepEqual(f.errors, []);
+    observe(f.service, REQUEST.source);
+    await f.service.waitForIdle();
+    assert.equal((await f.service.resolve(REQUEST)).status, 'ready');
+  } finally {
+    await f.close();
+  }
+});
+
+test('loopback is denied before GET and a served-origin grant cannot follow another local port', async () => {
+  let hits = 0;
+  const target = createServer((_req, res) => {
+    hits++;
+    res.end(PNG);
+  });
+  await new Promise<void>((resolve) => target.listen(0, '127.0.0.1', resolve));
+  const targetUrl = `http://127.0.0.1:${(target.address() as import('node:net').AddressInfo).port}/image.png`;
+  const origin = createServer((_req, res) => {
+    res.writeHead(302, { location: targetUrl });
+    res.end();
+  });
+  await new Promise<void>((resolve) => origin.listen(0, '127.0.0.1', resolve));
+  const source = `http://127.0.0.1:${(origin.address() as import('node:net').AddressInfo).port}/redirect`;
+  try {
+    for (const url of [targetUrl, 'http://[::1]:80/image.png'])
+      await assert.rejects(downloadChatImage(url, AbortSignal.timeout(1000)), /not_allowed/);
+    await assert.rejects(
+      downloadChatImage(source, AbortSignal.timeout(1000), {
+        loopbackOrigin: new URL(source).origin,
+      }),
+      /not_allowed/,
+    );
+    assert.equal(hits, 0);
+  } finally {
+    await Promise.all(
+      [target, origin].map(
+        (server) => new Promise<void>((resolve) => server.close(() => resolve())),
+      ),
+    );
+  }
 });
 
 test('completed turns release unfinished stream slots without archiving partial messages', async () => {
diff --git a/packages/runtime-host/src/__tests__/execution-composition.test.ts b/packages/runtime-host/src/__tests__/execution-composition.test.ts
index 2aa42f27fbf..ffd3615471b 100644
--- a/packages/runtime-host/src/__tests__/execution-composition.test.ts
+++ b/packages/runtime-host/src/__tests__/execution-composition.test.ts
@@ -4521,3 +4521,88 @@ test('production Host automatically archives assistant Markdown images and serve
     }
   });
 });
+
+test('production Host never downloads remote Markdown images in restricted session modes', async () => {
+  await withCompositionRoot(async ({ root, owner }) => {
+    let requests = 0;
+    const server = createServer((_request, response) => {
+      requests++;
+      response.end();
+    });
+    await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+    const source = `http://127.0.0.1:${(server.address() as import('node:net').AddressInfo).port}/secret.png`;
+    const captured = await createCapturedExecutionComposition(owner, {
+      primaryBackendFactory: (context) =>
+        new (class extends FakeBackend {
+          override async *send(input: BackendSendInput): AsyncIterable<SessionEvent> {
+            yield {
+              type: 'text_complete',
+              id: `text-${input.turnId}`,
+              turnId: input.turnId,
+              ts: Date.now(),
+              messageId: `message-${input.turnId}`,
+              text: `![](${source})`,
+            };
+            yield {
+              type: 'complete',
+              id: `complete-${input.turnId}`,
+              turnId: input.turnId,
+              ts: Date.now(),
+              stopReason: 'end_turn',
+            };
+          }
+        })(context),
+      context: {
+        retainUntilProcessExit: () => undefined,
+        requestDrain: () => assert.fail('remote images must not drain Host'),
+      },
+    });
+    try {
+      for (const permissionMode of ['explore', 'ask'] as const) {
+        const session = await captured.manager.createSession({
+          cwd: root,
+          llmConnectionId: FAKE_CONNECTION_ID,
+          llmConnectionSlug: 'fake',
+          model: 'fake-model',
+          permissionMode,
+        });
+        const context = {
+          hostEpoch: 'execution-composition-test',
+          connectionId: 'image-client',
+          principal: 'local_os_user',
+          acquireResidency: () => ({ release() {} }),
+        };
+        const turnId = `remote-${permissionMode}`;
+        assert.equal(
+          (
+            await captured.composition.handlers['turn.start'](
+              { sessionId: session.id, turnId, content: { text: 'deliver image' } },
+              context,
+            )
+          ).ok,
+          true,
+        );
+        const request = { sessionId: session.id, turnId, messageId: `message-${turnId}`, source };
+        await waitFor(async () => {
+          const result = await captured.composition.handlers['artifact.image.resolve'](
+            request,
+            context,
+          );
+          return result.ok && result.result.status === 'requires_confirmation';
+        }, 5000);
+        assert.deepEqual(
+          await captured.composition.handlers['artifact.image.resolve'](
+            { ...request, loadRemote: true },
+            context,
+          ),
+          { ok: true, result: { status: 'failed', reason: 'not_allowed' } },
+        );
+      }
+      assert.equal(requests, 0);
+    } finally {
+      captured.composition.beginDrain();
+      await captured.composition.close();
+      await new Promise<void>((resolve) => server.close(() => resolve()));
+    }
+  });
+});
diff --git a/packages/runtime-host/src/__tests__/protocol.test.ts b/packages/runtime-host/src/__tests__/protocol.test.ts
index a59cdbfffff..143d00400c6 100644
--- a/packages/runtime-host/src/__tests__/protocol.test.ts
+++ b/packages/runtime-host/src/__tests__/protocol.test.ts
@@ -133,6 +133,9 @@ describe('Runtime Host bootstrap protocol', () => {
     // field, so mixed-version peers must fail during the handshake instead.
     assert.ok(RUNTIME_HOST_COMPATIBILITY_EPOCH > 22);
   });
+  test('rejects peers predating remote image consent and image resolution', () => {
+    assert.ok(RUNTIME_HOST_COMPATIBILITY_EPOCH > 209);
+  });
 
   test('publishes a new compatibility epoch for durable external turn origins', () => {
     assert.ok(RUNTIME_HOST_COMPATIBILITY_EPOCH > 189);
diff --git a/packages/runtime-host/src/protocol/image-delivery.ts b/packages/runtime-host/src/protocol/image-delivery.ts
index c22ec6826ca..4ce40a4cb37 100644
--- a/packages/runtime-host/src/protocol/image-delivery.ts
+++ b/packages/runtime-host/src/protocol/image-delivery.ts
@@ -61,6 +61,9 @@ export const IMAGE_DELIVERY_OPERATION_SPECS = {
         ...(Object.hasOwn(requireRecord(value, 'image delivery request'), 'retry')
           ? ['retry']
           : []),
+        ...(Object.hasOwn(requireRecord(value, 'image delivery request'), 'loadRemote')
+          ? ['loadRemote']
+          : []),
       ]);
       const text = (s: unknown, max: number) => {
         if (typeof s !== 'string' || !s.length || s.length > max || /[\u0000-\u001f\u007f]/.test(s))
@@ -69,6 +72,8 @@ export const IMAGE_DELIVERY_OPERATION_SPECS = {
       };
       if (v.retry !== undefined && typeof v.retry !== 'boolean')
         throw invalidProtocolFrame('Invalid image retry flag');
+      if (v.loadRemote !== undefined && typeof v.loadRemote !== 'boolean')
+        throw invalidProtocolFrame('Invalid remote image load flag');
       const source = (s: unknown) => {
         if (!isImageDeliverySource(s))
           throw invalidProtocolFrame('Invalid image delivery identity');
@@ -80,11 +85,16 @@ export const IMAGE_DELIVERY_OPERATION_SPECS = {
         messageId: text(v.messageId, IMAGE_DELIVERY_IDENTITY_MAX_LENGTH),
         source: source(v.source),
         ...(v.retry === true ? { retry: true } : {}),
+        ...(v.loadRemote === true ? { loadRemote: true } : {}),
       };
     },
     decodeOutput(value) {
       const v = requireRecord(value, 'image delivery result');
-      if (v.status === 'pending' || v.status === 'unavailable') {
+      if (
+        v.status === 'pending' ||
+        v.status === 'unavailable' ||
+        v.status === 'requires_confirmation'
+      ) {
         requireExactRecord(v, 'image delivery status', ['status']);
         return { status: v.status };
       }
diff --git a/packages/runtime-host/src/protocol/index.ts b/packages/runtime-host/src/protocol/index.ts
index f4ba38b55e1..f30c2515ca5 100644
--- a/packages/runtime-host/src/protocol/index.ts
+++ b/packages/runtime-host/src/protocol/index.ts
@@ -105,7 +105,9 @@ export const RUNTIME_HOST_PROTOCOL_VERSION = 0 as const;
 // Increment when the same protocol version no longer guarantees safe Client-Host
 // interoperability. Mismatches are rejected before domain commands are admitted.
 export const RUNTIME_HOST_COMPATIBILITY_EPOCH = 213 as const;
-// 213: Add assistant image delivery resolution and bounded automatic archival.
+// 213: Epoch-212 peers do not support `artifact.image.resolve` or its image
+// delivery result shapes. Older Hosts reject the unknown operation and close
+// the connection, so mixed peers must fail admission.
 // 212: Session catalogs carry `backgroundActivity` and `backgroundActivityVersion`
 // for Host-owned activity and generation-scoped ordering independent of Session
 // revisions and Turn epochs. Older closed decoders reject these fields.
diff --git a/packages/runtime-host/src/server/chat-image-delivery.ts b/packages/runtime-host/src/server/chat-image-delivery.ts
index e9eb6900987..1c372674654 100644
--- a/packages/runtime-host/src/server/chat-image-delivery.ts
+++ b/packages/runtime-host/src/server/chat-image-delivery.ts
@@ -20,9 +20,9 @@
 import { createHash } from 'node:crypto';
 import { ImageFileReadError } from '@maka/runtime/image-file-reader';
 import type { CompleteEvent, TextCompleteEvent, TextDeltaEvent } from '@maka/core/events';
-import { foldAssistantDelta } from '@maka/core/events';
 import {
   IMAGE_MARKDOWN_MAX_LENGTH,
+  isRemoteImageSource,
   type ImageArchiveLimits,
   type ImageDeliveryRequest,
   type ImageDeliveryResult,
@@ -62,8 +62,11 @@ export interface ChatImageDeliveryPorts {
   isPresent(sessionId: string): Promise<boolean>;
   readMessage(identity: DeliveryIdentity): Promise<string | undefined>;
   readLocalImage(sessionId: string, path: string, signal: AbortSignal): Promise<ChatImageBytes>;
+  canLoadRemote(sessionId: string): Promise<boolean>;
   acquireResidency(): { release(): void };
   persistenceFailed(error: unknown): void;
+  presentationFailed(error: unknown): void;
+  readonly sourceReadTimeoutMs?: number;
   readonly limits?: ImageArchiveLimits;
   readonly download?: typeof downloadChatImage;
 }
@@ -71,64 +74,28 @@ export interface ChatImageDeliveryPorts {
 export class ChatImageDeliveryService {
   readonly #jobs = new Map<string, DeliveryJob>();
   readonly #queue: DeliveryJob[] = [];
-  readonly #streams = new Map<
-    string,
-    { turnId: string; text: string; seen: Set<string>; timer?: ReturnType<typeof setTimeout> }
-  >();
   readonly #abort = new AbortController();
   #running = 0;
   #closed = false;
   constructor(private readonly ports: ChatImageDeliveryPorts) {}
 
   observe(sessionId: string, event: TextDeltaEvent | TextCompleteEvent | CompleteEvent): void {
-    if (this.#closed) return;
-    if (event.type === 'complete') {
-      for (const [key, stream] of this.#streams) {
-        if (key.startsWith(`${sessionId}\0`) && stream.turnId === event.turnId) {
-          clearTimeout(stream.timer);
-          this.#streams.delete(key);
-        }
-      }
+    if (
+      this.#closed ||
+      event.type !== 'text_complete' ||
+      event.text.length > IMAGE_MARKDOWN_MAX_LENGTH
+    )
       return;
-    }
-    const key = `${sessionId}\0${event.messageId}`;
-    let stream = this.#streams.get(key);
-    if (!stream) {
-      if (this.#streams.size >= 32) return;
-      stream = { turnId: event.turnId, text: '', seen: new Set() };
-      this.#streams.set(key, stream);
-    }
-    if (event.type === 'text_complete') stream.text = event.text;
-    else {
-      const folded = foldAssistantDelta(stream.text.length, event);
-      if (!folded) return;
-      stream.text += folded.tail;
-    }
-    if (stream.text.length > IMAGE_MARKDOWN_MAX_LENGTH) {
-      clearTimeout(stream.timer);
-      this.#streams.delete(key);
-      return;
-    }
-    const capture = () => {
-      stream!.timer = undefined;
-      for (const source of chatImageSources(stream!.text)) {
-        if (stream!.seen.has(source)) continue;
-        stream!.seen.add(source);
+    // Reference destinations can grow during streaming. Only settled text
+    // grants capture, and remote sources always require an explicit action.
+    try {
+      for (const source of chatImageSources(event.text)) {
+        if (isRemoteImageSource(source)) continue;
         this.#enqueue({ sessionId, turnId: event.turnId, messageId: event.messageId, source });
       }
-    };
-    if (event.type === 'text_complete') {
-      clearTimeout(stream.timer);
-      capture();
-      this.#streams.delete(key);
-    } else if (!stream.timer)
-      stream.timer = setTimeout(() => {
-        try {
-          capture();
-        } catch (error) {
-          if (!this.#closed) this.ports.persistenceFailed(error);
-        }
-      }, 250);
+    } catch (error) {
+      this.ports.presentationFailed(error);
+    }
   }
 
   async resolve(identity: DeliveryIdentity): Promise<ImageDeliveryResult> {
@@ -140,8 +107,8 @@ export class ChatImageDeliveryService {
       identity.source,
     );
     const metadata = record?.imageDelivery;
-    if (metadata?.status === 'ready' && !identity.retry)
-      return { status: 'ready', artifactId: record!.id };
+    // A browser decode/read failure is not authority to destroy saved history.
+    if (metadata?.status === 'ready') return { status: 'ready', artifactId: record!.id };
     if (metadata?.status === 'failed' && !identity.retry)
       return { status: 'failed', reason: metadata.reason! };
     if (this.#jobs.has(deliveryKey(identity))) return { status: 'pending' };
@@ -152,7 +119,12 @@ export class ChatImageDeliveryService {
       if (text === undefined || !chatImageSources(text).includes(identity.source))
         return { status: 'unavailable' };
     }
-    if (metadata?.status === 'failed' || metadata?.status === 'ready') {
+    if (isRemoteImageSource(identity.source)) {
+      if (!identity.loadRemote) return { status: 'requires_confirmation' };
+      if (!(await this.ports.canLoadRemote(identity.sessionId)))
+        return { status: 'failed', reason: 'not_allowed' };
+    }
+    if (metadata?.status === 'failed') {
       return this.ports.admission.runOrJoin(identity.sessionId, async () => {
         if (this.#closed) return { status: 'unavailable' };
         if (this.#jobs.has(deliveryKey(identity))) return { status: 'pending' };
@@ -195,7 +167,10 @@ export class ChatImageDeliveryService {
         try {
           await this.#capture(identity);
         } catch (error) {
-          if (!this.#abort.signal.aborted) this.ports.persistenceFailed(error);
+          if (!this.#abort.signal.aborted) {
+            if (error instanceof ImagePersistenceError) this.ports.persistenceFailed(error.cause);
+            else this.ports.presentationFailed(error);
+          }
         } finally {
           finish();
         }
@@ -236,15 +211,20 @@ export class ChatImageDeliveryService {
     const publish = async (input: Parameters<InteractiveArtifactStoreWriter['create']>[0]) =>
       this.ports.admission.runOrJoin(sessionId, async () => {
         if (this.#abort.signal.aborted || !(await this.ports.isPresent(sessionId))) return;
-        await this.ports.artifacts.create(input);
-        // Retain a pending request only until a terminal record is durable.
-        // A crash between these writes still replays the terminal record.
-        if (input.imageDelivery?.status !== 'pending')
-          await this.ports.artifacts.deleteOwnedArtifactInSession(
-            sessionId,
-            pendingId,
-            'tool_result_projection',
-          );
+        try {
+          await this.ports.artifacts.create(input);
+          // Retain a pending request only until a terminal record is durable.
+          // A crash between these writes still replays the terminal record.
+          if (input.imageDelivery?.status !== 'pending')
+            await this.ports.artifacts.deleteOwnedArtifactInSession(
+              sessionId,
+              pendingId,
+              'tool_result_projection',
+            );
+        } catch (error) {
+          if (error instanceof ImageArchiveQuotaError) throw error;
+          throw new ImagePersistenceError('Image persistence failed', { cause: error });
+        }
       });
     await publish({
       ...base,
@@ -254,7 +234,10 @@ export class ChatImageDeliveryService {
       imageDelivery: { ...metadata, status: 'pending' },
     });
     if (this.#abort.signal.aborted || !(await this.ports.isPresent(sessionId))) return;
-    const signal = AbortSignal.any([this.#abort.signal, AbortSignal.timeout(10_000)]);
+    const readAbort = new AbortController();
+    // Keep the read deadline alive even when a source has no active handles.
+    const deadline = setTimeout(() => readAbort.abort(), this.ports.sourceReadTimeoutMs ?? 10_000);
+    const signal = AbortSignal.any([this.#abort.signal, readAbort.signal]);
     let image: ChatImageBytes;
     try {
       const path = localImagePath(source);
@@ -278,16 +261,9 @@ export class ChatImageDeliveryService {
           );
         }
       } else {
-        try {
-          image = await (this.ports.download ?? downloadChatImage)(source, signal);
-        } catch (error) {
-          if (
-            signal.aborted ||
-            (error instanceof ImageSourceError && error.reason !== 'download_failed')
-          )
-            throw error;
-          image = await (this.ports.download ?? downloadChatImage)(source, signal);
-        }
+        if (!identity.loadRemote || !(await this.ports.canLoadRemote(sessionId)))
+          throw new ImageSourceError('not_allowed');
+        image = await (this.ports.download ?? downloadChatImage)(source, signal);
       }
     } catch (error) {
       if (this.#abort.signal.aborted) return;
@@ -299,6 +275,8 @@ export class ChatImageDeliveryService {
         imageDelivery: { ...metadata, status: 'failed', reason: failureReason(error, source) },
       });
       return;
+    } finally {
+      clearTimeout(deadline);
     }
     if (this.#abort.signal.aborted) return;
     if (signal.aborted) {
@@ -341,8 +319,6 @@ export class ChatImageDeliveryService {
   beginDrain(): void {
     this.#closed = true;
     this.#abort.abort();
-    for (const stream of this.#streams.values()) clearTimeout(stream.timer);
-    this.#streams.clear();
     for (const job of this.#queue.splice(0)) job.cancel();
   }
   async close(): Promise<void> {
@@ -353,6 +329,7 @@ export class ChatImageDeliveryService {
     await Promise.all([...this.#jobs.values()].map((job) => job.done));
   }
 }
+class ImagePersistenceError extends Error {}
 function deliveryKey(i: DeliveryIdentity): string {
   return createHash('sha256')
     .update(JSON.stringify([i.sessionId, i.turnId, i.messageId, i.source]))
diff --git a/packages/runtime-host/src/server/chat-image-source.ts b/packages/runtime-host/src/server/chat-image-source.ts
index 6ba53189441..fa64e383a4e 100644
--- a/packages/runtime-host/src/server/chat-image-source.ts
+++ b/packages/runtime-host/src/server/chat-image-source.ts
@@ -76,16 +76,19 @@ export function decodedLocalImagePath(source: string): string | undefined {
 export async function downloadChatImage(
   source: string,
   signal: AbortSignal,
+  options: { readonly loopbackOrigin?: string } = {},
 ): Promise<ChatImageBytes> {
   let url = new URL(source);
+  // Only an embedding Host's exact served origin can opt into loopback. A
+  // public source cannot acquire this grant by redirecting into that origin.
+  const loopbackOrigin = url.origin === options.loopbackOrigin ? options.loopbackOrigin : undefined;
   for (let redirect = 0; redirect <= 3; redirect++) {
     signal.throwIfAborted();
     if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password)
       throw new ImageSourceError('not_allowed');
     const host = url.hostname.replace(/^\[|\]$/g, '');
-    // Literal loopback supports images served by this execution Host. Other private
-    // networks and DNS names resolving to them are never automatically fetched.
-    const literalLoopback = host === '127.0.0.1' || host === '::1';
+    const literalLoopback =
+      !!loopbackOrigin && url.origin === loopbackOrigin && (host === '127.0.0.1' || host === '::1');
     const addresses = isIP(host)
       ? [{ address: host, family: isIP(host) }]
       : await abortableLookup(host, signal);
diff --git a/packages/runtime-host/src/server/execution-composition.ts b/packages/runtime-host/src/server/execution-composition.ts
index dc7f880d280..c2687f29309 100644
--- a/packages/runtime-host/src/server/execution-composition.ts
+++ b/packages/runtime-host/src/server/execution-composition.ts
@@ -19,6 +19,7 @@
 
 import { createImageFileReader } from '@maka/runtime/image-file-reader';
 import { ChatImageDeliveryService } from './chat-image-delivery.js';
+import { createGenesisExecutionBoundary } from '@maka/core/sandbox-boundary';
 import { createWorkHubResultRuntime } from './workhub-result-runtime.js';
 import { createWorkHubInspectionTool } from './workhub-inspection-tool.js';
 import { createJevRoutingModel } from './jev-routing-model.js';
@@ -591,6 +592,20 @@ export async function createExecutionRuntimeHostComposition(
         console.warn('[runtime-host] Image delivery persistence failed', error);
         context.requestDrain();
       },
+      presentationFailed: (error) => {
+        console.warn('[runtime-host] Image presentation failed', error);
+      },
+      canLoadRemote: async (sessionId) => {
+        const [header, stored] = await Promise.all([
+          stores.sessionStore.readHeaderSnapshot(sessionId),
+          stores.sessionStore.readExecutionBoundary(sessionId),
+        ]);
+        const boundary = stored ?? createGenesisExecutionBoundary(header.permissionMode);
+        return (
+          boundary.kind === 'bypass' ||
+          (boundary.kind === 'managed' && boundary.profile.network.kind === 'enabled')
+        );
+      },
       readLocalImage: async (sessionId, path, abortSignal) => {
         const [header, boundary] = await Promise.all([
           stores.sessionStore.readHeaderSnapshot(sessionId),
@@ -793,9 +808,13 @@ export async function createExecutionRuntimeHostComposition(
         return Uint8Array.from(Buffer.from(result.base64, 'base64'));
       },
       list: async (invocation) =>
-        (await openedArtifactStore.listTurnArtifacts(invocation.sessionId, invocation.turnId)).map(
-          pluginAttachmentRef,
-        ),
+        (await openedArtifactStore.listTurnArtifacts(invocation.sessionId, invocation.turnId))
+          .filter(
+            (record) =>
+              record.imageDelivery?.status !== 'pending' &&
+              record.imageDelivery?.status !== 'failed',
+          )
+          .map(pluginAttachmentRef),
     });
     const webSearchService = createHostWebSearchService({
       policy: runtimePolicyStores.operations,
diff --git a/packages/runtime/src/__tests__/image-file.test.ts b/packages/runtime/src/__tests__/image-file.test.ts
index 9bc0d1f9a06..194ae70c55e 100644
--- a/packages/runtime/src/__tests__/image-file.test.ts
+++ b/packages/runtime/src/__tests__/image-file.test.ts
@@ -43,6 +43,18 @@ const WIDE_PNG = Buffer.from(
   'iVBORw0KGgoAAAANSUhEUgAACgAAAAABCAYAAAASePczAAAAIUlEQVR4nO3BAQ0AAADCoPdPbQ43oAAAAAAAAAAAAIA7AygBAAEQnI5pAAAAAElFTkSuQmCC',
   'base64',
 );
+test('chat images cap both edge length and total decoded pixels', () => {
+  for (const [width, height] of [
+    [16_385, 1],
+    [8192, 8192],
+  ]) {
+    const bytes = Buffer.from(ONE_PIXEL_PNG);
+    bytes.writeUInt32BE(width, 16);
+    bytes.writeUInt32BE(height, 20);
+    assert.throws(() => validateImageBytes(bytes, 'chat'), /Image exceeds/);
+  }
+  assert.equal(validateImageBytes(WIDE_PNG, 'chat').mimeType, 'image/png');
+});
 
 test('chat reader preserves structured Worker failures independently of message wording', async () => {
   for (const [reason, expected] of [
diff --git a/packages/runtime/src/image-file.ts b/packages/runtime/src/image-file.ts
index cda689e2785..c1f0ec5a71f 100644
--- a/packages/runtime/src/image-file.ts
+++ b/packages/runtime/src/image-file.ts
@@ -125,6 +125,15 @@ export function validateImageBytes(
       `Image dimensions ${dimensions.width}x${dimensions.height} exceed the ${MAX_MODEL_IMAGE_EDGE}px model input limit; downscale it and try again.`,
     );
   }
+  // Compressed byte size does not bound renderer decoding memory. Permit large
+  // screenshots while rejecting pathological headers before archival/preview.
+  if (
+    purpose === 'chat' &&
+    (Math.max(dimensions.width, dimensions.height) > 16_384 ||
+      dimensions.width * dimensions.height > 32 * 1024 * 1024)
+  ) {
+    throw imageTooLargeError(purpose);
+  }
   return { bytes, mimeType };
 }
 
@@ -132,7 +141,7 @@ function imageTooLargeError(purpose: 'model' | 'chat' = 'model'): Error {
   return new ImageFileError(
     'ERR_IMAGE_TOO_LARGE',
     purpose === 'chat'
-      ? 'Image exceeds the 2 MiB chat preview limit; resize it before publishing.'
+      ? 'Image exceeds a chat preview limit (2 MiB, 16384px per edge, or 32 megapixels); resize it before publishing.'
       : READ_IMAGE_TOO_LARGE_MESSAGE,
   );
 }
diff --git a/packages/runtime/src/system-prompt/main-session-prompt.ts b/packages/runtime/src/system-prompt/main-session-prompt.ts
index eab9df35ad7..c9f8914b73b 100644
--- a/packages/runtime/src/system-prompt/main-session-prompt.ts
+++ b/packages/runtime/src/system-prompt/main-session-prompt.ts
@@ -52,8 +52,8 @@ Keep simple answers simple; do not add headings or lists to simple answers.
 Use short headings and flat lists to organize longer answers.
 Use fenced code blocks for multiline code and backticks for inline commands, paths, identifiers, and literal values.
 Prefer descriptive link text for external sources when it is available.
-To deliver a generated screenshot or local image, include a Markdown image with its absolute path. The Host automatically saves supported images referenced in assistant messages as session attachments; HTTP/HTTPS images can also be embedded directly. Reading an image for your own inspection does not deliver it.
-If you need to delete or replace the source file immediately, use PublishImage when available first and include its returned Markdown. Keep source files available until capture finishes. Images above the automatic save limit may be displayed without a saved copy.
+To deliver a generated screenshot or local image, include a Markdown image with its absolute path. The Host automatically saves supported local images after the assistant message completes. Remote images require the user to choose Load image and the session to allow network access; include them only when relevant to the user's request. Reading an image for your own inspection does not deliver it.
+If you need to delete or replace the source file immediately, use PublishImage when available first and include its returned Markdown. Keep source files available until capture finishes. Images above the save limits cannot be previewed automatically.
 Only claim an image was saved after publication succeeds. Saving does not confirm that the client displayed it.
 Follow a more specific format requested by the user or task.`;
 }
diff --git a/packages/ui/scripts/markdown-images.browser.test.mjs b/packages/ui/scripts/markdown-images.browser.test.mjs
index fec2172f842..40696bdfcb8 100644
--- a/packages/ui/scripts/markdown-images.browser.test.mjs
+++ b/packages/ui/scripts/markdown-images.browser.test.mjs
@@ -145,29 +145,42 @@ before(async () => {
       const mode=new URLSearchParams(location.search).get('case') || 'remote';
       const destinations=${JSON.stringify(destinations)};
       const canonicalSources=${JSON.stringify(canonicalSources)};
-      let reads=0; window.imageReads=0; window.deliveryQueries=0; window.deliverySources=[]; window.deliveryReady=false; window.deliveryRetries=0;
+      let reads=0; const captured=new Map(); window.imageReads=0; window.deliveryQueries=0; window.deliverySources=[]; window.deliveryReady=false; window.deliveryRetries=0;
       const race=mode.endsWith('-race');
+      let messageId='message';
       let text=destinations[mode] ?? (mode==='attachment' ? '![Screenshot](maka://runtime/attachments/image-1)' :
         mode==='local' || mode==='local-saved' || race ? '![Screenshot](/tmp/private.png)' :
         '![Screenshot](${imageUrl}/'+(mode==='retry' ? 'retry.png' : 'image.png')+')');
       const root=createRoot(document.getElementById('root'));
-      const readBytes=async()=>{
+      const readBytes=async(_session,artifactId)=>{
+        if(captured.has(artifactId)) return captured.get(artifactId);
+        if(mode.startsWith('layout-')) await fetch('/fixture/'+encodeURIComponent(artifactId));
         if(mode.startsWith('badge-')) await fetch('/badge-attachment');
         if(mode==='geometry-saved') await fetch('/release-attachment');
         reads++; window.imageReads=reads; return (mode==='attachment' || mode==='read-retry-saved') && reads===1 ? {ok:false,reason:'read_failed'} :
-          {ok:true,base64:mode.startsWith('badge-') ? '${badge.toString('base64')}' : mode==='geometry-saved' ? '${screenshot.toString('base64')}' : mode==='corrupt-saved' && !window.deliveryRetries ? 'iVBORw0KGgo=' : '${png.toString('base64')}',mimeType:'image/png'};
+          {ok:true,base64:mode.startsWith('badge-') || artifactId.endsWith('badge.png') ? '${badge.toString('base64')}' : mode==='geometry-saved' || artifactId.endsWith('screenshot.png') ? '${screenshot.toString('base64')}' : mode==='corrupt-saved' && reads===1 ? 'iVBORw0KGgo=' : '${png.toString('base64')}',mimeType:'image/png'};
       };
-      const resolveDelivery=mode.endsWith('saved') || mode.endsWith('saving') || race ? async(_session,request)=>{
+      const preview=mode==='preview' || mode==='signed-preview' || mode==='local';
+      const seeded=mode.endsWith('saved') || mode.endsWith('saving') || race || mode.startsWith('badge-') || mode.startsWith('layout-');
+      const resolveDelivery=preview ? undefined : async(_session,request)=>{
         window.deliveryQueries++;
         window.deliverySource=request.source;
         window.deliverySources.push(request.source);
         if(canonicalSources[mode] && !canonicalSources[mode].includes(request.source)) return {status:'unavailable'};
         if(request.retry) window.deliveryRetries++;
+        if(!seeded) {
+          if(!request.loadRemote) return {status:'requires_confirmation'};
+          const response=await fetch('/capture?source='+encodeURIComponent(request.source));
+          const payload=await response.json();
+          if(!payload.ok) return {status:'failed',reason:'download_failed'};
+          captured.set(request.source,payload);
+          return {status:'ready',artifactId:request.source};
+        }
         if(race) return window.deliveryReady ? {status:'ready',artifactId:'saved-image'} : {status:'unavailable'};
         await new Promise(resolve=>setTimeout(resolve,100));
-        return mode.endsWith('saving') && window.deliveryQueries===1 ? {status:'pending'} : {status:'ready',artifactId:'saved-image'};
-      } : undefined;
-      const markdown=(streaming)=>React.createElement(Markdown,{text,streaming,settledText:race ? text : undefined,density:'compact',imageIdentity:{turnId:'turn',messageId:'message'}});
+        return mode.endsWith('saving') && window.deliveryQueries===1 ? {status:'pending'} : {status:'ready',artifactId:mode.startsWith('layout-') ? request.source : 'saved-image'};
+      };
+      const markdown=(streaming)=>React.createElement(Markdown,{text,streaming,settledText:race ? text : undefined,density:'compact',imageIdentity:{turnId:'turn',messageId}});
       const surface=(streaming)=>mode.startsWith('layout-') ? React.createElement('section',{className:mode==='layout-side' ? 'maka-quote-companion' : '',style:{width:mode==='layout-side' ? '360px' : '100%',maxWidth:'100%'}},
         React.createElement(ChatMessageList,{className:'maka-chat-message-list maka-chatContent',align:'top'},
           React.createElement('div',{className:'maka-transcript-turn maka-turn',style:{width:'100%',maxWidth:'var(--maka-reading-measure)',marginInline:'auto'}},
@@ -179,6 +192,7 @@ before(async () => {
               React.createElement(ImageDeliveryProvider,{sessionId:'session',resolve:resolveDelivery},
               React.createElement('div',{style:mode==='offscreen' ? {paddingTop:'2500px'} : {}},
                 surface(streaming)))))));
+      window.nextMessage=()=>{messageId='next-message'; render(false);};
       window.finishStream=()=>render(false);
       window.appendText=value=>{text+=value; render(true);};
       render();
@@ -192,6 +206,14 @@ before(async () => {
   const index = await readFile(new URL('../../../apps/desktop/src/renderer/index.html', import.meta.url), 'utf8');
   const csp = index.match(/http-equiv="Content-Security-Policy"\s+content="([^"]+)"/)[1];
   appServer = createServer((req, res) => {
+    if (req.url.startsWith('/capture?')) {
+      const source=new URL(req.url, appUrl).searchParams.get('source');
+      void fetch(source).then(async response=> {
+        const payload=response.ok ? {ok:true,base64:Buffer.from(await response.arrayBuffer()).toString('base64'),mimeType:'image/png'} : {ok:false};
+        res.setHeader('Content-Type','application/json'); res.end(JSON.stringify(payload));
+      }).catch(()=>res.end(JSON.stringify({ok:false}))); return;
+    }
+    if (req.url.startsWith('/fixture/')) { res.end(); return; }
     if (req.url === '/badge-attachment') { res.end(); return; }
     if (req.url === '/release-attachment') { void delayedAttachment.then(() => res.end()); return; }
     if (req.url === '/app.js') { res.setHeader('Content-Type', 'text/javascript'); res.end(js); }
@@ -223,29 +245,57 @@ async function loaded(page) {
   await page.waitForFunction(() => [...document.images].some(image => image.naturalWidth === 1));
 }
 
-test('remote image loads automatically under the actual desktop CSP, without sending a referrer', async () => {
+test('a remote image sends no request until clicked, then renders Host-owned bytes', async () => {
   requests = [];
   const page = await pageFor('remote');
   try {
-    assert.equal(await page.getByRole('button', { name: 'Load image', exact: true }).count(), 0);
+    await page.getByRole('button', { name: 'Load image', exact: true }).waitFor();
+    assert.deepEqual(requests, []);
+    assert.equal(await page.locator('img').count(), 0);
+    await page.getByRole('button', { name: 'Load image', exact: true }).click();
     await loaded(page);
     assert.deepEqual(requests, [{ path: '/image.png', referer: undefined }]);
-    // Astryx Button keeps an empty live region for asynchronous actions.
-    await page.getByText('Loading image…', { exact: true }).waitFor({ state: 'hidden' });
-    assert.equal(await page.getByRole('status').filter({ hasText: /\S/ }).count(), 0);
+    assert.match(await page.locator('img').getAttribute('src'), /^data:/);
   } finally { await page.close(); }
 });
 
-test('a signed image previews using its original URL without putting the token in visible text', async () => {
+test('remote consent belongs to one message, even when the next message reuses its URL', async () => {
   requests = [];
-  const page = await pageFor('signed-preview');
+  const page = await pageFor('remote');
   try {
+    await page.getByRole('button', { name: 'Load image', exact: true }).click();
+    await loaded(page);
+    assert.equal(requests.length, 1);
+    await page.evaluate(() => window.nextMessage());
+    await page.getByRole('button', { name: 'Load image', exact: true }).waitFor();
+    assert.equal(await page.locator('img').count(), 0);
+    assert.equal(requests.length, 1);
+    await page.getByRole('button', { name: 'Load image', exact: true }).click();
     await loaded(page);
-    assert.deepEqual(requests, [{ path: '/image.png?token=preview-secret', referer: undefined }]);
-    assert.ok(!(await page.locator('body').innerText()).includes('preview-secret'));
+    assert.equal(requests.length, 2);
   } finally { await page.close(); }
 });
 
+for (const scenario of ['preview', 'signed-preview']) {
+  test(`${scenario}: untrusted Markdown cannot load remote images or signed tracking URLs`, async () => {
+    requests = [];
+    const page = await pageFor(scenario);
+    try {
+      await page.getByText('Open in browser', { exact: true }).waitFor();
+      assert.deepEqual(requests, []);
+      assert.equal(await page.locator('img').count(), 0);
+      assert.equal(await page.getByRole('button', { name: 'Load image', exact: true }).count(), 0);
+      assert.ok(!(await page.locator('body').innerText()).includes('preview-secret'));
+      // Prove the production CSP blocks a bypass of the Markdown component too.
+      await page.evaluate(url => {
+        const img=document.createElement('img'); img.src=url; document.body.append(img);
+        return new Promise(resolve=> { img.onerror=resolve; img.onload=()=>resolve(); });
+      }, `${imageUrl}/blocked.png`);
+      assert.deepEqual(requests, []);
+    } finally { await page.close(); }
+  });
+}
+
 test('two signed destinations which redact alike replay their own saved attachments', async () => {
   requests = [];
   const page = await pageFor('signed-duplicates-saved');
@@ -279,7 +329,8 @@ test('failed remote image has a working retry control instead of a broken image
   failedOnce = false;
   const page = await pageFor('retry');
   try {
-    await page.getByText('Could not load the image. Try again.').waitFor();
+    await page.getByRole('button', { name: 'Load image', exact: true }).click();
+    await page.getByText('Image not saved: download failed. Try again.').waitFor();
     assert.equal(await page.locator('img').count(), 0);
     await page.getByRole('button', { name: 'Retry', exact: true }).click();
     await loaded(page);
@@ -293,21 +344,21 @@ test('attachment read failure recovers in place, and local paths explain how to
     await loaded(page);
     assert.match(await page.locator('img').getAttribute('src'), /^data:image\/png;base64,/);
     await page.goto(`${appUrl}/?case=local`);
-    await page.getByText('This image address cannot be displayed. Send the image as a chat attachment.').waitFor();
+    await page.getByText('This image address cannot be displayed here.').waitFor();
     assert.equal(await page.locator('img').count(), 0);
     assert.equal(await page.getByRole('button', { name: 'Load image' }).count(), 0);
   } finally { await page.close(); }
 });
 
-test('a saved image decode failure invalidates both caches and recaptures its source on retry', async () => {
+test('a saved image decode failure retries archived bytes without touching its source', async () => {
   const page = await pageFor('corrupt-saved');
   try {
     await page.getByText('Could not load the image. Try again.').waitFor();
     assert.equal(await page.evaluate(() => window.imageReads), 1);
     await page.getByRole('button', { name: 'Retry', exact: true }).click();
     await page.waitForFunction(() => [...document.images].some(img => img.src.startsWith('data:image/png;') && img.naturalWidth === 1));
-    assert.equal(await page.evaluate(() => window.deliveryRetries), 1);
-    assert.equal(await page.evaluate(() => window.deliveryQueries), 2);
+    assert.equal(await page.evaluate(() => window.deliveryRetries), 0);
+    assert.equal(await page.evaluate(() => window.deliveryQueries), 1);
     assert.equal(await page.evaluate(() => window.imageReads), 2);
   } finally { await page.close(); }
 });
@@ -351,24 +402,27 @@ test('offscreen image performs no image request until it approaches the viewport
     assert.deepEqual(requests, []);
     assert.equal(await page.locator('img').count(), 0);
     await page.locator('[data-maka-image-state]').scrollIntoViewIfNeeded();
+    await page.getByRole('button', { name: 'Load image', exact: true }).waitFor();
+    assert.deepEqual(requests, []);
+    await page.getByRole('button', { name: 'Load image', exact: true }).click();
     await loaded(page);
     assert.deepEqual(requests, [{ path: '/image.png', referer: undefined }]);
   } finally { await page.close(); }
 });
 
-test('a new remote image previews during archival and switches to saved bytes after background completion', async () => {
+test('a pending archive stays a placeholder until saved bytes are available', async () => {
   requests = [];
   const page = await pageFor('saving');
   try {
-    await loaded(page);
-    await page.getByText('Saving image…').waitFor();
-    assert.equal(requests.length, 1);
+    await page.getByText('Loading image…', { exact: true }).waitFor();
+    assert.deepEqual(requests, []);
+    assert.equal(await page.locator('img').count(), 0);
     await page.waitForFunction(() => [...document.images].some(img=>img.src.startsWith('data:image/png;') && img.naturalWidth===1));
     await page.getByText('Loading image…', { exact: true }).waitFor({ state: 'hidden' });
     await page.getByText('Saving image…', { exact: true }).waitFor({ state: 'hidden' });
     assert.equal(await page.getByRole('status').filter({ hasText: /\S/ }).count(), 0);
     assert.equal(await page.evaluate(() => window.deliveryQueries), 2);
-    assert.equal(requests.length, 1);
+    assert.equal(requests.length, 0);
   } finally { await page.close(); }
 });
 
@@ -410,6 +464,7 @@ for (const scenario of ['geometry-remote', 'geometry-saved']) {
   test(`${scenario}: loading and ready images preserve the position of subsequent content`, async () => {
     const page = await pageFor(scenario);
     try {
+      if (scenario === 'geometry-remote') await page.getByRole('button', { name: 'Load image', exact: true }).click();
       await page.getByText('Loading image…', { exact: true }).waitFor();
       const before = await page.getByText('Following paragraph', { exact: true }).boundingBox();
       if (scenario === 'geometry-remote') releaseImage(); else releaseAttachment();
@@ -427,6 +482,7 @@ for (const scenario of ['geometry-remote', 'geometry-saved']) {
 test('image frames fit narrow viewports without distorting screenshots or limiting the enlarged preview', async () => {
   const page = await pageFor('screenshot');
   try {
+    await page.getByRole('button', { name: 'Load image', exact: true }).click();
     await page.waitForFunction(() => [...document.images].some(image => image.naturalWidth > 1));
     for (const width of [720, 360]) {
       await page.setViewportSize({ width, height: 600 });
@@ -517,7 +573,7 @@ for (const scenario of ['badge-list', 'badge-table', 'badge-strip']) {
     page.setDefaultTimeout(5000);
     let release;
     const gate = new Promise(resolve => { release = resolve; });
-    await page.route(`${imageUrl}/badge.png`, async route => { await gate; await route.continue(); });
+    await page.route('**/badge-attachment', async route => { await gate; await route.continue(); });
     try {
       await page.goto(`${appUrl}/?case=${scenario}`, { waitUntil: 'domcontentloaded' });
       await page.locator('.maka-markdown-image-inline').first().waitFor();
@@ -540,7 +596,7 @@ for (const [scenario, width, height] of [
     page.setDefaultTimeout(5000);
     let release;
     const gate = new Promise(resolve => { release = resolve; });
-    await page.route(`${imageUrl}/**`, async route => { await gate; await route.continue(); });
+    await page.route('**/fixture/**', async route => { await gate; await route.continue(); });
     const measure = () => page.locator('.maka-markdown-image-resource').evaluateAll(elements => elements.map(element => {
       const r = element.getBoundingClientRect();
       return { x: r.x, y: r.y, width: r.width, height: r.height };
diff --git a/packages/ui/src/__tests__/markdown-body.test.ts b/packages/ui/src/__tests__/markdown-body.test.ts
index abb4a21afc5..60082e79177 100644
--- a/packages/ui/src/__tests__/markdown-body.test.ts
+++ b/packages/ui/src/__tests__/markdown-body.test.ts
@@ -502,13 +502,9 @@ function renderImageMarkdown(props: { text: string }) {
   }));
 }
 
-it('renders remote images automatically with lazy decoding and no referrer', () => {
+it('keeps remote URLs out of image elements until a Host archive is available', () => {
   const markup = renderImageMarkdown({ text: '![preview](https://example.com/image.png)' });
-  assert.match(markup, /<img\b/);
-  assert.match(markup, /src="https:\/\/example\.com\/image\.png"/);
-  assert.match(markup, /loading="lazy"/);
-  assert.match(markup, /referrerPolicy="no-referrer"|referrerpolicy="no-referrer"/);
-  assert.doesNotMatch(markup, /Load image|rel="preload"/);
+  assert.doesNotMatch(markup, /<img\b|rel="preload"/);
 });
 
 it('defers Mermaid fences beyond the per-Markdown automatic diagram budget', () => {
diff --git a/packages/ui/src/image-delivery.tsx b/packages/ui/src/image-delivery.tsx
index 558e95059ad..8881d5338de 100644
--- a/packages/ui/src/image-delivery.tsx
+++ b/packages/ui/src/image-delivery.tsx
@@ -50,16 +50,20 @@ export function useImageDelivery(source: string, enabled: boolean) {
   const scope = useContext(ImageMessageScope);
   const context = useContext(DeliveryContext);
   const [attempt, setAttempt] = useState(0);
+  const consentKey = JSON.stringify([scope?.turnId, scope?.messageId, source]);
+  const [consent, setConsent] = useState<{ context: typeof context; key: string }>();
+  const loadRemote = consent?.context === context && consent?.key === consentKey;
   const identity = useMemo(() => context && scope?.turnId && scope.messageId && enabled
-    ? { context, turnId: scope.turnId, messageId: scope.messageId, streaming: scope.streaming === true, source, attempt } : undefined,
-    [context, scope?.turnId, scope?.messageId, scope?.streaming, source, attempt, enabled]);
+    ? { context, turnId: scope.turnId, messageId: scope.messageId, streaming: scope.streaming === true, source, attempt, loadRemote } : undefined,
+    [context, scope?.turnId, scope?.messageId, scope?.streaming, source, attempt, loadRemote, enabled]);
   const [settled, setSettled] = useState<{ identity: typeof identity; result: ImageDeliveryResult }>();
   const retry = useCallback(() => setAttempt(a => a + 1), []);
+  const confirmRemote = useCallback(() => setConsent({ context, key: consentKey }), [context, consentKey]);
   useEffect(() => {
     if (!identity) return;
     let cancelled = false; let timer: ReturnType<typeof setTimeout> | undefined; let delay = 500; let unavailableRetries = 0;
     const query = async (retry: boolean) => {
-      const result = await identity.context.resolve({ turnId: identity.turnId, messageId: identity.messageId, source: identity.source, ...(retry ? { retry: true } : {}) });
+      const result = await identity.context.resolve({ turnId: identity.turnId, messageId: identity.messageId, source: identity.source, ...(retry ? { retry: true } : {}), ...(identity.loadRemote ? { loadRemote: true } : {}) });
       if (cancelled) return;
       setSettled({ identity, result });
       // Canonical text can lag the displayed stream. Retry briefly after settlement,
@@ -73,5 +77,5 @@ export function useImageDelivery(source: string, enabled: boolean) {
   }, [identity, attempt]);
   const result: ImageDeliveryResult = !identity ? { status: 'unavailable' }
     : settled?.identity === identity ? settled.result : { status: 'pending' };
-  return { ...result, retry, available: !!identity, checked: settled?.identity === identity };
+  return { ...result, retry, confirmRemote, available: !!identity, checked: settled?.identity === identity };
 }
diff --git a/packages/ui/src/markdown-image.tsx b/packages/ui/src/markdown-image.tsx
index fa3811ba379..909a1bf6733 100644
--- a/packages/ui/src/markdown-image.tsx
+++ b/packages/ui/src/markdown-image.tsx
@@ -100,23 +100,24 @@ function ImageResource(props: { src: string; alt: string; inline?: boolean }) {
   const [failedSource, setFailedSource] = useState<string>();
   const [attempt, setAttempt] = useState(0);
   const remote = isWebImage(props.src);
-  const source = artifactId ? image.src : visible && remote && (!delivery.available || delivery.checked) ? props.src : undefined;
+  const source = artifactId ? image.src : undefined;
   const failed = !!source && failedSource === source || !!artifactId && image.status === 'failed';
   const retry = () => {
     setFailedSource(undefined); setAttempt(a => a + 1);
     if (artifactId) image.retry();
-    // A transient byte-read failure retries the saved attachment. Only a
-    // browser decode failure invalidates automatic capture and rereads origin.
-    if (!artifactId || (!explicit && source && failedSource === source)) delivery.retry();
+    if (!artifactId) delivery.retry();
   };
   const sourceActions = <span className="maka-markdown-image-actions">
     <Button variant="ghost" size="sm" label={copy.imageRetry} onClick={retry} />
     {remote && <Link href={props.src} isExternalLink type="inherit" hasUnderline>{copy.imageOpen}</Link>}
   </span>;
   let message: string | undefined;
+  const needsConsent = visible && remote && !artifactId &&
+    (delivery.status === 'requires_confirmation' || !delivery.available);
   if (failed) message = copy.imageLoadFailed;
   else if (!source) message = !visible ? copy.imageLoading
     : explicit && image.status === 'unavailable' ? copy.imageUnavailable
+    : needsConsent ? copy.imageRemoteConsent
     : delivery.status === 'failed' ? copy.imageArchiveFailure(delivery.reason)
     : delivery.status === 'pending' || artifactId ? copy.imageLoading : copy.imageUnsupported;
   const hasFrame = props.inline || !visible || !!source || !!artifactId || delivery.status === 'pending';
@@ -126,14 +127,18 @@ function ImageResource(props: { src: string; alt: string; inline?: boolean }) {
       <span className="maka-markdown-image-placeholder" role="status" aria-label={message}>
         {failed || delivery.status === 'failed'
           ? <IconButton icon={<RotateCw size={14} />} size="sm" label={copy.imageRetry} onClick={retry} />
-          : delivery.status === 'unavailable' && visible
+          : needsConsent || delivery.status === 'unavailable' && visible
             ? <AlertTriangle size={14} aria-hidden="true" /> : <Spinner size="sm" shade="subtle" aria-hidden="true" />}
       </span>
     </Tooltip> : message ? <span className="maka-markdown-image-placeholder">
       {props.alt && <span className="maka-markdown-image-caption">{props.alt}</span>}
-      <span role="status">{hasFrame && !failed && delivery.status !== 'failed' && <Spinner size="sm" shade="subtle" aria-hidden="true" />} {message}</span>
+      <span role="status">{hasFrame && !failed && !needsConsent && delivery.status !== 'failed' && <Spinner size="sm" shade="subtle" aria-hidden="true" />} {message}</span>
       {(failed || delivery.status === 'failed') && sourceActions}
     </span> : source && <DisplayImage key={`${source}\0${attempt}`} src={source} alt={props.alt} onError={() => setFailedSource(source)} />}
+    {needsConsent && <span className="maka-markdown-image-actions">
+      {delivery.available && <Button variant="ghost" size="sm" label={copy.imageLoad} onClick={delivery.confirmRemote} />}
+      <Link href={props.src} isExternalLink type="inherit" hasUnderline>{copy.imageOpen}</Link>
+    </span>}
     {!explicit && delivery.status === 'pending' && remote && source && (props.inline ? <Tooltip content={copy.imageSaving}>
       <span className="maka-markdown-image-saving" role="status" aria-label={copy.imageSaving}><Spinner size="sm" aria-hidden="true" /></span>
     </Tooltip> : <span className="maka-markdown-image-saving" role="status">{copy.imageSaving}</span>)}
diff --git a/packages/ui/src/shared-ui-copy.ts b/packages/ui/src/shared-ui-copy.ts
index 5f85e840e95..3a8de3405e8 100644
--- a/packages/ui/src/shared-ui-copy.ts
+++ b/packages/ui/src/shared-ui-copy.ts
@@ -32,6 +32,8 @@ export interface SharedUiCopy {
     unsafeLink: string;
     imageLoading: string;
     imageSaving: string;
+    imageRemoteConsent: string;
+    imageLoad: string;
     imageExpand: (alt: string) => string;
     imageArchiveFailure: (reason: import('@maka/core/image-delivery').ImageDeliveryFailure) => string;
     imageUnavailable: string;
@@ -136,11 +138,22 @@ const SHARED_UI_COPY = {
       unsafeLink: '链接不安全',
       imageLoading: '正在加载图片…',
       imageSaving: '正在保存图片…',
+      imageRemoteConsent: '远程图片需要授权加载，图片来源会收到请求。',
+      imageLoad: '加载图片',
       imageExpand: (alt) => alt ? `放大图片：${alt}` : '放大图片',
-      imageArchiveFailure: (reason) => reason === 'quota_exceeded' ? '图片未保存：存储配额已满。' : reason === 'too_large' ? '图片未保存：超过 2 MiB 自动保存上限。' : reason === 'not_allowed' ? '图片未保存：当前权限不允许读取。' : '图片未保存，原文件或链接失效后可能无法查看。',
+      imageArchiveFailure: (reason) => ({
+        quota_exceeded: '图片未保存：存储配额已满（每个会话 100 MiB，工作区 1 GiB）。删除不再需要的会话可释放空间，仅归档不会释放。',
+        too_large: '图片未保存：超过自动保存的大小或像素上限。',
+        not_allowed: '图片未保存：当前权限不允许读取或联网。',
+        not_found: '图片未保存：原文件已不存在。',
+        unsupported_mime: '图片未保存：不是支持的有效图片。',
+        download_failed: '图片未保存：下载失败，请重试。',
+        read_failed: '图片未保存：读取失败，请重试。',
+        queue_full: '图片未保存：保存队列已满，请稍后重试。',
+      })[reason],
       imageUnavailable: '当前无法读取图片附件。',
       imageLoadFailed: '图片加载失败，请重试。',
-      imageUnsupported: '此图片地址无法直接显示，请将图片作为会话附件发送。',
+      imageUnsupported: '此图片地址无法在这里显示。',
       imageRetry: '重试',
       imageOpen: '在浏览器中打开',
       taskList: '任务列表',
@@ -225,11 +238,22 @@ const SHARED_UI_COPY = {
       unsafeLink: '連結不安全',
       imageLoading: '正在載入圖片…',
       imageSaving: '正在儲存圖片…',
+      imageRemoteConsent: '遠端圖片需要授權載入，圖片來源會收到請求。',
+      imageLoad: '載入圖片',
       imageExpand: (alt) => alt ? `放大圖片：${alt}` : '放大圖片',
-      imageArchiveFailure: (reason) => reason === 'quota_exceeded' ? '圖片未儲存：儲存配額已滿。' : reason === 'too_large' ? '圖片未儲存：超過 2 MiB 自動儲存上限。' : reason === 'not_allowed' ? '圖片未儲存：目前權限不允許讀取。' : '圖片未儲存，原檔案或連結失效後可能無法查看。',
+      imageArchiveFailure: (reason) => ({
+        quota_exceeded: '圖片未儲存：儲存配額已滿（每個對話 100 MiB，工作區 1 GiB）。刪除不再需要的對話可釋放空間，僅封存不會釋放。',
+        too_large: '圖片未儲存：超過自動儲存的大小或像素上限。',
+        not_allowed: '圖片未儲存：目前權限不允許讀取或連線。',
+        not_found: '圖片未儲存：原檔案已不存在。',
+        unsupported_mime: '圖片未儲存：不是支援的有效圖片。',
+        download_failed: '圖片未儲存：下載失敗，請重試。',
+        read_failed: '圖片未儲存：讀取失敗，請重試。',
+        queue_full: '圖片未儲存：儲存佇列已滿，請稍後重試。',
+      })[reason],
       imageUnavailable: '目前無法讀取圖片附件。',
       imageLoadFailed: '圖片載入失敗，請重試。',
-      imageUnsupported: '此圖片位址無法直接顯示，請將圖片作為對話附件傳送。',
+      imageUnsupported: '此圖片位址無法在這裡顯示。',
       imageRetry: '重試',
       imageOpen: '在瀏覽器中開啟',
       taskList: '任務列表',
@@ -314,11 +338,22 @@ const SHARED_UI_COPY = {
       unsafeLink: 'Unsafe link',
       imageLoading: 'Loading image…',
       imageSaving: 'Saving image…',
+      imageRemoteConsent: 'Load this remote image only if you trust its source. Loading sends a request to that source.',
+      imageLoad: 'Load image',
       imageExpand: (alt) => alt ? `Enlarge image: ${alt}` : 'Enlarge image',
-      imageArchiveFailure: (reason) => reason === 'quota_exceeded' ? 'Image not saved: storage quota reached.' : reason === 'too_large' ? 'Image not saved: exceeds the 2 MiB automatic save limit.' : reason === 'not_allowed' ? 'Image not saved: current permissions do not allow reading it.' : 'Image not saved. It may become unavailable if the original file or link expires.',
+      imageArchiveFailure: (reason) => ({
+        quota_exceeded: 'Image not saved: storage quota reached (100 MiB per session, 1 GiB per workspace). Delete unneeded sessions to free space; archiving does not free space.',
+        too_large: 'Image not saved: exceeds the automatic save size or pixel limit.',
+        not_allowed: 'Image not saved: current permissions do not allow reading it or using the network.',
+        not_found: 'Image not saved: the original file no longer exists.',
+        unsupported_mime: 'Image not saved: not a supported valid image.',
+        download_failed: 'Image not saved: download failed. Try again.',
+        read_failed: 'Image not saved: read failed. Try again.',
+        queue_full: 'Image not saved: the save queue is full. Try again later.',
+      })[reason],
       imageUnavailable: 'This image attachment is unavailable here.',
       imageLoadFailed: 'Could not load the image. Try again.',
-      imageUnsupported: 'This image address cannot be displayed. Send the image as a chat attachment.',
+      imageUnsupported: 'This image address cannot be displayed here.',
       imageRetry: 'Retry',
       imageOpen: 'Open in browser',
       taskList: 'Task list',
diff --git a/packages/ui/stories/attachment.stories.tsx b/packages/ui/stories/attachment.stories.tsx
index 878c33509c8..5b7d03149c3 100644
--- a/packages/ui/stories/attachment.stories.tsx
+++ b/packages/ui/stories/attachment.stories.tsx
@@ -24,6 +24,8 @@ import type { AttachmentRef } from '@maka/core/events';
 import type { SessionSummary, StoredMessage } from '@maka/core/session';
 import { ChatSurfaceLayout, ChatView, Composer } from '../src/components.js';
 import type { ChatModelChoice } from '../src/chat-model-helpers.js';
+import type { ImageDeliveryResult } from '@maka/core/image-delivery';
+import { LocaleProvider } from '../src/locale-context.js';
 
 const NOW = Date.UTC(2026, 6, 1, 9, 30, 0);
 
@@ -151,6 +153,35 @@ function AttachmentChat(props: ComponentProps<typeof ChatView>) {
   );
 }
 
+function imageDeliveryStory(result: ImageDeliveryResult): Story {
+  return {
+    render: () => <LocaleProvider locale="en"><Frame><AttachmentChat {...baseChat}
+      messages={[{ type: 'assistant', id: 'image-message', turnId: 'image-turn', ts: NOW,
+        modelId: 'claude-sonnet-4-5', text: '![Dashboard](https://example.invalid/dashboard.png)' }]}
+      onResolveImageDelivery={async () => result}
+    /></Frame></LocaleProvider>,
+    play: async ({ canvasElement }) => {
+      await waitFor(() => {
+        const image = canvasElement.querySelector('.maka-markdown-image-resource');
+        if (!image) throw new Error('assistant image has not mounted');
+        if (result.status === 'ready') expect(image.querySelector('img')?.getAttribute('src')).toMatch(/^data:/);
+        else if (result.status === 'requires_confirmation') expect(image.textContent).toContain('Load image');
+        else if (result.status === 'failed') expect(image.textContent).toContain('download failed');
+        else expect(image.textContent).toContain('Loading image');
+      });
+    },
+  };
+}
+
+// Real path: assistant chat bubble → remote image awaits the user's Load image action.
+export const AssistantImageConsent = imageDeliveryStory({ status: 'requires_confirmation' });
+// Real path: assistant chat bubble → Host is saving bytes; the image remains a placeholder.
+export const AssistantImageSaving = imageDeliveryStory({ status: 'pending' });
+// Real path: assistant chat bubble → saved attachment is read through the production byte reader.
+export const AssistantImageSaved = imageDeliveryStory({ status: 'ready', artifactId: 'dashboard-image' });
+// Real path: assistant chat bubble → failed download offers Retry with the failure reason.
+export const AssistantImageFailed = imageDeliveryStory({ status: 'failed', reason: 'download_failed' });
+
 // Real path: composer → ＋ → attach files → the pending chips before the message is sent.
 export const ComposerPendingChips: Story = {
   render: () => (

From 1523d1062eba283cfb12b7c6480570e2ea08ed24 Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Wed, 7 Oct 2026 13:58:49 +0800
Subject: [PATCH 17/37] refactor(images): share validation and remove obsolete
 preview states

Reuse request validation, remote source classification and abortable DNS waits. Consolidate failure publication and remove unreachable preview saving UI, unused state and ready-cache invalidation.

Generated-by: Codex (GPT-6)
---
 .../image-delivery-request-validator.json     |  5 ++
 .../src/protocol/image-delivery.ts            | 55 +++++++------------
 .../src/server/chat-image-delivery.ts         | 43 +++++----------
 .../src/server/chat-image-source.ts           | 24 +++-----
 packages/ui/src/image-delivery.tsx            |  3 +-
 packages/ui/src/markdown-image.tsx            | 16 +-----
 packages/ui/src/shared-ui-copy.ts             |  4 --
 packages/ui/src/styles.css                    | 16 ------
 8 files changed, 51 insertions(+), 115 deletions(-)
 create mode 100644 packages/runtime-host/protocol-compatible-changes/image-delivery-request-validator.json

diff --git a/packages/runtime-host/protocol-compatible-changes/image-delivery-request-validator.json b/packages/runtime-host/protocol-compatible-changes/image-delivery-request-validator.json
new file mode 100644
index 00000000000..f684e875750
--- /dev/null
+++ b/packages/runtime-host/protocol-compatible-changes/image-delivery-request-validator.json
@@ -0,0 +1,5 @@
+{
+  "epoch": 210,
+  "files": ["packages/runtime-host/src/protocol/image-delivery.ts"],
+  "reason": "At epoch 210, replace duplicate image request validation with the core validator and existing shaped-record codec. Required and optional fields, identity/source bounds, control-character rejection, error codes, normalized boolean flags and output codecs remain unchanged. Differential checks against the epoch-210 implementation preserve all 443 tested input outcomes; no field or operation is added or removed."
+}
diff --git a/packages/runtime-host/src/protocol/image-delivery.ts b/packages/runtime-host/src/protocol/image-delivery.ts
index 4ce40a4cb37..b5e44e65c40 100644
--- a/packages/runtime-host/src/protocol/image-delivery.ts
+++ b/packages/runtime-host/src/protocol/image-delivery.ts
@@ -19,13 +19,17 @@
 
 import {
   IMAGE_DELIVERY_FAILURES,
-  IMAGE_DELIVERY_IDENTITY_MAX_LENGTH,
-  isImageDeliverySource,
+  isImageDeliveryRequest,
   type ImageDeliveryRequest,
   type ImageDeliveryResult,
 } from '@maka/core/image-delivery';
 import { isCanonicalArtifactEntityId } from '@maka/core/artifacts';
-import { requireExactRecord, requireEntityId, requireRecord } from './codec.js';
+import {
+  requireExactRecord,
+  requireEntityId,
+  requireRecord,
+  requireShapedRecord,
+} from './codec.js';
 import { invalidProtocolFrame } from './errors.js';
 import { defineOperation } from './operation-spec.js';
 export interface ResolveImageDeliveryInput extends ImageDeliveryRequest {
@@ -53,39 +57,20 @@ export const IMAGE_DELIVERY_OPERATION_SPECS = {
       'internal_failure',
     ],
     decodeInput(value) {
-      const v = requireExactRecord(value, 'image delivery request', [
-        'sessionId',
-        'turnId',
-        'messageId',
-        'source',
-        ...(Object.hasOwn(requireRecord(value, 'image delivery request'), 'retry')
-          ? ['retry']
-          : []),
-        ...(Object.hasOwn(requireRecord(value, 'image delivery request'), 'loadRemote')
-          ? ['loadRemote']
-          : []),
-      ]);
-      const text = (s: unknown, max: number) => {
-        if (typeof s !== 'string' || !s.length || s.length > max || /[\u0000-\u001f\u007f]/.test(s))
-          throw invalidProtocolFrame('Invalid image delivery identity');
-        return s;
-      };
-      if (v.retry !== undefined && typeof v.retry !== 'boolean')
-        throw invalidProtocolFrame('Invalid image retry flag');
-      if (v.loadRemote !== undefined && typeof v.loadRemote !== 'boolean')
-        throw invalidProtocolFrame('Invalid remote image load flag');
-      const source = (s: unknown) => {
-        if (!isImageDeliverySource(s))
-          throw invalidProtocolFrame('Invalid image delivery identity');
-        return s;
-      };
+      const { sessionId, ...request } = requireShapedRecord(
+        value,
+        'image delivery request',
+        ['sessionId', 'turnId', 'messageId', 'source'],
+        ['retry', 'loadRemote'],
+      );
+      if (!isImageDeliveryRequest(request))
+        throw invalidProtocolFrame('Invalid image delivery request');
+      const { retry, loadRemote, ...identity } = request;
       return {
-        sessionId: requireEntityId(v.sessionId, 'sessionId'),
-        turnId: text(v.turnId, IMAGE_DELIVERY_IDENTITY_MAX_LENGTH),
-        messageId: text(v.messageId, IMAGE_DELIVERY_IDENTITY_MAX_LENGTH),
-        source: source(v.source),
-        ...(v.retry === true ? { retry: true } : {}),
-        ...(v.loadRemote === true ? { loadRemote: true } : {}),
+        sessionId: requireEntityId(sessionId, 'sessionId'),
+        ...identity,
+        ...(retry === true ? { retry: true } : {}),
+        ...(loadRemote === true ? { loadRemote: true } : {}),
       };
     },
     decodeOutput(value) {
diff --git a/packages/runtime-host/src/server/chat-image-delivery.ts b/packages/runtime-host/src/server/chat-image-delivery.ts
index 1c372674654..23743af105c 100644
--- a/packages/runtime-host/src/server/chat-image-delivery.ts
+++ b/packages/runtime-host/src/server/chat-image-delivery.ts
@@ -48,7 +48,6 @@ interface DeliveryIdentity extends ImageDeliveryRequest {
   readonly sessionId: string;
 }
 interface DeliveryJob {
-  readonly identity: DeliveryIdentity;
   readonly done: Promise<void>;
   run(): Promise<void>;
   cancel(): void;
@@ -160,7 +159,6 @@ export class ChatImageDeliveryService {
       settle();
     };
     const job: DeliveryJob = {
-      identity,
       done,
       cancel: finish,
       run: async () => {
@@ -201,6 +199,7 @@ export class ChatImageDeliveryService {
     );
     if (existing?.imageDelivery?.status !== 'pending' && existing) return;
     const metadata = { messageId, source };
+    const resultId = `chat_image_result_${deliveryKey(identity)}`;
     const pendingId = existing?.id ?? `chat_image_request_${deliveryKey(identity)}`;
     const base = {
       sessionId,
@@ -226,6 +225,14 @@ export class ChatImageDeliveryService {
           throw new ImagePersistenceError('Image persistence failed', { cause: error });
         }
       });
+    const publishFailure = (reason: ImageDeliveryFailure) =>
+      publish({
+        ...base,
+        id: resultId,
+        kind: 'file',
+        content: '',
+        imageDelivery: { ...metadata, status: 'failed', reason },
+      });
     await publish({
       ...base,
       id: pendingId,
@@ -267,36 +274,20 @@ export class ChatImageDeliveryService {
       }
     } catch (error) {
       if (this.#abort.signal.aborted) return;
-      await publish({
-        ...base,
-        id: `chat_image_result_${deliveryKey(identity)}`,
-        kind: 'file',
-        content: '',
-        imageDelivery: { ...metadata, status: 'failed', reason: failureReason(error, source) },
-      });
+      await publishFailure(failureReason(error, source));
       return;
     } finally {
       clearTimeout(deadline);
     }
     if (this.#abort.signal.aborted) return;
     if (signal.aborted) {
-      await publish({
-        ...base,
-        id: `chat_image_result_${deliveryKey(identity)}`,
-        kind: 'file',
-        content: '',
-        imageDelivery: {
-          ...metadata,
-          status: 'failed',
-          reason: failureReason(signal.reason, source),
-        },
-      });
+      await publishFailure(failureReason(signal.reason, source));
       return;
     }
     try {
       await publish(
         readyChatImageArtifact({
-          id: `chat_image_result_${deliveryKey(identity)}`,
+          id: resultId,
           sessionId,
           turnId,
           name: base.name,
@@ -307,13 +298,7 @@ export class ChatImageDeliveryService {
       );
     } catch (error) {
       if (!(error instanceof ImageArchiveQuotaError)) throw error;
-      await publish({
-        ...base,
-        id: `chat_image_result_${deliveryKey(identity)}`,
-        kind: 'file',
-        content: '',
-        imageDelivery: { ...metadata, status: 'failed', reason: 'quota_exceeded' },
-      });
+      await publishFailure('quota_exceeded');
     }
   }
   beginDrain(): void {
@@ -341,5 +326,5 @@ function failureReason(error: unknown, source: string): ImageDeliveryFailure {
   const code = (error as NodeJS.ErrnoException | undefined)?.code;
   if (code === 'ENOENT' || code === 'ENOTDIR') return 'not_found';
   if (code === 'EACCES' || code === 'EPERM') return 'not_allowed';
-  return /^https?:/i.test(source) ? 'download_failed' : 'read_failed';
+  return isRemoteImageSource(source) ? 'download_failed' : 'read_failed';
 }
diff --git a/packages/runtime-host/src/server/chat-image-source.ts b/packages/runtime-host/src/server/chat-image-source.ts
index fa64e383a4e..c1e36cc7a55 100644
--- a/packages/runtime-host/src/server/chat-image-source.ts
+++ b/packages/runtime-host/src/server/chat-image-source.ts
@@ -28,7 +28,12 @@ import {
   imageFileFailureReason,
   validateImageBytes,
 } from '@maka/runtime/image-file';
-import { isImageDeliverySource, type ImageDeliveryFailure } from '@maka/core/image-delivery';
+import {
+  isImageDeliverySource,
+  isRemoteImageSource,
+  type ImageDeliveryFailure,
+} from '@maka/core/image-delivery';
+import { abortable } from '../client/wait-for-ready.js';
 export class ImageSourceError extends Error {
   constructor(readonly reason: ImageDeliveryFailure) {
     super(reason);
@@ -47,7 +52,7 @@ export function checkedChatImage(bytes: Uint8Array): ChatImageBytes {
   }
 }
 export function localImagePath(source: string): string | undefined {
-  if (/^https?:/i.test(source)) return undefined;
+  if (isRemoteImageSource(source)) return undefined;
   if (source.startsWith('file:')) {
     try {
       return fileURLToPath(source);
@@ -63,7 +68,7 @@ export function localImagePath(source: string): string | undefined {
 /** A missing literal path may be a URL-encoded Markdown destination. File URLs
  * already went through fileURLToPath; never decode them a second time. */
 export function decodedLocalImagePath(source: string): string | undefined {
-  if (source.startsWith('file:') || /^https?:/i.test(source)) return undefined;
+  if (source.startsWith('file:') || isRemoteImageSource(source)) return undefined;
   try {
     const decoded = decodeURIComponent(source);
     return decoded !== source && isImageDeliverySource(decoded) ? decoded : undefined;
@@ -91,7 +96,7 @@ export async function downloadChatImage(
       !!loopbackOrigin && url.origin === loopbackOrigin && (host === '127.0.0.1' || host === '::1');
     const addresses = isIP(host)
       ? [{ address: host, family: isIP(host) }]
-      : await abortableLookup(host, signal);
+      : await abortable(() => lookup(host, { all: true }), signal);
     if (!addresses.length || (!literalLoopback && addresses.some((a) => !publicAddress(a.address))))
       throw new ImageSourceError('not_allowed');
     const target = addresses[0]!;
@@ -158,14 +163,3 @@ function publicAddress(address: string): boolean {
   // Only global-unicast IPv6 is eligible. Mapped IPv4/ULA/link-local are excluded.
   return /^[23][0-9a-f]{3}:/i.test(address);
 }
-
-function abortableLookup(host: string, signal: AbortSignal) {
-  signal.throwIfAborted();
-  return new Promise<import('node:dns').LookupAddress[]>((resolve, reject) => {
-    const abort = () => reject(signal.reason);
-    signal.addEventListener('abort', abort, { once: true });
-    void lookup(host, { all: true })
-      .then(resolve, reject)
-      .finally(() => signal.removeEventListener('abort', abort));
-  });
-}
diff --git a/packages/ui/src/image-delivery.tsx b/packages/ui/src/image-delivery.tsx
index 8881d5338de..763539497e8 100644
--- a/packages/ui/src/image-delivery.tsx
+++ b/packages/ui/src/image-delivery.tsx
@@ -30,7 +30,6 @@ export function ImageDeliveryProvider(props: { sessionId: string; resolve?: Reso
     const ready = new Map<string, ImageDeliveryResult>();
     return { resolve(request: ImageDeliveryRequest) {
       const key = JSON.stringify([request.turnId, request.messageId, request.source]);
-      if (request.retry) ready.delete(key);
       const cached = ready.get(key); if (cached) return Promise.resolve(cached);
       const running = pending.get(key); if (running) return running;
       const job = resolve(props.sessionId, request).catch((): ImageDeliveryResult => ({ status: 'failed', reason: 'read_failed' }));
@@ -77,5 +76,5 @@ export function useImageDelivery(source: string, enabled: boolean) {
   }, [identity, attempt]);
   const result: ImageDeliveryResult = !identity ? { status: 'unavailable' }
     : settled?.identity === identity ? settled.result : { status: 'pending' };
-  return { ...result, retry, confirmRemote, available: !!identity, checked: settled?.identity === identity };
+  return { ...result, retry, confirmRemote, available: !!identity };
 }
diff --git a/packages/ui/src/markdown-image.tsx b/packages/ui/src/markdown-image.tsx
index 909a1bf6733..b28140d196f 100644
--- a/packages/ui/src/markdown-image.tsx
+++ b/packages/ui/src/markdown-image.tsx
@@ -24,6 +24,7 @@ import type { MarkdownAstNode, MarkdownAstRoot } from '@astryxdesign/core/Markdo
 import { Maximize2, RotateCw, AlertTriangle } from './icons.js';
 import { Link } from '@astryxdesign/core/Link';
 import { parseAttachmentResourceRef } from '@maka/core/attachments';
+import { isRemoteImageSource } from '@maka/core/image-delivery';
 import { useAttachmentImage } from './attachment-image.js';
 import { useImageDelivery } from './image-delivery.js';
 import { getSharedUiCopy } from './shared-ui-copy.js';
@@ -99,7 +100,7 @@ function ImageResource(props: { src: string; alt: string; inline?: boolean }) {
   const image = useAttachmentImage(visible && artifactId ? { artifactId } : undefined);
   const [failedSource, setFailedSource] = useState<string>();
   const [attempt, setAttempt] = useState(0);
-  const remote = isWebImage(props.src);
+  const remote = isRemoteImageSource(props.src);
   const source = artifactId ? image.src : undefined;
   const failed = !!source && failedSource === source || !!artifactId && image.status === 'failed';
   const retry = () => {
@@ -139,16 +140,6 @@ function ImageResource(props: { src: string; alt: string; inline?: boolean }) {
       {delivery.available && <Button variant="ghost" size="sm" label={copy.imageLoad} onClick={delivery.confirmRemote} />}
       <Link href={props.src} isExternalLink type="inherit" hasUnderline>{copy.imageOpen}</Link>
     </span>}
-    {!explicit && delivery.status === 'pending' && remote && source && (props.inline ? <Tooltip content={copy.imageSaving}>
-      <span className="maka-markdown-image-saving" role="status" aria-label={copy.imageSaving}><Spinner size="sm" aria-hidden="true" /></span>
-    </Tooltip> : <span className="maka-markdown-image-saving" role="status">{copy.imageSaving}</span>)}
-    {!explicit && delivery.status === 'failed' && remote && source && !failed && (props.inline ? <Tooltip content={copy.imageArchiveFailure(delivery.reason)}>
-      <span className="maka-markdown-image-saving" role="status" aria-label={copy.imageArchiveFailure(delivery.reason)}>
-        <IconButton icon={<AlertTriangle size={14} />} size="sm" label={copy.imageRetry} onClick={retry} />
-      </span>
-    </Tooltip> : <span className="maka-markdown-image-saving" role="status">
-      {copy.imageArchiveFailure(delivery.reason)} {sourceActions}
-    </span>)}
   </span>;
 }
 function DisplayImage(props: { src: string; alt: string; onError(): void }) {
@@ -167,6 +158,3 @@ function DisplayImage(props: { src: string; alt: string; onError(): void }) {
     {lightbox.isOpen && lightbox.element}
   </>;
 }
-function isWebImage(source: string): boolean {
-  try { return ['http:', 'https:'].includes(new URL(source).protocol); } catch { return false; }
-}
diff --git a/packages/ui/src/shared-ui-copy.ts b/packages/ui/src/shared-ui-copy.ts
index 3a8de3405e8..5a3acaef670 100644
--- a/packages/ui/src/shared-ui-copy.ts
+++ b/packages/ui/src/shared-ui-copy.ts
@@ -31,7 +31,6 @@ export interface SharedUiCopy {
     invalidInternalLink: string;
     unsafeLink: string;
     imageLoading: string;
-    imageSaving: string;
     imageRemoteConsent: string;
     imageLoad: string;
     imageExpand: (alt: string) => string;
@@ -137,7 +136,6 @@ const SHARED_UI_COPY = {
       invalidInternalLink: '内部链接无效',
       unsafeLink: '链接不安全',
       imageLoading: '正在加载图片…',
-      imageSaving: '正在保存图片…',
       imageRemoteConsent: '远程图片需要授权加载，图片来源会收到请求。',
       imageLoad: '加载图片',
       imageExpand: (alt) => alt ? `放大图片：${alt}` : '放大图片',
@@ -237,7 +235,6 @@ const SHARED_UI_COPY = {
       invalidInternalLink: '內部連結無效',
       unsafeLink: '連結不安全',
       imageLoading: '正在載入圖片…',
-      imageSaving: '正在儲存圖片…',
       imageRemoteConsent: '遠端圖片需要授權載入，圖片來源會收到請求。',
       imageLoad: '載入圖片',
       imageExpand: (alt) => alt ? `放大圖片：${alt}` : '放大圖片',
@@ -337,7 +334,6 @@ const SHARED_UI_COPY = {
       invalidInternalLink: 'Invalid internal link',
       unsafeLink: 'Unsafe link',
       imageLoading: 'Loading image…',
-      imageSaving: 'Saving image…',
       imageRemoteConsent: 'Load this remote image only if you trust its source. Loading sends a request to that source.',
       imageLoad: 'Load image',
       imageExpand: (alt) => alt ? `Enlarge image: ${alt}` : 'Enlarge image',
diff --git a/packages/ui/src/styles.css b/packages/ui/src/styles.css
index cf463d534a5..ddcd1431469 100644
--- a/packages/ui/src/styles.css
+++ b/packages/ui/src/styles.css
@@ -691,22 +691,6 @@
   color: var(--muted-foreground);
   font-size: var(--maka-font-size-sm);
 }
-.maka-markdown-image-saving {
-  position: absolute;
-  inset-inline-start: var(--space-2);
-  inset-block-end: var(--space-2);
-  max-width: calc(100% - var(--space-10));
-  padding: var(--space-1) var(--space-2);
-  background: var(--background);
-  border-radius: var(--radius-surface);
-  color: var(--muted-foreground);
-  font-size: var(--maka-font-size-sm);
-}
-.maka-markdown-image-inline .maka-markdown-image-saving {
-  inset: auto auto 0 0;
-  max-width: 100%;
-  padding: 0;
-}
 
 /* Markdown code renderers are custom components so Mermaid can be loaded only
    for settled Mermaid fences. Astryx skips its own spacing wrapper when

From 41180a965fa36e822a449bb8d8ace90f83cc8203 Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Wed, 7 Oct 2026 15:38:21 +0800
Subject: [PATCH 18/37] fix(images): honor redaction and clarify remote consent

Disable remote load/open actions for destinations hidden by display redaction while preserving saved replay and archived-byte retries. Report network restrictions before asking for consent, distinguish non-chat copy, and document the test-only loopback grant. Correct the MCP patch provenance version.

Generated-by: Codex (GPT-6)
---
 .../src/__tests__/chat-image-delivery.test.ts |  4 +
 .../__tests__/execution-composition.test.ts   |  4 +-
 .../src/server/chat-image-delivery.ts         |  2 +-
 .../src/server/chat-image-source.ts           |  5 +-
 .../scripts/markdown-images.browser.test.mjs  | 91 ++++++++++++++++---
 packages/ui/src/markdown-image.tsx            | 40 +++++---
 packages/ui/src/shared-ui-copy.ts             |  8 ++
 7 files changed, 122 insertions(+), 32 deletions(-)

diff --git a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
index 409b6039511..ceb28a16190 100644
--- a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
+++ b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
@@ -801,6 +801,10 @@ test('remote capture requires a user action and current network authority, inclu
     assert.equal(downloads, 0);
     assert.deepEqual(await f.service.resolve(identity), { status: 'requires_confirmation' });
     f.allowRemote(false);
+    assert.deepEqual(await f.service.resolve(identity), {
+      status: 'failed',
+      reason: 'not_allowed',
+    });
     assert.deepEqual(await f.service.resolve({ ...identity, loadRemote: true }), {
       status: 'failed',
       reason: 'not_allowed',
diff --git a/packages/runtime-host/src/__tests__/execution-composition.test.ts b/packages/runtime-host/src/__tests__/execution-composition.test.ts
index ffd3615471b..db8231b508d 100644
--- a/packages/runtime-host/src/__tests__/execution-composition.test.ts
+++ b/packages/runtime-host/src/__tests__/execution-composition.test.ts
@@ -4588,7 +4588,9 @@ test('production Host never downloads remote Markdown images in restricted sessi
             request,
             context,
           );
-          return result.ok && result.result.status === 'requires_confirmation';
+          return (
+            result.ok && result.result.status === 'failed' && result.result.reason === 'not_allowed'
+          );
         }, 5000);
         assert.deepEqual(
           await captured.composition.handlers['artifact.image.resolve'](
diff --git a/packages/runtime-host/src/server/chat-image-delivery.ts b/packages/runtime-host/src/server/chat-image-delivery.ts
index 23743af105c..10358d64c96 100644
--- a/packages/runtime-host/src/server/chat-image-delivery.ts
+++ b/packages/runtime-host/src/server/chat-image-delivery.ts
@@ -119,9 +119,9 @@ export class ChatImageDeliveryService {
         return { status: 'unavailable' };
     }
     if (isRemoteImageSource(identity.source)) {
-      if (!identity.loadRemote) return { status: 'requires_confirmation' };
       if (!(await this.ports.canLoadRemote(identity.sessionId)))
         return { status: 'failed', reason: 'not_allowed' };
+      if (!identity.loadRemote) return { status: 'requires_confirmation' };
     }
     if (metadata?.status === 'failed') {
       return this.ports.admission.runOrJoin(identity.sessionId, async () => {
diff --git a/packages/runtime-host/src/server/chat-image-source.ts b/packages/runtime-host/src/server/chat-image-source.ts
index c1e36cc7a55..8d03c028d20 100644
--- a/packages/runtime-host/src/server/chat-image-source.ts
+++ b/packages/runtime-host/src/server/chat-image-source.ts
@@ -84,8 +84,9 @@ export async function downloadChatImage(
   options: { readonly loopbackOrigin?: string } = {},
 ): Promise<ChatImageBytes> {
   let url = new URL(source);
-  // Only an embedding Host's exact served origin can opt into loopback. A
-  // public source cannot acquire this grant by redirecting into that origin.
+  // Test fixtures alone pass loopbackOrigin; production callers must omit it.
+  // The fixture grant is pinned to its original exact origin, so redirects
+  // cannot acquire it or reach a different local port.
   const loopbackOrigin = url.origin === options.loopbackOrigin ? options.loopbackOrigin : undefined;
   for (let redirect = 0; redirect <= 3; redirect++) {
     signal.throwIfAborted();
diff --git a/packages/ui/scripts/markdown-images.browser.test.mjs b/packages/ui/scripts/markdown-images.browser.test.mjs
index 40696bdfcb8..35e4a36a27d 100644
--- a/packages/ui/scripts/markdown-images.browser.test.mjs
+++ b/packages/ui/scripts/markdown-images.browser.test.mjs
@@ -111,6 +111,11 @@ before(async () => {
     'hash-saved': `![Screenshot](/tmp/${'a'.repeat(48)}.png)`,
     'secret-reference-saved': `![Screenshot][picture]\n\n[picture]: ${imageUrl}/image.png?token=reference-secret`,
     'signed-streaming-race': `![Screenshot](${imageUrl}/image.png?token=stream-secret)`,
+    'signed-corrupt-saved': `![Screenshot](${imageUrl}/image.png?token=corrupt-secret)`,
+    'signed-remote': `![Screenshot](${imageUrl}/image.png?token=remote-secret)`,
+    'signed-inline': `Build ![Badge](${imageUrl}/image.png?token=inline-secret) passing.`,
+    'signed-failed': `![Screenshot](${imageUrl}/image.png?token=failed-secret)`,
+    'secret-alt': `![https://example.invalid/?token=alt-secret](${imageUrl}/image.png)`,
     'signed-preview': `![Screenshot](${imageUrl}/image.png?token=preview-secret)`,
     'signed-duplicates-saved': `![First](${imageUrl}/image.png?token=first-secret) ![Second](${imageUrl}/image.png?token=second-secret)`,
     'signed-live-saved': `![Screenshot](${imageUrl}/image.png?token=live-`,
@@ -158,7 +163,7 @@ before(async () => {
         if(mode.startsWith('badge-')) await fetch('/badge-attachment');
         if(mode==='geometry-saved') await fetch('/release-attachment');
         reads++; window.imageReads=reads; return (mode==='attachment' || mode==='read-retry-saved') && reads===1 ? {ok:false,reason:'read_failed'} :
-          {ok:true,base64:mode.startsWith('badge-') || artifactId.endsWith('badge.png') ? '${badge.toString('base64')}' : mode==='geometry-saved' || artifactId.endsWith('screenshot.png') ? '${screenshot.toString('base64')}' : mode==='corrupt-saved' && reads===1 ? 'iVBORw0KGgo=' : '${png.toString('base64')}',mimeType:'image/png'};
+          {ok:true,base64:mode.startsWith('badge-') || artifactId.endsWith('badge.png') ? '${badge.toString('base64')}' : mode==='geometry-saved' || artifactId.endsWith('screenshot.png') ? '${screenshot.toString('base64')}' : mode.endsWith('corrupt-saved') && reads===1 ? 'iVBORw0KGgo=' : '${png.toString('base64')}',mimeType:'image/png'};
       };
       const preview=mode==='preview' || mode==='signed-preview' || mode==='local';
       const seeded=mode.endsWith('saved') || mode.endsWith('saving') || race || mode.startsWith('badge-') || mode.startsWith('layout-');
@@ -168,6 +173,8 @@ before(async () => {
         window.deliverySources.push(request.source);
         if(canonicalSources[mode] && !canonicalSources[mode].includes(request.source)) return {status:'unavailable'};
         if(request.retry) window.deliveryRetries++;
+        if(mode==='restricted') return {status:'failed',reason:'not_allowed'};
+        if(mode==='signed-failed') return {status:'failed',reason:'download_failed'};
         if(!seeded) {
           if(!request.loadRemote) return {status:'requires_confirmation'};
           const response=await fetch('/capture?source='+encodeURIComponent(request.source));
@@ -281,7 +288,13 @@ for (const scenario of ['preview', 'signed-preview']) {
     requests = [];
     const page = await pageFor(scenario);
     try {
-      await page.getByText('Open in browser', { exact: true }).waitFor();
+      if(scenario==='signed-preview') {
+        await page.getByText('The image address contains hidden sensitive information. Loading and opening it are disabled.', {exact:true}).waitFor();
+        assert.equal(await page.getByText('Open in browser', {exact:true}).count(), 0);
+      } else {
+        await page.getByText('Remote images cannot be loaded here. You can open this image in your browser.', {exact:true}).waitFor();
+        await page.getByText('Open in browser', {exact:true}).waitFor();
+      }
       assert.deepEqual(requests, []);
       assert.equal(await page.locator('img').count(), 0);
       assert.equal(await page.getByRole('button', { name: 'Load image', exact: true }).count(), 0);
@@ -296,6 +309,50 @@ for (const scenario of ['preview', 'signed-preview']) {
   });
 }
 
+for (const scenario of ['signed-remote', 'signed-inline', 'signed-failed']) {
+  test(`${scenario}: hidden destinations provide no network actions, including failure and inline states`, async () => {
+    requests = [];
+    const page = await pageFor(scenario);
+    try {
+      const message = 'The image address contains hidden sensitive information. Loading and opening it are disabled.';
+      if (scenario === 'signed-inline') await page.getByRole('status', {name: message, exact: true}).waitFor();
+      else await page.getByText(message, {exact: true}).waitFor();
+      assert.equal(await page.getByRole('button', {name: 'Load image', exact: true}).count(), 0);
+      assert.equal(await page.getByRole('button', {name: 'Retry', exact: true}).count(), 0);
+      assert.equal(await page.getByText('Open in browser', {exact: true}).count(), 0);
+      assert.equal(await page.locator('a[href*="token="]').count(), 0);
+      assert.equal(await page.locator('img').count(), 0);
+      assert.doesNotMatch(await page.locator('body').innerText(), /remote-secret|inline-secret|failed-secret/);
+      assert.deepEqual(requests, []);
+    } finally { await page.close(); }
+  });
+}
+
+test('redacting only image alt text does not disable a safe destination', async () => {
+  requests = [];
+  const page = await pageFor('secret-alt');
+  try {
+    await page.getByRole('button', {name: 'Load image', exact: true}).waitFor();
+    assert.doesNotMatch(await page.locator('body').innerText(), /alt-secret/);
+    await page.getByRole('button', {name: 'Load image', exact: true}).click();
+    await loaded(page);
+    assert.equal(requests.length, 1);
+  } finally { await page.close(); }
+});
+
+test('network-restricted images show denial before any load click and can recheck permissions', async () => {
+  requests = [];
+  const page = await pageFor('restricted');
+  try {
+    await page.getByText('Image not saved: current permissions do not allow reading it or using the network.', {exact: true}).waitFor();
+    assert.equal(await page.getByRole('button', {name: 'Load image', exact: true}).count(), 0);
+    await page.getByRole('button', {name: 'Retry', exact: true}).click();
+    await page.getByText('Image not saved: current permissions do not allow reading it or using the network.', {exact: true}).waitFor();
+    await page.getByText('Open in browser', {exact: true}).waitFor();
+    assert.deepEqual(requests, []);
+  } finally { await page.close(); }
+});
+
 test('two signed destinations which redact alike replay their own saved attachments', async () => {
   requests = [];
   const page = await pageFor('signed-duplicates-saved');
@@ -350,18 +407,24 @@ test('attachment read failure recovers in place, and local paths explain how to
   } finally { await page.close(); }
 });
 
-test('a saved image decode failure retries archived bytes without touching its source', async () => {
-  const page = await pageFor('corrupt-saved');
-  try {
-    await page.getByText('Could not load the image. Try again.').waitFor();
-    assert.equal(await page.evaluate(() => window.imageReads), 1);
-    await page.getByRole('button', { name: 'Retry', exact: true }).click();
-    await page.waitForFunction(() => [...document.images].some(img => img.src.startsWith('data:image/png;') && img.naturalWidth === 1));
-    assert.equal(await page.evaluate(() => window.deliveryRetries), 0);
-    assert.equal(await page.evaluate(() => window.deliveryQueries), 1);
-    assert.equal(await page.evaluate(() => window.imageReads), 2);
-  } finally { await page.close(); }
-});
+for (const scenario of ['corrupt-saved', 'signed-corrupt-saved']) {
+  test(`${scenario}: a saved image decode failure retries archived bytes without touching its source`, async () => {
+    requests = [];
+    const page = await pageFor(scenario);
+    try {
+      await page.getByText('Could not load the image. Try again.').waitFor();
+      assert.equal(await page.evaluate(() => window.imageReads), 1);
+      await page.getByRole('button', { name: 'Retry', exact: true }).click();
+      await page.waitForFunction(() => [...document.images].some(img => img.src.startsWith('data:image/png;') && img.naturalWidth === 1));
+      assert.equal(await page.evaluate(() => window.deliveryRetries), 0);
+      assert.equal(await page.evaluate(() => window.deliveryQueries), 1);
+      assert.equal(await page.evaluate(() => window.imageReads), 2);
+      assert.deepEqual(requests, []);
+      if(scenario==='signed-corrupt-saved') assert.equal(await page.getByText('Open in browser', {exact:true}).count(), 0);
+    } finally { await page.close(); }
+  });
+
+}
 
 test('a transient saved attachment read retries its bytes without invalidating archival or touching origin', async () => {
   requests = [];
diff --git a/packages/ui/src/markdown-image.tsx b/packages/ui/src/markdown-image.tsx
index b28140d196f..f332e0ff700 100644
--- a/packages/ui/src/markdown-image.tsx
+++ b/packages/ui/src/markdown-image.tsx
@@ -30,8 +30,11 @@ import { useImageDelivery } from './image-delivery.js';
 import { getSharedUiCopy } from './shared-ui-copy.js';
 import { useUiLocale } from './locale-context.js';
 import { createMarkdownImageSourceResolver } from './markdown-image-source.js';
+import { redactSecrets } from './redact.js';
 
-const ImageSourceContext = createContext<(source: string) => string>((source) => source);
+const ImageSourceContext = createContext<(source: string) => { source: string; redacted: boolean }>(
+  (source) => ({ source, redacted: false }),
+);
 
 type PlacedImage = MarkdownExtensionNode<'maka-images', 'image', { src: string; alt: string; inline: boolean }>;
 // Placement comes from Markdown structure before bytes arrive. Never change a
@@ -72,7 +75,8 @@ export function MarkdownImageSourceProvider(props: { text: string; sources?: Rea
     const canonical = createMarkdownImageSourceResolver(props.text);
     return (source: string) => {
       const resolved = canonical(source);
-      return props.sources?.get(resolved) ?? resolved;
+      const original = props.sources?.get(resolved) ?? resolved;
+      return { source: original, redacted: props.sources?.has(resolved) === true && original !== redactSecrets(original) };
     };
   }, [props.text, props.sources]);
   return <ImageSourceContext.Provider value={resolve}>{props.children}</ImageSourceContext.Provider>;
@@ -80,10 +84,10 @@ export function MarkdownImageSourceProvider(props: { text: string; sources?: Rea
 
 /** Presentation only: Host resolves local addresses and archives; UI receives artifact identities. */
 export function MarkdownImage(props: { src: string; alt: string; inline?: boolean }) {
-  const source = useContext(ImageSourceContext)(props.src);
-  return <ImageResource key={source} src={source} alt={props.alt} inline={props.inline} />;
+  const { source, redacted } = useContext(ImageSourceContext)(props.src);
+  return <ImageResource key={source} src={source} redacted={redacted} alt={props.alt} inline={props.inline} />;
 }
-function ImageResource(props: { src: string; alt: string; inline?: boolean }) {
+function ImageResource(props: { src: string; redacted: boolean; alt: string; inline?: boolean }) {
   const copy = getSharedUiCopy(useUiLocale()).markdown;
   const anchor = useRef<HTMLSpanElement>(null);
   const [visible, setVisible] = useState(typeof IntersectionObserver === 'undefined');
@@ -108,16 +112,24 @@ function ImageResource(props: { src: string; alt: string; inline?: boolean }) {
     if (artifactId) image.retry();
     if (!artifactId) delivery.retry();
   };
+  // Redaction preserves the original identity for saved replay, never for a
+  // network action whose destination the user cannot inspect.
+  const hiddenRemote = remote && props.redacted;
+  const remoteBlocked = remote && delivery.status === 'failed' && delivery.reason === 'not_allowed';
   const sourceActions = <span className="maka-markdown-image-actions">
-    <Button variant="ghost" size="sm" label={copy.imageRetry} onClick={retry} />
-    {remote && <Link href={props.src} isExternalLink type="inherit" hasUnderline>{copy.imageOpen}</Link>}
+    {(!hiddenRemote || artifactId) && <Button variant="ghost" size="sm" label={copy.imageRetry} onClick={retry} />}
+    {remote && !hiddenRemote && <Link href={props.src} isExternalLink type="inherit" hasUnderline>{copy.imageOpen}</Link>}
   </span>;
   let message: string | undefined;
-  const needsConsent = visible && remote && !artifactId &&
-    (delivery.status === 'requires_confirmation' || !delivery.available);
+  const remotePlaceholder = visible && remote && !artifactId;
+  const needsConsent = remotePlaceholder && !hiddenRemote && delivery.status === 'requires_confirmation';
+  const remoteUnavailable = remotePlaceholder && !hiddenRemote && !delivery.available;
+  const remoteNotice = remotePlaceholder && (hiddenRemote || remoteUnavailable || needsConsent || remoteBlocked);
   if (failed) message = copy.imageLoadFailed;
   else if (!source) message = !visible ? copy.imageLoading
     : explicit && image.status === 'unavailable' ? copy.imageUnavailable
+    : remotePlaceholder && hiddenRemote ? copy.imageRemoteRedacted
+    : remoteUnavailable ? copy.imageRemoteUnavailable
     : needsConsent ? copy.imageRemoteConsent
     : delivery.status === 'failed' ? copy.imageArchiveFailure(delivery.reason)
     : delivery.status === 'pending' || artifactId ? copy.imageLoading : copy.imageUnsupported;
@@ -126,18 +138,18 @@ function ImageResource(props: { src: string; alt: string; inline?: boolean }) {
     data-maka-image-state={message ? failed ? 'failed' : 'loading' : 'ready'}>
     {message && props.inline ? <Tooltip content={message}>
       <span className="maka-markdown-image-placeholder" role="status" aria-label={message}>
-        {failed || delivery.status === 'failed'
+        {(failed || delivery.status === 'failed') && (!hiddenRemote || artifactId)
           ? <IconButton icon={<RotateCw size={14} />} size="sm" label={copy.imageRetry} onClick={retry} />
-          : needsConsent || delivery.status === 'unavailable' && visible
+          : remoteNotice || delivery.status === 'unavailable' && visible
             ? <AlertTriangle size={14} aria-hidden="true" /> : <Spinner size="sm" shade="subtle" aria-hidden="true" />}
       </span>
     </Tooltip> : message ? <span className="maka-markdown-image-placeholder">
       {props.alt && <span className="maka-markdown-image-caption">{props.alt}</span>}
-      <span role="status">{hasFrame && !failed && !needsConsent && delivery.status !== 'failed' && <Spinner size="sm" shade="subtle" aria-hidden="true" />} {message}</span>
+      <span role="status">{hasFrame && !failed && !remoteNotice && delivery.status !== 'failed' && <Spinner size="sm" shade="subtle" aria-hidden="true" />} {message}</span>
       {(failed || delivery.status === 'failed') && sourceActions}
     </span> : source && <DisplayImage key={`${source}\0${attempt}`} src={source} alt={props.alt} onError={() => setFailedSource(source)} />}
-    {needsConsent && <span className="maka-markdown-image-actions">
-      {delivery.available && <Button variant="ghost" size="sm" label={copy.imageLoad} onClick={delivery.confirmRemote} />}
+    {(needsConsent || remoteUnavailable) && <span className="maka-markdown-image-actions">
+      {needsConsent && <Button variant="ghost" size="sm" label={copy.imageLoad} onClick={delivery.confirmRemote} />}
       <Link href={props.src} isExternalLink type="inherit" hasUnderline>{copy.imageOpen}</Link>
     </span>}
   </span>;
diff --git a/packages/ui/src/shared-ui-copy.ts b/packages/ui/src/shared-ui-copy.ts
index 5a3acaef670..e3a4ec829c9 100644
--- a/packages/ui/src/shared-ui-copy.ts
+++ b/packages/ui/src/shared-ui-copy.ts
@@ -32,6 +32,8 @@ export interface SharedUiCopy {
     unsafeLink: string;
     imageLoading: string;
     imageRemoteConsent: string;
+    imageRemoteRedacted: string;
+    imageRemoteUnavailable: string;
     imageLoad: string;
     imageExpand: (alt: string) => string;
     imageArchiveFailure: (reason: import('@maka/core/image-delivery').ImageDeliveryFailure) => string;
@@ -137,6 +139,8 @@ const SHARED_UI_COPY = {
       unsafeLink: '链接不安全',
       imageLoading: '正在加载图片…',
       imageRemoteConsent: '远程图片需要授权加载，图片来源会收到请求。',
+      imageRemoteRedacted: '图片地址含已隐藏的敏感信息，无法加载或在浏览器中打开。',
+      imageRemoteUnavailable: '此处无法加载远程图片，可在浏览器中打开。',
       imageLoad: '加载图片',
       imageExpand: (alt) => alt ? `放大图片：${alt}` : '放大图片',
       imageArchiveFailure: (reason) => ({
@@ -236,6 +240,8 @@ const SHARED_UI_COPY = {
       unsafeLink: '連結不安全',
       imageLoading: '正在載入圖片…',
       imageRemoteConsent: '遠端圖片需要授權載入，圖片來源會收到請求。',
+      imageRemoteRedacted: '圖片位址含已隱藏的敏感資訊，無法載入或在瀏覽器中開啟。',
+      imageRemoteUnavailable: '此處無法載入遠端圖片，可在瀏覽器中開啟。',
       imageLoad: '載入圖片',
       imageExpand: (alt) => alt ? `放大圖片：${alt}` : '放大圖片',
       imageArchiveFailure: (reason) => ({
@@ -335,6 +341,8 @@ const SHARED_UI_COPY = {
       unsafeLink: 'Unsafe link',
       imageLoading: 'Loading image…',
       imageRemoteConsent: 'Load this remote image only if you trust its source. Loading sends a request to that source.',
+      imageRemoteRedacted: 'The image address contains hidden sensitive information. Loading and opening it are disabled.',
+      imageRemoteUnavailable: 'Remote images cannot be loaded here. You can open this image in your browser.',
       imageLoad: 'Load image',
       imageExpand: (alt) => alt ? `Enlarge image: ${alt}` : 'Enlarge image',
       imageArchiveFailure: (reason) => ({

From 77f1a00707cfdfc1607d794269b85e7592b7d90a Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Wed, 7 Oct 2026 16:01:34 +0800
Subject: [PATCH 19/37] fix(ci): exercise production WorkHub browser click path

Use BrowserSession navigation and OpenCLI native click preparation after Main closes instead of hand-dispatched down/up events. Keep the native-input and observed click-effect assertions, and dispose the acquired browser session during teardown.

Generated-by: Codex (GPT-6)
---
 .../workhub-browser-presentation-smoke.mjs    | 21 ++++++++++++-------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/apps/desktop/scripts/workhub-browser-presentation-smoke.mjs b/apps/desktop/scripts/workhub-browser-presentation-smoke.mjs
index ebbbb9f18d0..b4643a3eb14 100644
--- a/apps/desktop/scripts/workhub-browser-presentation-smoke.mjs
+++ b/apps/desktop/scripts/workhub-browser-presentation-smoke.mjs
@@ -36,6 +36,7 @@ import { registerBrowserIpc } from '../dist/main/browser-ipc-main.js';
 import { BrowserViewController } from '../dist/main/browser/controller.js';
 import { BrowserViewManager } from '../dist/main/browser/view-manager.js';
 import { browserViewHost, provideBrowserViewHost } from '../dist/main/browser/browser-host.js';
+import { withBrowserPage, releaseBrowserSession } from '../dist/main/browser/session.js';
 
 const temp = mkdtempSync(join(tmpdir(), 'maka-workhub-native-'));
 app.setPath('userData', join(temp, 'state'));
@@ -89,6 +90,7 @@ async function run() {
   const host = { visible: true, rect: { x: 0, y: 0, width: 470, height: 700 } };
   const rect = { x: 500, y: 80, width: 430, height: 560 };
   const viewport = (r) => send(main.webContents, 'browser:setViewport', scope, { sessionId, rect: r }, 'main', 1);
+  const browserSessionId = desktopSessionResourceKey({ ...scope, sessionId });
   let controller;
   try {
     await command(main.webContents, 'host', host);
@@ -99,7 +101,7 @@ async function run() {
     await send(main.webContents, 'browser:document-ready', 'main');
     await send(main.webContents, 'browser:active-session', scope, sessionId, 'main', 1);
     // Use the actual IPC owner resolver, not an independently constructed tree.
-    controller = views.getOrCreate(desktopSessionResourceKey({ ...scope, sessionId }));
+    controller = views.getOrCreate(browserSessionId);
     await controller.navigate(`${url}/page`);
     await viewport(rect);
 
@@ -177,9 +179,12 @@ async function run() {
     await wait(100);
     assert.ok(controller.hasParent(ownerParent));
     assert.equal(controller.state().hasPage, true);
-    const closedMainLease = controller.beginBackgroundAction();
-    await closedMainLease.ready;
-    await controller.navigate(`${url}/page?main-closed`);
+    // Use the same navigation, target preparation and native input path as
+    // WorkHub tools. A hand-built down/up pair skips OpenCLI's DOM scrolling,
+    // hit testing and pointer positioning after the hidden view is reparented.
+    await withBrowserPage(browserSessionId, 'navigate after Main closes',
+      (page) => page.goto(`${url}/page?main-closed`, { waitUntil: 'load' }),
+      { takeover: 'navigate' });
     const page = ownerParent.children.find((child) => 'webContents' in child && child.webContents !== owner).webContents;
     // The view was just reparented into the floating window and navigated.
     // Under Xvfb it may not have committed a frame (and hit-test data) in its
@@ -193,9 +198,9 @@ async function run() {
       if (document.readyState === 'complete') frames(); else addEventListener('load', frames, { once: true });
     })`);
     console.log(`Background page input readiness: ${readiness.via}, ${readiness.visibility}`);
-    const point = await page.executeJavaScript(`(() => { const r = document.querySelector('button').getBoundingClientRect(); return {x:r.x+r.width/2,y:r.y+r.height/2}; })()`);
-    await page.debugger.sendCommand('Input.dispatchMouseEvent', { type: 'mousePressed', ...point, button: 'left', buttons: 1, clickCount: 1 });
-    await page.debugger.sendCommand('Input.dispatchMouseEvent', { type: 'mouseReleased', ...point, button: 'left', buttons: 0, clickCount: 1 });
+    const click = await withBrowserPage(browserSessionId, 'click after Main closes',
+      (page) => page.click('button'), { takeover: 'mutate' });
+    assert.equal(click.click_method, 'cdp', 'background click must use native input, not a DOM fallback');
     // CDP input acknowledgement can precede the renderer's click handler on
     // Linux. Observe its effect without dispatching another click, so a lost
     // event or broken background-page attachment still fails this smoke.
@@ -207,9 +212,9 @@ async function run() {
       await wait(20);
     } while (Date.now() < clickDeadline);
     assert.equal(buttonText, 'Clicked', 'background page must handle the native click after Main closes');
-    await closedMainLease.release();
     console.log('PASS closing Main preserves the background page and native clicks');
   } finally {
+    await releaseBrowserSession(browserSessionId);
     await views.disposeAll();
     provideBrowserViewHost(null);
     presentation.dispose();

From 08eff1746e6beaccf31988bb7b4de747efc46f22 Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Wed, 7 Oct 2026 17:15:46 +0800
Subject: [PATCH 20/37] fix(review): remove unrelated WorkHub smoke changes

Move the background-click smoke fix to a separate change so chat image delivery can be reviewed independently.

Generated-by: Codex (GPT-6)
---
 .../workhub-browser-presentation-smoke.mjs    | 21 +++++++------------
 1 file changed, 8 insertions(+), 13 deletions(-)

diff --git a/apps/desktop/scripts/workhub-browser-presentation-smoke.mjs b/apps/desktop/scripts/workhub-browser-presentation-smoke.mjs
index b4643a3eb14..ebbbb9f18d0 100644
--- a/apps/desktop/scripts/workhub-browser-presentation-smoke.mjs
+++ b/apps/desktop/scripts/workhub-browser-presentation-smoke.mjs
@@ -36,7 +36,6 @@ import { registerBrowserIpc } from '../dist/main/browser-ipc-main.js';
 import { BrowserViewController } from '../dist/main/browser/controller.js';
 import { BrowserViewManager } from '../dist/main/browser/view-manager.js';
 import { browserViewHost, provideBrowserViewHost } from '../dist/main/browser/browser-host.js';
-import { withBrowserPage, releaseBrowserSession } from '../dist/main/browser/session.js';
 
 const temp = mkdtempSync(join(tmpdir(), 'maka-workhub-native-'));
 app.setPath('userData', join(temp, 'state'));
@@ -90,7 +89,6 @@ async function run() {
   const host = { visible: true, rect: { x: 0, y: 0, width: 470, height: 700 } };
   const rect = { x: 500, y: 80, width: 430, height: 560 };
   const viewport = (r) => send(main.webContents, 'browser:setViewport', scope, { sessionId, rect: r }, 'main', 1);
-  const browserSessionId = desktopSessionResourceKey({ ...scope, sessionId });
   let controller;
   try {
     await command(main.webContents, 'host', host);
@@ -101,7 +99,7 @@ async function run() {
     await send(main.webContents, 'browser:document-ready', 'main');
     await send(main.webContents, 'browser:active-session', scope, sessionId, 'main', 1);
     // Use the actual IPC owner resolver, not an independently constructed tree.
-    controller = views.getOrCreate(browserSessionId);
+    controller = views.getOrCreate(desktopSessionResourceKey({ ...scope, sessionId }));
     await controller.navigate(`${url}/page`);
     await viewport(rect);
 
@@ -179,12 +177,9 @@ async function run() {
     await wait(100);
     assert.ok(controller.hasParent(ownerParent));
     assert.equal(controller.state().hasPage, true);
-    // Use the same navigation, target preparation and native input path as
-    // WorkHub tools. A hand-built down/up pair skips OpenCLI's DOM scrolling,
-    // hit testing and pointer positioning after the hidden view is reparented.
-    await withBrowserPage(browserSessionId, 'navigate after Main closes',
-      (page) => page.goto(`${url}/page?main-closed`, { waitUntil: 'load' }),
-      { takeover: 'navigate' });
+    const closedMainLease = controller.beginBackgroundAction();
+    await closedMainLease.ready;
+    await controller.navigate(`${url}/page?main-closed`);
     const page = ownerParent.children.find((child) => 'webContents' in child && child.webContents !== owner).webContents;
     // The view was just reparented into the floating window and navigated.
     // Under Xvfb it may not have committed a frame (and hit-test data) in its
@@ -198,9 +193,9 @@ async function run() {
       if (document.readyState === 'complete') frames(); else addEventListener('load', frames, { once: true });
     })`);
     console.log(`Background page input readiness: ${readiness.via}, ${readiness.visibility}`);
-    const click = await withBrowserPage(browserSessionId, 'click after Main closes',
-      (page) => page.click('button'), { takeover: 'mutate' });
-    assert.equal(click.click_method, 'cdp', 'background click must use native input, not a DOM fallback');
+    const point = await page.executeJavaScript(`(() => { const r = document.querySelector('button').getBoundingClientRect(); return {x:r.x+r.width/2,y:r.y+r.height/2}; })()`);
+    await page.debugger.sendCommand('Input.dispatchMouseEvent', { type: 'mousePressed', ...point, button: 'left', buttons: 1, clickCount: 1 });
+    await page.debugger.sendCommand('Input.dispatchMouseEvent', { type: 'mouseReleased', ...point, button: 'left', buttons: 0, clickCount: 1 });
     // CDP input acknowledgement can precede the renderer's click handler on
     // Linux. Observe its effect without dispatching another click, so a lost
     // event or broken background-page attachment still fails this smoke.
@@ -212,9 +207,9 @@ async function run() {
       await wait(20);
     } while (Date.now() < clickDeadline);
     assert.equal(buttonText, 'Clicked', 'background page must handle the native click after Main closes');
+    await closedMainLease.release();
     console.log('PASS closing Main preserves the background page and native clicks');
   } finally {
-    await releaseBrowserSession(browserSessionId);
     await views.disposeAll();
     provideBrowserViewHost(null);
     presentation.dispose();

From 4329f9c40de9d569b903b35b7e8ec1ad780fe8a7 Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Wed, 7 Oct 2026 17:19:24 +0800
Subject: [PATCH 21/37] fix(images): remove test-only loopback grant from
 downloader

Keep network fixture routing in tests at the Node DNS and HTTP boundary. Exercise the production downloader without an address-policy exception, including private redirects, mixed DNS, byte limits, downgrade prevention and cancellation. Assert that the former runtime option no longer grants loopback access.

Generated-by: Codex (GPT-6)
---
 .../src/__tests__/chat-image-delivery.test.ts | 190 +++++++++++++++---
 .../src/server/chat-image-source.ts           |   9 +-
 2 files changed, 164 insertions(+), 35 deletions(-)

diff --git a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
index ceb28a16190..5e6d78afeca 100644
--- a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
+++ b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
@@ -18,12 +18,15 @@
  */
 
 import assert from 'node:assert/strict';
-import { test } from 'node:test';
+import { test, type TestContext } from 'node:test';
 import { mkdtemp, mkdir, readFile, writeFile, rm, stat } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { pathToFileURL } from 'node:url';
-import { createServer } from 'node:http';
+import http, { createServer, type RequestOptions, type IncomingMessage } from 'node:http';
+import https from 'node:https';
+import dns from 'node:dns/promises';
+import { syncBuiltinESMExports } from 'node:module';
 import { createHash } from 'node:crypto';
 import { createImageFileReader, ImageFileReadError } from '@maka/runtime/image-file-reader';
 import { FilesystemWorkerClientError } from '@maka/runtime/filesystem-worker';
@@ -43,6 +46,46 @@ const PNG = Buffer.from(
   'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8DwHwAFBQIAX8jx0gAAAABJRU5ErkJggg==',
   'base64',
 );
+// Mock only Node's DNS/transport boundary. The production downloader still
+// checks public addresses, pins DNS, follows redirects and validates HTTP bytes.
+// Top-level tests in this file run serially; restore the ESM bindings at teardown.
+function publicImageOrigin(t: TestContext, localSource: string, protocol = 'http:'): string {
+  const local = new URL(localSource);
+  const source = new URL(localSource);
+  source.hostname = 'image.example';
+  source.protocol = protocol;
+  const request = http.request;
+  t.mock.method(dns, 'lookup', async (host: string) => {
+    assert.equal(host, source.hostname);
+    return [{ address: '93.184.216.34', family: 4 }];
+  });
+  const transport = (
+    url: URL,
+    options: RequestOptions,
+    callback: (res: IncomingMessage) => void,
+  ) => {
+    assert.equal(url.origin, source.origin);
+    assert.ok(options.lookup);
+    options.lookup(url.hostname, { all: true }, (error, addresses) => {
+      assert.equal(error, null);
+      assert.deepEqual(addresses, [{ address: '93.184.216.34', family: 4 }]);
+    });
+    return request(
+      new URL(url.pathname + url.search, local),
+      { ...options, lookup: undefined },
+      callback,
+    );
+  };
+  t.mock.method(http, 'request', transport);
+  t.mock.method(https, 'request', transport);
+  syncBuiltinESMExports();
+  t.after(() => {
+    t.mock.restoreAll();
+    syncBuiltinESMExports();
+  });
+  return source.href;
+}
+
 const REQUEST = {
   sessionId: 'session-1',
   turnId: 'turn-1',
@@ -65,7 +108,6 @@ async function fixture(
   const errors: unknown[] = [];
   const presentationErrors: unknown[] = [];
   let remoteAllowed = true;
-  let loopbackOrigin: string | undefined;
   let reads = 0;
   let leases = 0;
   const messages = new Map<string, string>();
@@ -83,8 +125,7 @@ async function fixture(
     limits,
     sourceReadTimeoutMs: 1000,
     canLoadRemote: async () => remoteAllowed,
-    download:
-      download ?? ((source, signal) => downloadChatImage(source, signal, { loopbackOrigin })),
+    download: download ?? downloadChatImage,
     isPresent: async () => present,
     readMessage: async (i) => messages.get(i.messageId),
     readLocalImage: async (sessionId, path, signal) => {
@@ -114,9 +155,6 @@ async function fixture(
     allowRemote(value: boolean) {
       remoteAllowed = value;
     },
-    trustRemoteOrigin(source: string) {
-      loopbackOrigin = new URL(source).origin;
-    },
     get reads() {
       return reads;
     },
@@ -427,7 +465,7 @@ test('missing encoded sources never double-decode file URLs or retry invalid esc
   }
 });
 
-test('remote delivery is downloaded once, remains replayable after the origin server disappears, and sends no credentials/referrer', async () => {
+test('remote delivery is downloaded once, remains replayable after the origin server disappears, and sends no credentials/referrer', async (t) => {
   const f = await fixture();
   let requests = 0;
   const server = createServer((req, res) => {
@@ -439,9 +477,11 @@ test('remote delivery is downloaded once, remains replayable after the origin se
     res.end(PNG);
   });
   await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
-  const source = `http://127.0.0.1:${(server.address() as import('node:net').AddressInfo).port}/image.png`;
+  const source = publicImageOrigin(
+    t,
+    `http://127.0.0.1:${(server.address() as import('node:net').AddressInfo).port}/image.png`,
+  );
   try {
-    f.trustRemoteOrigin(source);
     f.messages.set(REQUEST.messageId, `![Screenshot](${source})`);
     observe(f.service, source);
     await f.service.waitForIdle();
@@ -499,7 +539,7 @@ test('transient failure is persisted and is retried only on an explicit request'
   }
 });
 
-test('truncated HTTP images are rejected, and an explicit retry archives the repaired source', async () => {
+test('truncated HTTP images are rejected, and an explicit retry archives the repaired source', async (t) => {
   const f = await fixture();
   let content = PNG.subarray(0, 8);
   let requests = 0;
@@ -509,10 +549,12 @@ test('truncated HTTP images are rejected, and an explicit retry archives the rep
     res.end(content);
   });
   await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
-  const source = `http://127.0.0.1:${(server.address() as import('node:net').AddressInfo).port}/image.png`;
+  const source = publicImageOrigin(
+    t,
+    `http://127.0.0.1:${(server.address() as import('node:net').AddressInfo).port}/image.png`,
+  );
   const identity = { ...REQUEST, source, loadRemote: true };
   try {
-    f.trustRemoteOrigin(source);
     f.messages.set(REQUEST.messageId, `![Screenshot](${source})`);
     await f.service.resolve(identity);
     await f.service.waitForIdle();
@@ -750,7 +792,7 @@ test('copying a conversation carries delivery provenance and saved bytes; it doe
     await f.close();
   }
 });
-test('source readers reject oversized payloads, unsafe MIME and redirects to private networks', async () => {
+test('source readers reject oversized payloads, unsafe MIME and redirects to private networks', async (t) => {
   assert.throws(() => checkedChatImage(Buffer.alloc(2 * 1024 * 1024 + 1)), /too_large/);
   assert.throws(() => checkedChatImage(Buffer.from('<svg/>')), /unsupported_mime/);
   const server = createServer((_req, res) => {
@@ -759,17 +801,104 @@ test('source readers reject oversized payloads, unsafe MIME and redirects to pri
   });
   await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
   try {
-    const source = `http://127.0.0.1:${(server.address() as import('node:net').AddressInfo).port}/redirect`;
+    const source = publicImageOrigin(
+      t,
+      `http://127.0.0.1:${(server.address() as import('node:net').AddressInfo).port}/redirect`,
+    );
+    await assert.rejects(downloadChatImage(source, AbortSignal.timeout(2000)), /not_allowed/);
+  } finally {
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+  }
+});
+test('HTTP download enforces header/stream limits, redirect budget and cancellation', async (t) => {
+  const server = createServer((req, res) => {
+    if (req.url === '/length') {
+      res.writeHead(200, { 'content-length': 2 * 1024 * 1024 + 1 });
+      res.end();
+    } else if (req.url === '/stream') {
+      res.writeHead(200);
+      res.write(Buffer.alloc(2 * 1024 * 1024 + 1));
+      res.end();
+    } else if (req.url === '/redirect') {
+      res.writeHead(302, { location: '/redirect' });
+      res.end();
+    } else if (req.url === '/stalled') {
+      // Keep the response open until the downloader's cancellation closes it.
+    } else {
+      res.writeHead(503);
+      res.end();
+    }
+  });
+  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+  const source = publicImageOrigin(
+    t,
+    `http://127.0.0.1:${(server.address() as import('node:net').AddressInfo).port}/`,
+  );
+  try {
+    for (const [path, reason] of [
+      ['length', 'too_large'],
+      ['stream', 'too_large'],
+      ['redirect', 'download_failed'],
+      ['unavailable', 'download_failed'],
+    ]) {
+      await assert.rejects(
+        downloadChatImage(source + path, AbortSignal.timeout(2000)),
+        new RegExp(reason),
+      );
+    }
+    await assert.rejects(downloadChatImage(source + 'stalled', AbortSignal.timeout(50)), {
+      name: 'AbortError',
+    });
+  } finally {
+    server.closeAllConnections();
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+  }
+});
+
+test('HTTPS download cannot redirect to HTTP', async (t) => {
+  let requests = 0;
+  const server = createServer((_req, res) => {
+    requests++;
+    res.writeHead(302, { location: 'http://image.example/image.png' });
+    res.end();
+  });
+  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+  const source = publicImageOrigin(
+    t,
+    `http://127.0.0.1:${(server.address() as import('node:net').AddressInfo).port}/`,
+    'https:',
+  );
+  try {
+    await assert.rejects(downloadChatImage(source, AbortSignal.timeout(2000)), /not_allowed/);
+    assert.equal(requests, 1);
+  } finally {
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+  }
+});
+
+test('DNS answers containing any private address are denied before a request', async (t) => {
+  const answers = [
+    { address: '93.184.216.34', family: 4 },
+    { address: '127.0.0.1', family: 4 },
+  ];
+  const lookup = t.mock.method(dns, 'lookup', async () => answers);
+  const request = t.mock.method(http, 'request', () => {
+    assert.fail('unsafe DNS must not reach transport');
+  });
+  syncBuiltinESMExports();
+  try {
     await assert.rejects(
-      downloadChatImage(source, AbortSignal.timeout(2000), {
-        loopbackOrigin: new URL(source).origin,
-      }),
+      downloadChatImage('http://image.example/image.png', AbortSignal.timeout(1000)),
       /not_allowed/,
     );
+    assert.equal(lookup.mock.callCount(), 1);
+    assert.equal(request.mock.callCount(), 0);
   } finally {
-    await new Promise<void>((resolve) => server.close(() => resolve()));
+    t.mock.restoreAll();
+    syncBuiltinESMExports();
   }
 });
+
 test('resolver codec rejects excess fields and noncanonical artifact identities', () => {
   const spec = IMAGE_DELIVERY_OPERATION_SPECS['artifact.image.resolve'];
   assert.deepEqual(spec.decodeInput(REQUEST), REQUEST);
@@ -906,7 +1035,7 @@ test('a Markdown parser failure stays in presentation and subsequent images stil
   }
 });
 
-test('loopback is denied before GET and a served-origin grant cannot follow another local port', async () => {
+test('loopback is denied before GET, including redirects from a public origin', async (t) => {
   let hits = 0;
   const target = createServer((_req, res) => {
     hits++;
@@ -919,16 +1048,23 @@ test('loopback is denied before GET and a served-origin grant cannot follow anot
     res.end();
   });
   await new Promise<void>((resolve) => origin.listen(0, '127.0.0.1', resolve));
-  const source = `http://127.0.0.1:${(origin.address() as import('node:net').AddressInfo).port}/redirect`;
   try {
-    for (const url of [targetUrl, 'http://[::1]:80/image.png'])
-      await assert.rejects(downloadChatImage(url, AbortSignal.timeout(1000)), /not_allowed/);
+    // An untyped caller passing the former fixture option cannot grant access.
     await assert.rejects(
-      downloadChatImage(source, AbortSignal.timeout(1000), {
-        loopbackOrigin: new URL(source).origin,
-      }),
+      Reflect.apply(downloadChatImage, undefined, [
+        targetUrl,
+        AbortSignal.timeout(1000),
+        { loopbackOrigin: new URL(targetUrl).origin },
+      ]),
       /not_allowed/,
     );
+    const source = publicImageOrigin(
+      t,
+      `http://127.0.0.1:${(origin.address() as import('node:net').AddressInfo).port}/redirect`,
+    );
+    for (const url of [targetUrl, 'http://[::1]:80/image.png'])
+      await assert.rejects(downloadChatImage(url, AbortSignal.timeout(1000)), /not_allowed/);
+    await assert.rejects(downloadChatImage(source, AbortSignal.timeout(1000)), /not_allowed/);
     assert.equal(hits, 0);
   } finally {
     await Promise.all(
diff --git a/packages/runtime-host/src/server/chat-image-source.ts b/packages/runtime-host/src/server/chat-image-source.ts
index 8d03c028d20..84364ca23a8 100644
--- a/packages/runtime-host/src/server/chat-image-source.ts
+++ b/packages/runtime-host/src/server/chat-image-source.ts
@@ -81,24 +81,17 @@ export function decodedLocalImagePath(source: string): string | undefined {
 export async function downloadChatImage(
   source: string,
   signal: AbortSignal,
-  options: { readonly loopbackOrigin?: string } = {},
 ): Promise<ChatImageBytes> {
   let url = new URL(source);
-  // Test fixtures alone pass loopbackOrigin; production callers must omit it.
-  // The fixture grant is pinned to its original exact origin, so redirects
-  // cannot acquire it or reach a different local port.
-  const loopbackOrigin = url.origin === options.loopbackOrigin ? options.loopbackOrigin : undefined;
   for (let redirect = 0; redirect <= 3; redirect++) {
     signal.throwIfAborted();
     if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password)
       throw new ImageSourceError('not_allowed');
     const host = url.hostname.replace(/^\[|\]$/g, '');
-    const literalLoopback =
-      !!loopbackOrigin && url.origin === loopbackOrigin && (host === '127.0.0.1' || host === '::1');
     const addresses = isIP(host)
       ? [{ address: host, family: isIP(host) }]
       : await abortable(() => lookup(host, { all: true }), signal);
-    if (!addresses.length || (!literalLoopback && addresses.some((a) => !publicAddress(a.address))))
+    if (!addresses.length || addresses.some((a) => !publicAddress(a.address)))
       throw new ImageSourceError('not_allowed');
     const target = addresses[0]!;
     const response = await new Promise<import('node:http').IncomingMessage>((resolve, reject) => {

From 37ac2492ef88060a55a3b6043368d876ba7247e0 Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Wed, 7 Oct 2026 19:53:37 +0800
Subject: [PATCH 22/37] fix(ui): enlarge chat images directly on click

Remove the separate expand control and hover affordance. Keep keyboard activation and restore focus after closing the image preview.

Generated-by: Codex (GPT-6)
---
 .../pr/chat-image-delivery/click-after.png    | Bin 0 -> 60327 bytes
 .../pr/chat-image-delivery/click-before.png   | Bin 0 -> 61189 bytes
 .../pr/chat-image-delivery/click-enlarged.png | Bin 0 -> 4496 bytes
 .../scripts/markdown-images.browser.test.mjs  |  57 ++++++++++++++++--
 packages/ui/src/markdown-image.tsx            |  19 ++++--
 packages/ui/src/styles.css                    |  19 ++----
 6 files changed, 72 insertions(+), 23 deletions(-)
 create mode 100644 docs/images/pr/chat-image-delivery/click-after.png
 create mode 100644 docs/images/pr/chat-image-delivery/click-before.png
 create mode 100644 docs/images/pr/chat-image-delivery/click-enlarged.png

diff --git a/docs/images/pr/chat-image-delivery/click-after.png b/docs/images/pr/chat-image-delivery/click-after.png
new file mode 100644
index 0000000000000000000000000000000000000000..b9d4268f04917a8f5007f42b3b00d5a744a77825
GIT binary patch
literal 60327
zcmY&fWmMGL+a0>Qhwkp~p}V`gL%Jk}?x8!R8>A(b?(P!l21x}(eU*Fff35e!e3@^*
zb<TcvJp06|tIDAv1Cap$0Gfilv?c%mJ@@CQj|lzepP?1mU;qFUpdc-w?U#S?(`9A9
z3!Ntl`ob6SyKTKS+4xo}6iuls6^4cm1?}eNw})y==x#GtqnWh9u}oC}%olPj3s$v^
z-}@oIzubKj_~lOe`w8<Y<acM#uRAq?;9pPAPD5V>qw1}q(pGLBR%^kHEd0$B-&t&f
zG)-t9LyzkWgBwT&k7w=Do6rSkBn%8{&QnjjjPZ!sq;)KcpLL%G<*XGNwB}TK9r5^l
zairw7mNm39ho9RB41V=JytStKeLNB_t~dQiB$`Ad;__33103#hO#1l574pkFbI(dg
zg!Ag`8<2-Tfh6zVGtdwJgdv&Uw)^YgyW<~YOwi>chho4Q(7SLc%@1pwG#x~O_nF5t
z>vt0Yra}8X&*Hz||DH4~WEwOiV>#ai`c>SyE93Sr<|P%NXat7hH{_h3<eR=v?c@2h
z<!I)1_(c9uct+J&j4fdZdnq4}E%{jjj{;RO#`|*iJtsD04d^89-5`8Nv8w!mdy#of
zhPNo*BnAUJczUl2XA7EP0%u?bKQj)=P72|z<eXZJ5y)A5>`0JrfvO?Yt<9G7ovmXB
z(&r;(KiH$)?+%Y|XgnY<LCE{HXVMl`N=&oKze>V}3hM6GR6hTD*F+6^Z$U(;p8yQj
z^UtOVb%$t{J{~l5HDh?r6zYk-|LARMFd1HMCP2n|ev_Mr*g$P1u^P~TZ&?2Y9<iTh
zZ}0OLoNF)~b*Kd=2Q@3;;D-Db+5AN)#~bPp2ZU?|NQz|yTLJRvMUu;D<#?M})B+Cr
z#9(YDCPUodg{XAEU(W{U84E$!YbYjM@ESZJ-a1|P3iA`r+4KXy<u!LZ8|_nVid$5r
z?}71i$zQJsP}JHOGJCX1--c54YeLP5|9*LXV#U^!n2kqA4?9xZMEp4X&W;gVBo*oQ
z{0>A6qsV=(Z$?7BU#dMbCUHDX7vcr&=6HW0Q+Ocy{?FN+_cUiBD1CAhF}$9*YA!uO
z8IzyOemN66m-ykYs{oHvL6Ag*l$&Qa<+fLnFgbK9T~1-3_>#@h1g|nUIFyC24_Fy=
z0G8A0%w=zB(H&7JwKTt|f=w3&cWKluYmwGe9}z;40khfMd6}cwRv{FGicXEfp;QE2
z*g2s|7aXW#f&rd23-U};kg68+1>zrKMXqX7^z;w`Hx4Ks1m`EXk}=W@l!v~vpTKoY
zv}jgxUie)zZ9@92-VKBulJD_T5O0h8#WIsj2YdUzE`qniH?N20^}j<KrH&X4G9U|z
zS*ML6yo@<Nr_rw`4=z0HB%O4P7~8q~v<~eC1yFvDiuT9;Vs3Bn&9sR630q`Cwgl+{
zC9G`XSCfBORDWPWl<S&DxU6%Z&o^%xp9z6Wg!z{zal-X5MUNftd;SwzFvQR*D6$0F
zA9<k{^JCZKiitFY8rRyJjP9!dlkb8Ix;tMIf6P8DcA^i>o#LLts$ZYPjsl(u3|$yK
zFkdPUAard__gm(>CRW0|Shn$F2VPf5?X>tXM(XmxNYQWIw1FbBx26w0&ny1Rx7Mcw
z5IK~-B~*BWQYi!dRNaLDF^LD*<tG-QYKo~6kUIBshUh!D&h+75_|J1FPC6WZ>3FWh
zp(%~>Kp|ZQayBZW)EgiV9qUG^q2o|xkhvsI@@mwgF!R6%Ak=CDLBdtTS2r<qq9<mR
zh7*SqSUhOa<{Q$u31wRc#QJ$v);%0u7dbmek^>QT<U}@0zXdzea;$UUXYt!-iqDmc
z8)fwgSxU6J7#u2Y-%(|Q6MKcF&}?`(5`AZx&;1{U?`jUK7uZRX@UxhC9>ds+4k&-I
zmvEq}s!>v?RB=3qrSH%X<?o`4+e4|$kCPzuLs33fMa4At^s*%QS;T!J7y<}~>08R^
zwCL>bm=&3M=HfzX%Y{9ZW4I>Ul=!s9j>>}U$1tyuVWDD&xZ8jaP87Pa%wTkHgy|PT
zOL`4BNt`1VwtW)wF!yZ;i6#Uh<V1XWju>!NmuR9QFl+XW^jPE?2n#VV&xqUz_mjdD
zzgDUeZEHE!nXP?OpvQ`l8NBP)VP6l-!4laP01z_rfs$eHyJA&wpRh0}sh0M5_Prmu
zpLz&xIO`7LlRpz0)2MQ#aBu=-UXYk95;Ux_UG;;r_ZZe2)?j_t`WKOJOh7_qlw&>S
z_@>i^a-qvi)sRrF0zcaqE&VJNQ~C;3qBJR{Zmv>1K_7ePskK(c<s*%1k<$$Dba(oe
zIk#;-fAr9tjW&WmstR=e&0>U^6p4Qv7L~eNBLR!;0P9y-Z>_{3m9PHGcW1)KI+JOC
zrdc8Dy>^-?&2CKKHFQ2p>Dmd{<QPZI9jov%a67ugpy3Q5h+(l><b5r$ffts1C`UY5
zT%Q6AP&F34qr&%hNsiTKL^@;;&wv+mXDm!1ODU%TOLuPaTRQoF%3&xzgD~0y?YTno
zz&!BtoVs6<Is_ABN`8Y5z}&?WQD;9)VXDw?zTOT|3#C|-C^nAeOT81=J2-iX#sWIR
z`MOaaR(TVd2JG5dyV0){b%P9^EgBjp-kk@p^HIHbgU8Z8qh^vg%fKt=A2|7O{Q2sC
zA9fg`KN(JYa)kREXE|G#CgD-Z88CH_Mqc!ms8ucgPBP}<#I8piW=K6*%`ZhI)JZ~^
zZ&!8;+SYgvSC2Y((v5{ox{9X^7mVev%}4#EKPak9R^oYNd%i&h;W|AxCgR&#B^nLe
z1as!$*5V8COrUIVk@pDHPT%zz9yVqK%a(dLg%T>E$Z}%X^N=(aG(z*mowkzf(T5E6
z=dIAmqkGsL^nTlSXk@2El}$kWx9Q>bV4^wkMJ8MIVX1=$pM1~LSO<8U4*`F1zWoR1
z#ttZ>rL>{eIke-&1NR`9k?Y3JwM|U#lpjPRTOzW0SJuH{4_`4SV<m7LFr@-tfM6E8
zr7kbnmGwmi*Kt0&%Nbo=<0|AF`}tg?ySltJ>M`<LD(g%-;_RdtHct}y31Zk;=RN>H
zSPxTn%q(B_u+AdP%Enndv8S&|W|N74DibG;Y2w6~`UEe21j6o!NN8%kbc)=!qx|W!
zz`YcFP*@2jc7b9M{ZBeCnCI}6-%Dml(`hNF45_)PpNN`-mlgPC<=S$QqryjVQU5>R
z7)^+>w)go4h@8xrbCnq6S_g%b3813v!Kkn`#-!)(jp%$wazzLK7ERe!r*p`Og!4IH
zGNW-f?#iT+VgRJrnlvW6N$>*4xXs(Y!ETO~zeIdMl5#DC(pNSPFU|ez+bBnx&7qAD
zkk?xXWta=O91kvAm@^-9Mt$@W8W==cwe}1@*3|Pr6!>OCPw=>Tv}Zd^p6Dms>_gOB
z@WEeoXzLII5uK1GOT-`?mA7XEtqWN(Hwe^nq`xHY7~$IyqD}ldjR*dn#vzh%^7hpf
z{m!EHG;})#Vsr{<1i$CQNn(Vl4|6$i2Mt}g<Wi~aX@j@&k1};w_FJe?2DSqwIneNJ
z0DA{Kk>riX$Q(Ec%W3*NPKb`5k$YFXwUB^~e3~>```EzvWWhXjMe``lSVc09L)1|l
zMAIqUq+)oOfiso_9_X7jvm<s6Q<o94oLd$HgX3zTBoM%w@$_3=`P3^3D8^$;g>1Hr
z9LBxgR(Ve9K&mow_MB}B?Ms?Q-q-tgs<FTOcdE5ZTfB?iLK8b;bkmuv?dCehypx_;
zm?oL>m%oMu_URiUG8|#?q333;<4Fi3^A;1sLi))S<O<Hw=S0@D_^}0ck}jOcxrOH8
zig#o?zr&3uw_=PhLRsy3h7UGlttq0o!J?bvs!|2bk1XjdHYMt1mNkCr%6I0Kt2Z|;
z4akp{RJi|EEDtvdb)>G9!T8O*)NWxh7sb<PydKwhDLHxsC%^Y)W0<Q=&~Uc4P|r;0
zecfUIA1ax}=U?asbK-(Tz$6^5LROzv)JlDH0H)GStl1z0P8RY>2_ais-MP%3xrA)B
zGHKM+ajUHyNkjEiMp#hLt#g(hQ32xc*HE<*L>Q-d1`-95X*0dXULgdI#GvsxOIQ|0
z*pH(~juKmKhF0>Mg5CfN&MaO(-i5=|?={T!wO=;V!W83P1X*^63kssXltfJk8d%9)
zD%Mq?_o1<6CSrSf&P)BsT~P+O35u^cv}(u4Ji9rPS=%%52eo4ehduP1`9EabP5e>M
zKL>97pe6}FJ$XY7O!c)i#Y&B#=T*!pjJh@mC&XCNY(968y|m%aAhsFveFcNz9Q7s0
z2fSED2`;A$)4$EGD+^U}8<nsJW^)~~F%WB2XG9UAFfy8xufg6U32wDef<L#SsbOw2
z+C#^c94LB<U>zqJ24bf_1Ofcy*nUt`G$ZVR2R`lx&EkIJD<`fw*2IgmhFOuKZ~EOM
z*Xo<*(n2*#CGol70R@MfMiwKzYvu?U)Xs*f+c;ubGKr`GimEDCtGL2z)@|gZL)*Bk
zIbP<UVRrIwyl-BUi(ktkB&uu7K?A5cB=;W5c>vrR<b_He+}lVX($Q1Q2J&?v4mnH#
zN*Kibur_TBn<H<l0`QVen<`8Lo|I=37yTK+O`0Fn{kxeAXa&QR{^)x3cUzM<K~=>s
z4zOxO-DVoXx{|)b63hx}Dkv1Z9azXc+;fUAAS#`n*(vD>lffy(erMKFg5qzIoNjc)
z{BzzjJo0*^d+RCIY(_yB2pWTL@>s~qh;SlSz&j_)YzC^*$2;nJ8I&8ZV4wL<dQFZM
z1+YU)C%6fj7ktyBMqDg)?hIBrzn7eGIL0V~r(DwiQaPD9ZZ2f2DSKP4bF@c>fBzzz
z(}rYJ>puu9)UZmE%GO@sGNWaeqV8KJE&p;fz)!zYh3Uo<*#)E1h$)T`TZ@Z5&{=!P
zbD>K65|L@njNanJphT0<Uj4n9yZ`VvVVMrg)~q;8%BS?Ju}6P9fntqVTXHlg$bn;>
zAGE$;gv6ns<NL-9xl+TiLvZ8GvAXJ_JjlitM)~vL^TO8MR&_?|j8!=mo`P%7_CKdo
zn|Z9*txd*?)9-!{pB9yk6o$h_5{3fJ{DsPQW#r}|-*PZAu%nHE{Q$m#V0kh*uhE|6
zGwM|QH#32ZAa*U>k<@obL_CLvf*vkuxiXzc_b>($%JbBzy0WPm@#1&%OB?dHq?QZT
z+1*(M_yX@2s%wWPnwx^PU7Zzx@dY(g?Na$BUUXWDN$yK@84}E*cn52>%!??=*FE9r
zWneG6I$3x9pLN0tMR<b|i~s_x?oPur)oW}2o)L>M`n1{ZY1uNfz;Az%)b>YU{+$X*
z_#bM^dFsL{Br~;0s_Cc4qf21<oC-Czl$oKh@F7yec~kNf)}wT4l4(&-Wykr_c=OhH
zrdjs9u(%*rDz*<fEb=^{RE{}&3Jim;`WepyDbSk~uD&qYc|nK&vVh9Dk0t;Y8!0yP
zW~*dLRvr#H3Ojp55++o;ii&s*%<;A0^?(feTxmVZghvQPVD^4^Q66k!yIG<s#e{fV
zRq_4Q_B8RSV{ln11?!pA_oayWa`-z})TR2P1GO}(^}k2sJ5!rU|LW2D1|_c}<Wkb9
z!jyi2>#zpe-Aqm%M~4{v?60{Kv$nXIrTQZ3h`gfWnt}A)N;K+h2a<A0`@3@W%yM&X
zM1C3@q13PpIFTMW7_{trSH=ij<Iwq{goHTmAFDD6L&xkPvhlHbu<Rbn7X}i21h>Mx
zMfcz)h(Rp69x=Rsn|7WRYKdcV;<|j}<-oaPH`}+YvT4|k9*g*9Ph;;pjxb{or8sOY
z*DqJ)O%s^3PjW8aHIa$0w7=Wq=-+(*N6Z`&^kJ$;I>)kwMIAe>wO4G6`(|oqKMPUD
zF9c^qaV20zfdVdKlV#|<Lbr;T%Cv`UHXSD`x2(@~Lt`U2V}nIZCQ8NLPo_{{%5x*S
zoQG^_glX8pOT)(507T;vmSMCBcI$r$Qo7f#-}O@4M-bkEHisq9yko+;UygO3(MZFC
z-ZnZO6DBD?*mqtePmlbx%%g%m8J2G8)wk*EKAyrPrA$EU#A~)F6?q;y*h?KerV-jt
z<=W87vo$WIzq$M?HJ$!w=zkJ{oLPc5cg6=t!x-1ipWJSJcY!1&YfRYcaLCd_uoo(8
z9@F>t=vOi+zn1VmU<4`=8pg!8L0bzy`CE3!Ca~ZLOuWC+Mgu|1uDq{+NGy034S2QT
zA=-qUXTX^2kp9@g%?g(YMtw{#?ipxRqca4^+5#?UwD4GCCb{(8v9mluSU)RdLOQ2m
zu`=kTT_dpQkon_JLgS8p<<u5$NiQiBIxL!z8g8clrrNQb+j${VPD<aOWttDH`&oyY
zr#R)(5mc?sRT;*mEWfA^sx@zHk_34DgP`75F6vc0oZs{EQ7f63To@N6xMv|&7{<*h
zd0NEzWU}q5=mFzFCl}G923HHE1M-lp{l=PrRI*saimWim)GB?O@4v<quJG30msk3X
z{O82af+$V_QdkV)6k+{~EiV)|{0ej{JgTir{i{Ajdf#RWC8hLQZJDR~{N2$oVc}nn
z$y|LLO(+_0)JUsS%vk603v@50a`e%|!^3O8_ZA$2AYX_`koIqz$B!)|)Ca<~Lj|Er
zhTOSCR^wC=HfAX%jXreg;tBAyd-9oMCy@5e{e{x%A1M8aJ21oy%}dcrfDG_CMBu1~
zOEfK1rAoOqQiqtwkhSPE?wqZ@l&4?U!ip6^Le^`;j#BEJTxH&vv1wd1)A_Kjgww-A
zN^A%0se@mKmLspyc1oI4vFXy)gnB=q;g1(Tp^?i=)8DerVSXYVkJZgl8SANdE+Qg@
z3)ewLRnT#d@wuQfAtBi7SwR~LZNk&U;COE=pKxJj5>96Pi8-(JJa>5{rIat6I3FD{
zy>~d3I#i{IIb${h7v9mkK&9~`wDd=Vx!6qJYtrFk+9sm^9Jzn0d1Y$ZjHkwdBQVhA
zB%=Y)w?sD&pb3PJ*(RXAFiT=f!8%&l5lcgk)eF~0>|g+Qct|4j_7uCkUvzhsg)M{8
zov}`(r3=F4m6nrhnwvH(V|rwDxvd5qMe(%GBT43{0@{5mLvwTcj5Pv><Mn;XvU<f&
zn||7^jFXgAWu(&yDV6q6%=+40XBaPzJwW<kP@ylE9d>NRWE@AOH<lP92V}5|8KV^u
zt5tLgXhH4~@d_(nUO&O@->{~THDC!fSa*?HnIb;?EmE{4H{~rACgcS=m@b}++<vjV
z5TdWeXgVIEs#KnroiL})W+)+rJBuj$jVKf|Mj)d@V_<5;bPXC@4_qVHKIe3F8-w7T
zKynFw95fu7s_1r?wxUT0*LhIkwJohV1p4Ihz_+PWS|Lr0CH{b&ae<!FB+?{vet%`j
z8@=pqy|X;xz1!t~kfdvFl!Lrf*%bo!&~bP6PA}tiqJ8;aaCYG06J`w-SCOq&xaNra
z4$z5|c$z~u<a9wD@P+mDR@{NXRL%)i!EBkVR(DrQql+VKCWNU*my8}6y=FE~$sNlu
zZH)nEoI#u1;W);dm*bF3F(A4U(k>{qKOg6xLO=1kI*w9gWxNykJ@v&s!H>nW*$~+7
zoq;ZaqW(myH7h*WFRnahTiM>K>F?0D{T*>P$zS*C^fb(aW*a>te56da(?d=!*wul;
z+ez>8V25y$F=O*D7_$C=p;GZr_GdIU$hCp8llLwZTI%Z)SVm~5Q}6yr%8#euTB{n$
zSi|1x5}YAkG@)=}<eg~A9ZB#swBK21?(@+>yI7u0o4ctKW@O&^8*@r}Ib4oq%y-1X
zd|{#SXUFUB6?X5~9I%<ML1>C-MUh(@I}(jEvy%FqRiwKi`f>D8$R>x8&e~Cs7TXjN
z^o<Q^WVcR3E(gdA#G<m+Vd~r@oNMJXu`|lnUh{%l8<Z0=2ty$sCNEL&D=0>@<bf(4
zeW+ptjWO}{8u|V~f^I;@M2ifajA-IjK$&g1#LDK+fL|WW(*X@l$><%n7MsYVQKDF>
z^mV@lxB5r?ench{1wzn(1vdsx61&pBEYp=hWEL62j4@Jg)sV>m9oJGTuq<A?wFbpm
zo+c87-xrZC_%#}%!gtgbA*MO1s5fF+1(}FB`AB|8TTr!rm7xo<P8Lm;$x_f*o*5D~
zO_rYRrAP{<^UAYD0~)yZ2xzNOIhib5<51<vekmznVV}}QpxyB=tabf4sS7`{1V_X|
zqjLcgkww5dB?zOg`r<F&82!sPg{)vQOLei@&KXopZ9av$PSlo(pSccv4TMb2JQ7ty
zN(mNNpgl5m3)^4)J3=kibaC&MOq+s#2->Yd-9XzMTLOA0cfTa_=E{u_;-K6R7(@C-
zG~43oKaZL2Wbr1W?9ubt+E5|Czx*^c<^qH7%`7|I)ojYv<0XYpealWA8@{n7>|pV*
z(_BQHP3yp{Gn-Ii7VBf2pik*UXntV@_vMr2g;H^5l$7_N^D(Rb8T0qcJVR#(FU`{X
zty5wrL>Oj#kF0O%Sz1}#x$MNEPB%L%X^wV(ecTt`_kXO<rKW!?;798%Ix0i&7)*>v
zOs4V)$vEy!D!b|-g}4_~HzptXQ!~Asy`B73OW(v871}1VHAwgl!Na7Wc5Yd-f&#uf
ze4FEGSFeV)As80ORiBJkN9ZXYuwG0p>E}qL1LDUc0m#0Le7r`@6y_33iNDz)<R2_N
zJgH;CQqrvp`G%hGj9`$$-mmpmxlWeHzLx=xu@Uag{<ZlM&S|F@lviHN`w{Mjq7&{r
z4kE%IJBhNWR<f*;Nc2sxQofP0_)AvBbeM+OYL&jPAN8L(RU<g=3KCguG+x0+9pa(?
zeoNY|)|`>!o1kk+@ZD`7K5W}c3xx`4a9$&sd;6UuC36i7h&ow`FunjYqNEW@(B=5l
zjg*t{y{R@wD-%YM#GVWt^K4IwAw10a8aDN#CNrR5a5;#H{I|?1Z!5YZGL5->Ih<T0
z^qG9LI|7R*T7TuVZhzk=j=Yb*HV|NkO!|{4S$Wf%k<g#GB^E$)mLGCCV|p@re&}vx
z_zDy6Sqv|^CoG1RCd=(*lWa1+^5*yHR}Y6Wx=71MLi93tUWH<PKnwZFOTOw-Sf>nr
zjA}_WIa{akp_!hDi@H1(Wt6{x$86}72oQfV7fkqWg%xYHhPze8k}z?2V(tMf7y%At
zDnF7$mTL>N&e^sDP72QoB2{vV*Hetyk7I0c;Lrn#6)I9q)f|YKH>OCXgXo(YMo^t;
z%b8M#I#UHRZK2>0AWk&VtyC!F$^}8~hRQ2mco|zeYu6CZee~|n`vR_fSLiunldlLO
z{$J`DdU89MDKE6whhV@SK9_LphNuZH_M*%>&DM*VFCWuPET|1LKVX<r2CE#k#=gU{
z9dic&Y`&^mTa-o~fxlI?6A7+jp49FQ*jnlsf)BmEC5D84W?%nK@e~fX5*N*QJ=<Xq
zYUGuj7ctDkkwVHdqHe(NOv6h>Qq@kP<m}(Mg|eSYD15u1Sg+0y{>z=)`Ab~asv`9?
z>(CbZwEkuhf_JSfQ<Xm_UdLMBq!y&%{;!`Y_%9i7R%j%0VyAg7jNcyXzx2BovD6}#
zD7&t%GV23$vyl!fD1&nWqXp^6L0Iq~zHw!@SYASbC>-2M5ZqCmab7SVv!WKO8F*??
zJ`AEbuLnv`(#PN(8xu4X;Fg)LV8jWaQsJs&6)6KdgLBI3>>1P^Ni5%95W0!N`?4Z@
zAk$`o(!U=N#ARbrn)3y|Ta|xYag->WnY0q}X$IAD>KjNI>}Ls!jc@a~@KENypRTUT
zREV&;_<@`l+d%mO2$JJcfcRgrHyjqcGU)y*gTB}FZ>Jf{#TKGI3ncx%!Ad3nm86^Y
zpe45|b7g4=y-ZFyVk$5$X0n;aX`B}!^O81rPk?MwFzl@ZyupN8y%Z06$B1Z&q<%`J
z<vJKd7Xql-;gaMXQy=in?OrD({^b1Y8&!AA0r|a@)ZKwD`Wi7zjrGwUXz)3(E1Xo=
zVrU*>Ifi(Rv#YY{TmzOEIc|og&voymu4Z)w0j73ylO%YvS==N$Iqal?quj?*=(cWs
z;a>dw)YGjHP>|cxT#VEw!gR$<fl@!3#5>tT+%D~JZ_@{s%g^69ue}D-#K#%`D75vx
zK)*!3O=~L!4)d`B+33pVJDNcbmN$7|Qi__%+|D#8yA;=Ev}3CRr3bI5!0I}_5@hbh
zRVajZ;qNu*>FJ5EGAOQ-xS$hrT=5WJgUWILRiaP6`JZr1#yssy;R?bfOW1BXiZRCv
z7x|c%8;j1ee7a$;h``%us-D_lFO1gR1<Q}4{YrwcNIWXz2w(`wrC?-oZ3R(;s;xFv
z9P>`1Z}vVeNg9RdR9tq97T;Sv=02NKh3K%UZk-0#x{Bm*0P?{9R#5tXS5WaRP3~)=
z7IScqp$*{16i3>h139g3N28(izL+7ISUh9h5s?RfJVPR<E8WM@EqLbXcbm3^0RA;E
z0wy@Ux_;QpalJZB^gzBed~4RUULL;A06SG^J6D?k+H072BuLH*MMU+{M8Qy7=s5-J
zwyF(>O*7xm=qAM_8r9Jy^}JT141#r@x<jfB<tp6H7;X;>@+edzFQM+Z2JitCH-BlF
zA0x`bj*A`t>A`Zg2~Z2aZ_d@@W4FDJ%TA$_DC*JoSLNXSM>*&TMeWb0zWITA2iXe=
zFqU%>&4JFdOXuHEFutAol9|M|3Wq4Z56$nFn|P&1VQI-IPr+E&OtM!BI8FR73+U%J
zM^>N1_Ub>PN~b=lqPwhXa;aa3xHz?)Q3$=cg=rZdmiZ}=*YsSjD*4vb&gPK<4MCY^
z8yP3wQ^LW9+`|k*Z<<5@y)dU!M_O`5UT($1b#Fa9*gq`94gz<xI#+PGR@bC8Lv<;J
zH~eOLIif7SdQZMxL-d0--s1#ekRw71+RZDp?*6me<rk%mZ^Ax;9$RVa_fS4A9zF>t
z&eMfupwG3!;4msf+;uGuyouFfs@+frwd0q64N0W$+60xar_Y<V+0gF*%t!%spIiH{
z`3T1c^PAjG?yS?kxe2VJrU`T}!m#xoe56bplb*uhOAIumuCVVRIffbnA}utdcw(R@
zw?N(XxQR>S3D(GF_I{n`aMjp_n|e!P{Jqk?jrE#!FPqMuC*gb6cZ+lV!!)1o;U8Q2
zfn9DyCG&pl?*m`cUH*U5-6Z_swB0811K7y7#ch!#Av`&<vb&tgq}qrm$9$&L#Q=b%
zGn-soa%C8#qrKPTF&VCZd1OlPf=%^|%ip%@c_2L}!4a4Hr{EjaYB;DrYPh?)Z7i$^
zIle107p_c!2idBEb|byTUy(ZzhLQ)_*2wrlm9Z=|Ow-%VGn#50#*rQmdq!HOY(RQJ
zo838b`Ra>iY11g_#7N!qdy5z@_N;(X7)n|9l>x_M?u_Oumz!aa&{8T_cz6i#^*Ap7
z^9sh&bojsE*X0aKB{=a5(Ylg8BfbCVj<^c&<7>C}69y#5MlDjIP1=a{d+rk;BOVDL
zJHqFJnmo`tpc`jw{IvM~gz|JaBq=SC8z)pw?u5P6ccg=yt~nG;*-$xPX-C2{GS15)
zV@<f$ftGlgfPTmFsDpF*7I^z+&e|rNL23SvoK+mr^RcUK_!3<RY;FWUEPrscj`R6i
zGH`TiC%JajbNO1G&rG!|SWo}%#D(Za#{qtsE)VR^T2#g2mXo}qf8jL+Et(IJ9D>0{
zRrq0^L93L#W*;}p(iq60(m$kw@`b5X_2PId#-}p~%BKhj*kwTQ$w_pvb%atU9_eX8
zBy`xFF4RcZ76tLkTXYzr!y+iHTSKkd>YKMglv9ROK1f=V%o{51Z-^|A0kk6I?UTDR
zijB^syW+D5b84Hu!wB`WS8T+gDi;nnnTWi#RGN%I%hrH$-#c@PDbj0%2Z$$iP2e8Q
z8Wm)zGhWG-Aps`|S_9KJAP3%()Q_Bx3eZYs-~SS8@9QQS9}=x}@(?1fz@hz1{%Rjg
zKi^ah?PJR^Nm_smzIj9;MWTW}jc6aH%YqUHXkaNLS;H7fJ+asMA}APFqSnFbAENTi
z7bs*mtx$YWzfKU@BuqXLj%&<~Eg%#&FbuuNV1V}(3WJVyJn?Ig0lN!Y*t2`OHK_(;
zbWNcl=;j?K!}0f?Ul|619X;9Am#{SzDbeW*<6cmapW_{~>`0*<A?a1zn-e0+h$oXV
zy)0Jh$L>9uj>_Ldo+*kxG`e~s=iez?c2zU+*)K#SVTTy8Hl6%u8?4IT%zmQa;*JZ)
ziamY<YotPI@>|sn5kwdx5lmQ;$hI>z_FE%T^*KO=?!cRb*eCvX|67$ZC<)3O<3svx
zE>L#g>|PfiMxWJ4vIyn`Ljw%rEH@5mDECM>h;64QO%ML^XoT=BmR-|)4Q?cK*Glk-
z{w2t8gvrGX>^P)??k}vs<cR5M)n^f87;WboMns_9zHdlJk~~Z*fJP=9zG7=4Mxw0U
zBPt+07fP*{#&vPc=QKn2_TdY9ZSd;|;QMz3U=Zx#TMYb^Ht?uaF^=d~ec_;}5E=EZ
zcAL9g6IZH4{u)cuID0ipSe~*Y-4<~g6E}_79gDsikis}`LpWLjKoNe%=d6Vj8EyaB
zd2LFPHnDq=Yc{dZZm|`-XmX*u9(Ir#T^js;uKSyLRt6Dcn^!W!l(>dp9ClQ!R?8=)
z_)JwxnY_tjRuP5=bxs(CtI_HbV-{Y^w@i{1Z;Sn7zlOX*qs!mspLRey00Z5;umv?;
zX!t(grcCrYbj<f9hFjrLK3Sf=ruo2Ott&PIQ?CpPzk>GRI*gNE(2L-_j<w?D1U6Jp
z=_p(T+5BvI5UoOrm5vSC0fVb6<jZ}E2{9sPDeW4cI9}Hcl{z&-0^6eK^ds^@QayL-
z=88F5#Ih%D>kGRgQbf%@0)65=Fyw>E&KzU2aH(Qb91}<G%PIzP_)w#Cq6?o72YYHK
zE}A4J{M*PMuOT!4?7tzi5kM<J*)w!;O*`Qc<rk0bN%=dqtDTY_Xw>0)g#4oz`mBrv
zXe=v<8k#jX9lKbHmX8N&;lz9bt0;hSK4wXpJPLvpy9^4g6ZA@YXhx&3Q^_TcmjO8(
zE;)CQJ0FXBUGgLOF=vtE<q{}3ONmTAHR0%O*4N;uuy2wZ2L$N=s@?d?l-X0C1Ekvb
zFpBh5)_qJ$?8`CFVx~eAwM0Fe{W#D_&7QTlBn2tXg_|D2Z#cEwxV3oGwU6?0V}A&e
zZ0+{^U1@&(Q`AVxFfG5eN2>LbbkF8!^TzETJJFm@q?Cf%mN<f<@m^e+d+VfnT&fxs
zdfy+~*b~^iE6it=T3m2X=r>>|0+k1_yHb|qz^23|4W4`Xp6_oB{E$cGyWa&<=5Eba
zb}B__DF`1=0mO}>LcMchitXIrjF5f~!s~aFBJqBYDDD;Lcj!h4)kpnl+rk5GMOuvB
zgIch?1nayR(UAd_VN_jSMFu)~HeJ2{QuIvq@Cb9g^2NgOGgNf$voqHRT0@;oXdLy*
zioCtCwc9B=gW!g_S6u&%pS4~KX|8=S<7@Xt`<oJ-)^qp9bXh#f_=_S_*<T;(xIxaM
zQ!p2(=|kfvTZA0wLtOqcFwC%U#!wwxJ4h4o@M9~TeSUcgEg4%lIB(sF8V;}0qgY!L
zJ{!2?%}|K;%OTdoo<#9Pc|yaEe`#O$buX&Ahv*~p?aedmy-CuYfi=c(z*@et{}>v8
zZ6Fnk<Ci6`T%eJ>q`ioa64dU5?QauOSuriKSQH*A9Lsm!7Q|v*MXmvV(EOwOVx7cc
z3%o&>@LRL=bzKwrX9|xmuw}?8Ndn|^W(|nhhAN2rw4pNxD~PtfRedvU9`9=#qZedN
zmnxE0Jt;DgaB4;2vT$VGY=p}^^H*mkv>-XAM(CrVqlw0PDh<Orqwh&lR%k`-?4vQ~
z@HNKF4;|;s;B{lEubt8!-=n{{1W{0#&xI?4$p&h-g7Yi9*G{y=De)Gt*0P*uCT&A{
zIklN3H;d>HFJ@#85};39sL*c=A(;|Z#e3uZNLbTQ?4b0>{4VyI@4S@BxqXvuMfh^3
zT^Cmyhp!zW_CHro?Qch@>!iAnLlXX?2?Sppak^aS?l{OdxvN%$5KfSg!ly%>n#<DL
znqI;ZrnSLm0bg#hnlldWL^;ruS)f~x!tuL;;EI<lr?)b(r|OV4B2hq711&=_!F8UU
zzp0w>GnUr)2WY2Rhf@M*k6O{@z|L}o&cY;fBztQ-m~g5&z0*wn1Iabayr9DPs07$W
z?K=IVQQ?@n>AnCaaJ{^5Dm}I?&dMS**b1hetJ<KBq;Jm7Y^2~)u=n>~-m7dm{G%cp
z{w{5XRa#3>r+NGue$y>dT;AD5`KW}p-+7tZdyF?k%pn)jQ!I9n93(?~6-!kEJScAa
zYxK9^#-n_H6d+qLBY_f%&?1~KV^Z3+;vHEP7iBzx5cqqymSVw9%4PcdySl>aJ5v-}
zE!D%i<x>J-NLxPT1#Ow3Xy}Zh6kLAfTibJj&f>ngW7Col(b{Y3R{0pqu;ozdE*|5u
z72-b&9x(MW+#*xa`)2OEtjst~EAM#dw|*KhuUD)5&(&)B+YiW0)c<k1ua()f=ZzXM
z3EfR`+Dwsmqc{;=f-1J8;j}VFWSz}h&W&pz)QIi3kKlYfq6!MIF<vp%ZoM>gQ6bXg
zv^TyTuqn>`?kmM*P+hY(484tgq3BIm+m_A248Q3emh~oB+UPCxd!}U>1I3HGoRXRm
zF>4$)e!g`=z9Toox9*hlZ%vEl`T-^tH(QlU*%VCeu13G}`T;T=GR|u4&QtqboE7l(
zw(@)+{(^8m&+ydOx%~Z4NPDb^kSJz^$$1E%r8Yd8{D{H|dPuP2C=nyH!EZny7si8)
z!Fn88!{8bCpzQuaRL6U66)Ja&T52M&XRb5Ip96(d+TZR*AHI)=n3X8=OJ)eVq_XkO
za0m`Lbmj&5eaKmQvAg<!G<KiyXL=tJ8&6W>_T)C|#c~TAH6J@i>m_cYgS!NS(t=4U
zP<zFrGvtM^Twxu*b=3~!Tb*M-ZAG?NQl~G9t(=BEyn(tlB(YQOP3JtN=|PBZ_)!9Z
z`a1<Hjqm17-26YG^S?<_sf_{FX!hZ!Rw`qqmBH95KMo)VW40Q?*0_^ic`=}g@{1eh
zg{SY=Y@a%%spHMouRN#?NW`(sp7oL>5m0HN8Ljb0ZoaJ2+QjoGjMB3ZK@HZC_k%D~
zejIw~g()Y++y-M|87Z-7t@3lo=q;n%l*V+2868c1Z?S7M)+~xmK520mo6oO<aKZ}Q
zA{UO=D45g}R`$)qOB{hPS*+xl0ro<Lsa7Lx#oG3$#6$Jz?FIVK0`#LiPPsz;iYU8B
z^P7MnJDIp+rQwyo-}P_H;SXAD;2hKl6@CVKL1jCv((nM^1%hL3h8_nJVSQ3XcW)^;
z>;PhubT{&l;w||Il8YM51?VP|HB+Sr>!Nc0!WfE}yReP^HBQ6f&)Tk2F5CFAiD#T8
zOHyk@57c9C*5Es=dp78B@r~xJbzL;YHF}V%{w!QBmw4n*jPE_TnAE#-^F(f5Y`yu1
zUY0^b+o17CvmPNl*u{{stSg@OQ8IvoX6{3O`1sdiJ*hw)=d2iVWt*KCPU-Sj%pd>3
ze4`iYXbUakM+Fmr8W*z=e|+Y-p!5cbh837aI%0l3#}4+p2b*uDpYqrNN<25o@CZvp
z)Dmb$HrX5Z7jYU*sR*Ay>?UEJ7p%LMhU2|GxikH5xh>QiR!g2Shp54yU|_?vv)a_t
zP*-P&ZacJ*sEtwR$L24<`}DM5LY{xN)cX5167AixiXFXdL_|%q#&X(jo1Pe=2fUJ$
zyu}#(4-g)Smc{7Hd_K2h5_!WDouL&+L45Ub&o3*JxROB%ht;50F*fmUTcc7*+PML|
z<G)bl^_&VJ!pwx9^=4A}z-C|8`5aLUT_efshN&rUjWa>|t`^mVs7r{G(S8n&S!1O9
zg*7JjD(|VEmfepQlg@|*VxMzKgoMt6IINbKsdc=aJ)F?*+Vmi`cZhmQR{BMZ!r&$5
zzbpXxOeQ{T#K~*;0MVzo3-oNB^U{5By{t6A&-!uHfbg^i%Kl^YCv8I+s_Vj?Z?wMb
z?F0y;@J|hINtcLU5Ll5lj2x>krCtgDzs@EZD<zIKCa*F>>L=9{IPP^%oI%S?Zz$)P
zDcL+X{pMH$)4Lb6O@nMweJ6swk~dmip(kQG&S2Mrb+PtxLDYGFNn3G?2x+vDFD23R
ztlr+|a_~69$X#60WM&$+mz@;LQYI}xapNWQjvU)9<lItxLLca?Gmpsq;%)WGWh{P^
zq!b{<*b<R_7`eK0iHEDEREBga?jpzSsCVS4^kXULr0s=6??lb?$2sAlsQPQI<ikJZ
zAC%FSNVOU#W|h4%`?z@$mSmuxGB>mn=FDS)9xMqaDIt})yYo*58j73vwDx}8=^)xw
zx(z2!_*OPaL5lbTKxbw+F`Bd%NH3dPo%2NE5<0KS1>Nri(rU6eKUFqXp|vdS#ZZ=e
zp{@*Oggwurey48TXX$+2eh1weOwAU`6^-XacdgdOn=AwRVI<&XF1w!yJEM-Qn3YBJ
zBLwOeEw|nLvt%MNw5#qw4w(E~s0B~YA0NCRH5Q4KXyQ2A`CIoji2dsqI~OEMlQNMR
ztsaRlYSYI3$JVZI-yIWFWM6c)uzVuky7QF<Lp?|yn<bP2dbtKm79I=qZm?z-G37EP
zj%2f8SqIKpByX5(c7-69?*MxzR6V0>t=!i1HrOMm3RYYWEbKJNcnEtEp3W61MHkIH
zS~3FrfXT>088mgpO!Cn}GLW{^fe04Is-ksjmFPF5!M)FHXtJ=anu2@zKJDaq^>BD;
z!pU}kZ9r*dZ!S`9RkoAib-ts^HDrG#jOF$!900HU@QU?^zgYjv@8uVxh}-CO$)&8F
z*hsLeN#mSorrL<b1ISu^F^Cf&xX`L1bhRKiMzMD;6szodjIzL34<gqOr2}Ih5UF_1
z<C2m|BlT06cr4PKKSuuAk-OgxQxy6(=Eh2C49g<gIiPj5*7j}OE4Mb<ayvzWtD5l#
z*&6oeD*QR-ZfDxA=O(%Iwcd%t%yM<{&Z5xotTADVkM`CZl+G{3@t?-0isU<bB<4Cl
zq79+B-S;UAI+oNdy_JfmtKvXtA)p9}Tm^=|rg)zJTO;F@Ov@$8ZYjGCnLh+3<fzQU
z6=lwTWq~PoH-gqu=I0bxL;?@@{puM*#-^&G$<Ie$LNcGA7m<*}OrL#<u|hJj<r(vV
zhxslwgbB#1x6Dd~0<tbSi)~&mN$BgzG5Zw9B{8Rm0tL;zQu#ZZF{?De^-a>uaXgJ?
zA8v)KiK3|*)0AxW5W>;NM*1dGVg;39^NqY?xwIDbeR93XgqW3$G9=BOCw^ZK{-oF8
zZpE=D1y1No*T>b-%niA+nBd;QeUu7+y>J<?(wOs4lc`cXv#fs%g*0#&-%&Xi_*6xw
zH}R>B5x2fXddhoY>L+t-jWS?}e&d=W%@Ls5w=`kcNrcv!Tr2cJCCOgcHfj$!T&<pC
zA|pN+k0<4KY&Moegq>lS{iXqNoqclRE@H@Vmn6Sn<CD#q9^8$D#etaNo>H4sWKFft
zNz8nAgD9KDIYI@Kuvb}>2itq=8KlW&qASZasxL)rBvNOMqOK*sYfyl$9vvsr>KJL!
zT6RC?eNxrpUk~QLih>yy$EURJ@h|6r-Tb8n9V@e=KDO^sk^|=YSmkH<Mi#h@DfI<_
z%5fycZhW_C5uYO1`C#F+xs%01RZW`T^^gU7Q)?)tqBLEyMcHJ^I<~LNaLbHG__^^Y
zVG!j-Ol8=s?P6YxK8l1$Ny*1Qwlky|mfT~0ueA?A|1h{U8(gXEh;&r8B~8X~p$U+9
zkTvb?Wcw=XOu`@L)G#Z*FA}BKMa{qAmiz|7=0mP=dxk7;J&XP><o_j+v-q4zffwd7
za11B?HrFCz8y1@A!EnF>MpGUvn`q820FD5u59ig80WK4aL59Ky|2=}OwlQ@ud~9OH
z=dO#7(GN!X8h+Ta!W_S_AEiRvnU=u@o%tU~`9{mw5}_-dSS;+V5105P>xf;}krJdn
zSF!=>6J5aVbI6h_W)6ANwI(85kR}W!Iq@-Wgv`90*ul_C!4DM^I)o`fM05p~n)yBq
z*vTsTTTZ%l7TN9sr>{)-UrE_6{!K-y8cq8~<`c)0Dc2xs4R8m0$c8u%Wt_}-mU~CB
zXI5Tv?5p`tn;s*}SPW>LWpit}NybUzc%>*LdJ{wjRMcH^^9|T>37i1gd6+Y<ZPYPi
z8Vq5hw8=V0ht+L&S9C(S5?Tjh)s@k-VYpcLqZh>m!7LA>-=3Hv%q>k+Fev~blme{b
z1!Y)_F2|a3W(M|JXkJ#Srt{30kM(z=+;3DH0EiB>p932zt~KC;E(#pg`6zh@IS>$<
zl|JmrN^SbT!lLbUAx6scY(H+da_YYA*OQ;?chz`AJ|*9O7K+J9V19e~ZuS7tqg*=N
zo0n>KD%%<SL;i{DfR0+}x?sm$f&wPp|Jh8=|E&zqEeKk$I4^f_%vRJ$5K9^1aM!pv
z+e8xcOW9F&Sw<h(nknn|Ws<gGZNfYLBDhjn_U=slQwBP1x7=b+eb(KaHq5PR<M}!6
z7-i4u7?Gz+Wv@agD2l#DqL#&-WSQB7;v^;8oZM+gDdd~=o$W7@##?78n{GLzd9D$%
zo-v;Wl{kB-m^9$;M_XMWuL~oi*M-r>z>Tv((LFU3{Z$#MNB@wy&!9CjIu)-1N5Y5#
zfeeVOFi_dasXXF*{8$%6t!1;o2r#k^6W@PBEg>Y@=|6)JGf#LP_9*YcP-3gifYcej
zwAe^`M8k!(u{a{!7m(^wqZ+<<ZK(|Pu?;sA!&aDz13}-qD*HjMn+05%2{E)uTte#f
z9Wf4vF-^b=TGB#ZuQd@rKu(s}vN@nj2I}t>)#rSmQId!kcz$F&t!WqKKbR$>vs7Z5
z^g@>k^|meB8_B>?pI+0*sN;?K%pt?P@dfYK>n`~prQ90%XWe4DiFrjc0FfbRlsO1X
z9IqR8H=q?r5N2BlRYc5_Nv$x)CxNMsPH0~s&2^;!nlmXVb~?UuyNU?9FcPKq<xkGQ
zaeIgO!M8a=A*<V)pg6_0*b*tCvN#Y1rB0<Q(HLLR$)rd3r{H)E0U~X@Rk`a#cyjQW
zLMn}?bCt_uHzASAgS$nJ%z-h)2j7BtLt{<TkSGviCimGsH<$j6WYq@6JAR@xjFl^I
zPXguwsSij7O~H;pf4h@1hA;tnz2YW6VVkZ0e`fZv({%V#b<=r7e0cganc5Vg5lOCn
zVoDxf`laK%;0jgG_W48>KWP&$CjwR74gn9Kpgq;8m87I$Oq!I6*l!vewis$=)<*g+
z;Z}6Q+5Cg#10hONxd#5Iftw|sK9mP2{nYVQ<~MAOCekTG5CGanwFe1O+B|dtoQ;fS
z-L^puC{>vtz(|AB9|<s}CH4a|HeE5)HbPTIFM)w<t<j4MZu!|IZXwh+cN}A9ivLnm
z3Eif5)tpO8Dxquje-_}is|mNFh6Cbip|sxTgHnC}#N&z_K4lF{2RSZA;?OPYoliiT
z^~k;`^JkR0@vpy^9P6H0*sb`CZetS$%Z;~L+WoN)>SxL6a$Bc$JJd0GI2K2C+I^8|
zcp}yeo&*oYx~=&5w(KzB(P4PcTuiGEsv#PC3xN<(na(?1K57pKF0p&93DiM}7f8^T
z5+QUG$tv3Jl>!7OKFYe&dzu{0Y=JX%V~Q9F^qE$;$VvZIPJx!=j6d&Y7XFvPF6}cF
zYUZOyTbxh%eU-+Kcz<jq9HE`!{@??BJByVa2Gj2@>B{P}YH+vpp~QUg@p=_OlDBW1
zaDaTk&z5H3Dc+<0y-p;S5L~+k!`J-<EukbB2QX+N`MJ?6tY1FfO%Swwy`Xvmb(1Tk
zlCX;S+0>Bo@e7rg!%$(w@P5UGTiC$cC0;7k{Ld1R>wSk`-lIu!R-O1`>3+)+!gmz#
zPS<)cm`<vq+;ZXx`<XGnF@|dr_wjFZ`M&VaYm5xYu3tOsmkpUB5rrt@)z*TA(oRj#
zZ}{=PI}$@JIcF#;RoJmfAr~68)5etsUHxP=?#3NQa0a+U`PdKuX6GUgSAz@XH~Bi#
z$C<*z&1S((G+W?k(H2SU9&3c(^}J0@`L^e*u*retRNvB+sQga*F<^hk<$TIubgD1A
zYV6yD6c!zDDLy!|zex>%UM;e_@95x~s*}0X#o;x%=2^ndaw@>$g&sIQ_6bj3-h`tP
zk!5LTjgZ_?T4VT2KNd;(M=TVgSIhrz>GDs{3>!XG1vga|dKULBg(nQbK+A-)aI2b8
zbGlbGRes^F&kLoz0b+SXceP{z-vXxdi{B8zZ38orP!_Qfnj7Ds$7m5jHVck<_KF%c
zuX07k4%M6Hy16_YyeM1tVid3eq9`@9bR7{faAY{H4lB>hMw{wBLyLc|Rao(N*#K}P
zA=dK^H|I{fFYI&o)NOfdRZ8pSw4n^<*n|4cv8J86h*w#+<FGDHIazQ6nK73<+F*6E
zFW@MUu%xp49k)z|2M4C^SO%itfTsAh*((uwzY>uPIG|m-nV5iZOn`}|HKNWK`WROK
zg}bA9#`;IP&C((zuyy$;Rm4qZM@npZhsfAo4Sn2B1cwzt5QB6rV#ayNFe{0)oePL+
zL*tyBVjE9HXG_71v~faNw;_Oj6c;*1%BTsY04LBEn_Q27nG>U#Ttb&-)Rusm#aBko
z1sq@RxM1ExF)=cq{z9^bDlY9mhqaDVN6KTkS)ku_k1(}m?^L6F<(t7uJZyf0&{<8@
zFJ7U;biRbDIcWM}m9u&4VZa>U?7Igq>*c)ujs@0m&^nU+&Z~Cw`nO&>k6q&Kw?&tB
zm&}~*6i|^tM5n<)T51O*p?vCNsGACNu;rtrsH<WT*$n*&Y~fny-NQjbvy?xe4?{Cl
z@wX_UlOPGi61Nbpr68ToKvWkA%aPVy;M?Otu%M5M;9j*Kw}~<GdpaRHtMHD7T}Nt-
ztigofb;bG;b8vSSF010hg?i$vEiqWkjaQ;EvDh{lvs;>MM^I(g)=ni1<w6xK`B%m1
z=NdBjE^L|b*9nbTry?FEF)2+6cYbxX|F@0x&+8g{_ciHI{in47Z<AoBuqYVd)CC7G
z&>?}SK3_NIaUsNrht11yA=<$2jaLK=*PRg8`~y*xDN1TSMM-uCHGr|tNZuq;&L2(C
zd_cubt%^~5;#-u0nsyw+l?PEb&~DE$m7U5=-{859lIFiGK<}rzZa)yET4KpoevBvb
zs{{8DU4gc0e*$#lJ9gzrbPr~Je&M7x3?LHJr>|qOb_G1|T7u4D-VBgIrJvO;!LD>z
zH%_TgeP2R+K8-yyPk$ZL|9iP@EPY0zmL3iR2*+m}LRaAGkv*DopCb)S*3jxV8=C4Q
zZI5sme51NaU&P%4)ir;dm!-yxQz6V+B9YeYhcUL}xJ5zczTV5UevLMSLX<fE02b8U
z8P<t6h4+J?XB!SsZT*lX=OiM@*$z8V=5mRSQ<7LJdc&04NlBm3(P&Dpf>zDV<BlJX
zr%DBZtbd?ZK1VW<BCjCJsoOVTM>M-g`FuhY$HBn{(GT_FLPM--SrgFlY~QLc5{chL
zp?rPoIPt%kolJB+uDAoFPz0rK^_*UBQfY^TPGAmWt?CPWm`a}{>b3|J?a%SnKTzdU
z#xY@0g#XzWHJ&VZ-`2A|<27SU{ze;~vjZ6Fb6ZwkB8Ef`bBb;KunfRVkqb=$#22+v
z@^6Zi85b#yWrSXu_ou}WJvLLinn*G?nx*5Oa|pb@bCV_Lx@?E9d)#rS?)yeHfvWOJ
zOw+IOl+-GkZMxb9Wy-jk&qi<G{CPhsXPF8dac6K5EKIOu%j9GTrCj)r5&iG+c_Hi8
zn+Zg5hqy8VZrXQaLD0#tZ*|{{@D3kS`3h#QS$Pn#&<AcfN%Y~WVp5@PMMO=F;laAq
zDMEF`KF${uctZ{8<pmc(kJuABw|t&L%!y(C;yJJ*S#Y}MIIxr|fvyOD)UI;!r-*x?
zD7hLkVnJyv^)-Sq7;PWM$LIg3dJDd&x9|O%7`nS*29WOV?vieh?rsothDK`W?naPq
z(4j$6I;D{=K@kCO<ec-pfB%Otulek~*Sgkqy%!vTrGc7{Be9DYWXr}2ncB!~6q)*H
zjMHulSTYc)E7ylA|K%kj`w(o8s(fE{eURrKtj#pb^dRV&?S==Fux8Z44nZ!C9n?~_
zWn1{4TbNOmGd84MErmH_imtdqir%Y<^`iQ!`g5s@0IGvZB(M4$ghD*Dklp{5h49k0
zIZz`#Q8k@TAmfOW)4Q)<&W=8ce56>~fHGQI#CBAhuzlz)7FNC^Y%odsgF~MJNlg(N
z{5}cKO*ScZbE>YM-DA?QC<?aYdwX1`Jp*h^nFvlEhFT?#9K=?lIQ85zj4;AraNb0V
z@}l8^km-WMAmOge5LhK|K(B^{2}^-p)wE)J5DHb+;UqfMNUn^C9|XTYI<?b;zKWAZ
zCTm_)d~WT8>x}dNrtUnJnH(vYLNm)@uI>Fv`NBUt*_>Xm*w}c`tEg#PL{xXsS}+mk
zMcO4%*y`0_f*A}!iwLsH`q91tODGf*6{BL2^=sM_)3un5qDc|aev7z1(2n{TFeo4P
zDtJW6g~4~L25?Z8UmTpP)KZL*=7?ABf9;H$904gEcGyBaVNHLnRJxt(l!Rf1_n_!%
z?L6#F@I$nP^krM<+e&mPHcf%6axV9Idd=8*;y?!ZDD!5cUcdMBmAEI9X@thS#m|L9
z?%x=vUzM2g=h<90V`0H~jGvZV*gcCFLoDF#gi#6%PZ4)21)Y4GAs@-ZmxJ2yLy>4=
z8NWo7nNKRiz|I!3F(fb)GJy`+3JM4m*{#XSyaU@K67$fh!F5>V<LRU!HwOk5Zv3vV
ziX#dfS?&RdYu^EhIj=({W=Rhj9+NKamCRENe+}(K9D<xGv$>9%td&`wBt=`=AIi$A
zs#iY@%%z9HnIIc1)D=CRk83v@$!<6VhyF?;-9YgU?Zv@;zS%DSojWx}6qf0^h7)cj
zCH>Aca*5u`Zmj<vBAJO&r9o7AbSe04<}H_$49GG94P>+hvw}ZclCv0JgS)(HAAYcy
zz8a@0b(mS#UjoVk)Ne{!l<iw`<f4z?xoec<<PqC472icS3ZnvJ>Zeu~82jci38zKE
zn!n=23lpNEo1fW2rDVFs>ec+J!0l)w<!365Q7}d9#xtb($Q++9@3v?v9dQsO)#}D)
z+QsL5e*5XfGP%6nO(-+<dCokx{gX5Ki`A%E!Q;l(z(*y(xgzFG;zbma<BG%r*6W{T
z9a_>`d$MJfU@cQ>%oa1Fjgf82H?f6G%2<Be6*dGN>#%M<_)6(S?8V2K_%nXS!z1g;
zFyNr!X-{?4z^Fbt>{6^Vb-NgEJ<z2$N7Uj7;N5@~Jg8%f?|OU?I4>G|O5{4nFZ|Lr
zmNxmwy$3oHUq$2X(z;1izi-~@LLPtb+eLk3Yz>7d1(Vinp*(gr35#v=6p7;7G|n=o
zFf&*Gzsars7c{<gw)O$#@soOj3IVQ<MZxmFnl-|c@=~Lw{Dbn+D3eIcm*6F*pyH%+
z=(l-FmD57KFKNFKCaOIaea8|a|M-h835oj{Mn0bgPJ`vGlS#pFtwpBEgTKTym2bov
zdQrG}nc;sWM-|i({icXnqXi#|ns`wK>J!rXG|EatKUx2>VlwNuLPu+pRCmY;y7I~R
zK%D1Bsnp^k=q*Hf$8o?6ar;yB{uA|tn>XZoS^<3TTYV+5v-^L<!7v3H4#}aZSEC@(
zd18fGrY+3Gqm_APL5~EkFWfG=6W?f5&-8W4nMkEIqUlMu`})+`YeGjy@mstFg`t+p
z*#SpzSw`?bK(p_`!7V5tZ?yn57I|d59NFxr@$agX4O#l^XjZ(3h|wpq>3n{n6us?T
zvT@zQNW;KVZUlXp@O1qt0H@}f_YW2-JrdOj;vqwP#u&;s-6lbd*t`-j27}D!fzcb>
zD8<|g6RLiZ+*qJjfI&H1Xbltf$;hW3pYIw$;h-1#QFOkD3yeZ%ssAT8?E2I$+yg@&
z6!vK|e(~eZaztMT+j;v+{6dLq4VG|~=JEQ*CB6fIH=g=|s|wB|^9aR&AS>wassY7v
zJt*ZV2xz8JO`Vst#Rjr(xjS+;VIAofY25Rn9du`qB47YP!p}LaNxk2dSoVPL6g6&M
zid=kHpAo6etzJFmd<#$Jcxh#-#uPzmc0!+K1c1p7b1}zf<>II?%z4FW!`ngAK_~=<
zJK(C<7XCHUKZxGb=A=!Fisr6+HLRk3s53S3?O%{=nRQ5*-h3#HU5{htQcd*O@EKsW
z3x4%nz5RDfyMRU!;{X;*gFDd>F>a$VHf?DzLh97ok&%h@Y|82Is1d_>CicBh?Wp;Q
zjhhO{xVKbQLsa-cg$cn;(;8OX*<}l-I8aztm7f1vaGUu@d8!$|AT!FN^(se6S6-x-
z144G4rLn>*Z&j{cmH}|4h($vVU1TQ1izpG&q2@8SwLFCOyh3Gjv?<A&^J!D7rDEqL
zC?+CDL~nkl*tW4G*Bi{`<$<)I&xH)U@q+2@BeXChn2Gfy@a-h}bg!<Xrmu^@jM(JB
z;qzDd*LZ656yDnMVuK^hcb$PVVRisX^-hdEnGj2Dl&!-IQ2BYa#Yf7~--ilqM_4q4
zPDfPUasiZz7|15-?1l1@e0UbEk1~v$31B$!im0CmE_yh2vctGM>9xwjj!BDNS}5cW
zLR~u@8=Wa$JL{6naUR1+ArrjO11MxPN=fYrHdkOkpK|W-mW`z@F+4H@>6(-((P2YZ
zikYGOLxKpIqIZeLH`-B{VYb@i<n(})9sM<hwcF|>rimct*Av_SD(mML)Bz1LbhmBI
z^T<BX8|Qp#u^Ca+$Wi;LL*D~0Tpjy@uf&j58)e)oZC6m{zDZ8*0*8bN-)&*B*O^VQ
z16Z$#Av7PJSgbC$QZucWidPcnlMYvBUS+A6BIPIV@jcarQG-*{#6lphux{w}h~lYJ
z$9!QFc%j8Kr4wplAjK*PZe)z8<g^fMKhJcd=wg>2D!{IV@uyf)Z2L~uoJ{Xd=KpS_
zalkk_k0VEACCUu%+{SuVM?d~A)y)8RX6}e0-LYR|k301!pmBu92bY$_IE{sY>%nLS
zEbJvXM$a5p5pIE>;{Ad+hT7irQ;Rl+I({Zg3|LP=Z*>=K8S8*;JfLhfY>X_p#M#KC
z*ljpXoWo#NoItayg9r^5$l4*?O-3i4ZyG1VO_PH01HxYiYzVpuADhs%)pWrfS;Ur4
zC%9<rs#YhrjlORgoE_2X{}AqCSz~qYqvIQX^ciPi?32dVQTVSBSSc+X2YfAQNt6G_
zMe|;lnj<L=Jl<=&zPHUk*c^t6DbWd1WhTyre1f@TOLpX2F46M7`-)$e=Zu2;Sj)I3
zP&R^yR-?r9@IC82Dakoo1}kN?6o4s?=nN^xFM4ZK_T%(h^!Bage5KsD?{Yt(_e?Ch
z8<$zC2=#K3{i{V;(Qm?SuIA950%q%=`E*&nhHcFsmU4s&zE)QB6-<I>Vb^&%K8WtP
zFkQiL!30L6`?;*e91H?JO2m%bO2Y5N7YbaU9|Nuyc<r3^kpynN)#B^xAAjd#Wnv1H
zo*n*|x78_Qr+k^AT)-qnJTR<&ujsr_E2t01M%6j6<d0P!)Q6D>rVpeY8<%QxJQ7u7
zKpRfS2~<Gv-uMJ~P8qM?bcWU9y?MujV9*U7GF3g;n%hVJ$R-?^gjs)5j`%0xLBO#+
zy(7n%A&Hs-;)Qquyh_w6q+F{TyQaw7kbP}-S8fcSO@2FG+X24lElc?&*p;pdQ2P<G
zdpvZpuc@6E2W2L07YSR$q8e54K16WY8#QKBcGZ#_bI$k)@85PMEh2~*<tO96X;`sL
zsZ;rk-1whKs2zxvxDAIU4fsg;F<>`&oF2hq*0rW!u^)T?3XwuGn#*sE+6dKk*iqAR
zj!X?^N+m_nXunL?JHC}g)sgDf8zmGya}IuC91WGzBQ&>gqxXc{K}ub2hhbycs;g5A
zkR2-o5Jm4r&<82O$4}%VjOG#7+E{$VIf>+0$y_hx8Ij9q^5gbbIP4&z!RY^*sTsSZ
z6er8uU;^kU`6VssnOI4jhn7@`G-||7;G9ytbIqT<R^(F&zo-o1uteLL=24DEQlKK|
z^UWOI4>e(Y{uo34ORV@5m1Ir#`FaEWVgTMbp%X0`1klM4>j*NxC#MMLyCn_xm~w))
z1-5z@(`SE?IM<U#<W@JEmL`{3Wl1SZ7>VNxzg|IjVP3&B9bu(f)P<pV`be!8akPDa
z%K@ONiiNEJJO_hXfNXxbg<2K{Qi?v($qs43lD;7$9HVXy0$k!gH)p6uzf|ZAk{gy%
z<x1?^D#_65DVbm*L{f%6Y7;$e@!ib?@6lJ$?}Cha*{e}VC!>2t^)%6P)V5}P{$D*b
z;)LFkZ*oUEfxwD79CAZg$0xr=7P^L8(37uY@i~{%7xETnlpm0OJ>#fj%dUV?dr9dK
z(GyldWyz*{{GS#u0FBdiWjyS+PvR8{YobwPL{h~I<r<rlhl%L%eb0u}D6jQ`aB-mZ
z%<*9NB<7gRN+VI|A_8hLZ`f^kuco1J@Xnk^Y0;e;tYE*)37>1$LQ>F{ATXck4^9Mp
z*@2d^t|EMg{3V;43PN_yBz#4OR4xg5XR3P@?D@s{Zx;83N5JjM6J;5U<-JcmyQ>lW
z9R<A|Ne3whc+C_6hz+*i(V;C^o8Vjij3>&v3=vARm7>9BDUYj+6u>+8C%|{s6<X0`
z8GxEilj#qg)z^o&jc>}yvVSlq2Wh=AUXBlAkyj=JA@l)r#;3f`VEj9udq(zfww*Zy
zkTdgl$4I$Bpco-3yvNJl*Wr`NNn<DO{BoTOe2vQ*gNHe1@fl|$eUW}&u4jx7>MuF!
zX{TMSPeN664Xyqy2L7SGBofQL$Fj7w84%vGkS?P+|IQbV-dU{HQ9jL4EZ<9xGzK3@
zX9kqEm)^}q350ipC;?MBc9$c2y0nGIWXN++@Jc8<pk}A?UwU8pyY(S_WW7<XQJL}#
zHM7~I2uLO|VC@DZ8?5_;8*mIm%_PaR2~l5zihe^}2jnj-Hgvu38fN#yC)zwHAwO?P
zKmT+o`!3@@mdi)|`Q^!KLV>yw3J)nT@>=_=Iq!^gHK;V7!Th)7`eNR5BCYGm#L4??
z;_MK(NdD2W8UJGwdP#=EVvs~O(e;b|<<y9$tj%k;H@?~w{dWOpVj!IFpDm%U--t@b
z!l75E=wV;U{3+8606hGHJ9Fp(m2`ZT`<N}1#4JoVOZt)qNyjBSi^*{7LlFNG>g9sV
zuW8!O&b31&zta^ka=0U}7jA_X3+?IG$+$FU*K$xigv`-Ro4Y|_GqADWxE(HdNdJ&r
zug~QSTZP4pDZAEqjM-ie>rH%D+LtBijVdI5No@j<f&UO<vP8CXumwJi;ksexGfAi}
z&tT!o;%_!+3}EW;YEUc^><;ir*_o3~$8GwkPT*w1POKJIQCA_{K$^IZ8{FBBg*v;r
zfS=OLh&zxD>mO-bQ}HG%Xc(MhAk#@jZBKSEja=)dc19#HV`$N+&b~Rnpmj3L&j>&U
zSh?frwrOORHo#g@Pv-W_t8fCCfAZPW@EBuv3Ba-GNXLoUGB<(5<lN;r445S)ABtl{
zkvaDTDE;{OcjFVFdepVy3EZ@Gq#`8<;NKm3OS?UwFoRP1=7vU1_Q?Zd=Yt{3;g>|%
zNq;7`R|4yw8|<e``<edMe2>t`@P!Oa$0PL97|hW`8(((uf>)E0VGE`|xgtD6bgIsm
z+0Hcz@as067PML+41iz5oA^|`)<2q5uGS0kQjYeT<LM|bAmq)FMr?~><r25iV<_x%
zE*K@f%7I%0v;^8P5i~hdhHhOAyam$7j&Nr~;-JSkeaHC4y!nY;K_YYN+H>254CcRP
zZ#T&C`O<qlK4^F}8ed~pQFPBa$^6C@9j=1p$OGgD9tvf_!c4mZ_Wr$}coPypSYg~K
zk>#6TQF03L8nb!-RTKXObVOjxBAx)GUHD)#ibsw2<Z2}_{N8PVwy;A<60+?Q1@$KC
z*?H}Gc#<4gF4(*P>9_lBKUwsr863logpgVrZ!bp3PcVFLbukxp_srOj_oq}fKzE~x
z<#+1QbNLpT)FtB=Na;6ofTdS_u6=yN#9Lk`!4t>GO*9&G?mxy&<-|+H(#qFA%9{<w
zrA!u+EITaTNtE1`fFzx4Qt&kf#kF@hh$_Xfnp1Q>K@Eo{bK)Dg0}<n@UvSzUuf3y_
zA+kV)x*;4@{Qb9{SbhI~i>f0>=ob?e#yCB*3yusJEH0%vRS{|<H>4<78CmzkrkKzv
zclPX!c~R@nN6L1>2)U#Cm~iB9iAt%Z-!+Lq_l-i(*zk9y5u_xgt;N20*8`lGX|tr{
zk(!k=R|qUIthcz4-yD7O4*eLiCeNf4(J0l|AzIni7$;brrA9thoWm7xgdzyd?)q6A
zy#6QBT%W?H$!;5H!X~9*Qm1%K`kB~)e)ETho28?xQLA<N&rj(8LZ1$xII#8HtR7Q+
z{-;+K9>ny1yYV1k$y*}@D+7fm&IEb!87`q@3j%C_m_UzIK*53I^>@^AI&^CX39-K2
ztQeuCSeZBe_*|t-^vyOUxdJ9L#NIQ#a}=0FyO}n*<SzS|Qtykbbig4F)zB4e%H0UW
zqQ|BH)5o{x7s@Ue(;Z0-5%5j!kwl$ydIDK5@w2NIM98?5s*eTgUHcSLWdmBt5osGE
z*G&ZjAKalg=&pDs6+z1(*2YS4GRTxO)f@kh>$6F|J}Q&H=Ycbk-4V?t5vB3s%L_`(
z!C^GPQH2^XE5_nEW28t;QEw@N^ntF289jLddd4>nv|m%ePD}*1Oj35sIZdvh29Er&
zuSa+_{d1x}U1gAYz7XJi<?je@tUT-V5Q;zbXx2%=T}c+8!-hG;L{yQ5Y*(JwmP(b+
zjAOC-*aDNQgqE9uZ;4{D<pRGl25r7$1yp9=mR;}@700ZUoZVpfA*MJ{&<|;czz)`k
zt>0}1R;hgm0gD#u$~-HE|K++9)3^2PK2ykf2}~TFezpBDJ|}`WqW%E|Uuh14W0IQ8
zFsnDlw`(V1C}ZA_#m=^VR4RCAPsQNPTD4eBeM|=b)ezsIINMwLQ>;+!!Urk_sZG>H
zV?9`GB(J{2oZ)=a`mgdn?CO?6HXTwBm!|n1mfYEO4Wg))8+ms}!X@cj-C<;_o>$y3
zC_+D6Y#kPZ=4U9tU*vMDA)gJN$)yEIaN+@cNsCOxH7V5N(nm<F%5Ia@aqr#o#)1+5
zzPSbv#zx8tD4r(u1OF?L{L_qn>5J0v+YNpc|1)7vBPX4pZb<Ik#5kr%a?1xV79eFN
zU{k~`4e~_TcZOq`xs?~6B~Z{B#?FG9Vp^g%8EaIq`o?FT_3`A!KNN^S?SPA{DEk`q
zt41<e2Qg1homkY;C2jp9o-tgv`l{ZPa%;HXgjTeiL|0695gyk^#Hf(TelN_;{IwoJ
ziSN?KJ*`;sMn#rZbV4IBXF8;;Sjl)E&G{*jjGf=0o?<C@UIl(E=(BPbsZXV3N=cZ(
z%d5w<V36SHID|S&QUx9PEaKTjP4X0O8U9PUFeimi$aKF`3A3T?-+Urlths=0H5Wh<
zvDb0L)=UbSK7)>_NGfr*fB2T<z6$~Qr3dY#Md}d~jG(%%c36OLVPoL2T5&zOX5~?Y
zL5#LGzU;}AcOv=;)fq7T<Uy$W5Mzq=XIW|yg@S7hp+}>obppe8^la~P3v}#k9e3ND
zdT&AaklQT@bNfFU-3o=$9UG1U8IHp9C=}roDItBWYuz12eKy#TVwWl%L#{IiPseE;
zH(;wZJ$niKg(!v9w5Yc3ZVP4T^B?x#oPnC%W13uiS&m~#aRSOzb<$Ssc^hs|rZ6rX
z0Rr*06%}KfxVtUJAVo2~E2XUh<<_;*b!S>@`3wrUWUEMZb(6lzmrUkDSBg%*;v%3i
zGW3$KJ)v_bjsR%-1!#D%-B0RM3Zo3y73Xr*%mz=0#b|sb@?ux*07b@Ul(%LM=Dg48
z2Ccx;C%h)na&X_xEIsEFqU(iyd^@Djc)ncS@Jn<U48dU$*<QjKsEQ6&#3~%b)*cIb
z?!EuX68=pRN9%?j8`2NO@2kjO$r#2k7OdaEC;9G~Xe=>Zh{mLo;o;IiH&7_7j|@>G
zTuRs=rqePlxLT{0+9s6tC3I5exa~|B)s-6MY4krBE42sLj)>*Fg9~ehfS64(+vSNe
zCdTn-DZ51@l0>u$WbZS@iGld!X4Xhzav2UA3w=^spvs*0=O(k$-Pq!U{45;VnU$Z(
zedOr>kg7Q*)n{<0C$9CR0-pNVG7jd!*}qrX|BwhfFZ@4p5b%UsFyu5HM<I#LhGX|F
z4y@mNuM6o)d#H3;wmV=(2;xR^mjW8a7zJP4Cc!90c;zg3oL<GA;oIbTC|y(S_0cGW
zI)Ih*R5TesX%oGFr33+v36xANOwC3G)DnTz${=<RGNf-4K&G%bsW>6rX|nN=>kLZr
z%<{zwq;H5{0w(q1EZnDA$M+0}%&!(Q`JL$eTgca%%{E09%0=I4*LtqKmg#n*T0pTX
zz-H#+6bJG`__qDvpQqTa&n`nwN}P;=HY$RtVSF%^d1B_`VH_Z*uiUHG7^xRY5+8_e
z*;9#uHQ&IjesNiD8(92??n5J}BghSgYC4BZp9qv!C#Vr@48g8*1s+kAqG>Y8?C|^v
z64|gm^Ff+sBRf>Y_krayLsFw_eH3QYZ7s*&=rC*1JQSW3TB!y_*QCQu`ifD_Lo9Qn
z={;g6m?u=YL$eedVMPf*3pi0%xQ5=oLup1|)d+sac0t{3*gmO`Q_c{kAdAY+@W@r+
zOzrjOLgw&kc<|S~()1z&fDq5fOoQ3<%j|Mz%l0llr5;eAwhw}1!)DcSGf#8=h4M2o
z(*{T+sBrF2%#-K*CHEe=3#c3S007)&rYxvuzq9=o`ODuamdQSIh43*!rWg(zzd2qx
zxha2xk7@QQ8(MAyC;jGN(<+=!)phXZ^}Q$DRt0YxVibMh{erJyH<+mptwqQtw?Yxd
zN{r3m!`416D^Ji?WHv&@-S+lt(vPDy-q~=06^nUGlQB&UJL>l<2HW4#CzMxW$|4Hq
z{2X>Eb9<>6O0AyH%F&ZfW%`TesiYZA71cnNnFg@bRrq4|a4Pitel3mGmJJwz!06LH
zM?^bgj4{(4vA8X)ymgU@;FId677q6+dO+Qg$mKBcDSQMPnNj#A1G5(<kUX&BhK?jl
z%#GOh(BWV-zwm2XQqF!65i!ZbK%nbJ=H@=e67o^v5H3dP6*rWmHCvqFCG5!FJyI72
zrCXHkVhV4!t|l4_3ZCin5+nFNnj|c*2Tl_{oq`WIvsNU8({eCNvLEW!p&ZB)C(?{!
zE_3e#UMO<myUrd|i*^!(yZ+-4{i}oOKRMnUl*2eYh9;Uta0R{q@H{@+=$2}QdzECQ
zT-UHANQVwJ3zxDrzmJ5jUXY3!u1no!CndFisp(imHQeoM4NvS57u3r0VJ2XnK~>9X
zL3_-FI0l*lA=*3?iM0>`m0o?5Gzw<=-&x~A>>og<R#N6V6DW0kBz1XQ$<tn#%W@v7
zHHbdR?0r88Z|F`3(+HHQVQ*r>Viv6zNt)Xe*P)-eLDmxI_K(U~xGg)CD~X;tHl03d
z?XW*wnaAninCD3G-^9`AU-n?eE-q|ft8JY&0QpB4GN*E6OO@KL{?t#WI;;P*fSc{}
zARwAZ!^Fq(mu^HN!{Tkye_FBT0$WKEY0X$&@v6hKa>JSve_NWQep#uMxVq+Rj%53M
zAdG|G#Z%i5<W&CFOnv546o?c!sxlF78m{S5loTI%=r3D{7e8C+&S=>mV8fz79?I{f
zA518Lz-SVgpJ{|?k`g|XM#!SYzf=NFG;S&WZL}!IN{U>`EY)Zrf-9PBWm)PT+x&t*
z_xU{iMF~8Iz>oq&Vq8}34iaj+9er!Q%`1YEh}e=N2{X5WwXH!mc_)L)$*8=g<`>yI
zD45^~%wn{?{`bD!EK1+@rBNKK`FU7r*-X9_!5XgpMDHTxe_i0>B-PNX)9c^~f(g&O
z|J2cg-@rYvM8;x5op?@^NG-HwvAxA_31xAO(nzh~?j08ezQ|gZ#muB>Fe9|zjC;yL
zwkVk}agoFBc}l&eLu?@WZN+YO(-t37dGhuS7|v18p3Aij;r}QC>7mv&KY1k@8XU<B
z)OvPbTCGUo_rteetvD;+I@|^WYb_6{#%DhiKth5)!wUi3mZpH2enFox)RSooQQ)+S
zGFkL;a9_H|f$if=>L1myq@8nv<bsFN;Nbh^_;+2tcRJKwMnz`TL`)zT^uI9()nzsL
zj!SY=+*;%|TKTCmzkz~mCff1_W7B$$GEW;_HMB8pJNz!2wt|?vxW=*Ee4M632Jt(s
zqGRR~-5g5I;W7$oAKu$xSN3`cszTNO(|>m2Dwdlc*!N*7sV?<?%}xBxW6dyIZ3-V|
zr@LKqZZn>wwa2<E>JO#`$spK>ENUVAnXx=7X0H-ZaFc}SMTEDEd-E+Z!LpJSDU732
z!%$y_slcTRS#9-^&K6WqU~a!xvn<DbLoA&DFtP_0D{GNL+;m^iXRxYxZdO42tWgrs
zZUts!RUgteY-ST^4-8*`TIKCr?}mFKp=XF33c%0`FUSl}Y2-K?+SZb#9OS3mtWiUp
zji11l1<GpJ8^f^e-A`zzbPi}rUk?$HkDtq#zx*zPCw^B+#Dc+C1*MxaF5>RX>y+Xo
z@h{kD-lt@_=gsDQv9W5(9bAcrAxa|g*VtpH4sZ52VQUspauBGU4-0crk#-%`k`#|A
z?~J#t0!|yV22(eaW}-EnORR#V4(WlmrvxwKwacGm2){*tWPbozFrvPzFW)T9tf9ox
zhTNSaA9a|lj4Kj<>J!<n6Q3g2N{(B%KPC)q2cEpgGtqy_Qow-5k&%)Arg`8c<5ocu
z@i7qwnwWW;LwsJ8GR8hlX*mn;$2qNPjw6Jfp>4cz3J8_z=G8NL{T~Ps`;(X7z+v^S
z@lgYc>mRY4@-5<#njW3_2*HgPBAhv993jx|jwH;$OAJ6WZQZ2T*9UJ?a4YaYZN#Ge
zr}~h-X&lMkHGH7(_(uDpDP<myKFae&eaw#V#EM2^W+7U&NE3A&ngT8CJ;HC3B1Yx$
zH5Aw3`Yq}ucNCLU-|XEw%sJ9GZo_Cj@-N?vQ1#4$vYN4keYUSsRbdT2v^xaI#osdF
zMBY(TSHI}uR<8NUJl)=%;;S=9z$yEq)5XQ4>CExD2NL}Y?0Rxd1TRm~-eze_F0zKW
zlq+x%b1&VpH*N!XN%^cPoPU|layY}um)MF#k5(do!VKZ%)^oyc=6zV<<5%>=``yFK
zDGFZU3DI`T?O`fo-Ar_Ok!tQBw3L(`TP@6n7s}2^hCz^Hwz&VpP@1#H5|?cC6)4a+
zi)>yIp|Y3BltSc|yIZ5Ht$LDD|J|<)YG3TdDtAmq1f4JDMoml9KE%PPJGMRxP4D&D
z1!Z_E;8TY!BKYtyv1+bmpJl}V@FG(g&HMyt%E}z+vNptUR>>5%7g{8-h-V%T2m!2i
z=^C#Lz&#_#g{}`&`b?G=b#{-4RLrJQl$qn}n3by}<hY5N*a2uRumNA+qRECds|W{s
zvv)e^bGfU6^@C+_GUdN_4ZW3!^Z+J-?_?QPw4^w1EM!FNV;4C;aph|Vo=n>CLFT3F
zEf+q65UPmM)HI?rEaFP5aAg^dyFQqA&K_PTF0Cc|C+k5Kka=AScpXQ-2Gu;@208!c
zjGO2BUs2G(JXA_(H%=IP89nh5Z{_rDmeV~$TrbD%Q<xMJl0?Omf`O9LBYLl;*;YuU
zDUrT$Stg&<o9pWo-C2%Ktg~-k-lQZOGb0!osK!!Ozp#*{QtJb=9OY_)9OBhi7hL^J
z@<X5o*?sXoi+Ba@a!)%~4jGMdBW^xfr=N|zv8CH}QfN>z-cvmHzNFW-Zmf{E&&p>;
zKf(Ip#ce%p#jEhxbZW|!WSJ~a;@Lqr6_)ZF+4`r2<iAS^{zW7m^0X_%$9HNaUa8zU
z%h`)%X{ecZ$&h$niMiq;jazt5ep?C0-n!=PH<D<cAP}hXLM{x`C*~dBykO?SO70Y6
zd`~6!hs(whUmD~ywvD;rr?hkO&>;h6_}zpz%~0|f=Bp)G%ZFMb#f^c9r--M#5UqnN
zfCIHHFLU%_M)7>TTlNuQXPLNy7?TLD(nOsctl(+l^Gf}j<a=n$8}80Gr%e&7TTTqp
z^CUG#Zq}()qEhB>-Ns2dKIH6&$dkzEpy!9hytgKJc)riPp7TfsPi`DkS-5RL?Gp9!
zO=?De&UpP-pgcSkQ^(E%Z3nO*SX0>`vy))NVw}FFn1L&4tsoS7v}QsvZjCB+puM;7
zb$ACSUeh*61ZEi~P|ti@&&VGcFn{OSkX0rAVSsOW3b)LwI^R@?jJzkJ2lIxviHgzQ
zww2oXcT5LsI7|ONwn}KYUcB?G_tWt}&YvfH^tkT^k}zg>vE$a_9}lsKnL;~Iitm@-
zchjX9m1&zrNA6Q`k;D)U`Y^Q6W4+X;$jP(cASvgyNltC~S5$lAD*Ro5F;Fg%5al}B
z=%hjSh{pnx!OW504-=^;&BwXlWH9Kkb2sBrAI;xd*fS^C)RykkI^K`Tl9Q{ONJiyf
zs^&%K&SkRg#6MoJxZcYas6@c$OkNu~L23fBLcV+xD-1W>N!fSX?wX!#pa$g#prBqg
z{2Y+-c(WuO!02N>(Awc$MB}`Eo$$uZ^hj*un?7*|(CTm;?YD;`8r|FBC<sNQYOWSy
zcNk2AL3{cWe61Kt2Xnf)44Su!Mf`s0sc{n>A)Eyx@VR9Bi;He};txc{&Q6hGzNt`5
zf!d>u!+%t;N$tS@);=cDoxToXhO)DxB1aCb<UXZtq#hf!=}mb$jNyqjn6eDvhiCM;
z!;E_kk$-e?^hIq7mY{Ef=(GrUMxm->9iaDgMag^p@)8}tkc`9QnezPBLO-=6+Bw`<
zkT+(vfel^A8!y)Morv-6ITf;-%(~Nq7#-&L_fzTPOC$S52BVFG8gd+Sj-7-KrH5aB
zs-)T3bZQ6cSU|cbDHmHVlJ3~6SX8L59CWO;Nc#3o=VqR}h3%(q;ja#Fk3nq}z^zEe
zq2A4ELCOv;rxQzJco$p?<diuw^0?1mLmb;<n0GfHc0fc*+T5XR0Ey(4!}Eg)5k^&D
zp2$iGm<vkT^eJ@^Tk;r+!dQE^W-o31foUY<-Wr+H!Y3MY9uJf|OX-x4K-4qFg~-Gq
z(`B+=L^Q5#DF}bfiQ$4|jJ}{mB&Sc5&D-Jy*q1NnUaZ;BYD4OSkA*+m>H5&Rm?t}o
z<nTq@E;Z%s+m~lkQ~{B)L|T`I*ayJ3L;GfpS<g1T4blIR{%Of@CkP`G>;-7*RPHcZ
z!?`-d<hhdnTr$<+u(sPoQy%dYEtN~7K;3usSK|ni{M?KT+ZNN+(z$k9najq9VI-FV
zK8t1^yQ@a$4CN(;t%b|EyH3ZEQeFr=Ow(I6?x~7o2f{5Wa%Phgw5C1p%ziJ#fqqMp
z(HpXwZG4C%W|h-F3?0r=rK#W|smAEU%^nainGh9K7K}Gu+-@hi+lhchtd41%4XQa)
z`j|Zb7eoI#3@TLn2xtcB<(2nIr}(o7m%A4x$VwX0fq1>iz3W(N0oh1+gQmI2-JuLx
ztRnIQShSt5wJ_;Gx%Yg%y18@EvK(++gV_hYkZqHan&$E{4?ddr#+J6oTk$-32uFSz
zjFNB_eltuQSS~z8dZ}S#Z#CbC`DKsr%oStIPg_;11}2C%DNe&!UGe*rYo(<s8XYg>
zhR@bm*h_xl&P{oat{R^Rc%0uW@%J(}p7~t$`5v~;o8UXo!81zyTzF0*$39K1y#G$E
zIKmn6+X0K{yoe7MuL8*%8ooZjXJZGbF-f;)$1QXD8}IQTxR3^~Ulp$;DR5yZjpLRo
z^sWF^UZ{M4zUGi6yo<f0htsG{#o#WknnCYV__Yafh|^?s@glajHK>SW>OXCbD#12O
zNZM}Q)Ro@#TQ=tK$ox$*dz<V(ADyMPZ6__-iT9~Wwrb18-J&6C)LsE$H~QrPTvY4G
zG~~!-{g!Bqi$zk~LHU4oZfT^yzE1B)L1$_fTB%1~cJ<$DjPogD@y|6TRKUS`SMNuN
z%E6_&_N%A6I%xWP#}oji144&O*~J<9n&~C5qu|mJIa8>S2BNjwi`b+k2Bg?G+$F$_
z$`EQ`N+x1w!W`<TN{%qHv+@PMYPMd@S_d?rg$|zVXf7Ww3Y#|9Uobje>_+OMC5h2l
zU!><>;c8K!&k_X35;hh_bc`D`*Us9}+G;dU7<;fO5?J2!9)zy3VEEhCTllay(d&JW
zU$J5bpaPVFK5SufYaeveY?=ku+SiXN8Q><U<@s=ACg}u45R<o^j@K+Te`tFApPsA#
zWG?!WT$q*Q<hM&)`am!=0$*Z_kE^h9nmP$IkXjy~xB@kW!MK$RlDNp@^84E+Nbh4S
zT_RW*RL=+-8vvcFDS@};+I;am2X3KipQVoUg#4nWWuym4_Kka9h2e@4L?qFonfTf1
z=tnx<G>nv)d}tm3T8X`x^12;EKE7dsp`Os&=-8-<OmxJ-<qZg|FGGspq>@#pN>P|{
zRG!T2lN*#I-}DsBC``+w(g0~-1uQ#Ap)uFYr%iBE+n#Kt$H3JU9cId>=bO6rzvh~F
zlO*g4%}t+J39lg7rH8gQPJbi#kyMZ|)(zBjkmi~4?mqB9Gg>yX5d(lW%knxCVH%!W
z?nkp|Kbo1LZ1V14^#YC$ob?8ZuWxZ{_>blQ#!DVf7KX`eeg*?C4h|@SCe*_9sPGSX
zZaH?7dcQRD<HQ&XYDQf6fRIo|mViH3z8N~5QqQQ}qJ=?Zl$!oT_L9qobj*@38+(L>
zZK7jnP)9+)%3*@Xt;>n%hhU`5{^kN5aiNqKBcw0$p5?>84pCy7PkH}o0ndPc6Uwm%
zL|_bI92d&#Uy^3vQdNi6v{OP%h|A39DXPXGE9}x6{}K9{3s%c+C+{mk&2&}OhI<al
z_g3F0q=}fAnzus#r0DAr)EZAPY!{4H-fN3wH7Cu>QDNVW9!J|E>|dWF^Y8#5IGFlQ
zfHNoS05fjIn<j)~E^3D2!xkP|wIc-s&5~rc>Sc_ps@za?X6K2u)P`d(>)+VoV{Mu+
z9w#lsB6YJZ%9oC=+;8rdOa7|}{=wbM4JkEupvMpJ*LakGvoF6PF(gxDD@K;8Ygb+%
z)DeVWRiRbnJJ-EKm0+-8rx2{48HrK~77PAf*lUv@M0eV0(@CNCg}kmWu!eNvOB*zT
z6n5J7!(?cI8Krk_vq<l#k6IR`@>gWY9K6^VwdQwr9giyYpi7iy^;(LWh0iNzUbKMM
zs_$H8M1WUU<0Rs{NS#}~yXcgt4&1g?EB^PPu;$tfvcl)%|Lm0hi|A4FO1rtInl!n>
zI}7SbApQfihZDoHyWM$vJE-LC0Mj7g>4=WTeyha_rsgvH99P>C?Nj}7D6ohfCR7r*
zNHjahnirS~ukM1Z={YM0V+JcZ<7Jp+Y}O8WDa8rducEpfwTT82x6|Ae7o~FMNs&?d
zGIyh%q7Ftsz-=LZc8tQ-_U+s^dtD`qI4#0{W4qT=ClGmB+fEi<C~67XK8&I=9uux_
zSt|UPgq7o~RB`aiNgdPZxqbQDg0b{ue4e!>h;@yfVDt<OOHuBimRETDA}AF7&dPGz
z^tco<@^+@Wa3Zxk(oajOC-x5}0jtU^Gmwxz4inwf%ZsGOmk3_%tu$`KpYWv7FVW~;
z{T7`r6QthnlFSO@7lX0`@`6;vrYME+;HOQButb~XkoW2cHV+uKyoIm6z<~J05x4g8
z^JAH3Wh31ydh_xghKok;l$J`++2N^TriDA<N1~}rj7VGGZ$AhQ;5Ry}KrEEL=Q@((
zx3naY1`2dJFvNoU@5OMC*Zykii~nJUOI{p6hEjT{2iEF?EDGS4nc-zL?C{V<y$RfQ
zAcCJdL?7z)quTS1=s#M#W@!-r@Paf{_T=71Mhx#$QXtOZ3BO!X6aQUuv#l?3ub+>b
zeLq8zNH2Crft&i&KD(M}h?RMXtT)@aXSr8jf)1%l$AkJM0y!7XO^C{<QR*yt^g)`0
zhzWzMzF0CH3YYxJ77I>QOF!VMVVN^hOb&Et(B{)-BHWFkv_&+0r{Dq_Qc3Pekx|u2
z->3arl9Up>{(LZ=5M)nctz*XLrWXQK{j+x_`g@JSv+rW^aKP+C_JMFXc_!K~uS##!
zu;C_K*OD(ljJy+5M)kZ5XCv*`6fO*qRWPsfceh-cLN|`YYixJ>M#dK*xx9jI9{ebe
zu5SdBB`PYu*5ejT-i_G4%Ti!g<z^!0RBugMiZD+o^OpX204x@W{=PkAXS!LykCeAX
z7jw08?!4)rU_y_xt7$J}a<DyacghrJ7-I>Zqy!eGC_F$s!z200&r=?XhINIm2wl1v
zi*#vF4?o6lVwd`Tm2$fN_htESC8jy{gj%TsAM=9An*hkSH<vFr+`bx?ekXg)%EpP(
zG5ScUu+e%zsLJ;+hSk!-i1<M;d2;DKRO#5^E9NODe2{hl!0}DyE9sWv&3I%>J56E&
z9z!*=AO5W3Tl(BV;VNv0D3=%@FIp<)6k>Y)w?#y#zMhS0yY1tbd^_0RX2i~lH;#;w
zMwsfnnPBnPFKg6)n+*vol~X{H6$U5p^tbj~J6ET>OMBg}_zP9F{HrP}wrQR#vj5mH
z!>STJ0guPbh`Zq)gGl5-$gZC!vOi5V>qp^2fmmJ49j_$5%mMVg^LaH0?M%`m1nAbg
zsehMr=<_j~><_LkIXwZLQU~<mj+=A6eDjDZq*)EHT{h~~5%}dSW%U%ZoNDi9&%DIK
zuD6`SiNG&1-uK7~n?{tnl}3^G3$2nEmj$kg&h2}*`8-gO8C&QnX}ViH(4!!(X^<<?
zaW!v+KQ=v(4F*(u%oqts5Fz^?XUqLVto8igeoIDKASf5%WAJt~>j+%)?0HuG;BjA?
zg&`0*ZY9wBcFj40Mit)1g_kF5kf|oMUl%I;&YjTCHlp936Q2(E23v~l6K@B$5Ox>H
znGG4dBu~h0YN80~o>AeeL!=~gaku?Z7S!KfrohZ)cTG*E8_k12?`;I%C}$mvt9d^2
z#8x`n6O3YzvHexhe{jZ|P}Cc+|3rcA`*YAEL0I`1{wO*z+@5n(2)RwD!8WS*$Ycfh
zg+@GoMXvwjbvQce$<TOTveyHI92Rj950Jj{Hir>{g<if|SY%EfuGj!<$O(v@&~l72
znw}6u4Z|J{2|mt;wS$#9(C93K<h2L)UNRJcfbivo_~qO$b$Si%3d~ghY)Me-1Bi+q
zhF&0i_GMb5x!&EuJmR9mYmP75Q$ykP3$^2FWj7lKcq6vLBRfV3l0eqXk4gJ33Ceqq
zZD4*8t**J8_P?jvHi}v)MjInrXRtNnGc74_xF>OU=0a>$@h?ztW{c`0oBzHjPsXQz
zd4r<?zi%WB>Pg@|;?`{X;Gs5ZXU)o!jedP1Js&j)8jZvksCl{(HuW3S3~>Rdr17>3
zxg1kLD)b+w_1_H)N)glcQ})-zS)YczSjR<x?zREkQ<!tHL(Za!h;3!QB?nJYG3Sy|
z&#Tb~UOQ#R-j@nMa)Jg4X=lF=@FO2zj|^g<<Iu02OWWVl+)4L2H6rsGY1c}OyGj*O
zJNrUt#!v;!7>{{tENk$VZTOVSY;)Rz8m2$))lbTvTK?uXA3^sZFuPxgnEIdh@vr*d
z^a2-ZZf7DE-b@vlFDFCD6l1OvHzlk-(ow|_mxYFLm`DXcAQf$jBeNYxirKV}gr=<$
zdBAHQ0dU_R!{8gt^P|rvMbJII!)2@xm_-}E|ImA_*tn(-7OS$pfNBiQLx}vV2B%po
z&PZX}Uei?^q$GE&D1aGCHcaZZ*5tKV(Hzm=Z4!^Pv^lP#d_=H2cb5&H?Gqmt1)^<-
zSsTo$Hw{rwt8>^7KbYynDrZQqYs&rzv1sFl{sc)4V<9<~ean4U_FSwyJ^atbN;7UG
z$```&&7!t9Z7M1QOS~0%$pRYkjajERKUJ+}QN+H-P08?=gkH)l@}O*Q<9b)%n3m!f
znKZv8X*JNLK3ym_#Ap}_pUQ4&C|;U(olmOGc9OSZN=DhklW{WIgr6>M<Qq!%&_+>u
zU-XNv=UbJ9*Fby6oNkWXJI4>LPDHI!Y6Rj6Ccp3uS`lIN!=991!nLID%3T-5YnscB
zsmHY`<F;4Ry$;l{6C-hbt;H)A!JU|Ab1Mw5B{qYer?z=d#c=P;Up5TFKH;)5=OH1T
za`!A1U>8je;)`<0MNXH;DEg&v^NFpEkHJlyr1YKupA`ZA5Dh*Oi)G9GX0|O}0qq(d
z-SG~2GyDq+rG=Z}H0Ru;_JH;DJ-`~i#1(4a6)YHY!~Nn#-Za4W?)NF2V6U;mFROg@
z96v%S5+yINm=j#Y!tqxRoT-)*_%THA2Ok>T(%7YvET^#Z*EXbZwFpYmeHA`|qQ+aL
z>nAj)^K3y6-?Ys9?{=ReVt>~U@BE7(nvKZR?UoX?K+&ubXq{B#GppT4Fd(H+CU67@
zAfV=L52>mX+AJt;mrS1n)t3lp9SJe>$&eLNqZ;%V!F@@oHhMC8tNGTPh59DbBOwWv
z@@tVPLiO*E^@xevAnzjquERA7^rP{|p!Md&VF}hxMn)rOfABmF3oK`%mX}mzi!9w5
zX`9|U#IyFo<&5M+!|Mx<Ubnu9H|>mBp9#z`?XjCWma;p=WW5?L$#U&|enVFN3#~R2
z?j&&=)m@<tdti4(Cv;3q^ywnx4(t*rHHItdPO+e6M=Z2QMJqtl<8cWH&*)FoJg6v(
zSB2z<KNp@_1nl!b7W+QAped1YXI!YRg-Q!JD-%aL^zsCmkfr`4b%em>gla>Es3Y7l
z1)89TA9WYsW!o20J?#j{R{#dDhHlLv%l9WM2k)fs9=bCMQtusc#1Czkv|H1<r8=4P
zMnb@HUwIoXnFYV<eT9ld|2EAS6hKzXu7Ca!|357OP6Q=sq$L4IsdE_&YQyo&DOzpL
zOO{E%^run7bLp#VmPf2ieMv5GqBnh>B~%vAfxe?8vsls5BCX#8#t%erv_i%ht?7@$
zlwFNtZFNicQ+~m-^x{LuSTIVAV}c&kdNrm)g9ock<6v^4+Yy4Zoz-ZsI9Tc!OsD1k
zFm%f6h4{fp>PX)rw{@2<k&X!7!`HY$G8H9HYOSD}#WTgRI}C@4?MpcppEIPG$aX?j
zXDHZyKZd2A)O}ZhwDEh6)g$*uI@F&zub<s>|34w7w?r~+Ls02s-)^5ePv#QrM8R-r
zN;YNc8o^+UF{@_M)_}kKvZ}qNo(D0-Raa-EAQTOwoEIh``$vHYhm_U_Iw}nJFb(P;
zoPm2~zO-|w&L~BehNw^9I1fSnW7^$*jp<*C&Y#q!&(Z#QsmFIK^B@ngEcEevv9ViP
z4BiCvfm}@G!yVV`WU05t^ee*jd*>)TaERX9WmuUPIL(Qh4naLLcn(XPsV96Fk6XS}
z*__OO6LoB?j3Vsac+U@{czE&$=Xm2cc4p5f=KSfzls>^zwh%sXklcwXtBI%)xXY))
znw9VvTNPyvDADAB0nWceM~V7T-Rb?03ygB;;pr$*DI)p$##6<>oqI{ccC#^DhT2h6
zfiBp%@|*syOlQp>8EjzXr!89pp;e<kpL2{aqmmvxm@(obZCtyF;52!)X{BhyudB8Y
z(4u(=AWcHq!^;F-j!UhJ?%v0W_;aOw#OTHSA%=g{*E(c^zepnTPl<-oWMm89BQvDj
zPfbuO8HiVL1tbJ`)vuz9Mnlgnj<6|+wu})DqYj^a!{`6ImtmNW;rP~9+v6q<*W8Ig
zL*Z(pE(xw!w*ZWSav>ENI+@|TXtV)%34|t#4+@5FLwVn!*zF#U_Yo2WzmzFXC!CpP
zQi<g=%5INI>0@!?_(f!_<^UfjS~RcJSN%PF>!cHhEOa^91;OQD4zCL_Qd2(EZaURv
zwV&Ntl26^`>Ohn>;ayl5wat>;XGfkvoh>b-4(D-it;*ZN!(m$?8u|sh-)H;kH!|DX
zK4<8Hn_EdfY4=cq^5+`hX^ra3zuI_nJ1*wS5bXx8Ra~2!+pXXtBQ=?NB&vD<Qt6MK
zK7MXKA{hYD2AQ7}G&aA=7Ea<WwrRhf{`x;Hz|j%)#n|!$D5$WPRg9DN^M$gv11JQ~
z5Jpdq3w{tHQ}ghIj1?rnZ`%uvRV-=02tw#+VN(5l=iMMxf@j_t`|8`8Gf*(6NvPy2
zSAF@$^cKGgVuN3!_3MXj(NMJnxe4`jMcdyJ?%b)H7a<p!T%m8;Uat%y{b}+EdLHim
zH!+_gt_W<8Ym=eOrv9}VQ>8`=UGDXj2`mwOO9-jvdR?D6O2q`z$YoT}-J_M1f;jWW
zU-~e-bmHcwEiUWID-=T~1$<%@i9I1a@t~ABDh3Z7vvtN;;!iH5X07<t=A@bmI1}p;
znMb9`eC|aS1vK4Q=|p>aBa>YDSp0%(j>>T2A|lB+FKSL6oU7H`NM4#+zndXPn{e*w
zFDkWU{!~ekdulD%+wq<u#`3u%7WsE58K8wA!E2<BczFpKc@6BdBW@oNP}`Nw#XIIW
zQ6C~eZ^F^8#6|Qn5DOgYN74QXS6>pm0aotwR`O(P-lfKX6PCQg3l$H>wNds3zsn|l
z;W`*StTWG-ToI~;hqs4C6P6KrRjoUQDzxp3dad4rIy5S(r?kL}JWO1bovI<as9)2W
z#EZa1Qf#>y7d@3B0Tr<f(Q8=yUZgale!iGzv~mFcabhXJTwmW;D)1(L(@VM9gR>g*
z@zn69q5G%s%>R*9{sOF(Zz&?xK?+G&F3V8hpyJBNKyHp65oK8JX%93GfY1$H6{o*@
z2q^xR%j#X=g+eB+;;?z0F^e0kQ~zD(<OU(^%W(`Z`jN>e7~{F02S{;ycbf@A3FbDE
z+&oM&Uh!!LnX0G^&fKs+v)hz6L;da$y=Iz}IGGMkQp(W=lX5e)_d6-!2`P6Gd!+|U
zU@?{M=Qd6<Svi25wLd!i0dQ_$ow4-Gg7|>2d61h~*Zp^(dw!c^a{t3nRXc{#`~YEU
zyY6e3dhvl9v3F*}(8tc_I_#g`_z6CUM3zLLjM~!t_5-~j;+I{%BP-^QekNQJ!=nU-
zh5#~!N7YCGgPfYcw77{bZEa^0^`@<B-W8iDsg_KiO=q4H8txK2l>>LBjhW=A7P}1<
zk?L3`PcV#oco5BqI8H8X%a<8gYQ?o=Da@t#F;r}``D?7F-Bc<Fz1(QdWbSn>C#u2T
zNYVvw>8BAGf3Zfs!RFLkrCD1ILD#Xo7WHJaN8KUo0{UUNTNmpDnR{%<2->>$8<@~A
zM);mpUmcKVnp|n4npui;;y-xXC#R|X^G>yPW<P})Mn$mrrB7;5GLb^#9zhITtF$3$
zoGylxo+X;)R5vlTh;q8e5Ch$iw4Il$3F+x4&>d<HSG8uG0hfySea7C9akvUN<1(xn
zQD%&cN&%MoMfU*XBY{HqD{RxjFJ;NeJ1dk8*3uV9D`7R-7+f^kBiV^9xE3v%sC*MB
zv&6l%l%LWNQhprZ(hSF6QeC@i>hUdip}+JSqW;Do+l*Ba^U;US*hW4xuZ%VbTq>v~
z_*QM+mW@k0;yZmj=bv-RkDCw2e-n6rtqcEbywq|qCU#g1>)P1+-r--Exr7^6%>_^L
zI=gf3T~wgQm&aD`7276OnV1|Vk_L;^Q{qf@Due*PL%4ce#M@mx>C{WB9FW_gt()FY
z%FS0Ra6TvzASADmAXCGVh*+>1<I`H%$HT5cqd?b9;qcPQ4f#V@y6p)=7gm*=u~(6T
zg;69AF0WdlnmX;9?(?kKI-HWOnuC*yBqX{$`fcRGfRWhvZob#q*GVGu-X!6M66eS{
zQ)(p7=jm^Q_D^;LZvCo6za1kxVkRhGHaE6Qc9W0Dn#ZoOUMYjOz|7E;_q7iPfa%zF
zB+|)KV&pJ){%cw_{CM4d$||xY|7<Ox8tNHAC)%*deE2L<w@F;k;=4Dyiu6--XMoZA
z$gMTqeuo<Q%0D1l`|jq#g1I!rJ>#p9H;!xwV?;}&dTBKRD#}$gOXE4!<=HQI>`~nP
z*d2CzhCU-WB*ht$>WA%A|9?DPg+o&h*A^5h0YyquLTbWjkd#JJT4Eq2-Q9vTNGKs7
z-Hh&@bc4hg-OWaKjBo1u`~HHv-Fwb?&hwm7ZJChktVUCv_^4d#Jo1+-|Lu+WqvaEF
z_;xg<w5cK9#*M-zzvn*`i<y6*-T#HlZT2#FXxO1d=2<Au&Z-e+40>>XhJ!9LzeG68
z{}}zHuA?jmHvmrp8RjI+H~W;9(LW_uz3$44ZeJ>z286k|G5wWXlk2O|NA3P%!PD;2
zm-cJioaE+Xlin7sFE97AvC3{JleXqix-hVBzBPpZnIJmnMb;e;m3(neZ`!#VQ}~w-
z1^GrbzHwT6vUl^B(^0dT0JoL*j&mHN(A<W|0Jg5bt6pYNwXlD;gSMKg=P@E!d=y8?
zDw4G}VhIuj*tKY%v(xuZ!JLxkl6yI@&Rrn7eK=`RW{<U5zUk`Bgs}m>o;oxu&R@s$
z#ed*<I*zFyQmSWQ!sHs*UB_4HfcCVfooqf4@m9c3E{<#mRLNZY=rc=`(t-qr)Z0?r
zK+4x?OVRVcS<PuTKTFUd$9@BC`LYbSGO|mWm~CHWDb6e3h!T>RKCAvnxQh|z?$9oj
zNFabWOlg{2^(BaKVc`Cg1CMD?fkAHIy3$xg`)9Skvs{4xE<BA%knySkKE{UH>BS$t
z7^RV1jjI<}nP}9*n3kai6(-F;;IZB>rqr^?LaXhN3wvRgt<wby_5fg*W|HXW<?uXQ
zCTpRezzKhrqL|kxC}#Ye(r7Wa>g9scL0M%6`1gx1E6Cg=(fA6%LOjCCMnI8*+(Oh{
zD%=Ep{UfLcnO)oPm_o>OOO}_THV$Lq-UzeSM6c3JHo!aaO$fGl60av}2~V<dhqK@_
zvUlcj!f~cZGO=vrP$CuH`J|-eJN9;?6`ZHd?8v`TEGeo!@$cxc=^+Nc!s*LdblLE3
zX@+ABcmkE;)0!`f4}QK4xpk;W<Oy}UculU1=Nj8H{OBSaOSrNy93!0G^?`?xgD+)7
zBE%;j>}pRvOm1O&MpgRBICYXF3j?E~jBw(~;Ddsw;q^%U_6KdLZ<7i)O$_QD*C%Mn
z<r@`7d<+#o3p(MHH+e%pPnJXaOL@9n91&t6Ak^6797})`#JvEG7wvfYMpNFj;-^Z1
zrYJG-MT`7hWE{3o7`tvl%QTaHz9j9+V{wS_4h9tP@5)8ee|tIf3C$DSF#E8+6d2sN
z&NB1_-u?h+$Bc2<;+Q!L-*^b7je2x^TAj{pBqOj}f1Lc0G}lU%Queg03LOvgyqvN>
z?7^eG)2|j5Z(}pd9!|6Ve1STh##fk(owl48Q^@>&P(m&685A>Rn5ycBW|)@FlZBW3
z-0NZbxq@;}@RUqmIM2q9e`xvbOA#ZUV(G+~xVij1oXuVGLc)<T0_#}u$4D01ucL=e
znj?3aV8Ou*0N@c0xm>&p3-LVAsxT_&?fZgFSG+i(qrdy&?0^1m&dEITVe&DHFy(8l
z*i0t8Oqmokjlv|~yxmTEn{^XOH;u=(d6m4jd8*JsjUqPo0IK3gA7yW9NE=>()YCi3
z<U@$mSoPlJ#!3tq&St&|nPV*DCBwf{C4GDrF8B1w(9Qrg@n?Q|sUj1-Y$ZRx`URe^
z29sD8hQs|Xauy`AmY3~?_=Dy6iZw8$-1wbjaZ}JI-+g6KqH?)aD=FVK5rQBgUCO8n
zGFqSwK9V)XfM@P61HJxVK=6NS`b5SqYptQt%{Yusa)g6_)ir(l^nO=&1^i-%AuQ^<
z!*<JB0ECyB_wCcD2o1(xvDjHoM`hwt?-1<?Hj@C07&9XMok(bq=PnK9SAicS{RD^p
zFCkU9<98Y&GUPImCGlZJ{p7(P`;0BZ5={kV9#~|t;SV_%fCmv=HC<1c1UQP->sPaX
zw2*nO?AWDjXI81KJibB+=OGypwhV$4KTj{W^D3(O6J(0F5@edTpxVR#jg@>X4C;6P
zcDdmwY$Ua+#8~rz?JX0!VwchkdY9Fc!Ns62be}gV4A#zVPvZI>#RUld{-va&5xyl#
z>bYb5Q6EF6CDaQ;&*+gy-h96)k0+W!te8L%UUThzvIOi`9`Oa!yY2P!pV4IPv7$MN
zx>;^^7^B-Rflf{5n5|>9PY9Ay;=Ir#gCuyUNR)^uO8SIA%n3gR2Jbo&p8J5M5055Z
zjy&f&B1*%>!X4VxVlX(e%3&P!ezU^%x2XUB2kOQGw-%+NgjXyFVt+)*?qStSl4d3Z
zxKc;m7BnV|9((<G_Vm-bZF^~UWPYZgdH4(oxv36HGw7FDPorA15E7}mWO4r%t@fg0
zn(oVT&N}K9@I@>Ae8ke#7Cij}b)zZc(^6?4v;Rn#M+r{Y;djyiPK<|(B2*`yybAAd
z`GArln1q7zzie@wUzCrjSqLJQl!QlqbkX8ARe72~AI!Z?Sov7I>av6P@`kF&?>N_J
zc4J=Zj<hk?OwYE9Jx}lJ-xBdZRjj#NRQK(pA)Kx!Z^9*!sv8{HS2H`y`j}+)G4|+=
zvf1lraxt-bWMo<KBOl3mA~x~AI?!S+N6k4frhZ^>3S7@TKEylIKau&y^YmS>TUV?>
zA9Gu)^+xW28^+@Bm!W4$eczrGVML@S6N}3XbE}hml&gyGf8hDKyt#orWUS$tOobEr
zeGu_nkQ3Mzz}7X%)$(#gi3iCO6gvLmja{??ZgC?wOk{QvIQIabG(ZMdt~DP0Sb}vq
z({3Go-w1Wv!PQH79rVD8U^|c*MD}-+y7qsY)N@{~JdQJbfc-5ua4_f-6BD*N5k;jB
z1zE77*N_n><4R6r{O@OyJwvqXM3h^i>Oq{#0yDG@L(>)O(kA3}o(x(Rpma|(OyOxr
zat7HjE}z{uKU$B`!B04MK>$tpcD+oO&rqObTJTcPhAWf@k6dD&k>ta-AC@nF$#z1!
z8@+<zxRm0d#bdK#i<H~csPg?+XXvl0ss;VC4?k(#qh@pT*BLg|u;p_4d&&Yg*+C?(
z7F;l-|9rkno*z2x-wWyrfBQ&4tTBoGnB0w&G_BLPkadgmSrtM?wf(M_m&(~jLPM<;
zi<WU+$*ioW(~rg3#+?;10TNhb3Lm&=fqm5NVn2W!+^@3Pgb29Eu-^htuo#3iA3pb+
z=2;Ot5+%I~R@}yrc8y9jrW&XgQ05q#SZ!X`%jxP9nDHutqqa2WWUAKO+pqRL)8U%_
z?x0%prgpa7G{xZ7X3A^yk!shvP@?Vrew7F5W(xTOKYOV0LafVci}bgzD!+_8%aBQ5
z_&WiF0+TIyJppRA`-%Jedr~i~(Dtr@Uh5JJS2QigV`;6=sA~5KfxsLQoqrm7majzn
zxFc#S*o%D2tjFRM*@{80(72|*p+Uu$BQkU}zccj9wS2ZUXkDwfeJv9BpB7N@mDXS;
z179;v*j?Ec*(j9#OT@2_JaI*oFF*Ay;G7wo!ySev@;D7&_iKLxTC0XUS)vKY#mjm8
zvZkI(;uHQb`qFDL8;{GDY{qwO)gjOym4cj7ha9HARVosyalX*%*PAe>KX{}XfcsZo
zn){z1o3r76w}j;PIYj(s9C~47dymUp;bedCWmP25QQz3?S{NT4r1Y|2$phuWmgA-`
znEm0CBA=ww4^wdsz-a8-9BN6`viwJ1BhMF6RsGVc5n3!hCq1tn$;Dp~?_wYnnBvo^
z-|2B4h}inQ)7FxRx)f}OIuX67kEe`=z;J5ShLK0c%kE%+!^QbNu!ro{Mw(^t*Zmb)
z{&c<m6<Kb9_b2zq{M;)PuYGaL?^j@e$HehRowyQcL}Da6S^<uvFFoDGS5qL;cWWB=
z4iR^u`}$+|Doh6W>0+%nxB2vrB1d_{Fhc}#Eucsvz1Py8EZ|0k#;&?)<L|rpbN{9a
zbqgbBV`4(DPSW2!P$0&ixjLGL$%A-9me%fuQ*`Xf&sT8dgwEy^1xYiL8E&f!(-402
zNl{~Y&Wc}iM~n*WyWxWd__&(}eD0OqwWYQ_Y>ZQ_CTG7vKR2Ms)uMhS*E;v+S+mOV
zD$LTc@z)44o%qW8bb<cQ)NF$9f5S{`8_~WP%%3^@MQEJ1Ufm3FljE8(Z!g$yfT%5f
zwRn;swl*!)P4Q&fZegr<7Gte=vf++jI-{I#T-asy168*?9XWRH0(MyzFAx~^K#o@0
z1HQJKU2lrr0vm<-==*TDlaanbU)C-#;pralKI}0_Z~6oWb<*r^5LIJn{4>o$^6k0b
zO1r?~&eCChJpsr@80fcF9^=)5kwYp-lH}G>(;zyBNh{^m(_=nu_>*`3#^rbEAWe))
za1JeTih0JIcg<GGCa8Z)wT$<@d(PW?vJ7|a44%{4kN&dY1I+TKVELEwh<R6Z;&sMA
zE4M#t&Q|+DvNqf3-!I)F0}H@8&ZLStHYZ!m1L1zXym>|Q$n=$6?>zkR(aq9H*Ov<Y
z<<)3UAWeO3Q#4JNysWC?nKGKaTaE#yeoxOke^{b7F*8rJF4nbuSrgxt#SKNK51NX<
z$mKqf>Uu?e!6%U8)Y!@HaV6?3I*P&<$Uz)#DXPX+mbrKU*ND)I!VrZrnt&4IO1v0l
z6#wG<rTzh;OKSH%F!G|9-XI!^)uq7cj_yk@$)w-2(N!HA)5mUjS32Z7tW)h9Yuvx@
zj<<Cl_cWs*?z)ZU5~6}y6xoX{QVti|)EqQHHPj)okLvYh{DJTtJWtQY^;-|lZ3ClU
zqGF@=Z@#x0;@m%ec^jj(ryyM}YcS9(=zn((7Dc+lTfDaUs|+z&7sdVbYvb>;5<y`b
zm}2iW8LkK%u0t~Hc<DoI5B3)13%8)6<0r++&3-q5sBG&gsx34WH{+0ALvKYt82xN5
zq&OyOB{0PvYg3ge*2n}Z`-7fHjkkp<@<!49talhGIizj0uxY>qU({6nDT{yB*}%KR
z%mnwL0yj{1_xs%-^Yf6!RmEL`LEMOqiS|hG$7_;%@LJ6#BXf`CXQ%E2iSfX{Z8xx4
z_!3GZjrrR@954Q2hTu6*tmAggVcSzWQmjSQ38YpkXJUHRvinV?d??mNJMVsw)ad>B
zLJx5ZeDySs^D1xn+Ib^2p?~{zN0}@>#}{5c<D7ZC8bqFM4M^P65lQ5z)d#j0@#3Bw
zC(!fm2`;nU7G^&ZI^1_&EZJ%)8l8q-iNt69SrqN1H<dJm3gGWhW5IflS`;c0(?^9o
z6OIBdZg}S@(3|O}Z!VCB^$@IOQL$zUho!8{NCphozPUg?kQ7>N=3xYv-9h2YCO3e9
zny1adnZg7gjnu~_o$R?vwr)o+`15lML)IF)G{@2p1&}A4<&AOY4Yh{?LP2YGH{Wtz
znUk)~hTrY^&iqv_?`cq`9utRBj_Yhvq;7?cLQQiHcUl;uzlQ;U1Xt)m*^XN|aC^~(
zM{}ZG0Owo^P@xjOF;X|t&}9%aex`-9jJSnu5NH3E8;NDP7Fh6l^9wnEx2BrMP(iq@
z>!?|a>Zd%GmvZ+dFLuy3u9iB9`Wb}HyQ22`Ya3Gd1@dR<j;EPOd7C$C0!I?1GSI|P
zVVu(_yFq9N6?RtzR#*srlKu?4qOMGPx=gzH<E#fzh;i@#j?h7f6AlC~2HD%oF6WJV
zG@hy#!5HuAxtFYCI?j`pRCsGeV0y9$x}~T^+<e373LIZs)kgH_6N7<2s*?PcZ||Q7
ziz+X>_a!{(;T1q2>TofIeVId?s%m^Wf=ssZ_)YeqI4zM*{!3rPaxg9iynx8wgAClB
z#|i$daUUUk&ml(Ht(L|}@4JoYeEa0&1?DtJyp_N3vGPFX-Tn41%<WI9G{Ict&tLnq
zX>G@eo0Np+*oVv7duXtFi&W~e0ueYTwC?8{;;QUp^~1i+nfgMgb*5+L!r`pn)q5TH
zI?PfV<E&uZpuCx9t6Q3Y9XY%1K6&7_vls4nSG(V-pm%_CTAZNSvzWDZCak$p|7|g2
z=47|^w52KI;_|=F-$C3GDc?wL&l9v){+Z-{!R29iifzEfUmt-#Jbv*2TUK13KEAwZ
zep<u-as`QYVHjgysLp-2+(vp*Ok>+-9g+P*d-ft9&#4+>IfuMBBlUm7out)dh_5+g
z@8H&X?3=)NpgGTNCY?~K;wiTD2<vZ!IN`r7Ocsrz1CErX=64d3rm@i~qf21k$)yL+
z1KJ68SLU1}Wp7)Wl&8<ISXl!)W-=+5)6!1%k`GwJ1Pw1W1ze(3jjpPGZ`NfMd@7Cx
z(M><4_1B4U=q=ZFI9vYxQ_ndV<XH1jkbUss5{aKx^GPC{j~ei7amzb;uONy155-%Z
zF+?fz=`5&mA&W*~5mI^W(QCY~htur<dD9s!CD;XQo5NcYucB;N%8T9OB#^gqOb4Q`
zAu+$#sWO{xm4oaNPK)NtME9q{_wMC1@ox&HIi9xmuY9*1m*)sGyzf@{O1p79#&s_^
z?PpR{Fi<TyH?wCOZW6?P-CK^=%&oly`CHdO^^pG?S{m*9N~y2(n^a26ZT&9xL{eY*
z<2%y83$-n(B}9yhix2ZEGIA(O)xzbS(hmrTBY$$h2v5`x!dyBCG?$#m@3?u~xQbsO
z%i<U?K|sE&wHR7m{lc$^Z_#k)yr{Sya#{4Vs^DhRprGrl_>X#rJRKC{``@Dv<n${D
zM(>bFnyw|P#%2$D5_r<={rd@Tjj#2XYk9BSr@y+F^4<t7c;EY$K0d4u))%!e^I&F$
zWSnE~Uw&UAXv5#dob_rwb`CRc5jyocL@Y0j?s=ZATpq1$9f*{Rf^P5k|C9((UL{7a
zt!3tM;_pn|xrkKjD4?gQSg(D2Ly+VraBx!VZ-D;PKO!O~>AN8?26F8&_SxlAM#R9V
z;nmT@m#cw#LUfDi=KhKsKEK=UIbt*R`%}3W#L`e0nHQa|ZNFidf&%A15v%1g^<g$H
ze~uYW=b{1owF>iH##3e_{R=7X@~^i(T<oz|SCBPIg}D#jcgr_4z%%DJM|o&T_<~P1
zkxto7=53wWi#j>?480Ov7fh5Xo4-zAsh&#TckD$G<@Voobw|M$ninlzjRVLclrJ%$
zpsRNfH+;o}P1e;&7OrlmJsmvm<0rSk4nVu=HJm*OeC&tkE5;6SD*6rdHx44!a0ggs
zWk57V%@5YDzdS*ud%}ZNVguo!A;F=Jg-xxjz-Z_b8*|GX54Lglt@;o_y6ZbHabFQN
zWtunDZh*YosQSVtFF8u+pR#grh!5<4x14YFR<*;1ReHa1K}21V=*nI51dQtfPvxI2
z2~n~~LLN-Caj<VY1~e5<gO_vg?$Kz9F&u-k3~Lh&y;lzgqu111oRw~_X!lFsN~KRq
zwz$Rms-<^n>kf1}ma>l&+fN<bqzqbTIU>GO<@iBkU@Kwu?vO2LTiF&A^4}=LePWmL
zL-^J=f1idf?;9$!5n~+0Mb_HVAg!^W_W8owVdbhX9(UF(_2jpUArCLy-fZbM-#O2d
zn^B~dFZhHGA@@(x%z6hgo9~bvf(OKUMqpf9-!E;3RxL76kV2C&hYIAmqyOD9rX&BH
zjHmY)E$QENe8PJhonk!yvuFE08O*s%kH;+#gJW!xi+0!@XZr_(QNIoLqhoj~<g0nP
zu^5qy2I#HJuit|@G`J1?TPN+8gN^o9t;Cx&(HS(>sv9e_(P8&mCN^{)y5&oihH3Q8
z?Ezarqi4YSx~+tfT~F6^vzwp(j;IK(iHhJ$v5)}Jtyse?LY2R{dYCkF4|8H8*zy`c
z@kVTsECKRyQGwQ&=ji;Wx9dIL7lXaq$YGx^wTRqr<*+3^50;$h%d@??9?$9C)IAtu
z+e+0@-O!%dffaJ_!2hNZMKA!~+9!s7_j9B7f1dc^FC3C8ScqKGP*+1B7mzHk^1ZEF
zNOm}A?WX2%Q4H#9;OS6%Vd2iXWni7RbrbXSd@2!H*W%IaZt;u-U;6wMq}4h2n09W}
z)~(f9^`4rkB|&JGCegN8<7~W<GzsaA0$-rm+HAV^{r3OZml$1^n3u(#x(_2)0rrWR
zbHT;2e8>D9w0o~S$wv-wJN3bL?j>pr=*S8E{pGEjts${z;8ZOeu<les+&G?w*BE=l
z`W5D8@6}dr!jY4vribCd(=7p#EwS@uuh3su_CDbf6%Bg<gNNi`V_*J-K{1hXI|P`{
z+W=984EP^p`AZsD^c=B>8lZ6%PMo6LQb}ZFe8~g4)}-~zaQD=`;sea!@H>sYc%VJ7
zBnGwy^J<-?sSKxUZ9VYqX&ZDo8flpH(6|n)65NNW-vQs&e^;fp#R;f;2=}!w*r`9)
zXZ6t;ax5)IzVUlP=Qj;9YBgvEdNBQAULs!qq4jZ-27H+1f}oe!F-z$Twboh1@hwTZ
z{Y5L*q1J9K%d`gzay*#zB9EItUhu;(_G`a~ZlJ-0SVy*Hvuc$%4d4SX-(42Mu6HrB
zUS@s)&3_D+Y*pasq(RcHMD>tB@Z3sWOz*hNQ&#a8sHG?O54{Bb*ND(G|GKi?e77k?
zw2Vog=GR0DoSIYsQccRyhgWXS2~)|ynh<*Z#%Ov;U-La(2a%Pl#^`OCJba|yp=<B`
z<CXqP1jSbbn=t65JHa;F?P1LCb0oh$<!{xaO&31Z2iJ`ZwKz|`Uq=g%VBL3ix6J+d
z->pPv2PpFKM|Qt`PRMi)@@rUOJgV#YPYd9Ri#hZX@24k6SPi!M-GZOFlX~14(O;(0
zED<~V%rw7SC~uzoRSxN$vsT8?cyA3XFlbot{B5|`P)>0>*$Sy@j!kS{P$k@86(ePn
zv6Lh>WaT-c;_zlGZ0kzRUpRvN$&0K0oF9q#=C^Xmzs?pmL&18Ep0IyWQKf>hH=dey
z1y#Ee{oek#L2N)a@KoO8UUzDcIAbFwoP4o3mA~LFN$&cdSxwuoh5%;`uX=v^KDnzA
za_6V%S?+bwu<Uep_I?zsGJdja`M*hy`v{`AFt3vN{ZW8$nzkX_PwLLDx~85G7J4nB
z*w&!<aGK(RF(YZ+6L}6xlKBByVc)%kc8myA3%XfOQ~bQM>8YKFvaWv|z<G~1ep~Bv
z@3ESNpG?AHcL6W}R?WHTHIR~;-!>h7+nI^^bd^e2`u9dm#D6v}b!%1QO5K!0`Z}8e
zzigVy{mV(Jmw}_u>SMQtI(ebXfh(wegWA|fzw}lBpEqJ~47<LRb=Ar!1`yRPYvN8-
zmggfdW5`;oGKC0(RqdwEDahoV?AeZO-h8{8G;=gi^SW5Y4;yS<)^W59o|IYmtnT=C
zXEW$;?;eoyJ_Kt6ivmLoX8s$fzw!b7;uClApe%%{65tcGz&sYb+l?{2fByafbY{FE
z$)R!Rz|{tF0$`?ibL9Bp1)U+$XclvJ;_+49zQP?0ycDmIQXwBr&R4G5`b4sY!jjSv
zuq|dJX17+SA_}ZiPu2L&>bK&Y`}S|M1V1W*1OB9BGfx>v+P9{b(1!@jg%8irYo({y
zA7sa<%4UBylRcapT%)WXHKIwIIr7>jEb{A~540AWyDp2(`TRXZny6yo!H&|4`cI!Z
z_EKkR(FAMibJP&_9v|l2AB0zDCgooiXdP%>>P*?0zH+E}o}H(#rq;z?u?6jwKz09h
zqQYGvDpASV2z<HKNpur8$Ix^BeAn?<&b!wfxy*MSX?fM8_!hPZJdcSzcUs|fU#GZ?
zx>517KYYA@x!mDfPv4!vAlq-x=24w64K4P8NGGZC-}hPD_jZci*0f)s_e$#`6gNEF
zu1N}?CLQN&L3NZz0XO-m&;MsO(qG0vRpyNw`}>Vb0;JCR{M~1%8@ZM#@A~}fR1Ev(
z7KJ<uME?dHw6^FQIf}`y3AySQOTR>=Bz%`o+}xYI>EZ87>c5{aG^*NeQWRD#b@Nld
zcxBLUsbO6-cE>AoG`!&Box259I9a@%JlS<x&BMGuKvB-W{>^>N{$n4b4|%@bR%v5!
zm+vTcg(Y|+No<cFbhFjd!kuTJ;vs2#VUHE<?u~nCKNtz2Jh{6_Zxd9(^DZAmenB?o
zNmP;gI!qGQmuH-g4MKTeHoW&=ZR>lx)mHSkBRL6t-}*m0mmPd%gW!-fh`y`eiUO|<
ziRKNwK{L*1@o!6XBe}^!gMDZbqF7sb9(a4#4dft~J?@fhzZFk7boY0c;1oJd?h@*_
z&G%fL@_{5^gWGh1r_#*rqb<s3*LBCK^_qd_^XX^aKrSSgowlLMvpR1S^`YGNJPSq{
zdE8&|Nc9;|%e|Z6Q3cJiS8%SPs=l;l)}<xPDgGUun{VO))(WY5X)7K%L=!Eu7KT3?
z5^=nS9s?4TU5M68wU_E&l~$m7_}pzpO}6mfRX^I9&Ol~Yt!3&Iid9YF^kK>5ut?xG
zXrFSqFHNw1Q7BGVDXcm|&%1c#CbCs?@63J_fJ%__{+|o6yq#86^@fGa<q*UCU36O5
z5{<NsjZ)V@4OA=QavPW*sfLXQ0!Y1F-P;UHDy(|*fz;4f<+iMRAE+IA9y*c)ZHBb&
z95g?>j2yjW=IuMsH#tMM49;+r+-&#;d(g~Q<rTQm-Hoj3IzS)u<E!L3J?e&+;<s59
zrE52bqcoq$&Hqiij}d0zU)|7*#tK55!oKH0pL+)+RFf%uW`05#MOiQ}aU(5xzLH8F
z#@`y|EpSa$wttK>*s_{F+HR=pMf+LXQ?}01lzr7h<7rX{5bx^wZ2Lyb!ZHaBI-;ZA
z`d$Jlp`EgjsFPS#xpvc5VYi)EslDTQR+foMGnP?)_ou5{jG_002u7bupZ?Z+<>`Tr
zuEDLuGu*mTH}@8?b=Z)29^)eLee-vXY6#_J=ZZl4vB32{gP5-FhZ{khaxAJ)aUtcm
z+Gs)-ad%lWet;7o9d}L0lHK~j>(jR%fq5rozrXzM?e)5tfzgYUFQ%hh0M#P%S5CZ-
zopi3-iGjqB+yEZ80;de0@vXXzD^NsF&>_{kfenXVnsyb3*!Fy%_SRv}i-|W`zX0~F
z#BJq*WbwUQcyHLruHVfs^4!G8=eI#z1d$qJ)&b=?&=XdFRJM4xk%2<6(RdVsF?E$^
z5NwCz1rXmN`6y#(ZY8s>4twrazi6bDbc~YUD>NT$wXSxs`L#OXw4A>}K3rTHIdVrF
z)_)E6zzwgL0KEPs7Ik_yx`%y))P~gl7IWu?=Tjm(5fwLq<LTONS37=PNFU`<FzeAD
zKubm$`+ZQ?-j+5dXLc7{s>!xVc%+e=QM==n@dEbugQ+@@LUSa|Jv5pB$GJNx2n#BM
zAV_7<ASP|_#MP+#vZhROk&k%W>!E(i4vM8Q@7Ka`x(IW>ZPf@g)O97HAiZ`A(oAPs
z?0m6%T@P2rf!k(y8~7IIqd0-c{|I(@ICs!KR2+VGOT)0IgpK(Vi%wi%)v5nT9eRjn
zc&l}d{zauR_%?0k1UloZPjwW6hFt=W7-}o`EG6^56-2)Xp(M>k^O)-Zo~e3YM&gG*
zHwGp!kYB6zhnJO0I=vScs(V!aS#AqwG-<EAB^9HKBF{T6U3=;zqT7EEWmZ2?W(8ra
zG|pc=o55hXTY{&BH<dJ%8RT8~Tf73#zpGLl_I*xRXdhKQn!>Z6*=65Pb{REa{I2B|
zT%>^z!IbQIC1y)z>L#6dCWKQu8xMuKvr5wC#j`9#M72)XR1N-4X;5O)J5x5wU^3@<
z4>D>~J;5FjuxdVC?D5xiOW+PXas2e`=BlU6we*@CGN)KqZapB}@!k(kWc9A6tO9IU
z3GjF=KncwJfz6NcIwXXZ``d@qfoYX45jsc*#SC~iHFN;6W4uo9XhxD%$1tN{I#Z<2
zZRSlvmBN@Mbc_k1E2^7f7}7Ut4JRQt@hhBqtp%OP)$30s+a>v7hrQ|rU(>*E)(k|G
zVx2i}t^~|P^pxF})z1<O6H!K!J_SM?yX!LP_MHtwe@bZShv?M6qOHEQSSc5SuA01_
zB=cgQm35i4=8esN*)Ht17p?-w*}hPm5+b@&4U(5Rh(}lI?^sfCSzx^QY`7p^HgJyr
ziZM3QcWdcABKB>>B`>0<jB+}me7)5TL*;Sk8n0=0EjY~>IXL-3$cCoTc=|naWjCZ$
zaSu&_b-vcL1^;D)^4yPjIb@$$7V1b(M5%I4)jszN+UCB9pBj-wq0dFR8gy)Pz7X9=
z?zsYs<#Iw>cJ=algTlS8AG&D<fLftt%l*p^EtqUm+AnMJT-IXzn5S9XUOQt%<?$6#
zrlS`YyFB}7_bX0!;Zz}Fbm0(5m{%hU(fEBFRjBI{Gt^e&<-+U+-PX8y_wsICD6L>(
zpf1<*$rT9_31;`acZ=v1bPEQxPX2q!11O!$IQ5lgQd1g#$<D`69@X&P^Q&h#3&$44
zS@qK@t{2TQ#?~8$g&5-YXPQmAl+na`Egx&|Y#)E#osx1cFm;K(+CL@Q&x1&}2(B%t
zMiMivKUdkcP~FWgftRQd*w|3j3=3~IlfmUBe5awnX=33Ql+jyjOsYGxj9mBk;TpOR
zRual%!mZf%Y3#W4e!e>ZBF~=fv9Nh_s1Gz|>>@?3n7w#~H@9a+M2(@^l4R>!w_A{`
z5-Zh?)CV<11^JJIOu-AF!P;W!Kf~9pYAWA7KWy~*T*mR-%1N86TJHBvs2o?lg5xw_
zziSRG2<$xaDS2O=^+kbpzIFY4+dK81D(K~|ec7^e<0qwae>R)FV1vR672+C>@;qcu
z;K1H2`7E58aC=3|1`$86p*f@F>RK?)Zf{yHO5atL?a9}6C11rA5*12yr@kf)nWZVT
zSx6>EP`MTuJZL7@lT57yzlQ-3IO#a}y(dMkJI3gZN}jmEKWu=?Q<-#(hU_zJ%#ORp
zBGNOnJmL<b{o8>=3Zb0F$v-Mt^%3*C&#p_mTscXecU6xQuqkKj84kkxLvGK1*JLQV
zn$H`@6@4y7J1bHak^%8`$N_LD3)D3(z7txtm&t%D0G{=r_O)Lt9-_V0@<~s-5yg4~
z#JUY)-NEcz1J}fMTkay%X5CCF-^|UDo(?$cZbRW@W#I}8qHUD^h`km3xCQ+2RfeWf
z&kB)hEh~el<a&P68QrgJl;ZPKPhd%Qo_XsoebWgF!Jx*4H|6odb7jkMD9a66O(9AZ
zZR<gNV)v!cA<5X4pN;(b#_NXht*)tIxXjb@+Fg_+<RZ4!_Hw;M9&5~0Q;O!M^duy&
zia0SHS3o1_8g^#an^4Rz32YX>Q@7`DdOnB$q<NR35)39+5&r$pa)WFc{Tmo<ahs;j
zAPh`qQzpL{E8&HgbK7;hi8;1*yE993@vGHzA(3XqQ69`~?K>|;>uR?$WoT0<vC~GZ
z@g)lyZj!isb|~g@&;)xRc|#hffE92mpac-uab*6}+EC8%cAqIK*hqU?(<;6N_22$@
zWyo=<mn8RO_z|_9%R=?w-1@5Knjxoh%oM{pEl8dHi`M1(=Gi%`Zm}T>sDo`E%Or+q
z$DAfxXu&jdlRQ6ZfUvFWDYENbXx^|F?<w8{1+HTDuVmyO^0R`6CADC*mu;{4JcP~2
ziTt!`W8Rr)7u7OVfMF=FA*PImy;s=N7$mtCc!ABz8zBJtZgPARMy_Pi$0teXe6sEy
zjtvU-eIaTP`f<a6KUrBt{kj%aM9G=N8T9O~7g(g9G7j=nFv-b7@J}mO=tO-><;iE4
zgo?Gq#=BBAU3vWWS!#*6c;h}G`k+}bJ_J;{>N}EFF!T4({0<H9j+f@Rz9FA4WEbk9
zRLRn!qPM1M40|@ghX=r2rvo16BGtCxpM;wvHb)<9GEx=I@6sL?`I8+8k+;U%;pBOX
z<Y-#aRt;i{il_FktOFh6sTXU@jI0{94l+)+riKyD{Ijpz*h=3|s6S#W3eaK{-0wwU
zOWMU8u`mf`G{1wx!rIVDY@NcaYOtRCNvaq+541-!OS*zEyP@t?Tb;T5Y4?u{f8x?9
zbwwp?!)tQs+{~%EZ(A=<d=~Ag0?SVY3sWmiOLF~Zjly<_yIG*6wXLa*tUCaz#s9Pb
zg|lgIUySAyyq+?rIv5IG$S9-TIeO*pBQfn!Me2sjTDc#QtYR%@y9saJ)d0#o5;MOg
z*$*+FQ5Gho4l`kk{G@oHjQJs``0k-zleU%Kz-Uh?Y^>BWl*C^1X1O|e*|p_$Q9T94
z365KB!LPDKEA2yl2Z6=*Z*zm-V~D<Yuj8o1aVHX_yQz5Jm{&klKa)^@_9Af#T(+vA
zPc_+3^A5f4u?N_6ZxPbad}2@p@TF2ee@*KCBAiL4Q<tpuPHL6j#L(1VK%%z`Z9y$a
z#$XD`Ujb$Vy1DAyEL~QE+P}1~cn~N0dVRGHmKrH>R)>)}>-hwboDeG=)>=@I*H@V3
z$LmY)$>>`ang8f)D08Kc-*Ysi#+=$s8*D2W;}H?#W!Z>I=<TZOsWV|OC@(fr%bdE?
zfo4u0<vz+W+Ej0vEbZLZ9Jsc&z1f2JVL>f;QCL$N4>8p~WOfipj}~kt3u@N`2HyF1
zn+Zimcr6fKan8q}nC$PnZw3)|gy;CKIIGk9GZ)i+`q+B!XLU0T2x0N9nbU&Jv65tY
zIlhiwNLGa}L_p5T50Qe>bu$uY$NPS9Gt^XIQNDv2{abS7G`2T}TTDN%Ib-+zu0B56
zW61L}KJPe*w45e(tDQYjK%qEB=-STo@5soxthHHgel)|Dfv<1nhX7u$nD}b_60?ma
zk|^dR_k0{?lOiRmr-thC_&x~cJ|pcRlwFWKXdbwBkXwD!rP*^I{ZeVGpc_=_T0c?O
zgzV9*@#1->z*k)qm0^u!kgR3f7;ry<5v=IyFjBox<FLu;ZAV$O=2ZDV5KQ{$#EB-f
zza6utLiH3l0Tp_rQbM~m9b4Aq?KR^nUZ0mB5&FdHeL~e%vg2IrWa)?0S2vhf-QiPk
zr4kD-La`&X$&yROaycJg(iw@HS_1i`0?o)JkomKfmNdHKmKo#2ND#Ig?{Ul0ztDwI
z{xFT`DoT3di^I(ztmNr3<dF#79&dme&r!p09RlzqN=OXI)#oJ)`JPNZ-z~2OV6(BX
zPCyT_3>Q_w$670FCebV#|MYZc)aW`{U(7PcclEljl*&@i>f)RNR8+oU2A6mGQVG`l
zG}iI00QDbHZmS*F&1+aZRl{ZYGj%pO(l@%Bre0g^jdd}g>~JMTe*B2!3~o#f8xFO1
zTY#&%T^#2rx-kp7iP7zRjV)_dtv0@qa;279^c2WTS}iWP<jUBo;y@vJv1d4_-2`RK
zc)BH|+7Mz^OK&u#2W&}Ou<@IS^GiD5?szTPa$_GCPgVpMZ*HGnF0&cn_9<gT5(ow$
zRw(*3+?_nfEr^)_n({TQ4>$92HZC*4NbR;~@%Grl6?j#=>IpA?)Xb`TOWho3j!GG9
zQW$(0%Vu=%;W*kG7Yb}oTF(c$3v=^UCvTe{_ddT$^*EPSqNw`(0|EMy0ydCT<qnWx
zQ(I`tDXmih6+68c*MTt`wgjuUx_$LtDO)`H{3TLOX@vh_75T;U{p;bG`pfwgFE&vB
zo%jLOY>VT|=8p1j6#$qMe769Ola7twTU~hs&rr{FsMNbWY2Sly$x}XGouU-flc#aM
z08d}vt7SsdC4}|Icd0R=yy{qoF`3Bilj?_e33C<i)RUd-2MYx;&JDRzOLg<|kU8$c
zZF&0|3Tcj~8u<X2)xxZsutG6-k)@j@a0xIqRc`^FxhPcQ@u2iQfbdX78>1j_^diy?
zBL?L;GZyh3HR>=3zJHwmdhSx3!ESX`g1hO-*}Sx6yuQIWg6eH+e`Am<PfjHEj8hTq
z<{ZiW8N+_`k>Wf=*uZx}S99P<Yw5^BGcMlqw&Up5R>;LwCufoJ+l=QYf0pIC7a@Mu
zgR;YT&9kJHU>X#);1Hl3?HM=h{c-7r45<b(6<5lMIHj=0a`bq;5pPwSVw><N{Y^tY
z4?g$o4ea-Mt%`$9p(0i0zmOBYCCLG1olRXQ;hh?<x6lPfs2e6wSutznd0m-JpJ_Ty
zGy^ICaCyI>vgLLZxIbay*~%J47fRZEq;TSDXP1*!es!64^uBz9yw*;U_|oS2&fZ(=
zy-0@M@O@gj@K*zx=8ob*Zz>b(HpoH;>xZi#b4`@EKnl3Yp*kt@4x|_e`YL6s!j9cs
z9O3^B)czf1u>?C-g8;*pn?1+*Hr=lubf0xdi$s4}0L$PN$&9c}Y4SFD)|G3;yzKdG
z0W9*d4zP$$+dQu+^H&`Zv?|flH(m5!Fi9vlIwDpaEs9Se{7^~U+)*}Lmr()m;1Zxb
z`1n|x&5iX-95HX1|CB35b|0wgcD{v<acKM+Si75|=09G}3fFKKu+CAw1ARYr**Gj^
zX^xf1iueUqQig98Sm^*2S2JtR__YtLnw34^hb}=OUKWma5UPv51il+Xws|v)t2)Qe
zn)yK?CMdJ8Irc`Swz&AcLLaiUQh(Nd`XoK(;;wd50askpPE?yt(eYz3S(CAObL8hj
z?hM6qZVIs?2JB)n!+xH=&<V~NJwv@A$OO}U;5xD-py45vI?^Q~sj<azx<#dryPrya
z?{0{AYovLY-T6TERyDWv=;a!H$cuY$!l-o+*Ttjhgsv**<Y{O#0*4v{zjtCs%{+Cw
zagS%|J3GBVOm{F?ufkwdb~a~7>5V>^#q<s4r#2?$!LMeah-#(H{JX0L8)560fN$v;
z(OgUh(jF;iC5c_5gGs{~Dm3IhG44Bz%}$Q78NGKJBTP(0#qXf9p%#taJ!OxYuWg$H
zw*oqkTtX&a>HI#DjclcNs1%XZQx+ffGI+_9rrz^Om<MAjsSK&6ZP;}y+QYAU6{%6U
zslmQ_)X$Lqor7_H<ik{d`VewHF<sF-X5FnOW2k2t0vC%ZCDcFjZYB569OLi({-y~p
zl_jlDPne&??W1-z5qwt`F8|kBvHbDstTj~l)1~XEn%L)g4S}Fbvk`XQcb>Lj7e!`n
z!yvqH4sGdI&Hix_zBM9PoAQZu?9g-088;$pr}-sQfS6DP5r?Z(5%<LVKyVwD6ZrR>
zzNGYOBrjNZUM3ExR|(dE6-aaH%tnCTCFIUt-=i|`KW-BC4C_fv)41}pB^>olKOv%L
zg8+$y{C)9dQI=utay#u2pkeZg4M~IUTm+$Jq}^I1z9G*hfsl*OyFIU(d7Dw)f?ET#
z!Rj5mgL_dXRbbV?Kp05#qjq^UAOQ1A=Mh~8b1}a3Z*|ixXDi2|lv|a+hjXh!XP{ry
zLo+P?F9+{!^oeG`o_5{}7kMdf7WaCp*4~!F+2*|)oP<HwF&fxbs@YmNCA&S-k>m_!
zFCeajh{MgEpLorL@LkM*W)k@!VDX0$?BKJvxNgTv!f;@wl#)=d4q$;#a2MwT{cuWW
zI#hq*SXS2tAo)T`0;|}s?Y>QKm++)?2}kUK-D+=@Euh?t4D1N;U*yWrJ-b^kbl%TU
zQs9TcbcmPOMM4vMx5ap?1i0W<xjkim?PbeZ%MQZn=Q{ar??#?>Rz=-5Cw9V$1{6j+
zy21N|XWB;%w_By^P$i5sDFHL*${+WH`G|Tu&2Rc(^`5EMuri15zBU8S3-xC1dl$?J
zBzCRV7K_u*oIcEo@Tb}owA|CBJ`MHW2#uZ0LtbQr3}qeYen;;`19w5dy-via@C^l`
z(pePo?wt@FoMi7Wn&gK6(DqF?Kc8uo2=cHUeGPq8%)U^dR!d|MwY97F)`AoN`51$T
zp8!n3{%61eVbIDf3v*6HUNM^wTSs|?{*$`ViDQ+MYgkR%^5br|X9#@`Rew6)%A7$P
z`wcg|H!_{OgO=ZlIltp?uzN{>T0f=A3fu^aWmFM5!>thQWom5~|9(*YZ_~<m(~vjU
z8DVUOXWW+-U^_DYq8wMe36It(SXpD{(D-@TYsq&vvQ=gPBOZrhFIv6~cf}D4#tj2i
z4WbW1eow4y>nI7%UKXV_-$qGjIp8ix>plVH4^Q%S3`31J>B|^gZ_^X?en;O-JXg3)
zF3D(Yt6IEWet4#y!GKB$&z#*bMp3ZF<|Ac}V~$&1M`rz)HWZx_v0Bf(rZoAD%dhDn
zn`|t<2%Z<0!RYp?yii2^*>8)QGP(TT5;bD$jn(3I>!v2g10xM6_x6;(929<D-5-)K
zYIm@x`=0b+i|WVXj&mmZ$&&4{rk1^_xA5X2)@jrficfRkA8TjziQ>W-xxXTKHC!m+
zgiTUk+g!e3@rl`SBKpirruXcNEqPUbXVs!bz2h)uO>1oAv5Ecar%BCc$69-Gjhd!;
zE{PN{#CBXE+@cu04LOBy*)F2h91R5-X^R<aAAWQYFbK56rSW={W%tWD_Za(v?CoHo
zQ)JGq?eTrY=4>thX?7u74cociwzmsx;k{g=HIAKVDeH}Cn<tYuU_v=Gdr1q*zPfOd
zKg9<No;)l6r4G6CnTF2CfbLL`MvsCt?0sEe-37QI^3%k?#<?|&&~--kJ!x>eK1m#h
z$na)E(Z~yPHW=ATA}76#7H81VW{AqkkoJpUncJ*nG5BZFT*|Rw%VXP-bd6lj6=>rJ
z;sR)^f|ya!D`{BOPBU@ZXX+a7pR?%`#-2$=cLfT2=a~gBpEe(V)b>5NLHRQ(JDL+%
zDofYSuzj;>JA1XCmOlT<;!`7`Bfr-I)HVmr`Pz4m%UDXi@=YV4PD)+r-G<bNmC?~+
zo&WsD@aSEvW6=nUlXrcBi@M&%u|=vguA%~&d*b3p#-!=y9I8U|0<b*f9MX;5weBMW
zH#U{(Dj7~>!=j*zRDpUFD#NawJv9FJEg3^(zJl%W<+O6TNORH+R9s>Tr`pm5i%_GR
zV&B=4DY?c1l`pvHK(;Xmk+9TVgCgo+hY`G?V_xJ{SnfT#bY8vE*8Eqbzw=#BQrVO<
zW^tA-U|{=Ikf=#*+5Q`ulLec*4<!xzioO~7CkV`(gOn4>h?$2k{zzL?|N8~wK3o?Y
ztoPTQjhtmS%*C=I8SO(Q;>rirxu?D&O$yJ<ifa!Xf%H|H4JuGO$i?PfR^h8n(rh&r
zttah6cum*Z+>->r*Ot77iPsbZz3Ig&i$X=m)X;=})+6GATfn`?O#qclLZ>}Y4>6rU
z+5VTr@;C@kN9UUfA!>ozsWRPtK-FD6sI4_2(dKx)lJA3RyIw7O<~9pcg7Ls}d1Bf+
z41o2a>P*7^55pQK9T|RCLjQaDz!OV*$$qb~&)^9+Pv)z;pF2Hnpa80ikJ^DC->SQi
zf813-{Y%Xg+EaO4HF0uny-Joi+s4-|in>;%yDR!u(%xb#nn$FQ@6KY6^$&5<!4~df
zzHGu@k7}UZ)PgKDcGPpk&D3L&Xd6HGvZoPSLWv<Dj0(Wji+`^Ue@e`?fa^akz?4PP
zA9J$jW6m6xnzGBjDr#T13tX?9sH7YTwiY0;D8{uhp4hahew|?=?uyYSEe(3!xtlJ4
z1J`KfWB!=~V##&E&CV@Zbx@vtv+WEA(<l4NOd1S690*-4C9{TjB?SA9xuZVZH^XXx
z2fF|zfw_U2<m9Sp)hMwJ9#4<B!H%FAy?@MN4<KG9c~e2otOua)J7d?bYcoz5T91BO
zEE-8OGhJ0Tv!ieWvQ5e8JaFHympqu$hD}nW#%z1Uw7A+D&~aDeB+)Z&7r-JOvD=?f
zMM{2gLTCmy;a0T%xSB6g_zb!luK*-1r=ddNqtLY#IM-96U#|h(TdQpL$Fl<^g4sdT
zf(>u(Syg?#uq*%#ik*2W$dRU$KrP+F@_@Qt9<xYUgl=A8eF^eoG(tBbcSvobMJ<H?
zB~&%9@%ty%tuX7bqJgL}EeANc-i97_O~wW7PS#H1_Z_YMOT{F7Xiu38Vj60X(wI=#
zbYZmW+GqXa6ks@HZF0#iWhsrVz_0lU^Qlya=Ft_tmKw3M|4nLKF?=nC&lavSU7xxv
z&96@B_NuveeVm+!z^T|{e(7Ro_gK_>le50)vFCBd>36<CeW=_RR@|9|M0sC=%Pxs`
zFC)Uo(jP5o&slqKp}n!L;qg~(0ez9L0iedoX{a?Spgh6v)ho0cR<4YzWUPHMTls#J
zaNtK4zz+;t&kO*0RB`F(h5><As&S3u%1Wi~jo#f(O2m(5EY1Yd67?uZwJ9zfIP$Tq
zS-+`lUoOYr4;OEqkyvu}LB8qStp`SLJ0>vR2r*Ow;KgM-wg13}DtBzNeDe7+qA9}j
zP4BM?KwIS8C#I*x@cxTB3uTMdarPn>7cGcwY*w?su+SR_)hUl6_k7MYvIudTC0|`C
zo8Xh(Q~Kyi&lyBU3XUl6n;-q<@vZYys~%=Bh>9P}4O;Ax@y~@Y-AKMgD!g9Ysj;dD
zX=l}02fQ*<@h<0Yj5~Urni8s)SK^J^C_#RgEdahzGgOr`B23WQW3GEwN3`xybHSr~
zR<M*pAv7dn6@M3GF`qHvztEsri|8mDsQaj$L{VQ{2fF7+QC8GDr1<Tcyx&3U%E|B}
z$<+65?!uw)iLh7XDP8Ni_wK5$Xo{(~qn@*kR+i4MPMa#F#bKuv^6%&4vg(kK3PJNb
zZ(pra>ISm=F214k9+`w3qoptr3*DdZ^a<(+cdnD`It`Oi?~oNZ!te*@82+eBby?l6
zEZ3mDQOan$iS=3>Lmt*Ml3%8_VQK=2A;lpD3xRL%aiv5JlN``nPC3HsOFOa7YFVW=
zOKK+PpY~o~j+1g3%V*^5t-xLK9ke76%DMj3?YEtNvwFyx3TtCe6Xf?vTO4omYqqIL
zDDqmrtoxGN*N+feHUxAwKMf^7r8LheqYEbTtM}X*`-ukG(G)1>a_utg^qbg<Cg_V+
zBb9JqPAus;ZU|kN22f$$X4kwMCWIt%M%T`NB_#c1y4vDe^o()bx%y1moJvQ%O{W`c
zR|a#L6(ll0)R5Nno9m=C-x>nu+;%#EYn7X=6zqHL`yG^OTZYEY3X5Kepgw|0k$HES
zUvJrRGAdPn!1Typj{JpsQ{bbKu8m&@el#w@<ZhZ<5frktYkbagd%^U;Xv{61O)l+0
zB8NeV55ejH@!y@TXjkuR{KIZD?bw<v*$bh@dI8l1`c$z5;h^#YE<<TfZvl$RiU=wm
zVQ7=pj7+8y15-Cj+FC-zGE^aufC+=s^MWtE@zr#Q3h=vs6_MU+#P+b7$Od1MU8~kd
z>jcuOb6JMIfeos=7E0%<m!mrei2(eqVhUFG;aH+5U3QD9>>}B?hbdhABDK)XHdFBS
zqJ3VV;yNUT(L~#6K?1&uD#ra0BUXOg@JBN?XR_s$y`PXjd_~Iaul|FYP3Kun)A6K;
z|H1d$qUhIgZ9(8)$Ioe#r>OMVN;aM4!|mF)-=qweJLAx`SbekBi0LMkK+<SvYi9(3
zx(O@5EoZWD9BOp@-p*vnlGO3!aO6zueV2Ah*E{ELDwWpvMX#yONO#Qu7eBQUdr(w9
zykoM?YwCmD%7+D02LdI;Z<nt}d19@4=}-w<^*Q4Nuu$Vuk+iD4k*M3edTYqRR7Tjk
zKvRiZV!rfM2#A>2L>pqMefSauqa&1jWo47Rg>&7!RSXKYtj8^OTY3cJO+euUegjg5
zDx5cpJr_Amb{x}FV-0T%`5t>T6Y9#d7cg_43oP*#EJ<cyls$tJne}|#jTV4im4~SV
z8E$mais#AU(Ao1#wM~a>eOMib-<)VcmcO|~XTXT?xU$nAmH8^F%mFP&8889LfKB}8
zn@2akow-JEaF2k0#s|6-4+SocqBsBYT`wcDs6M_?EGwj?D^}L>v9YrL-c#ayKRM6b
zK&SU)ry4)pT7~w!Oy!(J-ftlQD6zFJrEQYes66DIEI1Krs!LN)K6x$1<#)T-NFs@-
z9)Ly~X=iA{S=o@Wp!O3~t?ESzkFz?_eR&=tBQK^a1vp%XE)kca-I<6q{!&Jx>LLWH
zVXLhf$E!ZNlAT+3uyL~g5T@CHp+{J>Z%`Gj1b)FMwWzqd=IJQ~JL6~cEM6kp0;0Fr
zYAkK48Sc=$tAB5Npg^#@%gC84I=TA(Mxdpt7atYBD!?@VBott0;@c6t{bEGQa-w=M
zOXb?QEB$Z4#CT}3M<UN+(DHyaST7HgEk&Mkj(^Zz?S*<MF{xIbsYz|dXT(g<Z(rBA
zkvq-SLE;8posNL*wtlwW>a;qm5evHfC7#+ak4W~3TX|J1lq{ZSdQkIMv;oR=N}F3(
z6B&kJvBGj%Cy+$bya5pAgXah;no!7qhYWZ!kzc9xg|~j;2cm+i?0(<t)WL?@F&mW+
zALpV)z3qgsp}!j5oi%Ul7nQm11)u4q)1#OTuX7uUus5QJXUbk=lgG0WB3@k5(^-hD
z2Cci7`>#SK(@M4g-8|o;oNv_;vD})Xq+m>XS3n+?|1hi#!!!e{fByg4yUu^M+PL36
zs1AfuqpGxawY6#$rCN<GDQedqsS#Ql?p9S%wDwliN{Ct^2~xX8C=n}0QB)$d2sOfU
z+@9xec;4KvPLdbr`kb8W{C?kco$JAOE!Hj$n~W+y1NDaOa>ojji6^E80r03hCl)B^
zO^MoP`1e)isCqdx=c4#hV5(K4FTe+GOWg)aU9S)B>)K~^iE-~HbHdt;#9Kn~h_0<~
zE3M~ZRdo4J?Hgur)rJaq9cDh22Qy(?*5PE2+Q8t)!VB8|F>Q9P@cms7{(f7g&}5B}
z0T0L$Q3)~6pp%4bp$!15u3B!Vv+NQ8{^X)oBSj1;`DA4>qttX!E;WkHN@x?IfsMQB
zROtrlLw(Y)l9*32Fe#<I0x3zJjiqjig_fE*%_H+4j0Y<CnE|f>K|tMO8S@g={r;@<
zTb0xP&$Ey4^xoyU5wbfuKTo5UkBQZPor8J(feH-Tqh-<di{d4=(1>i{<{eVxi*1We
zKOx2g<8~4H^!D8kK4OWX<7sQs35IK$c-1x9%i)=RNpoh+;+!85>pQq1MekF3&O6Xr
z!5dgywkFJHo#DChg7?R>UwVsyGjb7*lU@z4L>C|d+c(HA#ayK+mL+jS@bWg6m*A^D
z?klwS0o&0KvRc?9eJK=RcvrM#33mUwNCMHx99DK&y64|;F1M6PtkZ5=las0%=Mq)!
zA?vZW`3tiPaj{0m3}m*@V>+S(%?VP{->vBL{>Bo)!u(<y<^Fj1!WO6c8CYID?a>yg
z_}1l;xm%-(CCt0_(MX!28rwzs_Yv(A;~8DF`lG5x*2W!?-s{Z`17qw%pEwQep=N=L
z)Y$_t(|3lA24&8>u?~5O9oE2X!vk~ds5h}CiH8bdZtnfZiK#VHlNJ}MKG;(7FgZ7|
zToG39+>%9XiY~dw&X)GL(AGWFD~gz|p>z<gDbU$<Hsf_&pF*R3KS!ndg^j+xfloJ-
zj^J59wotj{1Ms~3wNqP(MMu`9#1bQgQ|hjxOdPhAO^LU-|5HZ%cSPt*!(S*yNTJtA
z&PAwe0^#wK;CYRUlhsV!q&ipWek5C<BKOuL$Y}3ND_O-M_)iT7hTUIznCm#+qP6y6
zISLAR8Qg#sX!!E^r&!AZx<hp>6Q3{WrVuGUdv~^IS(?2Pwdm7bZ~wJ-#ppDHPk3SP
zk)IzVjW;va?tuqSSIqj)OB+~uX79Kr{M!uPGH99PWebabhS&<GXaf2(61FLZf87q)
z3}-R;p0sd?$dgPi1uWf&+u}C-j|PieA%D4~`9`0J^)_yIotU<?f_d%yd_*nd&*?J`
z754h(Ts{)=Xlc|PY5v4cP|y>VJB?JH!|G=U$&SLNb?D|v@7R%6_-8lcu~M{tsC&RB
z3(I0BD8>q4Rj2no&Uq8@CvYpoG2zJA=w<0ac2_m$A}`7G_W_zH?(E`^!Z{B=oaWI~
z#|-aaT96f!hS~L@6c{a4SvfMw-3iu`;^X9Vfv?aLH%e%?ney0u(DjlFOvub^8k=~t
zBEK`5>y?bAR`pVR$GzX1NhKFj2tsu0TmEFOFQ|FI+}&5DZaF81py5{RTvd<T(4OdB
zobF!Rdw#8~3l*PTx7{}gAy52nz6k~&yDfIY!WsAS#%ika>Qt}dj%fl>e*KFfGkXI0
z@avo`2KiEjd?$JBj6LYOlOvmK@q$^cQWQVJ!OYC#<6F%(?qTAPyAZ@|T;EfD1_-yZ
z;aS4=-7x?usbuk_BhcEG>`v@uUvA{7=_U)X4%vI2)<_7qjwpf+Oqg;++?pFy;~sG8
z*1o2fY6`hGy7dmyO6aw<aI?H{%i;--<CcO*1};k6&$lDJ>cmIVa7IH%-P`q&B$W7x
zd=z*!yIfsO?z~p7+4qWgdQ9y;vn7W73<r<~pkOE$HQklbo`JpS09~p4+yirO%#C%8
z)Lg7UC)D2UN^cOZ;FUWA9=h<cCs*CaJqQi~DW)MCx<?L;<4z1Ud+-w>FqQKtfhHAs
z7lZO_PP%7u=8Nm-x+q^YUvu-bK)2a!A=pBH>jH96sGCx$<Qp)F7&{dc`NVy2)M=ez
zUI`jm7;Gy0CA39pMZnqNObIjQv@Qp?LYl4-AXm)A80^Vr-KtV$SZnf~5p*t43zL4T
z`o_URPNoAkZqzM6Kc}wI6JgcSa2ju6ZsYYYnz8=+T-6>+qOwgvs-mM1v9g0Fz{mgI
z3v%O$V`NKjP{|M6v)_s+CzqC&&(gRwwdMDUJ5#ahq)BK3FE6*=@4}kQVu2g5(;J~T
zMp$U<m+*CeJsM}9F?lB^0>OI$l=oKo7<*{>w`2ge0PzTJ!;{8=FJ6^)S)roQE%})_
z_sVY4?Bw7<T5Hu9H~!qJV_>e^IvI2?T(<P!Y{9^gs*hU`gY#HsIs9Vq4RdFcc59-u
zZ_j0y(W1)BUk^X__&+Ux!uuhAR8ZF)PgYG&mvBYvY!qB0SM2#D)|5iL_5*N}Kr7hC
zz3nzeyMg3Q(5n=;-ce~XynL?8>P<EAPv=O`Q-)Z}0Q^)okvjAigM<imJ~RgVSLV8E
zNx`pDy=NBDw?RS;e@t${)t_bBJDPVx&#k^Ve-|#En$)Du`(qC<wi_}Lxzn8<O5R*X
zL!s5#-A!ddE}18~`hMRBN(glW;9Nk!sJWc99&3mxoOKLI&TT8vx|`Jh^B5EKKw6(S
zCsndlK`^=aZGE|`ueU1e4I8J+sHAd_9M>sZNbP4zLW9|wq~{`O{pN{DopiZ$lV4e#
z>gAVdd~ck&A_emX6fS+N4eVRuPr$6tS<ZP@y0;eF@*nm{k=W2~3>EvU9s~j~hsZ64
zGQgk#KPYM#RI4f_Q!$b4n=c8GF1s#zOh_7OT;poB`#>)42-<$|x;NKHGy97fnMeDr
ze>sq4^9`=*ZHIe-!ajS58mmcPymAxO<5~(6X0I`Ow{9Ekr7&rcJO(xA9NQKrBAzCy
z-3|%+6!=I%uNiG`h4!vrsT0Hp#vCA!!`_@V`m(bD1{<@yRduG<E9R(ANvBxd2>tmb
zP!9U)T`a%+QYU6%@72wncv#V(HgZR#45vdc)Qyz(_Sgu_inAoAA&6a@-3wc+i=D6*
zba3;(P^#__>gVNCX@o(>xe9NcP``Ivng1-A^iiFu$lW~CH%cj&I50bN#u-tHiM+`k
zXZ*@uF9x}WhqKMDnLh2_R*n9~`#olMFQ4KQ)>3!HBA}V3Vh>#vY(&QZ-(>*&DXz$8
zP$<z>7c*xzK64u!Xv<V)2R5uY?ScJWzQgl_E%6<Q$FrqSPiEEcIUIZ@eJk#5G*wtc
zO!-jy$!X(aKEVuHc)!-vd3yA^J5_0CF91Wj5x<+C-dXl)r4Ui=mMAx)+f}(S!}Hs0
zt@ykYP9Q%?$y58saH1`gW;2o$@)i9<11N@>YV$9x?=z7C$-4r&jLjcQ72{c4e&S#J
zp1#}0y+;%@rx6#0(rKcR0f$|(C(+>%*8UK6@F=@rh6&;3?qj2#Z)KIL5}xmIazDwB
zn>EIeXps{mXfW4CuY%%Edbl9xc)#nIHC!&pU47XA>RP%sd>A0E=ltc|Ul6PsP4;b4
zg!l`>O6Zlq-0Qk$2cKM(zj+e$<)N+v$o#|3ud4K6nENskR!9FjN(z|uF8EgdP?p*c
zF2UbxU85#Kp<<AssfV|1(2CLNV$L;1#RG=6Wb<ydu8k_;3_cP~t<X|ytGc4c{S{79
ze*0CuRx=tBX~gZ%a61SH3Y3JD3R!=+KOo^NBgA>lC{8Cr>&<{C9z8GYsP*D)3NeG%
zLRd?Ls2@k@fVix&V`BZ*mDe;Z9SpY~j10hjx`BwoW4y)zk7>*}TFxU{<owS;h8b@<
zJ*GIjN_yhKWKHig{=n}ax4L3r#_s_f=UCaW_#Am4&<M6ao(i>I9FvCXv0TL*8<S>n
z<0eEYJ-Gtz(7bom$?=nXCuM_pN~i2K7JSEKxqkq*W^`q8rgp65yJIScZ*)iZRsF_n
z@U!Sj?|#V1!2W=3y-PL2Uto+v>mhTs!78a)@niT%06oP5;0f^7m+yA9HVC!4d6N9g
zsk^Up_%wcPR*Xln+9d1Ozv?m@ua=_NCI1;r9_KBLkM7hu-k<l$Z$R9*8$&@2)$2sH
z7C&iu?|T1Fdh{nXkx1BdR&}@(2I~D+iUh>B_PzDK10^E#h1K!YU&s$KcS<$2w%5&D
zy<aK7sl3(gf)2+>+NsW}C3#6&_R)I0HAJ1WaEmKqON@6o3*UF25Mjc{*08Zxb8fSm
zBWI9a<*@-$UfQE9vEv2Ly*yE!`egG7Wx<ofZZ1;$@tR2>F(3*&Mc3HOwz|F~IV7%?
z&WlYgu;?3o<11qZh{S%N$1B_x>Ws`p|B+qwLQ#j`{jqmv^pUw{Qao-Acxd}DEOQOS
zpPHPRxe?sW6w{C+!~~MjCddt2{q={QX3C<hxCZ_9SKUb<?RS5**0q--<aVnS*_T%K
zZ8ie{DgubA&=<jNUitSYn?rvlsqWbn)w<vu@#@lG0#qyKj^NV)S)Pff5+N+4^AUY-
z{go-*P;|pY{MTNentv*)do!qWlJvVtpWW^lUlM7TzRC9i5-xV7eQL{_62yhs!tFLW
z#cz&BB#^oL3+3I0(?OHt-UhE+-8_&d@M*L5&=v6mFzGjFWwuv0Z1_V|L>ikv@@#HZ
zQfeuLIbqgKJ-LO9k&_v5_p-3u{`Cp#lV|;)e;sji>!Mzdy&{c~>m&Psc(S;DwxD8~
zs><L*C>$@P@~qPM?=P_P4z3p&#EE<4eLwl}2|U_$w?Up&aJn=8WZgQ>>;5#?kpBK%
z@V}?-@UQul6(d#bbHvt)Iyx$p*D7Y4bW~U!F^Sv|yWbj<x=IOMJ3mj%kK#Us6OA4n
zd|Z`w=~PzG%FzI$<#;Y)qc=!ZpY;YS;ztQu4UO(c#SHK4)J-R6c~mXc!d(AEMu1-*
z(PPPz0`ciz0U%DtzJ37!b>|uBB1uUbc$>|Ru~oE@B`r>7$rK-=&I)P$&`_5r;KJ@R
zBo9*O+{N0Y-^ob2K5?oBClohv&ya8QjyQiIaoq=#mrX}?ar_~j%hNBbgLpv$x>u8S
zxN_cRKc8q?4(d*nF)sqdM{4qc(pl*ZwZe_*-1RA@Y#I-INfJ*%amlCr8bUokreKkf
z)SQ2%Cefx*?VG+)xBvMxcJsutw6u#3B^BCo!G8l}Ze{je_%gR%62hGO&cQYRbP$_~
zpcFdB#Iz>ITET(*-sJYdFj3z@_tt2=($@eTj*}aLRSiru(Uh`FhcMm{kV>!8?L?=P
zLd)GOQ(ZmRRQI@~3X6Z%#e86~7nNGg#<wx_y4lqHJYl2ycihuDyJ>sT2G5FS4!1m0
z3{ns_Zdm}jx0%9J^Z|#{t~C^S$f!{<LhWQlc~+oTe!m|x{wUtGb8QpM(%MB3yzAAw
zJYvDP!s*b4Xm6v6_#x!+FW=apKzbq+F4Z#f%DwgzU63c~%P!gqGd&&GF8W0;#V@X(
zK87s*kYwpN9%>*Z$P(NK_&djk$v}i;A2O_tpoOB@%S8vl<{o{idVQ<Kx`ufOqv}(R
z9{An+-$~nS>75R$)zx7a6T+y-6yN;sZX06@(6Ko={p|Msp_i5G+Qkm)@opx`>V9w1
zxFj=vr-&-#KXRfrm|MWF-O)#N^J+t!vc2gk(ehFEFAtNGF5;<jom~f`llt-x(Wu<s
ztMzKK;AE|A+pzaq!`)FG$i_+YOnbC7ht=5-?O0a_lq&a7&|pc*0RP<}gS*@38Fw_j
z<J_#RldsFsY4_>+u{uH(7Ku%=F?YY)v*~$;Pv8Pn!sd@L-Kc|VeZ^-xthBNAQG=!7
z;`Xjfu|pGN=^=R7k#dPfbnrp2S%sg*oxwl%Ey%H`GGzCd>IRfyh=kYz3!z@;2Nv2E
z(itl`;QXfQ^|dMQ^15qRR}L4*G-r#&4{Y_dz9~ZK?cE7xg?S=-eZF@OGiuFBm2(?B
zDKl{27DPRva`<$MUuhq<5m}+GtJLhaC|+|K9|*ME{bbT%6Rp>A$Q=ed3HO!JGmo`0
z@WoYK|4Oyrm^Jx02i^TA!X<`!cEK2qzT|>*7NYv_I0yV?E{^7q)4IkuJi=AvU8y!L
zXQj&Bp4skc`~2l;>je@dqW*I0^#I2Lf+H%Kc~5sY^gK;A*7>aBaw~FGQ?{jlrS0NW
zb9Cc9b<!3aVb*_ThHDx(!4~JpE@M1`9ERpKe`L~K3r*Z6S8;s-eTXkF^fCg)D4k*!
z8#awV45xFJvvj*`=iGs9LlSFJW<Yn)$Mr7bOh+IIcvt?xyg`}*f>j&i<mp*#D%2}#
z!)rVqVFrCmuv;D-i&-Nucmu1w7?HD?uFuChcYG9O?eIjn#LbeQ#g53Oq;;EV)uHlQ
z`!?x)vre%3U(H9R<s~1xKw!M|kb{Q_?d1I2nOgJQOJ^7lljGPx()L{j_TX5yvyI-N
zJvZC3@-@d5_<h7Az!a*@v%g9r<cog<(&_QzbGRg_xX(|;c)^}>VkQ>dx5G$R7r!y@
z4I|S8x;)ewwfW=Aoi#9DqQj_WZ&brkAinZ&0w7jT0Sfn)T5IUprrq3I1E%EGeO7E+
zD}v?aK4}Zqc7OEq_ziUv=i+xDjfIC|3y%HDa}~cNMcVuuz9s}g^ZC?(9Y7NneUoZ9
zUf6G+*QE+TbQ_M)5sE>Xwcl6U@|L2j22B!}OYo?DgUT}me=s-LtUSSE98QSzN1&LG
zcMZF^aGNRZ;?=+7wniu-ifWOfGc4!MEnt^&k_FTAc4Jd$M=Lt9o3QH0HOhP?C+z_|
zMCPt|FZq{cCB_UEK$TJ$pP$Dc<7E$7^FegjvrONSx)ahxj-PFsNf#dc{02S{GW$%v
zT;iNR!yo_p8X)uWmJHjIy)J3ACS11qX!~Irm&OOLdI@<{Pk3isYH@S#+SQ)0k@@ov
z|Cp%C)r%RcbY~To*oD2oxzX{OA+n-^X&G&cj<MCuqmfKd3U-%1U|PX1+A&)|c2RZA
z>8OQB8CZTnnV$70UwY#4GUec+FOg>xrPn{(Y`1@2yZmf{9DK{097#}}Etsr9LZ+|!
zC;T7@CvjWSbKwti%plnVX@yIn8JJ{MQet}77NaC<n~Mm>FqV)evR*7tCtSiefSz~&
z5dh62ywa)+IDfkV>T2+^*bAn3P8C`l+Du?47tOyrIlandART<JS{|d*6Oty5g=f2S
zKcG|Q-GagKZAEY=-dD~-qh|H)&{HpbJ4^R6?QH&3dYJnXa#4T|XYg;9YCjHmZaz;t
zcglL>=?QgDyO?Z<MV@cxru9Ds-wnt037pO$bWf`^o|VlD9>g@$g!Kz(zJC@bGQ<O^
z9f9A;qwe|!zAJo{(Gea@&c$;IpM!J5Y|!ugOQwK~(3XXv3F=B82d^@o`FUg~zynh>
zwckK)GnxOJ67?%Be_2L38Ibf-ctX4y3!hZ*66(zvk9{;;r&l5b6M3Tl1rC)Zjh!pv
zuaZV-vwKjEo9F(TeTmRj^#`1V3NrUBfdk_|Ecm*JY*>b$TQ5ELvXGRMGtT{5iFbKu
zTNiW3OkOXarpQ)Y3XD8^X?bX$y_5rGCfy>jt*R#8NlMPoB9~XVGlbhWaIM!k6_Ut9
z`3P#Fn~W63KpSl-<%yF=xwmt#6i9e0W=Ln;%&n6y(5vtyPaORwQoUQ{@|PoBpdC?T
z0%K<=A3DTR_28a{=?#mUK{Y9&1vLpo(7;iecpjVC*^Nrd%1#?~P-NdjfdP^hJ73KG
zcy(v;fXta{$fFlU)h!WN!9;=L72$2%N}*l<1sB(mw-?vD9qYX+-Jized5C-~u|>{K
zO82Vqyu}HKY;!ROF<bXk(zpvFrzTARXR_z)ylht%cH8ew!<k9f)Rr%NK<YCXSi`kn
zR?~KFSZ}9%9mPL@H-|$}lG_4@Us}6*z~2lAV;gcCemG#MtiQT2WTpNjW>jlfv&P>k
zQ@r9Msb<+s+ElIa;4t!~*H9A+v6O16!)=MFc&|yM5AMRqJvgm|D<S}}VwN0GlRHZ5
zQFh}ON8U%A<Nj0-pfRMm==e>><6#jtwe_~orgHMR>luBy8`z?&qNI$Cfnv_7Ph2zz
zeNg@OJ!HJ3<({ndwyk3gyIWZpf^E<N3T*V~RVJ~>b}(ZWhFiCux0f?Cpx78M$$C~?
z*gcJ=COKv6ITKYo#mGO69T{DT(o7|RlHe|jhVzk1HH7;%WNz6(j!<pBYsrs4>cG|i
zA-k7ufi;~JzLzd77A-2t3{zF>#=oL(4c2=^MVCq+#&?PVtD*}3S0&KU$&*Jnk}C_<
z)vSN_&0l%U$5KN$Zg*AzmOqO5k(LIl?EUj2v1_aFQ&o)$pWR>O$t{(JUmvm}wz*4+
zC2X3N(!kk!vw0ig3Kl^Zcb0=%Hw^N3=Y;0Guh#F1za=^sF$H)ZQnsVVS}y8ujf#r_
zT9Jg9Ps8|uD<i0$_;7dS?zkZqBwi&p$rVNIqa+xX&6#A9ZuvI+_*9+8x$20%E{VCH
z_M;YGHFavphRKJ>7e|kH^9{c|KkQypj(z_sN!poBMF-Og`vSj)GrPgweJUi=@guU%
z{D)$1_%7089$A`i_P|@kUxeMKz{vr+jFEVL8Aw#m=Y22=nIYM+uSdK0(FXnw`bmgu
z8)=`P5+=U56{I_Fnt`qs&csoDBKF?6Q3D`h^eJ40$n^2s8^@I<3nx==E(Lr}Ga)$~
zbKhRy62-{KW{#VKU9z_Gf}Yn`EG(W!n^LA<w@LTRsZp{NzoISLuy3q3SEiek53sCq
z3hy+eeV)gOH(Ns{@+JYlqxM>2RdX_s9nOD0y7QN*aUv@2Z%KAwn3ZLXtYfMBrB^?x
z5u=3k#Z8h@j8md<1b#LP8AtH!GIO>sK5o~$b^TY!<$Fc4_e${B7dxFVEK+k@KGKf^
zaQ0~U4ES?02!Wn{K7yPKFf+zVf!#@_u94GDe*Td+P@`?>3F}vdnl3O&&By(Vh||{U
z&X*UqAVrDV%QH=*teC2N-Ga%Ji5qX%eyi|D{Oxnt)H#bc@Of{Q$$IuuIZBE$16<Sl
z-PyC34jnr5b?@~1XZuI`kN*z;{RRKcg8v?b|7yX1<?#QdBkafk!|v_Xfs=ZH4=48V
c>(N7pniF4D9*M~UemV3&TmK$f)AsfM0A6x;@c;k-

literal 0
HcmV?d00001

diff --git a/docs/images/pr/chat-image-delivery/click-before.png b/docs/images/pr/chat-image-delivery/click-before.png
new file mode 100644
index 0000000000000000000000000000000000000000..25f98ff3b82703c12aba0db4ca0686ba1d92878c
GIT binary patch
literal 61189
zcmY&fWmMGL+a0>Qhwkp~p}V`gL%Jk}?x8!R8>A(b?(P!l21x}(eU*Fff35e!e3@^*
zb<TcvJp06|tIDAv1Cap$0Gfilv?c%mJ@@CQj|lzepP?1mU;qFUpdc-w?U#S?(`9A9
z3!Ntl`ob6SyKTKS+4xo}6iuls6^4cm1?}eNw})y==x#GtqnWh9u}oC}%olPj3s$v^
z-}@oIzubKj_~lOe`w8<Y<acM#uRAq?;9pPAPD5V>qw1}q(pGLBR%^kHEd0$B-&t&f
zG)-t9LyzkWgBwT&k7w=Do6rSkBn%8{&QnjjjPZ!sq;)KcpLL%G<*XGNwB}TK9r5^l
zairw7mNm39ho9RB41V=JytStKeLNB_t~dQiB$`Ad;__33103#hO#1l574pkFbI(dg
zg!Ag`8<2-Tfh6zVGtdwJgdv&Uw)^YgyW<~YOwi>chho4Q(7SLc%@1pwG#x~O_nF5t
z>vt0Yra}8X&*Hz||DH4~WEwOiV>#ai`c>SyE93Sr<|P%NXat7hH{_h3<eR=v?c@2h
z<!I)1_(c9uct+J&j4fdZdnq4}E%{jjj{;RO#`|*iJtsD04d^89-5`8Nv8w!mdy#of
zhPNo*BnAUJczUl2XA7EP0%u?bKQj)=P72|z<eXZJ5y)A5>`0JrfvO?Yt<9G7ovmXB
z(&r;(KiH$)?+%Y|XgnY<LCE{HXVMl`N=&oKze>V}3hM6GR6hTD*F+6^Z$U(;p8yQj
z^UtOVb%$t{J{~l5HDh?r6zYk-|LARMFd1HMCP2n|ev_Mr*g$P1u^P~TZ&?2Y9<iTh
zZ}0OLoNF)~b*Kd=2Q@3;;D-Db+5AN)#~bPp2ZU?|NQz|yTLJRvMUu;D<#?M})B+Cr
z#9(YDCPUodg{XAEU(W{U84E$!YbYjM@ESZJ-a1|P3iA`r+4KXy<u!LZ8|_nVid$5r
z?}71i$zQJsP}JHOGJCX1--c54YeLP5|9*LXV#U^!n2kqA4?9xZMEp4X&W;gVBo*oQ
z{0>A6qsV=(Z$?7BU#dMbCUHDX7vcr&=6HW0Q+Ocy{?FN+_cUiBD1CAhF}$9*YA!uO
z8IzyOemN66m-ykYs{oHvL6Ag*l$&Qa<+fLnFgbK9T~1-3_>#@h1g|nUIFyC24_Fy=
z0G8A0%w=zB(H&7JwKTt|f=w3&cWKluYmwGe9}z;40khfMd6}cwRv{FGicXEfp;QE2
z*g2s|7aXW#f&rd23-U};kg68+1>zrKMXqX7^z;w`Hx4Ks1m`EXk}=W@l!v~vpTKoY
zv}jgxUie)zZ9@92-VKBulJD_T5O0h8#WIsj2YdUzE`qniH?N20^}j<KrH&X4G9U|z
zS*ML6yo@<Nr_rw`4=z0HB%O4P7~8q~v<~eC1yFvDiuT9;Vs3Bn&9sR630q`Cwgl+{
zC9G`XSCfBORDWPWl<S&DxU6%Z&o^%xp9z6Wg!z{zal-X5MUNftd;SwzFvQR*D6$0F
zA9<k{^JCZKiitFY8rRyJjP9!dlkb8Ix;tMIf6P8DcA^i>o#LLts$ZYPjsl(u3|$yK
zFkdPUAard__gm(>CRW0|Shn$F2VPf5?X>tXM(XmxNYQWIw1FbBx26w0&ny1Rx7Mcw
z5IK~-B~*BWQYi!dRNaLDF^LD*<tG-QYKo~6kUIBshUh!D&h+75_|J1FPC6WZ>3FWh
zp(%~>Kp|ZQayBZW)EgiV9qUG^q2o|xkhvsI@@mwgF!R6%Ak=CDLBdtTS2r<qq9<mR
zh7*SqSUhOa<{Q$u31wRc#QJ$v);%0u7dbmek^>QT<U}@0zXdzea;$UUXYt!-iqDmc
z8)fwgSxU6J7#u2Y-%(|Q6MKcF&}?`(5`AZx&;1{U?`jUK7uZRX@UxhC9>ds+4k&-I
zmvEq}s!>v?RB=3qrSH%X<?o`4+e4|$kCPzuLs33fMa4At^s*%QS;T!J7y<}~>08R^
zwCL>bm=&3M=HfzX%Y{9ZW4I>Ul=!s9j>>}U$1tyuVWDD&xZ8jaP87Pa%wTkHgy|PT
zOL`4BNt`1VwtW)wF!yZ;i6#Uh<V1XWju>!NmuR9QFl+XW^jPE?2n#VV&xqUz_mjdD
zzgDUeZEHE!nXP?OpvQ`l8NBP)VP6l-!4laP01z_rfs$eHyJA&wpRh0}sh0M5_Prmu
zpLz&xIO`7LlRpz0)2MQ#aBu=-UXYk95;Ux_UG;;r_ZZe2)?j_t`WKOJOh7_qlw&>S
z_@>i^a-qvi)sRrF0zcaqE&VJNQ~C;3qBJR{Zmv>1K_7ePskK(c<s*%1k<$$Dba(oe
zIk#;-fAr9tjW&WmstR=e&0>U^6p4Qv7L~eNBLR!;0P9y-Z>_{3m9PHGcW1)KI+JOC
zrdc8Dy>^-?&2CKKHFQ2p>Dmd{<QPZI9jov%a67ugpy3Q5h+(l><b5r$ffts1C`UY5
zT%Q6AP&F34qr&%hNsiTKL^@;;&wv+mXDm!1ODU%TOLuPaTRQoF%3&xzgD~0y?YTno
zz&!BtoVs6<Is_ABN`8Y5z}&?WQD;9)VXDw?zTOT|3#C|-C^nAeOT81=J2-iX#sWIR
z`MOaaR(TVd2JG5dyV0){b%P9^EgBjp-kk@p^HIHbgU8Z8qh^vg%fKt=A2|7O{Q2sC
zA9fg`KN(JYa)kREXE|G#CgD-Z88CH_Mqc!ms8ucgPBP}<#I8piW=K6*%`ZhI)JZ~^
zZ&!8;+SYgvSC2Y((v5{ox{9X^7mVev%}4#EKPak9R^oYNd%i&h;W|AxCgR&#B^nLe
z1as!$*5V8COrUIVk@pDHPT%zz9yVqK%a(dLg%T>E$Z}%X^N=(aG(z*mowkzf(T5E6
z=dIAmqkGsL^nTlSXk@2El}$kWx9Q>bV4^wkMJ8MIVX1=$pM1~LSO<8U4*`F1zWoR1
z#ttZ>rL>{eIke-&1NR`9k?Y3JwM|U#lpjPRTOzW0SJuH{4_`4SV<m7LFr@-tfM6E8
zr7kbnmGwmi*Kt0&%Nbo=<0|AF`}tg?ySltJ>M`<LD(g%-;_RdtHct}y31Zk;=RN>H
zSPxTn%q(B_u+AdP%Enndv8S&|W|N74DibG;Y2w6~`UEe21j6o!NN8%kbc)=!qx|W!
zz`YcFP*@2jc7b9M{ZBeCnCI}6-%Dml(`hNF45_)PpNN`-mlgPC<=S$QqryjVQU5>R
z7)^+>w)go4h@8xrbCnq6S_g%b3813v!Kkn`#-!)(jp%$wazzLK7ERe!r*p`Og!4IH
zGNW-f?#iT+VgRJrnlvW6N$>*4xXs(Y!ETO~zeIdMl5#DC(pNSPFU|ez+bBnx&7qAD
zkk?xXWta=O91kvAm@^-9Mt$@W8W==cwe}1@*3|Pr6!>OCPw=>Tv}Zd^p6Dms>_gOB
z@WEeoXzLII5uK1GOT-`?mA7XEtqWN(Hwe^nq`xHY7~$IyqD}ldjR*dn#vzh%^7hpf
z{m!EHG;})#Vsr{<1i$CQNn(Vl4|6$i2Mt}g<Wi~aX@j@&k1};w_FJe?2DSqwIneNJ
z0DA{Kk>riX$Q(Ec%W3*NPKb`5k$YFXwUB^~e3~>```EzvWWhXjMe``lSVc09L)1|l
zMAIqUq+)oOfiso_9_X7jvm<s6Q<o94oLd$HgX3zTBoM%w@$_3=`P3^3D8^$;g>1Hr
z9LBxgR(Ve9K&mow_MB}B?Ms?Q-q-tgs<FTOcdE5ZTfB?iLK8b;bkmuv?dCehypx_;
zm?oL>m%oMu_URiUG8|#?q333;<4Fi3^A;1sLi))S<O<Hw=S0@D_^}0ck}jOcxrOH8
zig#o?zr&3uw_=PhLRsy3h7UGlttq0o!J?bvs!|2bk1XjdHYMt1mNkCr%6I0Kt2Z|;
z4akp{RJi|EEDtvdb)>G9!T8O*)NWxh7sb<PydKwhDLHxsC%^Y)W0<Q=&~Uc4P|r;0
zecfUIA1ax}=U?asbK-(Tz$6^5LROzv)JlDH0H)GStl1z0P8RY>2_ais-MP%3xrA)B
zGHKM+ajUHyNkjEiMp#hLt#g(hQ32xc*HE<*L>Q-d1`-95X*0dXULgdI#GvsxOIQ|0
z*pH(~juKmKhF0>Mg5CfN&MaO(-i5=|?={T!wO=;V!W83P1X*^63kssXltfJk8d%9)
zD%Mq?_o1<6CSrSf&P)BsT~P+O35u^cv}(u4Ji9rPS=%%52eo4ehduP1`9EabP5e>M
zKL>97pe6}FJ$XY7O!c)i#Y&B#=T*!pjJh@mC&XCNY(968y|m%aAhsFveFcNz9Q7s0
z2fSED2`;A$)4$EGD+^U}8<nsJW^)~~F%WB2XG9UAFfy8xufg6U32wDef<L#SsbOw2
z+C#^c94LB<U>zqJ24bf_1Ofcy*nUt`G$ZVR2R`lx&EkIJD<`fw*2IgmhFOuKZ~EOM
z*Xo<*(n2*#CGol70R@MfMiwKzYvu?U)Xs*f+c;ubGKr`GimEDCtGL2z)@|gZL)*Bk
zIbP<UVRrIwyl-BUi(ktkB&uu7K?A5cB=;W5c>vrR<b_He+}lVX($Q1Q2J&?v4mnH#
zN*Kibur_TBn<H<l0`QVen<`8Lo|I=37yTK+O`0Fn{kxeAXa&QR{^)x3cUzM<K~=>s
z4zOxO-DVoXx{|)b63hx}Dkv1Z9azXc+;fUAAS#`n*(vD>lffy(erMKFg5qzIoNjc)
z{BzzjJo0*^d+RCIY(_yB2pWTL@>s~qh;SlSz&j_)YzC^*$2;nJ8I&8ZV4wL<dQFZM
z1+YU)C%6fj7ktyBMqDg)?hIBrzn7eGIL0V~r(DwiQaPD9ZZ2f2DSKP4bF@c>fBzzz
z(}rYJ>puu9)UZmE%GO@sGNWaeqV8KJE&p;fz)!zYh3Uo<*#)E1h$)T`TZ@Z5&{=!P
zbD>K65|L@njNanJphT0<Uj4n9yZ`VvVVMrg)~q;8%BS?Ju}6P9fntqVTXHlg$bn;>
zAGE$;gv6ns<NL-9xl+TiLvZ8GvAXJ_JjlitM)~vL^TO8MR&_?|j8!=mo`P%7_CKdo
zn|Z9*txd*?)9-!{pB9yk6o$h_5{3fJ{DsPQW#r}|-*PZAu%nHE{Q$m#V0kh*uhE|6
zGwM|QH#32ZAa*U>k<@obL_CLvf*vkuxiXzc_b>($%JbBzy0WPm@#1&%OB?dHq?QZT
z+1*(M_yX@2s%wWPnwx^PU7Zzx@dY(g?Na$BUUXWDN$yK@84}E*cn52>%!??=*FE9r
zWneG6I$3x9pLN0tMR<b|i~s_x?oPur)oW}2o)L>M`n1{ZY1uNfz;Az%)b>YU{+$X*
z_#bM^dFsL{Br~;0s_Cc4qf21<oC-Czl$oKh@F7yec~kNf)}wT4l4(&-Wykr_c=OhH
zrdjs9u(%*rDz*<fEb=^{RE{}&3Jim;`WepyDbSk~uD&qYc|nK&vVh9Dk0t;Y8!0yP
zW~*dLRvr#H3Ojp55++o;ii&s*%<;A0^?(feTxmVZghvQPVD^4^Q66k!yIG<s#e{fV
zRq_4Q_B8RSV{ln11?!pA_oayWa`-z})TR2P1GO}(^}k2sJ5!rU|LW2D1|_c}<Wkb9
z!jyi2>#zpe-Aqm%M~4{v?60{Kv$nXIrTQZ3h`gfWnt}A)N;K+h2a<A0`@3@W%yM&X
zM1C3@q13PpIFTMW7_{trSH=ij<Iwq{goHTmAFDD6L&xkPvhlHbu<Rbn7X}i21h>Mx
zMfcz)h(Rp69x=Rsn|7WRYKdcV;<|j}<-oaPH`}+YvT4|k9*g*9Ph;;pjxb{or8sOY
z*DqJ)O%s^3PjW8aHIa$0w7=Wq=-+(*N6Z`&^kJ$;I>)kwMIAe>wO4G6`(|oqKMPUD
zF9c^qaV20zfdVdKlV#|<Lbr;T%Cv`UHXSD`x2(@~Lt`U2V}nIZCQ8NLPo_{{%5x*S
zoQG^_glX8pOT)(507T;vmSMCBcI$r$Qo7f#-}O@4M-bkEHisq9yko+;UygO3(MZFC
z-ZnZO6DBD?*mqtePmlbx%%g%m8J2G8)wk*EKAyrPrA$EU#A~)F6?q;y*h?KerV-jt
z<=W87vo$WIzq$M?HJ$!w=zkJ{oLPc5cg6=t!x-1ipWJSJcY!1&YfRYcaLCd_uoo(8
z9@F>t=vOi+zn1VmU<4`=8pg!8L0bzy`CE3!Ca~ZLOuWC+Mgu|1uDq{+NGy034S2QT
zA=-qUXTX^2kp9@g%?g(YMtw{#?ipxRqca4^+5#?UwD4GCCb{(8v9mluSU)RdLOQ2m
zu`=kTT_dpQkon_JLgS8p<<u5$NiQiBIxL!z8g8clrrNQb+j${VPD<aOWttDH`&oyY
zr#R)(5mc?sRT;*mEWfA^sx@zHk_34DgP`75F6vc0oZs{EQ7f63To@N6xMv|&7{<*h
zd0NEzWU}q5=mFzFCl}G923HHE1M-lp{l=PrRI*saimWim)GB?O@4v<quJG30msk3X
z{O82af+$V_QdkV)6k+{~EiV)|{0ej{JgTir{i{Ajdf#RWC8hLQZJDR~{N2$oVc}nn
z$y|LLO(+_0)JUsS%vk603v@50a`e%|!^3O8_ZA$2AYX_`koIqz$B!)|)Ca<~Lj|Er
zhTOSCR^wC=HfAX%jXreg;tBAyd-9oMCy@5e{e{x%A1M8aJ21oy%}dcrfDG_CMBu1~
zOEfK1rAoOqQiqtwkhSPE?wqZ@l&4?U!ip6^Le^`;j#BEJTxH&vv1wd1)A_Kjgww-A
zN^A%0se@mKmLspyc1oI4vFXy)gnB=q;g1(Tp^?i=)8DerVSXYVkJZgl8SANdE+Qg@
z3)ewLRnT#d@wuQfAtBi7SwR~LZNk&U;COE=pKxJj5>96Pi8-(JJa>5{rIat6I3FD{
zy>~d3I#i{IIb${h7v9mkK&9~`wDd=Vx!6qJYtrFk+9sm^9Jzn0d1Y$ZjHkwdBQVhA
zB%=Y)w?sD&pb3PJ*(RXAFiT=f!8%&l5lcgk)eF~0>|g+Qct|4j_7uCkUvzhsg)M{8
zov}`(r3=F4m6nrhnwvH(V|rwDxvd5qMe(%GBT43{0@{5mLvwTcj5Pv><Mn;XvU<f&
zn||7^jFXgAWu(&yDV6q6%=+40XBaPzJwW<kP@ylE9d>NRWE@AOH<lP92V}5|8KV^u
zt5tLgXhH4~@d_(nUO&O@->{~THDC!fSa*?HnIb;?EmE{4H{~rACgcS=m@b}++<vjV
z5TdWeXgVIEs#KnroiL})W+)+rJBuj$jVKf|Mj)d@V_<5;bPXC@4_qVHKIe3F8-w7T
zKynFw95fu7s_1r?wxUT0*LhIkwJohV1p4Ihz_+PWS|Lr0CH{b&ae<!FB+?{vet%`j
z8@=pqy|X;xz1!t~kfdvFl!Lrf*%bo!&~bP6PA}tiqJ8;aaCYG06J`w-SCOq&xaNra
z4$z5|c$z~u<a9wD@P+mDR@{NXRL%)i!EBkVR(DrQql+VKCWNU*my8}6y=FE~$sNlu
zZH)nEoI#u1;W);dm*bF3F(A4U(k>{qKOg6xLO=1kI*w9gWxNykJ@v&s!H>nW*$~+7
zoq;ZaqW(myH7h*WFRnahTiM>K>F?0D{T*>P$zS*C^fb(aW*a>te56da(?d=!*wul;
z+ez>8V25y$F=O*D7_$C=p;GZr_GdIU$hCp8llLwZTI%Z)SVm~5Q}6yr%8#euTB{n$
zSi|1x5}YAkG@)=}<eg~A9ZB#swBK21?(@+>yI7u0o4ctKW@O&^8*@r}Ib4oq%y-1X
zd|{#SXUFUB6?X5~9I%<ML1>C-MUh(@I}(jEvy%FqRiwKi`f>D8$R>x8&e~Cs7TXjN
z^o<Q^WVcR3E(gdA#G<m+Vd~r@oNMJXu`|lnUh{%l8<Z0=2ty$sCNEL&D=0>@<bf(4
zeW+ptjWO}{8u|V~f^I;@M2ifajA-IjK$&g1#LDK+fL|WW(*X@l$><%n7MsYVQKDF>
z^mV@lxB5r?ench{1wzn(1vdsx61&pBEYp=hWEL62j4@Jg)sV>m9oJGTuq<A?wFbpm
zo+c87-xrZC_%#}%!gtgbA*MO1s5fF+1(}FB`AB|8TTr!rm7xo<P8Lm;$x_f*o*5D~
zO_rYRrAP{<^UAYD0~)yZ2xzNOIhib5<51<vekmznVV}}QpxyB=tabf4sS7`{1V_X|
zqjLcgkww5dB?zOg`r<F&82!sPg{)vQOLei@&KXopZ9av$PSlo(pSccv4TMb2JQ7ty
zN(mNNpgl5m3)^4)J3=kibaC&MOq+s#2->Yd-9XzMTLOA0cfTa_=E{u_;-K6R7(@C-
zG~43oKaZL2Wbr1W?9ubt+E5|Czx*^c<^qH7%`7|I)ojYv<0XYpealWA8@{n7>|pV*
z(_BQHP3yp{Gn-Ii7VBf2pik*UXntV@_vMr2g;H^5l$7_N^D(Rb8T0qcJVR#(FU`{X
zty5wrL>Oj#kF0O%Sz1}#x$MNEPB%L%X^wV(ecTt`_kXO<rKW!?;798%Ix0i&7)*>v
zOs4V)$vEy!D!b|-g}4_~HzptXQ!~Asy`B73OW(v871}1VHAwgl!Na7Wc5Yd-f&#uf
ze4FEGSFeV)As80ORiBJkN9ZXYuwG0p>E}qL1LDUc0m#0Le7r`@6y_33iNDz)<R2_N
zJgH;CQqrvp`G%hGj9`$$-mmpmxlWeHzLx=xu@Uag{<ZlM&S|F@lviHN`w{Mjq7&{r
z4kE%IJBhNWR<f*;Nc2sxQofP0_)AvBbeM+OYL&jPAN8L(RU<g=3KCguG+x0+9pa(?
zeoNY|)|`>!o1kk+@ZD`7K5W}c3xx`4a9$&sd;6UuC36i7h&ow`FunjYqNEW@(B=5l
zjg*t{y{R@wD-%YM#GVWt^K4IwAw10a8aDN#CNrR5a5;#H{I|?1Z!5YZGL5->Ih<T0
z^qG9LI|7R*T7TuVZhzk=j=Yb*HV|NkO!|{4S$Wf%k<g#GB^E$)mLGCCV|p@re&}vx
z_zDy6Sqv|^CoG1RCd=(*lWa1+^5*yHR}Y6Wx=71MLi93tUWH<PKnwZFOTOw-Sf>nr
zjA}_WIa{akp_!hDi@H1(Wt6{x$86}72oQfV7fkqWg%xYHhPze8k}z?2V(tMf7y%At
zDnF7$mTL>N&e^sDP72QoB2{vV*Hetyk7I0c;Lrn#6)I9q)f|YKH>OCXgXo(YMo^t;
z%b8M#I#UHRZK2>0AWk&VtyC!F$^}8~hRQ2mco|zeYu6CZee~|n`vR_fSLiunldlLO
z{$J`DdU89MDKE6whhV@SK9_LphNuZH_M*%>&DM*VFCWuPET|1LKVX<r2CE#k#=gU{
z9dic&Y`&^mTa-o~fxlI?6A7+jp49FQ*jnlsf)BmEC5D84W?%nK@e~fX5*N*QJ=<Xq
zYUGuj7ctDkkwVHdqHe(NOv6h>Qq@kP<m}(Mg|eSYD15u1Sg+0y{>z=)`Ab~asv`9?
z>(CbZwEkuhf_JSfQ<Xm_UdLMBq!y&%{;!`Y_%9i7R%j%0VyAg7jNcyXzx2BovD6}#
zD7&t%GV23$vyl!fD1&nWqXp^6L0Iq~zHw!@SYASbC>-2M5ZqCmab7SVv!WKO8F*??
zJ`AEbuLnv`(#PN(8xu4X;Fg)LV8jWaQsJs&6)6KdgLBI3>>1P^Ni5%95W0!N`?4Z@
zAk$`o(!U=N#ARbrn)3y|Ta|xYag->WnY0q}X$IAD>KjNI>}Ls!jc@a~@KENypRTUT
zREV&;_<@`l+d%mO2$JJcfcRgrHyjqcGU)y*gTB}FZ>Jf{#TKGI3ncx%!Ad3nm86^Y
zpe45|b7g4=y-ZFyVk$5$X0n;aX`B}!^O81rPk?MwFzl@ZyupN8y%Z06$B1Z&q<%`J
z<vJKd7Xql-;gaMXQy=in?OrD({^b1Y8&!AA0r|a@)ZKwD`Wi7zjrGwUXz)3(E1Xo=
zVrU*>Ifi(Rv#YY{TmzOEIc|og&voymu4Z)w0j73ylO%YvS==N$Iqal?quj?*=(cWs
z;a>dw)YGjHP>|cxT#VEw!gR$<fl@!3#5>tT+%D~JZ_@{s%g^69ue}D-#K#%`D75vx
zK)*!3O=~L!4)d`B+33pVJDNcbmN$7|Qi__%+|D#8yA;=Ev}3CRr3bI5!0I}_5@hbh
zRVajZ;qNu*>FJ5EGAOQ-xS$hrT=5WJgUWILRiaP6`JZr1#yssy;R?bfOW1BXiZRCv
z7x|c%8;j1ee7a$;h``%us-D_lFO1gR1<Q}4{YrwcNIWXz2w(`wrC?-oZ3R(;s;xFv
z9P>`1Z}vVeNg9RdR9tq97T;Sv=02NKh3K%UZk-0#x{Bm*0P?{9R#5tXS5WaRP3~)=
z7IScqp$*{16i3>h139g3N28(izL+7ISUh9h5s?RfJVPR<E8WM@EqLbXcbm3^0RA;E
z0wy@Ux_;QpalJZB^gzBed~4RUULL;A06SG^J6D?k+H072BuLH*MMU+{M8Qy7=s5-J
zwyF(>O*7xm=qAM_8r9Jy^}JT141#r@x<jfB<tp6H7;X;>@+edzFQM+Z2JitCH-BlF
zA0x`bj*A`t>A`Zg2~Z2aZ_d@@W4FDJ%TA$_DC*JoSLNXSM>*&TMeWb0zWITA2iXe=
zFqU%>&4JFdOXuHEFutAol9|M|3Wq4Z56$nFn|P&1VQI-IPr+E&OtM!BI8FR73+U%J
zM^>N1_Ub>PN~b=lqPwhXa;aa3xHz?)Q3$=cg=rZdmiZ}=*YsSjD*4vb&gPK<4MCY^
z8yP3wQ^LW9+`|k*Z<<5@y)dU!M_O`5UT($1b#Fa9*gq`94gz<xI#+PGR@bC8Lv<;J
zH~eOLIif7SdQZMxL-d0--s1#ekRw71+RZDp?*6me<rk%mZ^Ax;9$RVa_fS4A9zF>t
z&eMfupwG3!;4msf+;uGuyouFfs@+frwd0q64N0W$+60xar_Y<V+0gF*%t!%spIiH{
z`3T1c^PAjG?yS?kxe2VJrU`T}!m#xoe56bplb*uhOAIumuCVVRIffbnA}utdcw(R@
zw?N(XxQR>S3D(GF_I{n`aMjp_n|e!P{Jqk?jrE#!FPqMuC*gb6cZ+lV!!)1o;U8Q2
zfn9DyCG&pl?*m`cUH*U5-6Z_swB0811K7y7#ch!#Av`&<vb&tgq}qrm$9$&L#Q=b%
zGn-soa%C8#qrKPTF&VCZd1OlPf=%^|%ip%@c_2L}!4a4Hr{EjaYB;DrYPh?)Z7i$^
zIle107p_c!2idBEb|byTUy(ZzhLQ)_*2wrlm9Z=|Ow-%VGn#50#*rQmdq!HOY(RQJ
zo838b`Ra>iY11g_#7N!qdy5z@_N;(X7)n|9l>x_M?u_Oumz!aa&{8T_cz6i#^*Ap7
z^9sh&bojsE*X0aKB{=a5(Ylg8BfbCVj<^c&<7>C}69y#5MlDjIP1=a{d+rk;BOVDL
zJHqFJnmo`tpc`jw{IvM~gz|JaBq=SC8z)pw?u5P6ccg=yt~nG;*-$xPX-C2{GS15)
zV@<f$ftGlgfPTmFsDpF*7I^z+&e|rNL23SvoK+mr^RcUK_!3<RY;FWUEPrscj`R6i
zGH`TiC%JajbNO1G&rG!|SWo}%#D(Za#{qtsE)VR^T2#g2mXo}qf8jL+Et(IJ9D>0{
zRrq0^L93L#W*;}p(iq60(m$kw@`b5X_2PId#-}p~%BKhj*kwTQ$w_pvb%atU9_eX8
zBy`xFF4RcZ76tLkTXYzr!y+iHTSKkd>YKMglv9ROK1f=V%o{51Z-^|A0kk6I?UTDR
zijB^syW+D5b84Hu!wB`WS8T+gDi;nnnTWi#RGN%I%hrH$-#c@PDbj0%2Z$$iP2e8Q
z8Wm)zGhWG-Aps`|S_9KJAP3%()Q_Bx3eZYs-~SS8@9QQS9}=x}@(?1fz@hz1{%Rjg
zKi^ah?PJR^Nm_smzIj9;MWTW}jc6aH%YqUHXkaNLS;H7fJ+asMA}APFqSnFbAENTi
z7bs*mtx$YWzfKU@BuqXLj%&<~Eg%#&FbuuNV1V}(3WJVyJn?Ig0lN!Y*t2`OHK_(;
zbWNcl=;j?K!}0f?Ul|619X;9Am#{SzDbeW*<6cmapW_{~>`0*<A?a1zn-e0+h$oXV
zy)0Jh$L>9uj>_Ldo+*kxG`e~s=iez?c2zU+*)K#SVTTy8Hl6%u8?4IT%zmQa;*JZ)
ziamY<YotPI@>|sn5kwdx5lmQ;$hI>z_FE%T^*KO=?!cRb*eCvX|67$ZC<)3O<3svx
zE>L#g>|PfiMxWJ4vIyn`Ljw%rEH@5mDECM>h;64QO%ML^XoT=BmR-|)4Q?cK*Glk-
z{w2t8gvrGX>^P)??k}vs<cR5M)n^f87;WboMns_9zHdlJk~~Z*fJP=9zG7=4Mxw0U
zBPt+07fP*{#&vPc=QKn2_TdY9ZSd;|;QMz3U=Zx#TMYb^Ht?uaF^=d~ec_;}5E=EZ
zcAL9g6IZH4{u)cuID0ipSe~*Y-4<~g6E}_79gDsikis}`LpWLjKoNe%=d6Vj8EyaB
zd2LFPHnDq=Yc{dZZm|`-XmX*u9(Ir#T^js;uKSyLRt6Dcn^!W!l(>dp9ClQ!R?8=)
z_)JwxnY_tjRuP5=bxs(CtI_HbV-{Y^w@i{1Z;Sn7zlOX*qs!mspLRey00Z5;umv?;
zX!t(grcCrYbj<f9hFjrLK3Sf=ruo2Ott&PIQ?CpPzk>GRI*gNE(2L-_j<w?D1U6Jp
z=_p(T+5BvI5UoOrm5vSC0fVb6<jZ}E2{9sPDeW4cI9}Hcl{z&-0^6eK^ds^@QayL-
z=88F5#Ih%D>kGRgQbf%@0)65=Fyw>E&KzU2aH(Qb91}<G%PIzP_)w#Cq6?o72YYHK
zE}A4J{M*PMuOT!4?7tzi5kM<J*)w!;O*`Qc<rk0bN%=dqtDTY_Xw>0)g#4oz`mBrv
zXe=v<8k#jX9lKbHmX8N&;lz9bt0;hSK4wXpJPLvpy9^4g6ZA@YXhx&3Q^_TcmjO8(
zE;)CQJ0FXBUGgLOF=vtE<q{}3ONmTAHR0%O*4N;uuy2wZ2L$N=s@?d?l-X0C1Ekvb
zFpBh5)_qJ$?8`CFVx~eAwM0Fe{W#D_&7QTlBn2tXg_|D2Z#cEwxV3oGwU6?0V}A&e
zZ0+{^U1@&(Q`AVxFfG5eN2>LbbkF8!^TzETJJFm@q?Cf%mN<f<@m^e+d+VfnT&fxs
zdfy+~*b~^iE6it=T3m2X=r>>|0+k1_yHb|qz^23|4W4`Xp6_oB{E$cGyWa&<=5Eba
zb}B__DF`1=0mO}>LcMchitXIrjF5f~!s~aFBJqBYDDD;Lcj!h4)kpnl+rk5GMOuvB
zgIch?1nayR(UAd_VN_jSMFu)~HeJ2{QuIvq@Cb9g^2NgOGgNf$voqHRT0@;oXdLy*
zioCtCwc9B=gW!g_S6u&%pS4~KX|8=S<7@Xt`<oJ-)^qp9bXh#f_=_S_*<T;(xIxaM
zQ!p2(=|kfvTZA0wLtOqcFwC%U#!wwxJ4h4o@M9~TeSUcgEg4%lIB(sF8V;}0qgY!L
zJ{!2?%}|K;%OTdoo<#9Pc|yaEe`#O$buX&Ahv*~p?aedmy-CuYfi=c(z*@et{}>v8
zZ6Fnk<Ci6`T%eJ>q`ioa64dU5?QauOSuriKSQH*A9Lsm!7Q|v*MXmvV(EOwOVx7cc
z3%o&>@LRL=bzKwrX9|xmuw}?8Ndn|^W(|nhhAN2rw4pNxD~PtfRedvU9`9=#qZedN
zmnxE0Jt;DgaB4;2vT$VGY=p}^^H*mkv>-XAM(CrVqlw0PDh<Orqwh&lR%k`-?4vQ~
z@HNKF4;|;s;B{lEubt8!-=n{{1W{0#&xI?4$p&h-g7Yi9*G{y=De)Gt*0P*uCT&A{
zIklN3H;d>HFJ@#85};39sL*c=A(;|Z#e3uZNLbTQ?4b0>{4VyI@4S@BxqXvuMfh^3
zT^Cmyhp!zW_CHro?Qch@>!iAnLlXX?2?Sppak^aS?l{OdxvN%$5KfSg!ly%>n#<DL
znqI;ZrnSLm0bg#hnlldWL^;ruS)f~x!tuL;;EI<lr?)b(r|OV4B2hq711&=_!F8UU
zzp0w>GnUr)2WY2Rhf@M*k6O{@z|L}o&cY;fBztQ-m~g5&z0*wn1Iabayr9DPs07$W
z?K=IVQQ?@n>AnCaaJ{^5Dm}I?&dMS**b1hetJ<KBq;Jm7Y^2~)u=n>~-m7dm{G%cp
z{w{5XRa#3>r+NGue$y>dT;AD5`KW}p-+7tZdyF?k%pn)jQ!I9n93(?~6-!kEJScAa
zYxK9^#-n_H6d+qLBY_f%&?1~KV^Z3+;vHEP7iBzx5cqqymSVw9%4PcdySl>aJ5v-}
zE!D%i<x>J-NLxPT1#Ow3Xy}Zh6kLAfTibJj&f>ngW7Col(b{Y3R{0pqu;ozdE*|5u
z72-b&9x(MW+#*xa`)2OEtjst~EAM#dw|*KhuUD)5&(&)B+YiW0)c<k1ua()f=ZzXM
z3EfR`+Dwsmqc{;=f-1J8;j}VFWSz}h&W&pz)QIi3kKlYfq6!MIF<vp%ZoM>gQ6bXg
zv^TyTuqn>`?kmM*P+hY(484tgq3BIm+m_A248Q3emh~oB+UPCxd!}U>1I3HGoRXRm
zF>4$)e!g`=z9Toox9*hlZ%vEl`T-^tH(QlU*%VCeu13G}`T;T=GR|u4&QtqboE7l(
zw(@)+{(^8m&+ydOx%~Z4NPDb^kSJz^$$1E%r8Yd8{D{H|dPuP2C=nyH!EZny7si8)
z!Fn88!{8bCpzQuaRL6U66)Ja&T52M&XRb5Ip96(d+TZR*AHI)=n3X8=OJ)eVq_XkO
za0m`Lbmj&5eaKmQvAg<!G<KiyXL=tJ8&6W>_T)C|#c~TAH6J@i>m_cYgS!NS(t=4U
zP<zFrGvtM^Twxu*b=3~!Tb*M-ZAG?NQl~G9t(=BEyn(tlB(YQOP3JtN=|PBZ_)!9Z
z`a1<Hjqm17-26YG^S?<_sf_{FX!hZ!Rw`qqmBH95KMo)VW40Q?*0_^ic`=}g@{1eh
zg{SY=Y@a%%spHMouRN#?NW`(sp7oL>5m0HN8Ljb0ZoaJ2+QjoGjMB3ZK@HZC_k%D~
zejIw~g()Y++y-M|87Z-7t@3lo=q;n%l*V+2868c1Z?S7M)+~xmK520mo6oO<aKZ}Q
zA{UO=D45g}R`$)qOB{hPS*+xl0ro<Lsa7Lx#oG3$#6$Jz?FIVK0`#LiPPsz;iYU8B
z^P7MnJDIp+rQwyo-}P_H;SXAD;2hKl6@CVKL1jCv((nM^1%hL3h8_nJVSQ3XcW)^;
z>;PhubT{&l;w||Il8YM51?VP|HB+Sr>!Nc0!WfE}yReP^HBQ6f&)Tk2F5CFAiD#T8
zOHyk@57c9C*5Es=dp78B@r~xJbzL;YHF}V%{w!QBmw4n*jPE_TnAE#-^F(f5Y`yu1
zUY0^b+o17CvmPNl*u{{stSg@OQ8IvoX6{3O`1sdiJ*hw)=d2iVWt*KCPU-Sj%pd>3
ze4`iYXbUakM+Fmr8W*z=e|+Y-p!5cbh837aI%0l3#}4+p2b*uDpYqrNN<25o@CZvp
z)Dmb$HrX5Z7jYU*sR*Ay>?UEJ7p%LMhU2|GxikH5xh>QiR!g2Shp54yU|_?vv)a_t
zP*-P&ZacJ*sEtwR$L24<`}DM5LY{xN)cX5167AixiXFXdL_|%q#&X(jo1Pe=2fUJ$
zyu}#(4-g)Smc{7Hd_K2h5_!WDouL&+L45Ub&o3*JxROB%ht;50F*fmUTcc7*+PML|
z<G)bl^_&VJ!pwx9^=4A}z-C|8`5aLUT_efshN&rUjWa>|t`^mVs7r{G(S8n&S!1O9
zg*7JjD(|VEmfepQlg@|*VxMzKgoMt6IINbKsdc=aJ)F?*+Vmi`cZhmQR{BMZ!r&$5
zzbpXxOeQ{T#K~*;0MVzo3-oNB^U{5By{t6A&-!uHfbg^i%Kl^YCv8I+s_Vj?Z?wMb
z?F0y;@J|hINtcLU5Ll5lj2x>krCtgDzs@EZD<zIKCa*F>>L=9{IPP^%oI%S?Zz$)P
zDcL+X{pMH$)4Lb6O@nMweJ6swk~dmip(kQG&S2Mrb+PtxLDYGFNn3G?2x+vDFD23R
ztlr+|a_~69$X#60WM&$+mz@;LQYI}xapNWQjvU)9<lItxLLca?Gmpsq;%)WGWh{P^
zq!b{<*b<R_7`eK0iHEDEREBga?jpzSsCVS4^kXULr0s=6??lb?$2sAlsQPQI<ikJZ
zAC%FSNVOU#W|h4%`?z@$mSmuxGB>mn=FDS)9xMqaDIt})yYo*58j73vwDx}8=^)xw
zx(z2!_*OPaL5lbTKxbw+F`Bd%NH3dPo%2NE5<0KS1>Nri(rU6eKUFqXp|vdS#ZZ=e
zp{@*Oggwurey48TXX$+2eh1weOwAU`6^-XacdgdOn=AwRVI<&XF1w!yJEM-Qn3YBJ
zBLwOeEw|nLvt%MNw5#qw4w(E~s0B~YA0NCRH5Q4KXyQ2A`CIoji2dsqI~OEMlQNMR
ztsaRlYSYI3$JVZI-yIWFWM6c)uzVuky7QF<Lp?|yn<bP2dbtKm79I=qZm?z-G37EP
zj%2f8SqIKpByX5(c7-69?*MxzR6V0>t=!i1HrOMm3RYYWEbKJNcnEtEp3W61MHkIH
zS~3FrfXT>088mgpO!Cn}GLW{^fe04Is-ksjmFPF5!M)FHXtJ=anu2@zKJDaq^>BD;
z!pU}kZ9r*dZ!S`9RkoAib-ts^HDrG#jOF$!900HU@QU?^zgYjv@8uVxh}-CO$)&8F
z*hsLeN#mSorrL<b1ISu^F^Cf&xX`L1bhRKiMzMD;6szodjIzL34<gqOr2}Ih5UF_1
z<C2m|BlT06cr4PKKSuuAk-OgxQxy6(=Eh2C49g<gIiPj5*7j}OE4Mb<ayvzWtD5l#
z*&6oeD*QR-ZfDxA=O(%Iwcd%t%yM<{&Z5xotTADVkM`CZl+G{3@t?-0isU<bB<4Cl
zq79+B-S;UAI+oNdy_JfmtKvXtA)p9}Tm^=|rg)zJTO;F@Ov@$8ZYjGCnLh+3<fzQU
z6=lwTWq~PoH-gqu=I0bxL;?@@{puM*#-^&G$<Ie$LNcGA7m<*}OrL#<u|hJj<r(vV
zhxslwgbB#1x6Dd~0<tbSi)~&mN$BgzG5Zw9B{8Rm0tL;zQu#ZZF{?De^-a>uaXgJ?
zA8v)KiK3|*)0AxW5W>;NM*1dGVg;39^NqY?xwIDbeR93XgqW3$G9=BOCw^ZK{-oF8
zZpE=D1y1No*T>b-%niA+nBd;QeUu7+y>J<?(wOs4lc`cXv#fs%g*0#&-%&Xi_*6xw
zH}R>B5x2fXddhoY>L+t-jWS?}e&d=W%@Ls5w=`kcNrcv!Tr2cJCCOgcHfj$!T&<pC
zA|pN+k0<4KY&Moegq>lS{iXqNoqclRE@H@Vmn6Sn<CD#q9^8$D#etaNo>H4sWKFft
zNz8nAgD9KDIYI@Kuvb}>2itq=8KlW&qASZasxL)rBvNOMqOK*sYfyl$9vvsr>KJL!
zT6RC?eNxrpUk~QLih>yy$EURJ@h|6r-Tb8n9V@e=KDO^sk^|=YSmkH<Mi#h@DfI<_
z%5fycZhW_C5uYO1`C#F+xs%01RZW`T^^gU7Q)?)tqBLEyMcHJ^I<~LNaLbHG__^^Y
zVG!j-Ol8=s?P6YxK8l1$Ny*1Qwlky|mfT~0ueA?A|1h{U8(gXEh;&r8B~8X~p$U+9
zkTvb?Wcw=XOu`@L)G#Z*FA}BKMa{qAmiz|7=0mP=dxk7;J&XP><o_j+v-q4zffwd7
za11B?HrFCz8y1@A!EnF>MpGUvn`q820FD5u59ig80WK4aL59Ky|2=}OwlQ@ud~9OH
z=dO#7(GN!X8h+Ta!W_S_AEiRvnU=u@o%tU~`9{mw5}_-dSS;+V5105P>xf;}krJdn
zSF!=>6J5aVbI6h_W)6ANwI(85kR}W!Iq@-Wgv`90*ul_C!4DM^I)o`fM05p~n)yBq
z*vTsTTTZ%l7TN9sr>{)-UrE_6{!K-y8cq8~<`c)0Dc2xs4R8m0$c8u%Wt_}-mU~CB
zXI5Tv?5p`tn;s*}SPW>LWpit}NybUzc%>*LdJ{wjRMcH^^9|T>37i1gd6+Y<ZPYPi
z8Vq5hw8=V0ht+L&S9C(S5?Tjh)s@k-VYpcLqZh>m!7LA>-=3Hv%q>k+Fev~blme{b
z1!Y)_F2|a3W(M|JXkJ#Srt{30kM(z=+;3DH0EiB>p932zt~KC;E(#pg`6zh@IS>$<
zl|JmrN^SbT!lLbUAx6scY(H+da_YYA*OQ;?chz`AJ|*9O7K+J9V19e~ZuS7tqg*=N
zo0n>KD%%<SL;i{DfR0+}x?sm$f&wPp|Jh8=|E&zqEeKk$I4^f_%vRJ$5K9^1aM!pv
z+e8xcOW9F&Sw<h(nknn|Ws<gGZNfYLBDhjn_U=slQwBP1x7=b+eb(KaHq5PR<M}!6
z7-i4u7?Gz+Wv@agD2l#DqL#&-WSQB7;v^;8oZM+gDdd~=o$W7@##?78n{GLzd9D$%
zo-v;Wl{kB-m^9$;M_XMWuL~oi*M-r>z>Tv((LFU3{Z$#MNB@wy&!9CjIu)-1N5Y5#
zfeeVOFi_dasXXF*{8$%6t!1;o2r#k^6W@PBEg>Y@=|6)JGf#LP_9*YcP-3gifYcej
zwAe^`M8k!(u{a{!7m(^wqZ+<<ZK(|Pu?;sA!&aDz13}-qD*HjMn+05%2{E)uTte#f
z9Wf4vF-^b=TGB#ZuQd@rKu(s}vN@nj2I}t>)#rSmQId!kcz$F&t!WqKKbR$>vs7Z5
z^g@>k^|meB8_B>?pI+0*sN;?K%pt?P@dfYK>n`~prQ90%XWe4DiFrjc0FfbRlsO1X
z9IqR8H=q?r5N2BlRYc5_Nv$x)CxNMsPH0~s&2^;!nlmXVb~?UuyNU?9FcPKq<xkGQ
zaeIgO!M8a=A*<V)pg6_0*b*tCvN#Y1rB0<Q(HLLR$)rd3r{H)E0U~X@Rk`a#cyjQW
zLMn}?bCt_uHzASAgS$nJ%z-h)2j7BtLt{<TkSGviCimGsH<$j6WYq@6JAR@xjFl^I
zPXguwsSij7O~H;pf4h@1hA;tnz2YW6VVkZ0e`fZv({%V#b<=r7e0cganc5Vg5lOCn
zVoDxf`laK%;0jgG_W48>KWP&$CjwR74gn9Kpgq;8m87I$Oq!I6*l!vewis$=)<*g+
z;Z}6Q+5Cg#10hONxd#5Iftw|sK9mP2{nYVQ<~MAOCekTG5CGanwFe1O+B|dtoQ;fS
z-L^puC{>vtz(|AB9|<s}CH4a|HeE5)HbPTIFM)w<t<j4MZu!|IZXwh+cN}A9ivLnm
z3Eif5)tpO8Dxquje-_}is|mNFh6Cbip|sxTgHnC}#N&z_K4lF{2RSZA;?OPYoliiT
z^~k;`^JkR0@vpy^9P6H0*sb`CZetS$%Z;~L+WoN)>SxL6a$Bc$JJd0GI2K2C+I^8|
zcp}yeo&*oYx~=&5w(KzB(P4PcTuiGEsv#PC3xN<(na(?1K57pKF0p&93DiM}7f8^T
z5+QUG$tv3Jl>!7OKFYe&dzu{0Y=JX%V~Q9F^qE$;$VvZIPJx!=j6d&Y7XFvPF6}cF
zYUZOyTbxh%eU-+Kcz<jq9HE`!{@??BJByVa2Gj2@>B{P}YH+vpp~QUg@p=_OlDBW1
zaDaTk&z5H3Dc+<0y-p;S5L~+k!`J-<EukbB2QX+N`MJ?6tY1FfO%Swwy`Xvmb(1Tk
zlCX;S+0>Bo@e7rg!%$(w@P5UGTiC$cC0;7k{Ld1R>wSk`-lIu!R-O1`>3+)+!gmz#
zPS<)cm`<vq+;ZXx`<XGnF@|dr_wjFZ`M&VaYm5xYu3tOsmkpUB5rrt@)z*TA(oRj#
zZ}{=PI}$@JIcF#;RoJmfAr~68)5etsUHxP=?#3NQa0a+U`PdKuX6GUgSAz@XH~Bi#
z$C<*z&1S((G+W?k(H2SU9&3c(^}J0@`L^e*u*retRNvB+sQga*F<^hk<$TIubgD1A
zYV6yD6c!zDDLy!|zex>%UM;e_@95x~s*}0X#o;x%=2^ndaw@>$g&sIQ_6bj3-h`tP
zk!5LTjgZ_?T4VT2KNd;(M=TVgSIhrz>GDs{3>!XG1vga|dKULBg(nQbK+A-)aI2b8
zbGlbGRes^F&kLoz0b+SXceP{z-vXxdi{B8zZ38orP!_Qfnj7Ds$7m5jHVck<_KF%c
zuX07k4%M6Hy16_YyeM1tVid3eq9`@9bR7{faAY{H4lB>hMw{wBLyLc|Rao(N*#K}P
zA=dK^H|I{fFYI&o)NOfdRZ8pSw4n^<*n|4cv8J86h*w#+<FGDHIazQ6nK73<+F*6E
zFW@MUu%xp49k)z|2M4C^SO%itfTsAh*((uwzY>uPIG|m-nV5iZOn`}|HKNWK`WROK
zg}bA9#`;IP&C((zuyy$;Rm4qZM@npZhsfAo4Sn2B1cwzt5QB6rV#ayNFe{0)oePL+
zL*tyBVjE9HXG_71v~faNw;_Oj6c;*1%BTsY04LBEn_Q27nG>U#Ttb&-)Rusm#aBko
z1sq@RxM1ExF)=cq{z9^bDlY9mhqaDVN6KTkS)ku_k1(}m?^L6F<(t7uJZyf0&{<8@
zFJ7U;biRbDIcWM}m9u&4VZa>U?7Igq>*c)ujs@0m&^nU+&Z~Cw`nO&>k6q&Kw?&tB
zm&}~*6i|^tM5n<)T51O*p?vCNsGACNu;rtrsH<WT*$n*&Y~fny-NQjbvy?xe4?{Cl
z@wX_UlOPGi61Nbpr68ToKvWkA%aPVy;M?Otu%M5M;9j*Kw}~<GdpaRHtMHD7T}Nt-
ztigofb;bG;b8vSSF010hg?i$vEiqWkjaQ;EvDh{lvs;>MM^I(g)=ni1<w6xK`B%m1
z=NdBjE^L|b*9nbTry?FEF)2+6cYbxX|F@0x&+8g{_ciHI{in47Z<AoBuqYVd)CC7G
z&>?}SK3_NIaUsNrht11yA=<$2jaLK=*PRg8`~y*xDN1TSMM-uCHGr|tNZuq;&L2(C
zd_cubt%^~5;#-u0nsyw+l?PEb&~DE$m7U5=-{859lIFiGK<}rzZa)yET4KpoevBvb
zs{{8DU4gc0e*$#lJ9gzrbPr~Je&M7x3?LHJr>|qOb_G1|T7u4D-VBgIrJvO;!LD>z
zH%_TgeP2R+K8-yyPk$ZL|9iP@EPY0zmL3iR2*+m}LRaAGkv*DopCb)S*3jxV8=C4Q
zZI5sme51NaU&P%4)ir;dm!-yxQz6V+B9YeYhcUL}xJ5zczTV5UevLMSLX<fE02b8U
z8P<t6h4+J?XB!SsZT*lX=OiM@*$z8V=5mRSQ<7LJdc&04NlBm3(P&Dpf>zDV<BlJX
zr%DBZtbd?ZK1VW<BCjCJsoOVTM>M-g`FuhY$HBn{(GT_FLPM--SrgFlY~QLc5{chL
zp?rPoIPt%kolJB+uDAoFPz0rK^_*UBQfY^TPGAmWt?CPWm`a}{>b3|J?a%SnKTzdU
z#xY@0g#XzWHJ&VZ-`2A|<27SU{ze;~vjZ6Fb6ZwkB8Ef`bBb;KunfRVkqb=$#22+v
z@^6Zi85b#yWrSXu_ou}WJvLLinn*G?nx*5Oa|pb@bCV_Lx@?E9d)#rS?)yeHfvWOJ
zOw+IOl+-GkZMxb9Wy-jk&qi<G{CPhsXPF8dac6K5EKIOu%j9GTrCj)r5&iG+c_Hi8
zn+Zg5hqy8VZrXQaLD0#tZ*|{{@D3kS`3h#QS$Pn#&<AcfN%Y~WVp5@PMMO=F;laAq
zDMEF`KF${uctZ{8<pmc(kJuABw|t&L%!y(C;yJJ*S#Y}MIIxr|fvyOD)UI;!r-*x?
zD7hLkVnJyv^)-Sq7;PWM$LIg3dJDd&x9|O%7`nS*29WOV?vieh?rsothDK`W?naPq
z(4j$6I;D{=K@kCO<ec-pfB%Otulek~*Sgkqy%!vTrGc7{Be9DYWXr}2ncB!~6q)*H
zjMHulSTYc)E7ylA|K%kj`w(o8s(fE{eURrKtj#pb^dRV&?S==Fux8Z44nZ!C9n?~_
zWn1{4TbNOmGd84MErmH_imtdqir%Y<^`iQ!`g5s@0IGvZB(M4$ghD*Dklp{5h49k0
zIZz`#Q8k@TAmfOW)4Q)<&W=8ce56>~fHGQI#CBAhuzlz)7FNC^Y%odsgF~MJNlg(N
z{5}cKO*ScZbE>YM-DA?QC<?aYdwX1`Jp*h^nFvlEhFT?#9K=?lIQ85zj4;AraNb0V
z@}l8^km-WMAmOge5LhK|K(B^{2}^-p)wE)J5DHb+;UqfMNUn^C9|XTYI<?b;zKWAZ
zCTm_)d~WT8>x}dNrtUnJnH(vYLNm)@uI>Fv`NBUt*_>Xm*w}c`tEg#PL{xXsS}+mk
zMcO4%*y`0_f*A}!iwLsH`q91tODGf*6{BL2^=sM_)3un5qDc|aev7z1(2n{TFeo4P
zDtJW6g~4~L25?Z8UmTpP)KZL*=7?ABf9;H$904gEcGyBaVNHLnRJxt(l!Rf1_n_!%
z?L6#F@I$nP^krM<+e&mPHcf%6axV9Idd=8*;y?!ZDD!5cUcdMBmAEI9X@thS#m|L9
z?%x=vUzM2g=h<90V`0H~jGvZV*gcCFLoDF#gi#6%PZ4)21)Y4GAs@-ZmxJ2yLy>4=
z8NWo7nNKRiz|I!3F(fb)GJy`+3JM4m*{#XSyaU@K67$fh!F5>V<LRU!HwOk5Zv3vV
ziX#dfS?&RdYu^EhIj=({W=Rhj9+NKamCRENe+}(K9D<xGv$>9%td&`wBt=`=AIi$A
zs#iY@%%z9HnIIc1)D=CRk83v@$!<6VhyF?;-9YgU?Zv@;zS%DSojWx}6qf0^h7)cj
zCH>Aca*5u`Zmj<vBAJO&r9o7AbSe04<}H_$49GG94P>+hvw}ZclCv0JgS)(HAAYcy
zz8a@0b(mS#UjoVk)Ne{!l<iw`<f4z?xoec<<PqC472icS3ZnvJ>Zeu~82jci38zKE
zn!n=23lpNEo1fW2rDVFs>ec+J!0l)w<!365Q7}d9#xtb($Q++9@3v?v9dQsO)#}D)
z+QsL5e*5XfGP%6nO(-+<dCokx{gX5Ki`A%E!Q;l(z(*y(xgzFG;zbma<BG%r*6W{T
z9a_>`d$MJfU@cQ>%oa1Fjgf82H?f6G%2<Be6*dGN>#%M<_)6(S?8V2K_%nXS!z1g;
zFyNr!X-{?4z^Fbt>{6^Vb-NgEJ<z2$N7Uj7;N5@~Jg8%f?|OU?I4>G|O5{4nFZ|Lr
zmNxmwy$3oHUq$2X(z;1izi-~@LLPtb+eLk3Yz>7d1(Vinp*(gr35#v=6p7;7G|n=o
zFf&*Gzsars7c{<gw)O$#@soOj3IVQ<MZxmFnl-|c@=~Lw{Dbn+D3eIcm*6F*pyH%+
z=(l-FmD57KFKNFKCaOIaea8|a|M-h835oj{Mn0bgPJ`vGlS#pFtwpBEgTKTym2bov
zdQrG}nc;sWM-|i({icXnqXi#|ns`wK>J!rXG|EatKUx2>VlwNuLPu+pRCmY;y7I~R
zK%D1Bsnp^k=q*Hf$8o?6ar;yB{uA|tn>XZoS^<3TTYV+5v-^L<!7v3H4#}aZSEC@(
zd18fGrY+3Gqm_APL5~EkFWfG=6W?f5&-8W4nMkEIqUlMu`})+`YeGjy@mstFg`t+p
z*#SpzSw`?bK(p_`!7V5tZ?yn57I|d59NFxr@$agX4O#l^XjZ(3h|wpq>3n{n6us?T
zvT@zQNW;KVZUlXp@O1qt0H@}f_YW2-JrdOj;vqwP#u&;s-6lbd*t`-j27}D!fzcb>
zD8<|g6RLiZ+*qJjfI&H1Xbltf$;hW3pYIw$;h-1#QFOkD3yeZ%ssAT8?E2I$+yg@&
z6!vK|e(~eZaztMT+j;v+{6dLq4VG|~=JEQ*CB6fIH=g=|s|wB|^9aR&AS>wassY7v
zJt*ZV2xz8JO`Vst#Rjr(xjS+;VIAofY25Rn9du`qB47YP!p}LaNxk2dSoVPL6g6&M
zid=kHpAo6etzJFmd<#$Jcxh#-#uPzmc0!+K1c1p7b1}zf<>II?%z4FW!`ngAK_~=<
zJK(C<7XCHUKZxGb=A=!Fisr6+HLRk3s53S3?O%{=nRQ5*-h3#HU5{htQcd*O@EKsW
z3x4%nz5RDfyMRU!;{X;*gFDd>F>a$VHf?DzLh97ok&%h@Y|82Is1d_>CicBh?Wp;Q
zjhhO{xVKbQLsa-cg$cn;(;8OX*<}l-I8aztm7f1vaGUu@d8!$|AT!FN^(se6S6-x-
z144G4rLn>*Z&j{cmH}|4h($vVU1TQ1izpG&q2@8SwLFCOyh3Gjv?<A&^J!D7rDEqL
zC?+CDL~nkl*tW4G*Bi{`<$<)I&xH)U@q+2@BeXChn2Gfy@a-h}bg!<Xrmu^@jM(JB
z;qzDd*LZ656yDnMVuK^hcb$PVVRisX^-hdEnGj2Dl&!-IQ2BYa#Yf7~--ilqM_4q4
zPDfPUasiZz7|15-?1l1@e0UbEk1~v$31B$!im0CmE_yh2vctGM>9xwjj!BDNS}5cW
zLR~u@8=Wa$JL{6naUR1+ArrjO11MxPN=fYrHdkOkpK|W-mW`z@F+4H@>6(-((P2YZ
zikYGOLxKpIqIZeLH`-B{VYb@i<n(})9sM<hwcF|>rimct*Av_SD(mML)Bz1LbhmBI
z^T<BX8|Qp#u^Ca+$Wi;LL*D~0Tpjy@uf&j58)e)oZC6m{zDZ8*0*8bN-)&*B*O^VQ
z16Z$#Av7PJSgbC$QZucWidPcnlMYvBUS+A6BIPIV@jcarQG-*{#6lphux{w}h~lYJ
z$9!QFc%j8Kr4wplAjK*PZe)z8<g^fMKhJcd=wg>2D!{IV@uyf)Z2L~uoJ{Xd=KpS_
zalkk_k0VEACCUu%+{SuVM?d~A)y)8RX6}e0-LYR|k301!pmBu92bY$_IE{sY>%nLS
zEbJvXM$a5p5pIE>;{Ad+hT7irQ;Rl+I({Zg3|LP=Z*>=K8S8*;JfLhfY>X_p#M#KC
z*ljpXoWo#NoItayg9r^5$l4*?O-3i4ZyG1VO_PH01HxYiYzVpuADhs%)pWrfS;Ur4
zC%9<rs#YhrjlORgoE_2X{}AqCSz~qYqvIQX^ciPi?32dVQTVSBSSc+X2YfAQNt6G_
zMe|;lnj<L=Jl<=&zPHUk*c^t6DbWd1WhTyre1f@TOLpX2F46M7`-)$e=Zu2;Sj)I3
zP&R^yR-?r9@IC82Dakoo1}kN?6o4s?=nN^xFM4ZK_T%(h^!Bage5KsD?{Yt(_e?Ch
z8<$zC2=#K3{i{V;(Qm?SuIA950%q%=`E*&nhHcFsmU4s&zE)QB6-<I>Vb^&%K8WtP
zFkQiL!30L6`?;*e91H?JO2m%bO2Y5N7YbaU9|Nuyc<r3^kpynN)#B^xAAjd#Wnv1H
zo*n*|x78_Qr+k^AT)-qnJTR<&ujsr_E2t01M%6j6<d0P!)Q6D>rVpeY8<%QxJQ7u7
zKpRfS2~<Gv-uMJ~P8qM?bcWU9y?MujV9*U7GF3g;n%hVJ$R-?^gjs)5j`%0xLBO#+
zy(7n%A&Hs-;)Qquyh_w6q+F{TyQaw7kbP}-S8fcSO@2FG+X24lElc?&*p;pdQ2P<G
zdpvZpuc@6E2W2L07YSR$q8e54K16WY8#QKBcGZ#_bI$k)@85PMEh2~*<tO96X;`sL
zsZ;rk-1whKs2zxvxDAIU4fsg;F<>`&oF2hq*0rW!u^)T?3XwuGn#*sE+6dKk*iqAR
zj!X?^N+m_nXunL?JHC}g)sgDf8zmGya}IuC91WGzBQ&>gqxXc{K}ub2hhbycs;g5A
zkR2-o5Jm4r&<82O$4}%VjOG#7+E{$VIf>+0$y_hx8Ij9q^5gbbIP4&z!RY^*sTsSZ
z6er8uU;^kU`6VssnOI4jhn7@`G-||7;G9ytbIqT<R^(F&zo-o1uteLL=24DEQlKK|
z^UWOI4>e(Y{uo34ORV@5m1Ir#`FaEWVgTMbp%X0`1klM4>j*NxC#MMLyCn_xm~w))
z1-5z@(`SE?IM<U#<W@JEmL`{3Wl1SZ7>VNxzg|IjVP3&B9bu(f)P<pV`be!8akPDa
z%K@ONiiNEJJO_hXfNXxbg<2K{Qi?v($qs43lD;7$9HVXy0$k!gH)p6uzf|ZAk{gy%
z<x1?^D#_65DVbm*L{f%6Y7;$e@!ib?@6lJ$?}Cha*{e}VC!>2t^)%6P)V5}P{$D*b
z;)LFkZ*oUEfxwD79CAZg$0xr=7P^L8(37uY@i~{%7xETnlpm0OJ>#fj%dUV?dr9dK
z(GyldWyz*{{GS#u0FBdiWjyS+PvR8{YobwPL{h~I<r<rlhl%L%eb0u}D6jQ`aB-mZ
z%<*9NB<7gRN+VI|A_8hLZ`f^kuco1J@Xnk^Y0;e;tYE*)37>1$LQ>F{ATXck4^9Mp
z*@2d^t|EMg{3V;43PN_yBz#4OR4xg5XR3P@?D@s{Zx;83N5JjM6J;5U<-JcmyQ>lW
z9R<A|Ne3whc+C_6hz+*i(V;C^o8Vjij3>&v3=vARm7>9BDUYj+6u>+8C%|{s6<X0`
z8GxEilj#qg)z^o&jc>}yvVSlq2Wh=AUXBlAkyj=JA@l)r#;3f`VEj9udq(zfww*Zy
zkTdgl$4I$Bpco-3yvNJl*Wr`NNn<DO{BoTOe2vQ*gNHe1@fl|$eUW}&u4jx7>MuF!
zX{TMSPeN664Xyqy2L7SGBofQL$Fj7w84%vGkS?P+|IQbV-dU{HQ9jL4EZ<9xGzK3@
zX9kqEm)^}q350ipC;?MBc9$c2y0nGIWXN++@Jc8<pk}A?UwU8pyY(S_WW7<XQJL}#
zHM7~I2uLO|VC@DZ8?5_;8*mIm%_PaR2~l5zihe^}2jnj-Hgvu38fN#yC)zwHAwO?P
zKmT+o`!3@@mdi)|`Q^!KLV>yw3J)nT@>=_=Iq!^gHK;V7!Th)7`eNR5BCYGm#L4??
z;_MK(NdD2W8UJGwdP#=EVvs~O(e;b|<<y9$tj%k;H@?~w{dWOpVj!IFpDm%U--t@b
z!l75E=wV;U{3+8606hGHJ9Fp(m2`ZT`<N}1#4JoVOZt)qNyjBSi^*{7LlFNG>g9sV
zuW8!O&b31&zta^ka=0U}7jA_X3+?IG$+$FU*K$xigv`-Ro4Y|_GqADWxE(HdNdJ&r
zug~QSTZP4pDZAEqjM-ie>rH%D+LtBijVdI5No@j<f&UO<vP8CXumwJi;ksexGfAi}
z&tT!o;%_!+3}EW;YEUc^><;ir*_o3~$8GwkPT*w1POKJIQCA_{K$^IZ8{FBBg*v;r
zfS=OLh&zxD>mO-bQ}HG%Xc(MhAk#@jZBKSEja=)dc19#HV`$N+&b~Rnpmj3L&j>&U
zSh?frwrOORHo#g@Pv-W_t8fCCfAZPW@EBuv3Ba-GNXLoUGB<(5<lN;r445S)ABtl{
zkvaDTDE;{OcjFVFdepVy3EZ@Gq#`8<;NKm3OS?UwFoRP1=7vU1_Q?Zd=Yt{3;g>|%
zNq;7`R|4yw8|<e``<edMe2>t`@P!Oa$0PL97|hW`8(((uf>)E0VGE`|xgtD6bgIsm
z+0Hcz@as067PML+41iz5oA^|`)<2q5uGS0kQjYeT<LM|bAmq)FMr?~><r25iV<_x%
zE*K@f%7I%0v;^8P5i~hdhHhOAyam$7j&Nr~;-JSkeaHC4y!nY;K_YYN+H>254CcRP
zZ#T&C`O<qlK4^F}8ed~pQFPBa$^6C@9j=1p$OGgD9tvf_!c4mZ_Wr$}coPypSYg~K
zk>#6TQF03L8nb!-RTKXObVOjxBAx)GUHD)#ibsw2<Z2}_{N8PVwy;A<60+?Q1@$KC
z*?H}Gc#<4gF4(*P>9_lBKUwsr863logpgVrZ!bp3PcVFLbukxp_srOj_oq}fKzE~x
z<#+1QbNLpT)FtB=Na;6ofTdS_u6=yN#9Lk`!4t>GO*9&G?mxy&<-|+H(#qFA%9{<w
zrA!u+EITaTNtE1`fFzx4Qt&kf#kF@hh$_Xfnp1Q>K@Eo{bK)Dg0}<n@UvSzUuf3y_
zA+kV)x*;4@{Qb9{SbhI~i>f0>=ob?e#yCB*3yusJEH0%vRS{|<H>4<78CmzkrkKzv
zclPX!c~R@nN6L1>2)U#Cm~iB9iAt%Z-!+Lq_l-i(*zk9y5u_xgt;N20*8`lGX|tr{
zk(!k=R|qUIthcz4-yD7O4*eLiCeNf4(J0l|AzIni7$;brrA9thoWm7xgdzyd?)q6A
zy#6QBT%W?H$!;5H!X~9*Qm1%K`kB~)e)ETho28?xQLA<N&rj(8LZ1$xII#8HtR7Q+
z{-;+K9>ny1yYV1k$y*}@D+7fm&IEb!87`q@3j%C_m_UzIK*53I^>@^AI&^CX39-K2
ztQeuCSeZBe_*|t-^vyOUxdJ9L#NIQ#a}=0FyO}n*<SzS|Qtykbbig4F)zB4e%H0UW
zqQ|BH)5o{x7s@Ue(;Z0-5%5j!kwl$ydIDK5@w2NIM98?5s*eTgUHcSLWdmBt5osGE
z*G&ZjAKalg=&pDs6+z1(*2YS4GRTxO)f@kh>$6F|J}Q&H=Ycbk-4V?t5vB3s%L_`(
z!C^GPQH2^XE5_nEW28t;QEw@N^ntF289jLddd4>nv|m%ePD}*1Oj35sIZdvh29Er&
zuSa+_{d1x}U1gAYz7XJi<?je@tUT-V5Q;zbXx2%=T}c+8!-hG;L{yQ5Y*(JwmP(b+
zjAOC-*aDNQgqE9uZ;4{D<pRGl25r7$1yp9=mR;}@700ZUoZVpfA*MJ{&<|;czz)`k
zt>0}1R;hgm0gD#u$~-HE|K++9)3^2PK2ykf2}~TFezpBDJ|}`WqW%E|Uuh14W0IQ8
zFsnDlw`(V1C}ZA_#m=^VR4RCAPsQNPTD4eBeM|=b)ezsIINMwLQ>;+!!Urk_sZG>H
zV?9`GB(J{2oZ)=a`mgdn?CO?6HXTwBm!|n1mfYEO4Wg))8+ms}!X@cj-C<;_o>$y3
zC_+D6Y#kPZ=4U9tU*vMDA)gJN$)yEIaN+@cNsCOxH7V5N(nm<F%5Ia@aqr#o#)1+5
zzPSbv#zx8tD4r(u1OF?L{L_qn>5J0v+YNpc|1)7vBPX4pZb<Ik#5kr%a?1xV79eFN
zU{k~`4e~_TcZOq`xs?~6B~Z{B#?FG9Vp^g%8EaIq`o?FT_3`A!KNN^S?SPA{DEk`q
zt41<e2Qg1homkY;C2jp9o-tgv`l{ZPa%;HXgjTeiL|0695gyk^#Hf(TelN_;{IwoJ
ziSN?KJ*`;sMn#rZbV4IBXF8;;Sjl)E&G{*jjGf=0o?<C@UIl(E=(BPbsZXV3N=cZ(
z%d5w<V36SHID|S&QUx9PEaKTjP4X0O8U9PUFeimi$aKF`3A3T?-+Urlths=0H5Wh<
zvDb0L)=UbSK7)>_NGfr*fB2T<z6$~Qr3dY#Md}d~jG(%%c36OLVPoL2T5&zOX5~?Y
zL5#LGzU;}AcOv=;)fq7T<Uy$W5Mzq=XIW|yg@S7hp+}>obppe8^la~P3v}#k9e3ND
zdT&AaklQT@bNfFU-3o=$9UG1U8IHp9C=}roDItBWYuz12eKy#TVwWl%L#{IiPseE;
zH(;wZJ$niKg(!v9w5Yc3ZVP4T^B?x#oPnC%W13uiS&m~#aRSOzb<$Ssc^hs|rZ6rX
z0Rr*06%}KfxVtUJAVo2~E2XUh<<_;*b!S>@`3wrUWUEMZb(6lzmrUkDSBg%*;v%3i
zGW3$KJ)v_bjsR%-1!#D%-B0RM3Zo3y73Xr*%mz=0#b|sb@?ux*07b@Ul(%LM=Dg48
z2Ccx;C%h)na&X_xEIsEFqU(iyd^@Djc)ncS@Jn<U48dU$*<QjKsEQ6&#3~%b)*cIb
z?!EuX68=pRN9%?j8`2NO@2kjO$r#2k7OdaEC;9G~Xe=>Zh{mLo;o;IiH&7_7j|@>G
zTuRs=rqePlxLT{0+9s6tC3I5exa~|B)s-6MY4krBE42sLj)>*Fg9~ehfS64(+vSNe
zCdTn-DZ51@l0>u$WbZS@iGld!X4Xhzav2UA3w=^spvs*0=O(k$-Pq!U{45;VnU$Z(
zedOr>kg7Q*)n{<0C$9CR0-pNVG7jd!*}qrX|BwhfFZ@4p5b%UsFyu5HM<I#LhGX|F
z4y@mNuM6o)d#H3;wmV=(2;xR^mjW8a7zJP4Cc!90c;zg3oL<GA;oIbTC|y(S_0cGW
zI)Ih*R5TesX%oGFr33+v36xANOwC3G)DnTz${=<RGNf-4K&G%bsW>6rX|nN=>kLZr
z%<{zwq;H5{0w(q1EZnDA$M+0}%&!(Q`JL$eTgca%%{E09%0=I4*LtqKmg#n*T0pTX
zz-H#+6bJG`__qDvpQqTa&n`nwN}P;=HY$RtVSF%^d1B_`VH_Z*uiUHG7^xRY5+8_e
z*;9#uHQ&IjesNiD8(92??n5J}BghSgYC4BZp9qv!C#Vr@48g8*1s+kAqG>Y8?C|^v
z64|gm^Ff+sBRf>Y_krayLsFw_eH3QYZ7s*&=rC*1JQSW3TB!y_*QCQu`ifD_Lo9Qn
z={;g6m?u=YL$eedVMPf*3pi0%xQ5=oLup1|)d+sac0t{3*gmO`Q_c{kAdAY+@W@r+
zOzrjOLgw&kc<|S~()1z&fDq5fOoQ3<%j|Mz%l0llr5;eAwhw}1!)DcSGf#8=h4M2o
z(*{T+sBrF2%#-K*CHEe=3#c3S007)&rYxvuzq9=o`ODuamdQSIh43*!rWg(zzd2qx
zxha2xk7@QQ8(MAyC;jGN(<+=!)phXZ^}Q$DRt0YxVibMh{erJyH<+mptwqQtw?Yxd
zN{r3m!`416D^Ji?WHv&@-S+lt(vPDy-q~=06^nUGlQB&UJL>l<2HW4#CzMxW$|4Hq
z{2X>Eb9<>6O0AyH%F&ZfW%`TesiYZA71cnNnFg@bRrq4|a4Pitel3mGmJJwz!06LH
zM?^bgj4{(4vA8X)ymgU@;FId677q6+dO+Qg$mKBcDSQMPnNj#A1G5(<kUX&BhK?jl
z%#GOh(BWV-zwm2XQqF!65i!ZbK%nbJ=H@=e67o^v5H3dP6*rWmHCvqFCG5!FJyI72
zrCXHkVhV4!t|l4_3ZCin5+nFNnj|c*2Tl_{oq`WIvsNU8({eCNvLEW!p&ZB)C(?{!
zE_3e#UMO<myUrd|i*^!(yZ+-4{i}oOKRMnUl*2eYh9;Uta0R{q@H{@+=$2}QdzECQ
zT-UHANQVwJ3zxDrzmJ5jUXY3!u1no!CndFisp(imHQeoM4NvS57u3r0VJ2XnK~>9X
zL3_-FI0l*lA=*3?iM0>`m0o?5Gzw<=-&x~A>>og<R#N6V6DW0kBz1XQ$<tn#%W@v7
zHHbdR?0r88Z|F`3(+HHQVQ*r>Viv6zNt)Xe*P)-eLDmxI_K(U~xGg)CD~X;tHl03d
z?XW*wnaAninCD3G-^9`AU-n?eE-q|ft8JY&0QpB4GN*E6OO@KL{?t#WI;;P*fSc{}
zARwAZ!^Fq(mu^HN!{Tkye_FBT0$WKEY0X$&@v6hKa>JSve_NWQep#uMxVq+Rj%53M
zAdG|G#Z%i5<W&CFOnv546o?c!sxlF78m{S5loTI%=r3D{7e8C+&S=>mV8fz79?I{f
zA518Lz-SVgpJ{|?k`g|XM#!SYzf=NFG;S&WZL}!IN{U>`EY)Zrf-9PBWm)PT+x&t*
z_xU{iMF~8Iz>oq&Vq8}34iaj+9er!Q%`1YEh}e=N2{X5WwXH!mc_)L)$*8=g<`>yI
zD45^~%wn{?{`bD!EK1+@rBNKK`FU7r*-X9_!5XgpMDHTxe_i0>B-PNX)9c^~f(g&O
z|J2cg-@rYvM8;x5op?@^NG-HwvAxA_31xAO(nzh~?j08ezQ|gZ#muB>Fe9|zjC;yL
zwkVk}agoFBc}l&eLu?@WZN+YO(-t37dGhuS7|v18p3Aij;r}QC>7mv&KY1k@8XU<B
z)OvPbTCGUo_rteetvD;+I@|^WYb_6{#%DhiKth5)!wUi3mZpH2enFox)RSooQQ)+S
zGFkL;a9_H|f$if=>L1myq@8nv<bsFN;Nbh^_;+2tcRJKwMnz`TL`)zT^uI9()nzsL
zj!SY=+*;%|TKTCmzkz~mCff1_W7B$$GEW;_HMB8pJNz!2wt|?vxW=*Ee4M632Jt(s
zqGRR~-5g5I;W7$oAKu$xSN3`cszTNO(|>m2Dwdlc*!N*7sV?<?%}xBxW6dyIZ3-V|
zr@LKqZZn>wwa2<E>JO#`$spK>ENUVAnXx=7X0H-ZaFc}SMTEDEd-E+Z!LpJSDU732
z!%$y_slcTRS#9-^&K6WqU~a!xvn<DbLoA&DFtP_0D{GNL+;m^iXRxYxZdO42tWgrs
zZUts!RUgteY-ST^4-8*`TIKCr?}mFKp=XF33c%0`FUSl}Y2-K?+SZb#9OS3mtWiUp
zji11l1<GpJ8^f^e-A`zzbPi}rUk?$HkDtq#zx*zPCw^B+#Dc+C1*MxaF5>RX>y+Xo
z@h{kD-lt@_=gsDQv9W5(9bAcrAxa|g*VtpH4sZ52VQUspauBGU4-0crk#-%`k`#|A
z?~J#t0!|yV22(eaW}-EnORR#V4(WlmrvxwKwacGm2){*tWPbozFrvPzFW)T9tf9ox
zhTNSaA9a|lj4Kj<>J!<n6Q3g2N{(B%KPC)q2cEpgGtqy_Qow-5k&%)Arg`8c<5ocu
z@i7qwnwWW;LwsJ8GR8hlX*mn;$2qNPjw6Jfp>4cz3J8_z=G8NL{T~Ps`;(X7z+v^S
z@lgYc>mRY4@-5<#njW3_2*HgPBAhv993jx|jwH;$OAJ6WZQZ2T*9UJ?a4YaYZN#Ge
zr}~h-X&lMkHGH7(_(uDpDP<myKFae&eaw#V#EM2^W+7U&NE3A&ngT8CJ;HC3B1Yx$
zH5Aw3`Yq}ucNCLU-|XEw%sJ9GZo_Cj@-N?vQ1#4$vYN4keYUSsRbdT2v^xaI#osdF
zMBY(TSHI}uR<8NUJl)=%;;S=9z$yEq)5XQ4>CExD2NL}Y?0Rxd1TRm~-eze_F0zKW
zlq+x%b1&VpH*N!XN%^cPoPU|layY}um)MF#k5(do!VKZ%)^oyc=6zV<<5%>=``yFK
zDGFZU3DI`T?O`fo-Ar_Ok!tQBw3L(`TP@6n7s}2^hCz^Hwz&VpP@1#H5|?cC6)4a+
zi)>yIp|Y3BltSc|yIZ5Ht$LDD|J|<)YG3TdDtAmq1f4JDMoml9KE%PPJGMRxP4D&D
z1!Z_E;8TY!BKYtyv1+bmpJl}V@FG(g&HMyt%E}z+vNptUR>>5%7g{8-h-V%T2m!2i
z=^C#Lz&#_#g{}`&`b?G=b#{-4RLrJQl$qn}n3by}<hY5N*a2uRumNA+qRECds|W{s
zvv)e^bGfU6^@C+_GUdN_4ZW3!^Z+J-?_?QPw4^w1EM!FNV;4C;aph|Vo=n>CLFT3F
zEf+q65UPmM)HI?rEaFP5aAg^dyFQqA&K_PTF0Cc|C+k5Kka=AScpXQ-2Gu;@208!c
zjGO2BUs2G(JXA_(H%=IP89nh5Z{_rDmeV~$TrbD%Q<xMJl0?Omf`O9LBYLl;*;YuU
zDUrT$Stg&<o9pWo-C2%Ktg~-k-lQZOGb0!osK!!Ozp#*{QtJb=9OY_)9OBhi7hL^J
z@<X5o*?sXoi+Ba@a!)%~4jGMdBW^xfr=N|zv8CH}QfN>z-cvmHzNFW-Zmf{E&&p>;
zKf(Ip#ce%p#jEhxbZW|!WSJ~a;@Lqr6_)ZF+4`r2<iAS^{zW7m^0X_%$9HNaUa8zU
z%h`)%X{ecZ$&h$niMiq;jazt5ep?C0-n!=PH<D<cAP}hXLM{x`C*~dBykO?SO70Y6
zd`~6!hs(whUmD~ywvD;rr?hkO&>;h6_}zpz%~0|f=Bp)G%ZFMb#f^c9r--M#5UqnN
zfCIHHFLU%_M)7>TTlNuQXPLNy7?TLD(nOsctl(+l^Gf}j<a=n$8}80Gr%e&7TTTqp
z^CUG#Zq}()qEhB>-Ns2dKIH6&$dkzEpy!9hytgKJc)riPp7TfsPi`DkS-5RL?Gp9!
zO=?De&UpP-pgcSkQ^(E%Z3nO*SX0>`vy))NVw}FFn1L&4tsoS7v}QsvZjCB+puM;7
zb$ACSUeh*61ZEi~P|ti@&&VGcFn{OSkX0rAVSsOW3b)LwI^R@?jJzkJ2lIxviHgzQ
zww2oXcT5LsI7|ONwn}KYUcB?G_tWt}&YvfH^tkT^k}zg>vE$a_9}lsKnL;~Iitm@-
zchjX9m1&zrNA6Q`k;D)U`Y^Q6W4+X;$jP(cASvgyNltC~S5$lAD*Ro5F;Fg%5al}B
z=%hjSh{pnx!OW504-=^;&BwXlWH9Kkb2sBrAI;xd*fS^C)RykkI^K`Tl9Q{ONJiyf
zs^&%K&SkRg#6MoJxZcYas6@c$OkNu~L23fBLcV+xD-1W>N!fSX?wX!#pa$g#prBqg
z{2Y+-c(WuO!02N>(Awc$MB}`Eo$$uZ^hj*un?7*|(CTm;?YD;`8r|FBC<sNQYOWSy
zcNk2AL3{cWe61Kt2Xnf)44Su!Mf`s0sc{n>A)Eyx@VR9Bi;He};txc{&Q6hGzNt`5
zf!d>u!+%t;N$tS@);=cDoxToXhO)DxB1aCb<UXZtq#hf!=}mb$jNyqjn6eDvhiCM;
z!;E_kk$-e?^hIq7mY{Ef=(GrUMxm->9iaDgMag^p@)8}tkc`9QnezPBLO-=6+Bw`<
zkT+(vfel^A8!y)Morv-6ITf;-%(~Nq7#-&L_fzTPOC$S52BVFG8gd+Sj-7-KrH5aB
zs-)T3bZQ6cSU|cbDHmHVlJ3~6SX8L59CWO;Nc#3o=VqR}h3%(q;ja#Fk3nq}z^zEe
zq2A4ELCOv;rxQzJco$p?<diuw^0?1mLmb;<n0GfHc0fc*+T5XR0Ey(4!}Eg)5k^&D
zp2$iGm<vkT^eJ@^Tk;r+!dQE^W-o31foUY<-Wr+H!Y3MY9uJf|OX-x4K-4qFg~-Gq
z(`B+=L^Q5#DF}bfiQ$4|jJ}{mB&Sc5&D-Jy*q1NnUaZ;BYD4OSkA*+m>H5&Rm?t}o
z<nTq@E;Z%s+m~lkQ~{B)L|T`I*ayJ3L;GfpS<g1T4blIR{%Of@CkP`G>;-7*RPHcZ
z!?`-d<hhdnTr$<+u(sPoQy%dYEtN~7K;3usSK|ni{M?KT+ZNN+(z$k9najq9VI-FV
zK8t1^yQ@a$4CN(;t%b|EyH3ZEQeFr=Ow(I6?x~7o2f{5Wa%Phgw5C1p%ziJ#fqqMp
z(HpXwZG4C%W|h-F3?0r=rK#W|smAEU%^nainGh9K7K}Gu+-@hi+lhchtd41%4XQa)
z`j|Zb7eoI#3@TLn2xtcB<(2nIr}(o7m%A4x$VwX0fq1>iz3W(N0oh1+gQmI2-JuLx
ztRnIQShSt5wJ_;Gx%Yg%y18@EvK(++gV_hYkZqHan&$E{4?ddr#+J6oTk$-32uFSz
zjFNB_eltuQSS~z8dZ}S#Z#CbC`DKsr%oStIPg_;11}2C%DNe&!UGe*rYo(<s8XYg>
zhR@bm*h_xl&P{oat{R^Rc%0uW@%J(}p7~t$`5v~;o8UXo!81zyTzF0*$39K1y#G$E
zIKmn6+X0K{yoe7MuL8*%8ooZjXJZGbF-f;)$1QXD8}IQTxR3^~Ulp$;DR5yZjpLRo
z^sWF^UZ{M4zUGi6yo<f0htsG{#o#WknnCYV__Yafh|^?s@glajHK>SW>OXCbD#12O
zNZM}Q)Ro@#TQ=tK$ox$*dz<V(ADyMPZ6__-iT9~Wwrb18-J&6C)LsE$H~QrPTvY4G
zG~~!-{g!Bqi$zk~LHU4oZfT^yzE1B)L1$_fTB%1~cJ<$DjPogD@y|6TRKUS`SMNuN
z%E6_&_N%A6I%xWP#}oji144&O*~J<9n&~C5qu|mJIa8>S2BNjwi`b+k2Bg?G+$F$_
z$`EQ`N+x1w!W`<TN{%qHv+@PMYPMd@S_d?rg$|zVXf7Ww3Y#|9Uobje>_+OMC5h2l
zU!><>;c8K!&k_X35;hh_bc`D`*Us9}+G;dU7<;fO5?J2!9)zy3VEEhCTllay(d&JW
zU$J5bpaPVFK5SufYaeveY?=ku+SiXN8Q><U<@s=ACg}u45R<o^j@K+Te`tFApPsA#
zWG?!WT$q*Q<hM&)`am!=0$*Z_kE^h9nmP$IkXjy~xB@kW!MK$RlDNp@^84E+Nbh4S
zT_RW*RL=+-8vvcFDS@};+I;am2X3KipQVoUg#4nWWuym4_Kka9h2e@4L?qFonfTf1
z=tnx<G>nv)d}tm3T8X`x^12;EKE7dsp`Os&=-8-<OmxJ-<qZg|FGGspq>@#pN>P|{
zRG!T2lN*#I-}DsBC``+w(g0~-1uQ#Ap)uFYr%iBE+n#Kt$H3JU9cId>=bO6rzvh~F
zlO*g4%}t+J39lg7rH8gQPJbi#kyMZ|)(zBjkmi~4?mqB9Gg>yX5d(lW%knxCVH%!W
z?nkp|Kbo1LZ1V14^#YC$ob?8ZuWxZ{_>blQ#!DVf7KX`eeg*?C4h|@SCe*_9sPGSX
zZaH?7dcQRD<HQ&XYDQf6fRIo|mViH3z8N~5QqQQ}qJ=?Zl$!oT_L9qobj*@38+(L>
zZK7jnP)9+)%3*@Xt;>n%hhU`5{^kN5aiNqKBcw0$p5?>84pCy7PkH}o0ndPc6Uwm%
zL|_bI92d&#Uy^3vQdNi6v{OP%h|A39DXPXGE9}x6{}K9{3s%c+C+{mk&2&}OhI<al
z_g3F0q=}fAnzus#r0DAr)EZAPY!{4H-fN3wH7Cu>QDNVW9!J|E>|dWF^Y8#5IGFlQ
zfHNoS05fjIn<j)~E^3D2!xkP|wIc-s&5~rc>Sc_ps@za?X6K2u)P`d(>)+VoV{Mu+
z9w#lsB6YJZ%9oC=+;8rdOa7|}{=wbM4JkEupvMpJ*LakGvoF6PF(gxDD@K;8Ygb+%
z)DeVWRiRbnJJ-EKm0+-8rx2{48HrK~77PAf*lUv@M0eV0(@CNCg}kmWu!eNvOB*zT
z6n5J7!(?cI8Krk_vq<l#k6IR`@>gWY9K6^VwdQwr9giyYpi7iy^;(LWh0iNzUbKMM
zs_$H8M1WUU<0Rs{NS#}~yXcgt4&1g?EB^PPu;$tfvcl)%|Lm0hi|A4FO1rtInl!n>
zI}7SbApQfihZDoHyWM$vJE-LC0Mj7g>4=WTeyha_rsgvH99P>C?Nj}7D6ohfCR7r*
zNHjahnirS~ukM1Z={YM0V+JcZ<7Jp+Y}O8WDa8rducEpfwTT82x6|Ae7o~FMNs&?d
zGIyh%q7Ftsz-=LZc8tQ-_U+s^dtD`qI4#0{W4qT=ClGmB+fEi<C~67XK8&I=9uux_
zSt|UPgq7o~RB`aiNgdPZxqbQDg0b{ue4e!>h;@yfVDt<OOHuBimRETDA}AF7&dPGz
z^tco<@^+@Wa3Zxk(oajOC-x5}0jtU^Gmwxz4inwf%ZsGOmk3_%tu$`KpYWv7FVW~;
z{T7`r6QthnlFSO@7lX0`@`6;vrYME+;HOQButb~XkoW2cHV+uKyoIm6z<~J05x4g8
z^JAH3Wh31ydh_xghKok;l$J`++2N^TriDA<N1~}rj7VGGZ$AhQ;5Ry}KrEEL=Q@((
zx3naY1`2dJFvNoU@5OMC*Zykii~nJUOI{p6hEjT{2iEF?EDGS4nc-zL?C{V<y$RfQ
zAcCJdL?7z)quTS1=s#M#W@!-r@Paf{_T=71Mhx#$QXtOZ3BO!X6aQUuv#l?3ub+>b
zeLq8zNH2Crft&i&KD(M}h?RMXtT)@aXSr8jf)1%l$AkJM0y!7XO^C{<QR*yt^g)`0
zhzWzMzF0CH3YYxJ77I>QOF!VMVVN^hOb&Et(B{)-BHWFkv_&+0r{Dq_Qc3Pekx|u2
z->3arl9Up>{(LZ=5M)nctz*XLrWXQK{j+x_`g@JSv+rW^aKP+C_JMFXc_!K~uS##!
zu;C_K*OD(ljJy+5M)kZ5XCv*`6fO*qRWPsfceh-cLN|`YYixJ>M#dK*xx9jI9{ebe
zu5SdBB`PYu*5ejT-i_G4%Ti!g<z^!0RBugMiZD+o^OpX204x@W{=PkAXS!LykCeAX
z7jw08?!4)rU_y_xt7$J}a<DyacghrJ7-I>Zqy!eGC_F$s!z200&r=?XhINIm2wl1v
zi*#vF4?o6lVwd`Tm2$fN_htESC8jy{gj%TsAM=9An*hkSH<vFr+`bx?ekXg)%EpP(
zG5ScUu+e%zsLJ;+hSk!-i1<M;d2;DKRO#5^E9NODe2{hl!0}DyE9sWv&3I%>J56E&
z9z!*=AO5W3Tl(BV;VNv0D3=%@FIp<)6k>Y)w?#y#zMhS0yY1tbd^_0RX2i~lH;#;w
zMwsfnnPBnPFKg6)n+*vol~X{H6$U5p^tbj~J6ET>OMBg}_zP9F{HrP}wrQR#vj5mH
z!>STJ0guPbh`Zq)gGl5-$gZC!vOi5V>qp^2fmmJ49j_$5%mMVg^LaH0?M%`m1nAbg
zsehMr=<_j~><_LkIXwZLQU~<mj+=A6eDjDZq*)EHT{h~~5%}dSW%U%ZoNDi9&%DIK
zuD6`SiNG&1-uK7~n?{tnl}3^G3$2nEmj$kg&h2}*`8-gO8C&QnX}ViH(4!!(X^<<?
zaW!v+KQ=v(4F*(u%oqts5Fz^?XUqLVto8igeoIDKASf5%WAJt~>j+%)?0HuG;BjA?
zg&`0*ZY9wBcFj40Mit)1g_kF5kf|oMUl%I;&YjTCHlp936Q2(E23v~l6K@B$5Ox>H
znGG4dBu~h0YN80~o>AeeL!=~gaku?Z7S!KfrohZ)cTG*E8_k12?`;I%C}$mvt9d^2
z#8x`n6O3YzvHexhe{jZ|P}Cc+|3rcA`*YAEL0I`1{wO*z+@5n(2)RwD!8WS*$Ycfh
zg+@GoMXvwjbvQce$<TOTveyHI92Rj950Jj{Hir>{g<if|SY%EfuGj!<$O(v@&~l72
znw}6u4Z|J{2|mt;wS$#9(C93K<h2L)UNRJcfbivo_~qO$b$Si%3d~ghY)Me-1Bi+q
zhF&0i_GMb5x!&EuJmR9mYmP75Q$ykP3$^2FWj7lKcq6vLBRfV3l0eqXk4gJ33Ceqq
zZD4*8t**J8_P?jvHi}v)MjInrXRtNnGc74_xF>OU=0a>$@h?ztW{c`0oBzHjPsXQz
zd4r<?zi%WB>Pg@|;?`{X;Gs5ZXU)o!jedP1Js&j)8jZvksCl{(HuW3S3~>Rdr17>3
zxg1kLD)b+w_1_H)N)glcQ})-zS)YczSjR<x?zREkQ<!tHL(Za!h;3!QB?nJYG3Sy|
z&#Tb~UOQ#R-j@nMa)Jg4X=lF=@FO2zj|^g<<Iu02OWWVl+)4L2H6rsGY1c}OyGj*O
zJNrUt#!v;!7>{{tENk$VZTOVSY;)Rz8m2$))lbTvTK?uXA3^sZFuPxgnEIdh@vr*d
z^a2-ZZf7DE-b@vlFDFCD6l1OvHzlk-(ow|_mxYFLm`DXcAQf$jBeNYxirKV}gr=<$
zdBAHQ0dU_R!{8gt^P|rvMbJII!)2@xm_-}E|ImA_*tn(-7OS$pfNBiQLx}vV2B%po
z&PZX}Uei?^q$GE&D1aGCHcaZZ*5tKV(Hzm=Z4!^Pv^lP#d_=H2cb5&H?Gqmt1)^<-
zSsTo$Hw{rwt8>^7KbYynDrZQqYs&rzv1sFl{sc)4V<9<~ean4U_FSwyJ^atbN;7UG
z$```&&7!t9Z7M1QOS~0%$pRYkjajERKUJ+}QN+H-P08?=gkH)l@}O*Q<9b)%n3m!f
znKZv8X*JNLK3ym_#Ap}_pUQ4&C|;U(olmOGc9OSZN=DhklW{WIgr6>M<Qq!%&_+>u
zU-XNv=UbJ9*Fby6oNkWXJI4>LPDHI!Y6Rj6Ccp3uS`lIN!=991!nLID%3T-5YnscB
zsmHY`<F;4Ry$;l{6C-hbt;H)A!JU|Ab1Mw5B{qYer?z=d#c=P;Up5TFKH;)5=OH1T
za`!A1U>8je;)`<0MNXH;DEg&v^NFpEkHJlyr1YKupA`ZA5Dh*Oi)G9GX0|O}0qq(d
z-SG~2GyDq+rG=Z}H0Ru;_JH;DJ-`~i#1(4a6)YHY!~Nn#-Za4W?)NF2V6U;mFROg@
z96v%S5+yINm=j#Y!tqxRoT-)*_%THA2Ok>T(%7YvET^#Z*EXbZwFpYmeHA`|qQ+aL
z>nAj)^K3y6-?Ys9?{=ReVt>~U@BE7(nvKZR?UoX?K+&ubXq{B#GppT4Fd(H+CU67@
zAfV=L52>mX+AJt;mrS1n)t3lp9SJe>$&eLNqZ;%V!F@@oHhMC8tNGTPh59DbBOwWv
z@@tVPLiO*E^@xevAnzjquERA7^rP{|p!Md&VF}hxMn)rOfABmF3oK`%mX}mzi!9w5
zX`9|U#IyFo<&5M+!|Mx<Ubnu9H|>mBp9#z`?XjCWma;p=WW5?L$#U&|enVFN3#~R2
z?j&&=)m@<tdti4(Cv;3q^ywnx4(t*rHHItdPO+e6M=Z2QMJqtl<8cWH&*)FoJg6v(
zSB2z<KNp@_1nl!b7W+QAped1YXI!YRg-Q!JD-%aL^zsCmkfr`4b%em>gla>Es3Y7l
z1)89TA9WYsW!o20J?#j{R{#dDhHlLv%l9WM2k)fs9=bCMQtusc#1Czkv|H1<r8=4P
zMnb@HUwIoXnFYV<eT9ld|2EAS6hKzXu7Ca!|357OP6Q=sq$L4IsdE_&YQyo&DOzpL
zOO{E%^run7bLp#VmPf2ieMv5GqBnh>B~%vAfxe?8vsls5BCX#8#t%erv_i%ht?7@$
zlwFNtZFNicQ+~m-^x{LuSTIVAV}c&kdNrm)g9ock<6v^4+Yy4Zoz-ZsI9Tc!OsD1k
zFm%f6h4{fp>PX)rw{@2<k&X!7!`HY$G8H9HYOSD}#WTgRI}C@4?MpcppEIPG$aX?j
zXDHZyKZd2A)O}ZhwDEh6)g$*uI@F&zub<s>|34w7w?r~+Ls02s-)^5ePv#QrM8R-r
zN;YNc8o^+UF{@_M)_}kKvZ}qNo(D0-Raa-EAQTOwoEIh``$vHYhm_U_Iw}nJFb(P;
zoPm2~zO-|w&L~BehNw^9I1fSnW7^$*jp<*C&Y#q!&(Z#QsmFIK^B@ngEcEevv9ViP
z4BiCvfm}@G!yVV`WU05t^ee*jd*>)TaERX9WmuUPIL(Qh4naLLcn(XPsV96Fk6XS}
z*__OO6LoB?j3Vsac+U@{czE&$=Xm2cc4p5f=KSfzls>^zwh%sXklcwXtBI%)xXY))
znw9VvTNPyvDADAB0nWceM~V7T-Rb?03ygB;;pr$*DI)p$##6<>oqI{ccC#^DhT2h6
zfiBp%@|*syOlQp>8EjzXr!89pp;e<kpL2{aqmmvxm@(obZCtyF;52!)X{BhyudB8Y
z(4u(=AWcHq!^;F-j!UhJ?%v0W_;aOw#OTHSA%=g{*E(c^zepnTPl<-oWMm89BQvDj
zPfbuO8HiVL1tbJ`)vuz9Mnlgnj<6|+wu})DqYj^a!{`6ImtmNW;rP~9+v6q<*W8Ig
zL*Z(pE(xw!w*ZWSav>ENI+@|TXtV)%34|t#4+@5FLwVn!*zF#U_Yo2WzmzFXC!CpP
zQi<g=%5INI>0@!?_(f!_<^UfjS~RcJSN%PF>!cHhEOa^91;OQD4zCL_Qd2(EZaURv
zwV&Ntl26^`>Ohn>;ayl5wat>;XGfkvoh>b-4(D-it;*ZN!(m$?8u|sh-)H;kH!|DX
zK4<8Hn_EdfY4=cq^5+`hX^ra3zuI_nJ1*wS5bXx8Ra~2!+pXXtBQ=?NB&vD<Qt6MK
zK7MXKA{hYD2AQ7}G&aA=7Ea<WwrRhf{`x;Hz|j%)#n|!$D5$WPRg9DN^M$gv11JQ~
z5Jpdq3w{tHQ}ghIj1?rnZ`%uvRV-=02tw#+VN(5l=iMMxf@j_t`|8`8Gf*(6NvPy2
zSAF@$^cKGgVuN3!_3MXj(NMJnxe4`jMcdyJ?%b)H7a<p!T%m8;Uat%y{b}+EdLHim
zH!+_gt_W<8Ym=eOrv9}VQ>8`=UGDXj2`mwOO9-jvdR?D6O2q`z$YoT}-J_M1f;jWW
zU-~e-bmHcwEiUWID-=T~1$<%@i9I1a@t~ABDh3Z7vvtN;;!iH5X07<t=A@bmI1}p;
znMb9`eC|aS1vK4Q=|p>aBa>YDSp0%(j>>T2A|lB+FKSL6oU7H`NM4#+zndXPn{e*w
zFDkWU{!~ekdulD%+wq<u#`3u%7WsE58K8wA!E2<BczFpKc@6BdBW@oNP}`Nw#XIIW
zQ6C~eZ^F^8#6|Qn5DOgYN74QXS6>pm0aotwR`O(P-lfKX6PCQg3l$H>wNds3zsn|l
z;W`*StTWG-ToI~;hqs4C6P6KrRjoUQDzxp3dad4rIy5S(r?kL}JWO1bovI<as9)2W
z#EZa1Qf#>y7d@3B0Tr<f(Q8=yUZgale!iGzv~mFcabhXJTwmW;D)1(L(@VM9gR>g*
z@zn69q5G%s%>R*9{sOF(Zz&?xK?+G&F3V8hpyJBNKyHp65oK8JX%93GfY1$H6{o*@
z2q^xR%j#X=g+eB+;;?z0F^e0kQ~zD(<OU(^%W(`Z`jN>e7~{F02S{;ycbf@A3FbDE
z+&oM&Uh!!LnX0G^&fKs+v)hz6L;da$y=Iz}IGGMkQp(W=lX5e)_d6-!2`P6Gd!+|U
zU@?{M=Qd6<Svi25wLd!i0dQ_$ow4-Gg7|>2d61h~*Zp^(dw!c^a{t3nRXc{#`~YEU
zyY6e3dhvl9v3F*}(8tc_I_#g`_z6CUM3zLLjM~!t_5-~j;+I{%BP-^QekNQJ!=nU-
zh5#~!N7YCGgPfYcw77{bZEa^0^`@<B-W8iDsg_KiO=q4H8txK2l>>LBjhW=A7P}1<
zk?L3`PcV#oco5BqI8H8X%a<8gYQ?o=Da@t#F;r}``D?7F-Bc<Fz1(QdWbSn>C#u2T
zNYVvw>8BAGf3Zfs!RFLkrCD1ILD#Xo7WHJaN8KUo0{UUNTNmpDnR{%<2->>$8<@~A
zM);mpUmcKVnp|n4npui;;y-xXC#R|X^G>yPW<P})Mn$mrrB7;5GLb^#9zhITtF$3$
zoGylxo+X;)R5vlTh;q8e5Ch$iw4Il$3F+x4&>d<HSG8uG0hfySea7C9akvUN<1(xn
zQD%&cN&%MoMfU*XBY{HqD{RxjFJ;NeJ1dk8*3uV9D`7R-7+f^kBiV^9xE3v%sC*MB
zv&6l%l%LWNQhprZ(hSF6QeC@i>hUdip}+JSqW;Do+l*Ba^U;US*hW4xuZ%VbTq>v~
z_*QM+mW@k0;yZmj=bv-RkDCw2e-n6rtqcEbywq|qCU#g1>)P1+-r--Exr7^6%>_^L
zI=gf3T~wgQm&aD`7276OnV1|Vk_L;^Q{qf@Due*PL%4ce#M@mx>C{WB9FW_gt()FY
z%FS0Ra6TvzASADmAXCGVh*+>1<I`H%$HT5cqd?b9;qcPQ4f#V@y6p)=7gm*=u~(6T
zg;69AF0WdlnmX;9?(?kKI-HWOnuC*yBqX{$`fcRGfRWhvZob#q*GVGu-X!6M66eS{
zQ)(p7=jm^Q_D^;LZvCo6za1kxVkRhGHaE6Qc9W0Dn#ZoOUMYjOz|7E;_q7iPfa%zF
zB+|)KV&pJ){%cw_{CM4d$||xY|7<Ox8tNHAC)%*deE2L<w@F;k;=4Dyiu6--XMoZA
z$gMTqeuo<Q%0D1l`|jq#g1I!rJ>#p9H;!xwV?;}&dTBKRD#}$gOXE4!<=HQI>`~nP
z*d2CzhCU-WB*ht$>WA%A|9?DPWk3^L+ZL1-P&%bsx?4h0Kw4V5yIZ=uq`PBu!=xJ|
zMt67jV0=@b_xrmaJ3D80UDsWT?bA{{bufz4-{l(|$NysGzqK)cxO@y2@9x&LPNkDi
zaT9Yh2}Q4kW0qg34+XHfEZzr=j@ea6ybs|x*wjaefejkUw$p?ZRS4wzUc!=U+Do#q
zGoXq>LLCIS7T=Lk`=%8rH$E7XpNdD5=pd}_%tsNZvPJ2CS05_lyY8zbwcTQ8B`}?w
z@igloy+6%EtO66I>@7igVdlZ*j$rQhe6Xx{xz8NLGG+Y(nYS)9VFBH;GA&A6Q)ISy
z(#!Yrk&8JDE*oF%mslo11<etDjJ<zHy(~g=VgGgq?X}h|!-dm%eVM?kPF359MNj5o
zQX|7;q8ON+b4XoE9biGcbpmP*B4<V#!>iN9YicZnGBQM6+qHdJevBDR{KoQb3PC%#
zQcKs6#@WBGk*mfI=3Rdm-g5HECmtWEIJ^U$8rrfqKj>QJRz%^%KUJdm6Mf8Fi(dXs
zZ%VfNLzEmc`J36AD_55-JFlXZ)|x8!%d$LJ2m{CHecgAAL%29syDt7@bRN_(BBRvW
zfIy6u;TID-4x_+g-2(q@xykUZA4-3FxfuSp;b~G7k5h@^du)h}R^kQz1c}&YTocd6
zbc+_;yu=5cl9c6F9G0hLL~3TaFb&;Oq4+j=8ohHtZVYfnIXD_x`5dp;@!Bb-k;C4n
zeJO0=6E?sk(qAp8C0&s_tE$N^|BWB80VzlkO04E9LB*(PVJMZAT8Vs4KQ@Hj{;tyx
z$!lnaC*(KUljLM+h=W^s(MM=7)T%L-^z%&S4Mq}4;dF-%;Yl^<cI11HCv6%h5N8Cz
z6V8K-CKIFH&WMRgGj-{2Airy4g8ZdoaiRH%e@lmr&f&OauSpkSCBynYQ(meZClP;n
zS0AwYD&te|lU;Q(M~K7SM*?|N=h*(SH+Nx(0yQOJaA6eAuiW(Qyoth-fnG)B&bA-M
z2+XW+h$~GD(r0jT;oz#PFs9#*yef_y+m6ugdexc!DWzoBP`44jDM?MLNWUcfdx*$Q
z;1#QkAuq);UOw(G`FViINw66Ye@nk(EIM)^`wA#gsGF2mRmP|~L!nqz2pjvZUFJC=
z4v9aMNi(T^p2oIFjBEp51ZZ#o2V(fQ<s#*Ob2+pzOp{y?1`z{_b-~Vyl>PosKN-|x
zCRwbJjU5HRZhV;&ZrvuE^EoYe=r-H%so!x6EEI_(ud8ZdQ4wwdL_?vk-W**=nVEfx
z&8d1lPoIGgU7f~Nl8ThMUKmqC`*lQA$^ShFA#IGf_NQv7n#S7|Qf~I`Q0)Rfskf+d
zhWL()iBsR&e|r<gh@_c2P$%!MV}>!hirtCYQ->p7e)&0`3-jyZb*t+5b51$mNHzn*
z8)O2hL?=4zWoC<#$ox-Vi+7z-<M=QB&Wp3n_^;2&G~#vYC7l4#N43}-8q^$#G#HhV
z6z{^r9tx{%LopW>c<aI%PU}KN(1=PYBa<I-*_-c@;CkF<Djnsl9z2;~EG2p^>4I3%
zv696c-ryzbDo#AKXGL82n=q+&Z$}S?KVbjhrVuYR)XJ0d@o8G&h|--wG}9X!a*{H`
zku<;WDnT0opna*IlPgF(NEI>CG4Vc?7s3KaZCZ$XZwaCY@@o=B-r<okTcJVd({wqO
z{vy!F{|tifC!@C#Ho05PEiMM3<YMD2+?&o>``0grnj7W#2b7_a33mJKTYf-JTFy`J
zBEwavf5jr@I$TtVh)bVzC0Wfdn8g@lX&*#@0^JWuh@yCY;tZjm`;r1{QKp_%1SJS0
zA}SI?ONR)8z7HChg(e&ENxU-4WkefwEG{28VXN<bN5jKXrrfld_p=?(edE9;Z9k`0
zVFUgFN}LC0hg(zf5oTQ9?-y3raVJTX?IlUH?t#?D{?}IWy(DnRHU56bUO-=bQ;xd+
z8{;P$*e|_u3$VQwZ%0-G1IT~u66$W<T3^KtzKQeW`~6E!LnUla2-p3<;JY@QMtg_{
zoR<C@x5DKiBMx^M*;rwoQq;DFmsHWYUxnCrG}8Oqw;9oRU9m#>$(p$?HgFUBPW}$9
zw+J1RWN*<^(&9W|!~#V*h;ihw2rCBpb!d}*4v#!{Ct-S(e?GsMCLPCQyTHmsK|~on
zRHM|ru*j#L@Z{ZK{F~JO{{?lE{(GyRBLz0hhhu+6N**CLiQ(oX`8j`xd@629nz;1%
z`Tm{Bwslu!UPMt2pJ~_v4uO#dlrtET*v=&0GUFGlzo&DJk5<C(o+l4j&)<eV0avtK
z#v8ic&Y=09&>c<LCTo?0w7%n^ZWYL(=LxuetZ=Va1&OcRIc23$xR}KR5is~<epw?s
z;sYj?%=k{$<OIfl_L8Br*18*lUM+n}+W20!>2!cf3MMY~xh&9M+*uZX#%(Du*0Szp
zD%6Vln<D<lina9#X?}V$iro8_H%ttoxWkh7uyC-hjeutxV+(69nYVo-6%(t4hnJf;
z{+)m$d>1XsjtpTva><T5{Tro&|8~yhIqHq}l|($pJLv(J-dNp1+RhHkoq{tLxYe<M
z(f4wL@o!7v!n0DbMI^@9mGQny)g}(Ta{mEnYi0_bY<@3M?Ew1{h`ki(P;Sk@*gM14
zPC72f0pSP?nZoC_iIznvYhj-gT%2KEdWDATCxIf>kqCP!O23|CvkiNy58dtH>><Cc
z^U4B!-=9_o@9!ja_5V#$&!^gekJEdF6kp&!5@<q0gQSc_SmQ;A7xcwrRG*c4Bfll_
z_j|GaQL=3;qCFwyK-P7h1v0zQ`ReV@h6Ii7lxk)=S?(|h0`tJsY`ifPE}M8CGPj8l
z6XfSW2346ZtsJKxAZD@5ptZmqXAlP}f#@<d&bRoV=A^$Qdq90H9zn+_L?R(&lZ(Qu
zMEf70>H8>0(68Fs744gE86>Wei}~8yl)FkuQu#yuRsOq7IylZ|Y;zFb<szp-A6T-#
z8`Ne0){*GY$0QFSu(uGAbj+gwx6N)B6)>okPJ2o3<@5CUM?0!l&EtAg>FKZM;YApy
z9A$GDL=o|1zp;@q4}Rzp{>jY3PL;>VkIsgN^ojWjk&<8aHKxxz$A<8Q5bi_JmwmX;
z&XLIm#KUzw@+_m%n{De_`MrZY3m&D%&?$}iIg0f!wwr_RHQ448>=f&H8y35a(sZA!
zW<4g}DE4miCtIJM*1F;DrV+gIu>~2d#5#R6%lbrB6EOZhTOw=aZwC<6ne54E@qA!>
znSObB!Sz54>FOOGu&jV{hEb!w{H*o^n(e+q=UKuc_sxXO^%m`#vWHFu!!I(=g%=^r
z`w~b6!!{oe0}@#e&(=^)pd6BF|6#4$vDIY#QPBT?TtIacneIY1nrfVYtGqR&g+K3?
zpwA#d@`eysQTiu_TUsO**Ev){_)Ij-sG(+<4iy=^WJ8ua(q*)&*8Y3!EACK=%12=<
zxBK=yYU$3pV9?JRK34H_7Ng$^)k$^80c6@uhO}9)-YEK^{H2$c{v%}bcYL4MAlzQ(
zC%>sj@%61=P-v?iY|jEV1^w-{4U8WJ&|r1sNQ>9ppek%WWrR=bdpsj(@;U1~9Ywbs
zhH0NgDWy)5`ywjhb`_e{udE#>L*#PM@;DG%{RQ+aV+Jv&dG%=bxZV1n?EOCIY)^)6
z3bui+h+fr3m4`WjbLdc?BZx?pJb)_?6XE*C6nxkaVVup~_?Kk)Q}z0nWO-tKxq7+e
zX5S$E=#2t+*_dO1$4<QHK@o+)62>`D^Rve#b$1onOap#?-cot73x5td)t-D&pwUIk
z67B#$6;ap=UKEba>778f{7O}_2F!i&{J;t%Hg&B#f8XNI{+n9pE{y!0>1nM-F<)1I
zo)}-+x@Zy_H|!lrG8-_f(B#_;s$<Bs#_lX3P8*FeN{188C|dMYX$v5K!>6q~Mqw^N
z?^W~hl#9yo5|z!Pxw`G#B&$+={%NyzfnTe$S<^;=WdZnoo5JPhoVk6=uW?8g_Jim3
z3dNtU*(C4(H8XAPM0>;0{$TMHByrfI0*|s2pcvEcuh{PBd@%P`<46HoTeW{^O~g}o
z38jBFo9sZ946_gDiF5=zF-e^IEAF}5vm8A89n!7doxs^LvviQ1adm<ZJqZtstz?&@
zU&36j#s^2d>3hpDu8%lR=iqg;=C6>UE6tuqpgD$?Kiw=i@t8gvT|BD?Yv)Z(=sH#c
z%syLy7>{<id|W=96qok;W}zhnGI5Xoe$#oq49;b+)9=a=k{E@cd@}4b)9fYB`n`%>
zouNI&D$cL2`JZ0!vR&1)Ij$SN`%0FdAplx~WJqOBmYrd-x2gRtT>h{*dtGO#>WmYA
z|LJy#IX~pf9O9TuQ@qte9h9hhFcrxgBPyGL<zx5@@Y+>xK(+SzX0$sqNmD~>G)b?F
zq~ezwc^F%ld|d?X{(foSxnxglT8?N<#7EnzR;~v#Fky}tjDoM={VA5>c6C#+iH`m3
z<kjJ24RkF!6v7uv0qvd$YbQ6>**F*;PeSfWf@P~n{3;+DiNZvY+^fs?+Gi)d;)gH(
z5qD)2y3ruSURhRGSZ@k38twj_-n!VBK_<QD%2DqzjXLjGgP~Jb)V<rdciF{pkDVm<
zKn3Wa$N?llz%l=>>WCq<pbmm`(WEWm%Y1x*>h9jM{p7~FudDw{NO;1QH=#oh`30Wz
zDMsx`_A@|Icestu_xZM52;zF&?y=8ZtA{|pD&nKvkoc0DtP{F}ApBL8@&VoMF*w_X
zlOovq>}W-%WDg`XbyX(c<^%SJMqBToWuYM`+2<50S{vFyus2)5WigQ({%N*|yNWci
z`i3CMpA=Y1ob5Cb;4iK>17i@eQFZ;5U0s^vRaM0dNwk}uX3jNQnqx2G^5zeHLq1?g
zQ6Z$Pwyc*gko{z5x+_8ieoO4=xIwj5-_&jW{k1E4aw7BJvYWZZ<25Kp8uPb)I8g+D
z0UeVg)_%YKyz?D7F5;@<G(;_(H90GH-4$FT6N0$Y#d#ViKJjw9(vRJKym?*7`cOFb
z=(v-fG_?P*yGjy`C4iI5Ab%OP{-jW|UPr{;9)e}BHdt;e=)pcSg|6k<A5>+%FTixc
ze}3w?TCvw&Ix!D=5KPSdGbq|aYc^#RYQUwTZNXY^+GVSgvnKf6lP>)3z?{p3ux%9c
z;5*296A*D-NVtvAZY?(_f)dVoaLJ!bM;xXh=RBOv=B$LY)rEma$=&MgMs}KuMEv`j
zM&42lW1qdpG3KqA9(_G|rhVnNV&Gd=Kug?hbHh0gf8dr4I6j}s6nASe?D@!h;V*Of
zLIM@_m^dhN+-Q|1{v@CuVw8V=&`uql5X!)e{s0@8XTO(!Y%8?#W=W`*!Lfi)r$i3T
z0HT?!=QM(lxX{j8h273Lf_(bK4nZ{E@-P0l8$iIoSzpJYCo9m|d(oywoFRkgA>Vh;
zi4+*m*4`-Ev~Xf2UE0<3XoY)x2g#^Ba5okNbb3NNaKxZ214$e)+%1W`3y^F?_HdJD
zgAP3dHzV}nLrvzpb==*bH~kDHa4){n7<T-u$IRucfws1i>xENpE!WDWbJWjG>}!@W
z-M1-g3Y-msb6S!o<ZF?uC`Een)yUq~iY>6wSGvQ0SS6V~?}0xS7Mfmm9ZY)L&&hLg
z(ujf};7uFsP+RZK5@@(r$ZdEELT-<6@LdZK&WF1j_F#q#oMof*!zcOD$9)HKVFLB@
zI?N3qp3ghcMYgG_E3}!wL<?VmOZnlP=a>D%IhQ}F(j-&CKUe!RY3;y)9T$h>(u>W~
zb9AI`4_ExY`ow>Uf7{19*je7o;-_t=<A*!`j)ne(JG+}9XU}bv$53;1xSQfBT|gVh
zUf*YQCdlHp>&%(U!BLpcbHizmtkxOwby<>X|7z~mjezP-Q~YZ7!qs8Nb$e^}-TnV6
ze@9R%#JwZf-LGJ%d~*nVf&ihYUpkpre|=~E>Gq3*xqZX=9sE7G?Oi=L=>`PmPA|r`
zM4A10y%YDUjKsRrGCc36`r=&?szV*nd<k-QgX_!7o}$*Oho-t<Yv<B)>77J<rn<~-
z{5h#o!CiRm4dUMnank>$FqyRo4cik{nm&t)8O25`Osti2&aAz{^y@-D+*opqkbG)y
zm7l*sq^I}mUdSP&&CI+yN<E_w<<q-Y<#CEs)PJb`z1x^uY*H4jLq7kG%vU4EZUCTe
zceDOGL(4Hp$G-kMAJfR|H5?y{wyWf0t`7|FSNA-lkBU<W{y@CV1wAM;pG6047cy%R
z5X6;HpLj%#I-l=ikTF_NlbgGn+h_3<L#?hF6Zc?pyYlC(nbZJktB5Wi^(ZW6S>!|d
z1u~<#a$tRl(L4uO4SicfNG|6seQTum;|lHP^j`X8qsVqHC)r;3=6wuHi-+sPmKKhz
z!wdtN9tQxZZS3l6z`uD7Xbt(lrlpC&C?ajS-?-vxF5AzsS7O@o-=%T=@09k4*G^&-
zoV;i^ArYgwie^sIazBAOEJZWJ`lv!aK-$U?W>c|cv~Dnb%O+Z}B%QtAG&;e$+G<E$
z9llQ~*Q(yZZE0B(@V+#owivvtTikn7_J_TLT#pEI{de@4ly)`x#4`j!(z{07(&lE1
zbDXmH@^#u%C8`NwtB}fdKFYO{6U@Kj`Qlv(f8G?NEo58eMoSOOzC}8{Pgq0mL_0)S
z^ys*B3^i!yzxFskSzntta=+QQzu4M469fq9JiVO$NfAP|N|-`j&DibA*YQKoDnzNf
zn1ZBwy8#}Ip5nuEcGcjk3;WJDJUk{PL612G_~<tI!^tE&e0W0d;o>#vroR?H`D&J_
z@0T5~-<>ZkvDv3X>Fg`QnNS~D7@ehVyQ7x|b<Te*R{MSW>pT?hd}HLERb8e>1={EA
zceD@+d~tR_)RPw*Q|!Y7aEnNG>6_>CI+%p{#*z1;5GDnU@9i$cA+Oc6vj=HaBmaeR
zK(zOchA3_K*VSCQyIjJ7t<VX;HbGN!qWn(vuHB<$7*Yz=B}%C48W=$d+c0F5bk>(V
zR<==}51R7wky>G5fO#0uTfFjz_d)d*W&%2t{$}<y2*g%#WiZdp2C52~o^3q_yoH8)
z0wcA;!(k!8K_T`ftsV5t(V(|hrsnx>j8m?AO~HKRkIx<=-hxW<B)oMl424gTO(m@!
zQbeFXY2~0`uetwrIX`J_s)vp#48*emg`6R<^1aLG)Z0AoWZtjw6EQ^qUrl$iFzws>
zwU*77ujiw_z>t)|*$3w8H6-hKZk~-qZz;Ds%7GuqPAfl&XU&MUyTp1cW%a6S4)@qs
zGL4tn&YpqOMl5sfPZEgpeLyjD8=+0Ez&%iB)gB1=zgCEs<X-vL$9wU<Ud_FpU}EEO
z1LTvt+^w|{G6O#K+m%ma^0fhO&z5ve1W&8MukT!V_cYs{9hV7=2{QpJULm89)2mG5
zff0nZXGk~S8Mc;wIf}J+K&PHXy97u_w$*?|0f=eu`@D`|&%Gq!?m0<@`*$3lz|l^R
zFvoxLY&$4{u$1El-wxEhM8di2ntNvL`ldVKv%_?8d7KW6G6fh2V>zkld~*8rdqjf-
zrI~y0s_TBF#nz$&dzU0So5WIaXJaus^hM3kirh^TuvVj&NzvBjx5upip1G-UFKPVH
z-8st`oZ)K^wcx5y3%(W$^wW6~ZhksZ<Zi1Q!;LsXnBEC8e`Fx!6<)<l0)AhWB{Sf-
zxXti%enAb;J$i~5^9pD<DToKmt!cT@<wxJ&94+;`&kv*@%~5x5)Lt}>9vPomKt|4d
z!7WgL!QiQWrRVdqH1YE1#BYDyA+D^M;62HQIw0^4nCk&J+Is@#h3Ra8>(5t(LEgIV
zb`5uCuB>~ymW6xZn0L3c$&ki&w>DR^_jG8VZ?ARKdPd;MmNu<jIvf>WKG3u$@h_4j
zTeqp)Ots*qKs=$&msxmgF-!er|3CC4Or9(3VRoeKMa@=>bY<*Ve0M3+z5ER7I|8J5
zNijUle)C=;g|-1*IKY0re{!+b!*=(dZD3?>ycQKPNF?DjK-#gSLf9R6*egi7a8Ols
z(>r^&$Ahyce7o)u@(a<{D@?Sy`N(hNoS@vmn|ozMSP)=yQcmuvdr}MW`_E<his_p5
zU(gBZ!myQ0UqjVWPH=o`%?-5Gs`g9o@Y=Qd+nnxs0*S4Nzb$h`%-q(TN5>*bO&EDc
z$C-D3=ZMqAc=L>#%A<cR-|3w4GxMjW1jP^5$bOBlkG*Y+51MYZ>Af^Y?JLV5ygqNq
zedcxaJ9OKa-Dv(GFF}w0dF#tomE$qGJM;l;`&_vj=vZe3`%gGows#$f=W2%ybn|X>
zkf|X0yFzyEM80ohNFRM(yXcH0#o9Bj8`mkssW87P=X%aPu^Cv+X_8o8f$^P0!Q14y
zxM~)2sZcye=exB~7S_6~a+mz_OQ*fR;19fH{$C+N>+;8%Cey>#V4*4+ZIWNpX~!RM
zd4P4eEQ6>3Q`R|!Y{Y5)kG%TxYuc(`$-A*EoK+^Cs$`DGo9udzzQS(|-JcLfoiGaM
zkh-GpGd`Wi{Jw>7YZLueyx4W(QhfE;LfL@)&hulmz&PSdPhb1epL=&;-JC(e#~<4L
z2@`|nR>!A#gZiSe|9@NnTU^Y!hsY2G!HLC4r_WRQdskeyXMKwMbdoh}N3Vr8=@mfR
z(k}pTV98P*PUWj5bFpsoiu-T9qh<i%(@Y1jwk<ZfZAB4dhh7+$QNmmdTaTXOf|$jV
zv81y%y=dhE_$Mx|{j+`~Cf;Y`o_m`ybb*lm7B=bhuDVtM?r17K^8uvvAe7Jr-z+>V
z>3=Qb_M$mEf}On+6GpIFmd;)LoFeu3LaU_iQ;&|kg<7{f|B~9<0(|ySbq9FdHLp9|
z+<cuVSD3mwH2<%Y<0Tv`F4Uu9`E-IoAX8oM*hl=?rmnsTV=m-T@Jna&m)G-zchuP_
z+wPFtxfF??zzwFudr<c{PaU6&`8;99vsHh?bfjeyydUce>eN$%*NfX`E?O!Moy{GC
zE_3aYi&ir(uIW?jdHlgbjLAbfM&;ifG2#D{aq%aMdgl+V`M4kR2+^wMiCqJ((mizT
z`8VNRnj2;K?}r~iw#`bD-+i(=7`Qx7MkbM(D(N>Z^kWzz`y>rriK_~|coy{N8x&?w
zLg#7^)0bo=3a^f=CwIZ|&ojpMx=J2*n`ogU9qStQ=0P(OD?gO&|ITdI`CGfkO!N|r
zxPwRtCp>5Rn^}9~8|<A4d)bI2khq4yD{zH&GU%`mZtV2->nqU0RC9`5%jlW274V9I
zmXP<t{u@5I9@a!IZC>)_L*c3H^IZ8_qDoq|Of&%(K(XVkSUaIPkv+q{u)eU(R-=Lt
zbE9&)N&>ylhGW5}zr_;VPz%oRCnQ^VM~Tz5H@gNqif$@!egoU^d6wx_UW}q--VbBR
z^QDn3qNWLblFWq*k9~|%pT1>(OW~!*s@VJ=3BjMSs#jhe$l*7c{9rjsUub~gt8dCz
zI<a;8w(R;UtS%>|=)PF(OzmD{*2aj+t{yY5P<BhHm#KOWG$0DC{_BC7yAo)ilE33m
zy4QmRj$5Mazr{SXzm)PEFomph-A0%{w0`+Cx5|7Q6MO5h!Rfk9cpnK?@UcCIKfPb?
z_HLr+%chhZvSoCuOPU9jc>zDCD006HTG|fu2tU<#-N6og);#&L<L2^+Q}Qn5GJg-G
zAwR(YE`t93e|jT*C3F=fcwLyj?$n?|G`5$Ye~5#n+GjnRiXPM9Y}?vp3(Zc3c8+zn
zR=p!85SUbf4@1IP_t21p>;A2aYpW;4@z;u`gxi%CMeAL{lG?RC?hp7>x<lqFmZg)=
zoDvsfD_))jdm!1X)u)-OLx;^mgqJfY<ov7O?3YYGPvHh3xBHznR=Uqc_QDT{d|)wb
zTeLv%UVl4#p{|0Pn8BSbVzjF#%DwGK1d!<J`7W!IPXW~vFaimHv=oZg;(FW7U^D@;
zuO~-9oTSZPeK$J?Kkapv{;fz(DSzqsPtGMrsH{#{#B`&doAx5hw?>5uhk0QPvfF(-
zlU;DYxiE9z+W85$HZc94p8J?t2qZ6i#k!tElFnUyT}4^>uTy*ZyPt~OH)p+oNl4|L
z8bPy}rnb>$fW>XisSjFh%(u%~H=fLF5H=fiJ%#s;o>1sRbn1Q+1QqhQzvPkPduBD)
zKJ+)$B<mhQ1z!}kKda{6o6k8UN|U>IC!Zm1;3`*kpb`L8VR9Pg&=!NkFSlT0boeA!
zqP5a(#fLUO%M!oFblFgnEO~L(j&>y1l{i#tpS=bl))6{<TQfW_<#`G`C0ZZM<ZD{x
zkJFS3tqa%kEZYD_bf_NP*iJA&1LVU0$3k?U<`oq^=Yp5=vFCi9G};-H_0<gY)3<b*
zi8n-~b`ZW3j~NX6;d(f`cIs7BTMQI2e*jSdtm(PFeX#3)ZI2VU8{Bbl*7p8BV&a~b
zbMQ>t@CMdADBE6aw>f_9RU2cihyPArAEdVT40h6otA^wHqVKp8t<$13OT8@&%K1d>
z{@3k3iII)=04AA;<pVl|CKQ4&J^hmE@MM3`zQu?nDqa=^e-^vlNGAy8?g;hdc_gkn
zy+j^q-^`lm($n-H`=RbG*=TOWwCSeuE~T3p^#OCSYo~o>9ft(=q`S%TMHC{cp0<*#
zkz8A|1@5f2*)Ob7KXAXP%7KO%>rlP>Q`Id@IdFwFN0CmE^~rPN-I<1_?vv<yl*URI
z*LLCUxlxfq>Q&~iZ3!xMK%)De4W6z`p2t&4VNK0%U_N93B5{Zazx*e482-Ds=iCJ!
zhAU=r_WIy8o9(lY*Pp&K7hYBU4){GV;BmJwM<EDU&4Q``v_$4Fo%j+v<Jfo*1B}4|
zGr)H+&+5JB+H{$cC5)aXhbZ?kH=lc`+Ekw-*>ag2ZO=KbCWCW-G1zuscLMnE5(oBB
zd71DYrI%MZz%epKoj@l(h{~j;A0QueMehrZ7N2*rp&o1^5$eHcdI8z!`(dbl*iR5H
zq8O4VvD}CA{^!jAmCTCn34#~dwzIvC&2C1Y4hQ7+TPn!w)wS^p*OT+6s4zE_uqIK4
zkH3T?uWu%fkS-wVz=q$#uAIk3M3A17YOw!Qmb%Nsfln{QOMar9{^E~AON9#iOJMKO
zo;m_+UhlDZt97fucndqVdN-B93R1$^Y@?2BTLj4qD3$x?tt+k$B1qx{J)Keo8@JgV
zMWr!dOCIO0=;YIYoANc2PArM(kQ$uBU8w6*hl;<RrZWy9?xRbfY8K6E5B}j})3H4A
zv30hmu6J1x6cY&k2e1KQ?185sk>i^u63QbvB!mn^auJ?QhoK8)&^e6WliDL}fI>^q
zQ|7`IXu(^X_#zkvsp2?%v=iW7iRb&o2YVMxgj)dPw$#mhqv&}bffj~oz??)$@TfQx
zRs|4q_$tER_y+JpY7coL<p|K84%bUq=oy!#K6@43=Q{!ws|=`E0jX;YiZ*W+;3%Kh
zjx%-2x#ZN=ECt!a^GnvgzfIfbe<K;dLUZWHi;^WPMfpyga*YhnkdzrCUTmur#y(V$
zMXK|Mxa4b!XoOuScq567lq7Gxo5tBPRqvB$f$190EASZm-DyghD#*JMqF#A;csejx
zX?Bs~%av5txtBBI7N$VRmzo)844v3D#`XE8Axb7?Fn&1kBenMtN0}Ad3_a8IkV%W!
z{J_uwHkRS2nuUPKfuwcus^yEqRFQ+Y9oP6517WR&7AELU0oU^6ouf2kqTISO!XWMV
z3x=n|j(cov96lm$(o`hwH=`lJN)nW;+=VrIbi3~#@K+NXN*Y_rm(#{2h57(*G4qt;
zE5(bVhFQfLL(J71Hq$6P&)MV4ELFQ_@GMnT)bSg{8p=9LlBt(vbbG%h|8kOEpYtZ9
zF|N}JcYLKlz2w5}qlz<qpS0qv4)l)@4cUUf9|7pqaF(2dN9V{wVyRN}u})ej(kYoS
z5@eJ+i$3U>G&DPyZg%QUOIe8&q!@79Xn>?r-fHghW1T2Ai+UVk!H!`B0W<g8<#%C#
z?S2_Sm8jtgU(s$)e8nc^{NsB8`rJOozW`QbcQ*{pY)(8jVk+8#iyAXNseF0qCxR*H
zgcww6FHMUxIMr{qim0ERU+Fp>_UDN2Bze6nyS*gWJ7S@?6iV2rO<|*;iKFb>4ZM46
zqNZg_8qt||Tbm{`HAoGZ*Bs)~C(VZZ&@*0Fcl~$HX#nLB`#Vjgv<pdoEGw*~r3@Iu
zGE^ll1sJ2xX^1Rp-({<8E-CxAY}`D<l;$ZEkW1V>RCJ7@MzdyGxoJIA4!%Chlb&qz
z;}<JWw+6buy}*Gymdm^Qx`c!Ie1h~=W&rEMzc-p;$fYAG881heoL6jrPIqycw`1I$
zY*Ap<ZpVEUEw9Nuv~jiVQ=8sUboSRB8FAv|C6a6W)>Q^RdiyG_Fx*03+LmZ*<$!Ei
z**C$>xwowYOHO`}A}dih|F^jL;<vL8^WO-}h}~znSnpNscQ(||y8az2<bshjYF!xl
zB21n{@afx*rC}b%nD?(QCRgkSCw;=g27(2~s3uChP0B0TG-pMoecsVUE6)^a)}SB}
zmvP^xBP-*Gz7C{MWgapmKV-R%R_e8Dm5ksMp`_o<3>z8)ajL6ud@~81`A4>~6Zb{w
ztj<6^=;>2{^)l$Ch0;ni=DJGX?dm#sUw4eZxQMRbaO0deYv)rh0S_BF^AYH+lzAB=
zEps~*i!a%lTKUpL-e@-OSn^YHV<pY1ep%>R+=x0}FlqkQD3uWfXpAk1WZE*31kbol
zRW%~eTRIj=dwVYAV*dg>s;Qek4JSFv0{zRO;`+GV>crxw9n#KAp_z<J6QTT`QGscJ
zik1~Rjq0=J5{rnPz>t|g7HY_(A$~S1J5wvb8U5L0b2;+y4Wy!8>?&b@caBY~mI=tn
zVNIhvimz_VhBrtbn|)ZFpHe6oIn(=HIP<fSAYB#KQ`sCckpAwLp_#~ur)uIhEuK!?
zr)@CaAsA;@!67%rTmJ-k?z!zlQ>_6e>d<t(wB2najwa_)uw@@5Jy++k@6Ex6OPmgx
z(lcf2fctOGIwOm$$kaJ*+ym_!&SQ~fCDiF;CU@E4)7T4!1Y{svo8fA_gEi1!7J5r+
z$~mLS$pKuT4yXV?G16DW7k_JH7`d8-6ic~an)e}4kdZGY^uyRhC!-xNI|@_U=$HDM
zH35K@jAiad%MUsGT<^>?myA+P&h2XaMD+%j4&KR~U+3kG?}2>u_5*Ow$W?ENqtmNL
zw_WE7m_+8<A;sH)qqV5>;Y}ylzW6IR8V)mKs)9?N>7riAy>_cbi677(xOuF5B~u=)
zW(Gee2<A?@hw1OXa|J5}(^wmNb9{Qdca>(RItd3K?!G;W&#8Vn*jpr!j$V5TT*ZT`
zOOQ;GCm35BpO2`C%)4B7?k%f9dq0lc-Ss(_drjFzSL9?qZ&-)yT&!#{Hdl*ghhTW}
z<s50fy*{yDT<`{n(V9AK*O=;HgomBHzkAs_c%O4w@;1VNV45qJ^g+bno`&q{X1HuC
zwvPj`k?{)qR3Viwh~#sn;nclq$qCxiA(s!FdJx)x^<bfMi7~2oWF$}0A+^h#QTEen
zz63T&ZB(rIn81Uofwpq4LU7C;nOW=Hm!gD~L?3g{6Q!oKTvpo}&fB|CD*Rl%DKmii
zGiows#bN$7eN^tyyBc)nH^!MERa_rbmbetIxb|cg;n&p(E$=}bwvJWWWB+vKb^6FS
zs>AH>ViY&e8SA0_pvgfqUmLka<BCQ^FeH!qPJ+Fdpl@lEOuwQFBj({Tb;xOPmG|9Z
z2&6NARc0vfYi;thCDkE$+t2m)_2vs1Pju0RL9Pwvc$!QLV49N_PDk)))a_<^vW1E<
zu1LyP5jjljyDjy5(D3s!G7}1MG=KF$D>!wJ$vUCF5_vAsf?HS|f5Q8JT)-Q%k|;XS
z`0st6?VTfhttVpl16a?R!qu$lf{U7&y`3@1N<e*=ct#&4z++<7K_3vDDUz>)>J|8%
zSOv*>3u|W@IoTx}#TzT<l+Vi*^`GcX+A8(Bf^vK8(fjcZv^>rqk<*9zn5DbT=%3G%
z!&P@lC;PQ8KZ;N@Pv9vY3VoI3E|=TX<Y8wcLSsQvT|#IyVpK^<jERyhr;r74aq5OQ
zcA27fUAeUc&Q{q*GTejGV1cdWdR@+cPAFRbpqpgda@)9-6}H{>TwWiU3Ne(G)fhD~
zv^8hvs4$i58`u6YlcbLE#tQA+WN5eJ#o%;Yt8o0fL1AIq?34uq{W=`P;_(m`9u-+R
zbZZxQ9rn7mz%EJP<FoU+x~%TgVfFRgg$2+bMJ!}X&FpwOLQj^`!H76Lt-oZ!0JUr)
zMWrj5+}TWfB{{CPm)wHgpdu()|Ls=V;?38pK5u)XZ?&#WOUV-5*H2#yW2bRXF^`Cr
zZd)Qd!<(i3;+sr0g1mY#F|NZ)<;<1l;PbIHcJ(TkNM0Jm1|`a&F@i;rmx2#mia*)_
z=zTseF}IuL=jvzX7ON0Cz#L~BagX=DgbJ(%^Fisp=JINlygbp7AQ*?Rw5Iw^VFSDY
zmA(9eV>n|z(n6r()X`q?o`Tk9fm?X)y;3i2Z8Sl6lIvAO<fD{cLyh~0$)>vNq0{h#
zfbi+eouAXy2tUnF8oGMSeC!W;UwQ!N<r>*{+v;|z`*zyICm!~8{PlXC7S!vw<qm?e
z^cL8H37Ev1!WE%Q*W3LrbI=mE#+_cXnKZ?wuL!6iGh3pzH7P4Mouw71A>r9Sc&yvS
zW9hf1H~Xztk7p{2I#}Vxa4G|-h!+a3vn`(}bs9Lg!(FfT(Df}+sZa1lSt>gEx}ZP7
z{OC`}1T`hxA|qXItbqA~(ZWtS-%`g{$(jw(c){TuAf4$HRa_&DG`fP393E9^t*rM=
z&eA%ght*aj+sqR65|(+=pn!X9!cS5DclG|^jAx|j<-mH8gX?;k%eE1gjqxQW@|biG
z0`Ok73*eCj{%5*eyAD55hzofu8dEIaUaHEyx#tv7pu6Jqqbl8WNoQIz#oKok(lvT_
z<K{)fuF@Q)iqxRelv`ztykA7MD8Nd3oqrmS#akIgI+fLP&YtR`<oO(KPLbjfXq~${
zV(V1UNsw|;j=>PACzmdbs$8|HZl|$tw;WDeb)f_*OS;(9o{^V3uHyu*WJ&MP(lPV&
z1Y0WkN6(d*Vmkt>xV)yfEQ)K}7Maa!qs-Ty5;0a0&C>`K<r>k&`$c*))0I7Ft7;>d
zw^HS!Hq`G`$K{^>nuR6OArFTe%e?qjf)d!0$t)d|GX~AAh-O;lIj<k4<g)5PABVA0
z$ZhDtlKSqczkF14kt<L97!*&Hrd(Idji#ig(PX_sp1d&@RuhSDMGZ98=;62go<bY3
zcTtY@L|=O0{e)bFL>z6YOm)C&FSqw-n9@d{t!H7g-=LEvPsRBYv*C>3SYexaa{-6S
zDik)al?yem$j!b;0`@|avX(<q);y+Gd{|$qST4W9-MQG~^zg1*uH_j90W;2GVeM_G
z#j<>}Ik)7JfupQhgAsKTLI;=GR=<b_wvT2v;LF%Wx$BO)og7qP2~Q><_;3!mZLPxS
z72`rxy+UL*<GItN*Fvss;SJBsZ!~Y{ddH|3cNISYOzVET*?oRGxop+=;vZY;P49Tj
zh5tGDmyc9YzS^{=nXqP$p{0eq^AP)OvW)R=T0{C$qp7q}GJgS&__<}5(h^Q7)e=qv
zCHAT0+9ESj2*o|N59qQ(66iky_3w+JDc#k|yFhr)IN|MrmAI@!_PRn>qph1|@lq{$
z=7UGH9JL)Y{SR`s2HK5gpgymW&5-2YW!4X2ODO|&wwe)%PVFErfp~0{DFGLKPe?K`
zTY81A&D$X-;W}Y#I~^jiEYMEwZn$1$#65`rf}xoO8p1>c1A~PwtY1(~EeFc&=^h5n
zX>*!cXM2ziQ)`)0A1#A)6*tuC$ChyGBL^^K$@QPZ1|I<K9QMA5Wf~%uNuzo9N{cv1
zM`64*pAU)xjT(%Yflh5%^fqp;a8L)I<hrYFrw<j^w-g-U+=(|UTI~K*7kuh<ig$DE
zFXPP&>V{$Q>eMJ+$zj*-ISuunsrtiq$p$wWlk@vGe|R`}(K(NBp)pTzrQEE{9(;4t
z)F%u$OFQ2?GoZg$RZzJTm%WEB@RWhN@nEz8Z$x!1ZTG1*;SU4W<qM&O)MOcRhQjlL
zvREl)dqf7A*qG(TM;5n;dFY{PvIkly;l1<bR_I5U1cjsd{q6nIyEk(yI4y)E*<IH^
zW$4KKsI{O*w#>#8_utnG;&rJ;WlnuJl8Cy>c3)|wb--rj=VlH=%CGm4Vq`0xIlE>+
z;qN0FU#1oF-J=vt<+ZY&qNY?Vp*$~3z+8G5vY3s;7B;Iq83UCsj$@t@3LNC-T3HYs
z0hR=Jq|#3SyQge3UL!oe>NT|cpeGNjKXm%Q%|YW6!JoNmnHij>Chn6Qu1Z_g$5Mvs
zMN0b_8a}j!&k|OA7oFS$hM>2OY2h+B3^M4ndl}d7HCpmxc5cL-fs-^~|Lxlf5mto7
z;-{f^%$)Ae)$ZxB#Z+9h4L8b$;~B2Ra=VLp^ZAIL&mxbKZz*ooWwYn(xaQv6t6ntb
z%RL>g{^w-Om5L+gQ;#@S6XYp)A|8YCwW`%7JQpiRQF$}U$&3~dOd6@APCS-uz$FQ3
z=Du7^M-v2z_|h>7lBMqflmby6$+DYUJ0lho#i*#y18qieD-L$CF$2#9#|qKx^dcb7
zfRY;begLx1O(!%IMIeqYpDtt?^uHF4KR)q`sKP&VK=jzXf@MAU$;P#rOIAJGIxnkJ
z5q9AnX_|LQQ2GwqJJ@TOfbA>4{L@a*P?1K9&D&W=lMSCSenHWf?IhsE_}Se_lcf)^
z6aM1ov2?6pV$0=Jz(EdxESD_#>7hcy2mXt4SX`(mMODvz?~pKd-D*iR4jDyp9iKzN
z^+~Ifmiwx!gM5NHJd^gD>AgkxpwS(tQcZLte^<s(_iX7R7qwQjfqb-Qrd6LQLJ@3m
zFfE74=Et9#38dU89Uzr@tQUi^3aq-CL>jG&a>dzv2_cR7aJ{6D(v3GS`Tyb~3J=oX
zamO-CpS{?>;DenFyO(4|lgduz*FVsKaF|WhNA<GUx)*5eS{kWvKF6DEg`ttC>|*m5
z_(~tS)oVMCr4@VW8jaQM+gL(#fQo3f$*J#w!@mGFd+KmZ(CD6ULqf5T!T*??KV3Oq
zR&`_m3C$_&td|SMlBKxqDVp{r-$B<XX1Ar1Qzylt-wl92a{Ic$xN>8$yKw8E@L4J~
zhZ=`U`TKkJ{;b5WqR9{~gh>}$o5+Rpa(}%JF(^(E3E7eu{REh(wsiefNh-HdJzOOJ
zwY}(Mt0L6~pO_PVSE{bJ+Eh(F`6-KFDY+_AQyY=qrSqk=Z5wB+a_ueutE#?e<0Aur
z$$q&H(0i3FOS9(0h}rR&L=}Y_xTnF`s9TH9*fi-|V&q^1H33n29SHv@i_4h_Hju1C
zARdA7c2C1`r+kvG$03t0Yf4E+ICw|cCNumay%}XUZF*SWaSDrbhcg4!U<00U1&Hm&
zfqMa5#53ou!37=Dpj3J~+tz$|L(CKsykc0Fyp!0ZXY}5{72t&#pEg4R!Ax0b&~a4y
zF8rMia%NTY#Sd!3Z$A9PP9w^~BPz^8xib{Uc<SC6rnmFFVsCt{V?HiW(NnMFf1P}%
zd%bsP`Kd$*jp4KZ`oe}bLx&H1r}TQTWk}97c~RNyIVTcu*@10dNPYxi%u;Wf%l`;#
zNxa@rBw`-ZeC(FGt}|&##fT6!qCuHT)r<OIII}*GO>2xV#;)GkMaY<X_a3wypcmxz
zAFXmKn$$<HPqMo&Oy1}QidoOEO4DD?iC*OR@^q7?*Jk0*hPsqq>qKQuGQ<=Sq}!Ey
z7&b4k%F3IU8tW;csQcX+%v#c-VJI-;U*K`N$&Rep1>(fjpX5yCQ?f+oHVwd!;YpZ*
zcv@752%bvHYClaBoQyUkJ?tV7mYgjX`2QgX#sTZCP;vkTeG<Q0qo<szpFm`=|3@w~
zcs6bi*ZkTq=}3Bjc$rr$ukd(;FQ;9q6*q-LaI;7?WR%`uWWuSFLG?`zS9ymsa##~y
zV=*RPwGCorEFwzS#AVA_as{KyjTip=W(ZMHPP3l+tXAb6P^J#&iGH`U^PfI3SVgkE
z8HczB6uwtYG!uDl^tj_B9&^IMJ^2YR<scHCr)IL``DmTQMY!knNhgYE{;o1CRWarB
zplqq&j#6yVRH{uzQ@&?jeeTd(f#=GjgIJx<waMtfZoq2TzY{QxG~9lZBeK5E5=@e7
z?tc|8kt9oGY?}bY4l9%`-}ft}s+YShxAZgu>6lWkaK7QrQlmRE>a?fvtSN01i!&|H
zL%2BgQLaok7rneRU8kGy5qh#X9ssN+=yg#+aSY~YLzb1Tx;^GtSyJ5+vz%<N(V0jl
zE<C4(jQ#YqQ)K$^PkS}ToA;+vrh!r9t+5C5=OtN-<Q>1UJk2c7m-ON2B%BP>yfW+5
z*}8w8TWNDdOkd6xW>$YqC@|N!)=7}~#I?AhU_Da0x~l)}#cV1~c#sLP7x3|3b;;BB
zAM;>yY^xqqu8=~s#dYF#Cofw?!7=?!ij~`A3{=?xYxwBBGG!>9lxOIW0tgF?_a9EG
zRY$qGYdqP4S9TKjh`swNPOKohdojDb74YR^m}#pECKVkShr#949iA~Sop6s0<h!6Z
zQ5Z>ZZKSC!hBY7DUHEf$kyE@)IZ_Y%$zpb+-v{oGS<c)i00CNANmHXRNFqHn1>-pL
z(!iRBIn*Y3Pf}dQwIkxFd}AY_Mzbq(t`s)pmbtaq-K^X!!|E@4WbwBsSgEUOne5z;
z!lO4wdaY>_#G%aw&@!-(&0L1FOt!opH)B@bwv9h`zgVSHZ=E1?oDf_Q#V@>m|AY+m
z5dQBMAYKiPrj#Eap$|v^ZSqTSZUo@j^WpJ3V&bQ68}^yR6LV)82iha0itW?OR-rZh
zDN&_#y9jylbjj#lGjCfL)!DbvnZKB;TFM@y?pVu$sLxJR+@lVsj8gA$@}Jm!eZhV<
z5=kqzddX84<+X5s(JUyZ$KIau<B<(OsAaL2LBcCcX^GxMD~XglrPIdZ^-p)fWQWX$
zf_O$L$3?AL#2O|uP5-FjXeY^&yrPjpZe{+9CIIDp_AOuHM+9shKI@PWjI{}T8>>CI
zeHU~e)$?-6#=DKbahi5Uu1I|FJBI?euGo8!1y|1Gi_QPI0Lm$<l-3mK6zy_N9$X8>
zH3c^#2z0WJmC`Bd#5!+;%iOejk1~mZrH#w9)PkL(7W3LQ7BAk{=oYk5CgHVN0-v2<
zfZ?`(VdrUA#z!iHvmX{DRvcO$!+w#1<R;;1*WOo2{tqBuC)5ELIaa?Yz~WD9oSi!6
z(9vJqbS36_S~}3=6>*t5LXcs-76zS;e@Q$}4KK|NQ9bYNLR=(Qk0qcVW+%#Bu75E`
z*Em<<ni#64!=6_R%}h=_OykW3ttAgbMllR*gl5+P?S%)4w@-{7M}V(~Tp&$Eu4inf
z*+z}u1nD!qr<JcNO9nQ@xRNWJT^?tAl+$|m&X+R5JHMB17dRS*`zaPzDFAZmNrQv5
z-P`9#iw7V|zoB&R0R!dSZyw2{wy;i|>{<MrNaqZes6aNP(}RClBSRHF1GYq>&`rDj
zKu$L^^|MFfZ&3vHJ-u-CY#i9bw@f{DrGdcwin5$k9Iuj`DponoE!|clx=Y47K|I4Y
z0&+UgSI+XpQ&cH;mD1gU(nRlGP@l?h=%k6A6@B_nI#NOA9n(S8Awj~BL6dKhY^%kV
zdWX}~q4&dIWPB$U0U|5cFVuPXT*=ictdnSx$l|O#Z1yTc>L>Y!wJzkcyj@#QcBSNw
zm$<U16C|()rhvIge9yR%YkK<(a#R2j{pnqkH(Pr9K$iWebD2oSllr1GA(tsDRjD}L
z)nuSrY)!o-j#iJ_;Y0i_EaLR;_+okhyE7~HA;6BugWxrgt@NUN=@DBSkB`Wetc{bu
zx9GYdek8{xO0($e<6F54%N9*8g84ui`h;M(m&-f??9!UXa*NK9Wd^1JBazr!&AVyn
zCqDMG_NWNn$W7FRy_k!_JjT9t6&{rm@oz6DjG)VBNd-MJW``fqq@j8{EZYhtoc_{5
z-DX$Hmq_Ox+P%#g-rwi3)_Se;-`jm|+_u!Aq@FRDk}s8ZQp>WY)p6BxcQNo;*)L5u
zX_lxtQC_+bODdC%(A*3=Y{D2mDzoh7(M$CGyz2q~m_WogtV2NiWYLzpuHFy|hQ2fO
zYImRRL>=tH9{4lUPG+~r#nl;q=N#*wT~M>LeK1zuw6l~R(G_J%k;tMQx9aT0*;X>U
zkYRAg(xPgk>~*Ve;D~Q1o+vva9Obn5c!cyGC|u;*YENge5TsY=+yy}6X8O$7)`|HK
zln}?dr&e|EIZsmIr5O1<A6?neq6%n6ZIgD?dmi@9w5v<2JIXpcVUa2RTCuAAysDaS
ze<7WIqYEk~tBBNiQOo{Zi@@|K+=-T7IH_v{m}mDwA;6KunD!qNXY(!EIX5+dK4N$T
z#n2zThylfm(KESy?sSVfR}*;ARnyy4D0;mNHyFRft<RO_Q(DVfi&ru}`67yc&`V)~
z6}VvuZ5r>f+X0cw;MYxwI_nTwZpm5}3?y<%PWMdizug!OT+EOH3-~XFJQskTYV<+9
z*Zofvr3>4)(buvSbajx2mW&99smBv#A2GfU$YD$U>^ERN4H{4IIrFuBOwqzOSfKnK
zZkRb^J$)nFM9t};QhRR@*WHp4Zpy5aHmeGXz~C)={8qDbD?F6(E7g2h9^-Z6M~qH|
zj?nA*ipt4UNwp+ftjU1Z)mJ}7O;Nbnn2N_iU#!c`4{c?fT9*mh7A#7^rRiDeYo6w+
zhh%|#cM3jtjQ6T~78)1jP$KmYg|PgJ;tfFR@IbjW<4tt$!LKt95~pAS50%|W!nQb{
z^p?|x?)SLh0LM+oQaWSAW(l&<?$Xp>2OFAxZnRTE;+=|3X*yH{Wrh0&cJ+yMFtubg
z<~IeA>WYy#@}3_*e&#0lAd^}6k>a<e%$M*#5!D1>y%zccJY=C^Z7CO{R9$Rd9zUPr
zs21|{CCifsnVQm^t{PxvD=T6_!i78<yzTiUDc($k+xX8q4i6jJtYSMw1XOSG2~eYy
zDC=pB0|G}?6`W^V7!NpB7AwC?$-0Bh*nCu@EkpHI=Ked%0&<f-L~Vvr$}UcY`GkR*
zJV*B>BAEk8GfI$kVr_{MKu;l4&|ru4O^BQ_soifRNY#2go?MotHO6G?C?f-LB7T^a
zT<a<<7AWFu+$epY)bvBIukx%HuulHxCWfKTihLk)!0D>+CIiwYCF@Yn@iMTEs^dw#
z!wI@McDVbetEXUG`eO0~K?LV<dBoeQ+)|q|CZW#yV%H&dOIl}(bY=%G8iYI=F_*Da
zI)M4f;aOWfO<^w&AEV2+gx=0gb?L5q5cry*`Q0B^fX6jnHN#u7)C*##l69iJY_=KD
zLho+n{BV3T2baVaWktQUq^QG=S8-)Fn!$YXx?K*5lajfOcCv|Qg0px<j0AoU(Iu4a
zS%OuPXyoa;!5nhZO$C~26?UUVrKOifzun`vl-A$AOI*dd-ln3<e$fJjS=(t#6TN@P
z(z`=-JHbCxsrSyRGn0C%Ua=kfR>g3VN~}vz=`>is8fjVVRLM_G4me@-#rgev)>;EY
z<;?V6Q(|z)u16Q6aTuBPER#KymYTgzY6zz4JpGjx%gQ^M_|v@V{gsKbgh$Gk%dPq#
z3vlr@36QgD=qs4kq0!(TWQYw!jyM|xtb0Ho9Up_kQ4tFa2tJ7^4CyUvD2jkFRoX0D
zn$orUeccmblONU?oMzIRyD0op5<zq;w~LC>iCCATOy0LFo7`!xCe}7sj`QNCOEk%O
z5|zvY0>oU=z^t;B0Srqk>thPa>*g1yqFU3W-{zvK3eT*fGh5f_beuyo+r<CTv|`1d
zqEUCttkb?Hi<ObpJWp{_{AQn?35j$2c4#Zga(j5Fv@a16i~)W`1*_6~TQnJTm&H~9
z8ZoN{($~`f)KfJb!>;%NvPlvA?=-kmjeQ$?)WYx^u#!yE(!|@P6G~mESpOgpvIW6^
z=!}r!G;g}4g;Forj(#q$V+HbVUe!;y`Y!agF{X#ac$q@OA}T$2^;(cx<;$pa>f|=x
z^O%wLVM#0Xm*2*c>4HrefmYwOWpCU1cIlX1&4YF{vKXP@kJDilYLot89F758=S%Vo
zGK)i|{r_w4yWiRV{`b3dXi*fkwY6vMRaCXq2&J|LHA|?yN~o&6Y7?uaqDI7u739@g
zHA0P;wfBe}E6C^R{rbNDgzs<fpB~qh>&lgrbDi^e+>iUd&pGu$u|M8yZf|}xkL%9U
zywa~lJXPaTqZYR34G^@WQth(hx)p>=ZN6p`e^VW+{slxaNSm8g?W!}4Ay(K8fT!LS
z7sxlfz=!PHjvUcx)n%)WAK^@yt;sOE==T7p1_ss-j0tA5(`GIE#<FrSH{-qhY$^EU
zoUWyBsFdeVg_Tz!)%c0=E=PJ7jLmHHi8**L=8h($JoWpdiY5Pb@FvIr`jmfDd`#3g
z3DizVOL}mk)7v21*QOAZk%gapFk@8n7!W(RvWax32teK#c=Fz?_{><j34Y@7S<z9C
zmYM0%4ph0~3x{3)JH8ijpRS9dSj^ZAaPS+jg;z>X_=$ygQca6CqlFFDmeAj-D(8#K
z(2me*1q;56nv#;-V(!|OiF+@Dt`B@X-XTdTS=dF}YOh|F3-lmh+z;s`Q$)$;joy=C
z$QuET_x4j@0O@Y8dAQE-S0u09W1!y1&tNRp`dKp0Aq6rBJ+aBA@YjOzm9VE`v&uw$
zv?rR26vVFUWH-FiR}mm&1lG0eRpHrmt~yadqrfGN*D9PQaE7lm>u_KtEgXbjU8tQN
zYva*R^e#Ku`m23t9HC@WTIoE!Q8d`nH3QJ%e32O!2>D{xnFM&mS{n7TI6nJ!1c58S
zh3Cb?Un%6u7KHT(STb=?70+wMhJp<PC2;u~F)@~o&sP3e)4xU6?q%`{VB^qg`%5_j
zAAReKCuG|X<Y+Tqek+x$OMHvCF{gPiqhsgCQ)GAy_rU6san2U&JL<2_!YYyZtTl$#
zAg$16Pa`dCS9eM>0pWo`jwKBaF-EVk8)c%sU*B@AoGcr>N<o{{X@k8c6Y$#Xlkm%)
z#yg~?D2~W$>r5!Gl*od6)1M<GOe$5e#^_pU=KO-OLBj9GgK&xl`gbv?cD+GaGPiuh
zr<3pUs{VRCYHBK>e;00^cF}#bSo{mroQoBH116k`u;dJBue34C%f$Ae7g;Z@h14gm
zzx0bGe=^6xd~e(eKmE<DLDZU@u)B<H^I@yo0fXahx-y?9!JNNf>%Y_r<TYAF^ZB)&
zwoPdp3zi0!3(}uD!bC&ojB2<4gVZ;bcV~m8-ZR!5;ua3J5}QlF(kWfR$%y96ms;_a
zY0jIBR~1uhHF$~l)fIDAe)CG`%dxd2k4mKC36av9)(*Q%b`Rti&L<HlLXmWNnnt=5
zw8>c)NIk{QentS7dBLa}Z^~)1m<nyK>0>&b4jW$O7llyiMKIyFYq}ca%}-GxdoB}#
zv%)TtPkwcu%*Lo$t|W1Jbme`4RJuu-jJc_cRI^mHw>44s<WQHlY?lb(zs<QZ9>k&h
z%(YbbO%u_$F^9(lZ42dK3&we%?ri@{D-zV{gwbVepJv<Ch&~J+k@}f~bR%h~eV=F1
zbh+OW6u#Z#p)I%#oz9z|psD)ptpcs4w8Qk;Z+Z#{!(j*-XjevR$c&6rk_k!j+}(c9
zz|^kl<q_VKVX21yd+qEpy(rp-p2vAA#~}_{THK!_NNT8tbRHRi|3Q{*8M)d5t2aj!
zed>njPJUe2R<LEdwAL5B?-euJzqtB9GrdO1C+Mi-IS+Vc`T0|!&Zp}y8K~@@coa&V
zu7<N~t^TmSeY@@40o8TQiN#u|tNk^~?N%R$U9gqDAwyCzOK4_`lM8cIUO;Rs<En+F
zky%-Tv4M>&3Li6XR3&lR#aNHA_$dkS8Gfox2X*vb8tL>wq4kUe?FJjjn?w}fHFGx8
z2QQoohKn8f0^9%owf{680b8-*PfBJ?7?#ST-<cIpXIe{bjaf5l01@Gz!5#^r@45X_
z40+t=N(QBhaDP$_taUrTde%6c4jvK<uLrEiQh=09HX|5Li)W1Hb9dtaX$z2?{J(?-
z8%CW>?<Z<Lx6{a;Gz@vcJjkiKUtan}MtLB!S)p=`%M+BwmOwd3RgXi-VDB6hN1<f-
zIWz|?P16g$nRF3u<c+DMPmm+{hLav5Hf?QLqAGk`d)0(NcpzD%fKJ)|{iO+xL~Q|&
zw}UH7L{~Kp+2PW95Mi~-PP{UyAWSC#v|k%Vbm9a!pW@TD1XHcQKMFY8YDV90_*S!@
z$*O=~Bk4~qeU-$I`6M2!bF(CseozkF3$v<zhdjDvrF~jlnz>z)L0AHK2|xj+SV5|3
z`8YQJoQxU{tU!vk|K<4k5mXHq23Jmb*4rbsVZ>IU)v21JE;!Q6m2CBhr%K#i36AOG
z#ToRPl^53L6wyBxxiu2<r}938W<B!>$?4~;>lw?mxhaU~GZteJ+TiOaiT*DaFlRKi
z00OEiIlw4?xuNIo8;tD+R{|G;4r$x>7xx4hgL=#vpjbp=IIpB~3fT^|eN*Q9!f45Q
zb%IxH)|&YknX<npTNtZWsxGeCXl{%}{ARIK*W>S+WO@1%SBtzx8g0crxNynuruI1#
zYb@Z~4F-eQ3!+u=U)MskHImoAsp}}}qYlark+#-oY(38XOK;h?Z3A$|-q#hS_+?!+
ziYh}qG>H&PvPqhhC^9wDT#YpSD+3d_#T|t>{i9_<^(M^N;ojcZuP1ER?lNj{7i}Ms
zk1E~3gdyxRf5?bKv{+sYRa+8xULUT%cjW2yXg%Y*7{WQATmt_)Iv<Uv`c|sbokjph
z%~g3{&d{Kxtv2G!kSPkcv*m9duhVM96AYN6_e?(Sh=qu0u6C~#FHzcsX;x~jX2Qc!
z%{pt{_nlb1l1o*;neh`_pJgonqfqtb^nOvZLwsvnlsDw-_hIQNF=Qr4$UCgyM)~`)
zzqDjNWtODU7Z){&v1kjR6)v>k2!r7D!QFzM!(|q}Xn41Hl$&xyWO1t#EG_6&?AMQj
zJuF;t55<HUevXN9IEPL#;9rkFw{;8}LA1X74KMf}f4d<<tI7kmZWiC_#gstb6OVU<
zKoTb&(zYNFiKD7^t6+ltP5ueb7J$R)7E6JIcAOpIyntx{{3FaWYHoY?R02mlb;^`u
zH6tHt3YG~nebdI<H+&(y%Y(A;j$qpj#^}$czk~%XGCr(V=R<Z1!1dPo_|=m}Yt0m>
zIwec64R(tG3ley;KwIfKqpg;Ii_K+NXE3dVKcZW}#yVbRl{Zo1N~QLT?%bm8@pyge
zcFQsy<Gm8~3h9cfwX|v~PaTz$zvD}9TPpqe2bQ5Z@MPJqcsvF^CZ-xNrN`+Kw(Qr6
zY*!+~j5F={xy=0QR>+3mpO<4Y@`@hhTnVn(da3ozguDF3JoH%fpLKFRn9UGdu69$*
z;B1?Izq6y}oK#e7vc~wO6`8w98eIoJ>%Dn}?s@l{BQc*-Th4=QWhox5LSRKlOuYW%
z_6RtFTFo)5X{+y}P#!4sN55AsY-xxwc;1K%10$u{9$(<#n{q5hg;-hk5nXgKu>f;j
z&snjq-YKn+ES6l0b#+cr#5&WV3jPS)Z3l}4ZfY4=s_nMROWVZhe5yIRvD{j=uLK)i
zJ+>XPhZA&b>l)`YM<dLJtB*J)hSbl_cdmz1?QLi0L1bdPOUhIs&dX<=)rJV-^-GvF
zf547&VF9{W$;3bK#9D!AzPz^RXOTZ)k*y!>3a`L!6^T3~Ph`!Oq9uB5W-k(IS>HiV
zgcW-4%G&XLFsY32O5)8mFWv2`&hukz&of20z5Dx87WU$nVfN3`iu=x~&JO-EV}&CM
z+O>829=16n*F;S`tFJ;r!Yr`&ngmbRh5-U&agc2DSx|tvlV`!ig4ibtc8+nnNa;GP
zfso-{O<CS$YK{Y>L=m5Q*UdLt%JB>mMQf_NUI{`xhObBUmpjXghH}5Fb+OGBIkdM^
z3)6K{`LtRV4+xAytQTr(sL$xpFvm=58iY%3>GZUxgNh^H3&P6jdKIfqpwdN2a6sj3
z)D>I&<XOs`K3%Gnn?66N9h6{)?)MkU<(}_D<N>~8Gn`wK_K_+P3Y`op-wAohHJh<y
zu#yWZuFNxeV6eTRhUl)5y?<b(3oeyHOWUceTeTTE5qC{9Xm&JyR80+klI3YLtLZ#p
z&hMy-&D<MsdV;i;e;hf;e0talxypz3zK$W6<U7K#o{=kF7MYAj2A!>ou*Qvi513`1
zK5FmY)eN5(&pqzZWLR(zeqZ$Wsyf5Ob)~zLQivAJ`t2~QYi?hkmdN_-L|0jR*!nmR
zeqiY^)A5eZ)gHd>LzXP{jycX$L)~ry(bjF6_rXK$giXh3H<Q32#kuP;$5wzAinMVF
z)Wl6{T|eb7VGH!q!F-DUskt?aJYPea4^G@{wDIdSmS^v{fPV80?qdD=56nFu4KbD2
z>V8fM3^wv|Wa5I5bqVVK9oI#vEbfvYaqUc~a-row34+`j$tIbgYtFZmYp_dGG@tcw
zww-YT=(ee8R9!lYa?`{@A42#==x^~QRQt*NCCytX?u+yqcuGFiHGPVm4!}b!{09`K
z_Y!xwh|vl2HW%zu+9L+)#pVZX(<LbnW@pJMbtB?jL3Y0ney<nL*uL-?@y+$Cy@x_P
z52`?ot~f@zRSSv_Ey+|bxI|7BeW4Vs?jyFf&%b>TcR!Q;8!J3jFkJxhO)eUrL<TbB
zIeV&#rJ*etRjGlGw9b*n6I?BXE~tM%|94qlT>5Q6B3Pv9^h762X2k>Bro<zF!6fgf
zmBP8J8K>tn+vPYIX4kfr`o$<qmyt?LBlix{wnFK1QS@_Ui|;6Q`bYNS<~865;*~B_
zCCOsus-dg8;(LEmWuDhH**mac<T*MitCA~O%Ur_6W3e@5P36aKub(i!tD#s`vBybb
z^$gpjw?@f>9ez0RUdJ$b@07R;U_RCE5|BY)4DIrE+wbV2kZZsk^){9`<}$34zbR<t
zG?Hg78`XT>`p%6AIn)MT?R!@;Fj8tW!RId-Go<L?+^RmT{pY|->;t=IoRv%$isAEb
zWpPoVT3AUkqY<(we5LQDlr!V}IxCtm$8UHT0iq!<&HvNku`%w$WA&(LQ{|1@?nj*Y
z;Kn^n+fda-RZ__FnK#;2Z6+XGpfP^T@@urh=%yzH?p~f6Db$xxI>FA@mUeL6igl)*
zvC*xHd(wHgl70)+^iA?}D6}V>lNF_-MOYi3{?RW=8(xEharT5YHsZ$Iqhq-c=<wS+
zanYO01DWEuJxz)Qpry3eFWsac2|FI1({1C~qfPtN(=3~5+1h$g5jwDLD#4i>)*<WA
z5P!j%4I*cpS@x+6&sXBlk9-1`eb~>M;?MU<0XrRm8y!Ih_M{!h?bo>{`mk*3IEeMh
zhUn+SWm%m0+&XTwS`sUl=Ck;D_}MZ8NB#ph*~%*;mIWiAC{}W#TP`{)WS^O5VMd(A
zzV7e#eyAoDmH<x!tDU*~x2+(d(N%pVtKOm=Pu_QmP!|&;(T;}-jvMhInFlI<i+4{Q
z5jO)3x@<2NeP)<+^KJ@qczTJ7bjW@_>~eO%(7YWgiB+Zov@cY}q)$*i;p4)q+W7+B
z_d@p`8{(Y*Jk&wX!Jq0f;LiBuW$)qwBI=x&Xw_*N3~ohAbf<wpcjC$HB)ckFFeO-5
zRsVmO*2PJvOt5BpR+8?L`+-+>>KHRUgdO7u*cqDv_PQ}eI@a|Rn4u7hqtKuo6{Y>L
zY2xHGvA++x8LmiFfxtr8E?fi;#3SB~<g#gVY|)r#8QUKG*6p3saGT&1=s2T`yw!83
zYA#27rKDl>4x|ZxT>e88#J%kIIeA809Tqe#(Q9GlRQ?SD9rXTVl42=dhKW^k<vqLn
z+(!l?{#t{k5U{5jn1{-r&^5-+FKZYE?n#p-M9$|#&WNO=t-zyjQe0GXCkHT!x6kNA
zaDBVJh)RFTniRhjwEY4+%7%LBMki9wxb$@5^1{h!POpK$Gex^MK7v}|X~$z5`_zG*
zh7!iZTpw~uRwEDSgrn=_rgf9-+Ov|>9>3$C<R0tPvrVx4zLaXU`7^CDRdR`Clj<_Y
zeZ~lo)MetQ&+#Is10rYL7DN<jdr;{(DeuL;^H_$&2PmhxaeO9nk8&f+cx3()%u<`4
z`EuThT;#M!lyBR>F%kiy`mk0l%1GPXE`HsB3X161kOEU_M#+ApaVaLYZdTp$_FyhF
zl1_8ZsWe~SwSi@K3W$F=sI4uK{vsBZ-?Gt|!Oar&Qaus1Qk~m`lFi8ND8Dfk825hQ
zdaL#tPAlOKpBDE25o}qlX{6IWi*~8=y`W<q(soDCsV$)}@TBnhl$71h22C)=pn1PQ
zq;sgB2Dt#77jjPtpES&RHeReh!8eOH-0}GXT9}b>gu=cXG%@>cJi6*JW=t!R2IafC
zv-B!eKR?26ZKMb8-WKI9D!yB}eAA|JZN`hIX0mH!{!zM6(&u)0^_YuI_Xi1FS{wNN
zAG4!1Bh1N3s|aWS(z{J{K0^hcs0WflH5lEH@d){7Oqe(yKZ$%VQ@wKYQR^M`UdH)`
z=Ym}9YAM)VxVB>KtqR5GiG-=I?Fz!W@h*83{_s>Ogrv8#)7a2+{0`)%QB{@Td(Hcp
z+S;iq#irQKY~3BQm=Vh&_LRO}R8y{;SqW-DjIwsds7(6^2f&`*84=PhX*g78G&jG+
z?P^$<3|GqTxTcnS$X<4zHF{&oQ{C#RN7edn@AvT(qp$fOCNs|@;d}P5VETSk#Uj`I
zJIdT#@Z^wb9#-<F`)_E{=YxV3IJdV{u<&i`7MknhE$zrK&}s1&8fbcbJ}I5&iv;dO
z2kE5+kq$}AI;XA6q&boEyZ|epCC^6KG@t324T0xJ7Yyx3EH~@FY92ujWRgrdGd|o4
znXcQWcM^B~o7{6G`r=fZl>RZ<kNvD1)*xSS@?`6de41fp-QyZAN<^}-cj9;x-37Ag
z*VaSV?uwp~H`AV;xSX~Joe`#eO^&ij=SqQ_%jccQ(@cx=4SOXsMNyz&XwytZHq99c
z@gD3b6I1N-$>(a*@3iqx(n3ABA*j>_o8r6nNtqKU^++qH(M|}wm+*3W*ztFN!;%1#
zPuQ#*XfF*L={Dh23Q2s+O(jX2aO@s3(&`U?D{6Nl3=~lQE#OoPC?LJ~Y&Ih~=%g?3
zJdH%aoUG=abna$<1bSCp=J2}kDUGCc#Tvfj5D)9b(eiiKRS*NAHsH{t(cJ{&U)CXD
z*PgE)tJZy7Dm~Jyc_|t2_b3sWfUHEP7~fcI7{7x=dY3^-{bwP0hrK=0GG<MjVs>cG
zyVd)bGu^Ft+u_`X>4En?i|e)Z?V>{8mX!g&7cf(QCy_IVfPLKo3g6>;(neqN{+<%4
zFKE#y@R<Fqr!Tqo3zHL?{4aSz;J04;-yf7L7@YTZY3A;yAesrE@?r^5^tr#uXTH#T
zh4gZ-CG+_y*xnLJGS^Ld5k|*8VG{D-uvkMh;7x1osO$+|JOh~^C6svI<JVX&&3%+v
zc-3;GhY(U}%}^a7^kRIIZR9?nR<9kPi9i<KNAp;m@1~JvsLn^0l}N`*q}{Y2f)NRy
z8?d9(T`~rJS+LCpq+x|AG4f$Hlt{tomZ51Rv+4IWMHHtkEyck#kC^)Ao5~wLIVT5t
ze><|YW<>FsYt?E8rq4)Mu8@-7DoF6XkmfI)f1YkwxaJLyZqMQC*Y9!~{NCE2KCW_I
z9qMFYHg_@?w$mQ$<~YP!L2ndYFuCgzmmdGnRL$4skb3^oB}y9g=gRu5nN^V%Cfg<d
z8Mx=uIS-|SdiJB>Es}rG;Z~YU&=F(vE)JP&<nj2|Pk$L<Y#NYxcD)_1z1`A4&ZZ@0
zauG`co=x#;xrlS2k(N=7lMX%x__apI9EgZrB>P^v(m5ZfuSeW#vhmw&#g5-*{`jm>
z-$p$C2nRXtJ)zs0^%Ve+vUKwS3YoISGEHonCW5C4;MEJbOwn0$9J@v&D&BLH@`jm-
zIdnPhG!*__I5w0em+ThsdBSHeVjwgH8!m7%BlGF0Xgy$FpzD{w4|*1~#Wi;k%<SZ8
z<F%w}D4D(X&h7sT1{VuFTwQ4w5RK{M1StRsc2~VYjx9=d=+w%{j&k)`aNQd&kRrda
zCiuX^-E7pxl!BGDBdj2CKDSuIZgR==h2Ho<1(U^~4R=p8cF5&6XI^%SyiZ0`rb&`8
zgv4`fl3H2;PB3{ANZ{WtnK-5kxMSYVxnTW<?Y4-jxfUzug&Ty;bbmG|u~?N@D;zUB
zrUhA(celC4szG&6i(XV7pO|}w8uoI8cQ0?vr{13u93H3ev(PmuNqV6pWOBQ~5sF)J
z&|<T$QA|K&e<I9={m~xU?oR*Fv8Fw{3DTBC>AuE3>}Q>0MiaiT9@V-SB4+_)o}zzt
z4j|#h{CLHaoUP-W-AF%C_s7BcKyM%ig0LlRfKTnNuu<&Je)nD&u(61~f)D51U}@&#
z?N2Y7){ih~)3=i6Xy|YFL9bk%)Tc=&@<G&sS?@45A|k=50&cV7m|dZyJu=AQXgIW1
z27~Thou2iKC^-zaJm{JrNF@rXrWk~Htrk8Qq67Ac(<1&vep}$^e!!tm(4oEJUPin^
zuWpBwc?=5=kkOsp4VVUZr0d~KOhVK<)QjQKvQJJ5f5PpgpbB}<(xG|?GB@>@C*Fbw
znd|FGx4%Lus@Nh1QPj|3US#BIvQu_J?Im{&go4oA`B5>^4R~*J9~Lu=E!<g^v=I+8
zwam61D(l(|^aiJ%hX{jc0H<@43joIV2Ea$>TcmTHpc8CgSu@Z)`9Aith6}pBJ@IK!
z(|Wxz?^KCy4SSOQxCNXpUOhx(3vV@<v$E0uwO`gCnmL6O-spFIPL#{kFsxr^-`dFi
z8FTDEBwi`FY%4|0cIyLI4b<3?{;HIu^yL#jzpSX71FrA54a<VuB_7PwOW_Z^1tzE#
zzdz-dFYIZ6?}2BgZLoQZ*t|7y(c4~Naz$Sg?bpqJ<&O75bf9amJ8E?W0X-Ci{sMHh
z)ukG`avWeop&_F;NwA^-2F!!TZ=)goZwKLbtQ(TY2D_G;(csaS(NOAt`hyz=>CA*F
zI_N6Lr<LO&vc)h7{-(%DjQ3BM9T%@sB-B+XZc}W1Q~%<y5s@Hp)EclqBl(ElrRL4d
z_)+j5TW??HvHeJChOeJ}lr<B%8znmh1sypmV4V`XyB{doUyTmlFt;$$|HB>W=QGZ=
z{+cSW6jEbmuA7jUy`V;>lBvi1IHfeFZ2#1-jis~$8TS*}V{W}c`7ghZ>klEE$IYwV
z<g)cx>@~}o1^<!cbf;M=Gr`l&N}!5{>r(l=byM2!DOH#)?FPS!sXrqGaS<Q32Uxut
z_>lT&55kl{xD>^@P~(SvfUQ-FmX#NmOCDL7)!SUcU;mI*vGHD{r=I%a9LR3emiW|v
z87pnoCMlRSjf?-u**qB)RQpp~nd`dQ-FDYKD}yw$*9JkEO+9>pb}MyIat%}LBy|JE
z6vIB&o?sAC98fN1zA~D};}NHd>j>Ie!Os%Lg_nN{)&xULd_pC>kl1m8X!P58#$rsk
z3<QFvE?H?&H#6mK1Gc6?VwTV0f3%ab_|MFB$hy*TI(ac1-}D*?wc`Bphr!;r-q{RU
z$f$#JZQk%w%&!2b1|17%lYyaDz3XHbYSDT_U@o7R_FByV%0=7yYf-oE)!GESomf7%
zI_R>(&xq}16Jf3@={pB|jSk3x54{79rhE_LI*=M}vMQ*Z5`RFDx+}*rvi$9fdC=M5
z+cy0ANFJ`}9I@)i|6Eu7?%PLLH*vJ)@~bR3N+COaF0YO1ndH8F@vmK1uxXMNnM4hl
z=yd)hqu6_&&xtBH=(UpdgH!Gr)cxK~-gbk&(*()J9N-<fn`*^~K;;11LhD>%9hMm*
z$$8^n$WjH2D;4IG0H9H_-JuXIIorGQC>G0c13t8=jfuB(Vp}oOd<dWYoiM<h@@hfw
z`OtKhP~??vF}R?ggTj|AA>A{d1O<ONV!xI^MjgbdNbK0GhDDN_$#LeOdU(H1R72>%
zN%474ChuvN9YE9sx8>lk1GfASz>RoQMBu|4;0^{l^ww{^1|cm-(yMn7bE=*-(T}SJ
zPBN2+IfZ|XJu$_sn09Ku#*Fkb-fU>Tj~m*T6BfjlhY6{R`6>QrH2faAJo_?=RYABf
z;_ab!+)hc;+gfUjX(bqN&US6z6~A=pQWoVS79hCFdCCA`#&g9L2>-19nFYef!EY^>
zfmo;#eiaDX;gmOkkVVN#2?QBdx&M9ff0OgSmGi&d@xRpZzx4S3yLR-FfH@|SR+Zu{
hfuwu=qC32LiOAY`bQ7=Z27Gc!{e|}PvS*f`{tu63_k{oe

literal 0
HcmV?d00001

diff --git a/docs/images/pr/chat-image-delivery/click-enlarged.png b/docs/images/pr/chat-image-delivery/click-enlarged.png
new file mode 100644
index 0000000000000000000000000000000000000000..aee0afd560cf64ca31d5cf84b2cb2eac0a3e5cf3
GIT binary patch
literal 4496
zcmd^DdpOi-8-B(iIqYaZq{F0k)4^dwT4p3^JGv-|8WkU<NI8sTk<)~-rL?UM<kV)Z
zwd7DSD9o4~3WF_&avCHuc1jKj&3x}WnYKRLxBLC~UDx-A%jNmK^ZuUazVGLLo^g8n
zw#}c(&65Lw&&;-L*a09>hkk5lN}$NS#!bNhv%qY_Ivc<Efwpzu&fhuDwDSimqWW_U
zdHNT+2UX7QlO6~wJ5V0KQ&;*_#&snw?V3@ZdPQnN^A9()sA<KX-xHnd;-4-l6m+Ch
zc?*Nb_Qk||&Dq8N@?7^=?ONgF+t(c-f;YXqrYzya_(&Z3HP(He;qV59I|MBRdP2kD
zk^0T5wT-nV{({M#Dpef^L2pmhm88H|_iwq>nvC})GlZl4k_TftT^`I0CT2!x>^bBP
zG&lXXrWAH9%XNkf3{*VzT`DC5`Ub`3#D{}scjm<Ch8%}&<r(S+O9^l#@cfmPod8Ee
zC81K52#c1HfgaCA0c%;J;^MZN$FB6DZ%32DQbV*y$FDqcSq}2I>uOmKWh(mVSvPZE
zX-Uym%pRxob!GWy_ei}AE?yib%hHoiehQ9_#wij|oK_V}16`L*%xK1&w|e+hOG&_O
zb=^h-_;G8^;~fMXdH76SnVDe6)>B1KvyUYqTvQzby(V}L!Ebt8l7b9KVO((JR2xQh
zmPM*|1ifx+atH|;iu4o?ws@8VO=O*N%0_Q9e_f?hVjLovjPoq^pBO^d_~-w6jv*X-
zXu0<7I4_H>H#6$A_ji(9HNkb`Gh1EUt~w1xGjem@bXm<L0{6F?XJij|g-}WQZvFO{
zNF%a=7VAP{#49Zs8Y4}$BHlzMtJYoN4yEF3o=u>m$#4Bafhv7>Y>h)lQ?A#7xfSlj
zy_!SU452S@q=71=&Ts0awBPmjz9_R3F`(Vn^6S`O#lnz@-x+ZZfh{D@OofU?WarYH
z<*>3uD3}N+3C=Jl&p_ynT0_igmY(F#^PxI{8zWOgU}oIt2)a18RZ@3vv0fb6Gg2Ck
zGV*NfK9ghq@P_0z5X#Qd2JdIyZe1Q*$sUtYlr{qM-U6Z0gI>q(u2<B-M2AYREFA*V
z{}shg%6H9dtv;|_nH08pm>EExRD<jTCNhdWT{_@g-B@lnphQ~fAvd`Kj8#G;7oLbL
zL6Z3D((YMJP#wpOSrrfs@iKcg!ITs3v_fGu#ONs@;kcCQxe_BKXlfQ>1?AZ|vrb#V
zvzqV^wADILOPd^Na$r9$$j|rl>OsUT0CL@0>Zzeu2pmOkXQaxf2(IsyNMMRZLSg+`
zppg4A)EXSq?>q_o8o(|Gkw5)Y*Hdi_YVRH2E)Dqy@U?{jWPnpuLFaSih;bUgT%Biw
zOH+YGd3%sbfr1P1@xSS9*!gm$KP+-GmxjvU^K6VO<lw;jx~8?tv_Si8d9W#OQ$$*R
zR{}=sVD1D9BXNV#OEHj@fLY|Sa3>PbH{Qaz8$@hsd8>TqYsjV@Sp)FME$!pVY0f|U
zEj)=E6TOXG*Qu|p<0%QmV`G=*;kR(m&75lGtl?Gv-ps8mmR?y)70~A|9oy%QQ0QG6
zY|-<@nxU6m-F~1iDG)pj*-}diRIKQ4v;^Qg<C+Uxm7%#JdDP&)C_2+X2KFSQ42_zy
zZmXi44i1$v>gS@ilESw%_8%_QBLbw1cm(vwx}WL2FVqM68T~1U3N%Rba$_aHg=3Ad
zIwA}p8{d}z<9PhsBk3!Z?$3bRxeJxblpXLt^e9Xnm~2d0L9A4SlR7e(3AZ#0$F*gb
ziBKJj6ziClX*g@#b09&C2QnIZic#n1W|-smE;o%j94Hu*hd#HCrY}+2oKXX7%pU)q
zQq*91E%ik)t@KVSf&MU{UpC?q(4}LTbBQ$wRSv3jk#Co5gzF5@z99Q40lNg;&!1wk
z(*7))j1W2bdqNWLQp;KbJqAk==cY(`k|QtH{pvy9a{_%X<w^9C=tP>|KUIMfCO#;#
z>S&Wy{X`oeEAravEf(^@wCu9nAN_Ow+m5!~M^X)eeidgmv_b{A_52nckr)4I{o*;$
zY7^RBtksO(z54Ce<R;h71uGz1IaM*Lf#4twoKP`$q7J>As0K6L6KB7_7CZYladA3-
zEg`DIWNv|J5b9(3T`~w%z~WycF8?DRXl#jFIm0qr0#q=KzPv6SYM2C6<jE6H65s&#
zzKanL7XZ`B&aUy^nss{oktGPtd|r?HjQJ>P{L(#Vj}$Z~RqQ9wTTPUR-3q|9`s)n;
zvtGn_iOBd<M15FT`qakt2miOt%41Y1>P3k#80g-w`y0~taWE5?8u%i+_b6IZn`1T$
z=uC~Jq;3H1t5}5$%Bm;))aDxm`pLaK0$daM#|Mbe_4UgpmQNWv^8_*JM?e4hK)c4y
zdZatG4Pb9eNuAa*L}HXi`#)zut1e6N2%?*8IOwFQ_&hd3Cc+Ah)B7XKgzJw#;|7p-
zF@hz4W+)m-Ta$rlqL$0p_xHvK&dWQO0(JAGWuUGgIHd?Rr)HdL@i`7Mmt~IVmfO3i
zN>N?_%WwF$XjvYzHntQb5x^#1Y%E(l>wc+G2C{b|68xTt4tA&6Y~)p<=g5@icmgOg
z@Q$_3v37m3nmPg0uv=HwsFO*H33N(}i}^u`35~pCXuq+Wlm>I3q7!u?PA?RuEQEua
zS-U~@{FbYq9ERd?$tiOHQ<sV2*{FAp<uPKP;N@yrBJHeUaPjfiCzaZJh!EdyZAtzK
zc@$HMLpy{}^~IGIC|Qy%^uh7;CwsxD#k?G0BpS>7{iJe?h}(-vyR24$EZh^1tH8?o
zD0{R@iCnDpw1cH0R9Ds~YR3+Tvxf?SrY1fp8rE^cKU(=-lVJMWzKC)jr^$e(XdqAd
zqu=cbK4;JBA_6=TW#x;sh|Dbb^faZ2>wmv4{QM8nYkL+N1<lVr=M`;}e?dd$PY$AG
z5XUruHv2tySf{-s!(e)7==OKwYcb%np0o!3wS)@ByRvGe`_l<vn{9+abwtCn?*sAw
zu~#$N+b`<*g{r_WF&OT>sv!mQkZAJkY0DL0k@t~OuVmwRK0s7g*UhDT*)w=sgFvRe
zj;DSzj-K$0Z1@tG0%NpVJROat&2d3s?Em{B|HwtB;q}QtraYE@{!KMaR3!JzM`K6q
zbgFAoZu&264ATVW670%NZEOPQ+VKO<?xZza5TISOoMGZ~8XjQf<GGzy6`gQLHsZ>C
zNtlZp*MpJLMcIW`uD@T>P@XMZTgeX=*$7SsPaMtkcWc-Gm02aQ!@C>OsgetCYgBD6
z>QMB^$y{zrb>W0}-+hy8&MLg_XrFMap}|@cx%T!wmWwpc)uZRi8Cr6Ywp9LyM%Jk=
z%{vq7vvJ?&ya%F1tTn*AELs~MZB&uw_2-Cft<p#oKxap6wGiuEsZrxq{f-9jKF%sU
zu8pN&7|qQN+9XQADn?lN1Y4cAdUA&T0eh=#oa5%~fyk1~uzH7CqzgV9(Lq|NPme-{
z#hl-Eh@Rg)kIkT}eTQD`PmZF`#MA6WtGZ`of^0|Y_Ni0i-hJ-?VnuVDa*!nkG+|#i
zYKh#9Wr)qrqj)`SgfE|&(rqQG?PO18dTJtVYzi(b+v>urXtN7BrGbD7TehwefIz|j
z3qYr<Y^h?;4D>a9SDh`t5PSUe@6kw@eQr8b74e=M={2VUjmhjHo?Fq;IJJPm>lPv;
z51)Bwjb4T=Tbp(j+mqFJ{a1Z_HZ(ST&FlXzDlb!95&vFRYSM!Bly~@-);Bi%w2Wk+
zj`Kvh_1?~OORK(6^7tLWdH4^OhKQB2%NV7&;qdiytVOUXb6o9j*c0U8QR4nmub}WP
zPe~nP?GBBDHYLs7=Y&P$A;z6Aa(q;7W@e;^`s8N#^wjlvou!6s@VF80HNoyF$q(3l
zPGHh)Ad*aH81FEZx=bPJR-nP*;mRiKTbN+w%SD+2833WMfAP^f05AiCC<$hqvzyrE
S!^m6!%r<V@kok>c=)V94XUhTr

literal 0
HcmV?d00001

diff --git a/packages/ui/scripts/markdown-images.browser.test.mjs b/packages/ui/scripts/markdown-images.browser.test.mjs
index 35e4a36a27d..dcf12f870a8 100644
--- a/packages/ui/scripts/markdown-images.browser.test.mjs
+++ b/packages/ui/scripts/markdown-images.browser.test.mjs
@@ -98,6 +98,7 @@ before(async () => {
     'badge-strip': `![Badge](${imageUrl}/badge.png) ![Badge](${imageUrl}/badge.png)`,
     'layout-main': `## Image delivery\n\nBuild ![Badge](${imageUrl}/badge.png) passing.\n\n![Screenshot](${imageUrl}/screenshot.png)\n\nFollowing paragraph stays in place.`,
     'layout-side': `## Image delivery\n\nBuild ![Badge](${imageUrl}/badge.png) passing.\n\n![Screenshot](${imageUrl}/screenshot.png)\n\nFollowing paragraph stays in place.`,
+    'screenshot-saved': '![Screenshot](/tmp/screenshot.png)',
     'angle-saved': '![Screenshot](</tmp/my image.png>)',
     'title-saved': `![Screenshot](${imageUrl}/image.png "Screenshot title")`,
     'escaped-saved': String.raw`![Screenshot](/tmp/a\(1\).png)`,
@@ -163,7 +164,7 @@ before(async () => {
         if(mode.startsWith('badge-')) await fetch('/badge-attachment');
         if(mode==='geometry-saved') await fetch('/release-attachment');
         reads++; window.imageReads=reads; return (mode==='attachment' || mode==='read-retry-saved') && reads===1 ? {ok:false,reason:'read_failed'} :
-          {ok:true,base64:mode.startsWith('badge-') || artifactId.endsWith('badge.png') ? '${badge.toString('base64')}' : mode==='geometry-saved' || artifactId.endsWith('screenshot.png') ? '${screenshot.toString('base64')}' : mode.endsWith('corrupt-saved') && reads===1 ? 'iVBORw0KGgo=' : '${png.toString('base64')}',mimeType:'image/png'};
+          {ok:true,base64:mode.startsWith('badge-') || artifactId.endsWith('badge.png') ? '${badge.toString('base64')}' : mode==='geometry-saved' || mode==='screenshot-saved' || artifactId.endsWith('screenshot.png') ? '${screenshot.toString('base64')}' : mode.endsWith('corrupt-saved') && reads===1 ? 'iVBORw0KGgo=' : '${png.toString('base64')}',mimeType:'image/png'};
       };
       const preview=mode==='preview' || mode==='signed-preview' || mode==='local';
       const seeded=mode.endsWith('saved') || mode.endsWith('saving') || race || mode.startsWith('badge-') || mode.startsWith('layout-');
@@ -456,6 +457,54 @@ for (const scenario of ['remote-saved', 'local-saved']) {
     } finally { await page.close(); }
   });
 }
+for (const scenario of ['local-saved', 'remote-saved', 'badge-saved', 'screenshot-saved']) {
+  test(`${scenario}: clicking the image itself opens the enlarged preview`, async () => {
+    requests = [];
+    const page = await pageFor(scenario);
+    try {
+      const image = page.locator('.maka-markdown-image-preview img');
+      await image.waitFor();
+      await image.evaluate(image => image.decode());
+      assert.equal(await page.locator('.maka-markdown-image-expand').count(), 0);
+      assert.equal(await page.getByRole('button', { name: /^Enlarge image:/ }).count(), 1);
+      const source = await image.getAttribute('src');
+      const url = page.url();
+      await image.hover();
+      assert.equal(await image.evaluate(element => getComputedStyle(element).cursor), 'default');
+      const evidence = scenario === 'screenshot-saved' && process.env.MAKA_IMAGE_LAYOUT_EVIDENCE_DIR;
+      if (evidence) {
+        await mkdir(evidence, { recursive: true });
+        await page.screenshot({ path: join(evidence, 'click-image-ready.png'), fullPage: true });
+      }
+      await image.click();
+      const dialog = page.getByRole('dialog');
+      await dialog.waitFor();
+      assert.equal(await dialog.locator('img').getAttribute('src'), source);
+      if (evidence) await page.screenshot({ path: join(evidence, 'click-image-enlarged.png'), fullPage: true });
+      assert.equal(page.url(), url);
+      assert.deepEqual(requests, []);
+      await page.keyboard.press('Escape');
+      await dialog.waitFor({ state: 'hidden' });
+    } finally { await page.close(); }
+  });
+}
+
+for (const key of ['Enter', 'Space']) {
+  test(`the image itself supports keyboard enlargement with ${key}`, async () => {
+    const page = await pageFor('local-saved');
+    try {
+      await loaded(page);
+      const trigger = page.locator('.maka-markdown-image-trigger');
+      await trigger.focus();
+      await page.keyboard.press(key);
+      await page.getByRole('dialog').waitFor();
+      await page.keyboard.press('Escape');
+      await page.getByRole('dialog').waitFor({ state: 'hidden' });
+      await page.waitForFunction(() => document.activeElement?.classList.contains('maka-markdown-image-trigger'));
+    } finally { await page.close(); }
+  });
+}
+
 test('offscreen image performs no image request until it approaches the viewport', async () => {
   requests = [];
   const page = await pageFor('offscreen');
@@ -558,16 +607,16 @@ test('image frames fit narrow viewports without distorting screenshots or limiti
       });
       assert.ok(Math.abs(geometry.box.width / geometry.box.height - geometry.ratio) < 0.01);
       assert.ok(geometry.box.x >= geometry.frame.x && geometry.box.right <= geometry.frame.right + 1);
-      assert.ok(geometry.box.y >= geometry.frame.y && geometry.box.bottom <= geometry.frame.bottom + 1);
+      assert.ok(geometry.box.y >= geometry.frame.y && geometry.box.bottom <= geometry.frame.bottom + 1, JSON.stringify(geometry));
       assert.ok(geometry.frame.right <= width);
     }
     await page.getByRole('button', { name: 'Enlarge image: Screenshot', exact: true }).click();
     await page.waitForFunction(() => document.images.length > 1);
-    assert.equal(await page.locator('.maka-markdown-image-preview > img').count(), 1);
+    assert.equal(await page.locator('.maka-markdown-image-preview img').count(), 1);
     const dialog = await page.getByRole('dialog').boundingBox();
     const frame = await page.locator('.maka-markdown-image-frame').boundingBox();
     assert.ok(dialog.height > frame.height);
-    assert.equal(await page.getByRole('dialog').locator('img').getAttribute('src'), await page.locator('.maka-markdown-image-preview > img').getAttribute('src'));
+    assert.equal(await page.getByRole('dialog').locator('img').getAttribute('src'), await page.locator('.maka-markdown-image-preview img').getAttribute('src'));
   } finally { await page.close(); }
 });
 
diff --git a/packages/ui/src/markdown-image.tsx b/packages/ui/src/markdown-image.tsx
index f332e0ff700..17af0c859bf 100644
--- a/packages/ui/src/markdown-image.tsx
+++ b/packages/ui/src/markdown-image.tsx
@@ -21,7 +21,7 @@ import { createContext, useContext, useEffect, useMemo, useRef, useState, type R
 import { Button, IconButton, Spinner, Tooltip, useLightbox } from '@astryxdesign/core';
 import { createMarkdownPlugin, type MarkdownExtensionNode } from '@astryxdesign/core/Markdown/plugins';
 import type { MarkdownAstNode, MarkdownAstRoot } from '@astryxdesign/core/Markdown';
-import { Maximize2, RotateCw, AlertTriangle } from './icons.js';
+import { RotateCw, AlertTriangle } from './icons.js';
 import { Link } from '@astryxdesign/core/Link';
 import { parseAttachmentResourceRef } from '@maka/core/attachments';
 import { isRemoteImageSource } from '@maka/core/image-delivery';
@@ -158,14 +158,23 @@ function DisplayImage(props: { src: string; alt: string; onError(): void }) {
   const copy = getSharedUiCopy(useUiLocale()).markdown;
   const [loaded, setLoaded] = useState(false);
   const lightbox = useLightbox({ media: { src: props.src, alt: props.alt }, hasZoom: true });
+  const trigger = useRef<HTMLSpanElement>(null);
+  useEffect(() => {
+    if (lightbox.isOpen) return () => trigger.current?.focus();
+  }, [lightbox.isOpen]);
   return <>
-    <span className="maka-markdown-image-preview">
+    <span ref={trigger} className="maka-markdown-image-preview maka-markdown-image-trigger"
+        role="button" tabIndex={loaded ? 0 : -1} aria-label={copy.imageExpand(props.alt)}
+        aria-haspopup="dialog" aria-disabled={!loaded}
+        onClick={event => { event.preventDefault(); event.stopPropagation(); if (loaded) lightbox.open(); }}
+        onKeyDown={event => {
+          if (loaded && (event.key === 'Enter' || event.key === ' ')) {
+            event.preventDefault(); event.stopPropagation(); lightbox.open();
+          }
+        }}>
       {!loaded && <span className="maka-markdown-image-loading" role="status" aria-label={copy.imageLoading}><Spinner size="sm" shade="subtle" aria-hidden="true" /> <span className="maka-markdown-image-loading-label">{copy.imageLoading}</span></span>}
       <img src={props.src} alt={props.alt} loading="lazy" decoding="async" referrerPolicy="no-referrer"
           className="maka-markdown-attachment-image" onLoad={() => setLoaded(true)} onError={props.onError} />
-      {loaded && <span className="maka-markdown-image-expand">
-        <IconButton icon={<Maximize2 size={16} />} size="sm" label={copy.imageExpand(props.alt)} onClick={event => { event.preventDefault(); event.stopPropagation(); lightbox.open(); }} />
-      </span>}
     </span>
     {lightbox.isOpen && lightbox.element}
   </>;
diff --git a/packages/ui/src/styles.css b/packages/ui/src/styles.css
index ddcd1431469..fb1e3960328 100644
--- a/packages/ui/src/styles.css
+++ b/packages/ui/src/styles.css
@@ -665,20 +665,11 @@
 }
 .maka-markdown-image-inline .maka-markdown-image-placeholder { padding: 0; }
 .maka-markdown-image-inline .maka-markdown-image-loading-label { display: none; }
-.maka-markdown-image-expand {
-  position: absolute;
-  inset-block-end: var(--space-2);
-  inset-inline-end: var(--space-2);
-}
-/* Badge controls remain keyboard reachable without covering the badge at rest. */
-.maka-markdown-image-inline .maka-markdown-image-expand {
-  inset: auto 0 0 auto;
-  opacity: 0;
-  pointer-events: none;
-}
-.maka-markdown-image-inline:is(:hover, :focus-within) .maka-markdown-image-expand {
-  opacity: 1;
-  pointer-events: auto;
+/* The image is the lightbox trigger, including keyboard and touch activation. */
+.maka-markdown-image-trigger { cursor: default; }
+.maka-markdown-image-trigger:focus-visible {
+  outline: var(--focus-ring-width) solid var(--focus-ring);
+  outline-offset: calc(-1 * var(--focus-ring-width));
 }
 .maka-markdown-image-preview img { margin: 0; max-height: 100%; max-width: 100%; object-fit: contain; }
 .maka-markdown-image-loading {

From efe025cb2e05107d18ca69dc7222a6052cbabf12 Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Wed, 7 Oct 2026 20:08:56 +0800
Subject: [PATCH 23/37] fix(desktop): automatically load remote images through
 app networking

Use application outbound policy and proxy routes for transcript media, permit named VPN fake DNS destinations, and retain private-source checks and archived replay.

Generated-by: Codex (GPT-6)
---
 .../pr/chat-image-delivery/remote-after.png   | Bin 0 -> 60327 bytes
 .../pr/chat-image-delivery/remote-before.png  | Bin 0 -> 19007 bytes
 packages/core/src/image-delivery.ts           |   2 +-
 .../src/__tests__/chat-image-delivery.test.ts | 206 +++++++++++++++++-
 .../__tests__/execution-composition.test.ts   | 143 +++++++++++-
 .../src/server/chat-image-delivery.ts         |   2 +-
 .../src/server/chat-image-source.ts           | 133 ++++++++---
 .../src/server/execution-composition.ts       |  29 ++-
 .../src/network/scoped-fetch-transport.ts     |   9 +
 .../scripts/markdown-images.browser.test.mjs  |  33 +--
 packages/ui/src/image-delivery.tsx            |  11 +-
 packages/ui/src/markdown-image.tsx            |  11 +-
 packages/ui/src/shared-ui-copy.ts             |  14 +-
 13 files changed, 501 insertions(+), 92 deletions(-)
 create mode 100644 docs/images/pr/chat-image-delivery/remote-after.png
 create mode 100644 docs/images/pr/chat-image-delivery/remote-before.png

diff --git a/docs/images/pr/chat-image-delivery/remote-after.png b/docs/images/pr/chat-image-delivery/remote-after.png
new file mode 100644
index 0000000000000000000000000000000000000000..b9d4268f04917a8f5007f42b3b00d5a744a77825
GIT binary patch
literal 60327
zcmY&fWmMGL+a0>Qhwkp~p}V`gL%Jk}?x8!R8>A(b?(P!l21x}(eU*Fff35e!e3@^*
zb<TcvJp06|tIDAv1Cap$0Gfilv?c%mJ@@CQj|lzepP?1mU;qFUpdc-w?U#S?(`9A9
z3!Ntl`ob6SyKTKS+4xo}6iuls6^4cm1?}eNw})y==x#GtqnWh9u}oC}%olPj3s$v^
z-}@oIzubKj_~lOe`w8<Y<acM#uRAq?;9pPAPD5V>qw1}q(pGLBR%^kHEd0$B-&t&f
zG)-t9LyzkWgBwT&k7w=Do6rSkBn%8{&QnjjjPZ!sq;)KcpLL%G<*XGNwB}TK9r5^l
zairw7mNm39ho9RB41V=JytStKeLNB_t~dQiB$`Ad;__33103#hO#1l574pkFbI(dg
zg!Ag`8<2-Tfh6zVGtdwJgdv&Uw)^YgyW<~YOwi>chho4Q(7SLc%@1pwG#x~O_nF5t
z>vt0Yra}8X&*Hz||DH4~WEwOiV>#ai`c>SyE93Sr<|P%NXat7hH{_h3<eR=v?c@2h
z<!I)1_(c9uct+J&j4fdZdnq4}E%{jjj{;RO#`|*iJtsD04d^89-5`8Nv8w!mdy#of
zhPNo*BnAUJczUl2XA7EP0%u?bKQj)=P72|z<eXZJ5y)A5>`0JrfvO?Yt<9G7ovmXB
z(&r;(KiH$)?+%Y|XgnY<LCE{HXVMl`N=&oKze>V}3hM6GR6hTD*F+6^Z$U(;p8yQj
z^UtOVb%$t{J{~l5HDh?r6zYk-|LARMFd1HMCP2n|ev_Mr*g$P1u^P~TZ&?2Y9<iTh
zZ}0OLoNF)~b*Kd=2Q@3;;D-Db+5AN)#~bPp2ZU?|NQz|yTLJRvMUu;D<#?M})B+Cr
z#9(YDCPUodg{XAEU(W{U84E$!YbYjM@ESZJ-a1|P3iA`r+4KXy<u!LZ8|_nVid$5r
z?}71i$zQJsP}JHOGJCX1--c54YeLP5|9*LXV#U^!n2kqA4?9xZMEp4X&W;gVBo*oQ
z{0>A6qsV=(Z$?7BU#dMbCUHDX7vcr&=6HW0Q+Ocy{?FN+_cUiBD1CAhF}$9*YA!uO
z8IzyOemN66m-ykYs{oHvL6Ag*l$&Qa<+fLnFgbK9T~1-3_>#@h1g|nUIFyC24_Fy=
z0G8A0%w=zB(H&7JwKTt|f=w3&cWKluYmwGe9}z;40khfMd6}cwRv{FGicXEfp;QE2
z*g2s|7aXW#f&rd23-U};kg68+1>zrKMXqX7^z;w`Hx4Ks1m`EXk}=W@l!v~vpTKoY
zv}jgxUie)zZ9@92-VKBulJD_T5O0h8#WIsj2YdUzE`qniH?N20^}j<KrH&X4G9U|z
zS*ML6yo@<Nr_rw`4=z0HB%O4P7~8q~v<~eC1yFvDiuT9;Vs3Bn&9sR630q`Cwgl+{
zC9G`XSCfBORDWPWl<S&DxU6%Z&o^%xp9z6Wg!z{zal-X5MUNftd;SwzFvQR*D6$0F
zA9<k{^JCZKiitFY8rRyJjP9!dlkb8Ix;tMIf6P8DcA^i>o#LLts$ZYPjsl(u3|$yK
zFkdPUAard__gm(>CRW0|Shn$F2VPf5?X>tXM(XmxNYQWIw1FbBx26w0&ny1Rx7Mcw
z5IK~-B~*BWQYi!dRNaLDF^LD*<tG-QYKo~6kUIBshUh!D&h+75_|J1FPC6WZ>3FWh
zp(%~>Kp|ZQayBZW)EgiV9qUG^q2o|xkhvsI@@mwgF!R6%Ak=CDLBdtTS2r<qq9<mR
zh7*SqSUhOa<{Q$u31wRc#QJ$v);%0u7dbmek^>QT<U}@0zXdzea;$UUXYt!-iqDmc
z8)fwgSxU6J7#u2Y-%(|Q6MKcF&}?`(5`AZx&;1{U?`jUK7uZRX@UxhC9>ds+4k&-I
zmvEq}s!>v?RB=3qrSH%X<?o`4+e4|$kCPzuLs33fMa4At^s*%QS;T!J7y<}~>08R^
zwCL>bm=&3M=HfzX%Y{9ZW4I>Ul=!s9j>>}U$1tyuVWDD&xZ8jaP87Pa%wTkHgy|PT
zOL`4BNt`1VwtW)wF!yZ;i6#Uh<V1XWju>!NmuR9QFl+XW^jPE?2n#VV&xqUz_mjdD
zzgDUeZEHE!nXP?OpvQ`l8NBP)VP6l-!4laP01z_rfs$eHyJA&wpRh0}sh0M5_Prmu
zpLz&xIO`7LlRpz0)2MQ#aBu=-UXYk95;Ux_UG;;r_ZZe2)?j_t`WKOJOh7_qlw&>S
z_@>i^a-qvi)sRrF0zcaqE&VJNQ~C;3qBJR{Zmv>1K_7ePskK(c<s*%1k<$$Dba(oe
zIk#;-fAr9tjW&WmstR=e&0>U^6p4Qv7L~eNBLR!;0P9y-Z>_{3m9PHGcW1)KI+JOC
zrdc8Dy>^-?&2CKKHFQ2p>Dmd{<QPZI9jov%a67ugpy3Q5h+(l><b5r$ffts1C`UY5
zT%Q6AP&F34qr&%hNsiTKL^@;;&wv+mXDm!1ODU%TOLuPaTRQoF%3&xzgD~0y?YTno
zz&!BtoVs6<Is_ABN`8Y5z}&?WQD;9)VXDw?zTOT|3#C|-C^nAeOT81=J2-iX#sWIR
z`MOaaR(TVd2JG5dyV0){b%P9^EgBjp-kk@p^HIHbgU8Z8qh^vg%fKt=A2|7O{Q2sC
zA9fg`KN(JYa)kREXE|G#CgD-Z88CH_Mqc!ms8ucgPBP}<#I8piW=K6*%`ZhI)JZ~^
zZ&!8;+SYgvSC2Y((v5{ox{9X^7mVev%}4#EKPak9R^oYNd%i&h;W|AxCgR&#B^nLe
z1as!$*5V8COrUIVk@pDHPT%zz9yVqK%a(dLg%T>E$Z}%X^N=(aG(z*mowkzf(T5E6
z=dIAmqkGsL^nTlSXk@2El}$kWx9Q>bV4^wkMJ8MIVX1=$pM1~LSO<8U4*`F1zWoR1
z#ttZ>rL>{eIke-&1NR`9k?Y3JwM|U#lpjPRTOzW0SJuH{4_`4SV<m7LFr@-tfM6E8
zr7kbnmGwmi*Kt0&%Nbo=<0|AF`}tg?ySltJ>M`<LD(g%-;_RdtHct}y31Zk;=RN>H
zSPxTn%q(B_u+AdP%Enndv8S&|W|N74DibG;Y2w6~`UEe21j6o!NN8%kbc)=!qx|W!
zz`YcFP*@2jc7b9M{ZBeCnCI}6-%Dml(`hNF45_)PpNN`-mlgPC<=S$QqryjVQU5>R
z7)^+>w)go4h@8xrbCnq6S_g%b3813v!Kkn`#-!)(jp%$wazzLK7ERe!r*p`Og!4IH
zGNW-f?#iT+VgRJrnlvW6N$>*4xXs(Y!ETO~zeIdMl5#DC(pNSPFU|ez+bBnx&7qAD
zkk?xXWta=O91kvAm@^-9Mt$@W8W==cwe}1@*3|Pr6!>OCPw=>Tv}Zd^p6Dms>_gOB
z@WEeoXzLII5uK1GOT-`?mA7XEtqWN(Hwe^nq`xHY7~$IyqD}ldjR*dn#vzh%^7hpf
z{m!EHG;})#Vsr{<1i$CQNn(Vl4|6$i2Mt}g<Wi~aX@j@&k1};w_FJe?2DSqwIneNJ
z0DA{Kk>riX$Q(Ec%W3*NPKb`5k$YFXwUB^~e3~>```EzvWWhXjMe``lSVc09L)1|l
zMAIqUq+)oOfiso_9_X7jvm<s6Q<o94oLd$HgX3zTBoM%w@$_3=`P3^3D8^$;g>1Hr
z9LBxgR(Ve9K&mow_MB}B?Ms?Q-q-tgs<FTOcdE5ZTfB?iLK8b;bkmuv?dCehypx_;
zm?oL>m%oMu_URiUG8|#?q333;<4Fi3^A;1sLi))S<O<Hw=S0@D_^}0ck}jOcxrOH8
zig#o?zr&3uw_=PhLRsy3h7UGlttq0o!J?bvs!|2bk1XjdHYMt1mNkCr%6I0Kt2Z|;
z4akp{RJi|EEDtvdb)>G9!T8O*)NWxh7sb<PydKwhDLHxsC%^Y)W0<Q=&~Uc4P|r;0
zecfUIA1ax}=U?asbK-(Tz$6^5LROzv)JlDH0H)GStl1z0P8RY>2_ais-MP%3xrA)B
zGHKM+ajUHyNkjEiMp#hLt#g(hQ32xc*HE<*L>Q-d1`-95X*0dXULgdI#GvsxOIQ|0
z*pH(~juKmKhF0>Mg5CfN&MaO(-i5=|?={T!wO=;V!W83P1X*^63kssXltfJk8d%9)
zD%Mq?_o1<6CSrSf&P)BsT~P+O35u^cv}(u4Ji9rPS=%%52eo4ehduP1`9EabP5e>M
zKL>97pe6}FJ$XY7O!c)i#Y&B#=T*!pjJh@mC&XCNY(968y|m%aAhsFveFcNz9Q7s0
z2fSED2`;A$)4$EGD+^U}8<nsJW^)~~F%WB2XG9UAFfy8xufg6U32wDef<L#SsbOw2
z+C#^c94LB<U>zqJ24bf_1Ofcy*nUt`G$ZVR2R`lx&EkIJD<`fw*2IgmhFOuKZ~EOM
z*Xo<*(n2*#CGol70R@MfMiwKzYvu?U)Xs*f+c;ubGKr`GimEDCtGL2z)@|gZL)*Bk
zIbP<UVRrIwyl-BUi(ktkB&uu7K?A5cB=;W5c>vrR<b_He+}lVX($Q1Q2J&?v4mnH#
zN*Kibur_TBn<H<l0`QVen<`8Lo|I=37yTK+O`0Fn{kxeAXa&QR{^)x3cUzM<K~=>s
z4zOxO-DVoXx{|)b63hx}Dkv1Z9azXc+;fUAAS#`n*(vD>lffy(erMKFg5qzIoNjc)
z{BzzjJo0*^d+RCIY(_yB2pWTL@>s~qh;SlSz&j_)YzC^*$2;nJ8I&8ZV4wL<dQFZM
z1+YU)C%6fj7ktyBMqDg)?hIBrzn7eGIL0V~r(DwiQaPD9ZZ2f2DSKP4bF@c>fBzzz
z(}rYJ>puu9)UZmE%GO@sGNWaeqV8KJE&p;fz)!zYh3Uo<*#)E1h$)T`TZ@Z5&{=!P
zbD>K65|L@njNanJphT0<Uj4n9yZ`VvVVMrg)~q;8%BS?Ju}6P9fntqVTXHlg$bn;>
zAGE$;gv6ns<NL-9xl+TiLvZ8GvAXJ_JjlitM)~vL^TO8MR&_?|j8!=mo`P%7_CKdo
zn|Z9*txd*?)9-!{pB9yk6o$h_5{3fJ{DsPQW#r}|-*PZAu%nHE{Q$m#V0kh*uhE|6
zGwM|QH#32ZAa*U>k<@obL_CLvf*vkuxiXzc_b>($%JbBzy0WPm@#1&%OB?dHq?QZT
z+1*(M_yX@2s%wWPnwx^PU7Zzx@dY(g?Na$BUUXWDN$yK@84}E*cn52>%!??=*FE9r
zWneG6I$3x9pLN0tMR<b|i~s_x?oPur)oW}2o)L>M`n1{ZY1uNfz;Az%)b>YU{+$X*
z_#bM^dFsL{Br~;0s_Cc4qf21<oC-Czl$oKh@F7yec~kNf)}wT4l4(&-Wykr_c=OhH
zrdjs9u(%*rDz*<fEb=^{RE{}&3Jim;`WepyDbSk~uD&qYc|nK&vVh9Dk0t;Y8!0yP
zW~*dLRvr#H3Ojp55++o;ii&s*%<;A0^?(feTxmVZghvQPVD^4^Q66k!yIG<s#e{fV
zRq_4Q_B8RSV{ln11?!pA_oayWa`-z})TR2P1GO}(^}k2sJ5!rU|LW2D1|_c}<Wkb9
z!jyi2>#zpe-Aqm%M~4{v?60{Kv$nXIrTQZ3h`gfWnt}A)N;K+h2a<A0`@3@W%yM&X
zM1C3@q13PpIFTMW7_{trSH=ij<Iwq{goHTmAFDD6L&xkPvhlHbu<Rbn7X}i21h>Mx
zMfcz)h(Rp69x=Rsn|7WRYKdcV;<|j}<-oaPH`}+YvT4|k9*g*9Ph;;pjxb{or8sOY
z*DqJ)O%s^3PjW8aHIa$0w7=Wq=-+(*N6Z`&^kJ$;I>)kwMIAe>wO4G6`(|oqKMPUD
zF9c^qaV20zfdVdKlV#|<Lbr;T%Cv`UHXSD`x2(@~Lt`U2V}nIZCQ8NLPo_{{%5x*S
zoQG^_glX8pOT)(507T;vmSMCBcI$r$Qo7f#-}O@4M-bkEHisq9yko+;UygO3(MZFC
z-ZnZO6DBD?*mqtePmlbx%%g%m8J2G8)wk*EKAyrPrA$EU#A~)F6?q;y*h?KerV-jt
z<=W87vo$WIzq$M?HJ$!w=zkJ{oLPc5cg6=t!x-1ipWJSJcY!1&YfRYcaLCd_uoo(8
z9@F>t=vOi+zn1VmU<4`=8pg!8L0bzy`CE3!Ca~ZLOuWC+Mgu|1uDq{+NGy034S2QT
zA=-qUXTX^2kp9@g%?g(YMtw{#?ipxRqca4^+5#?UwD4GCCb{(8v9mluSU)RdLOQ2m
zu`=kTT_dpQkon_JLgS8p<<u5$NiQiBIxL!z8g8clrrNQb+j${VPD<aOWttDH`&oyY
zr#R)(5mc?sRT;*mEWfA^sx@zHk_34DgP`75F6vc0oZs{EQ7f63To@N6xMv|&7{<*h
zd0NEzWU}q5=mFzFCl}G923HHE1M-lp{l=PrRI*saimWim)GB?O@4v<quJG30msk3X
z{O82af+$V_QdkV)6k+{~EiV)|{0ej{JgTir{i{Ajdf#RWC8hLQZJDR~{N2$oVc}nn
z$y|LLO(+_0)JUsS%vk603v@50a`e%|!^3O8_ZA$2AYX_`koIqz$B!)|)Ca<~Lj|Er
zhTOSCR^wC=HfAX%jXreg;tBAyd-9oMCy@5e{e{x%A1M8aJ21oy%}dcrfDG_CMBu1~
zOEfK1rAoOqQiqtwkhSPE?wqZ@l&4?U!ip6^Le^`;j#BEJTxH&vv1wd1)A_Kjgww-A
zN^A%0se@mKmLspyc1oI4vFXy)gnB=q;g1(Tp^?i=)8DerVSXYVkJZgl8SANdE+Qg@
z3)ewLRnT#d@wuQfAtBi7SwR~LZNk&U;COE=pKxJj5>96Pi8-(JJa>5{rIat6I3FD{
zy>~d3I#i{IIb${h7v9mkK&9~`wDd=Vx!6qJYtrFk+9sm^9Jzn0d1Y$ZjHkwdBQVhA
zB%=Y)w?sD&pb3PJ*(RXAFiT=f!8%&l5lcgk)eF~0>|g+Qct|4j_7uCkUvzhsg)M{8
zov}`(r3=F4m6nrhnwvH(V|rwDxvd5qMe(%GBT43{0@{5mLvwTcj5Pv><Mn;XvU<f&
zn||7^jFXgAWu(&yDV6q6%=+40XBaPzJwW<kP@ylE9d>NRWE@AOH<lP92V}5|8KV^u
zt5tLgXhH4~@d_(nUO&O@->{~THDC!fSa*?HnIb;?EmE{4H{~rACgcS=m@b}++<vjV
z5TdWeXgVIEs#KnroiL})W+)+rJBuj$jVKf|Mj)d@V_<5;bPXC@4_qVHKIe3F8-w7T
zKynFw95fu7s_1r?wxUT0*LhIkwJohV1p4Ihz_+PWS|Lr0CH{b&ae<!FB+?{vet%`j
z8@=pqy|X;xz1!t~kfdvFl!Lrf*%bo!&~bP6PA}tiqJ8;aaCYG06J`w-SCOq&xaNra
z4$z5|c$z~u<a9wD@P+mDR@{NXRL%)i!EBkVR(DrQql+VKCWNU*my8}6y=FE~$sNlu
zZH)nEoI#u1;W);dm*bF3F(A4U(k>{qKOg6xLO=1kI*w9gWxNykJ@v&s!H>nW*$~+7
zoq;ZaqW(myH7h*WFRnahTiM>K>F?0D{T*>P$zS*C^fb(aW*a>te56da(?d=!*wul;
z+ez>8V25y$F=O*D7_$C=p;GZr_GdIU$hCp8llLwZTI%Z)SVm~5Q}6yr%8#euTB{n$
zSi|1x5}YAkG@)=}<eg~A9ZB#swBK21?(@+>yI7u0o4ctKW@O&^8*@r}Ib4oq%y-1X
zd|{#SXUFUB6?X5~9I%<ML1>C-MUh(@I}(jEvy%FqRiwKi`f>D8$R>x8&e~Cs7TXjN
z^o<Q^WVcR3E(gdA#G<m+Vd~r@oNMJXu`|lnUh{%l8<Z0=2ty$sCNEL&D=0>@<bf(4
zeW+ptjWO}{8u|V~f^I;@M2ifajA-IjK$&g1#LDK+fL|WW(*X@l$><%n7MsYVQKDF>
z^mV@lxB5r?ench{1wzn(1vdsx61&pBEYp=hWEL62j4@Jg)sV>m9oJGTuq<A?wFbpm
zo+c87-xrZC_%#}%!gtgbA*MO1s5fF+1(}FB`AB|8TTr!rm7xo<P8Lm;$x_f*o*5D~
zO_rYRrAP{<^UAYD0~)yZ2xzNOIhib5<51<vekmznVV}}QpxyB=tabf4sS7`{1V_X|
zqjLcgkww5dB?zOg`r<F&82!sPg{)vQOLei@&KXopZ9av$PSlo(pSccv4TMb2JQ7ty
zN(mNNpgl5m3)^4)J3=kibaC&MOq+s#2->Yd-9XzMTLOA0cfTa_=E{u_;-K6R7(@C-
zG~43oKaZL2Wbr1W?9ubt+E5|Czx*^c<^qH7%`7|I)ojYv<0XYpealWA8@{n7>|pV*
z(_BQHP3yp{Gn-Ii7VBf2pik*UXntV@_vMr2g;H^5l$7_N^D(Rb8T0qcJVR#(FU`{X
zty5wrL>Oj#kF0O%Sz1}#x$MNEPB%L%X^wV(ecTt`_kXO<rKW!?;798%Ix0i&7)*>v
zOs4V)$vEy!D!b|-g}4_~HzptXQ!~Asy`B73OW(v871}1VHAwgl!Na7Wc5Yd-f&#uf
ze4FEGSFeV)As80ORiBJkN9ZXYuwG0p>E}qL1LDUc0m#0Le7r`@6y_33iNDz)<R2_N
zJgH;CQqrvp`G%hGj9`$$-mmpmxlWeHzLx=xu@Uag{<ZlM&S|F@lviHN`w{Mjq7&{r
z4kE%IJBhNWR<f*;Nc2sxQofP0_)AvBbeM+OYL&jPAN8L(RU<g=3KCguG+x0+9pa(?
zeoNY|)|`>!o1kk+@ZD`7K5W}c3xx`4a9$&sd;6UuC36i7h&ow`FunjYqNEW@(B=5l
zjg*t{y{R@wD-%YM#GVWt^K4IwAw10a8aDN#CNrR5a5;#H{I|?1Z!5YZGL5->Ih<T0
z^qG9LI|7R*T7TuVZhzk=j=Yb*HV|NkO!|{4S$Wf%k<g#GB^E$)mLGCCV|p@re&}vx
z_zDy6Sqv|^CoG1RCd=(*lWa1+^5*yHR}Y6Wx=71MLi93tUWH<PKnwZFOTOw-Sf>nr
zjA}_WIa{akp_!hDi@H1(Wt6{x$86}72oQfV7fkqWg%xYHhPze8k}z?2V(tMf7y%At
zDnF7$mTL>N&e^sDP72QoB2{vV*Hetyk7I0c;Lrn#6)I9q)f|YKH>OCXgXo(YMo^t;
z%b8M#I#UHRZK2>0AWk&VtyC!F$^}8~hRQ2mco|zeYu6CZee~|n`vR_fSLiunldlLO
z{$J`DdU89MDKE6whhV@SK9_LphNuZH_M*%>&DM*VFCWuPET|1LKVX<r2CE#k#=gU{
z9dic&Y`&^mTa-o~fxlI?6A7+jp49FQ*jnlsf)BmEC5D84W?%nK@e~fX5*N*QJ=<Xq
zYUGuj7ctDkkwVHdqHe(NOv6h>Qq@kP<m}(Mg|eSYD15u1Sg+0y{>z=)`Ab~asv`9?
z>(CbZwEkuhf_JSfQ<Xm_UdLMBq!y&%{;!`Y_%9i7R%j%0VyAg7jNcyXzx2BovD6}#
zD7&t%GV23$vyl!fD1&nWqXp^6L0Iq~zHw!@SYASbC>-2M5ZqCmab7SVv!WKO8F*??
zJ`AEbuLnv`(#PN(8xu4X;Fg)LV8jWaQsJs&6)6KdgLBI3>>1P^Ni5%95W0!N`?4Z@
zAk$`o(!U=N#ARbrn)3y|Ta|xYag->WnY0q}X$IAD>KjNI>}Ls!jc@a~@KENypRTUT
zREV&;_<@`l+d%mO2$JJcfcRgrHyjqcGU)y*gTB}FZ>Jf{#TKGI3ncx%!Ad3nm86^Y
zpe45|b7g4=y-ZFyVk$5$X0n;aX`B}!^O81rPk?MwFzl@ZyupN8y%Z06$B1Z&q<%`J
z<vJKd7Xql-;gaMXQy=in?OrD({^b1Y8&!AA0r|a@)ZKwD`Wi7zjrGwUXz)3(E1Xo=
zVrU*>Ifi(Rv#YY{TmzOEIc|og&voymu4Z)w0j73ylO%YvS==N$Iqal?quj?*=(cWs
z;a>dw)YGjHP>|cxT#VEw!gR$<fl@!3#5>tT+%D~JZ_@{s%g^69ue}D-#K#%`D75vx
zK)*!3O=~L!4)d`B+33pVJDNcbmN$7|Qi__%+|D#8yA;=Ev}3CRr3bI5!0I}_5@hbh
zRVajZ;qNu*>FJ5EGAOQ-xS$hrT=5WJgUWILRiaP6`JZr1#yssy;R?bfOW1BXiZRCv
z7x|c%8;j1ee7a$;h``%us-D_lFO1gR1<Q}4{YrwcNIWXz2w(`wrC?-oZ3R(;s;xFv
z9P>`1Z}vVeNg9RdR9tq97T;Sv=02NKh3K%UZk-0#x{Bm*0P?{9R#5tXS5WaRP3~)=
z7IScqp$*{16i3>h139g3N28(izL+7ISUh9h5s?RfJVPR<E8WM@EqLbXcbm3^0RA;E
z0wy@Ux_;QpalJZB^gzBed~4RUULL;A06SG^J6D?k+H072BuLH*MMU+{M8Qy7=s5-J
zwyF(>O*7xm=qAM_8r9Jy^}JT141#r@x<jfB<tp6H7;X;>@+edzFQM+Z2JitCH-BlF
zA0x`bj*A`t>A`Zg2~Z2aZ_d@@W4FDJ%TA$_DC*JoSLNXSM>*&TMeWb0zWITA2iXe=
zFqU%>&4JFdOXuHEFutAol9|M|3Wq4Z56$nFn|P&1VQI-IPr+E&OtM!BI8FR73+U%J
zM^>N1_Ub>PN~b=lqPwhXa;aa3xHz?)Q3$=cg=rZdmiZ}=*YsSjD*4vb&gPK<4MCY^
z8yP3wQ^LW9+`|k*Z<<5@y)dU!M_O`5UT($1b#Fa9*gq`94gz<xI#+PGR@bC8Lv<;J
zH~eOLIif7SdQZMxL-d0--s1#ekRw71+RZDp?*6me<rk%mZ^Ax;9$RVa_fS4A9zF>t
z&eMfupwG3!;4msf+;uGuyouFfs@+frwd0q64N0W$+60xar_Y<V+0gF*%t!%spIiH{
z`3T1c^PAjG?yS?kxe2VJrU`T}!m#xoe56bplb*uhOAIumuCVVRIffbnA}utdcw(R@
zw?N(XxQR>S3D(GF_I{n`aMjp_n|e!P{Jqk?jrE#!FPqMuC*gb6cZ+lV!!)1o;U8Q2
zfn9DyCG&pl?*m`cUH*U5-6Z_swB0811K7y7#ch!#Av`&<vb&tgq}qrm$9$&L#Q=b%
zGn-soa%C8#qrKPTF&VCZd1OlPf=%^|%ip%@c_2L}!4a4Hr{EjaYB;DrYPh?)Z7i$^
zIle107p_c!2idBEb|byTUy(ZzhLQ)_*2wrlm9Z=|Ow-%VGn#50#*rQmdq!HOY(RQJ
zo838b`Ra>iY11g_#7N!qdy5z@_N;(X7)n|9l>x_M?u_Oumz!aa&{8T_cz6i#^*Ap7
z^9sh&bojsE*X0aKB{=a5(Ylg8BfbCVj<^c&<7>C}69y#5MlDjIP1=a{d+rk;BOVDL
zJHqFJnmo`tpc`jw{IvM~gz|JaBq=SC8z)pw?u5P6ccg=yt~nG;*-$xPX-C2{GS15)
zV@<f$ftGlgfPTmFsDpF*7I^z+&e|rNL23SvoK+mr^RcUK_!3<RY;FWUEPrscj`R6i
zGH`TiC%JajbNO1G&rG!|SWo}%#D(Za#{qtsE)VR^T2#g2mXo}qf8jL+Et(IJ9D>0{
zRrq0^L93L#W*;}p(iq60(m$kw@`b5X_2PId#-}p~%BKhj*kwTQ$w_pvb%atU9_eX8
zBy`xFF4RcZ76tLkTXYzr!y+iHTSKkd>YKMglv9ROK1f=V%o{51Z-^|A0kk6I?UTDR
zijB^syW+D5b84Hu!wB`WS8T+gDi;nnnTWi#RGN%I%hrH$-#c@PDbj0%2Z$$iP2e8Q
z8Wm)zGhWG-Aps`|S_9KJAP3%()Q_Bx3eZYs-~SS8@9QQS9}=x}@(?1fz@hz1{%Rjg
zKi^ah?PJR^Nm_smzIj9;MWTW}jc6aH%YqUHXkaNLS;H7fJ+asMA}APFqSnFbAENTi
z7bs*mtx$YWzfKU@BuqXLj%&<~Eg%#&FbuuNV1V}(3WJVyJn?Ig0lN!Y*t2`OHK_(;
zbWNcl=;j?K!}0f?Ul|619X;9Am#{SzDbeW*<6cmapW_{~>`0*<A?a1zn-e0+h$oXV
zy)0Jh$L>9uj>_Ldo+*kxG`e~s=iez?c2zU+*)K#SVTTy8Hl6%u8?4IT%zmQa;*JZ)
ziamY<YotPI@>|sn5kwdx5lmQ;$hI>z_FE%T^*KO=?!cRb*eCvX|67$ZC<)3O<3svx
zE>L#g>|PfiMxWJ4vIyn`Ljw%rEH@5mDECM>h;64QO%ML^XoT=BmR-|)4Q?cK*Glk-
z{w2t8gvrGX>^P)??k}vs<cR5M)n^f87;WboMns_9zHdlJk~~Z*fJP=9zG7=4Mxw0U
zBPt+07fP*{#&vPc=QKn2_TdY9ZSd;|;QMz3U=Zx#TMYb^Ht?uaF^=d~ec_;}5E=EZ
zcAL9g6IZH4{u)cuID0ipSe~*Y-4<~g6E}_79gDsikis}`LpWLjKoNe%=d6Vj8EyaB
zd2LFPHnDq=Yc{dZZm|`-XmX*u9(Ir#T^js;uKSyLRt6Dcn^!W!l(>dp9ClQ!R?8=)
z_)JwxnY_tjRuP5=bxs(CtI_HbV-{Y^w@i{1Z;Sn7zlOX*qs!mspLRey00Z5;umv?;
zX!t(grcCrYbj<f9hFjrLK3Sf=ruo2Ott&PIQ?CpPzk>GRI*gNE(2L-_j<w?D1U6Jp
z=_p(T+5BvI5UoOrm5vSC0fVb6<jZ}E2{9sPDeW4cI9}Hcl{z&-0^6eK^ds^@QayL-
z=88F5#Ih%D>kGRgQbf%@0)65=Fyw>E&KzU2aH(Qb91}<G%PIzP_)w#Cq6?o72YYHK
zE}A4J{M*PMuOT!4?7tzi5kM<J*)w!;O*`Qc<rk0bN%=dqtDTY_Xw>0)g#4oz`mBrv
zXe=v<8k#jX9lKbHmX8N&;lz9bt0;hSK4wXpJPLvpy9^4g6ZA@YXhx&3Q^_TcmjO8(
zE;)CQJ0FXBUGgLOF=vtE<q{}3ONmTAHR0%O*4N;uuy2wZ2L$N=s@?d?l-X0C1Ekvb
zFpBh5)_qJ$?8`CFVx~eAwM0Fe{W#D_&7QTlBn2tXg_|D2Z#cEwxV3oGwU6?0V}A&e
zZ0+{^U1@&(Q`AVxFfG5eN2>LbbkF8!^TzETJJFm@q?Cf%mN<f<@m^e+d+VfnT&fxs
zdfy+~*b~^iE6it=T3m2X=r>>|0+k1_yHb|qz^23|4W4`Xp6_oB{E$cGyWa&<=5Eba
zb}B__DF`1=0mO}>LcMchitXIrjF5f~!s~aFBJqBYDDD;Lcj!h4)kpnl+rk5GMOuvB
zgIch?1nayR(UAd_VN_jSMFu)~HeJ2{QuIvq@Cb9g^2NgOGgNf$voqHRT0@;oXdLy*
zioCtCwc9B=gW!g_S6u&%pS4~KX|8=S<7@Xt`<oJ-)^qp9bXh#f_=_S_*<T;(xIxaM
zQ!p2(=|kfvTZA0wLtOqcFwC%U#!wwxJ4h4o@M9~TeSUcgEg4%lIB(sF8V;}0qgY!L
zJ{!2?%}|K;%OTdoo<#9Pc|yaEe`#O$buX&Ahv*~p?aedmy-CuYfi=c(z*@et{}>v8
zZ6Fnk<Ci6`T%eJ>q`ioa64dU5?QauOSuriKSQH*A9Lsm!7Q|v*MXmvV(EOwOVx7cc
z3%o&>@LRL=bzKwrX9|xmuw}?8Ndn|^W(|nhhAN2rw4pNxD~PtfRedvU9`9=#qZedN
zmnxE0Jt;DgaB4;2vT$VGY=p}^^H*mkv>-XAM(CrVqlw0PDh<Orqwh&lR%k`-?4vQ~
z@HNKF4;|;s;B{lEubt8!-=n{{1W{0#&xI?4$p&h-g7Yi9*G{y=De)Gt*0P*uCT&A{
zIklN3H;d>HFJ@#85};39sL*c=A(;|Z#e3uZNLbTQ?4b0>{4VyI@4S@BxqXvuMfh^3
zT^Cmyhp!zW_CHro?Qch@>!iAnLlXX?2?Sppak^aS?l{OdxvN%$5KfSg!ly%>n#<DL
znqI;ZrnSLm0bg#hnlldWL^;ruS)f~x!tuL;;EI<lr?)b(r|OV4B2hq711&=_!F8UU
zzp0w>GnUr)2WY2Rhf@M*k6O{@z|L}o&cY;fBztQ-m~g5&z0*wn1Iabayr9DPs07$W
z?K=IVQQ?@n>AnCaaJ{^5Dm}I?&dMS**b1hetJ<KBq;Jm7Y^2~)u=n>~-m7dm{G%cp
z{w{5XRa#3>r+NGue$y>dT;AD5`KW}p-+7tZdyF?k%pn)jQ!I9n93(?~6-!kEJScAa
zYxK9^#-n_H6d+qLBY_f%&?1~KV^Z3+;vHEP7iBzx5cqqymSVw9%4PcdySl>aJ5v-}
zE!D%i<x>J-NLxPT1#Ow3Xy}Zh6kLAfTibJj&f>ngW7Col(b{Y3R{0pqu;ozdE*|5u
z72-b&9x(MW+#*xa`)2OEtjst~EAM#dw|*KhuUD)5&(&)B+YiW0)c<k1ua()f=ZzXM
z3EfR`+Dwsmqc{;=f-1J8;j}VFWSz}h&W&pz)QIi3kKlYfq6!MIF<vp%ZoM>gQ6bXg
zv^TyTuqn>`?kmM*P+hY(484tgq3BIm+m_A248Q3emh~oB+UPCxd!}U>1I3HGoRXRm
zF>4$)e!g`=z9Toox9*hlZ%vEl`T-^tH(QlU*%VCeu13G}`T;T=GR|u4&QtqboE7l(
zw(@)+{(^8m&+ydOx%~Z4NPDb^kSJz^$$1E%r8Yd8{D{H|dPuP2C=nyH!EZny7si8)
z!Fn88!{8bCpzQuaRL6U66)Ja&T52M&XRb5Ip96(d+TZR*AHI)=n3X8=OJ)eVq_XkO
za0m`Lbmj&5eaKmQvAg<!G<KiyXL=tJ8&6W>_T)C|#c~TAH6J@i>m_cYgS!NS(t=4U
zP<zFrGvtM^Twxu*b=3~!Tb*M-ZAG?NQl~G9t(=BEyn(tlB(YQOP3JtN=|PBZ_)!9Z
z`a1<Hjqm17-26YG^S?<_sf_{FX!hZ!Rw`qqmBH95KMo)VW40Q?*0_^ic`=}g@{1eh
zg{SY=Y@a%%spHMouRN#?NW`(sp7oL>5m0HN8Ljb0ZoaJ2+QjoGjMB3ZK@HZC_k%D~
zejIw~g()Y++y-M|87Z-7t@3lo=q;n%l*V+2868c1Z?S7M)+~xmK520mo6oO<aKZ}Q
zA{UO=D45g}R`$)qOB{hPS*+xl0ro<Lsa7Lx#oG3$#6$Jz?FIVK0`#LiPPsz;iYU8B
z^P7MnJDIp+rQwyo-}P_H;SXAD;2hKl6@CVKL1jCv((nM^1%hL3h8_nJVSQ3XcW)^;
z>;PhubT{&l;w||Il8YM51?VP|HB+Sr>!Nc0!WfE}yReP^HBQ6f&)Tk2F5CFAiD#T8
zOHyk@57c9C*5Es=dp78B@r~xJbzL;YHF}V%{w!QBmw4n*jPE_TnAE#-^F(f5Y`yu1
zUY0^b+o17CvmPNl*u{{stSg@OQ8IvoX6{3O`1sdiJ*hw)=d2iVWt*KCPU-Sj%pd>3
ze4`iYXbUakM+Fmr8W*z=e|+Y-p!5cbh837aI%0l3#}4+p2b*uDpYqrNN<25o@CZvp
z)Dmb$HrX5Z7jYU*sR*Ay>?UEJ7p%LMhU2|GxikH5xh>QiR!g2Shp54yU|_?vv)a_t
zP*-P&ZacJ*sEtwR$L24<`}DM5LY{xN)cX5167AixiXFXdL_|%q#&X(jo1Pe=2fUJ$
zyu}#(4-g)Smc{7Hd_K2h5_!WDouL&+L45Ub&o3*JxROB%ht;50F*fmUTcc7*+PML|
z<G)bl^_&VJ!pwx9^=4A}z-C|8`5aLUT_efshN&rUjWa>|t`^mVs7r{G(S8n&S!1O9
zg*7JjD(|VEmfepQlg@|*VxMzKgoMt6IINbKsdc=aJ)F?*+Vmi`cZhmQR{BMZ!r&$5
zzbpXxOeQ{T#K~*;0MVzo3-oNB^U{5By{t6A&-!uHfbg^i%Kl^YCv8I+s_Vj?Z?wMb
z?F0y;@J|hINtcLU5Ll5lj2x>krCtgDzs@EZD<zIKCa*F>>L=9{IPP^%oI%S?Zz$)P
zDcL+X{pMH$)4Lb6O@nMweJ6swk~dmip(kQG&S2Mrb+PtxLDYGFNn3G?2x+vDFD23R
ztlr+|a_~69$X#60WM&$+mz@;LQYI}xapNWQjvU)9<lItxLLca?Gmpsq;%)WGWh{P^
zq!b{<*b<R_7`eK0iHEDEREBga?jpzSsCVS4^kXULr0s=6??lb?$2sAlsQPQI<ikJZ
zAC%FSNVOU#W|h4%`?z@$mSmuxGB>mn=FDS)9xMqaDIt})yYo*58j73vwDx}8=^)xw
zx(z2!_*OPaL5lbTKxbw+F`Bd%NH3dPo%2NE5<0KS1>Nri(rU6eKUFqXp|vdS#ZZ=e
zp{@*Oggwurey48TXX$+2eh1weOwAU`6^-XacdgdOn=AwRVI<&XF1w!yJEM-Qn3YBJ
zBLwOeEw|nLvt%MNw5#qw4w(E~s0B~YA0NCRH5Q4KXyQ2A`CIoji2dsqI~OEMlQNMR
ztsaRlYSYI3$JVZI-yIWFWM6c)uzVuky7QF<Lp?|yn<bP2dbtKm79I=qZm?z-G37EP
zj%2f8SqIKpByX5(c7-69?*MxzR6V0>t=!i1HrOMm3RYYWEbKJNcnEtEp3W61MHkIH
zS~3FrfXT>088mgpO!Cn}GLW{^fe04Is-ksjmFPF5!M)FHXtJ=anu2@zKJDaq^>BD;
z!pU}kZ9r*dZ!S`9RkoAib-ts^HDrG#jOF$!900HU@QU?^zgYjv@8uVxh}-CO$)&8F
z*hsLeN#mSorrL<b1ISu^F^Cf&xX`L1bhRKiMzMD;6szodjIzL34<gqOr2}Ih5UF_1
z<C2m|BlT06cr4PKKSuuAk-OgxQxy6(=Eh2C49g<gIiPj5*7j}OE4Mb<ayvzWtD5l#
z*&6oeD*QR-ZfDxA=O(%Iwcd%t%yM<{&Z5xotTADVkM`CZl+G{3@t?-0isU<bB<4Cl
zq79+B-S;UAI+oNdy_JfmtKvXtA)p9}Tm^=|rg)zJTO;F@Ov@$8ZYjGCnLh+3<fzQU
z6=lwTWq~PoH-gqu=I0bxL;?@@{puM*#-^&G$<Ie$LNcGA7m<*}OrL#<u|hJj<r(vV
zhxslwgbB#1x6Dd~0<tbSi)~&mN$BgzG5Zw9B{8Rm0tL;zQu#ZZF{?De^-a>uaXgJ?
zA8v)KiK3|*)0AxW5W>;NM*1dGVg;39^NqY?xwIDbeR93XgqW3$G9=BOCw^ZK{-oF8
zZpE=D1y1No*T>b-%niA+nBd;QeUu7+y>J<?(wOs4lc`cXv#fs%g*0#&-%&Xi_*6xw
zH}R>B5x2fXddhoY>L+t-jWS?}e&d=W%@Ls5w=`kcNrcv!Tr2cJCCOgcHfj$!T&<pC
zA|pN+k0<4KY&Moegq>lS{iXqNoqclRE@H@Vmn6Sn<CD#q9^8$D#etaNo>H4sWKFft
zNz8nAgD9KDIYI@Kuvb}>2itq=8KlW&qASZasxL)rBvNOMqOK*sYfyl$9vvsr>KJL!
zT6RC?eNxrpUk~QLih>yy$EURJ@h|6r-Tb8n9V@e=KDO^sk^|=YSmkH<Mi#h@DfI<_
z%5fycZhW_C5uYO1`C#F+xs%01RZW`T^^gU7Q)?)tqBLEyMcHJ^I<~LNaLbHG__^^Y
zVG!j-Ol8=s?P6YxK8l1$Ny*1Qwlky|mfT~0ueA?A|1h{U8(gXEh;&r8B~8X~p$U+9
zkTvb?Wcw=XOu`@L)G#Z*FA}BKMa{qAmiz|7=0mP=dxk7;J&XP><o_j+v-q4zffwd7
za11B?HrFCz8y1@A!EnF>MpGUvn`q820FD5u59ig80WK4aL59Ky|2=}OwlQ@ud~9OH
z=dO#7(GN!X8h+Ta!W_S_AEiRvnU=u@o%tU~`9{mw5}_-dSS;+V5105P>xf;}krJdn
zSF!=>6J5aVbI6h_W)6ANwI(85kR}W!Iq@-Wgv`90*ul_C!4DM^I)o`fM05p~n)yBq
z*vTsTTTZ%l7TN9sr>{)-UrE_6{!K-y8cq8~<`c)0Dc2xs4R8m0$c8u%Wt_}-mU~CB
zXI5Tv?5p`tn;s*}SPW>LWpit}NybUzc%>*LdJ{wjRMcH^^9|T>37i1gd6+Y<ZPYPi
z8Vq5hw8=V0ht+L&S9C(S5?Tjh)s@k-VYpcLqZh>m!7LA>-=3Hv%q>k+Fev~blme{b
z1!Y)_F2|a3W(M|JXkJ#Srt{30kM(z=+;3DH0EiB>p932zt~KC;E(#pg`6zh@IS>$<
zl|JmrN^SbT!lLbUAx6scY(H+da_YYA*OQ;?chz`AJ|*9O7K+J9V19e~ZuS7tqg*=N
zo0n>KD%%<SL;i{DfR0+}x?sm$f&wPp|Jh8=|E&zqEeKk$I4^f_%vRJ$5K9^1aM!pv
z+e8xcOW9F&Sw<h(nknn|Ws<gGZNfYLBDhjn_U=slQwBP1x7=b+eb(KaHq5PR<M}!6
z7-i4u7?Gz+Wv@agD2l#DqL#&-WSQB7;v^;8oZM+gDdd~=o$W7@##?78n{GLzd9D$%
zo-v;Wl{kB-m^9$;M_XMWuL~oi*M-r>z>Tv((LFU3{Z$#MNB@wy&!9CjIu)-1N5Y5#
zfeeVOFi_dasXXF*{8$%6t!1;o2r#k^6W@PBEg>Y@=|6)JGf#LP_9*YcP-3gifYcej
zwAe^`M8k!(u{a{!7m(^wqZ+<<ZK(|Pu?;sA!&aDz13}-qD*HjMn+05%2{E)uTte#f
z9Wf4vF-^b=TGB#ZuQd@rKu(s}vN@nj2I}t>)#rSmQId!kcz$F&t!WqKKbR$>vs7Z5
z^g@>k^|meB8_B>?pI+0*sN;?K%pt?P@dfYK>n`~prQ90%XWe4DiFrjc0FfbRlsO1X
z9IqR8H=q?r5N2BlRYc5_Nv$x)CxNMsPH0~s&2^;!nlmXVb~?UuyNU?9FcPKq<xkGQ
zaeIgO!M8a=A*<V)pg6_0*b*tCvN#Y1rB0<Q(HLLR$)rd3r{H)E0U~X@Rk`a#cyjQW
zLMn}?bCt_uHzASAgS$nJ%z-h)2j7BtLt{<TkSGviCimGsH<$j6WYq@6JAR@xjFl^I
zPXguwsSij7O~H;pf4h@1hA;tnz2YW6VVkZ0e`fZv({%V#b<=r7e0cganc5Vg5lOCn
zVoDxf`laK%;0jgG_W48>KWP&$CjwR74gn9Kpgq;8m87I$Oq!I6*l!vewis$=)<*g+
z;Z}6Q+5Cg#10hONxd#5Iftw|sK9mP2{nYVQ<~MAOCekTG5CGanwFe1O+B|dtoQ;fS
z-L^puC{>vtz(|AB9|<s}CH4a|HeE5)HbPTIFM)w<t<j4MZu!|IZXwh+cN}A9ivLnm
z3Eif5)tpO8Dxquje-_}is|mNFh6Cbip|sxTgHnC}#N&z_K4lF{2RSZA;?OPYoliiT
z^~k;`^JkR0@vpy^9P6H0*sb`CZetS$%Z;~L+WoN)>SxL6a$Bc$JJd0GI2K2C+I^8|
zcp}yeo&*oYx~=&5w(KzB(P4PcTuiGEsv#PC3xN<(na(?1K57pKF0p&93DiM}7f8^T
z5+QUG$tv3Jl>!7OKFYe&dzu{0Y=JX%V~Q9F^qE$;$VvZIPJx!=j6d&Y7XFvPF6}cF
zYUZOyTbxh%eU-+Kcz<jq9HE`!{@??BJByVa2Gj2@>B{P}YH+vpp~QUg@p=_OlDBW1
zaDaTk&z5H3Dc+<0y-p;S5L~+k!`J-<EukbB2QX+N`MJ?6tY1FfO%Swwy`Xvmb(1Tk
zlCX;S+0>Bo@e7rg!%$(w@P5UGTiC$cC0;7k{Ld1R>wSk`-lIu!R-O1`>3+)+!gmz#
zPS<)cm`<vq+;ZXx`<XGnF@|dr_wjFZ`M&VaYm5xYu3tOsmkpUB5rrt@)z*TA(oRj#
zZ}{=PI}$@JIcF#;RoJmfAr~68)5etsUHxP=?#3NQa0a+U`PdKuX6GUgSAz@XH~Bi#
z$C<*z&1S((G+W?k(H2SU9&3c(^}J0@`L^e*u*retRNvB+sQga*F<^hk<$TIubgD1A
zYV6yD6c!zDDLy!|zex>%UM;e_@95x~s*}0X#o;x%=2^ndaw@>$g&sIQ_6bj3-h`tP
zk!5LTjgZ_?T4VT2KNd;(M=TVgSIhrz>GDs{3>!XG1vga|dKULBg(nQbK+A-)aI2b8
zbGlbGRes^F&kLoz0b+SXceP{z-vXxdi{B8zZ38orP!_Qfnj7Ds$7m5jHVck<_KF%c
zuX07k4%M6Hy16_YyeM1tVid3eq9`@9bR7{faAY{H4lB>hMw{wBLyLc|Rao(N*#K}P
zA=dK^H|I{fFYI&o)NOfdRZ8pSw4n^<*n|4cv8J86h*w#+<FGDHIazQ6nK73<+F*6E
zFW@MUu%xp49k)z|2M4C^SO%itfTsAh*((uwzY>uPIG|m-nV5iZOn`}|HKNWK`WROK
zg}bA9#`;IP&C((zuyy$;Rm4qZM@npZhsfAo4Sn2B1cwzt5QB6rV#ayNFe{0)oePL+
zL*tyBVjE9HXG_71v~faNw;_Oj6c;*1%BTsY04LBEn_Q27nG>U#Ttb&-)Rusm#aBko
z1sq@RxM1ExF)=cq{z9^bDlY9mhqaDVN6KTkS)ku_k1(}m?^L6F<(t7uJZyf0&{<8@
zFJ7U;biRbDIcWM}m9u&4VZa>U?7Igq>*c)ujs@0m&^nU+&Z~Cw`nO&>k6q&Kw?&tB
zm&}~*6i|^tM5n<)T51O*p?vCNsGACNu;rtrsH<WT*$n*&Y~fny-NQjbvy?xe4?{Cl
z@wX_UlOPGi61Nbpr68ToKvWkA%aPVy;M?Otu%M5M;9j*Kw}~<GdpaRHtMHD7T}Nt-
ztigofb;bG;b8vSSF010hg?i$vEiqWkjaQ;EvDh{lvs;>MM^I(g)=ni1<w6xK`B%m1
z=NdBjE^L|b*9nbTry?FEF)2+6cYbxX|F@0x&+8g{_ciHI{in47Z<AoBuqYVd)CC7G
z&>?}SK3_NIaUsNrht11yA=<$2jaLK=*PRg8`~y*xDN1TSMM-uCHGr|tNZuq;&L2(C
zd_cubt%^~5;#-u0nsyw+l?PEb&~DE$m7U5=-{859lIFiGK<}rzZa)yET4KpoevBvb
zs{{8DU4gc0e*$#lJ9gzrbPr~Je&M7x3?LHJr>|qOb_G1|T7u4D-VBgIrJvO;!LD>z
zH%_TgeP2R+K8-yyPk$ZL|9iP@EPY0zmL3iR2*+m}LRaAGkv*DopCb)S*3jxV8=C4Q
zZI5sme51NaU&P%4)ir;dm!-yxQz6V+B9YeYhcUL}xJ5zczTV5UevLMSLX<fE02b8U
z8P<t6h4+J?XB!SsZT*lX=OiM@*$z8V=5mRSQ<7LJdc&04NlBm3(P&Dpf>zDV<BlJX
zr%DBZtbd?ZK1VW<BCjCJsoOVTM>M-g`FuhY$HBn{(GT_FLPM--SrgFlY~QLc5{chL
zp?rPoIPt%kolJB+uDAoFPz0rK^_*UBQfY^TPGAmWt?CPWm`a}{>b3|J?a%SnKTzdU
z#xY@0g#XzWHJ&VZ-`2A|<27SU{ze;~vjZ6Fb6ZwkB8Ef`bBb;KunfRVkqb=$#22+v
z@^6Zi85b#yWrSXu_ou}WJvLLinn*G?nx*5Oa|pb@bCV_Lx@?E9d)#rS?)yeHfvWOJ
zOw+IOl+-GkZMxb9Wy-jk&qi<G{CPhsXPF8dac6K5EKIOu%j9GTrCj)r5&iG+c_Hi8
zn+Zg5hqy8VZrXQaLD0#tZ*|{{@D3kS`3h#QS$Pn#&<AcfN%Y~WVp5@PMMO=F;laAq
zDMEF`KF${uctZ{8<pmc(kJuABw|t&L%!y(C;yJJ*S#Y}MIIxr|fvyOD)UI;!r-*x?
zD7hLkVnJyv^)-Sq7;PWM$LIg3dJDd&x9|O%7`nS*29WOV?vieh?rsothDK`W?naPq
z(4j$6I;D{=K@kCO<ec-pfB%Otulek~*Sgkqy%!vTrGc7{Be9DYWXr}2ncB!~6q)*H
zjMHulSTYc)E7ylA|K%kj`w(o8s(fE{eURrKtj#pb^dRV&?S==Fux8Z44nZ!C9n?~_
zWn1{4TbNOmGd84MErmH_imtdqir%Y<^`iQ!`g5s@0IGvZB(M4$ghD*Dklp{5h49k0
zIZz`#Q8k@TAmfOW)4Q)<&W=8ce56>~fHGQI#CBAhuzlz)7FNC^Y%odsgF~MJNlg(N
z{5}cKO*ScZbE>YM-DA?QC<?aYdwX1`Jp*h^nFvlEhFT?#9K=?lIQ85zj4;AraNb0V
z@}l8^km-WMAmOge5LhK|K(B^{2}^-p)wE)J5DHb+;UqfMNUn^C9|XTYI<?b;zKWAZ
zCTm_)d~WT8>x}dNrtUnJnH(vYLNm)@uI>Fv`NBUt*_>Xm*w}c`tEg#PL{xXsS}+mk
zMcO4%*y`0_f*A}!iwLsH`q91tODGf*6{BL2^=sM_)3un5qDc|aev7z1(2n{TFeo4P
zDtJW6g~4~L25?Z8UmTpP)KZL*=7?ABf9;H$904gEcGyBaVNHLnRJxt(l!Rf1_n_!%
z?L6#F@I$nP^krM<+e&mPHcf%6axV9Idd=8*;y?!ZDD!5cUcdMBmAEI9X@thS#m|L9
z?%x=vUzM2g=h<90V`0H~jGvZV*gcCFLoDF#gi#6%PZ4)21)Y4GAs@-ZmxJ2yLy>4=
z8NWo7nNKRiz|I!3F(fb)GJy`+3JM4m*{#XSyaU@K67$fh!F5>V<LRU!HwOk5Zv3vV
ziX#dfS?&RdYu^EhIj=({W=Rhj9+NKamCRENe+}(K9D<xGv$>9%td&`wBt=`=AIi$A
zs#iY@%%z9HnIIc1)D=CRk83v@$!<6VhyF?;-9YgU?Zv@;zS%DSojWx}6qf0^h7)cj
zCH>Aca*5u`Zmj<vBAJO&r9o7AbSe04<}H_$49GG94P>+hvw}ZclCv0JgS)(HAAYcy
zz8a@0b(mS#UjoVk)Ne{!l<iw`<f4z?xoec<<PqC472icS3ZnvJ>Zeu~82jci38zKE
zn!n=23lpNEo1fW2rDVFs>ec+J!0l)w<!365Q7}d9#xtb($Q++9@3v?v9dQsO)#}D)
z+QsL5e*5XfGP%6nO(-+<dCokx{gX5Ki`A%E!Q;l(z(*y(xgzFG;zbma<BG%r*6W{T
z9a_>`d$MJfU@cQ>%oa1Fjgf82H?f6G%2<Be6*dGN>#%M<_)6(S?8V2K_%nXS!z1g;
zFyNr!X-{?4z^Fbt>{6^Vb-NgEJ<z2$N7Uj7;N5@~Jg8%f?|OU?I4>G|O5{4nFZ|Lr
zmNxmwy$3oHUq$2X(z;1izi-~@LLPtb+eLk3Yz>7d1(Vinp*(gr35#v=6p7;7G|n=o
zFf&*Gzsars7c{<gw)O$#@soOj3IVQ<MZxmFnl-|c@=~Lw{Dbn+D3eIcm*6F*pyH%+
z=(l-FmD57KFKNFKCaOIaea8|a|M-h835oj{Mn0bgPJ`vGlS#pFtwpBEgTKTym2bov
zdQrG}nc;sWM-|i({icXnqXi#|ns`wK>J!rXG|EatKUx2>VlwNuLPu+pRCmY;y7I~R
zK%D1Bsnp^k=q*Hf$8o?6ar;yB{uA|tn>XZoS^<3TTYV+5v-^L<!7v3H4#}aZSEC@(
zd18fGrY+3Gqm_APL5~EkFWfG=6W?f5&-8W4nMkEIqUlMu`})+`YeGjy@mstFg`t+p
z*#SpzSw`?bK(p_`!7V5tZ?yn57I|d59NFxr@$agX4O#l^XjZ(3h|wpq>3n{n6us?T
zvT@zQNW;KVZUlXp@O1qt0H@}f_YW2-JrdOj;vqwP#u&;s-6lbd*t`-j27}D!fzcb>
zD8<|g6RLiZ+*qJjfI&H1Xbltf$;hW3pYIw$;h-1#QFOkD3yeZ%ssAT8?E2I$+yg@&
z6!vK|e(~eZaztMT+j;v+{6dLq4VG|~=JEQ*CB6fIH=g=|s|wB|^9aR&AS>wassY7v
zJt*ZV2xz8JO`Vst#Rjr(xjS+;VIAofY25Rn9du`qB47YP!p}LaNxk2dSoVPL6g6&M
zid=kHpAo6etzJFmd<#$Jcxh#-#uPzmc0!+K1c1p7b1}zf<>II?%z4FW!`ngAK_~=<
zJK(C<7XCHUKZxGb=A=!Fisr6+HLRk3s53S3?O%{=nRQ5*-h3#HU5{htQcd*O@EKsW
z3x4%nz5RDfyMRU!;{X;*gFDd>F>a$VHf?DzLh97ok&%h@Y|82Is1d_>CicBh?Wp;Q
zjhhO{xVKbQLsa-cg$cn;(;8OX*<}l-I8aztm7f1vaGUu@d8!$|AT!FN^(se6S6-x-
z144G4rLn>*Z&j{cmH}|4h($vVU1TQ1izpG&q2@8SwLFCOyh3Gjv?<A&^J!D7rDEqL
zC?+CDL~nkl*tW4G*Bi{`<$<)I&xH)U@q+2@BeXChn2Gfy@a-h}bg!<Xrmu^@jM(JB
z;qzDd*LZ656yDnMVuK^hcb$PVVRisX^-hdEnGj2Dl&!-IQ2BYa#Yf7~--ilqM_4q4
zPDfPUasiZz7|15-?1l1@e0UbEk1~v$31B$!im0CmE_yh2vctGM>9xwjj!BDNS}5cW
zLR~u@8=Wa$JL{6naUR1+ArrjO11MxPN=fYrHdkOkpK|W-mW`z@F+4H@>6(-((P2YZ
zikYGOLxKpIqIZeLH`-B{VYb@i<n(})9sM<hwcF|>rimct*Av_SD(mML)Bz1LbhmBI
z^T<BX8|Qp#u^Ca+$Wi;LL*D~0Tpjy@uf&j58)e)oZC6m{zDZ8*0*8bN-)&*B*O^VQ
z16Z$#Av7PJSgbC$QZucWidPcnlMYvBUS+A6BIPIV@jcarQG-*{#6lphux{w}h~lYJ
z$9!QFc%j8Kr4wplAjK*PZe)z8<g^fMKhJcd=wg>2D!{IV@uyf)Z2L~uoJ{Xd=KpS_
zalkk_k0VEACCUu%+{SuVM?d~A)y)8RX6}e0-LYR|k301!pmBu92bY$_IE{sY>%nLS
zEbJvXM$a5p5pIE>;{Ad+hT7irQ;Rl+I({Zg3|LP=Z*>=K8S8*;JfLhfY>X_p#M#KC
z*ljpXoWo#NoItayg9r^5$l4*?O-3i4ZyG1VO_PH01HxYiYzVpuADhs%)pWrfS;Ur4
zC%9<rs#YhrjlORgoE_2X{}AqCSz~qYqvIQX^ciPi?32dVQTVSBSSc+X2YfAQNt6G_
zMe|;lnj<L=Jl<=&zPHUk*c^t6DbWd1WhTyre1f@TOLpX2F46M7`-)$e=Zu2;Sj)I3
zP&R^yR-?r9@IC82Dakoo1}kN?6o4s?=nN^xFM4ZK_T%(h^!Bage5KsD?{Yt(_e?Ch
z8<$zC2=#K3{i{V;(Qm?SuIA950%q%=`E*&nhHcFsmU4s&zE)QB6-<I>Vb^&%K8WtP
zFkQiL!30L6`?;*e91H?JO2m%bO2Y5N7YbaU9|Nuyc<r3^kpynN)#B^xAAjd#Wnv1H
zo*n*|x78_Qr+k^AT)-qnJTR<&ujsr_E2t01M%6j6<d0P!)Q6D>rVpeY8<%QxJQ7u7
zKpRfS2~<Gv-uMJ~P8qM?bcWU9y?MujV9*U7GF3g;n%hVJ$R-?^gjs)5j`%0xLBO#+
zy(7n%A&Hs-;)Qquyh_w6q+F{TyQaw7kbP}-S8fcSO@2FG+X24lElc?&*p;pdQ2P<G
zdpvZpuc@6E2W2L07YSR$q8e54K16WY8#QKBcGZ#_bI$k)@85PMEh2~*<tO96X;`sL
zsZ;rk-1whKs2zxvxDAIU4fsg;F<>`&oF2hq*0rW!u^)T?3XwuGn#*sE+6dKk*iqAR
zj!X?^N+m_nXunL?JHC}g)sgDf8zmGya}IuC91WGzBQ&>gqxXc{K}ub2hhbycs;g5A
zkR2-o5Jm4r&<82O$4}%VjOG#7+E{$VIf>+0$y_hx8Ij9q^5gbbIP4&z!RY^*sTsSZ
z6er8uU;^kU`6VssnOI4jhn7@`G-||7;G9ytbIqT<R^(F&zo-o1uteLL=24DEQlKK|
z^UWOI4>e(Y{uo34ORV@5m1Ir#`FaEWVgTMbp%X0`1klM4>j*NxC#MMLyCn_xm~w))
z1-5z@(`SE?IM<U#<W@JEmL`{3Wl1SZ7>VNxzg|IjVP3&B9bu(f)P<pV`be!8akPDa
z%K@ONiiNEJJO_hXfNXxbg<2K{Qi?v($qs43lD;7$9HVXy0$k!gH)p6uzf|ZAk{gy%
z<x1?^D#_65DVbm*L{f%6Y7;$e@!ib?@6lJ$?}Cha*{e}VC!>2t^)%6P)V5}P{$D*b
z;)LFkZ*oUEfxwD79CAZg$0xr=7P^L8(37uY@i~{%7xETnlpm0OJ>#fj%dUV?dr9dK
z(GyldWyz*{{GS#u0FBdiWjyS+PvR8{YobwPL{h~I<r<rlhl%L%eb0u}D6jQ`aB-mZ
z%<*9NB<7gRN+VI|A_8hLZ`f^kuco1J@Xnk^Y0;e;tYE*)37>1$LQ>F{ATXck4^9Mp
z*@2d^t|EMg{3V;43PN_yBz#4OR4xg5XR3P@?D@s{Zx;83N5JjM6J;5U<-JcmyQ>lW
z9R<A|Ne3whc+C_6hz+*i(V;C^o8Vjij3>&v3=vARm7>9BDUYj+6u>+8C%|{s6<X0`
z8GxEilj#qg)z^o&jc>}yvVSlq2Wh=AUXBlAkyj=JA@l)r#;3f`VEj9udq(zfww*Zy
zkTdgl$4I$Bpco-3yvNJl*Wr`NNn<DO{BoTOe2vQ*gNHe1@fl|$eUW}&u4jx7>MuF!
zX{TMSPeN664Xyqy2L7SGBofQL$Fj7w84%vGkS?P+|IQbV-dU{HQ9jL4EZ<9xGzK3@
zX9kqEm)^}q350ipC;?MBc9$c2y0nGIWXN++@Jc8<pk}A?UwU8pyY(S_WW7<XQJL}#
zHM7~I2uLO|VC@DZ8?5_;8*mIm%_PaR2~l5zihe^}2jnj-Hgvu38fN#yC)zwHAwO?P
zKmT+o`!3@@mdi)|`Q^!KLV>yw3J)nT@>=_=Iq!^gHK;V7!Th)7`eNR5BCYGm#L4??
z;_MK(NdD2W8UJGwdP#=EVvs~O(e;b|<<y9$tj%k;H@?~w{dWOpVj!IFpDm%U--t@b
z!l75E=wV;U{3+8606hGHJ9Fp(m2`ZT`<N}1#4JoVOZt)qNyjBSi^*{7LlFNG>g9sV
zuW8!O&b31&zta^ka=0U}7jA_X3+?IG$+$FU*K$xigv`-Ro4Y|_GqADWxE(HdNdJ&r
zug~QSTZP4pDZAEqjM-ie>rH%D+LtBijVdI5No@j<f&UO<vP8CXumwJi;ksexGfAi}
z&tT!o;%_!+3}EW;YEUc^><;ir*_o3~$8GwkPT*w1POKJIQCA_{K$^IZ8{FBBg*v;r
zfS=OLh&zxD>mO-bQ}HG%Xc(MhAk#@jZBKSEja=)dc19#HV`$N+&b~Rnpmj3L&j>&U
zSh?frwrOORHo#g@Pv-W_t8fCCfAZPW@EBuv3Ba-GNXLoUGB<(5<lN;r445S)ABtl{
zkvaDTDE;{OcjFVFdepVy3EZ@Gq#`8<;NKm3OS?UwFoRP1=7vU1_Q?Zd=Yt{3;g>|%
zNq;7`R|4yw8|<e``<edMe2>t`@P!Oa$0PL97|hW`8(((uf>)E0VGE`|xgtD6bgIsm
z+0Hcz@as067PML+41iz5oA^|`)<2q5uGS0kQjYeT<LM|bAmq)FMr?~><r25iV<_x%
zE*K@f%7I%0v;^8P5i~hdhHhOAyam$7j&Nr~;-JSkeaHC4y!nY;K_YYN+H>254CcRP
zZ#T&C`O<qlK4^F}8ed~pQFPBa$^6C@9j=1p$OGgD9tvf_!c4mZ_Wr$}coPypSYg~K
zk>#6TQF03L8nb!-RTKXObVOjxBAx)GUHD)#ibsw2<Z2}_{N8PVwy;A<60+?Q1@$KC
z*?H}Gc#<4gF4(*P>9_lBKUwsr863logpgVrZ!bp3PcVFLbukxp_srOj_oq}fKzE~x
z<#+1QbNLpT)FtB=Na;6ofTdS_u6=yN#9Lk`!4t>GO*9&G?mxy&<-|+H(#qFA%9{<w
zrA!u+EITaTNtE1`fFzx4Qt&kf#kF@hh$_Xfnp1Q>K@Eo{bK)Dg0}<n@UvSzUuf3y_
zA+kV)x*;4@{Qb9{SbhI~i>f0>=ob?e#yCB*3yusJEH0%vRS{|<H>4<78CmzkrkKzv
zclPX!c~R@nN6L1>2)U#Cm~iB9iAt%Z-!+Lq_l-i(*zk9y5u_xgt;N20*8`lGX|tr{
zk(!k=R|qUIthcz4-yD7O4*eLiCeNf4(J0l|AzIni7$;brrA9thoWm7xgdzyd?)q6A
zy#6QBT%W?H$!;5H!X~9*Qm1%K`kB~)e)ETho28?xQLA<N&rj(8LZ1$xII#8HtR7Q+
z{-;+K9>ny1yYV1k$y*}@D+7fm&IEb!87`q@3j%C_m_UzIK*53I^>@^AI&^CX39-K2
ztQeuCSeZBe_*|t-^vyOUxdJ9L#NIQ#a}=0FyO}n*<SzS|Qtykbbig4F)zB4e%H0UW
zqQ|BH)5o{x7s@Ue(;Z0-5%5j!kwl$ydIDK5@w2NIM98?5s*eTgUHcSLWdmBt5osGE
z*G&ZjAKalg=&pDs6+z1(*2YS4GRTxO)f@kh>$6F|J}Q&H=Ycbk-4V?t5vB3s%L_`(
z!C^GPQH2^XE5_nEW28t;QEw@N^ntF289jLddd4>nv|m%ePD}*1Oj35sIZdvh29Er&
zuSa+_{d1x}U1gAYz7XJi<?je@tUT-V5Q;zbXx2%=T}c+8!-hG;L{yQ5Y*(JwmP(b+
zjAOC-*aDNQgqE9uZ;4{D<pRGl25r7$1yp9=mR;}@700ZUoZVpfA*MJ{&<|;czz)`k
zt>0}1R;hgm0gD#u$~-HE|K++9)3^2PK2ykf2}~TFezpBDJ|}`WqW%E|Uuh14W0IQ8
zFsnDlw`(V1C}ZA_#m=^VR4RCAPsQNPTD4eBeM|=b)ezsIINMwLQ>;+!!Urk_sZG>H
zV?9`GB(J{2oZ)=a`mgdn?CO?6HXTwBm!|n1mfYEO4Wg))8+ms}!X@cj-C<;_o>$y3
zC_+D6Y#kPZ=4U9tU*vMDA)gJN$)yEIaN+@cNsCOxH7V5N(nm<F%5Ia@aqr#o#)1+5
zzPSbv#zx8tD4r(u1OF?L{L_qn>5J0v+YNpc|1)7vBPX4pZb<Ik#5kr%a?1xV79eFN
zU{k~`4e~_TcZOq`xs?~6B~Z{B#?FG9Vp^g%8EaIq`o?FT_3`A!KNN^S?SPA{DEk`q
zt41<e2Qg1homkY;C2jp9o-tgv`l{ZPa%;HXgjTeiL|0695gyk^#Hf(TelN_;{IwoJ
ziSN?KJ*`;sMn#rZbV4IBXF8;;Sjl)E&G{*jjGf=0o?<C@UIl(E=(BPbsZXV3N=cZ(
z%d5w<V36SHID|S&QUx9PEaKTjP4X0O8U9PUFeimi$aKF`3A3T?-+Urlths=0H5Wh<
zvDb0L)=UbSK7)>_NGfr*fB2T<z6$~Qr3dY#Md}d~jG(%%c36OLVPoL2T5&zOX5~?Y
zL5#LGzU;}AcOv=;)fq7T<Uy$W5Mzq=XIW|yg@S7hp+}>obppe8^la~P3v}#k9e3ND
zdT&AaklQT@bNfFU-3o=$9UG1U8IHp9C=}roDItBWYuz12eKy#TVwWl%L#{IiPseE;
zH(;wZJ$niKg(!v9w5Yc3ZVP4T^B?x#oPnC%W13uiS&m~#aRSOzb<$Ssc^hs|rZ6rX
z0Rr*06%}KfxVtUJAVo2~E2XUh<<_;*b!S>@`3wrUWUEMZb(6lzmrUkDSBg%*;v%3i
zGW3$KJ)v_bjsR%-1!#D%-B0RM3Zo3y73Xr*%mz=0#b|sb@?ux*07b@Ul(%LM=Dg48
z2Ccx;C%h)na&X_xEIsEFqU(iyd^@Djc)ncS@Jn<U48dU$*<QjKsEQ6&#3~%b)*cIb
z?!EuX68=pRN9%?j8`2NO@2kjO$r#2k7OdaEC;9G~Xe=>Zh{mLo;o;IiH&7_7j|@>G
zTuRs=rqePlxLT{0+9s6tC3I5exa~|B)s-6MY4krBE42sLj)>*Fg9~ehfS64(+vSNe
zCdTn-DZ51@l0>u$WbZS@iGld!X4Xhzav2UA3w=^spvs*0=O(k$-Pq!U{45;VnU$Z(
zedOr>kg7Q*)n{<0C$9CR0-pNVG7jd!*}qrX|BwhfFZ@4p5b%UsFyu5HM<I#LhGX|F
z4y@mNuM6o)d#H3;wmV=(2;xR^mjW8a7zJP4Cc!90c;zg3oL<GA;oIbTC|y(S_0cGW
zI)Ih*R5TesX%oGFr33+v36xANOwC3G)DnTz${=<RGNf-4K&G%bsW>6rX|nN=>kLZr
z%<{zwq;H5{0w(q1EZnDA$M+0}%&!(Q`JL$eTgca%%{E09%0=I4*LtqKmg#n*T0pTX
zz-H#+6bJG`__qDvpQqTa&n`nwN}P;=HY$RtVSF%^d1B_`VH_Z*uiUHG7^xRY5+8_e
z*;9#uHQ&IjesNiD8(92??n5J}BghSgYC4BZp9qv!C#Vr@48g8*1s+kAqG>Y8?C|^v
z64|gm^Ff+sBRf>Y_krayLsFw_eH3QYZ7s*&=rC*1JQSW3TB!y_*QCQu`ifD_Lo9Qn
z={;g6m?u=YL$eedVMPf*3pi0%xQ5=oLup1|)d+sac0t{3*gmO`Q_c{kAdAY+@W@r+
zOzrjOLgw&kc<|S~()1z&fDq5fOoQ3<%j|Mz%l0llr5;eAwhw}1!)DcSGf#8=h4M2o
z(*{T+sBrF2%#-K*CHEe=3#c3S007)&rYxvuzq9=o`ODuamdQSIh43*!rWg(zzd2qx
zxha2xk7@QQ8(MAyC;jGN(<+=!)phXZ^}Q$DRt0YxVibMh{erJyH<+mptwqQtw?Yxd
zN{r3m!`416D^Ji?WHv&@-S+lt(vPDy-q~=06^nUGlQB&UJL>l<2HW4#CzMxW$|4Hq
z{2X>Eb9<>6O0AyH%F&ZfW%`TesiYZA71cnNnFg@bRrq4|a4Pitel3mGmJJwz!06LH
zM?^bgj4{(4vA8X)ymgU@;FId677q6+dO+Qg$mKBcDSQMPnNj#A1G5(<kUX&BhK?jl
z%#GOh(BWV-zwm2XQqF!65i!ZbK%nbJ=H@=e67o^v5H3dP6*rWmHCvqFCG5!FJyI72
zrCXHkVhV4!t|l4_3ZCin5+nFNnj|c*2Tl_{oq`WIvsNU8({eCNvLEW!p&ZB)C(?{!
zE_3e#UMO<myUrd|i*^!(yZ+-4{i}oOKRMnUl*2eYh9;Uta0R{q@H{@+=$2}QdzECQ
zT-UHANQVwJ3zxDrzmJ5jUXY3!u1no!CndFisp(imHQeoM4NvS57u3r0VJ2XnK~>9X
zL3_-FI0l*lA=*3?iM0>`m0o?5Gzw<=-&x~A>>og<R#N6V6DW0kBz1XQ$<tn#%W@v7
zHHbdR?0r88Z|F`3(+HHQVQ*r>Viv6zNt)Xe*P)-eLDmxI_K(U~xGg)CD~X;tHl03d
z?XW*wnaAninCD3G-^9`AU-n?eE-q|ft8JY&0QpB4GN*E6OO@KL{?t#WI;;P*fSc{}
zARwAZ!^Fq(mu^HN!{Tkye_FBT0$WKEY0X$&@v6hKa>JSve_NWQep#uMxVq+Rj%53M
zAdG|G#Z%i5<W&CFOnv546o?c!sxlF78m{S5loTI%=r3D{7e8C+&S=>mV8fz79?I{f
zA518Lz-SVgpJ{|?k`g|XM#!SYzf=NFG;S&WZL}!IN{U>`EY)Zrf-9PBWm)PT+x&t*
z_xU{iMF~8Iz>oq&Vq8}34iaj+9er!Q%`1YEh}e=N2{X5WwXH!mc_)L)$*8=g<`>yI
zD45^~%wn{?{`bD!EK1+@rBNKK`FU7r*-X9_!5XgpMDHTxe_i0>B-PNX)9c^~f(g&O
z|J2cg-@rYvM8;x5op?@^NG-HwvAxA_31xAO(nzh~?j08ezQ|gZ#muB>Fe9|zjC;yL
zwkVk}agoFBc}l&eLu?@WZN+YO(-t37dGhuS7|v18p3Aij;r}QC>7mv&KY1k@8XU<B
z)OvPbTCGUo_rteetvD;+I@|^WYb_6{#%DhiKth5)!wUi3mZpH2enFox)RSooQQ)+S
zGFkL;a9_H|f$if=>L1myq@8nv<bsFN;Nbh^_;+2tcRJKwMnz`TL`)zT^uI9()nzsL
zj!SY=+*;%|TKTCmzkz~mCff1_W7B$$GEW;_HMB8pJNz!2wt|?vxW=*Ee4M632Jt(s
zqGRR~-5g5I;W7$oAKu$xSN3`cszTNO(|>m2Dwdlc*!N*7sV?<?%}xBxW6dyIZ3-V|
zr@LKqZZn>wwa2<E>JO#`$spK>ENUVAnXx=7X0H-ZaFc}SMTEDEd-E+Z!LpJSDU732
z!%$y_slcTRS#9-^&K6WqU~a!xvn<DbLoA&DFtP_0D{GNL+;m^iXRxYxZdO42tWgrs
zZUts!RUgteY-ST^4-8*`TIKCr?}mFKp=XF33c%0`FUSl}Y2-K?+SZb#9OS3mtWiUp
zji11l1<GpJ8^f^e-A`zzbPi}rUk?$HkDtq#zx*zPCw^B+#Dc+C1*MxaF5>RX>y+Xo
z@h{kD-lt@_=gsDQv9W5(9bAcrAxa|g*VtpH4sZ52VQUspauBGU4-0crk#-%`k`#|A
z?~J#t0!|yV22(eaW}-EnORR#V4(WlmrvxwKwacGm2){*tWPbozFrvPzFW)T9tf9ox
zhTNSaA9a|lj4Kj<>J!<n6Q3g2N{(B%KPC)q2cEpgGtqy_Qow-5k&%)Arg`8c<5ocu
z@i7qwnwWW;LwsJ8GR8hlX*mn;$2qNPjw6Jfp>4cz3J8_z=G8NL{T~Ps`;(X7z+v^S
z@lgYc>mRY4@-5<#njW3_2*HgPBAhv993jx|jwH;$OAJ6WZQZ2T*9UJ?a4YaYZN#Ge
zr}~h-X&lMkHGH7(_(uDpDP<myKFae&eaw#V#EM2^W+7U&NE3A&ngT8CJ;HC3B1Yx$
zH5Aw3`Yq}ucNCLU-|XEw%sJ9GZo_Cj@-N?vQ1#4$vYN4keYUSsRbdT2v^xaI#osdF
zMBY(TSHI}uR<8NUJl)=%;;S=9z$yEq)5XQ4>CExD2NL}Y?0Rxd1TRm~-eze_F0zKW
zlq+x%b1&VpH*N!XN%^cPoPU|layY}um)MF#k5(do!VKZ%)^oyc=6zV<<5%>=``yFK
zDGFZU3DI`T?O`fo-Ar_Ok!tQBw3L(`TP@6n7s}2^hCz^Hwz&VpP@1#H5|?cC6)4a+
zi)>yIp|Y3BltSc|yIZ5Ht$LDD|J|<)YG3TdDtAmq1f4JDMoml9KE%PPJGMRxP4D&D
z1!Z_E;8TY!BKYtyv1+bmpJl}V@FG(g&HMyt%E}z+vNptUR>>5%7g{8-h-V%T2m!2i
z=^C#Lz&#_#g{}`&`b?G=b#{-4RLrJQl$qn}n3by}<hY5N*a2uRumNA+qRECds|W{s
zvv)e^bGfU6^@C+_GUdN_4ZW3!^Z+J-?_?QPw4^w1EM!FNV;4C;aph|Vo=n>CLFT3F
zEf+q65UPmM)HI?rEaFP5aAg^dyFQqA&K_PTF0Cc|C+k5Kka=AScpXQ-2Gu;@208!c
zjGO2BUs2G(JXA_(H%=IP89nh5Z{_rDmeV~$TrbD%Q<xMJl0?Omf`O9LBYLl;*;YuU
zDUrT$Stg&<o9pWo-C2%Ktg~-k-lQZOGb0!osK!!Ozp#*{QtJb=9OY_)9OBhi7hL^J
z@<X5o*?sXoi+Ba@a!)%~4jGMdBW^xfr=N|zv8CH}QfN>z-cvmHzNFW-Zmf{E&&p>;
zKf(Ip#ce%p#jEhxbZW|!WSJ~a;@Lqr6_)ZF+4`r2<iAS^{zW7m^0X_%$9HNaUa8zU
z%h`)%X{ecZ$&h$niMiq;jazt5ep?C0-n!=PH<D<cAP}hXLM{x`C*~dBykO?SO70Y6
zd`~6!hs(whUmD~ywvD;rr?hkO&>;h6_}zpz%~0|f=Bp)G%ZFMb#f^c9r--M#5UqnN
zfCIHHFLU%_M)7>TTlNuQXPLNy7?TLD(nOsctl(+l^Gf}j<a=n$8}80Gr%e&7TTTqp
z^CUG#Zq}()qEhB>-Ns2dKIH6&$dkzEpy!9hytgKJc)riPp7TfsPi`DkS-5RL?Gp9!
zO=?De&UpP-pgcSkQ^(E%Z3nO*SX0>`vy))NVw}FFn1L&4tsoS7v}QsvZjCB+puM;7
zb$ACSUeh*61ZEi~P|ti@&&VGcFn{OSkX0rAVSsOW3b)LwI^R@?jJzkJ2lIxviHgzQ
zww2oXcT5LsI7|ONwn}KYUcB?G_tWt}&YvfH^tkT^k}zg>vE$a_9}lsKnL;~Iitm@-
zchjX9m1&zrNA6Q`k;D)U`Y^Q6W4+X;$jP(cASvgyNltC~S5$lAD*Ro5F;Fg%5al}B
z=%hjSh{pnx!OW504-=^;&BwXlWH9Kkb2sBrAI;xd*fS^C)RykkI^K`Tl9Q{ONJiyf
zs^&%K&SkRg#6MoJxZcYas6@c$OkNu~L23fBLcV+xD-1W>N!fSX?wX!#pa$g#prBqg
z{2Y+-c(WuO!02N>(Awc$MB}`Eo$$uZ^hj*un?7*|(CTm;?YD;`8r|FBC<sNQYOWSy
zcNk2AL3{cWe61Kt2Xnf)44Su!Mf`s0sc{n>A)Eyx@VR9Bi;He};txc{&Q6hGzNt`5
zf!d>u!+%t;N$tS@);=cDoxToXhO)DxB1aCb<UXZtq#hf!=}mb$jNyqjn6eDvhiCM;
z!;E_kk$-e?^hIq7mY{Ef=(GrUMxm->9iaDgMag^p@)8}tkc`9QnezPBLO-=6+Bw`<
zkT+(vfel^A8!y)Morv-6ITf;-%(~Nq7#-&L_fzTPOC$S52BVFG8gd+Sj-7-KrH5aB
zs-)T3bZQ6cSU|cbDHmHVlJ3~6SX8L59CWO;Nc#3o=VqR}h3%(q;ja#Fk3nq}z^zEe
zq2A4ELCOv;rxQzJco$p?<diuw^0?1mLmb;<n0GfHc0fc*+T5XR0Ey(4!}Eg)5k^&D
zp2$iGm<vkT^eJ@^Tk;r+!dQE^W-o31foUY<-Wr+H!Y3MY9uJf|OX-x4K-4qFg~-Gq
z(`B+=L^Q5#DF}bfiQ$4|jJ}{mB&Sc5&D-Jy*q1NnUaZ;BYD4OSkA*+m>H5&Rm?t}o
z<nTq@E;Z%s+m~lkQ~{B)L|T`I*ayJ3L;GfpS<g1T4blIR{%Of@CkP`G>;-7*RPHcZ
z!?`-d<hhdnTr$<+u(sPoQy%dYEtN~7K;3usSK|ni{M?KT+ZNN+(z$k9najq9VI-FV
zK8t1^yQ@a$4CN(;t%b|EyH3ZEQeFr=Ow(I6?x~7o2f{5Wa%Phgw5C1p%ziJ#fqqMp
z(HpXwZG4C%W|h-F3?0r=rK#W|smAEU%^nainGh9K7K}Gu+-@hi+lhchtd41%4XQa)
z`j|Zb7eoI#3@TLn2xtcB<(2nIr}(o7m%A4x$VwX0fq1>iz3W(N0oh1+gQmI2-JuLx
ztRnIQShSt5wJ_;Gx%Yg%y18@EvK(++gV_hYkZqHan&$E{4?ddr#+J6oTk$-32uFSz
zjFNB_eltuQSS~z8dZ}S#Z#CbC`DKsr%oStIPg_;11}2C%DNe&!UGe*rYo(<s8XYg>
zhR@bm*h_xl&P{oat{R^Rc%0uW@%J(}p7~t$`5v~;o8UXo!81zyTzF0*$39K1y#G$E
zIKmn6+X0K{yoe7MuL8*%8ooZjXJZGbF-f;)$1QXD8}IQTxR3^~Ulp$;DR5yZjpLRo
z^sWF^UZ{M4zUGi6yo<f0htsG{#o#WknnCYV__Yafh|^?s@glajHK>SW>OXCbD#12O
zNZM}Q)Ro@#TQ=tK$ox$*dz<V(ADyMPZ6__-iT9~Wwrb18-J&6C)LsE$H~QrPTvY4G
zG~~!-{g!Bqi$zk~LHU4oZfT^yzE1B)L1$_fTB%1~cJ<$DjPogD@y|6TRKUS`SMNuN
z%E6_&_N%A6I%xWP#}oji144&O*~J<9n&~C5qu|mJIa8>S2BNjwi`b+k2Bg?G+$F$_
z$`EQ`N+x1w!W`<TN{%qHv+@PMYPMd@S_d?rg$|zVXf7Ww3Y#|9Uobje>_+OMC5h2l
zU!><>;c8K!&k_X35;hh_bc`D`*Us9}+G;dU7<;fO5?J2!9)zy3VEEhCTllay(d&JW
zU$J5bpaPVFK5SufYaeveY?=ku+SiXN8Q><U<@s=ACg}u45R<o^j@K+Te`tFApPsA#
zWG?!WT$q*Q<hM&)`am!=0$*Z_kE^h9nmP$IkXjy~xB@kW!MK$RlDNp@^84E+Nbh4S
zT_RW*RL=+-8vvcFDS@};+I;am2X3KipQVoUg#4nWWuym4_Kka9h2e@4L?qFonfTf1
z=tnx<G>nv)d}tm3T8X`x^12;EKE7dsp`Os&=-8-<OmxJ-<qZg|FGGspq>@#pN>P|{
zRG!T2lN*#I-}DsBC``+w(g0~-1uQ#Ap)uFYr%iBE+n#Kt$H3JU9cId>=bO6rzvh~F
zlO*g4%}t+J39lg7rH8gQPJbi#kyMZ|)(zBjkmi~4?mqB9Gg>yX5d(lW%knxCVH%!W
z?nkp|Kbo1LZ1V14^#YC$ob?8ZuWxZ{_>blQ#!DVf7KX`eeg*?C4h|@SCe*_9sPGSX
zZaH?7dcQRD<HQ&XYDQf6fRIo|mViH3z8N~5QqQQ}qJ=?Zl$!oT_L9qobj*@38+(L>
zZK7jnP)9+)%3*@Xt;>n%hhU`5{^kN5aiNqKBcw0$p5?>84pCy7PkH}o0ndPc6Uwm%
zL|_bI92d&#Uy^3vQdNi6v{OP%h|A39DXPXGE9}x6{}K9{3s%c+C+{mk&2&}OhI<al
z_g3F0q=}fAnzus#r0DAr)EZAPY!{4H-fN3wH7Cu>QDNVW9!J|E>|dWF^Y8#5IGFlQ
zfHNoS05fjIn<j)~E^3D2!xkP|wIc-s&5~rc>Sc_ps@za?X6K2u)P`d(>)+VoV{Mu+
z9w#lsB6YJZ%9oC=+;8rdOa7|}{=wbM4JkEupvMpJ*LakGvoF6PF(gxDD@K;8Ygb+%
z)DeVWRiRbnJJ-EKm0+-8rx2{48HrK~77PAf*lUv@M0eV0(@CNCg}kmWu!eNvOB*zT
z6n5J7!(?cI8Krk_vq<l#k6IR`@>gWY9K6^VwdQwr9giyYpi7iy^;(LWh0iNzUbKMM
zs_$H8M1WUU<0Rs{NS#}~yXcgt4&1g?EB^PPu;$tfvcl)%|Lm0hi|A4FO1rtInl!n>
zI}7SbApQfihZDoHyWM$vJE-LC0Mj7g>4=WTeyha_rsgvH99P>C?Nj}7D6ohfCR7r*
zNHjahnirS~ukM1Z={YM0V+JcZ<7Jp+Y}O8WDa8rducEpfwTT82x6|Ae7o~FMNs&?d
zGIyh%q7Ftsz-=LZc8tQ-_U+s^dtD`qI4#0{W4qT=ClGmB+fEi<C~67XK8&I=9uux_
zSt|UPgq7o~RB`aiNgdPZxqbQDg0b{ue4e!>h;@yfVDt<OOHuBimRETDA}AF7&dPGz
z^tco<@^+@Wa3Zxk(oajOC-x5}0jtU^Gmwxz4inwf%ZsGOmk3_%tu$`KpYWv7FVW~;
z{T7`r6QthnlFSO@7lX0`@`6;vrYME+;HOQButb~XkoW2cHV+uKyoIm6z<~J05x4g8
z^JAH3Wh31ydh_xghKok;l$J`++2N^TriDA<N1~}rj7VGGZ$AhQ;5Ry}KrEEL=Q@((
zx3naY1`2dJFvNoU@5OMC*Zykii~nJUOI{p6hEjT{2iEF?EDGS4nc-zL?C{V<y$RfQ
zAcCJdL?7z)quTS1=s#M#W@!-r@Paf{_T=71Mhx#$QXtOZ3BO!X6aQUuv#l?3ub+>b
zeLq8zNH2Crft&i&KD(M}h?RMXtT)@aXSr8jf)1%l$AkJM0y!7XO^C{<QR*yt^g)`0
zhzWzMzF0CH3YYxJ77I>QOF!VMVVN^hOb&Et(B{)-BHWFkv_&+0r{Dq_Qc3Pekx|u2
z->3arl9Up>{(LZ=5M)nctz*XLrWXQK{j+x_`g@JSv+rW^aKP+C_JMFXc_!K~uS##!
zu;C_K*OD(ljJy+5M)kZ5XCv*`6fO*qRWPsfceh-cLN|`YYixJ>M#dK*xx9jI9{ebe
zu5SdBB`PYu*5ejT-i_G4%Ti!g<z^!0RBugMiZD+o^OpX204x@W{=PkAXS!LykCeAX
z7jw08?!4)rU_y_xt7$J}a<DyacghrJ7-I>Zqy!eGC_F$s!z200&r=?XhINIm2wl1v
zi*#vF4?o6lVwd`Tm2$fN_htESC8jy{gj%TsAM=9An*hkSH<vFr+`bx?ekXg)%EpP(
zG5ScUu+e%zsLJ;+hSk!-i1<M;d2;DKRO#5^E9NODe2{hl!0}DyE9sWv&3I%>J56E&
z9z!*=AO5W3Tl(BV;VNv0D3=%@FIp<)6k>Y)w?#y#zMhS0yY1tbd^_0RX2i~lH;#;w
zMwsfnnPBnPFKg6)n+*vol~X{H6$U5p^tbj~J6ET>OMBg}_zP9F{HrP}wrQR#vj5mH
z!>STJ0guPbh`Zq)gGl5-$gZC!vOi5V>qp^2fmmJ49j_$5%mMVg^LaH0?M%`m1nAbg
zsehMr=<_j~><_LkIXwZLQU~<mj+=A6eDjDZq*)EHT{h~~5%}dSW%U%ZoNDi9&%DIK
zuD6`SiNG&1-uK7~n?{tnl}3^G3$2nEmj$kg&h2}*`8-gO8C&QnX}ViH(4!!(X^<<?
zaW!v+KQ=v(4F*(u%oqts5Fz^?XUqLVto8igeoIDKASf5%WAJt~>j+%)?0HuG;BjA?
zg&`0*ZY9wBcFj40Mit)1g_kF5kf|oMUl%I;&YjTCHlp936Q2(E23v~l6K@B$5Ox>H
znGG4dBu~h0YN80~o>AeeL!=~gaku?Z7S!KfrohZ)cTG*E8_k12?`;I%C}$mvt9d^2
z#8x`n6O3YzvHexhe{jZ|P}Cc+|3rcA`*YAEL0I`1{wO*z+@5n(2)RwD!8WS*$Ycfh
zg+@GoMXvwjbvQce$<TOTveyHI92Rj950Jj{Hir>{g<if|SY%EfuGj!<$O(v@&~l72
znw}6u4Z|J{2|mt;wS$#9(C93K<h2L)UNRJcfbivo_~qO$b$Si%3d~ghY)Me-1Bi+q
zhF&0i_GMb5x!&EuJmR9mYmP75Q$ykP3$^2FWj7lKcq6vLBRfV3l0eqXk4gJ33Ceqq
zZD4*8t**J8_P?jvHi}v)MjInrXRtNnGc74_xF>OU=0a>$@h?ztW{c`0oBzHjPsXQz
zd4r<?zi%WB>Pg@|;?`{X;Gs5ZXU)o!jedP1Js&j)8jZvksCl{(HuW3S3~>Rdr17>3
zxg1kLD)b+w_1_H)N)glcQ})-zS)YczSjR<x?zREkQ<!tHL(Za!h;3!QB?nJYG3Sy|
z&#Tb~UOQ#R-j@nMa)Jg4X=lF=@FO2zj|^g<<Iu02OWWVl+)4L2H6rsGY1c}OyGj*O
zJNrUt#!v;!7>{{tENk$VZTOVSY;)Rz8m2$))lbTvTK?uXA3^sZFuPxgnEIdh@vr*d
z^a2-ZZf7DE-b@vlFDFCD6l1OvHzlk-(ow|_mxYFLm`DXcAQf$jBeNYxirKV}gr=<$
zdBAHQ0dU_R!{8gt^P|rvMbJII!)2@xm_-}E|ImA_*tn(-7OS$pfNBiQLx}vV2B%po
z&PZX}Uei?^q$GE&D1aGCHcaZZ*5tKV(Hzm=Z4!^Pv^lP#d_=H2cb5&H?Gqmt1)^<-
zSsTo$Hw{rwt8>^7KbYynDrZQqYs&rzv1sFl{sc)4V<9<~ean4U_FSwyJ^atbN;7UG
z$```&&7!t9Z7M1QOS~0%$pRYkjajERKUJ+}QN+H-P08?=gkH)l@}O*Q<9b)%n3m!f
znKZv8X*JNLK3ym_#Ap}_pUQ4&C|;U(olmOGc9OSZN=DhklW{WIgr6>M<Qq!%&_+>u
zU-XNv=UbJ9*Fby6oNkWXJI4>LPDHI!Y6Rj6Ccp3uS`lIN!=991!nLID%3T-5YnscB
zsmHY`<F;4Ry$;l{6C-hbt;H)A!JU|Ab1Mw5B{qYer?z=d#c=P;Up5TFKH;)5=OH1T
za`!A1U>8je;)`<0MNXH;DEg&v^NFpEkHJlyr1YKupA`ZA5Dh*Oi)G9GX0|O}0qq(d
z-SG~2GyDq+rG=Z}H0Ru;_JH;DJ-`~i#1(4a6)YHY!~Nn#-Za4W?)NF2V6U;mFROg@
z96v%S5+yINm=j#Y!tqxRoT-)*_%THA2Ok>T(%7YvET^#Z*EXbZwFpYmeHA`|qQ+aL
z>nAj)^K3y6-?Ys9?{=ReVt>~U@BE7(nvKZR?UoX?K+&ubXq{B#GppT4Fd(H+CU67@
zAfV=L52>mX+AJt;mrS1n)t3lp9SJe>$&eLNqZ;%V!F@@oHhMC8tNGTPh59DbBOwWv
z@@tVPLiO*E^@xevAnzjquERA7^rP{|p!Md&VF}hxMn)rOfABmF3oK`%mX}mzi!9w5
zX`9|U#IyFo<&5M+!|Mx<Ubnu9H|>mBp9#z`?XjCWma;p=WW5?L$#U&|enVFN3#~R2
z?j&&=)m@<tdti4(Cv;3q^ywnx4(t*rHHItdPO+e6M=Z2QMJqtl<8cWH&*)FoJg6v(
zSB2z<KNp@_1nl!b7W+QAped1YXI!YRg-Q!JD-%aL^zsCmkfr`4b%em>gla>Es3Y7l
z1)89TA9WYsW!o20J?#j{R{#dDhHlLv%l9WM2k)fs9=bCMQtusc#1Czkv|H1<r8=4P
zMnb@HUwIoXnFYV<eT9ld|2EAS6hKzXu7Ca!|357OP6Q=sq$L4IsdE_&YQyo&DOzpL
zOO{E%^run7bLp#VmPf2ieMv5GqBnh>B~%vAfxe?8vsls5BCX#8#t%erv_i%ht?7@$
zlwFNtZFNicQ+~m-^x{LuSTIVAV}c&kdNrm)g9ock<6v^4+Yy4Zoz-ZsI9Tc!OsD1k
zFm%f6h4{fp>PX)rw{@2<k&X!7!`HY$G8H9HYOSD}#WTgRI}C@4?MpcppEIPG$aX?j
zXDHZyKZd2A)O}ZhwDEh6)g$*uI@F&zub<s>|34w7w?r~+Ls02s-)^5ePv#QrM8R-r
zN;YNc8o^+UF{@_M)_}kKvZ}qNo(D0-Raa-EAQTOwoEIh``$vHYhm_U_Iw}nJFb(P;
zoPm2~zO-|w&L~BehNw^9I1fSnW7^$*jp<*C&Y#q!&(Z#QsmFIK^B@ngEcEevv9ViP
z4BiCvfm}@G!yVV`WU05t^ee*jd*>)TaERX9WmuUPIL(Qh4naLLcn(XPsV96Fk6XS}
z*__OO6LoB?j3Vsac+U@{czE&$=Xm2cc4p5f=KSfzls>^zwh%sXklcwXtBI%)xXY))
znw9VvTNPyvDADAB0nWceM~V7T-Rb?03ygB;;pr$*DI)p$##6<>oqI{ccC#^DhT2h6
zfiBp%@|*syOlQp>8EjzXr!89pp;e<kpL2{aqmmvxm@(obZCtyF;52!)X{BhyudB8Y
z(4u(=AWcHq!^;F-j!UhJ?%v0W_;aOw#OTHSA%=g{*E(c^zepnTPl<-oWMm89BQvDj
zPfbuO8HiVL1tbJ`)vuz9Mnlgnj<6|+wu})DqYj^a!{`6ImtmNW;rP~9+v6q<*W8Ig
zL*Z(pE(xw!w*ZWSav>ENI+@|TXtV)%34|t#4+@5FLwVn!*zF#U_Yo2WzmzFXC!CpP
zQi<g=%5INI>0@!?_(f!_<^UfjS~RcJSN%PF>!cHhEOa^91;OQD4zCL_Qd2(EZaURv
zwV&Ntl26^`>Ohn>;ayl5wat>;XGfkvoh>b-4(D-it;*ZN!(m$?8u|sh-)H;kH!|DX
zK4<8Hn_EdfY4=cq^5+`hX^ra3zuI_nJ1*wS5bXx8Ra~2!+pXXtBQ=?NB&vD<Qt6MK
zK7MXKA{hYD2AQ7}G&aA=7Ea<WwrRhf{`x;Hz|j%)#n|!$D5$WPRg9DN^M$gv11JQ~
z5Jpdq3w{tHQ}ghIj1?rnZ`%uvRV-=02tw#+VN(5l=iMMxf@j_t`|8`8Gf*(6NvPy2
zSAF@$^cKGgVuN3!_3MXj(NMJnxe4`jMcdyJ?%b)H7a<p!T%m8;Uat%y{b}+EdLHim
zH!+_gt_W<8Ym=eOrv9}VQ>8`=UGDXj2`mwOO9-jvdR?D6O2q`z$YoT}-J_M1f;jWW
zU-~e-bmHcwEiUWID-=T~1$<%@i9I1a@t~ABDh3Z7vvtN;;!iH5X07<t=A@bmI1}p;
znMb9`eC|aS1vK4Q=|p>aBa>YDSp0%(j>>T2A|lB+FKSL6oU7H`NM4#+zndXPn{e*w
zFDkWU{!~ekdulD%+wq<u#`3u%7WsE58K8wA!E2<BczFpKc@6BdBW@oNP}`Nw#XIIW
zQ6C~eZ^F^8#6|Qn5DOgYN74QXS6>pm0aotwR`O(P-lfKX6PCQg3l$H>wNds3zsn|l
z;W`*StTWG-ToI~;hqs4C6P6KrRjoUQDzxp3dad4rIy5S(r?kL}JWO1bovI<as9)2W
z#EZa1Qf#>y7d@3B0Tr<f(Q8=yUZgale!iGzv~mFcabhXJTwmW;D)1(L(@VM9gR>g*
z@zn69q5G%s%>R*9{sOF(Zz&?xK?+G&F3V8hpyJBNKyHp65oK8JX%93GfY1$H6{o*@
z2q^xR%j#X=g+eB+;;?z0F^e0kQ~zD(<OU(^%W(`Z`jN>e7~{F02S{;ycbf@A3FbDE
z+&oM&Uh!!LnX0G^&fKs+v)hz6L;da$y=Iz}IGGMkQp(W=lX5e)_d6-!2`P6Gd!+|U
zU@?{M=Qd6<Svi25wLd!i0dQ_$ow4-Gg7|>2d61h~*Zp^(dw!c^a{t3nRXc{#`~YEU
zyY6e3dhvl9v3F*}(8tc_I_#g`_z6CUM3zLLjM~!t_5-~j;+I{%BP-^QekNQJ!=nU-
zh5#~!N7YCGgPfYcw77{bZEa^0^`@<B-W8iDsg_KiO=q4H8txK2l>>LBjhW=A7P}1<
zk?L3`PcV#oco5BqI8H8X%a<8gYQ?o=Da@t#F;r}``D?7F-Bc<Fz1(QdWbSn>C#u2T
zNYVvw>8BAGf3Zfs!RFLkrCD1ILD#Xo7WHJaN8KUo0{UUNTNmpDnR{%<2->>$8<@~A
zM);mpUmcKVnp|n4npui;;y-xXC#R|X^G>yPW<P})Mn$mrrB7;5GLb^#9zhITtF$3$
zoGylxo+X;)R5vlTh;q8e5Ch$iw4Il$3F+x4&>d<HSG8uG0hfySea7C9akvUN<1(xn
zQD%&cN&%MoMfU*XBY{HqD{RxjFJ;NeJ1dk8*3uV9D`7R-7+f^kBiV^9xE3v%sC*MB
zv&6l%l%LWNQhprZ(hSF6QeC@i>hUdip}+JSqW;Do+l*Ba^U;US*hW4xuZ%VbTq>v~
z_*QM+mW@k0;yZmj=bv-RkDCw2e-n6rtqcEbywq|qCU#g1>)P1+-r--Exr7^6%>_^L
zI=gf3T~wgQm&aD`7276OnV1|Vk_L;^Q{qf@Due*PL%4ce#M@mx>C{WB9FW_gt()FY
z%FS0Ra6TvzASADmAXCGVh*+>1<I`H%$HT5cqd?b9;qcPQ4f#V@y6p)=7gm*=u~(6T
zg;69AF0WdlnmX;9?(?kKI-HWOnuC*yBqX{$`fcRGfRWhvZob#q*GVGu-X!6M66eS{
zQ)(p7=jm^Q_D^;LZvCo6za1kxVkRhGHaE6Qc9W0Dn#ZoOUMYjOz|7E;_q7iPfa%zF
zB+|)KV&pJ){%cw_{CM4d$||xY|7<Ox8tNHAC)%*deE2L<w@F;k;=4Dyiu6--XMoZA
z$gMTqeuo<Q%0D1l`|jq#g1I!rJ>#p9H;!xwV?;}&dTBKRD#}$gOXE4!<=HQI>`~nP
z*d2CzhCU-WB*ht$>WA%A|9?DPg+o&h*A^5h0YyquLTbWjkd#JJT4Eq2-Q9vTNGKs7
z-Hh&@bc4hg-OWaKjBo1u`~HHv-Fwb?&hwm7ZJChktVUCv_^4d#Jo1+-|Lu+WqvaEF
z_;xg<w5cK9#*M-zzvn*`i<y6*-T#HlZT2#FXxO1d=2<Au&Z-e+40>>XhJ!9LzeG68
z{}}zHuA?jmHvmrp8RjI+H~W;9(LW_uz3$44ZeJ>z286k|G5wWXlk2O|NA3P%!PD;2
zm-cJioaE+Xlin7sFE97AvC3{JleXqix-hVBzBPpZnIJmnMb;e;m3(neZ`!#VQ}~w-
z1^GrbzHwT6vUl^B(^0dT0JoL*j&mHN(A<W|0Jg5bt6pYNwXlD;gSMKg=P@E!d=y8?
zDw4G}VhIuj*tKY%v(xuZ!JLxkl6yI@&Rrn7eK=`RW{<U5zUk`Bgs}m>o;oxu&R@s$
z#ed*<I*zFyQmSWQ!sHs*UB_4HfcCVfooqf4@m9c3E{<#mRLNZY=rc=`(t-qr)Z0?r
zK+4x?OVRVcS<PuTKTFUd$9@BC`LYbSGO|mWm~CHWDb6e3h!T>RKCAvnxQh|z?$9oj
zNFabWOlg{2^(BaKVc`Cg1CMD?fkAHIy3$xg`)9Skvs{4xE<BA%knySkKE{UH>BS$t
z7^RV1jjI<}nP}9*n3kai6(-F;;IZB>rqr^?LaXhN3wvRgt<wby_5fg*W|HXW<?uXQ
zCTpRezzKhrqL|kxC}#Ye(r7Wa>g9scL0M%6`1gx1E6Cg=(fA6%LOjCCMnI8*+(Oh{
zD%=Ep{UfLcnO)oPm_o>OOO}_THV$Lq-UzeSM6c3JHo!aaO$fGl60av}2~V<dhqK@_
zvUlcj!f~cZGO=vrP$CuH`J|-eJN9;?6`ZHd?8v`TEGeo!@$cxc=^+Nc!s*LdblLE3
zX@+ABcmkE;)0!`f4}QK4xpk;W<Oy}UculU1=Nj8H{OBSaOSrNy93!0G^?`?xgD+)7
zBE%;j>}pRvOm1O&MpgRBICYXF3j?E~jBw(~;Ddsw;q^%U_6KdLZ<7i)O$_QD*C%Mn
z<r@`7d<+#o3p(MHH+e%pPnJXaOL@9n91&t6Ak^6797})`#JvEG7wvfYMpNFj;-^Z1
zrYJG-MT`7hWE{3o7`tvl%QTaHz9j9+V{wS_4h9tP@5)8ee|tIf3C$DSF#E8+6d2sN
z&NB1_-u?h+$Bc2<;+Q!L-*^b7je2x^TAj{pBqOj}f1Lc0G}lU%Queg03LOvgyqvN>
z?7^eG)2|j5Z(}pd9!|6Ve1STh##fk(owl48Q^@>&P(m&685A>Rn5ycBW|)@FlZBW3
z-0NZbxq@;}@RUqmIM2q9e`xvbOA#ZUV(G+~xVij1oXuVGLc)<T0_#}u$4D01ucL=e
znj?3aV8Ou*0N@c0xm>&p3-LVAsxT_&?fZgFSG+i(qrdy&?0^1m&dEITVe&DHFy(8l
z*i0t8Oqmokjlv|~yxmTEn{^XOH;u=(d6m4jd8*JsjUqPo0IK3gA7yW9NE=>()YCi3
z<U@$mSoPlJ#!3tq&St&|nPV*DCBwf{C4GDrF8B1w(9Qrg@n?Q|sUj1-Y$ZRx`URe^
z29sD8hQs|Xauy`AmY3~?_=Dy6iZw8$-1wbjaZ}JI-+g6KqH?)aD=FVK5rQBgUCO8n
zGFqSwK9V)XfM@P61HJxVK=6NS`b5SqYptQt%{Yusa)g6_)ir(l^nO=&1^i-%AuQ^<
z!*<JB0ECyB_wCcD2o1(xvDjHoM`hwt?-1<?Hj@C07&9XMok(bq=PnK9SAicS{RD^p
zFCkU9<98Y&GUPImCGlZJ{p7(P`;0BZ5={kV9#~|t;SV_%fCmv=HC<1c1UQP->sPaX
zw2*nO?AWDjXI81KJibB+=OGypwhV$4KTj{W^D3(O6J(0F5@edTpxVR#jg@>X4C;6P
zcDdmwY$Ua+#8~rz?JX0!VwchkdY9Fc!Ns62be}gV4A#zVPvZI>#RUld{-va&5xyl#
z>bYb5Q6EF6CDaQ;&*+gy-h96)k0+W!te8L%UUThzvIOi`9`Oa!yY2P!pV4IPv7$MN
zx>;^^7^B-Rflf{5n5|>9PY9Ay;=Ir#gCuyUNR)^uO8SIA%n3gR2Jbo&p8J5M5055Z
zjy&f&B1*%>!X4VxVlX(e%3&P!ezU^%x2XUB2kOQGw-%+NgjXyFVt+)*?qStSl4d3Z
zxKc;m7BnV|9((<G_Vm-bZF^~UWPYZgdH4(oxv36HGw7FDPorA15E7}mWO4r%t@fg0
zn(oVT&N}K9@I@>Ae8ke#7Cij}b)zZc(^6?4v;Rn#M+r{Y;djyiPK<|(B2*`yybAAd
z`GArln1q7zzie@wUzCrjSqLJQl!QlqbkX8ARe72~AI!Z?Sov7I>av6P@`kF&?>N_J
zc4J=Zj<hk?OwYE9Jx}lJ-xBdZRjj#NRQK(pA)Kx!Z^9*!sv8{HS2H`y`j}+)G4|+=
zvf1lraxt-bWMo<KBOl3mA~x~AI?!S+N6k4frhZ^>3S7@TKEylIKau&y^YmS>TUV?>
zA9Gu)^+xW28^+@Bm!W4$eczrGVML@S6N}3XbE}hml&gyGf8hDKyt#orWUS$tOobEr
zeGu_nkQ3Mzz}7X%)$(#gi3iCO6gvLmja{??ZgC?wOk{QvIQIabG(ZMdt~DP0Sb}vq
z({3Go-w1Wv!PQH79rVD8U^|c*MD}-+y7qsY)N@{~JdQJbfc-5ua4_f-6BD*N5k;jB
z1zE77*N_n><4R6r{O@OyJwvqXM3h^i>Oq{#0yDG@L(>)O(kA3}o(x(Rpma|(OyOxr
zat7HjE}z{uKU$B`!B04MK>$tpcD+oO&rqObTJTcPhAWf@k6dD&k>ta-AC@nF$#z1!
z8@+<zxRm0d#bdK#i<H~csPg?+XXvl0ss;VC4?k(#qh@pT*BLg|u;p_4d&&Yg*+C?(
z7F;l-|9rkno*z2x-wWyrfBQ&4tTBoGnB0w&G_BLPkadgmSrtM?wf(M_m&(~jLPM<;
zi<WU+$*ioW(~rg3#+?;10TNhb3Lm&=fqm5NVn2W!+^@3Pgb29Eu-^htuo#3iA3pb+
z=2;Ot5+%I~R@}yrc8y9jrW&XgQ05q#SZ!X`%jxP9nDHutqqa2WWUAKO+pqRL)8U%_
z?x0%prgpa7G{xZ7X3A^yk!shvP@?Vrew7F5W(xTOKYOV0LafVci}bgzD!+_8%aBQ5
z_&WiF0+TIyJppRA`-%Jedr~i~(Dtr@Uh5JJS2QigV`;6=sA~5KfxsLQoqrm7majzn
zxFc#S*o%D2tjFRM*@{80(72|*p+Uu$BQkU}zccj9wS2ZUXkDwfeJv9BpB7N@mDXS;
z179;v*j?Ec*(j9#OT@2_JaI*oFF*Ay;G7wo!ySev@;D7&_iKLxTC0XUS)vKY#mjm8
zvZkI(;uHQb`qFDL8;{GDY{qwO)gjOym4cj7ha9HARVosyalX*%*PAe>KX{}XfcsZo
zn){z1o3r76w}j;PIYj(s9C~47dymUp;bedCWmP25QQz3?S{NT4r1Y|2$phuWmgA-`
znEm0CBA=ww4^wdsz-a8-9BN6`viwJ1BhMF6RsGVc5n3!hCq1tn$;Dp~?_wYnnBvo^
z-|2B4h}inQ)7FxRx)f}OIuX67kEe`=z;J5ShLK0c%kE%+!^QbNu!ro{Mw(^t*Zmb)
z{&c<m6<Kb9_b2zq{M;)PuYGaL?^j@e$HehRowyQcL}Da6S^<uvFFoDGS5qL;cWWB=
z4iR^u`}$+|Doh6W>0+%nxB2vrB1d_{Fhc}#Eucsvz1Py8EZ|0k#;&?)<L|rpbN{9a
zbqgbBV`4(DPSW2!P$0&ixjLGL$%A-9me%fuQ*`Xf&sT8dgwEy^1xYiL8E&f!(-402
zNl{~Y&Wc}iM~n*WyWxWd__&(}eD0OqwWYQ_Y>ZQ_CTG7vKR2Ms)uMhS*E;v+S+mOV
zD$LTc@z)44o%qW8bb<cQ)NF$9f5S{`8_~WP%%3^@MQEJ1Ufm3FljE8(Z!g$yfT%5f
zwRn;swl*!)P4Q&fZegr<7Gte=vf++jI-{I#T-asy168*?9XWRH0(MyzFAx~^K#o@0
z1HQJKU2lrr0vm<-==*TDlaanbU)C-#;pralKI}0_Z~6oWb<*r^5LIJn{4>o$^6k0b
zO1r?~&eCChJpsr@80fcF9^=)5kwYp-lH}G>(;zyBNh{^m(_=nu_>*`3#^rbEAWe))
za1JeTih0JIcg<GGCa8Z)wT$<@d(PW?vJ7|a44%{4kN&dY1I+TKVELEwh<R6Z;&sMA
zE4M#t&Q|+DvNqf3-!I)F0}H@8&ZLStHYZ!m1L1zXym>|Q$n=$6?>zkR(aq9H*Ov<Y
z<<)3UAWeO3Q#4JNysWC?nKGKaTaE#yeoxOke^{b7F*8rJF4nbuSrgxt#SKNK51NX<
z$mKqf>Uu?e!6%U8)Y!@HaV6?3I*P&<$Uz)#DXPX+mbrKU*ND)I!VrZrnt&4IO1v0l
z6#wG<rTzh;OKSH%F!G|9-XI!^)uq7cj_yk@$)w-2(N!HA)5mUjS32Z7tW)h9Yuvx@
zj<<Cl_cWs*?z)ZU5~6}y6xoX{QVti|)EqQHHPj)okLvYh{DJTtJWtQY^;-|lZ3ClU
zqGF@=Z@#x0;@m%ec^jj(ryyM}YcS9(=zn((7Dc+lTfDaUs|+z&7sdVbYvb>;5<y`b
zm}2iW8LkK%u0t~Hc<DoI5B3)13%8)6<0r++&3-q5sBG&gsx34WH{+0ALvKYt82xN5
zq&OyOB{0PvYg3ge*2n}Z`-7fHjkkp<@<!49talhGIizj0uxY>qU({6nDT{yB*}%KR
z%mnwL0yj{1_xs%-^Yf6!RmEL`LEMOqiS|hG$7_;%@LJ6#BXf`CXQ%E2iSfX{Z8xx4
z_!3GZjrrR@954Q2hTu6*tmAggVcSzWQmjSQ38YpkXJUHRvinV?d??mNJMVsw)ad>B
zLJx5ZeDySs^D1xn+Ib^2p?~{zN0}@>#}{5c<D7ZC8bqFM4M^P65lQ5z)d#j0@#3Bw
zC(!fm2`;nU7G^&ZI^1_&EZJ%)8l8q-iNt69SrqN1H<dJm3gGWhW5IflS`;c0(?^9o
z6OIBdZg}S@(3|O}Z!VCB^$@IOQL$zUho!8{NCphozPUg?kQ7>N=3xYv-9h2YCO3e9
zny1adnZg7gjnu~_o$R?vwr)o+`15lML)IF)G{@2p1&}A4<&AOY4Yh{?LP2YGH{Wtz
znUk)~hTrY^&iqv_?`cq`9utRBj_Yhvq;7?cLQQiHcUl;uzlQ;U1Xt)m*^XN|aC^~(
zM{}ZG0Owo^P@xjOF;X|t&}9%aex`-9jJSnu5NH3E8;NDP7Fh6l^9wnEx2BrMP(iq@
z>!?|a>Zd%GmvZ+dFLuy3u9iB9`Wb}HyQ22`Ya3Gd1@dR<j;EPOd7C$C0!I?1GSI|P
zVVu(_yFq9N6?RtzR#*srlKu?4qOMGPx=gzH<E#fzh;i@#j?h7f6AlC~2HD%oF6WJV
zG@hy#!5HuAxtFYCI?j`pRCsGeV0y9$x}~T^+<e373LIZs)kgH_6N7<2s*?PcZ||Q7
ziz+X>_a!{(;T1q2>TofIeVId?s%m^Wf=ssZ_)YeqI4zM*{!3rPaxg9iynx8wgAClB
z#|i$daUUUk&ml(Ht(L|}@4JoYeEa0&1?DtJyp_N3vGPFX-Tn41%<WI9G{Ict&tLnq
zX>G@eo0Np+*oVv7duXtFi&W~e0ueYTwC?8{;;QUp^~1i+nfgMgb*5+L!r`pn)q5TH
zI?PfV<E&uZpuCx9t6Q3Y9XY%1K6&7_vls4nSG(V-pm%_CTAZNSvzWDZCak$p|7|g2
z=47|^w52KI;_|=F-$C3GDc?wL&l9v){+Z-{!R29iifzEfUmt-#Jbv*2TUK13KEAwZ
zep<u-as`QYVHjgysLp-2+(vp*Ok>+-9g+P*d-ft9&#4+>IfuMBBlUm7out)dh_5+g
z@8H&X?3=)NpgGTNCY?~K;wiTD2<vZ!IN`r7Ocsrz1CErX=64d3rm@i~qf21k$)yL+
z1KJ68SLU1}Wp7)Wl&8<ISXl!)W-=+5)6!1%k`GwJ1Pw1W1ze(3jjpPGZ`NfMd@7Cx
z(M><4_1B4U=q=ZFI9vYxQ_ndV<XH1jkbUss5{aKx^GPC{j~ei7amzb;uONy155-%Z
zF+?fz=`5&mA&W*~5mI^W(QCY~htur<dD9s!CD;XQo5NcYucB;N%8T9OB#^gqOb4Q`
zAu+$#sWO{xm4oaNPK)NtME9q{_wMC1@ox&HIi9xmuY9*1m*)sGyzf@{O1p79#&s_^
z?PpR{Fi<TyH?wCOZW6?P-CK^=%&oly`CHdO^^pG?S{m*9N~y2(n^a26ZT&9xL{eY*
z<2%y83$-n(B}9yhix2ZEGIA(O)xzbS(hmrTBY$$h2v5`x!dyBCG?$#m@3?u~xQbsO
z%i<U?K|sE&wHR7m{lc$^Z_#k)yr{Sya#{4Vs^DhRprGrl_>X#rJRKC{``@Dv<n${D
zM(>bFnyw|P#%2$D5_r<={rd@Tjj#2XYk9BSr@y+F^4<t7c;EY$K0d4u))%!e^I&F$
zWSnE~Uw&UAXv5#dob_rwb`CRc5jyocL@Y0j?s=ZATpq1$9f*{Rf^P5k|C9((UL{7a
zt!3tM;_pn|xrkKjD4?gQSg(D2Ly+VraBx!VZ-D;PKO!O~>AN8?26F8&_SxlAM#R9V
z;nmT@m#cw#LUfDi=KhKsKEK=UIbt*R`%}3W#L`e0nHQa|ZNFidf&%A15v%1g^<g$H
ze~uYW=b{1owF>iH##3e_{R=7X@~^i(T<oz|SCBPIg}D#jcgr_4z%%DJM|o&T_<~P1
zkxto7=53wWi#j>?480Ov7fh5Xo4-zAsh&#TckD$G<@Voobw|M$ninlzjRVLclrJ%$
zpsRNfH+;o}P1e;&7OrlmJsmvm<0rSk4nVu=HJm*OeC&tkE5;6SD*6rdHx44!a0ggs
zWk57V%@5YDzdS*ud%}ZNVguo!A;F=Jg-xxjz-Z_b8*|GX54Lglt@;o_y6ZbHabFQN
zWtunDZh*YosQSVtFF8u+pR#grh!5<4x14YFR<*;1ReHa1K}21V=*nI51dQtfPvxI2
z2~n~~LLN-Caj<VY1~e5<gO_vg?$Kz9F&u-k3~Lh&y;lzgqu111oRw~_X!lFsN~KRq
zwz$Rms-<^n>kf1}ma>l&+fN<bqzqbTIU>GO<@iBkU@Kwu?vO2LTiF&A^4}=LePWmL
zL-^J=f1idf?;9$!5n~+0Mb_HVAg!^W_W8owVdbhX9(UF(_2jpUArCLy-fZbM-#O2d
zn^B~dFZhHGA@@(x%z6hgo9~bvf(OKUMqpf9-!E;3RxL76kV2C&hYIAmqyOD9rX&BH
zjHmY)E$QENe8PJhonk!yvuFE08O*s%kH;+#gJW!xi+0!@XZr_(QNIoLqhoj~<g0nP
zu^5qy2I#HJuit|@G`J1?TPN+8gN^o9t;Cx&(HS(>sv9e_(P8&mCN^{)y5&oihH3Q8
z?Ezarqi4YSx~+tfT~F6^vzwp(j;IK(iHhJ$v5)}Jtyse?LY2R{dYCkF4|8H8*zy`c
z@kVTsECKRyQGwQ&=ji;Wx9dIL7lXaq$YGx^wTRqr<*+3^50;$h%d@??9?$9C)IAtu
z+e+0@-O!%dffaJ_!2hNZMKA!~+9!s7_j9B7f1dc^FC3C8ScqKGP*+1B7mzHk^1ZEF
zNOm}A?WX2%Q4H#9;OS6%Vd2iXWni7RbrbXSd@2!H*W%IaZt;u-U;6wMq}4h2n09W}
z)~(f9^`4rkB|&JGCegN8<7~W<GzsaA0$-rm+HAV^{r3OZml$1^n3u(#x(_2)0rrWR
zbHT;2e8>D9w0o~S$wv-wJN3bL?j>pr=*S8E{pGEjts${z;8ZOeu<les+&G?w*BE=l
z`W5D8@6}dr!jY4vribCd(=7p#EwS@uuh3su_CDbf6%Bg<gNNi`V_*J-K{1hXI|P`{
z+W=984EP^p`AZsD^c=B>8lZ6%PMo6LQb}ZFe8~g4)}-~zaQD=`;sea!@H>sYc%VJ7
zBnGwy^J<-?sSKxUZ9VYqX&ZDo8flpH(6|n)65NNW-vQs&e^;fp#R;f;2=}!w*r`9)
zXZ6t;ax5)IzVUlP=Qj;9YBgvEdNBQAULs!qq4jZ-27H+1f}oe!F-z$Twboh1@hwTZ
z{Y5L*q1J9K%d`gzay*#zB9EItUhu;(_G`a~ZlJ-0SVy*Hvuc$%4d4SX-(42Mu6HrB
zUS@s)&3_D+Y*pasq(RcHMD>tB@Z3sWOz*hNQ&#a8sHG?O54{Bb*ND(G|GKi?e77k?
zw2Vog=GR0DoSIYsQccRyhgWXS2~)|ynh<*Z#%Ov;U-La(2a%Pl#^`OCJba|yp=<B`
z<CXqP1jSbbn=t65JHa;F?P1LCb0oh$<!{xaO&31Z2iJ`ZwKz|`Uq=g%VBL3ix6J+d
z->pPv2PpFKM|Qt`PRMi)@@rUOJgV#YPYd9Ri#hZX@24k6SPi!M-GZOFlX~14(O;(0
zED<~V%rw7SC~uzoRSxN$vsT8?cyA3XFlbot{B5|`P)>0>*$Sy@j!kS{P$k@86(ePn
zv6Lh>WaT-c;_zlGZ0kzRUpRvN$&0K0oF9q#=C^Xmzs?pmL&18Ep0IyWQKf>hH=dey
z1y#Ee{oek#L2N)a@KoO8UUzDcIAbFwoP4o3mA~LFN$&cdSxwuoh5%;`uX=v^KDnzA
za_6V%S?+bwu<Uep_I?zsGJdja`M*hy`v{`AFt3vN{ZW8$nzkX_PwLLDx~85G7J4nB
z*w&!<aGK(RF(YZ+6L}6xlKBByVc)%kc8myA3%XfOQ~bQM>8YKFvaWv|z<G~1ep~Bv
z@3ESNpG?AHcL6W}R?WHTHIR~;-!>h7+nI^^bd^e2`u9dm#D6v}b!%1QO5K!0`Z}8e
zzigVy{mV(Jmw}_u>SMQtI(ebXfh(wegWA|fzw}lBpEqJ~47<LRb=Ar!1`yRPYvN8-
zmggfdW5`;oGKC0(RqdwEDahoV?AeZO-h8{8G;=gi^SW5Y4;yS<)^W59o|IYmtnT=C
zXEW$;?;eoyJ_Kt6ivmLoX8s$fzw!b7;uClApe%%{65tcGz&sYb+l?{2fByafbY{FE
z$)R!Rz|{tF0$`?ibL9Bp1)U+$XclvJ;_+49zQP?0ycDmIQXwBr&R4G5`b4sY!jjSv
zuq|dJX17+SA_}ZiPu2L&>bK&Y`}S|M1V1W*1OB9BGfx>v+P9{b(1!@jg%8irYo({y
zA7sa<%4UBylRcapT%)WXHKIwIIr7>jEb{A~540AWyDp2(`TRXZny6yo!H&|4`cI!Z
z_EKkR(FAMibJP&_9v|l2AB0zDCgooiXdP%>>P*?0zH+E}o}H(#rq;z?u?6jwKz09h
zqQYGvDpASV2z<HKNpur8$Ix^BeAn?<&b!wfxy*MSX?fM8_!hPZJdcSzcUs|fU#GZ?
zx>517KYYA@x!mDfPv4!vAlq-x=24w64K4P8NGGZC-}hPD_jZci*0f)s_e$#`6gNEF
zu1N}?CLQN&L3NZz0XO-m&;MsO(qG0vRpyNw`}>Vb0;JCR{M~1%8@ZM#@A~}fR1Ev(
z7KJ<uME?dHw6^FQIf}`y3AySQOTR>=Bz%`o+}xYI>EZ87>c5{aG^*NeQWRD#b@Nld
zcxBLUsbO6-cE>AoG`!&Box259I9a@%JlS<x&BMGuKvB-W{>^>N{$n4b4|%@bR%v5!
zm+vTcg(Y|+No<cFbhFjd!kuTJ;vs2#VUHE<?u~nCKNtz2Jh{6_Zxd9(^DZAmenB?o
zNmP;gI!qGQmuH-g4MKTeHoW&=ZR>lx)mHSkBRL6t-}*m0mmPd%gW!-fh`y`eiUO|<
ziRKNwK{L*1@o!6XBe}^!gMDZbqF7sb9(a4#4dft~J?@fhzZFk7boY0c;1oJd?h@*_
z&G%fL@_{5^gWGh1r_#*rqb<s3*LBCK^_qd_^XX^aKrSSgowlLMvpR1S^`YGNJPSq{
zdE8&|Nc9;|%e|Z6Q3cJiS8%SPs=l;l)}<xPDgGUun{VO))(WY5X)7K%L=!Eu7KT3?
z5^=nS9s?4TU5M68wU_E&l~$m7_}pzpO}6mfRX^I9&Ol~Yt!3&Iid9YF^kK>5ut?xG
zXrFSqFHNw1Q7BGVDXcm|&%1c#CbCs?@63J_fJ%__{+|o6yq#86^@fGa<q*UCU36O5
z5{<NsjZ)V@4OA=QavPW*sfLXQ0!Y1F-P;UHDy(|*fz;4f<+iMRAE+IA9y*c)ZHBb&
z95g?>j2yjW=IuMsH#tMM49;+r+-&#;d(g~Q<rTQm-Hoj3IzS)u<E!L3J?e&+;<s59
zrE52bqcoq$&Hqiij}d0zU)|7*#tK55!oKH0pL+)+RFf%uW`05#MOiQ}aU(5xzLH8F
z#@`y|EpSa$wttK>*s_{F+HR=pMf+LXQ?}01lzr7h<7rX{5bx^wZ2Lyb!ZHaBI-;ZA
z`d$Jlp`EgjsFPS#xpvc5VYi)EslDTQR+foMGnP?)_ou5{jG_002u7bupZ?Z+<>`Tr
zuEDLuGu*mTH}@8?b=Z)29^)eLee-vXY6#_J=ZZl4vB32{gP5-FhZ{khaxAJ)aUtcm
z+Gs)-ad%lWet;7o9d}L0lHK~j>(jR%fq5rozrXzM?e)5tfzgYUFQ%hh0M#P%S5CZ-
zopi3-iGjqB+yEZ80;de0@vXXzD^NsF&>_{kfenXVnsyb3*!Fy%_SRv}i-|W`zX0~F
z#BJq*WbwUQcyHLruHVfs^4!G8=eI#z1d$qJ)&b=?&=XdFRJM4xk%2<6(RdVsF?E$^
z5NwCz1rXmN`6y#(ZY8s>4twrazi6bDbc~YUD>NT$wXSxs`L#OXw4A>}K3rTHIdVrF
z)_)E6zzwgL0KEPs7Ik_yx`%y))P~gl7IWu?=Tjm(5fwLq<LTONS37=PNFU`<FzeAD
zKubm$`+ZQ?-j+5dXLc7{s>!xVc%+e=QM==n@dEbugQ+@@LUSa|Jv5pB$GJNx2n#BM
zAV_7<ASP|_#MP+#vZhROk&k%W>!E(i4vM8Q@7Ka`x(IW>ZPf@g)O97HAiZ`A(oAPs
z?0m6%T@P2rf!k(y8~7IIqd0-c{|I(@ICs!KR2+VGOT)0IgpK(Vi%wi%)v5nT9eRjn
zc&l}d{zauR_%?0k1UloZPjwW6hFt=W7-}o`EG6^56-2)Xp(M>k^O)-Zo~e3YM&gG*
zHwGp!kYB6zhnJO0I=vScs(V!aS#AqwG-<EAB^9HKBF{T6U3=;zqT7EEWmZ2?W(8ra
zG|pc=o55hXTY{&BH<dJ%8RT8~Tf73#zpGLl_I*xRXdhKQn!>Z6*=65Pb{REa{I2B|
zT%>^z!IbQIC1y)z>L#6dCWKQu8xMuKvr5wC#j`9#M72)XR1N-4X;5O)J5x5wU^3@<
z4>D>~J;5FjuxdVC?D5xiOW+PXas2e`=BlU6we*@CGN)KqZapB}@!k(kWc9A6tO9IU
z3GjF=KncwJfz6NcIwXXZ``d@qfoYX45jsc*#SC~iHFN;6W4uo9XhxD%$1tN{I#Z<2
zZRSlvmBN@Mbc_k1E2^7f7}7Ut4JRQt@hhBqtp%OP)$30s+a>v7hrQ|rU(>*E)(k|G
zVx2i}t^~|P^pxF})z1<O6H!K!J_SM?yX!LP_MHtwe@bZShv?M6qOHEQSSc5SuA01_
zB=cgQm35i4=8esN*)Ht17p?-w*}hPm5+b@&4U(5Rh(}lI?^sfCSzx^QY`7p^HgJyr
ziZM3QcWdcABKB>>B`>0<jB+}me7)5TL*;Sk8n0=0EjY~>IXL-3$cCoTc=|naWjCZ$
zaSu&_b-vcL1^;D)^4yPjIb@$$7V1b(M5%I4)jszN+UCB9pBj-wq0dFR8gy)Pz7X9=
z?zsYs<#Iw>cJ=algTlS8AG&D<fLftt%l*p^EtqUm+AnMJT-IXzn5S9XUOQt%<?$6#
zrlS`YyFB}7_bX0!;Zz}Fbm0(5m{%hU(fEBFRjBI{Gt^e&<-+U+-PX8y_wsICD6L>(
zpf1<*$rT9_31;`acZ=v1bPEQxPX2q!11O!$IQ5lgQd1g#$<D`69@X&P^Q&h#3&$44
zS@qK@t{2TQ#?~8$g&5-YXPQmAl+na`Egx&|Y#)E#osx1cFm;K(+CL@Q&x1&}2(B%t
zMiMivKUdkcP~FWgftRQd*w|3j3=3~IlfmUBe5awnX=33Ql+jyjOsYGxj9mBk;TpOR
zRual%!mZf%Y3#W4e!e>ZBF~=fv9Nh_s1Gz|>>@?3n7w#~H@9a+M2(@^l4R>!w_A{`
z5-Zh?)CV<11^JJIOu-AF!P;W!Kf~9pYAWA7KWy~*T*mR-%1N86TJHBvs2o?lg5xw_
zziSRG2<$xaDS2O=^+kbpzIFY4+dK81D(K~|ec7^e<0qwae>R)FV1vR672+C>@;qcu
z;K1H2`7E58aC=3|1`$86p*f@F>RK?)Zf{yHO5atL?a9}6C11rA5*12yr@kf)nWZVT
zSx6>EP`MTuJZL7@lT57yzlQ-3IO#a}y(dMkJI3gZN}jmEKWu=?Q<-#(hU_zJ%#ORp
zBGNOnJmL<b{o8>=3Zb0F$v-Mt^%3*C&#p_mTscXecU6xQuqkKj84kkxLvGK1*JLQV
zn$H`@6@4y7J1bHak^%8`$N_LD3)D3(z7txtm&t%D0G{=r_O)Lt9-_V0@<~s-5yg4~
z#JUY)-NEcz1J}fMTkay%X5CCF-^|UDo(?$cZbRW@W#I}8qHUD^h`km3xCQ+2RfeWf
z&kB)hEh~el<a&P68QrgJl;ZPKPhd%Qo_XsoebWgF!Jx*4H|6odb7jkMD9a66O(9AZ
zZR<gNV)v!cA<5X4pN;(b#_NXht*)tIxXjb@+Fg_+<RZ4!_Hw;M9&5~0Q;O!M^duy&
zia0SHS3o1_8g^#an^4Rz32YX>Q@7`DdOnB$q<NR35)39+5&r$pa)WFc{Tmo<ahs;j
zAPh`qQzpL{E8&HgbK7;hi8;1*yE993@vGHzA(3XqQ69`~?K>|;>uR?$WoT0<vC~GZ
z@g)lyZj!isb|~g@&;)xRc|#hffE92mpac-uab*6}+EC8%cAqIK*hqU?(<;6N_22$@
zWyo=<mn8RO_z|_9%R=?w-1@5Knjxoh%oM{pEl8dHi`M1(=Gi%`Zm}T>sDo`E%Or+q
z$DAfxXu&jdlRQ6ZfUvFWDYENbXx^|F?<w8{1+HTDuVmyO^0R`6CADC*mu;{4JcP~2
ziTt!`W8Rr)7u7OVfMF=FA*PImy;s=N7$mtCc!ABz8zBJtZgPARMy_Pi$0teXe6sEy
zjtvU-eIaTP`f<a6KUrBt{kj%aM9G=N8T9O~7g(g9G7j=nFv-b7@J}mO=tO-><;iE4
zgo?Gq#=BBAU3vWWS!#*6c;h}G`k+}bJ_J;{>N}EFF!T4({0<H9j+f@Rz9FA4WEbk9
zRLRn!qPM1M40|@ghX=r2rvo16BGtCxpM;wvHb)<9GEx=I@6sL?`I8+8k+;U%;pBOX
z<Y-#aRt;i{il_FktOFh6sTXU@jI0{94l+)+riKyD{Ijpz*h=3|s6S#W3eaK{-0wwU
zOWMU8u`mf`G{1wx!rIVDY@NcaYOtRCNvaq+541-!OS*zEyP@t?Tb;T5Y4?u{f8x?9
zbwwp?!)tQs+{~%EZ(A=<d=~Ag0?SVY3sWmiOLF~Zjly<_yIG*6wXLa*tUCaz#s9Pb
zg|lgIUySAyyq+?rIv5IG$S9-TIeO*pBQfn!Me2sjTDc#QtYR%@y9saJ)d0#o5;MOg
z*$*+FQ5Gho4l`kk{G@oHjQJs``0k-zleU%Kz-Uh?Y^>BWl*C^1X1O|e*|p_$Q9T94
z365KB!LPDKEA2yl2Z6=*Z*zm-V~D<Yuj8o1aVHX_yQz5Jm{&klKa)^@_9Af#T(+vA
zPc_+3^A5f4u?N_6ZxPbad}2@p@TF2ee@*KCBAiL4Q<tpuPHL6j#L(1VK%%z`Z9y$a
z#$XD`Ujb$Vy1DAyEL~QE+P}1~cn~N0dVRGHmKrH>R)>)}>-hwboDeG=)>=@I*H@V3
z$LmY)$>>`ang8f)D08Kc-*Ysi#+=$s8*D2W;}H?#W!Z>I=<TZOsWV|OC@(fr%bdE?
zfo4u0<vz+W+Ej0vEbZLZ9Jsc&z1f2JVL>f;QCL$N4>8p~WOfipj}~kt3u@N`2HyF1
zn+Zimcr6fKan8q}nC$PnZw3)|gy;CKIIGk9GZ)i+`q+B!XLU0T2x0N9nbU&Jv65tY
zIlhiwNLGa}L_p5T50Qe>bu$uY$NPS9Gt^XIQNDv2{abS7G`2T}TTDN%Ib-+zu0B56
zW61L}KJPe*w45e(tDQYjK%qEB=-STo@5soxthHHgel)|Dfv<1nhX7u$nD}b_60?ma
zk|^dR_k0{?lOiRmr-thC_&x~cJ|pcRlwFWKXdbwBkXwD!rP*^I{ZeVGpc_=_T0c?O
zgzV9*@#1->z*k)qm0^u!kgR3f7;ry<5v=IyFjBox<FLu;ZAV$O=2ZDV5KQ{$#EB-f
zza6utLiH3l0Tp_rQbM~m9b4Aq?KR^nUZ0mB5&FdHeL~e%vg2IrWa)?0S2vhf-QiPk
zr4kD-La`&X$&yROaycJg(iw@HS_1i`0?o)JkomKfmNdHKmKo#2ND#Ig?{Ul0ztDwI
z{xFT`DoT3di^I(ztmNr3<dF#79&dme&r!p09RlzqN=OXI)#oJ)`JPNZ-z~2OV6(BX
zPCyT_3>Q_w$670FCebV#|MYZc)aW`{U(7PcclEljl*&@i>f)RNR8+oU2A6mGQVG`l
zG}iI00QDbHZmS*F&1+aZRl{ZYGj%pO(l@%Bre0g^jdd}g>~JMTe*B2!3~o#f8xFO1
zTY#&%T^#2rx-kp7iP7zRjV)_dtv0@qa;279^c2WTS}iWP<jUBo;y@vJv1d4_-2`RK
zc)BH|+7Mz^OK&u#2W&}Ou<@IS^GiD5?szTPa$_GCPgVpMZ*HGnF0&cn_9<gT5(ow$
zRw(*3+?_nfEr^)_n({TQ4>$92HZC*4NbR;~@%Grl6?j#=>IpA?)Xb`TOWho3j!GG9
zQW$(0%Vu=%;W*kG7Yb}oTF(c$3v=^UCvTe{_ddT$^*EPSqNw`(0|EMy0ydCT<qnWx
zQ(I`tDXmih6+68c*MTt`wgjuUx_$LtDO)`H{3TLOX@vh_75T;U{p;bG`pfwgFE&vB
zo%jLOY>VT|=8p1j6#$qMe769Ola7twTU~hs&rr{FsMNbWY2Sly$x}XGouU-flc#aM
z08d}vt7SsdC4}|Icd0R=yy{qoF`3Bilj?_e33C<i)RUd-2MYx;&JDRzOLg<|kU8$c
zZF&0|3Tcj~8u<X2)xxZsutG6-k)@j@a0xIqRc`^FxhPcQ@u2iQfbdX78>1j_^diy?
zBL?L;GZyh3HR>=3zJHwmdhSx3!ESX`g1hO-*}Sx6yuQIWg6eH+e`Am<PfjHEj8hTq
z<{ZiW8N+_`k>Wf=*uZx}S99P<Yw5^BGcMlqw&Up5R>;LwCufoJ+l=QYf0pIC7a@Mu
zgR;YT&9kJHU>X#);1Hl3?HM=h{c-7r45<b(6<5lMIHj=0a`bq;5pPwSVw><N{Y^tY
z4?g$o4ea-Mt%`$9p(0i0zmOBYCCLG1olRXQ;hh?<x6lPfs2e6wSutznd0m-JpJ_Ty
zGy^ICaCyI>vgLLZxIbay*~%J47fRZEq;TSDXP1*!es!64^uBz9yw*;U_|oS2&fZ(=
zy-0@M@O@gj@K*zx=8ob*Zz>b(HpoH;>xZi#b4`@EKnl3Yp*kt@4x|_e`YL6s!j9cs
z9O3^B)czf1u>?C-g8;*pn?1+*Hr=lubf0xdi$s4}0L$PN$&9c}Y4SFD)|G3;yzKdG
z0W9*d4zP$$+dQu+^H&`Zv?|flH(m5!Fi9vlIwDpaEs9Se{7^~U+)*}Lmr()m;1Zxb
z`1n|x&5iX-95HX1|CB35b|0wgcD{v<acKM+Si75|=09G}3fFKKu+CAw1ARYr**Gj^
zX^xf1iueUqQig98Sm^*2S2JtR__YtLnw34^hb}=OUKWma5UPv51il+Xws|v)t2)Qe
zn)yK?CMdJ8Irc`Swz&AcLLaiUQh(Nd`XoK(;;wd50askpPE?yt(eYz3S(CAObL8hj
z?hM6qZVIs?2JB)n!+xH=&<V~NJwv@A$OO}U;5xD-py45vI?^Q~sj<azx<#dryPrya
z?{0{AYovLY-T6TERyDWv=;a!H$cuY$!l-o+*Ttjhgsv**<Y{O#0*4v{zjtCs%{+Cw
zagS%|J3GBVOm{F?ufkwdb~a~7>5V>^#q<s4r#2?$!LMeah-#(H{JX0L8)560fN$v;
z(OgUh(jF;iC5c_5gGs{~Dm3IhG44Bz%}$Q78NGKJBTP(0#qXf9p%#taJ!OxYuWg$H
zw*oqkTtX&a>HI#DjclcNs1%XZQx+ffGI+_9rrz^Om<MAjsSK&6ZP;}y+QYAU6{%6U
zslmQ_)X$Lqor7_H<ik{d`VewHF<sF-X5FnOW2k2t0vC%ZCDcFjZYB569OLi({-y~p
zl_jlDPne&??W1-z5qwt`F8|kBvHbDstTj~l)1~XEn%L)g4S}Fbvk`XQcb>Lj7e!`n
z!yvqH4sGdI&Hix_zBM9PoAQZu?9g-088;$pr}-sQfS6DP5r?Z(5%<LVKyVwD6ZrR>
zzNGYOBrjNZUM3ExR|(dE6-aaH%tnCTCFIUt-=i|`KW-BC4C_fv)41}pB^>olKOv%L
zg8+$y{C)9dQI=utay#u2pkeZg4M~IUTm+$Jq}^I1z9G*hfsl*OyFIU(d7Dw)f?ET#
z!Rj5mgL_dXRbbV?Kp05#qjq^UAOQ1A=Mh~8b1}a3Z*|ixXDi2|lv|a+hjXh!XP{ry
zLo+P?F9+{!^oeG`o_5{}7kMdf7WaCp*4~!F+2*|)oP<HwF&fxbs@YmNCA&S-k>m_!
zFCeajh{MgEpLorL@LkM*W)k@!VDX0$?BKJvxNgTv!f;@wl#)=d4q$;#a2MwT{cuWW
zI#hq*SXS2tAo)T`0;|}s?Y>QKm++)?2}kUK-D+=@Euh?t4D1N;U*yWrJ-b^kbl%TU
zQs9TcbcmPOMM4vMx5ap?1i0W<xjkim?PbeZ%MQZn=Q{ar??#?>Rz=-5Cw9V$1{6j+
zy21N|XWB;%w_By^P$i5sDFHL*${+WH`G|Tu&2Rc(^`5EMuri15zBU8S3-xC1dl$?J
zBzCRV7K_u*oIcEo@Tb}owA|CBJ`MHW2#uZ0LtbQr3}qeYen;;`19w5dy-via@C^l`
z(pePo?wt@FoMi7Wn&gK6(DqF?Kc8uo2=cHUeGPq8%)U^dR!d|MwY97F)`AoN`51$T
zp8!n3{%61eVbIDf3v*6HUNM^wTSs|?{*$`ViDQ+MYgkR%^5br|X9#@`Rew6)%A7$P
z`wcg|H!_{OgO=ZlIltp?uzN{>T0f=A3fu^aWmFM5!>thQWom5~|9(*YZ_~<m(~vjU
z8DVUOXWW+-U^_DYq8wMe36It(SXpD{(D-@TYsq&vvQ=gPBOZrhFIv6~cf}D4#tj2i
z4WbW1eow4y>nI7%UKXV_-$qGjIp8ix>plVH4^Q%S3`31J>B|^gZ_^X?en;O-JXg3)
zF3D(Yt6IEWet4#y!GKB$&z#*bMp3ZF<|Ac}V~$&1M`rz)HWZx_v0Bf(rZoAD%dhDn
zn`|t<2%Z<0!RYp?yii2^*>8)QGP(TT5;bD$jn(3I>!v2g10xM6_x6;(929<D-5-)K
zYIm@x`=0b+i|WVXj&mmZ$&&4{rk1^_xA5X2)@jrficfRkA8TjziQ>W-xxXTKHC!m+
zgiTUk+g!e3@rl`SBKpirruXcNEqPUbXVs!bz2h)uO>1oAv5Ecar%BCc$69-Gjhd!;
zE{PN{#CBXE+@cu04LOBy*)F2h91R5-X^R<aAAWQYFbK56rSW={W%tWD_Za(v?CoHo
zQ)JGq?eTrY=4>thX?7u74cociwzmsx;k{g=HIAKVDeH}Cn<tYuU_v=Gdr1q*zPfOd
zKg9<No;)l6r4G6CnTF2CfbLL`MvsCt?0sEe-37QI^3%k?#<?|&&~--kJ!x>eK1m#h
z$na)E(Z~yPHW=ATA}76#7H81VW{AqkkoJpUncJ*nG5BZFT*|Rw%VXP-bd6lj6=>rJ
z;sR)^f|ya!D`{BOPBU@ZXX+a7pR?%`#-2$=cLfT2=a~gBpEe(V)b>5NLHRQ(JDL+%
zDofYSuzj;>JA1XCmOlT<;!`7`Bfr-I)HVmr`Pz4m%UDXi@=YV4PD)+r-G<bNmC?~+
zo&WsD@aSEvW6=nUlXrcBi@M&%u|=vguA%~&d*b3p#-!=y9I8U|0<b*f9MX;5weBMW
zH#U{(Dj7~>!=j*zRDpUFD#NawJv9FJEg3^(zJl%W<+O6TNORH+R9s>Tr`pm5i%_GR
zV&B=4DY?c1l`pvHK(;Xmk+9TVgCgo+hY`G?V_xJ{SnfT#bY8vE*8Eqbzw=#BQrVO<
zW^tA-U|{=Ikf=#*+5Q`ulLec*4<!xzioO~7CkV`(gOn4>h?$2k{zzL?|N8~wK3o?Y
ztoPTQjhtmS%*C=I8SO(Q;>rirxu?D&O$yJ<ifa!Xf%H|H4JuGO$i?PfR^h8n(rh&r
zttah6cum*Z+>->r*Ot77iPsbZz3Ig&i$X=m)X;=})+6GATfn`?O#qclLZ>}Y4>6rU
z+5VTr@;C@kN9UUfA!>ozsWRPtK-FD6sI4_2(dKx)lJA3RyIw7O<~9pcg7Ls}d1Bf+
z41o2a>P*7^55pQK9T|RCLjQaDz!OV*$$qb~&)^9+Pv)z;pF2Hnpa80ikJ^DC->SQi
zf813-{Y%Xg+EaO4HF0uny-Joi+s4-|in>;%yDR!u(%xb#nn$FQ@6KY6^$&5<!4~df
zzHGu@k7}UZ)PgKDcGPpk&D3L&Xd6HGvZoPSLWv<Dj0(Wji+`^Ue@e`?fa^akz?4PP
zA9J$jW6m6xnzGBjDr#T13tX?9sH7YTwiY0;D8{uhp4hahew|?=?uyYSEe(3!xtlJ4
z1J`KfWB!=~V##&E&CV@Zbx@vtv+WEA(<l4NOd1S690*-4C9{TjB?SA9xuZVZH^XXx
z2fF|zfw_U2<m9Sp)hMwJ9#4<B!H%FAy?@MN4<KG9c~e2otOua)J7d?bYcoz5T91BO
zEE-8OGhJ0Tv!ieWvQ5e8JaFHympqu$hD}nW#%z1Uw7A+D&~aDeB+)Z&7r-JOvD=?f
zMM{2gLTCmy;a0T%xSB6g_zb!luK*-1r=ddNqtLY#IM-96U#|h(TdQpL$Fl<^g4sdT
zf(>u(Syg?#uq*%#ik*2W$dRU$KrP+F@_@Qt9<xYUgl=A8eF^eoG(tBbcSvobMJ<H?
zB~&%9@%ty%tuX7bqJgL}EeANc-i97_O~wW7PS#H1_Z_YMOT{F7Xiu38Vj60X(wI=#
zbYZmW+GqXa6ks@HZF0#iWhsrVz_0lU^Qlya=Ft_tmKw3M|4nLKF?=nC&lavSU7xxv
z&96@B_NuveeVm+!z^T|{e(7Ro_gK_>le50)vFCBd>36<CeW=_RR@|9|M0sC=%Pxs`
zFC)Uo(jP5o&slqKp}n!L;qg~(0ez9L0iedoX{a?Spgh6v)ho0cR<4YzWUPHMTls#J
zaNtK4zz+;t&kO*0RB`F(h5><As&S3u%1Wi~jo#f(O2m(5EY1Yd67?uZwJ9zfIP$Tq
zS-+`lUoOYr4;OEqkyvu}LB8qStp`SLJ0>vR2r*Ow;KgM-wg13}DtBzNeDe7+qA9}j
zP4BM?KwIS8C#I*x@cxTB3uTMdarPn>7cGcwY*w?su+SR_)hUl6_k7MYvIudTC0|`C
zo8Xh(Q~Kyi&lyBU3XUl6n;-q<@vZYys~%=Bh>9P}4O;Ax@y~@Y-AKMgD!g9Ysj;dD
zX=l}02fQ*<@h<0Yj5~Urni8s)SK^J^C_#RgEdahzGgOr`B23WQW3GEwN3`xybHSr~
zR<M*pAv7dn6@M3GF`qHvztEsri|8mDsQaj$L{VQ{2fF7+QC8GDr1<Tcyx&3U%E|B}
z$<+65?!uw)iLh7XDP8Ni_wK5$Xo{(~qn@*kR+i4MPMa#F#bKuv^6%&4vg(kK3PJNb
zZ(pra>ISm=F214k9+`w3qoptr3*DdZ^a<(+cdnD`It`Oi?~oNZ!te*@82+eBby?l6
zEZ3mDQOan$iS=3>Lmt*Ml3%8_VQK=2A;lpD3xRL%aiv5JlN``nPC3HsOFOa7YFVW=
zOKK+PpY~o~j+1g3%V*^5t-xLK9ke76%DMj3?YEtNvwFyx3TtCe6Xf?vTO4omYqqIL
zDDqmrtoxGN*N+feHUxAwKMf^7r8LheqYEbTtM}X*`-ukG(G)1>a_utg^qbg<Cg_V+
zBb9JqPAus;ZU|kN22f$$X4kwMCWIt%M%T`NB_#c1y4vDe^o()bx%y1moJvQ%O{W`c
zR|a#L6(ll0)R5Nno9m=C-x>nu+;%#EYn7X=6zqHL`yG^OTZYEY3X5Kepgw|0k$HES
zUvJrRGAdPn!1Typj{JpsQ{bbKu8m&@el#w@<ZhZ<5frktYkbagd%^U;Xv{61O)l+0
zB8NeV55ejH@!y@TXjkuR{KIZD?bw<v*$bh@dI8l1`c$z5;h^#YE<<TfZvl$RiU=wm
zVQ7=pj7+8y15-Cj+FC-zGE^aufC+=s^MWtE@zr#Q3h=vs6_MU+#P+b7$Od1MU8~kd
z>jcuOb6JMIfeos=7E0%<m!mrei2(eqVhUFG;aH+5U3QD9>>}B?hbdhABDK)XHdFBS
zqJ3VV;yNUT(L~#6K?1&uD#ra0BUXOg@JBN?XR_s$y`PXjd_~Iaul|FYP3Kun)A6K;
z|H1d$qUhIgZ9(8)$Ioe#r>OMVN;aM4!|mF)-=qweJLAx`SbekBi0LMkK+<SvYi9(3
zx(O@5EoZWD9BOp@-p*vnlGO3!aO6zueV2Ah*E{ELDwWpvMX#yONO#Qu7eBQUdr(w9
zykoM?YwCmD%7+D02LdI;Z<nt}d19@4=}-w<^*Q4Nuu$Vuk+iD4k*M3edTYqRR7Tjk
zKvRiZV!rfM2#A>2L>pqMefSauqa&1jWo47Rg>&7!RSXKYtj8^OTY3cJO+euUegjg5
zDx5cpJr_Amb{x}FV-0T%`5t>T6Y9#d7cg_43oP*#EJ<cyls$tJne}|#jTV4im4~SV
z8E$mais#AU(Ao1#wM~a>eOMib-<)VcmcO|~XTXT?xU$nAmH8^F%mFP&8889LfKB}8
zn@2akow-JEaF2k0#s|6-4+SocqBsBYT`wcDs6M_?EGwj?D^}L>v9YrL-c#ayKRM6b
zK&SU)ry4)pT7~w!Oy!(J-ftlQD6zFJrEQYes66DIEI1Krs!LN)K6x$1<#)T-NFs@-
z9)Ly~X=iA{S=o@Wp!O3~t?ESzkFz?_eR&=tBQK^a1vp%XE)kca-I<6q{!&Jx>LLWH
zVXLhf$E!ZNlAT+3uyL~g5T@CHp+{J>Z%`Gj1b)FMwWzqd=IJQ~JL6~cEM6kp0;0Fr
zYAkK48Sc=$tAB5Npg^#@%gC84I=TA(Mxdpt7atYBD!?@VBott0;@c6t{bEGQa-w=M
zOXb?QEB$Z4#CT}3M<UN+(DHyaST7HgEk&Mkj(^Zz?S*<MF{xIbsYz|dXT(g<Z(rBA
zkvq-SLE;8posNL*wtlwW>a;qm5evHfC7#+ak4W~3TX|J1lq{ZSdQkIMv;oR=N}F3(
z6B&kJvBGj%Cy+$bya5pAgXah;no!7qhYWZ!kzc9xg|~j;2cm+i?0(<t)WL?@F&mW+
zALpV)z3qgsp}!j5oi%Ul7nQm11)u4q)1#OTuX7uUus5QJXUbk=lgG0WB3@k5(^-hD
z2Cci7`>#SK(@M4g-8|o;oNv_;vD})Xq+m>XS3n+?|1hi#!!!e{fByg4yUu^M+PL36
zs1AfuqpGxawY6#$rCN<GDQedqsS#Ql?p9S%wDwliN{Ct^2~xX8C=n}0QB)$d2sOfU
z+@9xec;4KvPLdbr`kb8W{C?kco$JAOE!Hj$n~W+y1NDaOa>ojji6^E80r03hCl)B^
zO^MoP`1e)isCqdx=c4#hV5(K4FTe+GOWg)aU9S)B>)K~^iE-~HbHdt;#9Kn~h_0<~
zE3M~ZRdo4J?Hgur)rJaq9cDh22Qy(?*5PE2+Q8t)!VB8|F>Q9P@cms7{(f7g&}5B}
z0T0L$Q3)~6pp%4bp$!15u3B!Vv+NQ8{^X)oBSj1;`DA4>qttX!E;WkHN@x?IfsMQB
zROtrlLw(Y)l9*32Fe#<I0x3zJjiqjig_fE*%_H+4j0Y<CnE|f>K|tMO8S@g={r;@<
zTb0xP&$Ey4^xoyU5wbfuKTo5UkBQZPor8J(feH-Tqh-<di{d4=(1>i{<{eVxi*1We
zKOx2g<8~4H^!D8kK4OWX<7sQs35IK$c-1x9%i)=RNpoh+;+!85>pQq1MekF3&O6Xr
z!5dgywkFJHo#DChg7?R>UwVsyGjb7*lU@z4L>C|d+c(HA#ayK+mL+jS@bWg6m*A^D
z?klwS0o&0KvRc?9eJK=RcvrM#33mUwNCMHx99DK&y64|;F1M6PtkZ5=las0%=Mq)!
zA?vZW`3tiPaj{0m3}m*@V>+S(%?VP{->vBL{>Bo)!u(<y<^Fj1!WO6c8CYID?a>yg
z_}1l;xm%-(CCt0_(MX!28rwzs_Yv(A;~8DF`lG5x*2W!?-s{Z`17qw%pEwQep=N=L
z)Y$_t(|3lA24&8>u?~5O9oE2X!vk~ds5h}CiH8bdZtnfZiK#VHlNJ}MKG;(7FgZ7|
zToG39+>%9XiY~dw&X)GL(AGWFD~gz|p>z<gDbU$<Hsf_&pF*R3KS!ndg^j+xfloJ-
zj^J59wotj{1Ms~3wNqP(MMu`9#1bQgQ|hjxOdPhAO^LU-|5HZ%cSPt*!(S*yNTJtA
z&PAwe0^#wK;CYRUlhsV!q&ipWek5C<BKOuL$Y}3ND_O-M_)iT7hTUIznCm#+qP6y6
zISLAR8Qg#sX!!E^r&!AZx<hp>6Q3{WrVuGUdv~^IS(?2Pwdm7bZ~wJ-#ppDHPk3SP
zk)IzVjW;va?tuqSSIqj)OB+~uX79Kr{M!uPGH99PWebabhS&<GXaf2(61FLZf87q)
z3}-R;p0sd?$dgPi1uWf&+u}C-j|PieA%D4~`9`0J^)_yIotU<?f_d%yd_*nd&*?J`
z754h(Ts{)=Xlc|PY5v4cP|y>VJB?JH!|G=U$&SLNb?D|v@7R%6_-8lcu~M{tsC&RB
z3(I0BD8>q4Rj2no&Uq8@CvYpoG2zJA=w<0ac2_m$A}`7G_W_zH?(E`^!Z{B=oaWI~
z#|-aaT96f!hS~L@6c{a4SvfMw-3iu`;^X9Vfv?aLH%e%?ney0u(DjlFOvub^8k=~t
zBEK`5>y?bAR`pVR$GzX1NhKFj2tsu0TmEFOFQ|FI+}&5DZaF81py5{RTvd<T(4OdB
zobF!Rdw#8~3l*PTx7{}gAy52nz6k~&yDfIY!WsAS#%ika>Qt}dj%fl>e*KFfGkXI0
z@avo`2KiEjd?$JBj6LYOlOvmK@q$^cQWQVJ!OYC#<6F%(?qTAPyAZ@|T;EfD1_-yZ
z;aS4=-7x?usbuk_BhcEG>`v@uUvA{7=_U)X4%vI2)<_7qjwpf+Oqg;++?pFy;~sG8
z*1o2fY6`hGy7dmyO6aw<aI?H{%i;--<CcO*1};k6&$lDJ>cmIVa7IH%-P`q&B$W7x
zd=z*!yIfsO?z~p7+4qWgdQ9y;vn7W73<r<~pkOE$HQklbo`JpS09~p4+yirO%#C%8
z)Lg7UC)D2UN^cOZ;FUWA9=h<cCs*CaJqQi~DW)MCx<?L;<4z1Ud+-w>FqQKtfhHAs
z7lZO_PP%7u=8Nm-x+q^YUvu-bK)2a!A=pBH>jH96sGCx$<Qp)F7&{dc`NVy2)M=ez
zUI`jm7;Gy0CA39pMZnqNObIjQv@Qp?LYl4-AXm)A80^Vr-KtV$SZnf~5p*t43zL4T
z`o_URPNoAkZqzM6Kc}wI6JgcSa2ju6ZsYYYnz8=+T-6>+qOwgvs-mM1v9g0Fz{mgI
z3v%O$V`NKjP{|M6v)_s+CzqC&&(gRwwdMDUJ5#ahq)BK3FE6*=@4}kQVu2g5(;J~T
zMp$U<m+*CeJsM}9F?lB^0>OI$l=oKo7<*{>w`2ge0PzTJ!;{8=FJ6^)S)roQE%})_
z_sVY4?Bw7<T5Hu9H~!qJV_>e^IvI2?T(<P!Y{9^gs*hU`gY#HsIs9Vq4RdFcc59-u
zZ_j0y(W1)BUk^X__&+Ux!uuhAR8ZF)PgYG&mvBYvY!qB0SM2#D)|5iL_5*N}Kr7hC
zz3nzeyMg3Q(5n=;-ce~XynL?8>P<EAPv=O`Q-)Z}0Q^)okvjAigM<imJ~RgVSLV8E
zNx`pDy=NBDw?RS;e@t${)t_bBJDPVx&#k^Ve-|#En$)Du`(qC<wi_}Lxzn8<O5R*X
zL!s5#-A!ddE}18~`hMRBN(glW;9Nk!sJWc99&3mxoOKLI&TT8vx|`Jh^B5EKKw6(S
zCsndlK`^=aZGE|`ueU1e4I8J+sHAd_9M>sZNbP4zLW9|wq~{`O{pN{DopiZ$lV4e#
z>gAVdd~ck&A_emX6fS+N4eVRuPr$6tS<ZP@y0;eF@*nm{k=W2~3>EvU9s~j~hsZ64
zGQgk#KPYM#RI4f_Q!$b4n=c8GF1s#zOh_7OT;poB`#>)42-<$|x;NKHGy97fnMeDr
ze>sq4^9`=*ZHIe-!ajS58mmcPymAxO<5~(6X0I`Ow{9Ekr7&rcJO(xA9NQKrBAzCy
z-3|%+6!=I%uNiG`h4!vrsT0Hp#vCA!!`_@V`m(bD1{<@yRduG<E9R(ANvBxd2>tmb
zP!9U)T`a%+QYU6%@72wncv#V(HgZR#45vdc)Qyz(_Sgu_inAoAA&6a@-3wc+i=D6*
zba3;(P^#__>gVNCX@o(>xe9NcP``Ivng1-A^iiFu$lW~CH%cj&I50bN#u-tHiM+`k
zXZ*@uF9x}WhqKMDnLh2_R*n9~`#olMFQ4KQ)>3!HBA}V3Vh>#vY(&QZ-(>*&DXz$8
zP$<z>7c*xzK64u!Xv<V)2R5uY?ScJWzQgl_E%6<Q$FrqSPiEEcIUIZ@eJk#5G*wtc
zO!-jy$!X(aKEVuHc)!-vd3yA^J5_0CF91Wj5x<+C-dXl)r4Ui=mMAx)+f}(S!}Hs0
zt@ykYP9Q%?$y58saH1`gW;2o$@)i9<11N@>YV$9x?=z7C$-4r&jLjcQ72{c4e&S#J
zp1#}0y+;%@rx6#0(rKcR0f$|(C(+>%*8UK6@F=@rh6&;3?qj2#Z)KIL5}xmIazDwB
zn>EIeXps{mXfW4CuY%%Edbl9xc)#nIHC!&pU47XA>RP%sd>A0E=ltc|Ul6PsP4;b4
zg!l`>O6Zlq-0Qk$2cKM(zj+e$<)N+v$o#|3ud4K6nENskR!9FjN(z|uF8EgdP?p*c
zF2UbxU85#Kp<<AssfV|1(2CLNV$L;1#RG=6Wb<ydu8k_;3_cP~t<X|ytGc4c{S{79
ze*0CuRx=tBX~gZ%a61SH3Y3JD3R!=+KOo^NBgA>lC{8Cr>&<{C9z8GYsP*D)3NeG%
zLRd?Ls2@k@fVix&V`BZ*mDe;Z9SpY~j10hjx`BwoW4y)zk7>*}TFxU{<owS;h8b@<
zJ*GIjN_yhKWKHig{=n}ax4L3r#_s_f=UCaW_#Am4&<M6ao(i>I9FvCXv0TL*8<S>n
z<0eEYJ-Gtz(7bom$?=nXCuM_pN~i2K7JSEKxqkq*W^`q8rgp65yJIScZ*)iZRsF_n
z@U!Sj?|#V1!2W=3y-PL2Uto+v>mhTs!78a)@niT%06oP5;0f^7m+yA9HVC!4d6N9g
zsk^Up_%wcPR*Xln+9d1Ozv?m@ua=_NCI1;r9_KBLkM7hu-k<l$Z$R9*8$&@2)$2sH
z7C&iu?|T1Fdh{nXkx1BdR&}@(2I~D+iUh>B_PzDK10^E#h1K!YU&s$KcS<$2w%5&D
zy<aK7sl3(gf)2+>+NsW}C3#6&_R)I0HAJ1WaEmKqON@6o3*UF25Mjc{*08Zxb8fSm
zBWI9a<*@-$UfQE9vEv2Ly*yE!`egG7Wx<ofZZ1;$@tR2>F(3*&Mc3HOwz|F~IV7%?
z&WlYgu;?3o<11qZh{S%N$1B_x>Ws`p|B+qwLQ#j`{jqmv^pUw{Qao-Acxd}DEOQOS
zpPHPRxe?sW6w{C+!~~MjCddt2{q={QX3C<hxCZ_9SKUb<?RS5**0q--<aVnS*_T%K
zZ8ie{DgubA&=<jNUitSYn?rvlsqWbn)w<vu@#@lG0#qyKj^NV)S)Pff5+N+4^AUY-
z{go-*P;|pY{MTNentv*)do!qWlJvVtpWW^lUlM7TzRC9i5-xV7eQL{_62yhs!tFLW
z#cz&BB#^oL3+3I0(?OHt-UhE+-8_&d@M*L5&=v6mFzGjFWwuv0Z1_V|L>ikv@@#HZ
zQfeuLIbqgKJ-LO9k&_v5_p-3u{`Cp#lV|;)e;sji>!Mzdy&{c~>m&Psc(S;DwxD8~
zs><L*C>$@P@~qPM?=P_P4z3p&#EE<4eLwl}2|U_$w?Up&aJn=8WZgQ>>;5#?kpBK%
z@V}?-@UQul6(d#bbHvt)Iyx$p*D7Y4bW~U!F^Sv|yWbj<x=IOMJ3mj%kK#Us6OA4n
zd|Z`w=~PzG%FzI$<#;Y)qc=!ZpY;YS;ztQu4UO(c#SHK4)J-R6c~mXc!d(AEMu1-*
z(PPPz0`ciz0U%DtzJ37!b>|uBB1uUbc$>|Ru~oE@B`r>7$rK-=&I)P$&`_5r;KJ@R
zBo9*O+{N0Y-^ob2K5?oBClohv&ya8QjyQiIaoq=#mrX}?ar_~j%hNBbgLpv$x>u8S
zxN_cRKc8q?4(d*nF)sqdM{4qc(pl*ZwZe_*-1RA@Y#I-INfJ*%amlCr8bUokreKkf
z)SQ2%Cefx*?VG+)xBvMxcJsutw6u#3B^BCo!G8l}Ze{je_%gR%62hGO&cQYRbP$_~
zpcFdB#Iz>ITET(*-sJYdFj3z@_tt2=($@eTj*}aLRSiru(Uh`FhcMm{kV>!8?L?=P
zLd)GOQ(ZmRRQI@~3X6Z%#e86~7nNGg#<wx_y4lqHJYl2ycihuDyJ>sT2G5FS4!1m0
z3{ns_Zdm}jx0%9J^Z|#{t~C^S$f!{<LhWQlc~+oTe!m|x{wUtGb8QpM(%MB3yzAAw
zJYvDP!s*b4Xm6v6_#x!+FW=apKzbq+F4Z#f%DwgzU63c~%P!gqGd&&GF8W0;#V@X(
zK87s*kYwpN9%>*Z$P(NK_&djk$v}i;A2O_tpoOB@%S8vl<{o{idVQ<Kx`ufOqv}(R
z9{An+-$~nS>75R$)zx7a6T+y-6yN;sZX06@(6Ko={p|Msp_i5G+Qkm)@opx`>V9w1
zxFj=vr-&-#KXRfrm|MWF-O)#N^J+t!vc2gk(ehFEFAtNGF5;<jom~f`llt-x(Wu<s
ztMzKK;AE|A+pzaq!`)FG$i_+YOnbC7ht=5-?O0a_lq&a7&|pc*0RP<}gS*@38Fw_j
z<J_#RldsFsY4_>+u{uH(7Ku%=F?YY)v*~$;Pv8Pn!sd@L-Kc|VeZ^-xthBNAQG=!7
z;`Xjfu|pGN=^=R7k#dPfbnrp2S%sg*oxwl%Ey%H`GGzCd>IRfyh=kYz3!z@;2Nv2E
z(itl`;QXfQ^|dMQ^15qRR}L4*G-r#&4{Y_dz9~ZK?cE7xg?S=-eZF@OGiuFBm2(?B
zDKl{27DPRva`<$MUuhq<5m}+GtJLhaC|+|K9|*ME{bbT%6Rp>A$Q=ed3HO!JGmo`0
z@WoYK|4Oyrm^Jx02i^TA!X<`!cEK2qzT|>*7NYv_I0yV?E{^7q)4IkuJi=AvU8y!L
zXQj&Bp4skc`~2l;>je@dqW*I0^#I2Lf+H%Kc~5sY^gK;A*7>aBaw~FGQ?{jlrS0NW
zb9Cc9b<!3aVb*_ThHDx(!4~JpE@M1`9ERpKe`L~K3r*Z6S8;s-eTXkF^fCg)D4k*!
z8#awV45xFJvvj*`=iGs9LlSFJW<Yn)$Mr7bOh+IIcvt?xyg`}*f>j&i<mp*#D%2}#
z!)rVqVFrCmuv;D-i&-Nucmu1w7?HD?uFuChcYG9O?eIjn#LbeQ#g53Oq;;EV)uHlQ
z`!?x)vre%3U(H9R<s~1xKw!M|kb{Q_?d1I2nOgJQOJ^7lljGPx()L{j_TX5yvyI-N
zJvZC3@-@d5_<h7Az!a*@v%g9r<cog<(&_QzbGRg_xX(|;c)^}>VkQ>dx5G$R7r!y@
z4I|S8x;)ewwfW=Aoi#9DqQj_WZ&brkAinZ&0w7jT0Sfn)T5IUprrq3I1E%EGeO7E+
zD}v?aK4}Zqc7OEq_ziUv=i+xDjfIC|3y%HDa}~cNMcVuuz9s}g^ZC?(9Y7NneUoZ9
zUf6G+*QE+TbQ_M)5sE>Xwcl6U@|L2j22B!}OYo?DgUT}me=s-LtUSSE98QSzN1&LG
zcMZF^aGNRZ;?=+7wniu-ifWOfGc4!MEnt^&k_FTAc4Jd$M=Lt9o3QH0HOhP?C+z_|
zMCPt|FZq{cCB_UEK$TJ$pP$Dc<7E$7^FegjvrONSx)ahxj-PFsNf#dc{02S{GW$%v
zT;iNR!yo_p8X)uWmJHjIy)J3ACS11qX!~Irm&OOLdI@<{Pk3isYH@S#+SQ)0k@@ov
z|Cp%C)r%RcbY~To*oD2oxzX{OA+n-^X&G&cj<MCuqmfKd3U-%1U|PX1+A&)|c2RZA
z>8OQB8CZTnnV$70UwY#4GUec+FOg>xrPn{(Y`1@2yZmf{9DK{097#}}Etsr9LZ+|!
zC;T7@CvjWSbKwti%plnVX@yIn8JJ{MQet}77NaC<n~Mm>FqV)evR*7tCtSiefSz~&
z5dh62ywa)+IDfkV>T2+^*bAn3P8C`l+Du?47tOyrIlandART<JS{|d*6Oty5g=f2S
zKcG|Q-GagKZAEY=-dD~-qh|H)&{HpbJ4^R6?QH&3dYJnXa#4T|XYg;9YCjHmZaz;t
zcglL>=?QgDyO?Z<MV@cxru9Ds-wnt037pO$bWf`^o|VlD9>g@$g!Kz(zJC@bGQ<O^
z9f9A;qwe|!zAJo{(Gea@&c$;IpM!J5Y|!ugOQwK~(3XXv3F=B82d^@o`FUg~zynh>
zwckK)GnxOJ67?%Be_2L38Ibf-ctX4y3!hZ*66(zvk9{;;r&l5b6M3Tl1rC)Zjh!pv
zuaZV-vwKjEo9F(TeTmRj^#`1V3NrUBfdk_|Ecm*JY*>b$TQ5ELvXGRMGtT{5iFbKu
zTNiW3OkOXarpQ)Y3XD8^X?bX$y_5rGCfy>jt*R#8NlMPoB9~XVGlbhWaIM!k6_Ut9
z`3P#Fn~W63KpSl-<%yF=xwmt#6i9e0W=Ln;%&n6y(5vtyPaORwQoUQ{@|PoBpdC?T
z0%K<=A3DTR_28a{=?#mUK{Y9&1vLpo(7;iecpjVC*^Nrd%1#?~P-NdjfdP^hJ73KG
zcy(v;fXta{$fFlU)h!WN!9;=L72$2%N}*l<1sB(mw-?vD9qYX+-Jized5C-~u|>{K
zO82Vqyu}HKY;!ROF<bXk(zpvFrzTARXR_z)ylht%cH8ew!<k9f)Rr%NK<YCXSi`kn
zR?~KFSZ}9%9mPL@H-|$}lG_4@Us}6*z~2lAV;gcCemG#MtiQT2WTpNjW>jlfv&P>k
zQ@r9Msb<+s+ElIa;4t!~*H9A+v6O16!)=MFc&|yM5AMRqJvgm|D<S}}VwN0GlRHZ5
zQFh}ON8U%A<Nj0-pfRMm==e>><6#jtwe_~orgHMR>luBy8`z?&qNI$Cfnv_7Ph2zz
zeNg@OJ!HJ3<({ndwyk3gyIWZpf^E<N3T*V~RVJ~>b}(ZWhFiCux0f?Cpx78M$$C~?
z*gcJ=COKv6ITKYo#mGO69T{DT(o7|RlHe|jhVzk1HH7;%WNz6(j!<pBYsrs4>cG|i
zA-k7ufi;~JzLzd77A-2t3{zF>#=oL(4c2=^MVCq+#&?PVtD*}3S0&KU$&*Jnk}C_<
z)vSN_&0l%U$5KN$Zg*AzmOqO5k(LIl?EUj2v1_aFQ&o)$pWR>O$t{(JUmvm}wz*4+
zC2X3N(!kk!vw0ig3Kl^Zcb0=%Hw^N3=Y;0Guh#F1za=^sF$H)ZQnsVVS}y8ujf#r_
zT9Jg9Ps8|uD<i0$_;7dS?zkZqBwi&p$rVNIqa+xX&6#A9ZuvI+_*9+8x$20%E{VCH
z_M;YGHFavphRKJ>7e|kH^9{c|KkQypj(z_sN!poBMF-Og`vSj)GrPgweJUi=@guU%
z{D)$1_%7089$A`i_P|@kUxeMKz{vr+jFEVL8Aw#m=Y22=nIYM+uSdK0(FXnw`bmgu
z8)=`P5+=U56{I_Fnt`qs&csoDBKF?6Q3D`h^eJ40$n^2s8^@I<3nx==E(Lr}Ga)$~
zbKhRy62-{KW{#VKU9z_Gf}Yn`EG(W!n^LA<w@LTRsZp{NzoISLuy3q3SEiek53sCq
z3hy+eeV)gOH(Ns{@+JYlqxM>2RdX_s9nOD0y7QN*aUv@2Z%KAwn3ZLXtYfMBrB^?x
z5u=3k#Z8h@j8md<1b#LP8AtH!GIO>sK5o~$b^TY!<$Fc4_e${B7dxFVEK+k@KGKf^
zaQ0~U4ES?02!Wn{K7yPKFf+zVf!#@_u94GDe*Td+P@`?>3F}vdnl3O&&By(Vh||{U
z&X*UqAVrDV%QH=*teC2N-Ga%Ji5qX%eyi|D{Oxnt)H#bc@Of{Q$$IuuIZBE$16<Sl
z-PyC34jnr5b?@~1XZuI`kN*z;{RRKcg8v?b|7yX1<?#QdBkafk!|v_Xfs=ZH4=48V
c>(N7pniF4D9*M~UemV3&TmK$f)AsfM0A6x;@c;k-

literal 0
HcmV?d00001

diff --git a/docs/images/pr/chat-image-delivery/remote-before.png b/docs/images/pr/chat-image-delivery/remote-before.png
new file mode 100644
index 0000000000000000000000000000000000000000..8ecc682abaf93f3c2e7dcc35da60939885685224
GIT binary patch
literal 19007
zcmeIaXH-+&_b!SR6@k|R2qH+64odH+D7{DxHS}H$y+%Yu0g)a$B29YlBoXPo6MCo#
zp@kA!AaM74&iH@1_nv#t80UODKgP(HJ$AxgYt8b^XFhX(d#9;Hd57T+85tR+it-yB
zGP0|~z{l{`Rp3hdq+$pe**|0|Z(iy7rEksOuy}}CINqDS)jEHl@5<|sx^sE_9og?p
zjemBSMJRl}+QCiL8gbK?cSnb>;l|Y(iS`elrVy9&(=K9)*;<2vvw_I0zP#q@YGM1q
z{`AuU$@oPJ5r*2S*9r=3tgL?re*O9-a^Cz%WZ?G|m8g|FJm=QYywcLrO2Xvi;j2CI
z&hP$MJeF9kMIw>o&EpN=!+qmxWQ)kuIkV0BX$X=Z_LqPgdwlmMr3%k8k58XJtITxA
zuqag7^oWp=U2wvK&%~ZS{ZMQfSACsI<#A|es8N;82pQQ))-eI6i^D$kWM>)s`b{qG
z^$Z!=OPHv$L8DM7wErG7joV|Ljhlgt?CUdGMxnZ2EZ?R+fB7;qJw4)lo$LcYCnsm4
zT(7>4f{w@6uU|bpJb>+c=>iE(D9-(oYeC1vw6nhc`wH2IDRz(U|900?4>Gctr;T#=
zCE_9!^z<Gg=PAfOoU9VN-RCrU-cXW}{bUTiMn=Y^v<RF)?>z}JvJa5!RR6cj!5)i#
z2bh70V$`bpcGhZpPkcBvGq9RJ@}uO}qq}}Ei@PuUou9Av-W0<iXXS#4dS~`iHSZ5*
zYMtfRdDUP7NMAhSCK=iI*@r(P&Aw;?PWXhl(BiQ)S89Ta=hPC=t%3g2Mm`|xH0}#3
z2TuSG5y1S9gn(I-X{{4Y5B<KBZEu3Gz2@a9_B~PQ%9ShdfI|Vj3gvJ2^AMLy1>N1s
z1LK<&g|4$cU@-Uw1?}k?j9zH%?~SZU*V)Fk0d(&BYU?gdLs*OB7)Hu_W33OgnC31e
z8+7t6OTwzXn_D-Z^0Am{fNrXYW1TxXBsf4>Ss9HW-Fe8x9{EJd=47_s-S(HZu<G0+
zX}k1rrR>qXK7RAczfHRoa&n{eD;udupY0}RgYsBzL30G3_Af6Bi=TYhcr7O<;B+df
zZ!wBGhY;JSbHq!~zvch1q_j<l{%DEu8$kps$s^AW;26?wn{S%9>my;i5_Rf30p9Dw
z_fCa9I|<J;82V1siVa-n4%SSNZW<k`Ycn;Dn^<2hJ88(O!w)97ajjErz+utXuiZYb
zv*DjV_jsj1CrhS{gzXQHz_FZKJLSloTx{}4PM2x3Pw?5%KwlF7bhR%&UD8uT7yHHX
zEIQ*}Y;3Usf4Odf0UjLej&9-@<3NbGPYQu{OdpGvxK1?L;^jyoXRcbnzlM^$wKv8K
z&j>i#V4@&krtkWfNcK<ULrmYid4qDB&-wL>2UIlPq)}`)kjilPW)=mVW~Pky;YMB*
zy>PFKfPg?8i->1=*g4#$hn1Xs%-F6!c`Z}^l3G4Uuv{&P&mYr2?Y%ik$tYog={JH0
z9-r^`)d>YJv`A)Vejdt{HP3!6>2FeEID#OZbw~dFOi^yyxY7PCK9LvH6tt$=5kWIQ
zKW|ICAO*IyY2e=6S1L1YRQ%4sBB++YRp~MvA#6W{_4PGxw#!H>-t_a->Q~~BCm#F=
z_r&y*wyIM*BI&B@>xVXz>OGcT|GT=aYgd&b9&+0aWlGxhuZM+Gl^%iT8$D5D1w-no
zA{T!<`Z6<_0%raJ>@!Jz|F6aH{#su_0cEB8WoVmH^xel&{SF~hR;V)c*4?9htK%JX
zZgCr0{?Fjx;3JwfJRXW0<?vjr;9bWRLP4GH?=)ZmPszL<Emmp*?7~X#T3^;g(e!Wa
z96qC}WXy9_uF8JCK5pZh?gP3Z(Xr>lc~xtwCgRyapR2%N3M;W5i}C;FI_K7v^g=cc
z=cm|(h2qZWQ^%e-j_mC0drM1HRMEHlc~%&|B$G?B{rzk6kgZvb3U~Fr&wC~*8|ATl
z^L6I60c<LpQuNkzwRCgC-6v8FhLu*SjbZJrFP>4;Z}Gi#9r<<o?SWDxjUd8rul(~J
znt4QUxUJfjRqxZ3Hj8Lc_qM<3ags&_oSt5Bdki@v4%}#RIeQ@FUt}I{FZrGBuc6F+
z<Cv)I?d^kA9X-VrZESMy2A!X*tjEOsgS#5b4ZS$s1$;N)aKk|{Y$TsNTPLwMMaXu2
zzE~-p15{*M8Boh$*5oycR%IBrj%YpaluF~~c++)_n)=5*wl6(d?&OrQ_fmkbZ&bGn
z`c(dU3za`;KHLV*Hj<Y6{*$mMq1U-r$jA;C>cbTj)jxjx7<h~;xZJsOde$|PWBY+k
zzetZm_2Ez=FZRO)8d&4&n@Un%>kZB*fq@`W{q{?Tsfvq*U~&UKbM6e*dbfEVP}wqp
zzS<_BkCy+Lda~cfI398;@3(6a&Dc1UAzff}U$KPgmURLS?=<0bmq|#SmNl5>2eWK1
zOt2gwkn_T4@j0>-gj@i86vk)t%wPHD2jFMMf9X?@Jcm9qAxTFj78Wr;_<VTwfhCcK
zH|filPY(qzv?ogjIaCw8Dm)DvhSh}SEh?QRdYgUm0Rgl?;4FC)Kav9-S9fGHxXxwz
zd$^^sx_~6qHZ5u25dkc)a4shhl(JA}HmjL|a769&0S4x~zB@2gX|0;X=SXa7wW#TN
zoWErmvTD_vphAAk+#SzZUhIrOm7}8=C0PT$Os%l_<kthoZ(1?ze3U*dAka8d6H603
zpG^W0vGdJ7vOWaAp13?wAeSUBjpQgzSKC7`1+SBnpPkP8diKQwfmnhW9zvRFZEfx8
z!Og4f9v{Q-Qc|74TPvprSm4AX(jMPuk$s@4*+VeDvoCk`>eaCVEjnnES3J8~lKM5W
zrz}61<u85~v)?~x1(Mi@%O}^PbN?b~DagnY*nqr8wswmV2*8q8$pKG}{sWx(|DMZd
z)a217^=@Vo_=6q)GIM0e>1g7~7_(eZ1CTtn%{M;|0k$USc*%q+GiwgQ?Vt72-@jjF
z+c!Bp{Ep=M&SLn2L{7ylS3&|!Romlplzxb`#E&@4!JUtbLFKEpL!TpI0;C7j-rTEY
z>#vsupGXI&8=Fy{G|N5p2)dl7-kdBQiyNO7wm;sPe*h&S;Afd~!9_^9kgfLEHl^hu
z&+XpY?b$k&_-vAJy0q^Fv33(Le>u{oq{%2>MhZ-q@LBeFEzOE3(8}DILj1ee#92J@
z>|(ezY{_yd)#~_s=ZSQZh&}@&BOmM+05c@UfUsWYI_<N9(Fo4WkbaPiHOFpDI1i+X
zq2dzKlfegcEkUO`U}ibUNqZ%9Ia}bf>7p(7D)jpScBoIo_#^Z7{DZMF1ofCvg(vLr
z7O-P&r6%?0%T4TH#@Wwj_bv~Cr9GnDhiY6=I9E}F@gsdN5#9re)_Ujua)qZo35B|M
zZ-yNWRX{H<bPF`$m*=v9hwG!Ykw=17erOL^m*~)(zb6FK&t0Au+6=vH{SbOh?v(IA
zqY~Iqx0x0dwL6e|acbIreseK4_V&kpQH~SE`eRt5<YAdhMV>)6Yp=kOV$jgw<(vX3
z3(^&*ceFDfxUq`6E^mwoIwb{C*BskPQP8$CE@2KXuN66?!H)N}oL`EZg<d1i*UTUW
z+a;!ryG&Qn@aS<3dYPM}PY+shz2!VHQSh*^VrQmcV%a=$;Ka5wf`)f6t2qWOYu@CA
zBjB2SFU6cOe0cqZaxgN<NAtB;hbm2}T6{g}jQZ~GF>K*%r7Ie0e4vYy{2CS2u)Qhm
zI#UB=aY+uX9Sr7~CvflqJ<ECe#Rjn`y5OK^S}DZMxV!?bte!+(drW_dtJ(<=$6ukT
ze0r9IEYClA+7Ia$8o!m&UORHW2r9Q$il*PX>wkbroL<FD1?C;64aeM;*P3b!wjWGy
z1S9-j_{=pV@)|54FO_hkd8<~|3k%W**q)n$5@%=h<VxW({_3;R#I6@GL9>=Xlsi5X
z&Y_m59{+40L)sS;=+B>w^~Q~^@ugJT^rUiV!b=S+_le&hf2N?53OR2tN?c&c&R(&F
zOZRUEpIY@NSMtIF(NGU`6S#3H^F?s}Lq#zbWMBwfZVh9-^sD0lJ2+eEs?-@ppGU#N
z$7hPZq4UB2K;x`Kk4*RWGVM#qT&k!uoq%aW$b3^^$T3AgfE0&s98TxEFMdwae|fwl
zMc8(Z)2vAZ$ZXE}XNeTCv9Y$jN%WEsy`lu}Lm8HQ;J4(T{*i@-Y{rpDfRCQk1spn6
z;q%o~X!kLPJ@K6Qvw0Za7;8k_994q}((xLoLz_LjqJh;W@qz}8i-4pJM7QcBr=9dh
zK`^2}OFm2PvilxewM}mvf1udrRRG;q10WP82xgM-c(-AG)VFKdmXV%L%V*f&Hxk#W
z!En4O|MNq0;Fr7fHW)fV@Lk5|>nmDL5>isC?5R@TMKILgYiHEGR0A+UbYnHPKr@YD
z|JmwPY>rl@-06DG50}mDGd!X%MsB4|iMpUS|MM3{*?=uvJSTJFd3Q}Zx2}yOIW;51
zBW7*&yY5mx{WC4I#afTci?Ay2=G{?US?I;p!Wd^%nf*{Eziz&|(EFnjNx^g5zyp(d
zanJnzDmYRA9Dt3+hmy$iwX(Ep97fbrgnChQ{pJ-8d-t;r<or!NHy?9NG`MX`N&c;O
zohP18NB(*nxvr%BF;g}$WOuREZXnHZ??=ppGp&GWO~^bk@YpIkrlO+49BRfBXw&vZ
z!`JPMR#4kiOv!w(#orU#pW?f*%3a^$c6PK=s^6T%_<Qu0DN-Ojz*2G?RJNNG=Cj=1
zv+rn=Ffu=16-p;a>`xK)UHbSIQSaUZKC_)6q>9Ra*JWa6&f<>eFYq5+A2Yqv=rdp}
zi2`EU{&}OV+Cahi&lb1SXIiNZ0RuCOKc7l=#dE0T)9Dz9xDT2((yFomp|*fdM@)6*
z`l-X&<hGDj?60?5+uN=vw}lPcD*wlm?gaR@32Q)cX)XZCd!?Uq`7M9C9jmRKnVIRk
zlREgys3eNZ_Qe=Bq4k+jY)xo33k$^FdvURKG*4CKa?Y0xS*}}OCpYvhzQBObM7vSd
z)<44{kfY9RTFkmLYGT3J4UE+O?UDVETPNybub>ZBuB=c4#mh-PTYEE%6{#%_Ccl3D
zM9tab{Nz2{?FW-AkH#@jrP$zYBIR~Vax+rI)?nf+5L(8-{gXW<4mH)W4Ag-4Sf|DT
zW)Nn!wSjr&8Vwd!OFEZwA8es~EIzka%SbJM@toM3$Qu$868J0a&Fp9Q`6_Qrlu<Dp
zgl>6X{Vw~X4y4acwQZx;0*@eF2%6Ih=omsO8jTUfy7kd{#+vD-l|hYqk%&k$Q&RxZ
zaG7!I7bTl`mw%>cX~{)v8|SiO%KJbzg8kyPpTKk)8t*YD8hhq(97wFb{*QFo|KbAf
z<BwQm8E<#Y0`3s~L|DMNu7nNwSi3af5HJqFrVNBdDd}LOrW&KZd~~q9s?YAwN+<5%
zGK6^C5lIW=;J}lwmQ{2dFWVcPHB*Gv{#+peHRpx@isF2L*O>Y-cm|KmdZGB1@`+Tg
z7j6`Yk)(qmdE0>Xv>2?Qdd3k%;5)r=nOlaGZh;23S<|YPb!Yc&i)MAlMJD+WzEYiP
zJB`^oXEylqSiUC3t-A>{q7LJWC=O(%Sl4chxVwN^V-R}CeK+QnZC@gQYBq`zd8NIH
z`R11h$V;`hTzCACb(d{VlJ|IbtbQ>lO*pVDh<!}j>zoIA<ygqJH|T8prKJ0{t5-vq
z#1}Z4558)%QP2_?<wMTnIo}5gUAuPG{Kk!*NT38aMFdUbcg)5D`jTQJ(Y<TDQobAG
z(4UTQNRtyrd)HPCCgwciHSWt+ZPz2^wq+R10(r69=#j099h40?oU3<7=GLIx7rMRF
zuB4kOMltR<^8ER9awDeNtjvVpq;3m^guZ;Yc=GMRAwu_bXR>s5G*3(1uiN5VGO%(O
zgE0P9j@*aDAyIs#br<2Y@{$&#ymqdK<t&GqfdBsLw|+isP*?O58&$j<{4sQ7%7=+s
zYbcDI%2=tL>WP%j&zD#Hm$tY0>5xgK#)o*cAQzX%GP_zK7(sy2FuIVMqEMe&C@akt
zIkSS!ahzGoq2yGIPwB3W$pE3sr0JJVM}$H+Wo-QqX1P0&Op~$q0UqLw`C0qz_$vE8
zIosaVI#&}xaKi~^AdM;W#td`<EVnUH00O9lmGLyw@2}fl%gV?goY3H;;bz~VfJ2P~
z^+)m})6+%)^D}jhwGJb{(lC~ECJ(x_dUw);_s4s-XKIaVhK1TbQ^-}@4V3BR?RUqr
zrJJSOmiO!*!gnzfo5_iC(4(VmlQF{255NZIs#woROF|k<35^ognEpF7ydmOFZ`@FG
zY)V0NE@gR?o8pWTe(S}8$gR=5NYerszga#!jAiM}VC)`b@h2lomEhH@*GkT;wr9Mn
z7Bb<1J%ucxE+Zc~QcwBfbus$yc4Jt=7(|`8Q0$wKk5|J8!JGwCYrL?v4S>MFYssD3
z;Nm!dWH`}3WUcW?US+@47YzmFI=uMy1ajWa9d#<g48YoqLZmvkZc{?bq?YIOs6seZ
zT3wAZiXxxitjI|7loQAeZnHamN87V%TrwWJALN4fb9>yuNCqLVio%!!j1de8S>x$B
zmXE%$T>Kd-Cr7vX@T)G_Z4XG<;nswjlfq#BTMD|a6c%>&)zOZ~D*yQ=-(tPOI2<FR
zv|M;~U$=G}1q~lp{R^U`gVQxS!P64E0n4`VUYRQKYou#70e){zRyco@s!>q-=TNIY
zn*{ej#9Zd4a+Hn%tLx5KC`qXn)m0b=?<nSGB*?v;C9`w_A)hR+CbX!;4>kLW*B0x5
z?mO{<N@ZSC$zZouI!PtWeg;gLkWWxsdnt;5N$24|LCM{}dpmV(Rr@MoVrIrY`bnuq
z)kkqd94Vy$cGcMq81Oo83TqAzEF8@{d^Y0KV;>@4ZP}(+nD^egYifFSD8-ehF+J`9
zr)I$3xj#TC&D6MZ@JHE<tvh{_e6;Z8)5ZjAv(AR+{LEp#0lc(OKTF0j;>{(3M67d0
z5l{B4iw#Og`>`V@FIF-JG~Q=_%#71quK#p$*}0@(C+4t6H2c9M$*R#3qTK@%M4JAn
zcb^3p>2Wu{2NItTz|z<T<ol!m&d++B0GZmJYs>+Y0&1P0cA4_%(zN<zKJ6Wz)w;HY
zK{>#w1F)eYpN*>RT<7y^Tap}*Q1k_0E!ghZHirnce0QLZ4QHROTI=mqnW!-u+Yl|{
z^b<x^hNVaB>@Od=nyU~fXaiJAV(ahct?d{i1RgusKlfUn(nbi><7eyfztKNK7jksV
zg6LItQgL<!<)jiL<j&NH-o^RpxjE5&wyD&nCr${Os^@4En76whJ6D4Bc<**>EA7uO
zz9zKGO>_8mOmG?HKrn}d7*964o*jLmeB48dQ0Fr*OV4V2>m&H|P_j!W%iMTFcR|%P
z=y;wh*iKv=<&MCWm`ejy*4Fa!`5Mf1;6}ILVGv<=NibEkw#;a72=GTLCYj$2r!!j{
zGv#X7GM!3@$+H`AFJhl*sGq*{X>GkmZu4}q<xW^g*Skv9yb<}RqzB-g727|Cz3IFl
z0e%*U$<rsA`?9!%QM_QOYSOu~z$1VSh)ZXYt%uMFxlFwqdvM>R9xA;)d%rHP$=gIo
zS6#!1SMX?r>$o{Z$X*qbppL$g?>b&X^mgte71!2LibXzGM75Cuk7sL~t#_{X^7$fk
zG#k-z&W(*^Wkfj0CBO2cUZKufKfUk|K5T0kIS_)X&7!w`)p-N{@qH^~7M(?eD2@wd
z-8(%{K_+Z93nCn>bQRU6zu(L`{fyZG|C|T85^xZ+5|jGO5EH&|-x(3d)j_SI;FV4d
zoh)MLNRIvSQk!D;$RljhyieFNClz-E-&~X6&4!~*#^6um#UKzBHQesw2FiR5ZVc{r
ziyPjmwLpXjI@r5&stg*N6PG!%dc5;Y>dPRj4b9DJ%x!r4!R`yGpcCbbAb;d}F9e|s
znp{9H%gxvZrb0)yBArBwdQMp><{B(lDwf&^{M(Mxqk@N0@l!<wQ}WC*5}rhtFd}7c
z41mC@X-6&W#T|d;#XtnXzdbA+4Ob5vvbs8;A_Z>nrtdlRO_puM(UfeCcR#*dxpuaB
z*kXG?YY*Gn{x#H^2BAuQe8rJ*L;QC+bJFNd;OyCXvRmwB4e)b~X#mtBLF4Rfe3fen
zxLN7$pkr3f92eszf@7(DsHQvU$<~u9yT1JTV(Ge_7?NSL0Y7}un%VCe<P)|VXH_Fh
zaW|EqxViETV3K3N>WxQz{-F90c&E8Y<+ys-&EgjLVO*|i3Xj>0*L&4ppxQT{jSu4E
zj=u{uK75&4cnUrsn8ow>_hxlQ0c`8%kg2IjHFX7x=XLnq#O6kQSkh|e_s0jAp^0W4
zA=|+c`K6GPVHPaoV3Go_`Lf1~3*<@6A4}!MD;l`w0|KD}k%(&c*%|K-HJ&lYZ3Pnv
zDP9%M`G4GqDK`MN8RE4etQM$U@l)vobl1Gppc*{1$_uHxPM(6alG^AOpF7>}Eww}<
zNIV8b?66AKw-N2kF-h#P!T~I!e7*3mQC92jYe{MW+ajJI)gu?9!wOcqYm#q;?RtL?
z#q;Q=l0nDfZ4rnNh_ka<$y`2O#J&8hkfM>+^~Qo0KU~C|z+(;9)Ms!xAD_Lh?$Ygw
zr1|OTCNO#6+1(VOH|64oYM$Fho4U)5wQ_5n+GTfkZp`J_YbHvA1cGBBXg=BENIHR$
zNOoBcpGrZo(X|J(3<iI4K3o_i38F>u8d}o>jh-f*9l0_BlId$cy6(f?H|{h5MG|Io
zO^rG6MA@wlVC!;&C2(H+pzOKAv4XX@-LsTxAS1;FK5HCHJoBSY(^0ARMhy+!mx!v|
zc)o=FY^@=(`jzQ;1kK<oxP*b}Y)=${(nKt+PWNe67rD*yz0!Zi4D(psv7!skO-a(N
z-S~9-0gvAA-4P`Yn_aF!h`O*|@iSOGzzok0E@FM_eKL$Er)6Yic9Plh!HTnq8@4~<
z##rpBHdg`mZe!1^fI3npfWRdpLICgt<Q1%}_4n`Yue%;Ny8aC5`lIO52#x5N`s~W1
zw{FvP7&dm`ghx#TGL}Z)2d{Ql{(Lz`NhFa|LsH6pi03zCDQ5U)f1>Krtw%SXIVxmr
zVK$D&gPQ$^hK3Z-9d@5(WLL<kBnLbjR=3dgSzcIWI(SHGU(%NrQCFNwBTk$_!-U};
zi-{A%*7HZDIU!|kWuyAm+%{#Vldn~~!n{vKi$Jil{Iif_n<W~agnFtgCPsBc;s7l4
ziV`*RgkXGS@$gfWm~&CQz$ab^m4NXt`E#G6IV1AGG0718LRiz`=Egy{HjAy_J|QLP
z>A{6o37p3qF_*-jMo!6O3LaHzteR9DP0)+FEgx%L^9_ga4VEv~9V2RoUS;wP#<QQ$
zq=|RVjX00!M(TaM9=)F0xWxRA-)i^B;^NPC+Mn^UV*_boeIJw?A!~h!^$Di?x`T`_
zx_&e(g?b#kD(+|;sW8hNiQ&!HKaSTH+x(+(MR=fvj@_Rx4*s<EzO8yLcjqN1vrsOp
zaF?{--?lbJMys1bPvRw&$DV;c0{I<a_)R-=$MRM9L2ou|Uq!QY86HT#6@Obv@3Lc_
z$J{2DpDrZX>%brPE$Sqi`O<T?&h;AjdeoD%1Ax?DzFX*E+z)D>t$5z3Y15mo-HBYo
z@7wnE4rGl8S=rDPJeo{o7;w*B^HHY_3}j;^;2B(g`TF_UM67ZP+4iJ!t9=2Srp{rc
zMCU5VcKXfO#_DFJ))j@Vfaj#+lW!|JS&*D~0W$`b+e8N4d{u7268T^rFfybRl{Q{I
zM{V1m{z~k*H707nM5J7Y!{Ca|%`kZDQ4&btT9x>r)pXYeYt@{IvskHqVsB!u5~z-J
z-gppqP~*3NJss_(;mwc?Rs<_M73xfg7(8L3bu(_(C`^yzprC*j3y##q<!&plJFZN<
zSBRY8u>UG-PB?R$Z&oD_gcR6N(DCm~=fDn?zz;}QxTZ};n5UUQLRY!0#e3qVRl@y$
z?8vTMu9uW3D-Ng&pEorq9WxQ{T3X)gaf#-drm$SH+(S7=$u+6N9yBKtzuo##0Y;Xp
zcOkXo%No>E)X6_Y`H8uY0Ff)f_}6_uyYU*qtu2@1&pBI>&&Lokp)G~F`Le+mrcDVE
zwEQk+g<gUkE?;w83;F6dA&k?~Qza?^T>YGtHf!SL3x=G1mW-EVabxG$J?q&T*G)Y0
zbGNM_p)x_|1V5h0q~@dk6d}98xSp20fkS>#`(WwKBV4$epJB4=nKh3MA%fjkGev58
zV89z_UX6x5x^z^Ml*!j1z5Vijtwz8!_uW-W&{o%mE#J$*SJOA>`?uABCISzTskm!%
z6t*Hp>1@AxcfU=^OcaM}l)!rvrBNkD)kUB}9=fv-paEynBtwkU{w8<DrTUKJ?<Y^J
zBVzks7)_azS`uqOJ~x}!Q8zbVv5B&EwH;suZRj3y8%s=z-{<*OxLR$mUv5C^o!})A
zjaA*65~di1A&WgQe(RrNYA+b>%k0^H;+T7pP1W*sw|kX4&R%Q+{6*bJsMcX&3qSvq
zMJ4DZbvPU+$FcJU=Ne!3decN6-RwVSy7qFqHqaM<C9^f6-@}yKnjB)+iW|)ilppeg
zTN>n$<>l_F<BrSaYWRTKmTy8c)0s0qFUTtoS7XyUc=U_Av+4xFg!M^XfqtNs_r3N_
z8pUrLuG~9@|HTCyh&Yaomz$$!n0g?D&z;kMrZggO8cg*v^=_T#7RhrD8k#V554#<{
zM%0{(e6RT%SHmFY@)I7W9Z>px<VMBzhWN~67-ARggO8Onq%RsL5KSG3dN-?c^W=io
zJ!Cx#Mrxf=OtK**&}N5NR>!e?$MN6VR=lt>>*=7zrFb{R0hy;f<!NG~KN=rdxi+3&
zM@8BXGh_aV%L-wT1$aUsNyu7v62J5L+G8tpI_GbP%3tLl%}*DO;QlL}AFhzp^LkSh
z7*ffP@mOJbKJL6GUwlZspgJi_lUv6y9I`fb>((9h3g(&LZ>J|ST_smlFIV@h;R>3>
zyiyQD;S%fH+`kcZ_$kZv;p}iKCa3A5JULm+(;Avhhw+kwWSI3RLg6f1A>0IJt;_l4
zmz_{sMRpqib;gVI)x_&%e0Sz}4f-L9-P5tCbM=~pqmh;5ZAt=lP4v}ix%U9cg+TbK
zCU9jVWqmJ#sOad%2E8kI^^0;t9v4kBDt~*<urmLk4-wPXM>;z`nB9sLOcjfz3q0OR
zT+J=_LN5e^1kDra{2^HI3f!34VXXh!l@~BAYeL@?JlAJLDT&bJK3kVFk!CRZgSBf4
zfUgf)-qvSggfh8ecZlE9gm?r~l$-LGT?*6L_IC2rd6VRr+|yn!B)*=}izIxlahg}X
z;4`f7n4K(LQ*SGw%`aVmD}5}KyUuMAyxl9xAHp%iH!$u9d*<5ahy57^S~xu92hZ&{
z)Zn+Jxph)+vc*Yrz@C&+>o{OI%MU-pbKr5BtpSu9eOW*t*US*AwJoN_lsyT1!4t~7
zSsf%y<h;lY#O*vmE{|xrq8m5UPy?c^f<`|)9LuBjtdhXO`729oeS01qK{ClGS{nM4
z-D!6Lf7w&d{ga*^Ok6YO{UMm9+IjU)yep8nftImW-fXWiztEgrlxLSCW&=}ab;_f=
zA?nN6dyf_ScDl+I=rr@yqADyEC@;yF3B$i%Jm*@ErJQaa<?uP&NCdj!J<jy6O{#t1
za(`iRt~1iUZhaXMUT5W|h|w9CSuJGka8tZHPkX1Y-W~n^tgbxioix`yL&Yl#$yrd5
z)HcK+n*xDjnt0xZ(=CwlIUyoWyBy40{OBE{AU=ak_MvqJ-<ktM8Z`xtYb2&z_E)*B
zyGSnc-O1Y%R%WM^81OCJ-IgE@yFgT_iFvJ)s9K6ArX^szw+|+m*O4$SaAGRsvG}3?
z8T?~#!0~*QZ6s~EdXmNurpHy&?dzbMeWD9`S@pq(L{pYSdNW6}W*;M<xsv-W-hLo`
zt=1ycD`1oV;}(npn@4tbc$Kg{>+ZRAwcCha1=@OkW7P9vW1^TN5|*o;*gM}QBlUph
zY++$=P>Rf*KSku@=;>)+4K9%fG;*P8MJMI>l2@<jIk9U5(g@@I4(4g3NXOR>>lAUQ
z>EvnZ|1sqeN67%pgc};cZ&EW8=xt-8ciy3zwUI^5)EoO#JT_moYWhA1R1dHpvVljY
z#87dUsh`k){`qIP$krK0o>Ur7IKX&+y*uQHdCuut?*(Tk=$0q#+)Lq130o<QFR)=U
z(%dv~jb^G9z}6xddB-A*J4)7p(-FYX7omP5Lgu9;*=(9uKg2Rw;CN8ZC(AebjsnW}
zqoX3CqH8Nt&wt35RlX-F;zY!tq{Wj;d9~71AGf?-pq~b-e9k?auaPG0bz+P^I@mY%
zkZDC<Sc%MJ&WwW7XaN@L<9cwV-`+A%D5{Frs>A3&<)-n@ZDD8BbuP8%0*ttB^^9i&
zA3sOh*wHhXG+MpwpFmkqPF4=Ka}7Wif&8L-mALpyfmXm!B53MXU|{%((f}^LK&q}@
za)6C3quO5By%6_&vfk?e!~bN)x5mqZ!CL-`bqLF6pz(9~@iWEYYXNh_-zEm!l6j5a
zw;)hm-(`my{aTG#a|xICh8_$M_|yk%CYA0{J0Bc%mW&5c5e*-Q0_jX;Ped1Qu?Eo3
zX7B)wCVQW)sStjmubqUnG^ZK{=zD3>zl<H2tM@Gj-~Lt$5;7D9Vm7Hh2{<AVT}(ew
zYe1RpsVsSb!oz}3qh*<ro(ArqJSEPfP~Xb*(?8X=l7DlCK1yiRBG7quI{BL3hsK1x
z3ftntTLT%ws9I;x3anjk-;#|GC+~m3?uk*)XP)WJ5>)s?pn%i%iuEoK_Kmr6;^Uaq
zCze-hti$t+skUaBFB?Ytwc2b3Q*9SoP9Z*h4F{_#x`XE-if9TsI;*4CS#l&ozM(O`
zC;nL%o+4a_nQ%AUGTi2qtMsq4wYxb=mroVWNW>$vCaaE?#)Hv(4U+=R($uV!&Kr3Y
zzJE_{ZzDHiSpD}kGo&*l{B_K~%;jI6?k-KeSb44RS~Zc|tl6Lx==Zgo>jOllL75@9
z_=`vwU)6T=m^!yKv5t#q!K>fowbl#DtBo7f2_$bWn{Rry%l1>OJkQ-{YS&U2khKsr
z>?KtIEHql+o^?{)vElRFaEE7&s?Z#X7}W&!2Bhe3>nT@kOaH3ew6+RpZUg<U3@Ps_
zQ~rSC4FFj88dYPucR!7*kcfw9?OflWpYDOxv;&+`SzO->A0j+qnw&YC)vr75j1H#@
zQ>)iGj@k9DatEv>-x+SkM$i=Z->4`*owlc3runIc5)iiUXOLJlDg4ypKmR4=%Qbba
zJbKE?fY%znYM7)Bkt0W8xK5(#0xz6bzhoEocrSW{rqOt7rm;BU)c(@Ttl6tBfk);q
zf7a~qy3Rx?2!;LI!4meRS2HOy8Q@LYk<Wl8t#Ux!s<Ol71gKV>TCu%%?1@wz>>kk3
zZ&qn=9BVpk^u&rD{0V{yWUNVv`wq%XH!x(4|F&UbiAxl77`HgBqQMH9K6?HWx^-wc
z>6}@Rtyh(MJ*7amz@0XLKW?pCi5a^8K5vRmBcH~55+njDLP;rnXAsR5G@e0x`16#`
z9tMU7;^Ytc;RZlYgGpw}OHbT+Qp7qxN-@WK{)MP<t?>kQC`%*lNDWYu5gZS3C?)xm
zW}i(Vpw_!WB1cdLZ^pIRcE_}i`lvNSFV6kBeE__)qL)EvJKmU<4hW~u%fg&7Bk@)<
zbi(9E%#ZHfOA*hStyoex3?3=;gaLe?+g!s7fd2D#LK!39hk+koLq2)#jB%0NwB>@E
z9J`HPeIqyoSxk=R4I9v`#AP!|I^{-{&jUH=p!2&8`Fy$vhvx0P#@}9R8$Vwu#7U~6
z8^id}O?krkLyv~tf8Let&ghKER^ZbbdSrFXz`)<UHS113m@H|c$)VCO)NRY3E20b7
z-dweFeH5EN?f%wylWzLeps~iWt(0nU_qk+IXCKFP_Ug`*)^VPh8hQxT5pK-+bU(4$
zexS0tzW5YZK*^9i_)7Qj3AXLMbspv2#4BF`Nr{ZG@4N~ce9SZt#|*&+X}(EM6ocf0
ziN5@MM@8@Bhiu!BJ15^=${CqP1#p{*$?Gegl>qrC^!g#z(M`9xDd_DG6P%78{BC81
zVaU8CS;Sv82KqBHQVqX;Z74|()Hd|E%n)Hpl?HVF+fT=5RK0fQ909@IWAX02m{QG*
znavz$#nd;FqRX&1s&by4QRUJ>{8!X&2Av(^3*0fomI{Ek?hT+a*xQvajeHNZxK(Sr
z5l5-`T7awKwy$-XAUKU!QU6rs0Hjwo`He|7N(p>M`^87*8-dwC;NvwYiMcN|B^?Ba
z0^r<94cxWtESU1F>DQw#4rKwEn%S9re46{WrT5QN4HE0vE~@t+Gs-pN?oQ~|8TgT0
z?u*3kl1s*}z&J3ir2Xnkl$`0u+2Rh~>W3<tGsox%-$?VUa4P1WMB(rY&(r(c&0ae~
zK_?!#=YE%0yEA@W{0Tn_oh$)+0&38EY)TH7<S;?=l;@VeV5k;}K$c3Ko`DpXzUJ9m
zr)6_%oMIoJ*0O_APvpDU&6Enq+B4iXK14^T62hhLr*gKgov%gIyovsOJPkJch~#-$
z^g2~<7N;}ro526-_727L#^O&4TuHR~kj{NcRe1;gQKETsfQCRQu|7$_%x4obFe3jw
zTHfBO!2g^-xW4_)>CPQ!mjN=+Y;WilcSVhSRTron9E`?a)Q2H!%|1s-w3};w+)iBJ
zc!1;&R$8IQ=Cr2@6(7q`+%HaPSB*35u@!#Ozbq)<>h$f>o7*YfJoXny4c)?}X^bX<
zy-}6bQQ%YRX=VAzgO&3tSaNNrbmsjujX-zEdeFO>;r>&zv*!EKZ&wl|9ie9G=R^W@
z&uZ`QTN)mNga=!5DZ)2oWMo}4kDyssr_vmmUn_DP;b)Nmn|-hCixU(k(jX0>diYs=
z=Xd!ZS*Q1TC(OU-k(%)*B9&q6t#y2Z4@z!F2oIUpefu^Lvv}`NZnjv>LrJZ5S^aXj
zCYz&5(5CpoYz*>!e_!Y}JYb+zA^Z+4pBD<h^W7PBM%d0+O#haF*{dha-%mT8r@4qO
zy%_dZ2|bi``zmace!_F#r93XBBkLl%Q+QAbulaZ;Fzd!Q8tKY7c7y%v;s+#Wxk>}s
z3-HNf?A41OaV6o`F1bNv-CwtBcXywI#8E&72zCfKd3<rQ@*|9#I*~`e$YKkiS5`50
z9aV|`2iV#tTCJCSIAe*RlkPE2Et{_uZ@w)P@ogvO9;BJ?e}0lldWxRwj<m(<{VUjF
zkN6X-x2_9F!v9Bl<o_;H_F?6zgyP5n-IpbF1$Myt!Y4X9`Zno6kBscRJbu&q+&m!~
z84k$4UjAieWxd6y(m@b3Qu_>Oa-WJdvS<}SgCF<+nhtS>@9t;>pgDdi(kRq>xOcff
z6!bR<XOs-+yMd;<18{q)DZQ{w_fM8@$ydW$En=jAC|n5W@kF+PujhWxwT-!8CFvU)
zCIeb=f{%oxq$BVIT5+)t;qGjJ?3*D@Q+@HDePbshDH+BmPo6L`uDXX@JR;jQ7v$mL
zk&%)4s}3Hk&wgF<C!2zjGLeB=e8u<U6|#%Xp849GlsT7!gx{>U|J7uF$nE%g`+rW#
zb`c-ihC=xQYTD4ySMT!yL4X|~KCOWw>+fl!m~Xr-ywu=q&Az7#ZN4D7wx9L$<)wNq
zP8JUzr_z&sU|-tJJeVld9cmr1+)NrU9&HRd?frU>Z4*_VCSYc~*$!yJfL`UN&&X2!
zO<_RrR)X%!b{0%;IS>j~?Gkrqb9&e>2G`)m61YV~&okkvN3#PnZ%yws<&yeRIA8?R
zfc%g>#=>|ce&Ldn>v&}cTmCmn(b_L}uQfrDfo#!y?V5n(%~SI@Rgd>nR8&~O^ofgs
z=((Uti;YKdOELe&1!QY~k8oMn*B96r3PV$w1ZMXF9&{6$&Z*0z5&Elf6rDD{dktZs
zylj@T`uZ;`TnimY!yr(u%jvoPP840JUCWvim8noqf3f$OoUHvAp}>=m{*XD`{b8s>
zZF?p-Q825kAZs#JHZa<on1UV}FEx?(bwgFz@~U6je(@#(34lTLT*h4P7?4{c14vS>
z-V;S;SeWD3S_dGGQ-ulmF1HstO%ydZu4PHQUk2(wlNyH<UYJSg(8e4*5R`R!j2==Z
zkMcL8fu_9ZYf6_5JQj5tmv9Fgf$9g+>JtQXFP7TEiFNA964^Q(JZ~duftDK7!=oZ8
z_Zhxvp(<$SqE_}$;8VY2I>v{K7kU{muD2K{2yUjH3Bc_1sahY|Y&9ZIx2%1$;G;+`
z@AH+UzR%(KZh61Wr}%?=u}KW&Qa<?nYN$xMkA!picXL4*|82{;SHG36u<V4@-)MPZ
zmdP>gB4eM~c>E=rLaQTdy5-rxvC3}OgJauu#Ki$Fy!@R0x7Nkv*?Ge@NQz%F5i#2|
z<_qplm?+rMKl3-ofFCnx$p6wZ3i(?;Ft<WHFW71EV6NGAeE0jppl<yW-qW9DMVhIt
z&VHj2u}5g5zV@1+WsacQtU2+D4oU01*q!~@=1chItckv~>Wob}bHi-Z`!5eVPhRyg
z@xi>^HL*^3wehC>rtZw6s_n^>o2!&$C*lF<KbB3UBJCQC)J*3iC61nr5kDA2e|Z(^
zw0-%WEbWd^r@nQ|VR-idP}2bF^g^q=J2{B6kiMkS)YI(mKHD=$zdgv}pNpH)ZR;b}
z_f1jr(jfqSCo0If3$(qhyP`=O#ezW5D{j|6bl)I?mRriEd$A8xM!<`|GY7SO$tqA!
zaRLMni9AV{ZmV29v_d4nAk6E|cqC3HhO@)sr8yo;xtwg9)c<YMpcaT?mUrCGbsR_&
zfAZX75fL1SJk9qUy$BP+o`VgJ`|YGV1}%OYKaCuch5A2Xy626ZE*@0VJTAml=J`&D
zXD<!dJqdnnNmSbJ1iD~b$>`i94orxV-EpE)*koqCUiSeCT_%aH`?Z<6LxYF=3A<!y
zrHd-Qp~uTmOfu8%1ztD}Z%}OWG?ncb;1&)*ZDJ?v@7{z>y5jIpc-Q8qk*V=v!SN|d
zVFN$BWT@_@v}`J3^fc4X^bS2Vo3Z;V(UF?<d})Ecmm4>#@*E{dyCgby)m2sG1UB3B
z!uDbw#ylUqxABK^Y%uP};6ktwpFOdZ4uGs@6Q8&Hm>z@2MiwqM-xjRua;LQ?bcJR+
zH-R=leb$Q`o@qlQma#Ae)+4jPpv9T^8|E-)ZLuG<AC%l=o){Kb;D_!I%5ZxcwLwWW
zFS0{}68OIt#d4E<kYW~zU_PE4oecz_UwI20WY-h-c7aHKT|JEm)E61sTU!7_xwEts
zE91YPuYsIuv_=8ifyZJl6_7k%8=KXpL+2{{A%O$vscoR=KQGuTSo=iA^j!(-%m6ty
z(&B$$+Gr}zV+3jMUJ}~72s<l=!$rsB_w13LSTQXvt%Ii2ow>%%lW*|=<~MDG<mKeF
z5f7aSP}>G)nA<`z$^m2l22hPkxva;?1qb$-h}X{ncg7m7?Cg|r+_*$pLT`S0=%qqu
z-=uB?#k?XM(IZMtD*UJC_93?Qs{S`!<U%%6Y!ddQ%UtlF(g-Dk6vWBqeq!fN%J3E&
zd7!RYkeO(f9FiRwpiABJRUyLW=-b2AUGIsOfqr4N;X-l#)|BtE@`ny4BN|{*DyPCl
z>#UD?z<7<ifJ)-pfgK~N<dfW34cd)x)}J%mm7mJJmb6!bR>LhkGA@6os&p1feO0bE
z{?*6V#|%5<Wpa+%&yM$IhkCKFlI6t%KtE|Rqq<{c<Ji}v=V!NbDS^d8=Z>edbQ#pj
zwK#k=nq=*^n<swTXdVcNmFyT8q5H4n*tmfiiY~>VA|UO#E=YSksy$KQ0SFpdihvDA
z1-(*Z|HF+5p^aEk=Se_iTWVf^(K+z=;v!TlQ|5MvErVzSpwnFX`}wejMecO<f#>2^
zbh8ES{jky|hk7@<P`AJb0)cqf&Rw@3OnAZG?!}>&Cib1rgVaQcayNx7M0aUrw%ie-
zj5S3-YJq77;8{fF%CgC$H&N~_!Dm2em5A_FhZ9>dDS~EA33{Py8jvm<Djz{}_;+E_
zbaB1WsFV@fz^7i%c;;dBTS)%FDce)~&V=$dR!}Bk)&X%y9r^W6<a03eA$wNu?CTM&
zFxsIE7IwbZO?T$1+Cv!IA9=P$iyq8&U$>i7mlYruuSOr`LF{9+X>K#>Y=4HdzsaMZ
zK5vGmqltB|FZ$_rPW$9e8$2eh>oZm8x(B*i)ui=L{LVv83GJo!%yc4$n<4@!o}<yl
zw$Q1G2ECmjwKXoAK``CU8S>6|#@fAKBjd$(Q_$_64*9Eu4%+V2XW2EDl05y6*3D75
z-J3VU-5-l86cn9`ko`dpoE>|x@BX8t+--sb0lnpy7MYI%fI=Urwd{N1Y8AgbHG1}$
zmE^UtiV$3Z@i!|>z5kQ&46}a2ABQZjbnjLMy8;pQu<4M&W*{yvpth(HlD6_S!!c8j
zTleC$i+S>MOUR*AQ-6N)@&+b#e%c7*>Ei>4%bbD9omzHQ)ZkyqQ8OajPsLWl93Bw!
zO<*vil{neMVs|Zr@yWuMx2p1=^eUW_#-n|{a2*hs<pf#Zvj<croodj;SeSnpcoQf+
zoAQ8xUx*=Ia)$PgoCx3REVR#bwq@*o?4c`!y!oF47f}jZwCCFUE7%(SJ2pLuFKi)7
zVdw*tlDllyNL@k@Pa4$ub(=mX$;UKE0una#Q|d;SsNkL=!eJbetK}$?95+Ij=UG>{
z?lc{K+t<}FKeOpzdGdrfx&May@}4!>hx_=)66)JQEfflsR&SwZ`_2vyznP>5vyg!M
z6J`7%mm+p9hK5tw3THaG%J*n!L<5gxNX4HiXiO1S9ckk3I{E6{?pl`@fmX%U=Q|N6
zKMdaBP|L}$V26*zKEZ<ncYoTNdD;z)$a5K0t(KWJ4`s<81I_2W=c9SqL*@-0uT-8>
zGKe^!%D($kcK-SE5-y{X7lcp;hwlXG@<V&qL+_#s%EdBBo~p%h#$NoHNUVAB@9LJX
zUq!$dY%diBWHQE74GT^B^Be{V#Cn$l{gMjU;#+Y${3FV5K^D>)of0xt1rsRNd1^}e
z-fXCa$(oP@<N|S7@R?s$2g`iY_t0NE$KnWIZ`u>joybn@e`a(KJAl1xINSH0Zb><m
ztj>MEVK%04QF2LoRqWq|bk|WQ8VeP8Z-8do1fB_{)(zH(HD9N2(0&26+id^+Df$**
zn19J-M2K5Gz|i5O$>quEsi@oeX<AGSlWahiJQQ5Eet-?Eb(+_)8%&iP1CXn2!z!Ts
zLx)HkmaP-Lf4$22^6FJ9z+%ZkR;SXZJptY`ZJqe5OK&-`EdcL!%Jr|<xeP#I-Ay+s
z8CW+*+f=cG=vCl?+x!;|260}aDzA+iN5UzGNzjFV4s*!)djMd&%{PhKbPu1O$`Z1`
zDm?O{+yeE>=7aJfgZR9ts4e(@!*qJiDE%;^3YT)56d@VZ*0D()c5WU{xhn_jUnqlw
z@(KMj_RDmKNo{B@b_DkIw@P!F?Pm4J__pQ3oM9zPYu1?Z)`I*}k55iLI5zzrBf|@)
z9IcnieqKe-X9P^8SUO#ikS&ZbcV`@%ua9}qT&|Zu%1)|eVoqxX;bdMbG8w^v&Zsy@
zy?Y<W#zq2V6bt#_`%sptxc4Z~=nd9+N!vLgTjj(Od_=V%7@jE4k70Bs^sxl%@{uGf
zX?jxxF5ckK$_M4dc@{FVVrmCOIl5tQKs=+=-F_f-Bwu3_5cdKznOzK`avE83X24(}
zl!25JG+w2@i9Xue9L-CE!-FrckYr^j)=_;B+dlP7k@x4Hz5xcxXV9_^$j)w3GbJrH
z@hR}!HZ}Y{a#?AbZ(Q$I3zTSpW%o7R>~4~gAsCJ3ssJOM2DfEV<>s5imGF^A-s_7j
zviZtAfQDkCaz#8&&(stG3^jF6Oz5jg;dG_kHuUp`BB~R+w!eS<8t1%P@HqqP%jInE
z$<J(1{_b$^ER!6`zZ&PG@k15YufTbL;F%3+?YYn9i}?1HFGh4be?h;5I<PZ>@-}th
zBP%(v^R@m?yqw^u$IMcAD9eqi0;7q%*GFDGhqY7FC4~xWEzlOfF{_=*t}EF))1!Qw
zI*2!JeZPk}KUY6#Ia0r@W!0y!3BE@-vK}fSDur#*IN`njHV$<@?Ae0YDA!gwzfIxF
zkTp5eBlT{+iAJRT&G{wApWy0<jYy(Y`~3+n&;9h<>OOO*SejkQMy$6_v(UeVQ+Euz
z{5^(${)rKDHJ&9Gd;`=9VPRoWUhP?E;EyO_ANLh0z?>BsPW8lXw$2+ErC4(<UkK(1
z2F7vYOn(jibMGEYM}^#8(Q604TrW_!;WyXu1`_*}b@$QFMhy=2>n*p3l6iK*_=LLe
zKTQ2YVCM{6xYU?BD^c#{=2kuXr)qmtD_-F3oICu^_lj!aTy=ty3mMsE#@)`#QSJBi
z9EAqkD+%1XdPRmfAc13t%ujFyBlFF^6BlDaS=Z?vHOV??j_GMe0mbeG=p1#EYGCe1
zmD@Z~+II)ww&0MpJ9(;!lNVQV>;G&HZzHn&C1wt^4zK=uvp9M5<*l>m1q}0_VW=TH
zkzQSap!-OXL|4Z!AXuXHd|kf6@<RJz7|Wz5W!(>nM>*&znbLc3!viHBOouUyzB*<-
zaYL6+o^;=x|2<Q|SIOsua;0*0^VAVythc5@|Ce>>EWH(tmU(Cft#FuK#c7#=fO+Q%
z+eOEv6*Jl5lm9+y7H|j*U;jS`sQ(9Z)&IHtzp_=sycs)WWVhS@eP6);$ME`pHu-;L
zlmD}^|L?Cv_>Wcn$EyBkUY+qDJNb{D{KroIf8H<iA1C=g+et2|fg<73#giNfz>S;#
d;<;;NhS=FAGphcVz!fr;x0-LtUR!+pzW~aJ)R6!H

literal 0
HcmV?d00001

diff --git a/packages/core/src/image-delivery.ts b/packages/core/src/image-delivery.ts
index d1193b9c3fa..81f3b897be1 100644
--- a/packages/core/src/image-delivery.ts
+++ b/packages/core/src/image-delivery.ts
@@ -68,7 +68,7 @@ export interface ImageDeliveryRequest {
   readonly messageId: string;
   readonly source: string;
   readonly retry?: boolean;
-  /** Explicit user action; the Host must also allow networking for this session. */
+  /** Client permits remote media loading; the Host also checks application outbound policy. */
   readonly loadRemote?: boolean;
 }
 export type ImageDeliveryResult =
diff --git a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
index 5e6d78afeca..98c759453e8 100644
--- a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
+++ b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
@@ -38,6 +38,7 @@ import {
 } from '../server/chat-image-delivery.js';
 import { chatImageSources } from '../server/chat-image-markdown.js';
 import { checkedChatImage, downloadChatImage } from '../server/chat-image-source.js';
+import { createProxiedFetchTransport } from '@maka/runtime/network/scoped-fetch-transport';
 import { IMAGE_DELIVERY_OPERATION_SPECS } from '../protocol/image-delivery.js';
 import { SessionAdmissionGate } from '../server/session-admission-gate.js';
 import { createHostExecutionArtifactServices } from '../server/execution-artifacts.js';
@@ -49,7 +50,12 @@ const PNG = Buffer.from(
 // Mock only Node's DNS/transport boundary. The production downloader still
 // checks public addresses, pins DNS, follows redirects and validates HTTP bytes.
 // Top-level tests in this file run serially; restore the ESM bindings at teardown.
-function publicImageOrigin(t: TestContext, localSource: string, protocol = 'http:'): string {
+function publicImageOrigin(
+  t: TestContext,
+  localSource: string,
+  protocol = 'http:',
+  address = '93.184.216.34',
+): string {
   const local = new URL(localSource);
   const source = new URL(localSource);
   source.hostname = 'image.example';
@@ -57,7 +63,7 @@ function publicImageOrigin(t: TestContext, localSource: string, protocol = 'http
   const request = http.request;
   t.mock.method(dns, 'lookup', async (host: string) => {
     assert.equal(host, source.hostname);
-    return [{ address: '93.184.216.34', family: 4 }];
+    return [{ address, family: address.includes(':') ? 6 : 4 }];
   });
   const transport = (
     url: URL,
@@ -68,7 +74,7 @@ function publicImageOrigin(t: TestContext, localSource: string, protocol = 'http
     assert.ok(options.lookup);
     options.lookup(url.hostname, { all: true }, (error, addresses) => {
       assert.equal(error, null);
-      assert.deepEqual(addresses, [{ address: '93.184.216.34', family: 4 }]);
+      assert.deepEqual(addresses, [{ address, family: address.includes(':') ? 6 : 4 }]);
     });
     return request(
       new URL(url.pathname + url.search, local),
@@ -899,6 +905,196 @@ test('DNS answers containing any private address are denied before a request', a
   }
 });
 
+for (const address of ['198.18.0.2', '198.19.255.254', '2001:2::6', '2001:2:0:1::2']) {
+  test(`named images load through VPN fake DNS ${address} with pinned lookup`, async (t) => {
+    const server = createServer((_req, res) => res.end(PNG));
+    await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+    try {
+      const local = `http://127.0.0.1:${(server.address() as import('node:net').AddressInfo).port}/image.png`;
+      const source = publicImageOrigin(t, local, 'https:', address);
+      assert.deepEqual(
+        await downloadChatImage(source, AbortSignal.timeout(2000)),
+        checkedChatImage(PNG),
+      );
+    } finally {
+      await new Promise<void>((resolve) => server.close(() => resolve()));
+    }
+  });
+}
+
+test('fake DNS never authorizes literal private addresses, local names or mixed private answers', async (t) => {
+  let answers = [{ address: '198.18.0.2', family: 4 }];
+  t.mock.method(dns, 'lookup', async () => answers);
+  const request = t.mock.method(http, 'request', () =>
+    assert.fail('blocked source reached transport'),
+  );
+  syncBuiltinESMExports();
+  try {
+    for (const source of [
+      'http://198.18.0.2/a.png',
+      'http://198.19.0.2/a.png',
+      'http://[2001:2::6]/a.png',
+      'http://localhost/a.png',
+      'http://localhost./a.png',
+      'http://app.localhost/a.png',
+      'http://router.lan/a.png',
+      'http://server.local/a.png',
+      'http://metadata.google.internal/a.png',
+      'http://metadata.goog/a.png',
+    ]) {
+      await assert.rejects(downloadChatImage(source, AbortSignal.timeout(1000)), /not_allowed/);
+    }
+    for (const address of ['127.0.0.1', '192.168.1.2', '169.254.169.254', '::1']) {
+      answers = [
+        { address: '198.18.0.2', family: 4 },
+        { address, family: address.includes(':') ? 6 : 4 },
+      ];
+      await assert.rejects(
+        downloadChatImage('http://image.example/a.png', AbortSignal.timeout(1000)),
+        /not_allowed/,
+      );
+    }
+    assert.equal(request.mock.callCount(), 0);
+  } finally {
+    t.mock.restoreAll();
+    syncBuiltinESMExports();
+  }
+});
+
+test('a configured HTTP proxy receives the original hostname despite fake DNS and checks redirects and limits', async (t) => {
+  const tunnels: string[] = [];
+  const imageRequests: string[] = [];
+  const server = createServer((request, response) => {
+    imageRequests.push(
+      `${request.method} ${request.url} HTTP/1.1\r\n${request.rawHeaders.map((value, index) => (index % 2 ? `${value}\r\n` : `${value}: `)).join('')}`,
+    );
+    const path = new URL(request.url!, 'http://image.example').pathname;
+    if (path === '/redirect')
+      response.writeHead(302, { location: 'http://127.0.0.1/private' }).end();
+    else if (path === '/length') response.writeHead(200, { 'content-length': 2097153 }).end();
+    else if (path === '/stream') {
+      response.writeHead(200);
+      response.write(Buffer.alloc(2097153));
+      response.end();
+    } else if (path === '/loop') response.writeHead(302, { location: '/loop' }).end();
+    else if (path === '/stalled') {
+      /* Abort must close this unfinished response. */
+    } else response.writeHead(200, { 'content-type': 'image/png', connection: 'close' }).end(PNG);
+  });
+  server.on('connect', (request, socket) => {
+    tunnels.push(request.url!);
+    socket.write('HTTP/1.1 200 Connection Established\r\n\r\n');
+    let data = '';
+    socket.on('data', (chunk) => {
+      data += chunk.toString();
+      if (!data.includes('\r\n\r\n')) return;
+      imageRequests.push(data);
+      const path = data.split(' ')[1];
+      if (path === '/redirect')
+        socket.end(
+          'HTTP/1.1 302 Found\r\nLocation: http://127.0.0.1/private\r\nContent-Length: 0\r\n\r\n',
+        );
+      else if (path === '/length') socket.end('HTTP/1.1 200 OK\r\nContent-Length: 2097153\r\n\r\n');
+      else if (path === '/stream')
+        socket.end(
+          Buffer.concat([
+            Buffer.from('HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n200001\r\n'),
+            Buffer.alloc(2097153),
+            Buffer.from('\r\n0\r\n\r\n'),
+          ]),
+        );
+      else if (path === '/loop')
+        socket.end('HTTP/1.1 302 Found\r\nLocation: /loop\r\nContent-Length: 0\r\n\r\n');
+      else if (path === '/stalled') {
+        /* The caller cancels this tunnel. */
+      } else
+        socket.end(
+          Buffer.concat([
+            Buffer.from(
+              `HTTP/1.1 200 OK\r\nContent-Type: image/png\r\nContent-Length: ${PNG.length}\r\nConnection: close\r\n\r\n`,
+            ),
+            PNG,
+          ]),
+        );
+      data = '';
+    });
+  });
+  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+  t.mock.method(dns, 'lookup', async (host: string) => {
+    assert.equal(host, 'image.example');
+    return [{ address: '198.18.0.2', family: 4 }];
+  });
+  syncBuiltinESMExports();
+  const transport = createProxiedFetchTransport({
+    enabled: true,
+    type: 'http',
+    host: '127.0.0.1',
+    port: (server.address() as import('node:net').AddressInfo).port,
+    bypassList: [],
+  });
+  try {
+    const options = { fetch: transport.fetch };
+    assert.deepEqual(
+      await downloadChatImage('http://image.example/image.png', AbortSignal.timeout(2000), options),
+      checkedChatImage(PNG),
+    );
+    await assert.rejects(
+      downloadChatImage('http://image.example/redirect', AbortSignal.timeout(2000), options),
+      /not_allowed/,
+    );
+    await assert.rejects(
+      downloadChatImage('http://image.example/length', AbortSignal.timeout(2000), options),
+      /too_large/,
+    );
+    await assert.rejects(
+      downloadChatImage('http://image.example/stream', AbortSignal.timeout(2000), options),
+      /too_large/,
+    );
+    await assert.rejects(
+      downloadChatImage('http://image.example/loop', AbortSignal.timeout(2000), options),
+      /download_failed/,
+    );
+    await assert.rejects(
+      downloadChatImage('http://image.example/stalled', AbortSignal.timeout(50), options),
+      { name: 'TimeoutError' },
+    );
+    assert.ok(tunnels.every((target) => target === 'image.example:80'));
+    assert.equal(imageRequests.length, 9);
+    assert.ok(imageRequests.every((request) => /host: image\.example/i.test(request)));
+    assert.ok(
+      imageRequests.every((request) => !/198\.18|cookie:|authorization:|referer:/i.test(request)),
+    );
+  } finally {
+    await transport.close();
+    t.mock.restoreAll();
+    syncBuiltinESMExports();
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+  }
+});
+
+test('proxy bypass preserves the checked and pinned direct image connection', async (t) => {
+  const server = createServer((_req, res) => res.end(PNG));
+  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+  const transport = createProxiedFetchTransport({
+    enabled: true,
+    type: 'http',
+    host: '127.0.0.1',
+    port: 1,
+    bypassList: ['image.example'],
+  });
+  try {
+    const local = `http://127.0.0.1:${(server.address() as import('node:net').AddressInfo).port}/image.png`;
+    const source = publicImageOrigin(t, local, 'http:', '198.18.0.2');
+    assert.deepEqual(
+      await downloadChatImage(source, AbortSignal.timeout(2000), { fetch: transport.fetch }),
+      checkedChatImage(PNG),
+    );
+  } finally {
+    await transport.close();
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+  }
+});
+
 test('resolver codec rejects excess fields and noncanonical artifact identities', () => {
   const spec = IMAGE_DELIVERY_OPERATION_SPECS['artifact.image.resolve'];
   assert.deepEqual(spec.decodeInput(REQUEST), REQUEST);
@@ -915,7 +1111,7 @@ test('resolver codec rejects excess fields and noncanonical artifact identities'
   assert.throws(() => spec.decodeOutput({ status: 'requires_confirmation', source: '/private' }));
 });
 
-test('remote capture requires a user action and current network authority, including on retry', async () => {
+test('remote capture requires client display authority and application network access, including on retry', async () => {
   let downloads = 0;
   const f = await fixture(undefined, undefined, undefined, async () => {
     downloads++;
@@ -967,7 +1163,7 @@ test('remote capture requires a user action and current network authority, inclu
   }
 });
 
-test('failed remote downloads issue one request and require explicit retry consent', async () => {
+test('failed remote downloads issue one request and require a client retry', async () => {
   let downloads = 0;
   const f = await fixture(undefined, undefined, undefined, async () => {
     downloads++;
diff --git a/packages/runtime-host/src/__tests__/execution-composition.test.ts b/packages/runtime-host/src/__tests__/execution-composition.test.ts
index db8231b508d..7edc57da33e 100644
--- a/packages/runtime-host/src/__tests__/execution-composition.test.ts
+++ b/packages/runtime-host/src/__tests__/execution-composition.test.ts
@@ -20,7 +20,9 @@
 import assert from 'node:assert/strict';
 import { execFileSync } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
-import { createServer } from 'node:http';
+import http, { createServer } from 'node:http';
+import dns from 'node:dns/promises';
+import { syncBuiltinESMExports } from 'node:module';
 import { WORKHUB_COORDINATION_SESSION_ID } from '@maka/core/session';
 import {
   TOOL_BOUNDARY_PROTOCOL_V1,
@@ -4522,7 +4524,7 @@ test('production Host automatically archives assistant Markdown images and serve
   });
 });
 
-test('production Host never downloads remote Markdown images in restricted session modes', async () => {
+test('production Host rejects loopback image destinations even when a restricted-session client permits media loading', async () => {
   await withCompositionRoot(async ({ root, owner }) => {
     let requests = 0;
     const server = createServer((_request, response) => {
@@ -4582,7 +4584,13 @@ test('production Host never downloads remote Markdown images in restricted sessi
           ).ok,
           true,
         );
-        const request = { sessionId: session.id, turnId, messageId: `message-${turnId}`, source };
+        const request = {
+          sessionId: session.id,
+          turnId,
+          messageId: `message-${turnId}`,
+          source,
+          loadRemote: true,
+        };
         await waitFor(async () => {
           const result = await captured.composition.handlers['artifact.image.resolve'](
             request,
@@ -4608,3 +4616,132 @@ test('production Host never downloads remote Markdown images in restricted sessi
     }
   });
 });
+
+test('production Host loads visible remote media independently of agent sandbox networking and respects app privacy', async (t) => {
+  const png = Buffer.from(
+    'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8DwHwAFBQIAX8jx0gAAAABJRU5ErkJggg==',
+    'base64',
+  );
+  let requests = 0;
+  const server = createServer((_request, response) => {
+    requests++;
+    response.end(png);
+  });
+  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+  const origin = `http://127.0.0.1:${(server.address() as import('node:net').AddressInfo).port}`;
+  const realRequest = http.request;
+  t.mock.method(dns, 'lookup', async (host: string) => {
+    assert.equal(host, 'image.example');
+    return [{ address: '198.18.0.2', family: 4 }];
+  });
+  t.mock.method(
+    http,
+    'request',
+    (
+      url: URL,
+      options: import('node:http').RequestOptions,
+      callback: (response: import('node:http').IncomingMessage) => void,
+    ) => {
+      assert.equal(url.hostname, 'image.example');
+      assert.ok(options.lookup);
+      options.lookup(url.hostname, { all: true }, (error, addresses) => {
+        assert.equal(error, null);
+        assert.deepEqual(addresses, [{ address: '198.18.0.2', family: 4 }]);
+      });
+      return realRequest(
+        new URL(url.pathname, origin),
+        { ...options, lookup: undefined },
+        callback,
+      );
+    },
+  );
+  syncBuiltinESMExports();
+  try {
+    await withCompositionRoot(async ({ root, owner }) => {
+      const captured = await createCapturedExecutionComposition(owner, {
+        primaryBackendFactory: (context) =>
+          new (class extends FakeBackend {
+            override async *send(input: BackendSendInput): AsyncIterable<SessionEvent> {
+              yield {
+                type: 'text_complete',
+                id: `text-${input.turnId}`,
+                turnId: input.turnId,
+                ts: Date.now(),
+                messageId: `message-${input.turnId}`,
+                text: `![](http://image.example/${input.turnId}.png)`,
+              };
+              yield {
+                type: 'complete',
+                id: `complete-${input.turnId}`,
+                turnId: input.turnId,
+                ts: Date.now(),
+                stopReason: 'end_turn',
+              };
+            }
+          })(context),
+      });
+      const context = {
+        hostEpoch: 'execution-composition-test',
+        connectionId: 'image-client',
+        principal: 'local_os_user',
+        acquireResidency: () => ({ release() {} }),
+      };
+      try {
+        for (const [permissionMode, privacy] of [
+          ['explore', false],
+          ['ask', false],
+          ['bypass', true],
+        ] as const) {
+          const policy = await captured.composition.handlers['runtime.policy.query']({}, context);
+          assert.ok(policy.ok);
+          const changed = await captured.composition.handlers['runtime.policy.mutate'](
+            {
+              expectedRevision: policy.result.revision,
+              operation: { kind: 'set_privacy', value: { incognitoActive: privacy } },
+            },
+            context,
+          );
+          assert.ok(changed.ok);
+          const session = await captured.manager.createSession({
+            cwd: root,
+            llmConnectionId: FAKE_CONNECTION_ID,
+            llmConnectionSlug: 'fake',
+            model: 'fake-model',
+            permissionMode,
+          });
+          const turnId = `media-${permissionMode}`;
+          const started = await captured.composition.handlers['turn.start'](
+            { sessionId: session.id, turnId, content: { text: 'display image' } },
+            context,
+          );
+          assert.ok(started.ok, JSON.stringify(started));
+          const request = {
+            sessionId: session.id,
+            turnId,
+            messageId: `message-${turnId}`,
+            source: `http://image.example/${turnId}.png`,
+            loadRemote: true,
+          };
+          await waitFor(async () => {
+            const result = await captured.composition.handlers['artifact.image.resolve'](
+              request,
+              context,
+            );
+            assert.ok(result.ok);
+            return privacy
+              ? result.result.status === 'failed' && result.result.reason === 'not_allowed'
+              : result.result.status === 'ready';
+          }, 5000);
+        }
+        assert.equal(requests, 2, 'privacy mode must not issue a third media request');
+      } finally {
+        captured.composition.beginDrain();
+        await captured.composition.close();
+      }
+    });
+  } finally {
+    t.mock.restoreAll();
+    syncBuiltinESMExports();
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+  }
+});
diff --git a/packages/runtime-host/src/server/chat-image-delivery.ts b/packages/runtime-host/src/server/chat-image-delivery.ts
index 10358d64c96..54f067b22d4 100644
--- a/packages/runtime-host/src/server/chat-image-delivery.ts
+++ b/packages/runtime-host/src/server/chat-image-delivery.ts
@@ -86,7 +86,7 @@ export class ChatImageDeliveryService {
     )
       return;
     // Reference destinations can grow during streaming. Only settled text
-    // grants capture, and remote sources always require an explicit action.
+    // grants local capture. Remote media loads only when a client displays it.
     try {
       for (const source of chatImageSources(event.text)) {
         if (isRemoteImageSource(source)) continue;
diff --git a/packages/runtime-host/src/server/chat-image-source.ts b/packages/runtime-host/src/server/chat-image-source.ts
index 84364ca23a8..760918926a9 100644
--- a/packages/runtime-host/src/server/chat-image-source.ts
+++ b/packages/runtime-host/src/server/chat-image-source.ts
@@ -34,6 +34,7 @@ import {
   type ImageDeliveryFailure,
 } from '@maka/core/image-delivery';
 import { abortable } from '../client/wait-for-ready.js';
+import { usesFetchProxy } from '@maka/runtime/network/scoped-fetch-transport';
 export class ImageSourceError extends Error {
   constructor(readonly reason: ImageDeliveryFailure) {
     super(reason);
@@ -81,6 +82,7 @@ export function decodedLocalImagePath(source: string): string | undefined {
 export async function downloadChatImage(
   source: string,
   signal: AbortSignal,
+  options: { readonly fetch?: typeof globalThis.fetch } = {},
 ): Promise<ChatImageBytes> {
   let url = new URL(source);
   for (let redirect = 0; redirect <= 3; redirect++) {
@@ -88,49 +90,68 @@ export async function downloadChatImage(
     if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password)
       throw new ImageSourceError('not_allowed');
     const host = url.hostname.replace(/^\[|\]$/g, '');
+    // Fake DNS addresses are routing handles for a named destination, never
+    // authority to load a literal private address or a local/metadata hostname.
+    const namedHost = !isIP(host) && publicHostname(host);
+    if (!isIP(host) && !namedHost) throw new ImageSourceError('not_allowed');
     const addresses = isIP(host)
       ? [{ address: host, family: isIP(host) }]
       : await abortable(() => lookup(host, { all: true }), signal);
-    if (!addresses.length || addresses.some((a) => !publicAddress(a.address)))
+    if (
+      !addresses.length ||
+      addresses.some((a) => !publicAddress(a.address) && !(namedHost && fakeAddress(a.address)))
+    )
       throw new ImageSourceError('not_allowed');
     const target = addresses[0]!;
-    const response = await new Promise<import('node:http').IncomingMessage>((resolve, reject) => {
-      const req = (url.protocol === 'https:' ? httpsRequest : httpRequest)(
-        url,
-        {
-          signal,
-          headers: { accept: 'image/png,image/jpeg,image/webp,image/gif' },
-          lookup: (_host, options, callback) =>
-            options.all ? callback(null, [target]) : callback(null, target.address, target.family),
-        },
-        resolve,
-      );
-      req.on('error', reject);
-      req.end();
-    });
-    if ([301, 302, 303, 307, 308].includes(response.statusCode ?? 0) && response.headers.location) {
-      response.destroy();
-      const next = new URL(response.headers.location, url);
+    const headers = { accept: 'image/png,image/jpeg,image/webp,image/gif' };
+    const proxyFetch =
+      options.fetch && usesFetchProxy(options.fetch, url) ? options.fetch : undefined;
+    const response = proxyFetch
+      ? proxyImageResponse(
+          await proxyFetch(url, { signal, headers, redirect: 'manual', credentials: 'omit' }),
+        )
+      : directImageResponse(
+          await new Promise<import('node:http').IncomingMessage>((resolve, reject) => {
+            const req = (url.protocol === 'https:' ? httpsRequest : httpRequest)(
+              url,
+              {
+                signal,
+                headers,
+                lookup: (_host, options, callback) =>
+                  options.all
+                    ? callback(null, [target])
+                    : callback(null, target.address, target.family),
+              },
+              resolve,
+            );
+            req.on('error', reject);
+            req.end();
+          }),
+        );
+    const location = response.header('location');
+    if ([301, 302, 303, 307, 308].includes(response.status) && location) {
+      await response.close();
+      const next = new URL(location, url);
       if (url.protocol === 'https:' && next.protocol !== 'https:')
         throw new ImageSourceError('not_allowed');
       url = next;
       continue;
     }
-    if (response.statusCode !== 200) {
-      response.destroy();
+    if (response.status !== 200) {
+      await response.close();
       throw new ImageSourceError('download_failed');
     }
-    const length = Number(response.headers['content-length']);
+    const length = Number(response.header('content-length'));
     if (length > ARTIFACT_IMAGE_PREVIEW_MAX_BYTES) {
-      response.destroy();
+      await response.close();
       throw new ImageSourceError('too_large');
     }
     const chunks: Buffer[] = [];
     let size = 0;
-    for await (const chunk of response) {
+    for await (const chunk of response.chunks) {
       size += chunk.length;
       if (size > ARTIFACT_IMAGE_PREVIEW_MAX_BYTES) {
-        response.destroy();
+        await response.close();
         throw new ImageSourceError('too_large');
       }
       chunks.push(Buffer.from(chunk));
@@ -139,6 +160,68 @@ export async function downloadChatImage(
   }
   throw new ImageSourceError('download_failed');
 }
+interface ImageResponse {
+  readonly status: number;
+  readonly chunks: AsyncIterable<Uint8Array>;
+  header(name: string): string | undefined;
+  close(): void | Promise<void>;
+}
+function directImageResponse(response: import('node:http').IncomingMessage): ImageResponse {
+  return {
+    status: response.statusCode ?? 0,
+    chunks: response,
+    header: (name) => {
+      const value = response.headers[name];
+      return typeof value === 'string' ? value : undefined;
+    },
+    close: () => {
+      response.destroy();
+    },
+  };
+}
+function proxyImageResponse(response: Response): ImageResponse {
+  return {
+    status: response.status,
+    header: (name) => response.headers.get(name) ?? undefined,
+    close: async () => {
+      await response.body?.cancel().catch(() => {});
+    },
+    chunks: (async function* () {
+      const reader = response.body?.getReader();
+      if (!reader) return;
+      try {
+        while (true) {
+          const chunk = await reader.read();
+          if (chunk.done) break;
+          yield chunk.value;
+        }
+      } finally {
+        await reader.cancel().catch(() => {});
+        reader.releaseLock();
+      }
+    })(),
+  };
+}
+function publicHostname(host: string): boolean {
+  const name = host.toLowerCase().replace(/\.$/, '');
+  return (
+    name.includes('.') &&
+    !/(^|\.)(localhost|local|lan|internal|home|arpa|test|invalid)$/.test(name) &&
+    ![
+      'metadata.google.internal',
+      'metadata.goog',
+      'metadata.tencentyun.com',
+      'instance-data.ec2.internal',
+    ].includes(name)
+  );
+}
+function fakeAddress(address: string): boolean {
+  if (isIP(address) === 4) return /^198\.(18|19)\./.test(address);
+  if (isIP(address) !== 6) return false;
+  // RFC 5180's benchmarking prefix is also used by VPN fake DNS for IPv6.
+  const normalized = new URL(`http://[${address}]`).hostname;
+  return /^\[2001:2:(?::|0:)/i.test(normalized);
+}
 function publicAddress(address: string): boolean {
   if (isIP(address) === 4) {
     const [a = 0, b = 0] = address.split('.').map(Number);
@@ -155,5 +238,5 @@ function publicAddress(address: string): boolean {
     );
   }
   // Only global-unicast IPv6 is eligible. Mapped IPv4/ULA/link-local are excluded.
-  return /^[23][0-9a-f]{3}:/i.test(address);
+  return /^[23][0-9a-f]{3}:/i.test(address) && !fakeAddress(address);
 }
diff --git a/packages/runtime-host/src/server/execution-composition.ts b/packages/runtime-host/src/server/execution-composition.ts
index c2687f29309..b861b0b5736 100644
--- a/packages/runtime-host/src/server/execution-composition.ts
+++ b/packages/runtime-host/src/server/execution-composition.ts
@@ -19,6 +19,7 @@
 
 import { createImageFileReader } from '@maka/runtime/image-file-reader';
 import { ChatImageDeliveryService } from './chat-image-delivery.js';
+import { downloadChatImage, ImageSourceError } from './chat-image-source.js';
 import { createGenesisExecutionBoundary } from '@maka/core/sandbox-boundary';
 import { createWorkHubResultRuntime } from './workhub-result-runtime.js';
 import { createWorkHubInspectionTool } from './workhub-inspection-tool.js';
@@ -595,16 +596,26 @@ export async function createExecutionRuntimeHostComposition(
       presentationFailed: (error) => {
         console.warn('[runtime-host] Image presentation failed', error);
       },
-      canLoadRemote: async (sessionId) => {
-        const [header, stored] = await Promise.all([
-          stores.sessionStore.readHeaderSnapshot(sessionId),
-          stores.sessionStore.readExecutionBoundary(sessionId),
-        ]);
-        const boundary = stored ?? createGenesisExecutionBoundary(header.permissionMode);
-        return (
-          boundary.kind === 'bypass' ||
-          (boundary.kind === 'managed' && boundary.profile.network.kind === 'enabled')
+      // Transcript media belongs to the application's outbound policy, rather
+      // than the agent's subprocess sandbox. Privacy mode still blocks capture.
+      canLoadRemote: async () => {
+        const resolved = await runtimePolicyStores.operations.resolveHostOutboundExecution();
+        return resolved.kind === 'ready';
+      },
+      download: async (source, signal) => {
+        const resolved = await runtimePolicyStores.operations.resolveHostOutboundExecution();
+        if (resolved.kind !== 'ready') throw new ImageSourceError('not_allowed');
+        const proxy = toRuntimePolicyProxy(
+          resolved.networkProxy,
+          resolved.secretMaterial.networkProxy?.secret,
         );
+        if (!proxy) return downloadChatImage(source, signal);
+        const transport = createProxiedFetchTransport(proxy);
+        try {
+          return await downloadChatImage(source, signal, { fetch: transport.fetch });
+        } finally {
+          await transport.close();
+        }
       },
       readLocalImage: async (sessionId, path, abortSignal) => {
         const [header, boundary] = await Promise.all([
diff --git a/packages/runtime/src/network/scoped-fetch-transport.ts b/packages/runtime/src/network/scoped-fetch-transport.ts
index ef412233d4b..1d3ddc72f98 100644
--- a/packages/runtime/src/network/scoped-fetch-transport.ts
+++ b/packages/runtime/src/network/scoped-fetch-transport.ts
@@ -43,6 +43,15 @@ export interface ConnectionEffectFetchTransport {
 
 export type ProxiedFetchProxy = ConnectionEffectProxySnapshot;
 
+/** Use the same immutable route decision when a caller also owns a pinned direct connection. */
+export function usesFetchProxy(fetch: typeof globalThis.fetch, url: URL): boolean {
+  const proxy = Object.getOwnPropertyDescriptor(fetch, FETCH_PROXY_SNAPSHOT)?.value as
+    | ProxySettings
+    | null
+    | undefined;
+  return !!proxy?.enabled && !matchesBypassList(url.hostname, proxy.bypassList);
+}
+
 export interface ProxiedFetchTransport {
   readonly fetch: typeof globalThis.fetch;
   close(): Promise<void>;
diff --git a/packages/ui/scripts/markdown-images.browser.test.mjs b/packages/ui/scripts/markdown-images.browser.test.mjs
index dcf12f870a8..0374c29bad6 100644
--- a/packages/ui/scripts/markdown-images.browser.test.mjs
+++ b/packages/ui/scripts/markdown-images.browser.test.mjs
@@ -174,7 +174,7 @@ before(async () => {
         window.deliverySources.push(request.source);
         if(canonicalSources[mode] && !canonicalSources[mode].includes(request.source)) return {status:'unavailable'};
         if(request.retry) window.deliveryRetries++;
-        if(mode==='restricted') return {status:'failed',reason:'not_allowed'};
+        if(mode==='privacy') return {status:'failed',reason:'not_allowed'};
         if(mode==='signed-failed') return {status:'failed',reason:'download_failed'};
         if(!seeded) {
           if(!request.loadRemote) return {status:'requires_confirmation'};
@@ -253,32 +253,25 @@ async function loaded(page) {
   await page.waitForFunction(() => [...document.images].some(image => image.naturalWidth === 1));
 }
 
-test('a remote image sends no request until clicked, then renders Host-owned bytes', async () => {
+test('a remote image loads automatically and renders Host-owned bytes', async () => {
   requests = [];
   const page = await pageFor('remote');
   try {
-    await page.getByRole('button', { name: 'Load image', exact: true }).waitFor();
-    assert.deepEqual(requests, []);
-    assert.equal(await page.locator('img').count(), 0);
-    await page.getByRole('button', { name: 'Load image', exact: true }).click();
     await loaded(page);
+    assert.equal(await page.getByRole('button', { name: 'Load image', exact: true }).count(), 0);
     assert.deepEqual(requests, [{ path: '/image.png', referer: undefined }]);
     assert.match(await page.locator('img').getAttribute('src'), /^data:/);
   } finally { await page.close(); }
 });
 
-test('remote consent belongs to one message, even when the next message reuses its URL', async () => {
+test('each message automatically resolves its own remote image identity', async () => {
   requests = [];
   const page = await pageFor('remote');
   try {
-    await page.getByRole('button', { name: 'Load image', exact: true }).click();
     await loaded(page);
     assert.equal(requests.length, 1);
     await page.evaluate(() => window.nextMessage());
-    await page.getByRole('button', { name: 'Load image', exact: true }).waitFor();
-    assert.equal(await page.locator('img').count(), 0);
-    assert.equal(requests.length, 1);
-    await page.getByRole('button', { name: 'Load image', exact: true }).click();
+    await page.waitForFunction(() => window.deliveryQueries >= 2);
     await loaded(page);
     assert.equal(requests.length, 2);
   } finally { await page.close(); }
@@ -333,22 +326,20 @@ test('redacting only image alt text does not disable a safe destination', async
   requests = [];
   const page = await pageFor('secret-alt');
   try {
-    await page.getByRole('button', {name: 'Load image', exact: true}).waitFor();
     assert.doesNotMatch(await page.locator('body').innerText(), /alt-secret/);
-    await page.getByRole('button', {name: 'Load image', exact: true}).click();
     await loaded(page);
     assert.equal(requests.length, 1);
   } finally { await page.close(); }
 });
 
-test('network-restricted images show denial before any load click and can recheck permissions', async () => {
+test('application privacy policy prevents automatic image loading and can be rechecked', async () => {
   requests = [];
-  const page = await pageFor('restricted');
+  const page = await pageFor('privacy');
   try {
-    await page.getByText('Image not saved: current permissions do not allow reading it or using the network.', {exact: true}).waitFor();
+    await page.getByText('Image not saved: permissions, network settings, or the source address block loading.', {exact: true}).waitFor();
     assert.equal(await page.getByRole('button', {name: 'Load image', exact: true}).count(), 0);
     await page.getByRole('button', {name: 'Retry', exact: true}).click();
-    await page.getByText('Image not saved: current permissions do not allow reading it or using the network.', {exact: true}).waitFor();
+    await page.getByText('Image not saved: permissions, network settings, or the source address block loading.', {exact: true}).waitFor();
     await page.getByText('Open in browser', {exact: true}).waitFor();
     assert.deepEqual(requests, []);
   } finally { await page.close(); }
@@ -387,7 +378,6 @@ test('failed remote image has a working retry control instead of a broken image
   failedOnce = false;
   const page = await pageFor('retry');
   try {
-    await page.getByRole('button', { name: 'Load image', exact: true }).click();
     await page.getByText('Image not saved: download failed. Try again.').waitFor();
     assert.equal(await page.locator('img').count(), 0);
     await page.getByRole('button', { name: 'Retry', exact: true }).click();
@@ -514,9 +504,6 @@ test('offscreen image performs no image request until it approaches the viewport
     assert.deepEqual(requests, []);
     assert.equal(await page.locator('img').count(), 0);
     await page.locator('[data-maka-image-state]').scrollIntoViewIfNeeded();
-    await page.getByRole('button', { name: 'Load image', exact: true }).waitFor();
-    assert.deepEqual(requests, []);
-    await page.getByRole('button', { name: 'Load image', exact: true }).click();
     await loaded(page);
     assert.deepEqual(requests, [{ path: '/image.png', referer: undefined }]);
   } finally { await page.close(); }
@@ -576,7 +563,6 @@ for (const scenario of ['geometry-remote', 'geometry-saved']) {
   test(`${scenario}: loading and ready images preserve the position of subsequent content`, async () => {
     const page = await pageFor(scenario);
     try {
-      if (scenario === 'geometry-remote') await page.getByRole('button', { name: 'Load image', exact: true }).click();
       await page.getByText('Loading image…', { exact: true }).waitFor();
       const before = await page.getByText('Following paragraph', { exact: true }).boundingBox();
       if (scenario === 'geometry-remote') releaseImage(); else releaseAttachment();
@@ -594,7 +580,6 @@ for (const scenario of ['geometry-remote', 'geometry-saved']) {
 test('image frames fit narrow viewports without distorting screenshots or limiting the enlarged preview', async () => {
   const page = await pageFor('screenshot');
   try {
-    await page.getByRole('button', { name: 'Load image', exact: true }).click();
     await page.waitForFunction(() => [...document.images].some(image => image.naturalWidth > 1));
     for (const width of [720, 360]) {
       await page.setViewportSize({ width, height: 600 });
diff --git a/packages/ui/src/image-delivery.tsx b/packages/ui/src/image-delivery.tsx
index 763539497e8..4f814a177d0 100644
--- a/packages/ui/src/image-delivery.tsx
+++ b/packages/ui/src/image-delivery.tsx
@@ -19,6 +19,7 @@
 
 import { createContext, useCallback, useContext, useEffect, useMemo, useState, type ReactNode } from 'react';
 import type { ImageDeliveryRequest, ImageDeliveryResult } from '@maka/core/image-delivery';
+import { isRemoteImageSource } from '@maka/core/image-delivery';
 export type ResolveImageDelivery = (sessionId: string, request: ImageDeliveryRequest) => Promise<ImageDeliveryResult>;
 export const ImageMessageScope = createContext<{ turnId: string; messageId: string; streaming?: boolean } | undefined>(undefined);
 const DeliveryContext = createContext<{ resolve(request: ImageDeliveryRequest): Promise<ImageDeliveryResult> } | undefined>(undefined);
@@ -45,19 +46,17 @@ export function ImageDeliveryProvider(props: { sessionId: string; resolve?: Reso
   }, [props.resolve, props.sessionId]);
   return <DeliveryContext.Provider value={value}>{props.children}</DeliveryContext.Provider>;
 }
-export function useImageDelivery(source: string, enabled: boolean) {
+export function useImageDelivery(source: string, enabled: boolean, allowRemote: boolean) {
   const scope = useContext(ImageMessageScope);
   const context = useContext(DeliveryContext);
   const [attempt, setAttempt] = useState(0);
-  const consentKey = JSON.stringify([scope?.turnId, scope?.messageId, source]);
-  const [consent, setConsent] = useState<{ context: typeof context; key: string }>();
-  const loadRemote = consent?.context === context && consent?.key === consentKey;
+  // Saved images can resolve even when display redaction forbids a source fetch.
+  const loadRemote = allowRemote && isRemoteImageSource(source);
   const identity = useMemo(() => context && scope?.turnId && scope.messageId && enabled
     ? { context, turnId: scope.turnId, messageId: scope.messageId, streaming: scope.streaming === true, source, attempt, loadRemote } : undefined,
     [context, scope?.turnId, scope?.messageId, scope?.streaming, source, attempt, loadRemote, enabled]);
   const [settled, setSettled] = useState<{ identity: typeof identity; result: ImageDeliveryResult }>();
   const retry = useCallback(() => setAttempt(a => a + 1), []);
-  const confirmRemote = useCallback(() => setConsent({ context, key: consentKey }), [context, consentKey]);
   useEffect(() => {
     if (!identity) return;
     let cancelled = false; let timer: ReturnType<typeof setTimeout> | undefined; let delay = 500; let unavailableRetries = 0;
@@ -76,5 +75,5 @@ export function useImageDelivery(source: string, enabled: boolean) {
   }, [identity, attempt]);
   const result: ImageDeliveryResult = !identity ? { status: 'unavailable' }
     : settled?.identity === identity ? settled.result : { status: 'pending' };
-  return { ...result, retry, confirmRemote, available: !!identity };
+  return { ...result, retry, available: !!identity };
 }
diff --git a/packages/ui/src/markdown-image.tsx b/packages/ui/src/markdown-image.tsx
index 17af0c859bf..1b2f8270f28 100644
--- a/packages/ui/src/markdown-image.tsx
+++ b/packages/ui/src/markdown-image.tsx
@@ -99,7 +99,7 @@ function ImageResource(props: { src: string; redacted: boolean; alt: string; inl
     observer.observe(anchor.current); return () => observer.disconnect();
   }, [visible]);
   const explicit = parseAttachmentResourceRef(props.src);
-  const delivery = useImageDelivery(props.src, visible && !explicit);
+  const delivery = useImageDelivery(props.src, visible && !explicit, !props.redacted);
   const artifactId = explicit?.artifactId ?? (delivery.status === 'ready' ? delivery.artifactId : undefined);
   const image = useAttachmentImage(visible && artifactId ? { artifactId } : undefined);
   const [failedSource, setFailedSource] = useState<string>();
@@ -122,15 +122,13 @@ function ImageResource(props: { src: string; redacted: boolean; alt: string; inl
   </span>;
   let message: string | undefined;
   const remotePlaceholder = visible && remote && !artifactId;
-  const needsConsent = remotePlaceholder && !hiddenRemote && delivery.status === 'requires_confirmation';
-  const remoteUnavailable = remotePlaceholder && !hiddenRemote && !delivery.available;
-  const remoteNotice = remotePlaceholder && (hiddenRemote || remoteUnavailable || needsConsent || remoteBlocked);
+  const remoteUnavailable = remotePlaceholder && !hiddenRemote && (!delivery.available || delivery.status === 'requires_confirmation');
+  const remoteNotice = remotePlaceholder && (hiddenRemote || remoteUnavailable || remoteBlocked);
   if (failed) message = copy.imageLoadFailed;
   else if (!source) message = !visible ? copy.imageLoading
     : explicit && image.status === 'unavailable' ? copy.imageUnavailable
     : remotePlaceholder && hiddenRemote ? copy.imageRemoteRedacted
     : remoteUnavailable ? copy.imageRemoteUnavailable
-    : needsConsent ? copy.imageRemoteConsent
     : delivery.status === 'failed' ? copy.imageArchiveFailure(delivery.reason)
     : delivery.status === 'pending' || artifactId ? copy.imageLoading : copy.imageUnsupported;
   const hasFrame = props.inline || !visible || !!source || !!artifactId || delivery.status === 'pending';
@@ -148,8 +146,7 @@ function ImageResource(props: { src: string; redacted: boolean; alt: string; inl
       <span role="status">{hasFrame && !failed && !remoteNotice && delivery.status !== 'failed' && <Spinner size="sm" shade="subtle" aria-hidden="true" />} {message}</span>
       {(failed || delivery.status === 'failed') && sourceActions}
     </span> : source && <DisplayImage key={`${source}\0${attempt}`} src={source} alt={props.alt} onError={() => setFailedSource(source)} />}
-    {(needsConsent || remoteUnavailable) && <span className="maka-markdown-image-actions">
-      {needsConsent && <Button variant="ghost" size="sm" label={copy.imageLoad} onClick={delivery.confirmRemote} />}
+    {remoteUnavailable && <span className="maka-markdown-image-actions">
       <Link href={props.src} isExternalLink type="inherit" hasUnderline>{copy.imageOpen}</Link>
     </span>}
   </span>;
diff --git a/packages/ui/src/shared-ui-copy.ts b/packages/ui/src/shared-ui-copy.ts
index e3a4ec829c9..c656c375ca7 100644
--- a/packages/ui/src/shared-ui-copy.ts
+++ b/packages/ui/src/shared-ui-copy.ts
@@ -31,10 +31,8 @@ export interface SharedUiCopy {
     invalidInternalLink: string;
     unsafeLink: string;
     imageLoading: string;
-    imageRemoteConsent: string;
     imageRemoteRedacted: string;
     imageRemoteUnavailable: string;
-    imageLoad: string;
     imageExpand: (alt: string) => string;
     imageArchiveFailure: (reason: import('@maka/core/image-delivery').ImageDeliveryFailure) => string;
     imageUnavailable: string;
@@ -138,15 +136,13 @@ const SHARED_UI_COPY = {
       invalidInternalLink: '内部链接无效',
       unsafeLink: '链接不安全',
       imageLoading: '正在加载图片…',
-      imageRemoteConsent: '远程图片需要授权加载，图片来源会收到请求。',
       imageRemoteRedacted: '图片地址含已隐藏的敏感信息，无法加载或在浏览器中打开。',
       imageRemoteUnavailable: '此处无法加载远程图片，可在浏览器中打开。',
-      imageLoad: '加载图片',
       imageExpand: (alt) => alt ? `放大图片：${alt}` : '放大图片',
       imageArchiveFailure: (reason) => ({
         quota_exceeded: '图片未保存：存储配额已满（每个会话 100 MiB，工作区 1 GiB）。删除不再需要的会话可释放空间，仅归档不会释放。',
         too_large: '图片未保存：超过自动保存的大小或像素上限。',
-        not_allowed: '图片未保存：当前权限不允许读取或联网。',
+        not_allowed: '图片未保存：当前权限、联网设置或来源地址不允许加载。',
         not_found: '图片未保存：原文件已不存在。',
         unsupported_mime: '图片未保存：不是支持的有效图片。',
         download_failed: '图片未保存：下载失败，请重试。',
@@ -239,15 +235,13 @@ const SHARED_UI_COPY = {
       invalidInternalLink: '內部連結無效',
       unsafeLink: '連結不安全',
       imageLoading: '正在載入圖片…',
-      imageRemoteConsent: '遠端圖片需要授權載入，圖片來源會收到請求。',
       imageRemoteRedacted: '圖片位址含已隱藏的敏感資訊，無法載入或在瀏覽器中開啟。',
       imageRemoteUnavailable: '此處無法載入遠端圖片，可在瀏覽器中開啟。',
-      imageLoad: '載入圖片',
       imageExpand: (alt) => alt ? `放大圖片：${alt}` : '放大圖片',
       imageArchiveFailure: (reason) => ({
         quota_exceeded: '圖片未儲存：儲存配額已滿（每個對話 100 MiB，工作區 1 GiB）。刪除不再需要的對話可釋放空間，僅封存不會釋放。',
         too_large: '圖片未儲存：超過自動儲存的大小或像素上限。',
-        not_allowed: '圖片未儲存：目前權限不允許讀取或連線。',
+        not_allowed: '圖片未儲存：目前權限、連線設定或來源位址不允許載入。',
         not_found: '圖片未儲存：原檔案已不存在。',
         unsupported_mime: '圖片未儲存：不是支援的有效圖片。',
         download_failed: '圖片未儲存：下載失敗，請重試。',
@@ -340,15 +334,13 @@ const SHARED_UI_COPY = {
       invalidInternalLink: 'Invalid internal link',
       unsafeLink: 'Unsafe link',
       imageLoading: 'Loading image…',
-      imageRemoteConsent: 'Load this remote image only if you trust its source. Loading sends a request to that source.',
       imageRemoteRedacted: 'The image address contains hidden sensitive information. Loading and opening it are disabled.',
       imageRemoteUnavailable: 'Remote images cannot be loaded here. You can open this image in your browser.',
-      imageLoad: 'Load image',
       imageExpand: (alt) => alt ? `Enlarge image: ${alt}` : 'Enlarge image',
       imageArchiveFailure: (reason) => ({
         quota_exceeded: 'Image not saved: storage quota reached (100 MiB per session, 1 GiB per workspace). Delete unneeded sessions to free space; archiving does not free space.',
         too_large: 'Image not saved: exceeds the automatic save size or pixel limit.',
-        not_allowed: 'Image not saved: current permissions do not allow reading it or using the network.',
+        not_allowed: 'Image not saved: permissions, network settings, or the source address block loading.',
         not_found: 'Image not saved: the original file no longer exists.',
         unsupported_mime: 'Image not saved: not a supported valid image.',
         download_failed: 'Image not saved: download failed. Try again.',

From aa8e0cbc9065b3ebbad8837e180d088d3236374c Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Wed, 7 Oct 2026 21:47:12 +0800
Subject: [PATCH 24/37] fix(images): enforce copy quotas and restore UI checks

Apply archive budgets under the writer lock to conversation copies, including
linked child images and configured Host limits. Preserve content deduplication
and verified copy retries.

Use Astryx Button for image enlargement and update the legacy Host-unavailable
Storybook assertion. Document the retained application-media network boundary,
proxy DNS authority and trusted fake-DNS routing assumptions.

Generated-by: Codex (GPT-6)
---
 .../src/server/chat-image-source.ts           |  6 +-
 .../src/server/execution-composition.ts       |  3 +
 .../server/session-revision-coordinator.ts    |  4 +
 .../src/__tests__/artifact-store.test.ts      | 86 +++++++++++++++++++
 .../storage/src/artifact-image-storage.ts     | 34 ++++++--
 packages/storage/src/artifact-store.ts        | 10 ++-
 packages/storage/src/artifact-stores.ts       |  3 +
 packages/ui/src/image-delivery.tsx            |  2 +
 packages/ui/src/markdown-image.tsx            | 26 +++---
 packages/ui/src/styles.css                    |  9 +-
 packages/ui/stories/attachment.stories.tsx    |  6 +-
 11 files changed, 158 insertions(+), 31 deletions(-)

diff --git a/packages/runtime-host/src/server/chat-image-source.ts b/packages/runtime-host/src/server/chat-image-source.ts
index 760918926a9..43aa34a999d 100644
--- a/packages/runtime-host/src/server/chat-image-source.ts
+++ b/packages/runtime-host/src/server/chat-image-source.ts
@@ -78,7 +78,9 @@ export function decodedLocalImagePath(source: string): string | undefined {
     return undefined;
   }
 }
-/** Pin DNS at connection time and check each redirect; never send cookies, auth or referer. */
+/** Pin direct DNS and check each redirect; never send cookies, auth or referer.
+ * A configured proxy resolves the original hostname and is trusted to enforce
+ * its own egress boundary; local DNS checks cannot pin the proxy's destination. */
 export async function downloadChatImage(
   source: string,
   signal: AbortSignal,
@@ -92,6 +94,8 @@ export async function downloadChatImage(
     const host = url.hostname.replace(/^\[|\]$/g, '');
     // Fake DNS addresses are routing handles for a named destination, never
     // authority to load a literal private address or a local/metadata hostname.
+    // This compatibility exception assumes trusted VPN/TUN routing: a fake-IP
+    // answer alone does not prove that the eventual destination is public.
     const namedHost = !isIP(host) && publicHostname(host);
     if (!isIP(host) && !namedHost) throw new ImageSourceError('not_allowed');
     const addresses = isIP(host)
diff --git a/packages/runtime-host/src/server/execution-composition.ts b/packages/runtime-host/src/server/execution-composition.ts
index b861b0b5736..0eb1b3e330c 100644
--- a/packages/runtime-host/src/server/execution-composition.ts
+++ b/packages/runtime-host/src/server/execution-composition.ts
@@ -598,6 +598,8 @@ export async function createExecutionRuntimeHostComposition(
       },
       // Transcript media belongs to the application's outbound policy, rather
       // than the agent's subprocess sandbox. Privacy mode still blocks capture.
+      // Model-authored URLs can carry encoded data even when WebFetch is disabled;
+      // automatic media loading is not a Session network or DLP boundary.
       canLoadRemote: async () => {
         const resolved = await runtimePolicyStores.operations.resolveHostOutboundExecution();
         return resolved.kind === 'ready';
@@ -2910,6 +2912,7 @@ export async function createExecutionRuntimeHostComposition(
     });
     const executionInspect = new HostExecutionInspectCoordinator(stores);
     const sessionRevisions = new HostSessionRevisionCoordinator({
+      ...(options.imageArchiveLimits ? { imageArchiveLimits: options.imageArchiveLimits } : {}),
       stores,
       artifacts: openedArtifactStore,
       sessionTodo: sessionTodoStore,
diff --git a/packages/runtime-host/src/server/session-revision-coordinator.ts b/packages/runtime-host/src/server/session-revision-coordinator.ts
index 09f1aab0b08..9682c1043e2 100644
--- a/packages/runtime-host/src/server/session-revision-coordinator.ts
+++ b/packages/runtime-host/src/server/session-revision-coordinator.ts
@@ -97,6 +97,7 @@ type ConversationCopyCreateInput = CreateSessionInput & {
 };
 
 export interface HostSessionRevisionCoordinatorOptions {
+  readonly imageArchiveLimits?: import('@maka/core/image-delivery').ImageArchiveLimits;
   readonly stores: ExecutionStoresWriter<'interactive'>;
   readonly artifacts: InteractiveArtifactStoreWriter;
   readonly sessionTodo: InteractiveSessionTodoWriter;
@@ -517,6 +518,9 @@ export class HostSessionRevisionCoordinator {
         throw new Error(`Session context references could not be copied: ${contextCopy.reason}`);
       }
       const artifactCopy = await this.#artifacts.copyConversationArtifacts({
+        ...(this.options.imageArchiveLimits
+          ? { imageArchiveLimits: this.options.imageArchiveLimits }
+          : {}),
         sourceSessionId: input.sourceSessionId,
         targetSessionId: input.targetSessionId,
         turnIds: copyTurnIds,
diff --git a/packages/storage/src/__tests__/artifact-store.test.ts b/packages/storage/src/__tests__/artifact-store.test.ts
index d63d18f73e9..a5553d007e4 100644
--- a/packages/storage/src/__tests__/artifact-store.test.ts
+++ b/packages/storage/src/__tests__/artifact-store.test.ts
@@ -51,6 +51,7 @@ import {
   resolveArtifactPath,
   sanitizeArtifactName,
 } from '../artifact-store.js';
+import { ImageArchiveQuotaError } from '../artifact-image-storage.js';
 import { withArtifactWriterLock } from '../artifact-writer-lock.js';
 import { createSqliteArtifactMetadataRepository } from '../sqlite-artifact-metadata.js';
 
@@ -382,6 +383,91 @@ describe('SQLite Artifact store', () => {
     });
   });
 
+  test('conversation copies enforce the target image budget across root and linked child Sessions', async () => {
+    await withWorkspace(async (root) => {
+      const store = createArtifactStore(root);
+      const limits = { sessionBytes: 3, workspaceBytes: 6 };
+      const image = (id: string, sessionId: string, content: string): CreateArtifactInput => ({
+        ...artifactInput(id, content, 10),
+        sessionId,
+        turnId: 'image-turn',
+        mimeType: 'image/png',
+        imageArchiveLimits: limits,
+        imageDelivery: {
+          status: 'ready',
+          messageId: id,
+          source: '/tmp/image.png',
+          contentSha256: createHash('sha256').update(content).digest('hex'),
+        },
+      });
+      await store.create(image('root-image', 'session-1', 'one'));
+      await assert.rejects(
+        store.create(image('extra-image', 'session-1', 'two')),
+        ImageArchiveQuotaError,
+      );
+      await store.create(image('child-image', 'child-session', 'two'));
+      await assert.rejects(
+        store.copyConversationArtifacts({
+          sourceSessionId: 'session-1',
+          targetSessionId: 'session-copy',
+          turnIds: ['image-turn'],
+          linkedArtifacts: [{ sessionId: 'child-session', artifactIds: ['child-image'] }],
+          imageArchiveLimits: limits,
+        }),
+        ImageArchiveQuotaError,
+      );
+      const target = await listArtifacts(store, 'session-copy');
+      assert.equal(target.length, 1);
+      assert.equal(
+        target.reduce((sum, record) => sum + record.sizeBytes, 0),
+        limits.sessionBytes,
+      );
+      assert.deepEqual(await readArtifactText(store, 'root-image'), { ok: true, text: 'one' });
+      assert.deepEqual(await readArtifactText(store, 'child-image', 'child-session'), {
+        ok: true,
+        text: 'two',
+      });
+    });
+  });
+
+  test('conversation copies count identical image bytes once and allow verified retries at the limit', async () => {
+    await withWorkspace(async (root) => {
+      const store = createArtifactStore(root);
+      const limits = { sessionBytes: 3, workspaceBytes: 3 };
+      for (const [id, sessionId] of [
+        ['root-image', 'session-1'],
+        ['child-image', 'child-session'],
+      ]) {
+        await store.create({
+          ...artifactInput(id!, 'one', 10),
+          sessionId: sessionId!,
+          turnId: 'image-turn',
+          imageArchiveLimits: limits,
+          imageDelivery: {
+            status: 'ready',
+            messageId: id!,
+            source: '/tmp/image.png',
+            contentSha256: createHash('sha256').update('one').digest('hex'),
+          },
+        });
+      }
+      const input = {
+        sourceSessionId: 'session-1',
+        targetSessionId: 'session-copy',
+        turnIds: ['image-turn'],
+        linkedArtifacts: [{ sessionId: 'child-session', artifactIds: ['child-image'] }],
+        imageArchiveLimits: limits,
+      };
+      const copied = await store.copyConversationArtifacts(input);
+      assert.equal(copied.artifactIds.size, 2);
+      assert.equal((await listArtifacts(store, 'session-copy')).length, 2);
+      assert.deepEqual(
+        await store.copyConversationArtifacts({ ...input, existingTarget: 'reuse_verified' }),
+        copied,
+      );
+    });
+  });
+
   test('includes explicit same-Session Artifacts outside the copied turns', async () => {
     await withWorkspace(async (root) => {
       const authority = createArtifactStoreWriteAuthority(root);
diff --git a/packages/storage/src/artifact-image-storage.ts b/packages/storage/src/artifact-image-storage.ts
index a24ec5540d9..c0c477e71f4 100644
--- a/packages/storage/src/artifact-image-storage.ts
+++ b/packages/storage/src/artifact-image-storage.ts
@@ -41,6 +41,31 @@ export function planImageArchive(
   const digest =
     input.imageDelivery?.status === 'ready' ? input.imageDelivery.contentSha256 : undefined;
   const size = Buffer.byteLength(input.content);
+  assertImageArchiveQuota(records, { ...input, sizeBytes: size });
+  const sameContent = digest
+    ? records.find(
+        (r) =>
+          r.imageDelivery?.status === 'ready' &&
+          r.imageDelivery.contentSha256 === digest &&
+          r.sizeBytes === size,
+      )
+    : undefined;
+  return { digest, sameContent };
+}
+
+/** Checked under the Artifact writer lock before publishing captured or copied images. */
+export function assertImageArchiveQuota(
+  records: readonly ArtifactRecord[],
+  input: {
+    sessionId: string;
+    sizeBytes: number;
+    imageDelivery?: ImageDeliveryMetadata;
+    imageArchiveLimits?: ImageArchiveLimits;
+  },
+): void {
+  const digest =
+    input.imageDelivery?.status === 'ready' ? input.imageDelivery.contentSha256 : undefined;
+  const size = input.sizeBytes;
   const limits = input.imageArchiveLimits;
   if (digest && limits) {
     if (
@@ -62,13 +87,4 @@ export function planImageArchive(
     )
       throw new ImageArchiveQuotaError();
   }
-  const sameContent = digest
-    ? records.find(
-        (r) =>
-          r.imageDelivery?.status === 'ready' &&
-          r.imageDelivery.contentSha256 === digest &&
-          r.sizeBytes === size,
-      )
-    : undefined;
-  return { digest, sameContent };
 }
diff --git a/packages/storage/src/artifact-store.ts b/packages/storage/src/artifact-store.ts
index 13806e76163..df20d55b777 100644
--- a/packages/storage/src/artifact-store.ts
+++ b/packages/storage/src/artifact-store.ts
@@ -17,8 +17,9 @@
  * under the License.
  */
 
-import { planImageArchive } from './artifact-image-storage.js';
+import { assertImageArchiveQuota, planImageArchive } from './artifact-image-storage.js';
 import {
+  DEFAULT_IMAGE_ARCHIVE_LIMITS,
   isImageDeliveryMetadata,
   type ImageDeliveryMetadata,
   type ImageArchiveLimits,
@@ -140,6 +141,7 @@ export type ArtifactChunkReadResult =
   | { readonly ok: false; readonly reason: 'out_of_range' };
 
 export interface ConversationArtifactCopyInput {
+  readonly imageArchiveLimits?: ImageArchiveLimits;
   readonly sourceSessionId: string;
   readonly targetSessionId: string;
   readonly turnIds: readonly string[];
@@ -380,6 +382,9 @@ class SqliteArtifactStore implements ArtifactAuthorityStore {
     if (input.sourceSessionId === input.targetSessionId) {
       throw new Error('Artifact conversation copy requires distinct Sessions');
     }
+    const imageArchiveLimits = Object.freeze({
+      ...(input.imageArchiveLimits ?? DEFAULT_IMAGE_ARCHIVE_LIMITS),
+    });
     const turnIds = new Set(input.turnIds);
     const includedArtifactIds = new Set(input.includeArtifactIds ?? []);
     for (const turnId of turnIds) assertArtifactTurnKey(turnId);
@@ -448,6 +453,7 @@ class SqliteArtifactStore implements ArtifactAuthorityStore {
         input.targetSessionId,
         targetId,
         input.existingTarget === 'reuse_verified',
+        imageArchiveLimits,
       );
       artifactIds.set(record.id, created.id);
       relativePaths.set(record.relativePath, created.relativePath);
@@ -460,6 +466,7 @@ class SqliteArtifactStore implements ArtifactAuthorityStore {
     targetSessionId: string,
     targetId: string,
     reuseVerified: boolean,
+    imageArchiveLimits: ImageArchiveLimits,
   ): Promise<ArtifactRecord> {
     const source = prepared.record;
     const name = sanitizeArtifactName(source.name);
@@ -495,6 +502,7 @@ class SqliteArtifactStore implements ArtifactAuthorityStore {
         }
         return { ...existing };
       }
+      assertImageArchiveQuota(this.records, { ...expected, imageArchiveLimits });
       return this.publishNewArtifactUnlocked(
         expected,
         async (targetPath) => {
diff --git a/packages/storage/src/artifact-stores.ts b/packages/storage/src/artifact-stores.ts
index 86874feed74..383bef82e1e 100644
--- a/packages/storage/src/artifact-stores.ts
+++ b/packages/storage/src/artifact-stores.ts
@@ -160,6 +160,9 @@ function createWriterFacade(
       const acceptedInput: ConversationArtifactCopyInput = Object.freeze({
         ...input,
         turnIds: Object.freeze([...input.turnIds]),
+        ...(input.imageArchiveLimits
+          ? { imageArchiveLimits: Object.freeze({ ...input.imageArchiveLimits }) }
+          : {}),
         ...(input.includeArtifactIds
           ? { includeArtifactIds: Object.freeze([...input.includeArtifactIds]) }
           : {}),
diff --git a/packages/ui/src/image-delivery.tsx b/packages/ui/src/image-delivery.tsx
index 4f814a177d0..b2fd1c0a76c 100644
--- a/packages/ui/src/image-delivery.tsx
+++ b/packages/ui/src/image-delivery.tsx
@@ -51,6 +51,8 @@ export function useImageDelivery(source: string, enabled: boolean, allowRemote:
   const context = useContext(DeliveryContext);
   const [attempt, setAttempt] = useState(0);
   // Saved images can resolve even when display redaction forbids a source fetch.
+  // Redaction protects display/retry UX for recognized secrets, not outbound data:
+  // an encoded value in a model-authored URL may still pass this presentation check.
   const loadRemote = allowRemote && isRemoteImageSource(source);
   const identity = useMemo(() => context && scope?.turnId && scope.messageId && enabled
     ? { context, turnId: scope.turnId, messageId: scope.messageId, streaming: scope.streaming === true, source, attempt, loadRemote } : undefined,
diff --git a/packages/ui/src/markdown-image.tsx b/packages/ui/src/markdown-image.tsx
index 1b2f8270f28..e4069cfd33b 100644
--- a/packages/ui/src/markdown-image.tsx
+++ b/packages/ui/src/markdown-image.tsx
@@ -155,24 +155,22 @@ function DisplayImage(props: { src: string; alt: string; onError(): void }) {
   const copy = getSharedUiCopy(useUiLocale()).markdown;
   const [loaded, setLoaded] = useState(false);
   const lightbox = useLightbox({ media: { src: props.src, alt: props.alt }, hasZoom: true });
-  const trigger = useRef<HTMLSpanElement>(null);
+  const trigger = useRef<HTMLButtonElement>(null);
   useEffect(() => {
     if (lightbox.isOpen) return () => trigger.current?.focus();
   }, [lightbox.isOpen]);
+  const content = <>
+    {!loaded && <span className="maka-markdown-image-loading" role="status" aria-label={copy.imageLoading}><Spinner size="sm" shade="subtle" aria-hidden="true" /> <span className="maka-markdown-image-loading-label">{copy.imageLoading}</span></span>}
+    <img src={props.src} alt={props.alt} loading="lazy" decoding="async" referrerPolicy="no-referrer"
+        className="maka-markdown-attachment-image" onLoad={() => setLoaded(true)} onError={props.onError} />
+  </>;
   return <>
-    <span ref={trigger} className="maka-markdown-image-preview maka-markdown-image-trigger"
-        role="button" tabIndex={loaded ? 0 : -1} aria-label={copy.imageExpand(props.alt)}
-        aria-haspopup="dialog" aria-disabled={!loaded}
-        onClick={event => { event.preventDefault(); event.stopPropagation(); if (loaded) lightbox.open(); }}
-        onKeyDown={event => {
-          if (loaded && (event.key === 'Enter' || event.key === ' ')) {
-            event.preventDefault(); event.stopPropagation(); lightbox.open();
-          }
-        }}>
-      {!loaded && <span className="maka-markdown-image-loading" role="status" aria-label={copy.imageLoading}><Spinner size="sm" shade="subtle" aria-hidden="true" /> <span className="maka-markdown-image-loading-label">{copy.imageLoading}</span></span>}
-      <img src={props.src} alt={props.alt} loading="lazy" decoding="async" referrerPolicy="no-referrer"
-          className="maka-markdown-attachment-image" onLoad={() => setLoaded(true)} onError={props.onError} />
-    </span>
+    <Button ref={trigger} variant="ghost" className="maka-markdown-image-preview maka-markdown-image-trigger"
+        label={copy.imageExpand(props.alt)} aria-haspopup="dialog" isDisabled={!loaded}
+        style={{ width: '100%', height: '100%', padding: 0, background: 'transparent' }}
+        onClick={event => { event.preventDefault(); event.stopPropagation(); if (loaded) lightbox.open(); }}>
+      {content}
+    </Button>
     {lightbox.isOpen && lightbox.element}
   </>;
 }
diff --git a/packages/ui/src/styles.css b/packages/ui/src/styles.css
index fb1e3960328..e7ff65f486c 100644
--- a/packages/ui/src/styles.css
+++ b/packages/ui/src/styles.css
@@ -667,9 +667,12 @@
 .maka-markdown-image-inline .maka-markdown-image-loading-label { display: none; }
 /* The image is the lightbox trigger, including keyboard and touch activation. */
 .maka-markdown-image-trigger { cursor: default; }
-.maka-markdown-image-trigger:focus-visible {
-  outline: var(--focus-ring-width) solid var(--focus-ring);
-  outline-offset: calc(-1 * var(--focus-ring-width));
+.maka-markdown-image-trigger > span > span {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  width: 100%;
+  height: 100%;
 }
 .maka-markdown-image-preview img { margin: 0; max-height: 100%; max-width: 100%; object-fit: contain; }
 .maka-markdown-image-loading {
diff --git a/packages/ui/stories/attachment.stories.tsx b/packages/ui/stories/attachment.stories.tsx
index 5b7d03149c3..e74aef2f2b3 100644
--- a/packages/ui/stories/attachment.stories.tsx
+++ b/packages/ui/stories/attachment.stories.tsx
@@ -165,7 +165,7 @@ function imageDeliveryStory(result: ImageDeliveryResult): Story {
         const image = canvasElement.querySelector('.maka-markdown-image-resource');
         if (!image) throw new Error('assistant image has not mounted');
         if (result.status === 'ready') expect(image.querySelector('img')?.getAttribute('src')).toMatch(/^data:/);
-        else if (result.status === 'requires_confirmation') expect(image.textContent).toContain('Load image');
+        else if (result.status === 'requires_confirmation') expect(image.textContent).toContain('Remote images cannot be loaded here');
         else if (result.status === 'failed') expect(image.textContent).toContain('download failed');
         else expect(image.textContent).toContain('Loading image');
       });
@@ -173,8 +173,8 @@ function imageDeliveryStory(result: ImageDeliveryResult): Story {
   };
 }
 
-// Real path: assistant chat bubble → remote image awaits the user's Load image action.
-export const AssistantImageConsent = imageDeliveryStory({ status: 'requires_confirmation' });
+// Real path: assistant chat bubble → an older Host cannot deliver the remote image.
+export const AssistantImageUnavailable = imageDeliveryStory({ status: 'requires_confirmation' });
 // Real path: assistant chat bubble → Host is saving bytes; the image remains a placeholder.
 export const AssistantImageSaving = imageDeliveryStory({ status: 'pending' });
 // Real path: assistant chat bubble → saved attachment is read through the production byte reader.

From a44934642515f5fe61c6f2343e3a03b846a26c40 Mon Sep 17 00:00:00 2001
From: Sun-GLiang <81428141+Sun-GLiang@users.noreply.github.com>
Date: Fri, 9 Oct 2026 19:58:22 +0800
Subject: [PATCH 25/37] fix(images): align protocol guard with rebased main

Require an epoch beyond main 212 and remove the obsolete epoch-210 compatibility declaration.
---
 .../image-delivery-request-validator.json                    | 5 -----
 packages/runtime-host/src/__tests__/protocol.test.ts         | 4 ++--
 2 files changed, 2 insertions(+), 7 deletions(-)
 delete mode 100644 packages/runtime-host/protocol-compatible-changes/image-delivery-request-validator.json

diff --git a/packages/runtime-host/protocol-compatible-changes/image-delivery-request-validator.json b/packages/runtime-host/protocol-compatible-changes/image-delivery-request-validator.json
deleted file mode 100644
index f684e875750..00000000000
--- a/packages/runtime-host/protocol-compatible-changes/image-delivery-request-validator.json
+++ /dev/null
@@ -1,5 +0,0 @@
-{
-  "epoch": 210,
-  "files": ["packages/runtime-host/src/protocol/image-delivery.ts"],
-  "reason": "At epoch 210, replace duplicate image request validation with the core validator and existing shaped-record codec. Required and optional fields, identity/source bounds, control-character rejection, error codes, normalized boolean flags and output codecs remain unchanged. Differential checks against the epoch-210 implementation preserve all 443 tested input outcomes; no field or operation is added or removed."
-}
diff --git a/packages/runtime-host/src/__tests__/protocol.test.ts b/packages/runtime-host/src/__tests__/protocol.test.ts
index 143d00400c6..dffe8256580 100644
--- a/packages/runtime-host/src/__tests__/protocol.test.ts
+++ b/packages/runtime-host/src/__tests__/protocol.test.ts
@@ -133,8 +133,8 @@ describe('Runtime Host bootstrap protocol', () => {
     // field, so mixed-version peers must fail during the handshake instead.
     assert.ok(RUNTIME_HOST_COMPATIBILITY_EPOCH > 22);
   });
-  test('rejects peers predating remote image consent and image resolution', () => {
-    assert.ok(RUNTIME_HOST_COMPATIBILITY_EPOCH > 209);
+  test('rejects epoch-212 peers predating image resolution', () => {
+    assert.ok(RUNTIME_HOST_COMPATIBILITY_EPOCH > 212);
   });
 
   test('publishes a new compatibility epoch for durable external turn origins', () => {

From c6b0ec353ff3501ec41ff418824651a226336f29 Mon Sep 17 00:00:00 2001
From: Sun-GLiang <81428141+Sun-GLiang@users.noreply.github.com>
Date: Fri, 9 Oct 2026 20:05:37 +0800
Subject: [PATCH 26/37] fix(ci): synchronize Windows image test inventory

Record the POSIX FIFO rejection test in the generated Windows skip inventory so the CI consistency gate agrees with the existing tests.

Generated-by: Codex (GPT-6)
---
 docs/windows-test-inventory.md | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/docs/windows-test-inventory.md b/docs/windows-test-inventory.md
index e3327820ce2..fd5fdad7171 100644
--- a/docs/windows-test-inventory.md
+++ b/docs/windows-test-inventory.md
@@ -17,9 +17,9 @@ Locations intentionally omit line numbers so unrelated edits do not invalidate t
 |---|---:|
 | windows-backend-gap | 27 |
 | portable-candidate | 53 |
-| platform-contract | 40 |
+| platform-contract | 41 |
 
-Total Windows-excluded declarations: **120**
+Total Windows-excluded declarations: **121**
 
 ## Inventory
 
@@ -86,6 +86,7 @@ Total Windows-excluded declarations: **120**
 | platform-contract | `packages/runtime/src/__tests__/filesystem-worker-process-runner.test.ts` filesystem worker rejects boundedly when a detached descendant retains stdout | `process.platform === 'win32' ? 'POSIX detached process-group semantics required' : false` |
 | platform-contract | `packages/runtime/src/__tests__/filesystem-worker-smoke.test.ts` macOS filesystem worker smoke | `process.platform !== 'darwin'` |
 | platform-contract | `packages/runtime/src/__tests__/glob-search.test.ts` both Glob paths report permission failures and recover after permissions are restored | `process.platform === 'win32' \|\| process.getuid?.() === 0` |
+| platform-contract | `packages/runtime/src/__tests__/image-file.test.ts` chat reads reject FIFOs without waiting for a writer | `process.platform === 'win32'` |
 | portable-candidate | `packages/runtime/src/__tests__/node-pty-write-lifecycle.test.ts` does not carry queued Unix PTY writes past native exit | `process.platform === 'win32' ? 'Unix PTY file-descriptor lifecycle only' : false` |
 | portable-candidate | `packages/runtime/src/__tests__/shell-exec.test.ts` writes a legacy WSL Bash command through stdin | `process.platform === 'win32' ? 'uses /bin/sh as a portable stdin probe' : false` |
 | platform-contract | `packages/runtime/src/__tests__/shell-exec.test.ts` bounds output drain after the root exits while a detached descendant retains stdout | `process.platform === 'win32' ? 'POSIX detached process-group semantics required' : false` |

From ef91354f537f47b722332805d9a877ec421c8d91 Mon Sep 17 00:00:00 2001
From: Sun-GLiang <81428141+Sun-GLiang@users.noreply.github.com>
Date: Sat, 10 Oct 2026 11:21:33 +0800
Subject: [PATCH 27/37] refactor(images): separate capture attempts and
 presentation state

Store pending and failed attempts independently from archived artifacts, migrate existing state, and publish saved results atomically. Centralize canonical image ranges and UI resource transitions while preserving archive identities, redaction, and source authority.

Generated-by: Codex (GPT-6)
---
 .../pr/chat-image-delivery/click-after.png    |  Bin 60327 -> 0 bytes
 .../pr/chat-image-delivery/click-before.png   |  Bin 61189 -> 0 bytes
 .../pr/chat-image-delivery/click-enlarged.png |  Bin 4496 -> 0 bytes
 .../pr/chat-image-delivery/remote-after.png   |  Bin 60327 -> 0 bytes
 .../pr/chat-image-delivery/remote-before.png  |  Bin 19007 -> 0 bytes
 package-lock.json                             |    4 +-
 packages/cli/THIRD_PARTY_NOTICES.txt          | 1058 ++++++++++++++++-
 packages/core/package.json                    |    3 +-
 packages/core/src/__tests__/artifacts.test.ts |   23 -
 .../core/src/__tests__/image-markdown.test.ts |   35 +-
 packages/core/src/artifacts.ts                |    6 +-
 packages/core/src/image-delivery.ts           |   12 +
 packages/core/src/image-markdown.ts           |   29 +
 .../src/__tests__/chat-image-delivery.test.ts |   50 +-
 .../src/server/chat-image-delivery.ts         |   93 +-
 .../src/server/execution-composition.ts       |   66 +-
 .../src/server/session-transcript-reader.ts   |   60 +
 .../__tests__/image-delivery-storage.test.ts  |  219 ++++
 .../__tests__/session-bundle-policy.test.ts   |   31 +
 .../storage/src/artifact-image-storage.ts     |   10 +-
 packages/storage/src/artifact-store.ts        |   40 +-
 packages/storage/src/artifact-stores.ts       |    6 +
 .../storage/src/sqlite-artifact-metadata.ts   |   90 +-
 .../storage/src/sqlite-artifact-schema.ts     |    5 +-
 packages/storage/src/sqlite-image-delivery.ts |  144 +++
 packages/ui/package.json                      |    1 -
 packages/ui/src/chat-image-resource.ts        |   71 ++
 packages/ui/src/markdown-image-redaction.ts   |   52 +-
 packages/ui/src/markdown-image.tsx            |   71 +-
 29 files changed, 1900 insertions(+), 279 deletions(-)
 delete mode 100644 docs/images/pr/chat-image-delivery/click-after.png
 delete mode 100644 docs/images/pr/chat-image-delivery/click-before.png
 delete mode 100644 docs/images/pr/chat-image-delivery/click-enlarged.png
 delete mode 100644 docs/images/pr/chat-image-delivery/remote-after.png
 delete mode 100644 docs/images/pr/chat-image-delivery/remote-before.png
 create mode 100644 packages/storage/src/__tests__/image-delivery-storage.test.ts
 create mode 100644 packages/storage/src/sqlite-image-delivery.ts
 create mode 100644 packages/ui/src/chat-image-resource.ts

diff --git a/docs/images/pr/chat-image-delivery/click-after.png b/docs/images/pr/chat-image-delivery/click-after.png
deleted file mode 100644
index b9d4268f04917a8f5007f42b3b00d5a744a77825..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 60327
zcmY&fWmMGL+a0>Qhwkp~p}V`gL%Jk}?x8!R8>A(b?(P!l21x}(eU*Fff35e!e3@^*
zb<TcvJp06|tIDAv1Cap$0Gfilv?c%mJ@@CQj|lzepP?1mU;qFUpdc-w?U#S?(`9A9
z3!Ntl`ob6SyKTKS+4xo}6iuls6^4cm1?}eNw})y==x#GtqnWh9u}oC}%olPj3s$v^
z-}@oIzubKj_~lOe`w8<Y<acM#uRAq?;9pPAPD5V>qw1}q(pGLBR%^kHEd0$B-&t&f
zG)-t9LyzkWgBwT&k7w=Do6rSkBn%8{&QnjjjPZ!sq;)KcpLL%G<*XGNwB}TK9r5^l
zairw7mNm39ho9RB41V=JytStKeLNB_t~dQiB$`Ad;__33103#hO#1l574pkFbI(dg
zg!Ag`8<2-Tfh6zVGtdwJgdv&Uw)^YgyW<~YOwi>chho4Q(7SLc%@1pwG#x~O_nF5t
z>vt0Yra}8X&*Hz||DH4~WEwOiV>#ai`c>SyE93Sr<|P%NXat7hH{_h3<eR=v?c@2h
z<!I)1_(c9uct+J&j4fdZdnq4}E%{jjj{;RO#`|*iJtsD04d^89-5`8Nv8w!mdy#of
zhPNo*BnAUJczUl2XA7EP0%u?bKQj)=P72|z<eXZJ5y)A5>`0JrfvO?Yt<9G7ovmXB
z(&r;(KiH$)?+%Y|XgnY<LCE{HXVMl`N=&oKze>V}3hM6GR6hTD*F+6^Z$U(;p8yQj
z^UtOVb%$t{J{~l5HDh?r6zYk-|LARMFd1HMCP2n|ev_Mr*g$P1u^P~TZ&?2Y9<iTh
zZ}0OLoNF)~b*Kd=2Q@3;;D-Db+5AN)#~bPp2ZU?|NQz|yTLJRvMUu;D<#?M})B+Cr
z#9(YDCPUodg{XAEU(W{U84E$!YbYjM@ESZJ-a1|P3iA`r+4KXy<u!LZ8|_nVid$5r
z?}71i$zQJsP}JHOGJCX1--c54YeLP5|9*LXV#U^!n2kqA4?9xZMEp4X&W;gVBo*oQ
z{0>A6qsV=(Z$?7BU#dMbCUHDX7vcr&=6HW0Q+Ocy{?FN+_cUiBD1CAhF}$9*YA!uO
z8IzyOemN66m-ykYs{oHvL6Ag*l$&Qa<+fLnFgbK9T~1-3_>#@h1g|nUIFyC24_Fy=
z0G8A0%w=zB(H&7JwKTt|f=w3&cWKluYmwGe9}z;40khfMd6}cwRv{FGicXEfp;QE2
z*g2s|7aXW#f&rd23-U};kg68+1>zrKMXqX7^z;w`Hx4Ks1m`EXk}=W@l!v~vpTKoY
zv}jgxUie)zZ9@92-VKBulJD_T5O0h8#WIsj2YdUzE`qniH?N20^}j<KrH&X4G9U|z
zS*ML6yo@<Nr_rw`4=z0HB%O4P7~8q~v<~eC1yFvDiuT9;Vs3Bn&9sR630q`Cwgl+{
zC9G`XSCfBORDWPWl<S&DxU6%Z&o^%xp9z6Wg!z{zal-X5MUNftd;SwzFvQR*D6$0F
zA9<k{^JCZKiitFY8rRyJjP9!dlkb8Ix;tMIf6P8DcA^i>o#LLts$ZYPjsl(u3|$yK
zFkdPUAard__gm(>CRW0|Shn$F2VPf5?X>tXM(XmxNYQWIw1FbBx26w0&ny1Rx7Mcw
z5IK~-B~*BWQYi!dRNaLDF^LD*<tG-QYKo~6kUIBshUh!D&h+75_|J1FPC6WZ>3FWh
zp(%~>Kp|ZQayBZW)EgiV9qUG^q2o|xkhvsI@@mwgF!R6%Ak=CDLBdtTS2r<qq9<mR
zh7*SqSUhOa<{Q$u31wRc#QJ$v);%0u7dbmek^>QT<U}@0zXdzea;$UUXYt!-iqDmc
z8)fwgSxU6J7#u2Y-%(|Q6MKcF&}?`(5`AZx&;1{U?`jUK7uZRX@UxhC9>ds+4k&-I
zmvEq}s!>v?RB=3qrSH%X<?o`4+e4|$kCPzuLs33fMa4At^s*%QS;T!J7y<}~>08R^
zwCL>bm=&3M=HfzX%Y{9ZW4I>Ul=!s9j>>}U$1tyuVWDD&xZ8jaP87Pa%wTkHgy|PT
zOL`4BNt`1VwtW)wF!yZ;i6#Uh<V1XWju>!NmuR9QFl+XW^jPE?2n#VV&xqUz_mjdD
zzgDUeZEHE!nXP?OpvQ`l8NBP)VP6l-!4laP01z_rfs$eHyJA&wpRh0}sh0M5_Prmu
zpLz&xIO`7LlRpz0)2MQ#aBu=-UXYk95;Ux_UG;;r_ZZe2)?j_t`WKOJOh7_qlw&>S
z_@>i^a-qvi)sRrF0zcaqE&VJNQ~C;3qBJR{Zmv>1K_7ePskK(c<s*%1k<$$Dba(oe
zIk#;-fAr9tjW&WmstR=e&0>U^6p4Qv7L~eNBLR!;0P9y-Z>_{3m9PHGcW1)KI+JOC
zrdc8Dy>^-?&2CKKHFQ2p>Dmd{<QPZI9jov%a67ugpy3Q5h+(l><b5r$ffts1C`UY5
zT%Q6AP&F34qr&%hNsiTKL^@;;&wv+mXDm!1ODU%TOLuPaTRQoF%3&xzgD~0y?YTno
zz&!BtoVs6<Is_ABN`8Y5z}&?WQD;9)VXDw?zTOT|3#C|-C^nAeOT81=J2-iX#sWIR
z`MOaaR(TVd2JG5dyV0){b%P9^EgBjp-kk@p^HIHbgU8Z8qh^vg%fKt=A2|7O{Q2sC
zA9fg`KN(JYa)kREXE|G#CgD-Z88CH_Mqc!ms8ucgPBP}<#I8piW=K6*%`ZhI)JZ~^
zZ&!8;+SYgvSC2Y((v5{ox{9X^7mVev%}4#EKPak9R^oYNd%i&h;W|AxCgR&#B^nLe
z1as!$*5V8COrUIVk@pDHPT%zz9yVqK%a(dLg%T>E$Z}%X^N=(aG(z*mowkzf(T5E6
z=dIAmqkGsL^nTlSXk@2El}$kWx9Q>bV4^wkMJ8MIVX1=$pM1~LSO<8U4*`F1zWoR1
z#ttZ>rL>{eIke-&1NR`9k?Y3JwM|U#lpjPRTOzW0SJuH{4_`4SV<m7LFr@-tfM6E8
zr7kbnmGwmi*Kt0&%Nbo=<0|AF`}tg?ySltJ>M`<LD(g%-;_RdtHct}y31Zk;=RN>H
zSPxTn%q(B_u+AdP%Enndv8S&|W|N74DibG;Y2w6~`UEe21j6o!NN8%kbc)=!qx|W!
zz`YcFP*@2jc7b9M{ZBeCnCI}6-%Dml(`hNF45_)PpNN`-mlgPC<=S$QqryjVQU5>R
z7)^+>w)go4h@8xrbCnq6S_g%b3813v!Kkn`#-!)(jp%$wazzLK7ERe!r*p`Og!4IH
zGNW-f?#iT+VgRJrnlvW6N$>*4xXs(Y!ETO~zeIdMl5#DC(pNSPFU|ez+bBnx&7qAD
zkk?xXWta=O91kvAm@^-9Mt$@W8W==cwe}1@*3|Pr6!>OCPw=>Tv}Zd^p6Dms>_gOB
z@WEeoXzLII5uK1GOT-`?mA7XEtqWN(Hwe^nq`xHY7~$IyqD}ldjR*dn#vzh%^7hpf
z{m!EHG;})#Vsr{<1i$CQNn(Vl4|6$i2Mt}g<Wi~aX@j@&k1};w_FJe?2DSqwIneNJ
z0DA{Kk>riX$Q(Ec%W3*NPKb`5k$YFXwUB^~e3~>```EzvWWhXjMe``lSVc09L)1|l
zMAIqUq+)oOfiso_9_X7jvm<s6Q<o94oLd$HgX3zTBoM%w@$_3=`P3^3D8^$;g>1Hr
z9LBxgR(Ve9K&mow_MB}B?Ms?Q-q-tgs<FTOcdE5ZTfB?iLK8b;bkmuv?dCehypx_;
zm?oL>m%oMu_URiUG8|#?q333;<4Fi3^A;1sLi))S<O<Hw=S0@D_^}0ck}jOcxrOH8
zig#o?zr&3uw_=PhLRsy3h7UGlttq0o!J?bvs!|2bk1XjdHYMt1mNkCr%6I0Kt2Z|;
z4akp{RJi|EEDtvdb)>G9!T8O*)NWxh7sb<PydKwhDLHxsC%^Y)W0<Q=&~Uc4P|r;0
zecfUIA1ax}=U?asbK-(Tz$6^5LROzv)JlDH0H)GStl1z0P8RY>2_ais-MP%3xrA)B
zGHKM+ajUHyNkjEiMp#hLt#g(hQ32xc*HE<*L>Q-d1`-95X*0dXULgdI#GvsxOIQ|0
z*pH(~juKmKhF0>Mg5CfN&MaO(-i5=|?={T!wO=;V!W83P1X*^63kssXltfJk8d%9)
zD%Mq?_o1<6CSrSf&P)BsT~P+O35u^cv}(u4Ji9rPS=%%52eo4ehduP1`9EabP5e>M
zKL>97pe6}FJ$XY7O!c)i#Y&B#=T*!pjJh@mC&XCNY(968y|m%aAhsFveFcNz9Q7s0
z2fSED2`;A$)4$EGD+^U}8<nsJW^)~~F%WB2XG9UAFfy8xufg6U32wDef<L#SsbOw2
z+C#^c94LB<U>zqJ24bf_1Ofcy*nUt`G$ZVR2R`lx&EkIJD<`fw*2IgmhFOuKZ~EOM
z*Xo<*(n2*#CGol70R@MfMiwKzYvu?U)Xs*f+c;ubGKr`GimEDCtGL2z)@|gZL)*Bk
zIbP<UVRrIwyl-BUi(ktkB&uu7K?A5cB=;W5c>vrR<b_He+}lVX($Q1Q2J&?v4mnH#
zN*Kibur_TBn<H<l0`QVen<`8Lo|I=37yTK+O`0Fn{kxeAXa&QR{^)x3cUzM<K~=>s
z4zOxO-DVoXx{|)b63hx}Dkv1Z9azXc+;fUAAS#`n*(vD>lffy(erMKFg5qzIoNjc)
z{BzzjJo0*^d+RCIY(_yB2pWTL@>s~qh;SlSz&j_)YzC^*$2;nJ8I&8ZV4wL<dQFZM
z1+YU)C%6fj7ktyBMqDg)?hIBrzn7eGIL0V~r(DwiQaPD9ZZ2f2DSKP4bF@c>fBzzz
z(}rYJ>puu9)UZmE%GO@sGNWaeqV8KJE&p;fz)!zYh3Uo<*#)E1h$)T`TZ@Z5&{=!P
zbD>K65|L@njNanJphT0<Uj4n9yZ`VvVVMrg)~q;8%BS?Ju}6P9fntqVTXHlg$bn;>
zAGE$;gv6ns<NL-9xl+TiLvZ8GvAXJ_JjlitM)~vL^TO8MR&_?|j8!=mo`P%7_CKdo
zn|Z9*txd*?)9-!{pB9yk6o$h_5{3fJ{DsPQW#r}|-*PZAu%nHE{Q$m#V0kh*uhE|6
zGwM|QH#32ZAa*U>k<@obL_CLvf*vkuxiXzc_b>($%JbBzy0WPm@#1&%OB?dHq?QZT
z+1*(M_yX@2s%wWPnwx^PU7Zzx@dY(g?Na$BUUXWDN$yK@84}E*cn52>%!??=*FE9r
zWneG6I$3x9pLN0tMR<b|i~s_x?oPur)oW}2o)L>M`n1{ZY1uNfz;Az%)b>YU{+$X*
z_#bM^dFsL{Br~;0s_Cc4qf21<oC-Czl$oKh@F7yec~kNf)}wT4l4(&-Wykr_c=OhH
zrdjs9u(%*rDz*<fEb=^{RE{}&3Jim;`WepyDbSk~uD&qYc|nK&vVh9Dk0t;Y8!0yP
zW~*dLRvr#H3Ojp55++o;ii&s*%<;A0^?(feTxmVZghvQPVD^4^Q66k!yIG<s#e{fV
zRq_4Q_B8RSV{ln11?!pA_oayWa`-z})TR2P1GO}(^}k2sJ5!rU|LW2D1|_c}<Wkb9
z!jyi2>#zpe-Aqm%M~4{v?60{Kv$nXIrTQZ3h`gfWnt}A)N;K+h2a<A0`@3@W%yM&X
zM1C3@q13PpIFTMW7_{trSH=ij<Iwq{goHTmAFDD6L&xkPvhlHbu<Rbn7X}i21h>Mx
zMfcz)h(Rp69x=Rsn|7WRYKdcV;<|j}<-oaPH`}+YvT4|k9*g*9Ph;;pjxb{or8sOY
z*DqJ)O%s^3PjW8aHIa$0w7=Wq=-+(*N6Z`&^kJ$;I>)kwMIAe>wO4G6`(|oqKMPUD
zF9c^qaV20zfdVdKlV#|<Lbr;T%Cv`UHXSD`x2(@~Lt`U2V}nIZCQ8NLPo_{{%5x*S
zoQG^_glX8pOT)(507T;vmSMCBcI$r$Qo7f#-}O@4M-bkEHisq9yko+;UygO3(MZFC
z-ZnZO6DBD?*mqtePmlbx%%g%m8J2G8)wk*EKAyrPrA$EU#A~)F6?q;y*h?KerV-jt
z<=W87vo$WIzq$M?HJ$!w=zkJ{oLPc5cg6=t!x-1ipWJSJcY!1&YfRYcaLCd_uoo(8
z9@F>t=vOi+zn1VmU<4`=8pg!8L0bzy`CE3!Ca~ZLOuWC+Mgu|1uDq{+NGy034S2QT
zA=-qUXTX^2kp9@g%?g(YMtw{#?ipxRqca4^+5#?UwD4GCCb{(8v9mluSU)RdLOQ2m
zu`=kTT_dpQkon_JLgS8p<<u5$NiQiBIxL!z8g8clrrNQb+j${VPD<aOWttDH`&oyY
zr#R)(5mc?sRT;*mEWfA^sx@zHk_34DgP`75F6vc0oZs{EQ7f63To@N6xMv|&7{<*h
zd0NEzWU}q5=mFzFCl}G923HHE1M-lp{l=PrRI*saimWim)GB?O@4v<quJG30msk3X
z{O82af+$V_QdkV)6k+{~EiV)|{0ej{JgTir{i{Ajdf#RWC8hLQZJDR~{N2$oVc}nn
z$y|LLO(+_0)JUsS%vk603v@50a`e%|!^3O8_ZA$2AYX_`koIqz$B!)|)Ca<~Lj|Er
zhTOSCR^wC=HfAX%jXreg;tBAyd-9oMCy@5e{e{x%A1M8aJ21oy%}dcrfDG_CMBu1~
zOEfK1rAoOqQiqtwkhSPE?wqZ@l&4?U!ip6^Le^`;j#BEJTxH&vv1wd1)A_Kjgww-A
zN^A%0se@mKmLspyc1oI4vFXy)gnB=q;g1(Tp^?i=)8DerVSXYVkJZgl8SANdE+Qg@
z3)ewLRnT#d@wuQfAtBi7SwR~LZNk&U;COE=pKxJj5>96Pi8-(JJa>5{rIat6I3FD{
zy>~d3I#i{IIb${h7v9mkK&9~`wDd=Vx!6qJYtrFk+9sm^9Jzn0d1Y$ZjHkwdBQVhA
zB%=Y)w?sD&pb3PJ*(RXAFiT=f!8%&l5lcgk)eF~0>|g+Qct|4j_7uCkUvzhsg)M{8
zov}`(r3=F4m6nrhnwvH(V|rwDxvd5qMe(%GBT43{0@{5mLvwTcj5Pv><Mn;XvU<f&
zn||7^jFXgAWu(&yDV6q6%=+40XBaPzJwW<kP@ylE9d>NRWE@AOH<lP92V}5|8KV^u
zt5tLgXhH4~@d_(nUO&O@->{~THDC!fSa*?HnIb;?EmE{4H{~rACgcS=m@b}++<vjV
z5TdWeXgVIEs#KnroiL})W+)+rJBuj$jVKf|Mj)d@V_<5;bPXC@4_qVHKIe3F8-w7T
zKynFw95fu7s_1r?wxUT0*LhIkwJohV1p4Ihz_+PWS|Lr0CH{b&ae<!FB+?{vet%`j
z8@=pqy|X;xz1!t~kfdvFl!Lrf*%bo!&~bP6PA}tiqJ8;aaCYG06J`w-SCOq&xaNra
z4$z5|c$z~u<a9wD@P+mDR@{NXRL%)i!EBkVR(DrQql+VKCWNU*my8}6y=FE~$sNlu
zZH)nEoI#u1;W);dm*bF3F(A4U(k>{qKOg6xLO=1kI*w9gWxNykJ@v&s!H>nW*$~+7
zoq;ZaqW(myH7h*WFRnahTiM>K>F?0D{T*>P$zS*C^fb(aW*a>te56da(?d=!*wul;
z+ez>8V25y$F=O*D7_$C=p;GZr_GdIU$hCp8llLwZTI%Z)SVm~5Q}6yr%8#euTB{n$
zSi|1x5}YAkG@)=}<eg~A9ZB#swBK21?(@+>yI7u0o4ctKW@O&^8*@r}Ib4oq%y-1X
zd|{#SXUFUB6?X5~9I%<ML1>C-MUh(@I}(jEvy%FqRiwKi`f>D8$R>x8&e~Cs7TXjN
z^o<Q^WVcR3E(gdA#G<m+Vd~r@oNMJXu`|lnUh{%l8<Z0=2ty$sCNEL&D=0>@<bf(4
zeW+ptjWO}{8u|V~f^I;@M2ifajA-IjK$&g1#LDK+fL|WW(*X@l$><%n7MsYVQKDF>
z^mV@lxB5r?ench{1wzn(1vdsx61&pBEYp=hWEL62j4@Jg)sV>m9oJGTuq<A?wFbpm
zo+c87-xrZC_%#}%!gtgbA*MO1s5fF+1(}FB`AB|8TTr!rm7xo<P8Lm;$x_f*o*5D~
zO_rYRrAP{<^UAYD0~)yZ2xzNOIhib5<51<vekmznVV}}QpxyB=tabf4sS7`{1V_X|
zqjLcgkww5dB?zOg`r<F&82!sPg{)vQOLei@&KXopZ9av$PSlo(pSccv4TMb2JQ7ty
zN(mNNpgl5m3)^4)J3=kibaC&MOq+s#2->Yd-9XzMTLOA0cfTa_=E{u_;-K6R7(@C-
zG~43oKaZL2Wbr1W?9ubt+E5|Czx*^c<^qH7%`7|I)ojYv<0XYpealWA8@{n7>|pV*
z(_BQHP3yp{Gn-Ii7VBf2pik*UXntV@_vMr2g;H^5l$7_N^D(Rb8T0qcJVR#(FU`{X
zty5wrL>Oj#kF0O%Sz1}#x$MNEPB%L%X^wV(ecTt`_kXO<rKW!?;798%Ix0i&7)*>v
zOs4V)$vEy!D!b|-g}4_~HzptXQ!~Asy`B73OW(v871}1VHAwgl!Na7Wc5Yd-f&#uf
ze4FEGSFeV)As80ORiBJkN9ZXYuwG0p>E}qL1LDUc0m#0Le7r`@6y_33iNDz)<R2_N
zJgH;CQqrvp`G%hGj9`$$-mmpmxlWeHzLx=xu@Uag{<ZlM&S|F@lviHN`w{Mjq7&{r
z4kE%IJBhNWR<f*;Nc2sxQofP0_)AvBbeM+OYL&jPAN8L(RU<g=3KCguG+x0+9pa(?
zeoNY|)|`>!o1kk+@ZD`7K5W}c3xx`4a9$&sd;6UuC36i7h&ow`FunjYqNEW@(B=5l
zjg*t{y{R@wD-%YM#GVWt^K4IwAw10a8aDN#CNrR5a5;#H{I|?1Z!5YZGL5->Ih<T0
z^qG9LI|7R*T7TuVZhzk=j=Yb*HV|NkO!|{4S$Wf%k<g#GB^E$)mLGCCV|p@re&}vx
z_zDy6Sqv|^CoG1RCd=(*lWa1+^5*yHR}Y6Wx=71MLi93tUWH<PKnwZFOTOw-Sf>nr
zjA}_WIa{akp_!hDi@H1(Wt6{x$86}72oQfV7fkqWg%xYHhPze8k}z?2V(tMf7y%At
zDnF7$mTL>N&e^sDP72QoB2{vV*Hetyk7I0c;Lrn#6)I9q)f|YKH>OCXgXo(YMo^t;
z%b8M#I#UHRZK2>0AWk&VtyC!F$^}8~hRQ2mco|zeYu6CZee~|n`vR_fSLiunldlLO
z{$J`DdU89MDKE6whhV@SK9_LphNuZH_M*%>&DM*VFCWuPET|1LKVX<r2CE#k#=gU{
z9dic&Y`&^mTa-o~fxlI?6A7+jp49FQ*jnlsf)BmEC5D84W?%nK@e~fX5*N*QJ=<Xq
zYUGuj7ctDkkwVHdqHe(NOv6h>Qq@kP<m}(Mg|eSYD15u1Sg+0y{>z=)`Ab~asv`9?
z>(CbZwEkuhf_JSfQ<Xm_UdLMBq!y&%{;!`Y_%9i7R%j%0VyAg7jNcyXzx2BovD6}#
zD7&t%GV23$vyl!fD1&nWqXp^6L0Iq~zHw!@SYASbC>-2M5ZqCmab7SVv!WKO8F*??
zJ`AEbuLnv`(#PN(8xu4X;Fg)LV8jWaQsJs&6)6KdgLBI3>>1P^Ni5%95W0!N`?4Z@
zAk$`o(!U=N#ARbrn)3y|Ta|xYag->WnY0q}X$IAD>KjNI>}Ls!jc@a~@KENypRTUT
zREV&;_<@`l+d%mO2$JJcfcRgrHyjqcGU)y*gTB}FZ>Jf{#TKGI3ncx%!Ad3nm86^Y
zpe45|b7g4=y-ZFyVk$5$X0n;aX`B}!^O81rPk?MwFzl@ZyupN8y%Z06$B1Z&q<%`J
z<vJKd7Xql-;gaMXQy=in?OrD({^b1Y8&!AA0r|a@)ZKwD`Wi7zjrGwUXz)3(E1Xo=
zVrU*>Ifi(Rv#YY{TmzOEIc|og&voymu4Z)w0j73ylO%YvS==N$Iqal?quj?*=(cWs
z;a>dw)YGjHP>|cxT#VEw!gR$<fl@!3#5>tT+%D~JZ_@{s%g^69ue}D-#K#%`D75vx
zK)*!3O=~L!4)d`B+33pVJDNcbmN$7|Qi__%+|D#8yA;=Ev}3CRr3bI5!0I}_5@hbh
zRVajZ;qNu*>FJ5EGAOQ-xS$hrT=5WJgUWILRiaP6`JZr1#yssy;R?bfOW1BXiZRCv
z7x|c%8;j1ee7a$;h``%us-D_lFO1gR1<Q}4{YrwcNIWXz2w(`wrC?-oZ3R(;s;xFv
z9P>`1Z}vVeNg9RdR9tq97T;Sv=02NKh3K%UZk-0#x{Bm*0P?{9R#5tXS5WaRP3~)=
z7IScqp$*{16i3>h139g3N28(izL+7ISUh9h5s?RfJVPR<E8WM@EqLbXcbm3^0RA;E
z0wy@Ux_;QpalJZB^gzBed~4RUULL;A06SG^J6D?k+H072BuLH*MMU+{M8Qy7=s5-J
zwyF(>O*7xm=qAM_8r9Jy^}JT141#r@x<jfB<tp6H7;X;>@+edzFQM+Z2JitCH-BlF
zA0x`bj*A`t>A`Zg2~Z2aZ_d@@W4FDJ%TA$_DC*JoSLNXSM>*&TMeWb0zWITA2iXe=
zFqU%>&4JFdOXuHEFutAol9|M|3Wq4Z56$nFn|P&1VQI-IPr+E&OtM!BI8FR73+U%J
zM^>N1_Ub>PN~b=lqPwhXa;aa3xHz?)Q3$=cg=rZdmiZ}=*YsSjD*4vb&gPK<4MCY^
z8yP3wQ^LW9+`|k*Z<<5@y)dU!M_O`5UT($1b#Fa9*gq`94gz<xI#+PGR@bC8Lv<;J
zH~eOLIif7SdQZMxL-d0--s1#ekRw71+RZDp?*6me<rk%mZ^Ax;9$RVa_fS4A9zF>t
z&eMfupwG3!;4msf+;uGuyouFfs@+frwd0q64N0W$+60xar_Y<V+0gF*%t!%spIiH{
z`3T1c^PAjG?yS?kxe2VJrU`T}!m#xoe56bplb*uhOAIumuCVVRIffbnA}utdcw(R@
zw?N(XxQR>S3D(GF_I{n`aMjp_n|e!P{Jqk?jrE#!FPqMuC*gb6cZ+lV!!)1o;U8Q2
zfn9DyCG&pl?*m`cUH*U5-6Z_swB0811K7y7#ch!#Av`&<vb&tgq}qrm$9$&L#Q=b%
zGn-soa%C8#qrKPTF&VCZd1OlPf=%^|%ip%@c_2L}!4a4Hr{EjaYB;DrYPh?)Z7i$^
zIle107p_c!2idBEb|byTUy(ZzhLQ)_*2wrlm9Z=|Ow-%VGn#50#*rQmdq!HOY(RQJ
zo838b`Ra>iY11g_#7N!qdy5z@_N;(X7)n|9l>x_M?u_Oumz!aa&{8T_cz6i#^*Ap7
z^9sh&bojsE*X0aKB{=a5(Ylg8BfbCVj<^c&<7>C}69y#5MlDjIP1=a{d+rk;BOVDL
zJHqFJnmo`tpc`jw{IvM~gz|JaBq=SC8z)pw?u5P6ccg=yt~nG;*-$xPX-C2{GS15)
zV@<f$ftGlgfPTmFsDpF*7I^z+&e|rNL23SvoK+mr^RcUK_!3<RY;FWUEPrscj`R6i
zGH`TiC%JajbNO1G&rG!|SWo}%#D(Za#{qtsE)VR^T2#g2mXo}qf8jL+Et(IJ9D>0{
zRrq0^L93L#W*;}p(iq60(m$kw@`b5X_2PId#-}p~%BKhj*kwTQ$w_pvb%atU9_eX8
zBy`xFF4RcZ76tLkTXYzr!y+iHTSKkd>YKMglv9ROK1f=V%o{51Z-^|A0kk6I?UTDR
zijB^syW+D5b84Hu!wB`WS8T+gDi;nnnTWi#RGN%I%hrH$-#c@PDbj0%2Z$$iP2e8Q
z8Wm)zGhWG-Aps`|S_9KJAP3%()Q_Bx3eZYs-~SS8@9QQS9}=x}@(?1fz@hz1{%Rjg
zKi^ah?PJR^Nm_smzIj9;MWTW}jc6aH%YqUHXkaNLS;H7fJ+asMA}APFqSnFbAENTi
z7bs*mtx$YWzfKU@BuqXLj%&<~Eg%#&FbuuNV1V}(3WJVyJn?Ig0lN!Y*t2`OHK_(;
zbWNcl=;j?K!}0f?Ul|619X;9Am#{SzDbeW*<6cmapW_{~>`0*<A?a1zn-e0+h$oXV
zy)0Jh$L>9uj>_Ldo+*kxG`e~s=iez?c2zU+*)K#SVTTy8Hl6%u8?4IT%zmQa;*JZ)
ziamY<YotPI@>|sn5kwdx5lmQ;$hI>z_FE%T^*KO=?!cRb*eCvX|67$ZC<)3O<3svx
zE>L#g>|PfiMxWJ4vIyn`Ljw%rEH@5mDECM>h;64QO%ML^XoT=BmR-|)4Q?cK*Glk-
z{w2t8gvrGX>^P)??k}vs<cR5M)n^f87;WboMns_9zHdlJk~~Z*fJP=9zG7=4Mxw0U
zBPt+07fP*{#&vPc=QKn2_TdY9ZSd;|;QMz3U=Zx#TMYb^Ht?uaF^=d~ec_;}5E=EZ
zcAL9g6IZH4{u)cuID0ipSe~*Y-4<~g6E}_79gDsikis}`LpWLjKoNe%=d6Vj8EyaB
zd2LFPHnDq=Yc{dZZm|`-XmX*u9(Ir#T^js;uKSyLRt6Dcn^!W!l(>dp9ClQ!R?8=)
z_)JwxnY_tjRuP5=bxs(CtI_HbV-{Y^w@i{1Z;Sn7zlOX*qs!mspLRey00Z5;umv?;
zX!t(grcCrYbj<f9hFjrLK3Sf=ruo2Ott&PIQ?CpPzk>GRI*gNE(2L-_j<w?D1U6Jp
z=_p(T+5BvI5UoOrm5vSC0fVb6<jZ}E2{9sPDeW4cI9}Hcl{z&-0^6eK^ds^@QayL-
z=88F5#Ih%D>kGRgQbf%@0)65=Fyw>E&KzU2aH(Qb91}<G%PIzP_)w#Cq6?o72YYHK
zE}A4J{M*PMuOT!4?7tzi5kM<J*)w!;O*`Qc<rk0bN%=dqtDTY_Xw>0)g#4oz`mBrv
zXe=v<8k#jX9lKbHmX8N&;lz9bt0;hSK4wXpJPLvpy9^4g6ZA@YXhx&3Q^_TcmjO8(
zE;)CQJ0FXBUGgLOF=vtE<q{}3ONmTAHR0%O*4N;uuy2wZ2L$N=s@?d?l-X0C1Ekvb
zFpBh5)_qJ$?8`CFVx~eAwM0Fe{W#D_&7QTlBn2tXg_|D2Z#cEwxV3oGwU6?0V}A&e
zZ0+{^U1@&(Q`AVxFfG5eN2>LbbkF8!^TzETJJFm@q?Cf%mN<f<@m^e+d+VfnT&fxs
zdfy+~*b~^iE6it=T3m2X=r>>|0+k1_yHb|qz^23|4W4`Xp6_oB{E$cGyWa&<=5Eba
zb}B__DF`1=0mO}>LcMchitXIrjF5f~!s~aFBJqBYDDD;Lcj!h4)kpnl+rk5GMOuvB
zgIch?1nayR(UAd_VN_jSMFu)~HeJ2{QuIvq@Cb9g^2NgOGgNf$voqHRT0@;oXdLy*
zioCtCwc9B=gW!g_S6u&%pS4~KX|8=S<7@Xt`<oJ-)^qp9bXh#f_=_S_*<T;(xIxaM
zQ!p2(=|kfvTZA0wLtOqcFwC%U#!wwxJ4h4o@M9~TeSUcgEg4%lIB(sF8V;}0qgY!L
zJ{!2?%}|K;%OTdoo<#9Pc|yaEe`#O$buX&Ahv*~p?aedmy-CuYfi=c(z*@et{}>v8
zZ6Fnk<Ci6`T%eJ>q`ioa64dU5?QauOSuriKSQH*A9Lsm!7Q|v*MXmvV(EOwOVx7cc
z3%o&>@LRL=bzKwrX9|xmuw}?8Ndn|^W(|nhhAN2rw4pNxD~PtfRedvU9`9=#qZedN
zmnxE0Jt;DgaB4;2vT$VGY=p}^^H*mkv>-XAM(CrVqlw0PDh<Orqwh&lR%k`-?4vQ~
z@HNKF4;|;s;B{lEubt8!-=n{{1W{0#&xI?4$p&h-g7Yi9*G{y=De)Gt*0P*uCT&A{
zIklN3H;d>HFJ@#85};39sL*c=A(;|Z#e3uZNLbTQ?4b0>{4VyI@4S@BxqXvuMfh^3
zT^Cmyhp!zW_CHro?Qch@>!iAnLlXX?2?Sppak^aS?l{OdxvN%$5KfSg!ly%>n#<DL
znqI;ZrnSLm0bg#hnlldWL^;ruS)f~x!tuL;;EI<lr?)b(r|OV4B2hq711&=_!F8UU
zzp0w>GnUr)2WY2Rhf@M*k6O{@z|L}o&cY;fBztQ-m~g5&z0*wn1Iabayr9DPs07$W
z?K=IVQQ?@n>AnCaaJ{^5Dm}I?&dMS**b1hetJ<KBq;Jm7Y^2~)u=n>~-m7dm{G%cp
z{w{5XRa#3>r+NGue$y>dT;AD5`KW}p-+7tZdyF?k%pn)jQ!I9n93(?~6-!kEJScAa
zYxK9^#-n_H6d+qLBY_f%&?1~KV^Z3+;vHEP7iBzx5cqqymSVw9%4PcdySl>aJ5v-}
zE!D%i<x>J-NLxPT1#Ow3Xy}Zh6kLAfTibJj&f>ngW7Col(b{Y3R{0pqu;ozdE*|5u
z72-b&9x(MW+#*xa`)2OEtjst~EAM#dw|*KhuUD)5&(&)B+YiW0)c<k1ua()f=ZzXM
z3EfR`+Dwsmqc{;=f-1J8;j}VFWSz}h&W&pz)QIi3kKlYfq6!MIF<vp%ZoM>gQ6bXg
zv^TyTuqn>`?kmM*P+hY(484tgq3BIm+m_A248Q3emh~oB+UPCxd!}U>1I3HGoRXRm
zF>4$)e!g`=z9Toox9*hlZ%vEl`T-^tH(QlU*%VCeu13G}`T;T=GR|u4&QtqboE7l(
zw(@)+{(^8m&+ydOx%~Z4NPDb^kSJz^$$1E%r8Yd8{D{H|dPuP2C=nyH!EZny7si8)
z!Fn88!{8bCpzQuaRL6U66)Ja&T52M&XRb5Ip96(d+TZR*AHI)=n3X8=OJ)eVq_XkO
za0m`Lbmj&5eaKmQvAg<!G<KiyXL=tJ8&6W>_T)C|#c~TAH6J@i>m_cYgS!NS(t=4U
zP<zFrGvtM^Twxu*b=3~!Tb*M-ZAG?NQl~G9t(=BEyn(tlB(YQOP3JtN=|PBZ_)!9Z
z`a1<Hjqm17-26YG^S?<_sf_{FX!hZ!Rw`qqmBH95KMo)VW40Q?*0_^ic`=}g@{1eh
zg{SY=Y@a%%spHMouRN#?NW`(sp7oL>5m0HN8Ljb0ZoaJ2+QjoGjMB3ZK@HZC_k%D~
zejIw~g()Y++y-M|87Z-7t@3lo=q;n%l*V+2868c1Z?S7M)+~xmK520mo6oO<aKZ}Q
zA{UO=D45g}R`$)qOB{hPS*+xl0ro<Lsa7Lx#oG3$#6$Jz?FIVK0`#LiPPsz;iYU8B
z^P7MnJDIp+rQwyo-}P_H;SXAD;2hKl6@CVKL1jCv((nM^1%hL3h8_nJVSQ3XcW)^;
z>;PhubT{&l;w||Il8YM51?VP|HB+Sr>!Nc0!WfE}yReP^HBQ6f&)Tk2F5CFAiD#T8
zOHyk@57c9C*5Es=dp78B@r~xJbzL;YHF}V%{w!QBmw4n*jPE_TnAE#-^F(f5Y`yu1
zUY0^b+o17CvmPNl*u{{stSg@OQ8IvoX6{3O`1sdiJ*hw)=d2iVWt*KCPU-Sj%pd>3
ze4`iYXbUakM+Fmr8W*z=e|+Y-p!5cbh837aI%0l3#}4+p2b*uDpYqrNN<25o@CZvp
z)Dmb$HrX5Z7jYU*sR*Ay>?UEJ7p%LMhU2|GxikH5xh>QiR!g2Shp54yU|_?vv)a_t
zP*-P&ZacJ*sEtwR$L24<`}DM5LY{xN)cX5167AixiXFXdL_|%q#&X(jo1Pe=2fUJ$
zyu}#(4-g)Smc{7Hd_K2h5_!WDouL&+L45Ub&o3*JxROB%ht;50F*fmUTcc7*+PML|
z<G)bl^_&VJ!pwx9^=4A}z-C|8`5aLUT_efshN&rUjWa>|t`^mVs7r{G(S8n&S!1O9
zg*7JjD(|VEmfepQlg@|*VxMzKgoMt6IINbKsdc=aJ)F?*+Vmi`cZhmQR{BMZ!r&$5
zzbpXxOeQ{T#K~*;0MVzo3-oNB^U{5By{t6A&-!uHfbg^i%Kl^YCv8I+s_Vj?Z?wMb
z?F0y;@J|hINtcLU5Ll5lj2x>krCtgDzs@EZD<zIKCa*F>>L=9{IPP^%oI%S?Zz$)P
zDcL+X{pMH$)4Lb6O@nMweJ6swk~dmip(kQG&S2Mrb+PtxLDYGFNn3G?2x+vDFD23R
ztlr+|a_~69$X#60WM&$+mz@;LQYI}xapNWQjvU)9<lItxLLca?Gmpsq;%)WGWh{P^
zq!b{<*b<R_7`eK0iHEDEREBga?jpzSsCVS4^kXULr0s=6??lb?$2sAlsQPQI<ikJZ
zAC%FSNVOU#W|h4%`?z@$mSmuxGB>mn=FDS)9xMqaDIt})yYo*58j73vwDx}8=^)xw
zx(z2!_*OPaL5lbTKxbw+F`Bd%NH3dPo%2NE5<0KS1>Nri(rU6eKUFqXp|vdS#ZZ=e
zp{@*Oggwurey48TXX$+2eh1weOwAU`6^-XacdgdOn=AwRVI<&XF1w!yJEM-Qn3YBJ
zBLwOeEw|nLvt%MNw5#qw4w(E~s0B~YA0NCRH5Q4KXyQ2A`CIoji2dsqI~OEMlQNMR
ztsaRlYSYI3$JVZI-yIWFWM6c)uzVuky7QF<Lp?|yn<bP2dbtKm79I=qZm?z-G37EP
zj%2f8SqIKpByX5(c7-69?*MxzR6V0>t=!i1HrOMm3RYYWEbKJNcnEtEp3W61MHkIH
zS~3FrfXT>088mgpO!Cn}GLW{^fe04Is-ksjmFPF5!M)FHXtJ=anu2@zKJDaq^>BD;
z!pU}kZ9r*dZ!S`9RkoAib-ts^HDrG#jOF$!900HU@QU?^zgYjv@8uVxh}-CO$)&8F
z*hsLeN#mSorrL<b1ISu^F^Cf&xX`L1bhRKiMzMD;6szodjIzL34<gqOr2}Ih5UF_1
z<C2m|BlT06cr4PKKSuuAk-OgxQxy6(=Eh2C49g<gIiPj5*7j}OE4Mb<ayvzWtD5l#
z*&6oeD*QR-ZfDxA=O(%Iwcd%t%yM<{&Z5xotTADVkM`CZl+G{3@t?-0isU<bB<4Cl
zq79+B-S;UAI+oNdy_JfmtKvXtA)p9}Tm^=|rg)zJTO;F@Ov@$8ZYjGCnLh+3<fzQU
z6=lwTWq~PoH-gqu=I0bxL;?@@{puM*#-^&G$<Ie$LNcGA7m<*}OrL#<u|hJj<r(vV
zhxslwgbB#1x6Dd~0<tbSi)~&mN$BgzG5Zw9B{8Rm0tL;zQu#ZZF{?De^-a>uaXgJ?
zA8v)KiK3|*)0AxW5W>;NM*1dGVg;39^NqY?xwIDbeR93XgqW3$G9=BOCw^ZK{-oF8
zZpE=D1y1No*T>b-%niA+nBd;QeUu7+y>J<?(wOs4lc`cXv#fs%g*0#&-%&Xi_*6xw
zH}R>B5x2fXddhoY>L+t-jWS?}e&d=W%@Ls5w=`kcNrcv!Tr2cJCCOgcHfj$!T&<pC
zA|pN+k0<4KY&Moegq>lS{iXqNoqclRE@H@Vmn6Sn<CD#q9^8$D#etaNo>H4sWKFft
zNz8nAgD9KDIYI@Kuvb}>2itq=8KlW&qASZasxL)rBvNOMqOK*sYfyl$9vvsr>KJL!
zT6RC?eNxrpUk~QLih>yy$EURJ@h|6r-Tb8n9V@e=KDO^sk^|=YSmkH<Mi#h@DfI<_
z%5fycZhW_C5uYO1`C#F+xs%01RZW`T^^gU7Q)?)tqBLEyMcHJ^I<~LNaLbHG__^^Y
zVG!j-Ol8=s?P6YxK8l1$Ny*1Qwlky|mfT~0ueA?A|1h{U8(gXEh;&r8B~8X~p$U+9
zkTvb?Wcw=XOu`@L)G#Z*FA}BKMa{qAmiz|7=0mP=dxk7;J&XP><o_j+v-q4zffwd7
za11B?HrFCz8y1@A!EnF>MpGUvn`q820FD5u59ig80WK4aL59Ky|2=}OwlQ@ud~9OH
z=dO#7(GN!X8h+Ta!W_S_AEiRvnU=u@o%tU~`9{mw5}_-dSS;+V5105P>xf;}krJdn
zSF!=>6J5aVbI6h_W)6ANwI(85kR}W!Iq@-Wgv`90*ul_C!4DM^I)o`fM05p~n)yBq
z*vTsTTTZ%l7TN9sr>{)-UrE_6{!K-y8cq8~<`c)0Dc2xs4R8m0$c8u%Wt_}-mU~CB
zXI5Tv?5p`tn;s*}SPW>LWpit}NybUzc%>*LdJ{wjRMcH^^9|T>37i1gd6+Y<ZPYPi
z8Vq5hw8=V0ht+L&S9C(S5?Tjh)s@k-VYpcLqZh>m!7LA>-=3Hv%q>k+Fev~blme{b
z1!Y)_F2|a3W(M|JXkJ#Srt{30kM(z=+;3DH0EiB>p932zt~KC;E(#pg`6zh@IS>$<
zl|JmrN^SbT!lLbUAx6scY(H+da_YYA*OQ;?chz`AJ|*9O7K+J9V19e~ZuS7tqg*=N
zo0n>KD%%<SL;i{DfR0+}x?sm$f&wPp|Jh8=|E&zqEeKk$I4^f_%vRJ$5K9^1aM!pv
z+e8xcOW9F&Sw<h(nknn|Ws<gGZNfYLBDhjn_U=slQwBP1x7=b+eb(KaHq5PR<M}!6
z7-i4u7?Gz+Wv@agD2l#DqL#&-WSQB7;v^;8oZM+gDdd~=o$W7@##?78n{GLzd9D$%
zo-v;Wl{kB-m^9$;M_XMWuL~oi*M-r>z>Tv((LFU3{Z$#MNB@wy&!9CjIu)-1N5Y5#
zfeeVOFi_dasXXF*{8$%6t!1;o2r#k^6W@PBEg>Y@=|6)JGf#LP_9*YcP-3gifYcej
zwAe^`M8k!(u{a{!7m(^wqZ+<<ZK(|Pu?;sA!&aDz13}-qD*HjMn+05%2{E)uTte#f
z9Wf4vF-^b=TGB#ZuQd@rKu(s}vN@nj2I}t>)#rSmQId!kcz$F&t!WqKKbR$>vs7Z5
z^g@>k^|meB8_B>?pI+0*sN;?K%pt?P@dfYK>n`~prQ90%XWe4DiFrjc0FfbRlsO1X
z9IqR8H=q?r5N2BlRYc5_Nv$x)CxNMsPH0~s&2^;!nlmXVb~?UuyNU?9FcPKq<xkGQ
zaeIgO!M8a=A*<V)pg6_0*b*tCvN#Y1rB0<Q(HLLR$)rd3r{H)E0U~X@Rk`a#cyjQW
zLMn}?bCt_uHzASAgS$nJ%z-h)2j7BtLt{<TkSGviCimGsH<$j6WYq@6JAR@xjFl^I
zPXguwsSij7O~H;pf4h@1hA;tnz2YW6VVkZ0e`fZv({%V#b<=r7e0cganc5Vg5lOCn
zVoDxf`laK%;0jgG_W48>KWP&$CjwR74gn9Kpgq;8m87I$Oq!I6*l!vewis$=)<*g+
z;Z}6Q+5Cg#10hONxd#5Iftw|sK9mP2{nYVQ<~MAOCekTG5CGanwFe1O+B|dtoQ;fS
z-L^puC{>vtz(|AB9|<s}CH4a|HeE5)HbPTIFM)w<t<j4MZu!|IZXwh+cN}A9ivLnm
z3Eif5)tpO8Dxquje-_}is|mNFh6Cbip|sxTgHnC}#N&z_K4lF{2RSZA;?OPYoliiT
z^~k;`^JkR0@vpy^9P6H0*sb`CZetS$%Z;~L+WoN)>SxL6a$Bc$JJd0GI2K2C+I^8|
zcp}yeo&*oYx~=&5w(KzB(P4PcTuiGEsv#PC3xN<(na(?1K57pKF0p&93DiM}7f8^T
z5+QUG$tv3Jl>!7OKFYe&dzu{0Y=JX%V~Q9F^qE$;$VvZIPJx!=j6d&Y7XFvPF6}cF
zYUZOyTbxh%eU-+Kcz<jq9HE`!{@??BJByVa2Gj2@>B{P}YH+vpp~QUg@p=_OlDBW1
zaDaTk&z5H3Dc+<0y-p;S5L~+k!`J-<EukbB2QX+N`MJ?6tY1FfO%Swwy`Xvmb(1Tk
zlCX;S+0>Bo@e7rg!%$(w@P5UGTiC$cC0;7k{Ld1R>wSk`-lIu!R-O1`>3+)+!gmz#
zPS<)cm`<vq+;ZXx`<XGnF@|dr_wjFZ`M&VaYm5xYu3tOsmkpUB5rrt@)z*TA(oRj#
zZ}{=PI}$@JIcF#;RoJmfAr~68)5etsUHxP=?#3NQa0a+U`PdKuX6GUgSAz@XH~Bi#
z$C<*z&1S((G+W?k(H2SU9&3c(^}J0@`L^e*u*retRNvB+sQga*F<^hk<$TIubgD1A
zYV6yD6c!zDDLy!|zex>%UM;e_@95x~s*}0X#o;x%=2^ndaw@>$g&sIQ_6bj3-h`tP
zk!5LTjgZ_?T4VT2KNd;(M=TVgSIhrz>GDs{3>!XG1vga|dKULBg(nQbK+A-)aI2b8
zbGlbGRes^F&kLoz0b+SXceP{z-vXxdi{B8zZ38orP!_Qfnj7Ds$7m5jHVck<_KF%c
zuX07k4%M6Hy16_YyeM1tVid3eq9`@9bR7{faAY{H4lB>hMw{wBLyLc|Rao(N*#K}P
zA=dK^H|I{fFYI&o)NOfdRZ8pSw4n^<*n|4cv8J86h*w#+<FGDHIazQ6nK73<+F*6E
zFW@MUu%xp49k)z|2M4C^SO%itfTsAh*((uwzY>uPIG|m-nV5iZOn`}|HKNWK`WROK
zg}bA9#`;IP&C((zuyy$;Rm4qZM@npZhsfAo4Sn2B1cwzt5QB6rV#ayNFe{0)oePL+
zL*tyBVjE9HXG_71v~faNw;_Oj6c;*1%BTsY04LBEn_Q27nG>U#Ttb&-)Rusm#aBko
z1sq@RxM1ExF)=cq{z9^bDlY9mhqaDVN6KTkS)ku_k1(}m?^L6F<(t7uJZyf0&{<8@
zFJ7U;biRbDIcWM}m9u&4VZa>U?7Igq>*c)ujs@0m&^nU+&Z~Cw`nO&>k6q&Kw?&tB
zm&}~*6i|^tM5n<)T51O*p?vCNsGACNu;rtrsH<WT*$n*&Y~fny-NQjbvy?xe4?{Cl
z@wX_UlOPGi61Nbpr68ToKvWkA%aPVy;M?Otu%M5M;9j*Kw}~<GdpaRHtMHD7T}Nt-
ztigofb;bG;b8vSSF010hg?i$vEiqWkjaQ;EvDh{lvs;>MM^I(g)=ni1<w6xK`B%m1
z=NdBjE^L|b*9nbTry?FEF)2+6cYbxX|F@0x&+8g{_ciHI{in47Z<AoBuqYVd)CC7G
z&>?}SK3_NIaUsNrht11yA=<$2jaLK=*PRg8`~y*xDN1TSMM-uCHGr|tNZuq;&L2(C
zd_cubt%^~5;#-u0nsyw+l?PEb&~DE$m7U5=-{859lIFiGK<}rzZa)yET4KpoevBvb
zs{{8DU4gc0e*$#lJ9gzrbPr~Je&M7x3?LHJr>|qOb_G1|T7u4D-VBgIrJvO;!LD>z
zH%_TgeP2R+K8-yyPk$ZL|9iP@EPY0zmL3iR2*+m}LRaAGkv*DopCb)S*3jxV8=C4Q
zZI5sme51NaU&P%4)ir;dm!-yxQz6V+B9YeYhcUL}xJ5zczTV5UevLMSLX<fE02b8U
z8P<t6h4+J?XB!SsZT*lX=OiM@*$z8V=5mRSQ<7LJdc&04NlBm3(P&Dpf>zDV<BlJX
zr%DBZtbd?ZK1VW<BCjCJsoOVTM>M-g`FuhY$HBn{(GT_FLPM--SrgFlY~QLc5{chL
zp?rPoIPt%kolJB+uDAoFPz0rK^_*UBQfY^TPGAmWt?CPWm`a}{>b3|J?a%SnKTzdU
z#xY@0g#XzWHJ&VZ-`2A|<27SU{ze;~vjZ6Fb6ZwkB8Ef`bBb;KunfRVkqb=$#22+v
z@^6Zi85b#yWrSXu_ou}WJvLLinn*G?nx*5Oa|pb@bCV_Lx@?E9d)#rS?)yeHfvWOJ
zOw+IOl+-GkZMxb9Wy-jk&qi<G{CPhsXPF8dac6K5EKIOu%j9GTrCj)r5&iG+c_Hi8
zn+Zg5hqy8VZrXQaLD0#tZ*|{{@D3kS`3h#QS$Pn#&<AcfN%Y~WVp5@PMMO=F;laAq
zDMEF`KF${uctZ{8<pmc(kJuABw|t&L%!y(C;yJJ*S#Y}MIIxr|fvyOD)UI;!r-*x?
zD7hLkVnJyv^)-Sq7;PWM$LIg3dJDd&x9|O%7`nS*29WOV?vieh?rsothDK`W?naPq
z(4j$6I;D{=K@kCO<ec-pfB%Otulek~*Sgkqy%!vTrGc7{Be9DYWXr}2ncB!~6q)*H
zjMHulSTYc)E7ylA|K%kj`w(o8s(fE{eURrKtj#pb^dRV&?S==Fux8Z44nZ!C9n?~_
zWn1{4TbNOmGd84MErmH_imtdqir%Y<^`iQ!`g5s@0IGvZB(M4$ghD*Dklp{5h49k0
zIZz`#Q8k@TAmfOW)4Q)<&W=8ce56>~fHGQI#CBAhuzlz)7FNC^Y%odsgF~MJNlg(N
z{5}cKO*ScZbE>YM-DA?QC<?aYdwX1`Jp*h^nFvlEhFT?#9K=?lIQ85zj4;AraNb0V
z@}l8^km-WMAmOge5LhK|K(B^{2}^-p)wE)J5DHb+;UqfMNUn^C9|XTYI<?b;zKWAZ
zCTm_)d~WT8>x}dNrtUnJnH(vYLNm)@uI>Fv`NBUt*_>Xm*w}c`tEg#PL{xXsS}+mk
zMcO4%*y`0_f*A}!iwLsH`q91tODGf*6{BL2^=sM_)3un5qDc|aev7z1(2n{TFeo4P
zDtJW6g~4~L25?Z8UmTpP)KZL*=7?ABf9;H$904gEcGyBaVNHLnRJxt(l!Rf1_n_!%
z?L6#F@I$nP^krM<+e&mPHcf%6axV9Idd=8*;y?!ZDD!5cUcdMBmAEI9X@thS#m|L9
z?%x=vUzM2g=h<90V`0H~jGvZV*gcCFLoDF#gi#6%PZ4)21)Y4GAs@-ZmxJ2yLy>4=
z8NWo7nNKRiz|I!3F(fb)GJy`+3JM4m*{#XSyaU@K67$fh!F5>V<LRU!HwOk5Zv3vV
ziX#dfS?&RdYu^EhIj=({W=Rhj9+NKamCRENe+}(K9D<xGv$>9%td&`wBt=`=AIi$A
zs#iY@%%z9HnIIc1)D=CRk83v@$!<6VhyF?;-9YgU?Zv@;zS%DSojWx}6qf0^h7)cj
zCH>Aca*5u`Zmj<vBAJO&r9o7AbSe04<}H_$49GG94P>+hvw}ZclCv0JgS)(HAAYcy
zz8a@0b(mS#UjoVk)Ne{!l<iw`<f4z?xoec<<PqC472icS3ZnvJ>Zeu~82jci38zKE
zn!n=23lpNEo1fW2rDVFs>ec+J!0l)w<!365Q7}d9#xtb($Q++9@3v?v9dQsO)#}D)
z+QsL5e*5XfGP%6nO(-+<dCokx{gX5Ki`A%E!Q;l(z(*y(xgzFG;zbma<BG%r*6W{T
z9a_>`d$MJfU@cQ>%oa1Fjgf82H?f6G%2<Be6*dGN>#%M<_)6(S?8V2K_%nXS!z1g;
zFyNr!X-{?4z^Fbt>{6^Vb-NgEJ<z2$N7Uj7;N5@~Jg8%f?|OU?I4>G|O5{4nFZ|Lr
zmNxmwy$3oHUq$2X(z;1izi-~@LLPtb+eLk3Yz>7d1(Vinp*(gr35#v=6p7;7G|n=o
zFf&*Gzsars7c{<gw)O$#@soOj3IVQ<MZxmFnl-|c@=~Lw{Dbn+D3eIcm*6F*pyH%+
z=(l-FmD57KFKNFKCaOIaea8|a|M-h835oj{Mn0bgPJ`vGlS#pFtwpBEgTKTym2bov
zdQrG}nc;sWM-|i({icXnqXi#|ns`wK>J!rXG|EatKUx2>VlwNuLPu+pRCmY;y7I~R
zK%D1Bsnp^k=q*Hf$8o?6ar;yB{uA|tn>XZoS^<3TTYV+5v-^L<!7v3H4#}aZSEC@(
zd18fGrY+3Gqm_APL5~EkFWfG=6W?f5&-8W4nMkEIqUlMu`})+`YeGjy@mstFg`t+p
z*#SpzSw`?bK(p_`!7V5tZ?yn57I|d59NFxr@$agX4O#l^XjZ(3h|wpq>3n{n6us?T
zvT@zQNW;KVZUlXp@O1qt0H@}f_YW2-JrdOj;vqwP#u&;s-6lbd*t`-j27}D!fzcb>
zD8<|g6RLiZ+*qJjfI&H1Xbltf$;hW3pYIw$;h-1#QFOkD3yeZ%ssAT8?E2I$+yg@&
z6!vK|e(~eZaztMT+j;v+{6dLq4VG|~=JEQ*CB6fIH=g=|s|wB|^9aR&AS>wassY7v
zJt*ZV2xz8JO`Vst#Rjr(xjS+;VIAofY25Rn9du`qB47YP!p}LaNxk2dSoVPL6g6&M
zid=kHpAo6etzJFmd<#$Jcxh#-#uPzmc0!+K1c1p7b1}zf<>II?%z4FW!`ngAK_~=<
zJK(C<7XCHUKZxGb=A=!Fisr6+HLRk3s53S3?O%{=nRQ5*-h3#HU5{htQcd*O@EKsW
z3x4%nz5RDfyMRU!;{X;*gFDd>F>a$VHf?DzLh97ok&%h@Y|82Is1d_>CicBh?Wp;Q
zjhhO{xVKbQLsa-cg$cn;(;8OX*<}l-I8aztm7f1vaGUu@d8!$|AT!FN^(se6S6-x-
z144G4rLn>*Z&j{cmH}|4h($vVU1TQ1izpG&q2@8SwLFCOyh3Gjv?<A&^J!D7rDEqL
zC?+CDL~nkl*tW4G*Bi{`<$<)I&xH)U@q+2@BeXChn2Gfy@a-h}bg!<Xrmu^@jM(JB
z;qzDd*LZ656yDnMVuK^hcb$PVVRisX^-hdEnGj2Dl&!-IQ2BYa#Yf7~--ilqM_4q4
zPDfPUasiZz7|15-?1l1@e0UbEk1~v$31B$!im0CmE_yh2vctGM>9xwjj!BDNS}5cW
zLR~u@8=Wa$JL{6naUR1+ArrjO11MxPN=fYrHdkOkpK|W-mW`z@F+4H@>6(-((P2YZ
zikYGOLxKpIqIZeLH`-B{VYb@i<n(})9sM<hwcF|>rimct*Av_SD(mML)Bz1LbhmBI
z^T<BX8|Qp#u^Ca+$Wi;LL*D~0Tpjy@uf&j58)e)oZC6m{zDZ8*0*8bN-)&*B*O^VQ
z16Z$#Av7PJSgbC$QZucWidPcnlMYvBUS+A6BIPIV@jcarQG-*{#6lphux{w}h~lYJ
z$9!QFc%j8Kr4wplAjK*PZe)z8<g^fMKhJcd=wg>2D!{IV@uyf)Z2L~uoJ{Xd=KpS_
zalkk_k0VEACCUu%+{SuVM?d~A)y)8RX6}e0-LYR|k301!pmBu92bY$_IE{sY>%nLS
zEbJvXM$a5p5pIE>;{Ad+hT7irQ;Rl+I({Zg3|LP=Z*>=K8S8*;JfLhfY>X_p#M#KC
z*ljpXoWo#NoItayg9r^5$l4*?O-3i4ZyG1VO_PH01HxYiYzVpuADhs%)pWrfS;Ur4
zC%9<rs#YhrjlORgoE_2X{}AqCSz~qYqvIQX^ciPi?32dVQTVSBSSc+X2YfAQNt6G_
zMe|;lnj<L=Jl<=&zPHUk*c^t6DbWd1WhTyre1f@TOLpX2F46M7`-)$e=Zu2;Sj)I3
zP&R^yR-?r9@IC82Dakoo1}kN?6o4s?=nN^xFM4ZK_T%(h^!Bage5KsD?{Yt(_e?Ch
z8<$zC2=#K3{i{V;(Qm?SuIA950%q%=`E*&nhHcFsmU4s&zE)QB6-<I>Vb^&%K8WtP
zFkQiL!30L6`?;*e91H?JO2m%bO2Y5N7YbaU9|Nuyc<r3^kpynN)#B^xAAjd#Wnv1H
zo*n*|x78_Qr+k^AT)-qnJTR<&ujsr_E2t01M%6j6<d0P!)Q6D>rVpeY8<%QxJQ7u7
zKpRfS2~<Gv-uMJ~P8qM?bcWU9y?MujV9*U7GF3g;n%hVJ$R-?^gjs)5j`%0xLBO#+
zy(7n%A&Hs-;)Qquyh_w6q+F{TyQaw7kbP}-S8fcSO@2FG+X24lElc?&*p;pdQ2P<G
zdpvZpuc@6E2W2L07YSR$q8e54K16WY8#QKBcGZ#_bI$k)@85PMEh2~*<tO96X;`sL
zsZ;rk-1whKs2zxvxDAIU4fsg;F<>`&oF2hq*0rW!u^)T?3XwuGn#*sE+6dKk*iqAR
zj!X?^N+m_nXunL?JHC}g)sgDf8zmGya}IuC91WGzBQ&>gqxXc{K}ub2hhbycs;g5A
zkR2-o5Jm4r&<82O$4}%VjOG#7+E{$VIf>+0$y_hx8Ij9q^5gbbIP4&z!RY^*sTsSZ
z6er8uU;^kU`6VssnOI4jhn7@`G-||7;G9ytbIqT<R^(F&zo-o1uteLL=24DEQlKK|
z^UWOI4>e(Y{uo34ORV@5m1Ir#`FaEWVgTMbp%X0`1klM4>j*NxC#MMLyCn_xm~w))
z1-5z@(`SE?IM<U#<W@JEmL`{3Wl1SZ7>VNxzg|IjVP3&B9bu(f)P<pV`be!8akPDa
z%K@ONiiNEJJO_hXfNXxbg<2K{Qi?v($qs43lD;7$9HVXy0$k!gH)p6uzf|ZAk{gy%
z<x1?^D#_65DVbm*L{f%6Y7;$e@!ib?@6lJ$?}Cha*{e}VC!>2t^)%6P)V5}P{$D*b
z;)LFkZ*oUEfxwD79CAZg$0xr=7P^L8(37uY@i~{%7xETnlpm0OJ>#fj%dUV?dr9dK
z(GyldWyz*{{GS#u0FBdiWjyS+PvR8{YobwPL{h~I<r<rlhl%L%eb0u}D6jQ`aB-mZ
z%<*9NB<7gRN+VI|A_8hLZ`f^kuco1J@Xnk^Y0;e;tYE*)37>1$LQ>F{ATXck4^9Mp
z*@2d^t|EMg{3V;43PN_yBz#4OR4xg5XR3P@?D@s{Zx;83N5JjM6J;5U<-JcmyQ>lW
z9R<A|Ne3whc+C_6hz+*i(V;C^o8Vjij3>&v3=vARm7>9BDUYj+6u>+8C%|{s6<X0`
z8GxEilj#qg)z^o&jc>}yvVSlq2Wh=AUXBlAkyj=JA@l)r#;3f`VEj9udq(zfww*Zy
zkTdgl$4I$Bpco-3yvNJl*Wr`NNn<DO{BoTOe2vQ*gNHe1@fl|$eUW}&u4jx7>MuF!
zX{TMSPeN664Xyqy2L7SGBofQL$Fj7w84%vGkS?P+|IQbV-dU{HQ9jL4EZ<9xGzK3@
zX9kqEm)^}q350ipC;?MBc9$c2y0nGIWXN++@Jc8<pk}A?UwU8pyY(S_WW7<XQJL}#
zHM7~I2uLO|VC@DZ8?5_;8*mIm%_PaR2~l5zihe^}2jnj-Hgvu38fN#yC)zwHAwO?P
zKmT+o`!3@@mdi)|`Q^!KLV>yw3J)nT@>=_=Iq!^gHK;V7!Th)7`eNR5BCYGm#L4??
z;_MK(NdD2W8UJGwdP#=EVvs~O(e;b|<<y9$tj%k;H@?~w{dWOpVj!IFpDm%U--t@b
z!l75E=wV;U{3+8606hGHJ9Fp(m2`ZT`<N}1#4JoVOZt)qNyjBSi^*{7LlFNG>g9sV
zuW8!O&b31&zta^ka=0U}7jA_X3+?IG$+$FU*K$xigv`-Ro4Y|_GqADWxE(HdNdJ&r
zug~QSTZP4pDZAEqjM-ie>rH%D+LtBijVdI5No@j<f&UO<vP8CXumwJi;ksexGfAi}
z&tT!o;%_!+3}EW;YEUc^><;ir*_o3~$8GwkPT*w1POKJIQCA_{K$^IZ8{FBBg*v;r
zfS=OLh&zxD>mO-bQ}HG%Xc(MhAk#@jZBKSEja=)dc19#HV`$N+&b~Rnpmj3L&j>&U
zSh?frwrOORHo#g@Pv-W_t8fCCfAZPW@EBuv3Ba-GNXLoUGB<(5<lN;r445S)ABtl{
zkvaDTDE;{OcjFVFdepVy3EZ@Gq#`8<;NKm3OS?UwFoRP1=7vU1_Q?Zd=Yt{3;g>|%
zNq;7`R|4yw8|<e``<edMe2>t`@P!Oa$0PL97|hW`8(((uf>)E0VGE`|xgtD6bgIsm
z+0Hcz@as067PML+41iz5oA^|`)<2q5uGS0kQjYeT<LM|bAmq)FMr?~><r25iV<_x%
zE*K@f%7I%0v;^8P5i~hdhHhOAyam$7j&Nr~;-JSkeaHC4y!nY;K_YYN+H>254CcRP
zZ#T&C`O<qlK4^F}8ed~pQFPBa$^6C@9j=1p$OGgD9tvf_!c4mZ_Wr$}coPypSYg~K
zk>#6TQF03L8nb!-RTKXObVOjxBAx)GUHD)#ibsw2<Z2}_{N8PVwy;A<60+?Q1@$KC
z*?H}Gc#<4gF4(*P>9_lBKUwsr863logpgVrZ!bp3PcVFLbukxp_srOj_oq}fKzE~x
z<#+1QbNLpT)FtB=Na;6ofTdS_u6=yN#9Lk`!4t>GO*9&G?mxy&<-|+H(#qFA%9{<w
zrA!u+EITaTNtE1`fFzx4Qt&kf#kF@hh$_Xfnp1Q>K@Eo{bK)Dg0}<n@UvSzUuf3y_
zA+kV)x*;4@{Qb9{SbhI~i>f0>=ob?e#yCB*3yusJEH0%vRS{|<H>4<78CmzkrkKzv
zclPX!c~R@nN6L1>2)U#Cm~iB9iAt%Z-!+Lq_l-i(*zk9y5u_xgt;N20*8`lGX|tr{
zk(!k=R|qUIthcz4-yD7O4*eLiCeNf4(J0l|AzIni7$;brrA9thoWm7xgdzyd?)q6A
zy#6QBT%W?H$!;5H!X~9*Qm1%K`kB~)e)ETho28?xQLA<N&rj(8LZ1$xII#8HtR7Q+
z{-;+K9>ny1yYV1k$y*}@D+7fm&IEb!87`q@3j%C_m_UzIK*53I^>@^AI&^CX39-K2
ztQeuCSeZBe_*|t-^vyOUxdJ9L#NIQ#a}=0FyO}n*<SzS|Qtykbbig4F)zB4e%H0UW
zqQ|BH)5o{x7s@Ue(;Z0-5%5j!kwl$ydIDK5@w2NIM98?5s*eTgUHcSLWdmBt5osGE
z*G&ZjAKalg=&pDs6+z1(*2YS4GRTxO)f@kh>$6F|J}Q&H=Ycbk-4V?t5vB3s%L_`(
z!C^GPQH2^XE5_nEW28t;QEw@N^ntF289jLddd4>nv|m%ePD}*1Oj35sIZdvh29Er&
zuSa+_{d1x}U1gAYz7XJi<?je@tUT-V5Q;zbXx2%=T}c+8!-hG;L{yQ5Y*(JwmP(b+
zjAOC-*aDNQgqE9uZ;4{D<pRGl25r7$1yp9=mR;}@700ZUoZVpfA*MJ{&<|;czz)`k
zt>0}1R;hgm0gD#u$~-HE|K++9)3^2PK2ykf2}~TFezpBDJ|}`WqW%E|Uuh14W0IQ8
zFsnDlw`(V1C}ZA_#m=^VR4RCAPsQNPTD4eBeM|=b)ezsIINMwLQ>;+!!Urk_sZG>H
zV?9`GB(J{2oZ)=a`mgdn?CO?6HXTwBm!|n1mfYEO4Wg))8+ms}!X@cj-C<;_o>$y3
zC_+D6Y#kPZ=4U9tU*vMDA)gJN$)yEIaN+@cNsCOxH7V5N(nm<F%5Ia@aqr#o#)1+5
zzPSbv#zx8tD4r(u1OF?L{L_qn>5J0v+YNpc|1)7vBPX4pZb<Ik#5kr%a?1xV79eFN
zU{k~`4e~_TcZOq`xs?~6B~Z{B#?FG9Vp^g%8EaIq`o?FT_3`A!KNN^S?SPA{DEk`q
zt41<e2Qg1homkY;C2jp9o-tgv`l{ZPa%;HXgjTeiL|0695gyk^#Hf(TelN_;{IwoJ
ziSN?KJ*`;sMn#rZbV4IBXF8;;Sjl)E&G{*jjGf=0o?<C@UIl(E=(BPbsZXV3N=cZ(
z%d5w<V36SHID|S&QUx9PEaKTjP4X0O8U9PUFeimi$aKF`3A3T?-+Urlths=0H5Wh<
zvDb0L)=UbSK7)>_NGfr*fB2T<z6$~Qr3dY#Md}d~jG(%%c36OLVPoL2T5&zOX5~?Y
zL5#LGzU;}AcOv=;)fq7T<Uy$W5Mzq=XIW|yg@S7hp+}>obppe8^la~P3v}#k9e3ND
zdT&AaklQT@bNfFU-3o=$9UG1U8IHp9C=}roDItBWYuz12eKy#TVwWl%L#{IiPseE;
zH(;wZJ$niKg(!v9w5Yc3ZVP4T^B?x#oPnC%W13uiS&m~#aRSOzb<$Ssc^hs|rZ6rX
z0Rr*06%}KfxVtUJAVo2~E2XUh<<_;*b!S>@`3wrUWUEMZb(6lzmrUkDSBg%*;v%3i
zGW3$KJ)v_bjsR%-1!#D%-B0RM3Zo3y73Xr*%mz=0#b|sb@?ux*07b@Ul(%LM=Dg48
z2Ccx;C%h)na&X_xEIsEFqU(iyd^@Djc)ncS@Jn<U48dU$*<QjKsEQ6&#3~%b)*cIb
z?!EuX68=pRN9%?j8`2NO@2kjO$r#2k7OdaEC;9G~Xe=>Zh{mLo;o;IiH&7_7j|@>G
zTuRs=rqePlxLT{0+9s6tC3I5exa~|B)s-6MY4krBE42sLj)>*Fg9~ehfS64(+vSNe
zCdTn-DZ51@l0>u$WbZS@iGld!X4Xhzav2UA3w=^spvs*0=O(k$-Pq!U{45;VnU$Z(
zedOr>kg7Q*)n{<0C$9CR0-pNVG7jd!*}qrX|BwhfFZ@4p5b%UsFyu5HM<I#LhGX|F
z4y@mNuM6o)d#H3;wmV=(2;xR^mjW8a7zJP4Cc!90c;zg3oL<GA;oIbTC|y(S_0cGW
zI)Ih*R5TesX%oGFr33+v36xANOwC3G)DnTz${=<RGNf-4K&G%bsW>6rX|nN=>kLZr
z%<{zwq;H5{0w(q1EZnDA$M+0}%&!(Q`JL$eTgca%%{E09%0=I4*LtqKmg#n*T0pTX
zz-H#+6bJG`__qDvpQqTa&n`nwN}P;=HY$RtVSF%^d1B_`VH_Z*uiUHG7^xRY5+8_e
z*;9#uHQ&IjesNiD8(92??n5J}BghSgYC4BZp9qv!C#Vr@48g8*1s+kAqG>Y8?C|^v
z64|gm^Ff+sBRf>Y_krayLsFw_eH3QYZ7s*&=rC*1JQSW3TB!y_*QCQu`ifD_Lo9Qn
z={;g6m?u=YL$eedVMPf*3pi0%xQ5=oLup1|)d+sac0t{3*gmO`Q_c{kAdAY+@W@r+
zOzrjOLgw&kc<|S~()1z&fDq5fOoQ3<%j|Mz%l0llr5;eAwhw}1!)DcSGf#8=h4M2o
z(*{T+sBrF2%#-K*CHEe=3#c3S007)&rYxvuzq9=o`ODuamdQSIh43*!rWg(zzd2qx
zxha2xk7@QQ8(MAyC;jGN(<+=!)phXZ^}Q$DRt0YxVibMh{erJyH<+mptwqQtw?Yxd
zN{r3m!`416D^Ji?WHv&@-S+lt(vPDy-q~=06^nUGlQB&UJL>l<2HW4#CzMxW$|4Hq
z{2X>Eb9<>6O0AyH%F&ZfW%`TesiYZA71cnNnFg@bRrq4|a4Pitel3mGmJJwz!06LH
zM?^bgj4{(4vA8X)ymgU@;FId677q6+dO+Qg$mKBcDSQMPnNj#A1G5(<kUX&BhK?jl
z%#GOh(BWV-zwm2XQqF!65i!ZbK%nbJ=H@=e67o^v5H3dP6*rWmHCvqFCG5!FJyI72
zrCXHkVhV4!t|l4_3ZCin5+nFNnj|c*2Tl_{oq`WIvsNU8({eCNvLEW!p&ZB)C(?{!
zE_3e#UMO<myUrd|i*^!(yZ+-4{i}oOKRMnUl*2eYh9;Uta0R{q@H{@+=$2}QdzECQ
zT-UHANQVwJ3zxDrzmJ5jUXY3!u1no!CndFisp(imHQeoM4NvS57u3r0VJ2XnK~>9X
zL3_-FI0l*lA=*3?iM0>`m0o?5Gzw<=-&x~A>>og<R#N6V6DW0kBz1XQ$<tn#%W@v7
zHHbdR?0r88Z|F`3(+HHQVQ*r>Viv6zNt)Xe*P)-eLDmxI_K(U~xGg)CD~X;tHl03d
z?XW*wnaAninCD3G-^9`AU-n?eE-q|ft8JY&0QpB4GN*E6OO@KL{?t#WI;;P*fSc{}
zARwAZ!^Fq(mu^HN!{Tkye_FBT0$WKEY0X$&@v6hKa>JSve_NWQep#uMxVq+Rj%53M
zAdG|G#Z%i5<W&CFOnv546o?c!sxlF78m{S5loTI%=r3D{7e8C+&S=>mV8fz79?I{f
zA518Lz-SVgpJ{|?k`g|XM#!SYzf=NFG;S&WZL}!IN{U>`EY)Zrf-9PBWm)PT+x&t*
z_xU{iMF~8Iz>oq&Vq8}34iaj+9er!Q%`1YEh}e=N2{X5WwXH!mc_)L)$*8=g<`>yI
zD45^~%wn{?{`bD!EK1+@rBNKK`FU7r*-X9_!5XgpMDHTxe_i0>B-PNX)9c^~f(g&O
z|J2cg-@rYvM8;x5op?@^NG-HwvAxA_31xAO(nzh~?j08ezQ|gZ#muB>Fe9|zjC;yL
zwkVk}agoFBc}l&eLu?@WZN+YO(-t37dGhuS7|v18p3Aij;r}QC>7mv&KY1k@8XU<B
z)OvPbTCGUo_rteetvD;+I@|^WYb_6{#%DhiKth5)!wUi3mZpH2enFox)RSooQQ)+S
zGFkL;a9_H|f$if=>L1myq@8nv<bsFN;Nbh^_;+2tcRJKwMnz`TL`)zT^uI9()nzsL
zj!SY=+*;%|TKTCmzkz~mCff1_W7B$$GEW;_HMB8pJNz!2wt|?vxW=*Ee4M632Jt(s
zqGRR~-5g5I;W7$oAKu$xSN3`cszTNO(|>m2Dwdlc*!N*7sV?<?%}xBxW6dyIZ3-V|
zr@LKqZZn>wwa2<E>JO#`$spK>ENUVAnXx=7X0H-ZaFc}SMTEDEd-E+Z!LpJSDU732
z!%$y_slcTRS#9-^&K6WqU~a!xvn<DbLoA&DFtP_0D{GNL+;m^iXRxYxZdO42tWgrs
zZUts!RUgteY-ST^4-8*`TIKCr?}mFKp=XF33c%0`FUSl}Y2-K?+SZb#9OS3mtWiUp
zji11l1<GpJ8^f^e-A`zzbPi}rUk?$HkDtq#zx*zPCw^B+#Dc+C1*MxaF5>RX>y+Xo
z@h{kD-lt@_=gsDQv9W5(9bAcrAxa|g*VtpH4sZ52VQUspauBGU4-0crk#-%`k`#|A
z?~J#t0!|yV22(eaW}-EnORR#V4(WlmrvxwKwacGm2){*tWPbozFrvPzFW)T9tf9ox
zhTNSaA9a|lj4Kj<>J!<n6Q3g2N{(B%KPC)q2cEpgGtqy_Qow-5k&%)Arg`8c<5ocu
z@i7qwnwWW;LwsJ8GR8hlX*mn;$2qNPjw6Jfp>4cz3J8_z=G8NL{T~Ps`;(X7z+v^S
z@lgYc>mRY4@-5<#njW3_2*HgPBAhv993jx|jwH;$OAJ6WZQZ2T*9UJ?a4YaYZN#Ge
zr}~h-X&lMkHGH7(_(uDpDP<myKFae&eaw#V#EM2^W+7U&NE3A&ngT8CJ;HC3B1Yx$
zH5Aw3`Yq}ucNCLU-|XEw%sJ9GZo_Cj@-N?vQ1#4$vYN4keYUSsRbdT2v^xaI#osdF
zMBY(TSHI}uR<8NUJl)=%;;S=9z$yEq)5XQ4>CExD2NL}Y?0Rxd1TRm~-eze_F0zKW
zlq+x%b1&VpH*N!XN%^cPoPU|layY}um)MF#k5(do!VKZ%)^oyc=6zV<<5%>=``yFK
zDGFZU3DI`T?O`fo-Ar_Ok!tQBw3L(`TP@6n7s}2^hCz^Hwz&VpP@1#H5|?cC6)4a+
zi)>yIp|Y3BltSc|yIZ5Ht$LDD|J|<)YG3TdDtAmq1f4JDMoml9KE%PPJGMRxP4D&D
z1!Z_E;8TY!BKYtyv1+bmpJl}V@FG(g&HMyt%E}z+vNptUR>>5%7g{8-h-V%T2m!2i
z=^C#Lz&#_#g{}`&`b?G=b#{-4RLrJQl$qn}n3by}<hY5N*a2uRumNA+qRECds|W{s
zvv)e^bGfU6^@C+_GUdN_4ZW3!^Z+J-?_?QPw4^w1EM!FNV;4C;aph|Vo=n>CLFT3F
zEf+q65UPmM)HI?rEaFP5aAg^dyFQqA&K_PTF0Cc|C+k5Kka=AScpXQ-2Gu;@208!c
zjGO2BUs2G(JXA_(H%=IP89nh5Z{_rDmeV~$TrbD%Q<xMJl0?Omf`O9LBYLl;*;YuU
zDUrT$Stg&<o9pWo-C2%Ktg~-k-lQZOGb0!osK!!Ozp#*{QtJb=9OY_)9OBhi7hL^J
z@<X5o*?sXoi+Ba@a!)%~4jGMdBW^xfr=N|zv8CH}QfN>z-cvmHzNFW-Zmf{E&&p>;
zKf(Ip#ce%p#jEhxbZW|!WSJ~a;@Lqr6_)ZF+4`r2<iAS^{zW7m^0X_%$9HNaUa8zU
z%h`)%X{ecZ$&h$niMiq;jazt5ep?C0-n!=PH<D<cAP}hXLM{x`C*~dBykO?SO70Y6
zd`~6!hs(whUmD~ywvD;rr?hkO&>;h6_}zpz%~0|f=Bp)G%ZFMb#f^c9r--M#5UqnN
zfCIHHFLU%_M)7>TTlNuQXPLNy7?TLD(nOsctl(+l^Gf}j<a=n$8}80Gr%e&7TTTqp
z^CUG#Zq}()qEhB>-Ns2dKIH6&$dkzEpy!9hytgKJc)riPp7TfsPi`DkS-5RL?Gp9!
zO=?De&UpP-pgcSkQ^(E%Z3nO*SX0>`vy))NVw}FFn1L&4tsoS7v}QsvZjCB+puM;7
zb$ACSUeh*61ZEi~P|ti@&&VGcFn{OSkX0rAVSsOW3b)LwI^R@?jJzkJ2lIxviHgzQ
zww2oXcT5LsI7|ONwn}KYUcB?G_tWt}&YvfH^tkT^k}zg>vE$a_9}lsKnL;~Iitm@-
zchjX9m1&zrNA6Q`k;D)U`Y^Q6W4+X;$jP(cASvgyNltC~S5$lAD*Ro5F;Fg%5al}B
z=%hjSh{pnx!OW504-=^;&BwXlWH9Kkb2sBrAI;xd*fS^C)RykkI^K`Tl9Q{ONJiyf
zs^&%K&SkRg#6MoJxZcYas6@c$OkNu~L23fBLcV+xD-1W>N!fSX?wX!#pa$g#prBqg
z{2Y+-c(WuO!02N>(Awc$MB}`Eo$$uZ^hj*un?7*|(CTm;?YD;`8r|FBC<sNQYOWSy
zcNk2AL3{cWe61Kt2Xnf)44Su!Mf`s0sc{n>A)Eyx@VR9Bi;He};txc{&Q6hGzNt`5
zf!d>u!+%t;N$tS@);=cDoxToXhO)DxB1aCb<UXZtq#hf!=}mb$jNyqjn6eDvhiCM;
z!;E_kk$-e?^hIq7mY{Ef=(GrUMxm->9iaDgMag^p@)8}tkc`9QnezPBLO-=6+Bw`<
zkT+(vfel^A8!y)Morv-6ITf;-%(~Nq7#-&L_fzTPOC$S52BVFG8gd+Sj-7-KrH5aB
zs-)T3bZQ6cSU|cbDHmHVlJ3~6SX8L59CWO;Nc#3o=VqR}h3%(q;ja#Fk3nq}z^zEe
zq2A4ELCOv;rxQzJco$p?<diuw^0?1mLmb;<n0GfHc0fc*+T5XR0Ey(4!}Eg)5k^&D
zp2$iGm<vkT^eJ@^Tk;r+!dQE^W-o31foUY<-Wr+H!Y3MY9uJf|OX-x4K-4qFg~-Gq
z(`B+=L^Q5#DF}bfiQ$4|jJ}{mB&Sc5&D-Jy*q1NnUaZ;BYD4OSkA*+m>H5&Rm?t}o
z<nTq@E;Z%s+m~lkQ~{B)L|T`I*ayJ3L;GfpS<g1T4blIR{%Of@CkP`G>;-7*RPHcZ
z!?`-d<hhdnTr$<+u(sPoQy%dYEtN~7K;3usSK|ni{M?KT+ZNN+(z$k9najq9VI-FV
zK8t1^yQ@a$4CN(;t%b|EyH3ZEQeFr=Ow(I6?x~7o2f{5Wa%Phgw5C1p%ziJ#fqqMp
z(HpXwZG4C%W|h-F3?0r=rK#W|smAEU%^nainGh9K7K}Gu+-@hi+lhchtd41%4XQa)
z`j|Zb7eoI#3@TLn2xtcB<(2nIr}(o7m%A4x$VwX0fq1>iz3W(N0oh1+gQmI2-JuLx
ztRnIQShSt5wJ_;Gx%Yg%y18@EvK(++gV_hYkZqHan&$E{4?ddr#+J6oTk$-32uFSz
zjFNB_eltuQSS~z8dZ}S#Z#CbC`DKsr%oStIPg_;11}2C%DNe&!UGe*rYo(<s8XYg>
zhR@bm*h_xl&P{oat{R^Rc%0uW@%J(}p7~t$`5v~;o8UXo!81zyTzF0*$39K1y#G$E
zIKmn6+X0K{yoe7MuL8*%8ooZjXJZGbF-f;)$1QXD8}IQTxR3^~Ulp$;DR5yZjpLRo
z^sWF^UZ{M4zUGi6yo<f0htsG{#o#WknnCYV__Yafh|^?s@glajHK>SW>OXCbD#12O
zNZM}Q)Ro@#TQ=tK$ox$*dz<V(ADyMPZ6__-iT9~Wwrb18-J&6C)LsE$H~QrPTvY4G
zG~~!-{g!Bqi$zk~LHU4oZfT^yzE1B)L1$_fTB%1~cJ<$DjPogD@y|6TRKUS`SMNuN
z%E6_&_N%A6I%xWP#}oji144&O*~J<9n&~C5qu|mJIa8>S2BNjwi`b+k2Bg?G+$F$_
z$`EQ`N+x1w!W`<TN{%qHv+@PMYPMd@S_d?rg$|zVXf7Ww3Y#|9Uobje>_+OMC5h2l
zU!><>;c8K!&k_X35;hh_bc`D`*Us9}+G;dU7<;fO5?J2!9)zy3VEEhCTllay(d&JW
zU$J5bpaPVFK5SufYaeveY?=ku+SiXN8Q><U<@s=ACg}u45R<o^j@K+Te`tFApPsA#
zWG?!WT$q*Q<hM&)`am!=0$*Z_kE^h9nmP$IkXjy~xB@kW!MK$RlDNp@^84E+Nbh4S
zT_RW*RL=+-8vvcFDS@};+I;am2X3KipQVoUg#4nWWuym4_Kka9h2e@4L?qFonfTf1
z=tnx<G>nv)d}tm3T8X`x^12;EKE7dsp`Os&=-8-<OmxJ-<qZg|FGGspq>@#pN>P|{
zRG!T2lN*#I-}DsBC``+w(g0~-1uQ#Ap)uFYr%iBE+n#Kt$H3JU9cId>=bO6rzvh~F
zlO*g4%}t+J39lg7rH8gQPJbi#kyMZ|)(zBjkmi~4?mqB9Gg>yX5d(lW%knxCVH%!W
z?nkp|Kbo1LZ1V14^#YC$ob?8ZuWxZ{_>blQ#!DVf7KX`eeg*?C4h|@SCe*_9sPGSX
zZaH?7dcQRD<HQ&XYDQf6fRIo|mViH3z8N~5QqQQ}qJ=?Zl$!oT_L9qobj*@38+(L>
zZK7jnP)9+)%3*@Xt;>n%hhU`5{^kN5aiNqKBcw0$p5?>84pCy7PkH}o0ndPc6Uwm%
zL|_bI92d&#Uy^3vQdNi6v{OP%h|A39DXPXGE9}x6{}K9{3s%c+C+{mk&2&}OhI<al
z_g3F0q=}fAnzus#r0DAr)EZAPY!{4H-fN3wH7Cu>QDNVW9!J|E>|dWF^Y8#5IGFlQ
zfHNoS05fjIn<j)~E^3D2!xkP|wIc-s&5~rc>Sc_ps@za?X6K2u)P`d(>)+VoV{Mu+
z9w#lsB6YJZ%9oC=+;8rdOa7|}{=wbM4JkEupvMpJ*LakGvoF6PF(gxDD@K;8Ygb+%
z)DeVWRiRbnJJ-EKm0+-8rx2{48HrK~77PAf*lUv@M0eV0(@CNCg}kmWu!eNvOB*zT
z6n5J7!(?cI8Krk_vq<l#k6IR`@>gWY9K6^VwdQwr9giyYpi7iy^;(LWh0iNzUbKMM
zs_$H8M1WUU<0Rs{NS#}~yXcgt4&1g?EB^PPu;$tfvcl)%|Lm0hi|A4FO1rtInl!n>
zI}7SbApQfihZDoHyWM$vJE-LC0Mj7g>4=WTeyha_rsgvH99P>C?Nj}7D6ohfCR7r*
zNHjahnirS~ukM1Z={YM0V+JcZ<7Jp+Y}O8WDa8rducEpfwTT82x6|Ae7o~FMNs&?d
zGIyh%q7Ftsz-=LZc8tQ-_U+s^dtD`qI4#0{W4qT=ClGmB+fEi<C~67XK8&I=9uux_
zSt|UPgq7o~RB`aiNgdPZxqbQDg0b{ue4e!>h;@yfVDt<OOHuBimRETDA}AF7&dPGz
z^tco<@^+@Wa3Zxk(oajOC-x5}0jtU^Gmwxz4inwf%ZsGOmk3_%tu$`KpYWv7FVW~;
z{T7`r6QthnlFSO@7lX0`@`6;vrYME+;HOQButb~XkoW2cHV+uKyoIm6z<~J05x4g8
z^JAH3Wh31ydh_xghKok;l$J`++2N^TriDA<N1~}rj7VGGZ$AhQ;5Ry}KrEEL=Q@((
zx3naY1`2dJFvNoU@5OMC*Zykii~nJUOI{p6hEjT{2iEF?EDGS4nc-zL?C{V<y$RfQ
zAcCJdL?7z)quTS1=s#M#W@!-r@Paf{_T=71Mhx#$QXtOZ3BO!X6aQUuv#l?3ub+>b
zeLq8zNH2Crft&i&KD(M}h?RMXtT)@aXSr8jf)1%l$AkJM0y!7XO^C{<QR*yt^g)`0
zhzWzMzF0CH3YYxJ77I>QOF!VMVVN^hOb&Et(B{)-BHWFkv_&+0r{Dq_Qc3Pekx|u2
z->3arl9Up>{(LZ=5M)nctz*XLrWXQK{j+x_`g@JSv+rW^aKP+C_JMFXc_!K~uS##!
zu;C_K*OD(ljJy+5M)kZ5XCv*`6fO*qRWPsfceh-cLN|`YYixJ>M#dK*xx9jI9{ebe
zu5SdBB`PYu*5ejT-i_G4%Ti!g<z^!0RBugMiZD+o^OpX204x@W{=PkAXS!LykCeAX
z7jw08?!4)rU_y_xt7$J}a<DyacghrJ7-I>Zqy!eGC_F$s!z200&r=?XhINIm2wl1v
zi*#vF4?o6lVwd`Tm2$fN_htESC8jy{gj%TsAM=9An*hkSH<vFr+`bx?ekXg)%EpP(
zG5ScUu+e%zsLJ;+hSk!-i1<M;d2;DKRO#5^E9NODe2{hl!0}DyE9sWv&3I%>J56E&
z9z!*=AO5W3Tl(BV;VNv0D3=%@FIp<)6k>Y)w?#y#zMhS0yY1tbd^_0RX2i~lH;#;w
zMwsfnnPBnPFKg6)n+*vol~X{H6$U5p^tbj~J6ET>OMBg}_zP9F{HrP}wrQR#vj5mH
z!>STJ0guPbh`Zq)gGl5-$gZC!vOi5V>qp^2fmmJ49j_$5%mMVg^LaH0?M%`m1nAbg
zsehMr=<_j~><_LkIXwZLQU~<mj+=A6eDjDZq*)EHT{h~~5%}dSW%U%ZoNDi9&%DIK
zuD6`SiNG&1-uK7~n?{tnl}3^G3$2nEmj$kg&h2}*`8-gO8C&QnX}ViH(4!!(X^<<?
zaW!v+KQ=v(4F*(u%oqts5Fz^?XUqLVto8igeoIDKASf5%WAJt~>j+%)?0HuG;BjA?
zg&`0*ZY9wBcFj40Mit)1g_kF5kf|oMUl%I;&YjTCHlp936Q2(E23v~l6K@B$5Ox>H
znGG4dBu~h0YN80~o>AeeL!=~gaku?Z7S!KfrohZ)cTG*E8_k12?`;I%C}$mvt9d^2
z#8x`n6O3YzvHexhe{jZ|P}Cc+|3rcA`*YAEL0I`1{wO*z+@5n(2)RwD!8WS*$Ycfh
zg+@GoMXvwjbvQce$<TOTveyHI92Rj950Jj{Hir>{g<if|SY%EfuGj!<$O(v@&~l72
znw}6u4Z|J{2|mt;wS$#9(C93K<h2L)UNRJcfbivo_~qO$b$Si%3d~ghY)Me-1Bi+q
zhF&0i_GMb5x!&EuJmR9mYmP75Q$ykP3$^2FWj7lKcq6vLBRfV3l0eqXk4gJ33Ceqq
zZD4*8t**J8_P?jvHi}v)MjInrXRtNnGc74_xF>OU=0a>$@h?ztW{c`0oBzHjPsXQz
zd4r<?zi%WB>Pg@|;?`{X;Gs5ZXU)o!jedP1Js&j)8jZvksCl{(HuW3S3~>Rdr17>3
zxg1kLD)b+w_1_H)N)glcQ})-zS)YczSjR<x?zREkQ<!tHL(Za!h;3!QB?nJYG3Sy|
z&#Tb~UOQ#R-j@nMa)Jg4X=lF=@FO2zj|^g<<Iu02OWWVl+)4L2H6rsGY1c}OyGj*O
zJNrUt#!v;!7>{{tENk$VZTOVSY;)Rz8m2$))lbTvTK?uXA3^sZFuPxgnEIdh@vr*d
z^a2-ZZf7DE-b@vlFDFCD6l1OvHzlk-(ow|_mxYFLm`DXcAQf$jBeNYxirKV}gr=<$
zdBAHQ0dU_R!{8gt^P|rvMbJII!)2@xm_-}E|ImA_*tn(-7OS$pfNBiQLx}vV2B%po
z&PZX}Uei?^q$GE&D1aGCHcaZZ*5tKV(Hzm=Z4!^Pv^lP#d_=H2cb5&H?Gqmt1)^<-
zSsTo$Hw{rwt8>^7KbYynDrZQqYs&rzv1sFl{sc)4V<9<~ean4U_FSwyJ^atbN;7UG
z$```&&7!t9Z7M1QOS~0%$pRYkjajERKUJ+}QN+H-P08?=gkH)l@}O*Q<9b)%n3m!f
znKZv8X*JNLK3ym_#Ap}_pUQ4&C|;U(olmOGc9OSZN=DhklW{WIgr6>M<Qq!%&_+>u
zU-XNv=UbJ9*Fby6oNkWXJI4>LPDHI!Y6Rj6Ccp3uS`lIN!=991!nLID%3T-5YnscB
zsmHY`<F;4Ry$;l{6C-hbt;H)A!JU|Ab1Mw5B{qYer?z=d#c=P;Up5TFKH;)5=OH1T
za`!A1U>8je;)`<0MNXH;DEg&v^NFpEkHJlyr1YKupA`ZA5Dh*Oi)G9GX0|O}0qq(d
z-SG~2GyDq+rG=Z}H0Ru;_JH;DJ-`~i#1(4a6)YHY!~Nn#-Za4W?)NF2V6U;mFROg@
z96v%S5+yINm=j#Y!tqxRoT-)*_%THA2Ok>T(%7YvET^#Z*EXbZwFpYmeHA`|qQ+aL
z>nAj)^K3y6-?Ys9?{=ReVt>~U@BE7(nvKZR?UoX?K+&ubXq{B#GppT4Fd(H+CU67@
zAfV=L52>mX+AJt;mrS1n)t3lp9SJe>$&eLNqZ;%V!F@@oHhMC8tNGTPh59DbBOwWv
z@@tVPLiO*E^@xevAnzjquERA7^rP{|p!Md&VF}hxMn)rOfABmF3oK`%mX}mzi!9w5
zX`9|U#IyFo<&5M+!|Mx<Ubnu9H|>mBp9#z`?XjCWma;p=WW5?L$#U&|enVFN3#~R2
z?j&&=)m@<tdti4(Cv;3q^ywnx4(t*rHHItdPO+e6M=Z2QMJqtl<8cWH&*)FoJg6v(
zSB2z<KNp@_1nl!b7W+QAped1YXI!YRg-Q!JD-%aL^zsCmkfr`4b%em>gla>Es3Y7l
z1)89TA9WYsW!o20J?#j{R{#dDhHlLv%l9WM2k)fs9=bCMQtusc#1Czkv|H1<r8=4P
zMnb@HUwIoXnFYV<eT9ld|2EAS6hKzXu7Ca!|357OP6Q=sq$L4IsdE_&YQyo&DOzpL
zOO{E%^run7bLp#VmPf2ieMv5GqBnh>B~%vAfxe?8vsls5BCX#8#t%erv_i%ht?7@$
zlwFNtZFNicQ+~m-^x{LuSTIVAV}c&kdNrm)g9ock<6v^4+Yy4Zoz-ZsI9Tc!OsD1k
zFm%f6h4{fp>PX)rw{@2<k&X!7!`HY$G8H9HYOSD}#WTgRI}C@4?MpcppEIPG$aX?j
zXDHZyKZd2A)O}ZhwDEh6)g$*uI@F&zub<s>|34w7w?r~+Ls02s-)^5ePv#QrM8R-r
zN;YNc8o^+UF{@_M)_}kKvZ}qNo(D0-Raa-EAQTOwoEIh``$vHYhm_U_Iw}nJFb(P;
zoPm2~zO-|w&L~BehNw^9I1fSnW7^$*jp<*C&Y#q!&(Z#QsmFIK^B@ngEcEevv9ViP
z4BiCvfm}@G!yVV`WU05t^ee*jd*>)TaERX9WmuUPIL(Qh4naLLcn(XPsV96Fk6XS}
z*__OO6LoB?j3Vsac+U@{czE&$=Xm2cc4p5f=KSfzls>^zwh%sXklcwXtBI%)xXY))
znw9VvTNPyvDADAB0nWceM~V7T-Rb?03ygB;;pr$*DI)p$##6<>oqI{ccC#^DhT2h6
zfiBp%@|*syOlQp>8EjzXr!89pp;e<kpL2{aqmmvxm@(obZCtyF;52!)X{BhyudB8Y
z(4u(=AWcHq!^;F-j!UhJ?%v0W_;aOw#OTHSA%=g{*E(c^zepnTPl<-oWMm89BQvDj
zPfbuO8HiVL1tbJ`)vuz9Mnlgnj<6|+wu})DqYj^a!{`6ImtmNW;rP~9+v6q<*W8Ig
zL*Z(pE(xw!w*ZWSav>ENI+@|TXtV)%34|t#4+@5FLwVn!*zF#U_Yo2WzmzFXC!CpP
zQi<g=%5INI>0@!?_(f!_<^UfjS~RcJSN%PF>!cHhEOa^91;OQD4zCL_Qd2(EZaURv
zwV&Ntl26^`>Ohn>;ayl5wat>;XGfkvoh>b-4(D-it;*ZN!(m$?8u|sh-)H;kH!|DX
zK4<8Hn_EdfY4=cq^5+`hX^ra3zuI_nJ1*wS5bXx8Ra~2!+pXXtBQ=?NB&vD<Qt6MK
zK7MXKA{hYD2AQ7}G&aA=7Ea<WwrRhf{`x;Hz|j%)#n|!$D5$WPRg9DN^M$gv11JQ~
z5Jpdq3w{tHQ}ghIj1?rnZ`%uvRV-=02tw#+VN(5l=iMMxf@j_t`|8`8Gf*(6NvPy2
zSAF@$^cKGgVuN3!_3MXj(NMJnxe4`jMcdyJ?%b)H7a<p!T%m8;Uat%y{b}+EdLHim
zH!+_gt_W<8Ym=eOrv9}VQ>8`=UGDXj2`mwOO9-jvdR?D6O2q`z$YoT}-J_M1f;jWW
zU-~e-bmHcwEiUWID-=T~1$<%@i9I1a@t~ABDh3Z7vvtN;;!iH5X07<t=A@bmI1}p;
znMb9`eC|aS1vK4Q=|p>aBa>YDSp0%(j>>T2A|lB+FKSL6oU7H`NM4#+zndXPn{e*w
zFDkWU{!~ekdulD%+wq<u#`3u%7WsE58K8wA!E2<BczFpKc@6BdBW@oNP}`Nw#XIIW
zQ6C~eZ^F^8#6|Qn5DOgYN74QXS6>pm0aotwR`O(P-lfKX6PCQg3l$H>wNds3zsn|l
z;W`*StTWG-ToI~;hqs4C6P6KrRjoUQDzxp3dad4rIy5S(r?kL}JWO1bovI<as9)2W
z#EZa1Qf#>y7d@3B0Tr<f(Q8=yUZgale!iGzv~mFcabhXJTwmW;D)1(L(@VM9gR>g*
z@zn69q5G%s%>R*9{sOF(Zz&?xK?+G&F3V8hpyJBNKyHp65oK8JX%93GfY1$H6{o*@
z2q^xR%j#X=g+eB+;;?z0F^e0kQ~zD(<OU(^%W(`Z`jN>e7~{F02S{;ycbf@A3FbDE
z+&oM&Uh!!LnX0G^&fKs+v)hz6L;da$y=Iz}IGGMkQp(W=lX5e)_d6-!2`P6Gd!+|U
zU@?{M=Qd6<Svi25wLd!i0dQ_$ow4-Gg7|>2d61h~*Zp^(dw!c^a{t3nRXc{#`~YEU
zyY6e3dhvl9v3F*}(8tc_I_#g`_z6CUM3zLLjM~!t_5-~j;+I{%BP-^QekNQJ!=nU-
zh5#~!N7YCGgPfYcw77{bZEa^0^`@<B-W8iDsg_KiO=q4H8txK2l>>LBjhW=A7P}1<
zk?L3`PcV#oco5BqI8H8X%a<8gYQ?o=Da@t#F;r}``D?7F-Bc<Fz1(QdWbSn>C#u2T
zNYVvw>8BAGf3Zfs!RFLkrCD1ILD#Xo7WHJaN8KUo0{UUNTNmpDnR{%<2->>$8<@~A
zM);mpUmcKVnp|n4npui;;y-xXC#R|X^G>yPW<P})Mn$mrrB7;5GLb^#9zhITtF$3$
zoGylxo+X;)R5vlTh;q8e5Ch$iw4Il$3F+x4&>d<HSG8uG0hfySea7C9akvUN<1(xn
zQD%&cN&%MoMfU*XBY{HqD{RxjFJ;NeJ1dk8*3uV9D`7R-7+f^kBiV^9xE3v%sC*MB
zv&6l%l%LWNQhprZ(hSF6QeC@i>hUdip}+JSqW;Do+l*Ba^U;US*hW4xuZ%VbTq>v~
z_*QM+mW@k0;yZmj=bv-RkDCw2e-n6rtqcEbywq|qCU#g1>)P1+-r--Exr7^6%>_^L
zI=gf3T~wgQm&aD`7276OnV1|Vk_L;^Q{qf@Due*PL%4ce#M@mx>C{WB9FW_gt()FY
z%FS0Ra6TvzASADmAXCGVh*+>1<I`H%$HT5cqd?b9;qcPQ4f#V@y6p)=7gm*=u~(6T
zg;69AF0WdlnmX;9?(?kKI-HWOnuC*yBqX{$`fcRGfRWhvZob#q*GVGu-X!6M66eS{
zQ)(p7=jm^Q_D^;LZvCo6za1kxVkRhGHaE6Qc9W0Dn#ZoOUMYjOz|7E;_q7iPfa%zF
zB+|)KV&pJ){%cw_{CM4d$||xY|7<Ox8tNHAC)%*deE2L<w@F;k;=4Dyiu6--XMoZA
z$gMTqeuo<Q%0D1l`|jq#g1I!rJ>#p9H;!xwV?;}&dTBKRD#}$gOXE4!<=HQI>`~nP
z*d2CzhCU-WB*ht$>WA%A|9?DPg+o&h*A^5h0YyquLTbWjkd#JJT4Eq2-Q9vTNGKs7
z-Hh&@bc4hg-OWaKjBo1u`~HHv-Fwb?&hwm7ZJChktVUCv_^4d#Jo1+-|Lu+WqvaEF
z_;xg<w5cK9#*M-zzvn*`i<y6*-T#HlZT2#FXxO1d=2<Au&Z-e+40>>XhJ!9LzeG68
z{}}zHuA?jmHvmrp8RjI+H~W;9(LW_uz3$44ZeJ>z286k|G5wWXlk2O|NA3P%!PD;2
zm-cJioaE+Xlin7sFE97AvC3{JleXqix-hVBzBPpZnIJmnMb;e;m3(neZ`!#VQ}~w-
z1^GrbzHwT6vUl^B(^0dT0JoL*j&mHN(A<W|0Jg5bt6pYNwXlD;gSMKg=P@E!d=y8?
zDw4G}VhIuj*tKY%v(xuZ!JLxkl6yI@&Rrn7eK=`RW{<U5zUk`Bgs}m>o;oxu&R@s$
z#ed*<I*zFyQmSWQ!sHs*UB_4HfcCVfooqf4@m9c3E{<#mRLNZY=rc=`(t-qr)Z0?r
zK+4x?OVRVcS<PuTKTFUd$9@BC`LYbSGO|mWm~CHWDb6e3h!T>RKCAvnxQh|z?$9oj
zNFabWOlg{2^(BaKVc`Cg1CMD?fkAHIy3$xg`)9Skvs{4xE<BA%knySkKE{UH>BS$t
z7^RV1jjI<}nP}9*n3kai6(-F;;IZB>rqr^?LaXhN3wvRgt<wby_5fg*W|HXW<?uXQ
zCTpRezzKhrqL|kxC}#Ye(r7Wa>g9scL0M%6`1gx1E6Cg=(fA6%LOjCCMnI8*+(Oh{
zD%=Ep{UfLcnO)oPm_o>OOO}_THV$Lq-UzeSM6c3JHo!aaO$fGl60av}2~V<dhqK@_
zvUlcj!f~cZGO=vrP$CuH`J|-eJN9;?6`ZHd?8v`TEGeo!@$cxc=^+Nc!s*LdblLE3
zX@+ABcmkE;)0!`f4}QK4xpk;W<Oy}UculU1=Nj8H{OBSaOSrNy93!0G^?`?xgD+)7
zBE%;j>}pRvOm1O&MpgRBICYXF3j?E~jBw(~;Ddsw;q^%U_6KdLZ<7i)O$_QD*C%Mn
z<r@`7d<+#o3p(MHH+e%pPnJXaOL@9n91&t6Ak^6797})`#JvEG7wvfYMpNFj;-^Z1
zrYJG-MT`7hWE{3o7`tvl%QTaHz9j9+V{wS_4h9tP@5)8ee|tIf3C$DSF#E8+6d2sN
z&NB1_-u?h+$Bc2<;+Q!L-*^b7je2x^TAj{pBqOj}f1Lc0G}lU%Queg03LOvgyqvN>
z?7^eG)2|j5Z(}pd9!|6Ve1STh##fk(owl48Q^@>&P(m&685A>Rn5ycBW|)@FlZBW3
z-0NZbxq@;}@RUqmIM2q9e`xvbOA#ZUV(G+~xVij1oXuVGLc)<T0_#}u$4D01ucL=e
znj?3aV8Ou*0N@c0xm>&p3-LVAsxT_&?fZgFSG+i(qrdy&?0^1m&dEITVe&DHFy(8l
z*i0t8Oqmokjlv|~yxmTEn{^XOH;u=(d6m4jd8*JsjUqPo0IK3gA7yW9NE=>()YCi3
z<U@$mSoPlJ#!3tq&St&|nPV*DCBwf{C4GDrF8B1w(9Qrg@n?Q|sUj1-Y$ZRx`URe^
z29sD8hQs|Xauy`AmY3~?_=Dy6iZw8$-1wbjaZ}JI-+g6KqH?)aD=FVK5rQBgUCO8n
zGFqSwK9V)XfM@P61HJxVK=6NS`b5SqYptQt%{Yusa)g6_)ir(l^nO=&1^i-%AuQ^<
z!*<JB0ECyB_wCcD2o1(xvDjHoM`hwt?-1<?Hj@C07&9XMok(bq=PnK9SAicS{RD^p
zFCkU9<98Y&GUPImCGlZJ{p7(P`;0BZ5={kV9#~|t;SV_%fCmv=HC<1c1UQP->sPaX
zw2*nO?AWDjXI81KJibB+=OGypwhV$4KTj{W^D3(O6J(0F5@edTpxVR#jg@>X4C;6P
zcDdmwY$Ua+#8~rz?JX0!VwchkdY9Fc!Ns62be}gV4A#zVPvZI>#RUld{-va&5xyl#
z>bYb5Q6EF6CDaQ;&*+gy-h96)k0+W!te8L%UUThzvIOi`9`Oa!yY2P!pV4IPv7$MN
zx>;^^7^B-Rflf{5n5|>9PY9Ay;=Ir#gCuyUNR)^uO8SIA%n3gR2Jbo&p8J5M5055Z
zjy&f&B1*%>!X4VxVlX(e%3&P!ezU^%x2XUB2kOQGw-%+NgjXyFVt+)*?qStSl4d3Z
zxKc;m7BnV|9((<G_Vm-bZF^~UWPYZgdH4(oxv36HGw7FDPorA15E7}mWO4r%t@fg0
zn(oVT&N}K9@I@>Ae8ke#7Cij}b)zZc(^6?4v;Rn#M+r{Y;djyiPK<|(B2*`yybAAd
z`GArln1q7zzie@wUzCrjSqLJQl!QlqbkX8ARe72~AI!Z?Sov7I>av6P@`kF&?>N_J
zc4J=Zj<hk?OwYE9Jx}lJ-xBdZRjj#NRQK(pA)Kx!Z^9*!sv8{HS2H`y`j}+)G4|+=
zvf1lraxt-bWMo<KBOl3mA~x~AI?!S+N6k4frhZ^>3S7@TKEylIKau&y^YmS>TUV?>
zA9Gu)^+xW28^+@Bm!W4$eczrGVML@S6N}3XbE}hml&gyGf8hDKyt#orWUS$tOobEr
zeGu_nkQ3Mzz}7X%)$(#gi3iCO6gvLmja{??ZgC?wOk{QvIQIabG(ZMdt~DP0Sb}vq
z({3Go-w1Wv!PQH79rVD8U^|c*MD}-+y7qsY)N@{~JdQJbfc-5ua4_f-6BD*N5k;jB
z1zE77*N_n><4R6r{O@OyJwvqXM3h^i>Oq{#0yDG@L(>)O(kA3}o(x(Rpma|(OyOxr
zat7HjE}z{uKU$B`!B04MK>$tpcD+oO&rqObTJTcPhAWf@k6dD&k>ta-AC@nF$#z1!
z8@+<zxRm0d#bdK#i<H~csPg?+XXvl0ss;VC4?k(#qh@pT*BLg|u;p_4d&&Yg*+C?(
z7F;l-|9rkno*z2x-wWyrfBQ&4tTBoGnB0w&G_BLPkadgmSrtM?wf(M_m&(~jLPM<;
zi<WU+$*ioW(~rg3#+?;10TNhb3Lm&=fqm5NVn2W!+^@3Pgb29Eu-^htuo#3iA3pb+
z=2;Ot5+%I~R@}yrc8y9jrW&XgQ05q#SZ!X`%jxP9nDHutqqa2WWUAKO+pqRL)8U%_
z?x0%prgpa7G{xZ7X3A^yk!shvP@?Vrew7F5W(xTOKYOV0LafVci}bgzD!+_8%aBQ5
z_&WiF0+TIyJppRA`-%Jedr~i~(Dtr@Uh5JJS2QigV`;6=sA~5KfxsLQoqrm7majzn
zxFc#S*o%D2tjFRM*@{80(72|*p+Uu$BQkU}zccj9wS2ZUXkDwfeJv9BpB7N@mDXS;
z179;v*j?Ec*(j9#OT@2_JaI*oFF*Ay;G7wo!ySev@;D7&_iKLxTC0XUS)vKY#mjm8
zvZkI(;uHQb`qFDL8;{GDY{qwO)gjOym4cj7ha9HARVosyalX*%*PAe>KX{}XfcsZo
zn){z1o3r76w}j;PIYj(s9C~47dymUp;bedCWmP25QQz3?S{NT4r1Y|2$phuWmgA-`
znEm0CBA=ww4^wdsz-a8-9BN6`viwJ1BhMF6RsGVc5n3!hCq1tn$;Dp~?_wYnnBvo^
z-|2B4h}inQ)7FxRx)f}OIuX67kEe`=z;J5ShLK0c%kE%+!^QbNu!ro{Mw(^t*Zmb)
z{&c<m6<Kb9_b2zq{M;)PuYGaL?^j@e$HehRowyQcL}Da6S^<uvFFoDGS5qL;cWWB=
z4iR^u`}$+|Doh6W>0+%nxB2vrB1d_{Fhc}#Eucsvz1Py8EZ|0k#;&?)<L|rpbN{9a
zbqgbBV`4(DPSW2!P$0&ixjLGL$%A-9me%fuQ*`Xf&sT8dgwEy^1xYiL8E&f!(-402
zNl{~Y&Wc}iM~n*WyWxWd__&(}eD0OqwWYQ_Y>ZQ_CTG7vKR2Ms)uMhS*E;v+S+mOV
zD$LTc@z)44o%qW8bb<cQ)NF$9f5S{`8_~WP%%3^@MQEJ1Ufm3FljE8(Z!g$yfT%5f
zwRn;swl*!)P4Q&fZegr<7Gte=vf++jI-{I#T-asy168*?9XWRH0(MyzFAx~^K#o@0
z1HQJKU2lrr0vm<-==*TDlaanbU)C-#;pralKI}0_Z~6oWb<*r^5LIJn{4>o$^6k0b
zO1r?~&eCChJpsr@80fcF9^=)5kwYp-lH}G>(;zyBNh{^m(_=nu_>*`3#^rbEAWe))
za1JeTih0JIcg<GGCa8Z)wT$<@d(PW?vJ7|a44%{4kN&dY1I+TKVELEwh<R6Z;&sMA
zE4M#t&Q|+DvNqf3-!I)F0}H@8&ZLStHYZ!m1L1zXym>|Q$n=$6?>zkR(aq9H*Ov<Y
z<<)3UAWeO3Q#4JNysWC?nKGKaTaE#yeoxOke^{b7F*8rJF4nbuSrgxt#SKNK51NX<
z$mKqf>Uu?e!6%U8)Y!@HaV6?3I*P&<$Uz)#DXPX+mbrKU*ND)I!VrZrnt&4IO1v0l
z6#wG<rTzh;OKSH%F!G|9-XI!^)uq7cj_yk@$)w-2(N!HA)5mUjS32Z7tW)h9Yuvx@
zj<<Cl_cWs*?z)ZU5~6}y6xoX{QVti|)EqQHHPj)okLvYh{DJTtJWtQY^;-|lZ3ClU
zqGF@=Z@#x0;@m%ec^jj(ryyM}YcS9(=zn((7Dc+lTfDaUs|+z&7sdVbYvb>;5<y`b
zm}2iW8LkK%u0t~Hc<DoI5B3)13%8)6<0r++&3-q5sBG&gsx34WH{+0ALvKYt82xN5
zq&OyOB{0PvYg3ge*2n}Z`-7fHjkkp<@<!49talhGIizj0uxY>qU({6nDT{yB*}%KR
z%mnwL0yj{1_xs%-^Yf6!RmEL`LEMOqiS|hG$7_;%@LJ6#BXf`CXQ%E2iSfX{Z8xx4
z_!3GZjrrR@954Q2hTu6*tmAggVcSzWQmjSQ38YpkXJUHRvinV?d??mNJMVsw)ad>B
zLJx5ZeDySs^D1xn+Ib^2p?~{zN0}@>#}{5c<D7ZC8bqFM4M^P65lQ5z)d#j0@#3Bw
zC(!fm2`;nU7G^&ZI^1_&EZJ%)8l8q-iNt69SrqN1H<dJm3gGWhW5IflS`;c0(?^9o
z6OIBdZg}S@(3|O}Z!VCB^$@IOQL$zUho!8{NCphozPUg?kQ7>N=3xYv-9h2YCO3e9
zny1adnZg7gjnu~_o$R?vwr)o+`15lML)IF)G{@2p1&}A4<&AOY4Yh{?LP2YGH{Wtz
znUk)~hTrY^&iqv_?`cq`9utRBj_Yhvq;7?cLQQiHcUl;uzlQ;U1Xt)m*^XN|aC^~(
zM{}ZG0Owo^P@xjOF;X|t&}9%aex`-9jJSnu5NH3E8;NDP7Fh6l^9wnEx2BrMP(iq@
z>!?|a>Zd%GmvZ+dFLuy3u9iB9`Wb}HyQ22`Ya3Gd1@dR<j;EPOd7C$C0!I?1GSI|P
zVVu(_yFq9N6?RtzR#*srlKu?4qOMGPx=gzH<E#fzh;i@#j?h7f6AlC~2HD%oF6WJV
zG@hy#!5HuAxtFYCI?j`pRCsGeV0y9$x}~T^+<e373LIZs)kgH_6N7<2s*?PcZ||Q7
ziz+X>_a!{(;T1q2>TofIeVId?s%m^Wf=ssZ_)YeqI4zM*{!3rPaxg9iynx8wgAClB
z#|i$daUUUk&ml(Ht(L|}@4JoYeEa0&1?DtJyp_N3vGPFX-Tn41%<WI9G{Ict&tLnq
zX>G@eo0Np+*oVv7duXtFi&W~e0ueYTwC?8{;;QUp^~1i+nfgMgb*5+L!r`pn)q5TH
zI?PfV<E&uZpuCx9t6Q3Y9XY%1K6&7_vls4nSG(V-pm%_CTAZNSvzWDZCak$p|7|g2
z=47|^w52KI;_|=F-$C3GDc?wL&l9v){+Z-{!R29iifzEfUmt-#Jbv*2TUK13KEAwZ
zep<u-as`QYVHjgysLp-2+(vp*Ok>+-9g+P*d-ft9&#4+>IfuMBBlUm7out)dh_5+g
z@8H&X?3=)NpgGTNCY?~K;wiTD2<vZ!IN`r7Ocsrz1CErX=64d3rm@i~qf21k$)yL+
z1KJ68SLU1}Wp7)Wl&8<ISXl!)W-=+5)6!1%k`GwJ1Pw1W1ze(3jjpPGZ`NfMd@7Cx
z(M><4_1B4U=q=ZFI9vYxQ_ndV<XH1jkbUss5{aKx^GPC{j~ei7amzb;uONy155-%Z
zF+?fz=`5&mA&W*~5mI^W(QCY~htur<dD9s!CD;XQo5NcYucB;N%8T9OB#^gqOb4Q`
zAu+$#sWO{xm4oaNPK)NtME9q{_wMC1@ox&HIi9xmuY9*1m*)sGyzf@{O1p79#&s_^
z?PpR{Fi<TyH?wCOZW6?P-CK^=%&oly`CHdO^^pG?S{m*9N~y2(n^a26ZT&9xL{eY*
z<2%y83$-n(B}9yhix2ZEGIA(O)xzbS(hmrTBY$$h2v5`x!dyBCG?$#m@3?u~xQbsO
z%i<U?K|sE&wHR7m{lc$^Z_#k)yr{Sya#{4Vs^DhRprGrl_>X#rJRKC{``@Dv<n${D
zM(>bFnyw|P#%2$D5_r<={rd@Tjj#2XYk9BSr@y+F^4<t7c;EY$K0d4u))%!e^I&F$
zWSnE~Uw&UAXv5#dob_rwb`CRc5jyocL@Y0j?s=ZATpq1$9f*{Rf^P5k|C9((UL{7a
zt!3tM;_pn|xrkKjD4?gQSg(D2Ly+VraBx!VZ-D;PKO!O~>AN8?26F8&_SxlAM#R9V
z;nmT@m#cw#LUfDi=KhKsKEK=UIbt*R`%}3W#L`e0nHQa|ZNFidf&%A15v%1g^<g$H
ze~uYW=b{1owF>iH##3e_{R=7X@~^i(T<oz|SCBPIg}D#jcgr_4z%%DJM|o&T_<~P1
zkxto7=53wWi#j>?480Ov7fh5Xo4-zAsh&#TckD$G<@Voobw|M$ninlzjRVLclrJ%$
zpsRNfH+;o}P1e;&7OrlmJsmvm<0rSk4nVu=HJm*OeC&tkE5;6SD*6rdHx44!a0ggs
zWk57V%@5YDzdS*ud%}ZNVguo!A;F=Jg-xxjz-Z_b8*|GX54Lglt@;o_y6ZbHabFQN
zWtunDZh*YosQSVtFF8u+pR#grh!5<4x14YFR<*;1ReHa1K}21V=*nI51dQtfPvxI2
z2~n~~LLN-Caj<VY1~e5<gO_vg?$Kz9F&u-k3~Lh&y;lzgqu111oRw~_X!lFsN~KRq
zwz$Rms-<^n>kf1}ma>l&+fN<bqzqbTIU>GO<@iBkU@Kwu?vO2LTiF&A^4}=LePWmL
zL-^J=f1idf?;9$!5n~+0Mb_HVAg!^W_W8owVdbhX9(UF(_2jpUArCLy-fZbM-#O2d
zn^B~dFZhHGA@@(x%z6hgo9~bvf(OKUMqpf9-!E;3RxL76kV2C&hYIAmqyOD9rX&BH
zjHmY)E$QENe8PJhonk!yvuFE08O*s%kH;+#gJW!xi+0!@XZr_(QNIoLqhoj~<g0nP
zu^5qy2I#HJuit|@G`J1?TPN+8gN^o9t;Cx&(HS(>sv9e_(P8&mCN^{)y5&oihH3Q8
z?Ezarqi4YSx~+tfT~F6^vzwp(j;IK(iHhJ$v5)}Jtyse?LY2R{dYCkF4|8H8*zy`c
z@kVTsECKRyQGwQ&=ji;Wx9dIL7lXaq$YGx^wTRqr<*+3^50;$h%d@??9?$9C)IAtu
z+e+0@-O!%dffaJ_!2hNZMKA!~+9!s7_j9B7f1dc^FC3C8ScqKGP*+1B7mzHk^1ZEF
zNOm}A?WX2%Q4H#9;OS6%Vd2iXWni7RbrbXSd@2!H*W%IaZt;u-U;6wMq}4h2n09W}
z)~(f9^`4rkB|&JGCegN8<7~W<GzsaA0$-rm+HAV^{r3OZml$1^n3u(#x(_2)0rrWR
zbHT;2e8>D9w0o~S$wv-wJN3bL?j>pr=*S8E{pGEjts${z;8ZOeu<les+&G?w*BE=l
z`W5D8@6}dr!jY4vribCd(=7p#EwS@uuh3su_CDbf6%Bg<gNNi`V_*J-K{1hXI|P`{
z+W=984EP^p`AZsD^c=B>8lZ6%PMo6LQb}ZFe8~g4)}-~zaQD=`;sea!@H>sYc%VJ7
zBnGwy^J<-?sSKxUZ9VYqX&ZDo8flpH(6|n)65NNW-vQs&e^;fp#R;f;2=}!w*r`9)
zXZ6t;ax5)IzVUlP=Qj;9YBgvEdNBQAULs!qq4jZ-27H+1f}oe!F-z$Twboh1@hwTZ
z{Y5L*q1J9K%d`gzay*#zB9EItUhu;(_G`a~ZlJ-0SVy*Hvuc$%4d4SX-(42Mu6HrB
zUS@s)&3_D+Y*pasq(RcHMD>tB@Z3sWOz*hNQ&#a8sHG?O54{Bb*ND(G|GKi?e77k?
zw2Vog=GR0DoSIYsQccRyhgWXS2~)|ynh<*Z#%Ov;U-La(2a%Pl#^`OCJba|yp=<B`
z<CXqP1jSbbn=t65JHa;F?P1LCb0oh$<!{xaO&31Z2iJ`ZwKz|`Uq=g%VBL3ix6J+d
z->pPv2PpFKM|Qt`PRMi)@@rUOJgV#YPYd9Ri#hZX@24k6SPi!M-GZOFlX~14(O;(0
zED<~V%rw7SC~uzoRSxN$vsT8?cyA3XFlbot{B5|`P)>0>*$Sy@j!kS{P$k@86(ePn
zv6Lh>WaT-c;_zlGZ0kzRUpRvN$&0K0oF9q#=C^Xmzs?pmL&18Ep0IyWQKf>hH=dey
z1y#Ee{oek#L2N)a@KoO8UUzDcIAbFwoP4o3mA~LFN$&cdSxwuoh5%;`uX=v^KDnzA
za_6V%S?+bwu<Uep_I?zsGJdja`M*hy`v{`AFt3vN{ZW8$nzkX_PwLLDx~85G7J4nB
z*w&!<aGK(RF(YZ+6L}6xlKBByVc)%kc8myA3%XfOQ~bQM>8YKFvaWv|z<G~1ep~Bv
z@3ESNpG?AHcL6W}R?WHTHIR~;-!>h7+nI^^bd^e2`u9dm#D6v}b!%1QO5K!0`Z}8e
zzigVy{mV(Jmw}_u>SMQtI(ebXfh(wegWA|fzw}lBpEqJ~47<LRb=Ar!1`yRPYvN8-
zmggfdW5`;oGKC0(RqdwEDahoV?AeZO-h8{8G;=gi^SW5Y4;yS<)^W59o|IYmtnT=C
zXEW$;?;eoyJ_Kt6ivmLoX8s$fzw!b7;uClApe%%{65tcGz&sYb+l?{2fByafbY{FE
z$)R!Rz|{tF0$`?ibL9Bp1)U+$XclvJ;_+49zQP?0ycDmIQXwBr&R4G5`b4sY!jjSv
zuq|dJX17+SA_}ZiPu2L&>bK&Y`}S|M1V1W*1OB9BGfx>v+P9{b(1!@jg%8irYo({y
zA7sa<%4UBylRcapT%)WXHKIwIIr7>jEb{A~540AWyDp2(`TRXZny6yo!H&|4`cI!Z
z_EKkR(FAMibJP&_9v|l2AB0zDCgooiXdP%>>P*?0zH+E}o}H(#rq;z?u?6jwKz09h
zqQYGvDpASV2z<HKNpur8$Ix^BeAn?<&b!wfxy*MSX?fM8_!hPZJdcSzcUs|fU#GZ?
zx>517KYYA@x!mDfPv4!vAlq-x=24w64K4P8NGGZC-}hPD_jZci*0f)s_e$#`6gNEF
zu1N}?CLQN&L3NZz0XO-m&;MsO(qG0vRpyNw`}>Vb0;JCR{M~1%8@ZM#@A~}fR1Ev(
z7KJ<uME?dHw6^FQIf}`y3AySQOTR>=Bz%`o+}xYI>EZ87>c5{aG^*NeQWRD#b@Nld
zcxBLUsbO6-cE>AoG`!&Box259I9a@%JlS<x&BMGuKvB-W{>^>N{$n4b4|%@bR%v5!
zm+vTcg(Y|+No<cFbhFjd!kuTJ;vs2#VUHE<?u~nCKNtz2Jh{6_Zxd9(^DZAmenB?o
zNmP;gI!qGQmuH-g4MKTeHoW&=ZR>lx)mHSkBRL6t-}*m0mmPd%gW!-fh`y`eiUO|<
ziRKNwK{L*1@o!6XBe}^!gMDZbqF7sb9(a4#4dft~J?@fhzZFk7boY0c;1oJd?h@*_
z&G%fL@_{5^gWGh1r_#*rqb<s3*LBCK^_qd_^XX^aKrSSgowlLMvpR1S^`YGNJPSq{
zdE8&|Nc9;|%e|Z6Q3cJiS8%SPs=l;l)}<xPDgGUun{VO))(WY5X)7K%L=!Eu7KT3?
z5^=nS9s?4TU5M68wU_E&l~$m7_}pzpO}6mfRX^I9&Ol~Yt!3&Iid9YF^kK>5ut?xG
zXrFSqFHNw1Q7BGVDXcm|&%1c#CbCs?@63J_fJ%__{+|o6yq#86^@fGa<q*UCU36O5
z5{<NsjZ)V@4OA=QavPW*sfLXQ0!Y1F-P;UHDy(|*fz;4f<+iMRAE+IA9y*c)ZHBb&
z95g?>j2yjW=IuMsH#tMM49;+r+-&#;d(g~Q<rTQm-Hoj3IzS)u<E!L3J?e&+;<s59
zrE52bqcoq$&Hqiij}d0zU)|7*#tK55!oKH0pL+)+RFf%uW`05#MOiQ}aU(5xzLH8F
z#@`y|EpSa$wttK>*s_{F+HR=pMf+LXQ?}01lzr7h<7rX{5bx^wZ2Lyb!ZHaBI-;ZA
z`d$Jlp`EgjsFPS#xpvc5VYi)EslDTQR+foMGnP?)_ou5{jG_002u7bupZ?Z+<>`Tr
zuEDLuGu*mTH}@8?b=Z)29^)eLee-vXY6#_J=ZZl4vB32{gP5-FhZ{khaxAJ)aUtcm
z+Gs)-ad%lWet;7o9d}L0lHK~j>(jR%fq5rozrXzM?e)5tfzgYUFQ%hh0M#P%S5CZ-
zopi3-iGjqB+yEZ80;de0@vXXzD^NsF&>_{kfenXVnsyb3*!Fy%_SRv}i-|W`zX0~F
z#BJq*WbwUQcyHLruHVfs^4!G8=eI#z1d$qJ)&b=?&=XdFRJM4xk%2<6(RdVsF?E$^
z5NwCz1rXmN`6y#(ZY8s>4twrazi6bDbc~YUD>NT$wXSxs`L#OXw4A>}K3rTHIdVrF
z)_)E6zzwgL0KEPs7Ik_yx`%y))P~gl7IWu?=Tjm(5fwLq<LTONS37=PNFU`<FzeAD
zKubm$`+ZQ?-j+5dXLc7{s>!xVc%+e=QM==n@dEbugQ+@@LUSa|Jv5pB$GJNx2n#BM
zAV_7<ASP|_#MP+#vZhROk&k%W>!E(i4vM8Q@7Ka`x(IW>ZPf@g)O97HAiZ`A(oAPs
z?0m6%T@P2rf!k(y8~7IIqd0-c{|I(@ICs!KR2+VGOT)0IgpK(Vi%wi%)v5nT9eRjn
zc&l}d{zauR_%?0k1UloZPjwW6hFt=W7-}o`EG6^56-2)Xp(M>k^O)-Zo~e3YM&gG*
zHwGp!kYB6zhnJO0I=vScs(V!aS#AqwG-<EAB^9HKBF{T6U3=;zqT7EEWmZ2?W(8ra
zG|pc=o55hXTY{&BH<dJ%8RT8~Tf73#zpGLl_I*xRXdhKQn!>Z6*=65Pb{REa{I2B|
zT%>^z!IbQIC1y)z>L#6dCWKQu8xMuKvr5wC#j`9#M72)XR1N-4X;5O)J5x5wU^3@<
z4>D>~J;5FjuxdVC?D5xiOW+PXas2e`=BlU6we*@CGN)KqZapB}@!k(kWc9A6tO9IU
z3GjF=KncwJfz6NcIwXXZ``d@qfoYX45jsc*#SC~iHFN;6W4uo9XhxD%$1tN{I#Z<2
zZRSlvmBN@Mbc_k1E2^7f7}7Ut4JRQt@hhBqtp%OP)$30s+a>v7hrQ|rU(>*E)(k|G
zVx2i}t^~|P^pxF})z1<O6H!K!J_SM?yX!LP_MHtwe@bZShv?M6qOHEQSSc5SuA01_
zB=cgQm35i4=8esN*)Ht17p?-w*}hPm5+b@&4U(5Rh(}lI?^sfCSzx^QY`7p^HgJyr
ziZM3QcWdcABKB>>B`>0<jB+}me7)5TL*;Sk8n0=0EjY~>IXL-3$cCoTc=|naWjCZ$
zaSu&_b-vcL1^;D)^4yPjIb@$$7V1b(M5%I4)jszN+UCB9pBj-wq0dFR8gy)Pz7X9=
z?zsYs<#Iw>cJ=algTlS8AG&D<fLftt%l*p^EtqUm+AnMJT-IXzn5S9XUOQt%<?$6#
zrlS`YyFB}7_bX0!;Zz}Fbm0(5m{%hU(fEBFRjBI{Gt^e&<-+U+-PX8y_wsICD6L>(
zpf1<*$rT9_31;`acZ=v1bPEQxPX2q!11O!$IQ5lgQd1g#$<D`69@X&P^Q&h#3&$44
zS@qK@t{2TQ#?~8$g&5-YXPQmAl+na`Egx&|Y#)E#osx1cFm;K(+CL@Q&x1&}2(B%t
zMiMivKUdkcP~FWgftRQd*w|3j3=3~IlfmUBe5awnX=33Ql+jyjOsYGxj9mBk;TpOR
zRual%!mZf%Y3#W4e!e>ZBF~=fv9Nh_s1Gz|>>@?3n7w#~H@9a+M2(@^l4R>!w_A{`
z5-Zh?)CV<11^JJIOu-AF!P;W!Kf~9pYAWA7KWy~*T*mR-%1N86TJHBvs2o?lg5xw_
zziSRG2<$xaDS2O=^+kbpzIFY4+dK81D(K~|ec7^e<0qwae>R)FV1vR672+C>@;qcu
z;K1H2`7E58aC=3|1`$86p*f@F>RK?)Zf{yHO5atL?a9}6C11rA5*12yr@kf)nWZVT
zSx6>EP`MTuJZL7@lT57yzlQ-3IO#a}y(dMkJI3gZN}jmEKWu=?Q<-#(hU_zJ%#ORp
zBGNOnJmL<b{o8>=3Zb0F$v-Mt^%3*C&#p_mTscXecU6xQuqkKj84kkxLvGK1*JLQV
zn$H`@6@4y7J1bHak^%8`$N_LD3)D3(z7txtm&t%D0G{=r_O)Lt9-_V0@<~s-5yg4~
z#JUY)-NEcz1J}fMTkay%X5CCF-^|UDo(?$cZbRW@W#I}8qHUD^h`km3xCQ+2RfeWf
z&kB)hEh~el<a&P68QrgJl;ZPKPhd%Qo_XsoebWgF!Jx*4H|6odb7jkMD9a66O(9AZ
zZR<gNV)v!cA<5X4pN;(b#_NXht*)tIxXjb@+Fg_+<RZ4!_Hw;M9&5~0Q;O!M^duy&
zia0SHS3o1_8g^#an^4Rz32YX>Q@7`DdOnB$q<NR35)39+5&r$pa)WFc{Tmo<ahs;j
zAPh`qQzpL{E8&HgbK7;hi8;1*yE993@vGHzA(3XqQ69`~?K>|;>uR?$WoT0<vC~GZ
z@g)lyZj!isb|~g@&;)xRc|#hffE92mpac-uab*6}+EC8%cAqIK*hqU?(<;6N_22$@
zWyo=<mn8RO_z|_9%R=?w-1@5Knjxoh%oM{pEl8dHi`M1(=Gi%`Zm}T>sDo`E%Or+q
z$DAfxXu&jdlRQ6ZfUvFWDYENbXx^|F?<w8{1+HTDuVmyO^0R`6CADC*mu;{4JcP~2
ziTt!`W8Rr)7u7OVfMF=FA*PImy;s=N7$mtCc!ABz8zBJtZgPARMy_Pi$0teXe6sEy
zjtvU-eIaTP`f<a6KUrBt{kj%aM9G=N8T9O~7g(g9G7j=nFv-b7@J}mO=tO-><;iE4
zgo?Gq#=BBAU3vWWS!#*6c;h}G`k+}bJ_J;{>N}EFF!T4({0<H9j+f@Rz9FA4WEbk9
zRLRn!qPM1M40|@ghX=r2rvo16BGtCxpM;wvHb)<9GEx=I@6sL?`I8+8k+;U%;pBOX
z<Y-#aRt;i{il_FktOFh6sTXU@jI0{94l+)+riKyD{Ijpz*h=3|s6S#W3eaK{-0wwU
zOWMU8u`mf`G{1wx!rIVDY@NcaYOtRCNvaq+541-!OS*zEyP@t?Tb;T5Y4?u{f8x?9
zbwwp?!)tQs+{~%EZ(A=<d=~Ag0?SVY3sWmiOLF~Zjly<_yIG*6wXLa*tUCaz#s9Pb
zg|lgIUySAyyq+?rIv5IG$S9-TIeO*pBQfn!Me2sjTDc#QtYR%@y9saJ)d0#o5;MOg
z*$*+FQ5Gho4l`kk{G@oHjQJs``0k-zleU%Kz-Uh?Y^>BWl*C^1X1O|e*|p_$Q9T94
z365KB!LPDKEA2yl2Z6=*Z*zm-V~D<Yuj8o1aVHX_yQz5Jm{&klKa)^@_9Af#T(+vA
zPc_+3^A5f4u?N_6ZxPbad}2@p@TF2ee@*KCBAiL4Q<tpuPHL6j#L(1VK%%z`Z9y$a
z#$XD`Ujb$Vy1DAyEL~QE+P}1~cn~N0dVRGHmKrH>R)>)}>-hwboDeG=)>=@I*H@V3
z$LmY)$>>`ang8f)D08Kc-*Ysi#+=$s8*D2W;}H?#W!Z>I=<TZOsWV|OC@(fr%bdE?
zfo4u0<vz+W+Ej0vEbZLZ9Jsc&z1f2JVL>f;QCL$N4>8p~WOfipj}~kt3u@N`2HyF1
zn+Zimcr6fKan8q}nC$PnZw3)|gy;CKIIGk9GZ)i+`q+B!XLU0T2x0N9nbU&Jv65tY
zIlhiwNLGa}L_p5T50Qe>bu$uY$NPS9Gt^XIQNDv2{abS7G`2T}TTDN%Ib-+zu0B56
zW61L}KJPe*w45e(tDQYjK%qEB=-STo@5soxthHHgel)|Dfv<1nhX7u$nD}b_60?ma
zk|^dR_k0{?lOiRmr-thC_&x~cJ|pcRlwFWKXdbwBkXwD!rP*^I{ZeVGpc_=_T0c?O
zgzV9*@#1->z*k)qm0^u!kgR3f7;ry<5v=IyFjBox<FLu;ZAV$O=2ZDV5KQ{$#EB-f
zza6utLiH3l0Tp_rQbM~m9b4Aq?KR^nUZ0mB5&FdHeL~e%vg2IrWa)?0S2vhf-QiPk
zr4kD-La`&X$&yROaycJg(iw@HS_1i`0?o)JkomKfmNdHKmKo#2ND#Ig?{Ul0ztDwI
z{xFT`DoT3di^I(ztmNr3<dF#79&dme&r!p09RlzqN=OXI)#oJ)`JPNZ-z~2OV6(BX
zPCyT_3>Q_w$670FCebV#|MYZc)aW`{U(7PcclEljl*&@i>f)RNR8+oU2A6mGQVG`l
zG}iI00QDbHZmS*F&1+aZRl{ZYGj%pO(l@%Bre0g^jdd}g>~JMTe*B2!3~o#f8xFO1
zTY#&%T^#2rx-kp7iP7zRjV)_dtv0@qa;279^c2WTS}iWP<jUBo;y@vJv1d4_-2`RK
zc)BH|+7Mz^OK&u#2W&}Ou<@IS^GiD5?szTPa$_GCPgVpMZ*HGnF0&cn_9<gT5(ow$
zRw(*3+?_nfEr^)_n({TQ4>$92HZC*4NbR;~@%Grl6?j#=>IpA?)Xb`TOWho3j!GG9
zQW$(0%Vu=%;W*kG7Yb}oTF(c$3v=^UCvTe{_ddT$^*EPSqNw`(0|EMy0ydCT<qnWx
zQ(I`tDXmih6+68c*MTt`wgjuUx_$LtDO)`H{3TLOX@vh_75T;U{p;bG`pfwgFE&vB
zo%jLOY>VT|=8p1j6#$qMe769Ola7twTU~hs&rr{FsMNbWY2Sly$x}XGouU-flc#aM
z08d}vt7SsdC4}|Icd0R=yy{qoF`3Bilj?_e33C<i)RUd-2MYx;&JDRzOLg<|kU8$c
zZF&0|3Tcj~8u<X2)xxZsutG6-k)@j@a0xIqRc`^FxhPcQ@u2iQfbdX78>1j_^diy?
zBL?L;GZyh3HR>=3zJHwmdhSx3!ESX`g1hO-*}Sx6yuQIWg6eH+e`Am<PfjHEj8hTq
z<{ZiW8N+_`k>Wf=*uZx}S99P<Yw5^BGcMlqw&Up5R>;LwCufoJ+l=QYf0pIC7a@Mu
zgR;YT&9kJHU>X#);1Hl3?HM=h{c-7r45<b(6<5lMIHj=0a`bq;5pPwSVw><N{Y^tY
z4?g$o4ea-Mt%`$9p(0i0zmOBYCCLG1olRXQ;hh?<x6lPfs2e6wSutznd0m-JpJ_Ty
zGy^ICaCyI>vgLLZxIbay*~%J47fRZEq;TSDXP1*!es!64^uBz9yw*;U_|oS2&fZ(=
zy-0@M@O@gj@K*zx=8ob*Zz>b(HpoH;>xZi#b4`@EKnl3Yp*kt@4x|_e`YL6s!j9cs
z9O3^B)czf1u>?C-g8;*pn?1+*Hr=lubf0xdi$s4}0L$PN$&9c}Y4SFD)|G3;yzKdG
z0W9*d4zP$$+dQu+^H&`Zv?|flH(m5!Fi9vlIwDpaEs9Se{7^~U+)*}Lmr()m;1Zxb
z`1n|x&5iX-95HX1|CB35b|0wgcD{v<acKM+Si75|=09G}3fFKKu+CAw1ARYr**Gj^
zX^xf1iueUqQig98Sm^*2S2JtR__YtLnw34^hb}=OUKWma5UPv51il+Xws|v)t2)Qe
zn)yK?CMdJ8Irc`Swz&AcLLaiUQh(Nd`XoK(;;wd50askpPE?yt(eYz3S(CAObL8hj
z?hM6qZVIs?2JB)n!+xH=&<V~NJwv@A$OO}U;5xD-py45vI?^Q~sj<azx<#dryPrya
z?{0{AYovLY-T6TERyDWv=;a!H$cuY$!l-o+*Ttjhgsv**<Y{O#0*4v{zjtCs%{+Cw
zagS%|J3GBVOm{F?ufkwdb~a~7>5V>^#q<s4r#2?$!LMeah-#(H{JX0L8)560fN$v;
z(OgUh(jF;iC5c_5gGs{~Dm3IhG44Bz%}$Q78NGKJBTP(0#qXf9p%#taJ!OxYuWg$H
zw*oqkTtX&a>HI#DjclcNs1%XZQx+ffGI+_9rrz^Om<MAjsSK&6ZP;}y+QYAU6{%6U
zslmQ_)X$Lqor7_H<ik{d`VewHF<sF-X5FnOW2k2t0vC%ZCDcFjZYB569OLi({-y~p
zl_jlDPne&??W1-z5qwt`F8|kBvHbDstTj~l)1~XEn%L)g4S}Fbvk`XQcb>Lj7e!`n
z!yvqH4sGdI&Hix_zBM9PoAQZu?9g-088;$pr}-sQfS6DP5r?Z(5%<LVKyVwD6ZrR>
zzNGYOBrjNZUM3ExR|(dE6-aaH%tnCTCFIUt-=i|`KW-BC4C_fv)41}pB^>olKOv%L
zg8+$y{C)9dQI=utay#u2pkeZg4M~IUTm+$Jq}^I1z9G*hfsl*OyFIU(d7Dw)f?ET#
z!Rj5mgL_dXRbbV?Kp05#qjq^UAOQ1A=Mh~8b1}a3Z*|ixXDi2|lv|a+hjXh!XP{ry
zLo+P?F9+{!^oeG`o_5{}7kMdf7WaCp*4~!F+2*|)oP<HwF&fxbs@YmNCA&S-k>m_!
zFCeajh{MgEpLorL@LkM*W)k@!VDX0$?BKJvxNgTv!f;@wl#)=d4q$;#a2MwT{cuWW
zI#hq*SXS2tAo)T`0;|}s?Y>QKm++)?2}kUK-D+=@Euh?t4D1N;U*yWrJ-b^kbl%TU
zQs9TcbcmPOMM4vMx5ap?1i0W<xjkim?PbeZ%MQZn=Q{ar??#?>Rz=-5Cw9V$1{6j+
zy21N|XWB;%w_By^P$i5sDFHL*${+WH`G|Tu&2Rc(^`5EMuri15zBU8S3-xC1dl$?J
zBzCRV7K_u*oIcEo@Tb}owA|CBJ`MHW2#uZ0LtbQr3}qeYen;;`19w5dy-via@C^l`
z(pePo?wt@FoMi7Wn&gK6(DqF?Kc8uo2=cHUeGPq8%)U^dR!d|MwY97F)`AoN`51$T
zp8!n3{%61eVbIDf3v*6HUNM^wTSs|?{*$`ViDQ+MYgkR%^5br|X9#@`Rew6)%A7$P
z`wcg|H!_{OgO=ZlIltp?uzN{>T0f=A3fu^aWmFM5!>thQWom5~|9(*YZ_~<m(~vjU
z8DVUOXWW+-U^_DYq8wMe36It(SXpD{(D-@TYsq&vvQ=gPBOZrhFIv6~cf}D4#tj2i
z4WbW1eow4y>nI7%UKXV_-$qGjIp8ix>plVH4^Q%S3`31J>B|^gZ_^X?en;O-JXg3)
zF3D(Yt6IEWet4#y!GKB$&z#*bMp3ZF<|Ac}V~$&1M`rz)HWZx_v0Bf(rZoAD%dhDn
zn`|t<2%Z<0!RYp?yii2^*>8)QGP(TT5;bD$jn(3I>!v2g10xM6_x6;(929<D-5-)K
zYIm@x`=0b+i|WVXj&mmZ$&&4{rk1^_xA5X2)@jrficfRkA8TjziQ>W-xxXTKHC!m+
zgiTUk+g!e3@rl`SBKpirruXcNEqPUbXVs!bz2h)uO>1oAv5Ecar%BCc$69-Gjhd!;
zE{PN{#CBXE+@cu04LOBy*)F2h91R5-X^R<aAAWQYFbK56rSW={W%tWD_Za(v?CoHo
zQ)JGq?eTrY=4>thX?7u74cociwzmsx;k{g=HIAKVDeH}Cn<tYuU_v=Gdr1q*zPfOd
zKg9<No;)l6r4G6CnTF2CfbLL`MvsCt?0sEe-37QI^3%k?#<?|&&~--kJ!x>eK1m#h
z$na)E(Z~yPHW=ATA}76#7H81VW{AqkkoJpUncJ*nG5BZFT*|Rw%VXP-bd6lj6=>rJ
z;sR)^f|ya!D`{BOPBU@ZXX+a7pR?%`#-2$=cLfT2=a~gBpEe(V)b>5NLHRQ(JDL+%
zDofYSuzj;>JA1XCmOlT<;!`7`Bfr-I)HVmr`Pz4m%UDXi@=YV4PD)+r-G<bNmC?~+
zo&WsD@aSEvW6=nUlXrcBi@M&%u|=vguA%~&d*b3p#-!=y9I8U|0<b*f9MX;5weBMW
zH#U{(Dj7~>!=j*zRDpUFD#NawJv9FJEg3^(zJl%W<+O6TNORH+R9s>Tr`pm5i%_GR
zV&B=4DY?c1l`pvHK(;Xmk+9TVgCgo+hY`G?V_xJ{SnfT#bY8vE*8Eqbzw=#BQrVO<
zW^tA-U|{=Ikf=#*+5Q`ulLec*4<!xzioO~7CkV`(gOn4>h?$2k{zzL?|N8~wK3o?Y
ztoPTQjhtmS%*C=I8SO(Q;>rirxu?D&O$yJ<ifa!Xf%H|H4JuGO$i?PfR^h8n(rh&r
zttah6cum*Z+>->r*Ot77iPsbZz3Ig&i$X=m)X;=})+6GATfn`?O#qclLZ>}Y4>6rU
z+5VTr@;C@kN9UUfA!>ozsWRPtK-FD6sI4_2(dKx)lJA3RyIw7O<~9pcg7Ls}d1Bf+
z41o2a>P*7^55pQK9T|RCLjQaDz!OV*$$qb~&)^9+Pv)z;pF2Hnpa80ikJ^DC->SQi
zf813-{Y%Xg+EaO4HF0uny-Joi+s4-|in>;%yDR!u(%xb#nn$FQ@6KY6^$&5<!4~df
zzHGu@k7}UZ)PgKDcGPpk&D3L&Xd6HGvZoPSLWv<Dj0(Wji+`^Ue@e`?fa^akz?4PP
zA9J$jW6m6xnzGBjDr#T13tX?9sH7YTwiY0;D8{uhp4hahew|?=?uyYSEe(3!xtlJ4
z1J`KfWB!=~V##&E&CV@Zbx@vtv+WEA(<l4NOd1S690*-4C9{TjB?SA9xuZVZH^XXx
z2fF|zfw_U2<m9Sp)hMwJ9#4<B!H%FAy?@MN4<KG9c~e2otOua)J7d?bYcoz5T91BO
zEE-8OGhJ0Tv!ieWvQ5e8JaFHympqu$hD}nW#%z1Uw7A+D&~aDeB+)Z&7r-JOvD=?f
zMM{2gLTCmy;a0T%xSB6g_zb!luK*-1r=ddNqtLY#IM-96U#|h(TdQpL$Fl<^g4sdT
zf(>u(Syg?#uq*%#ik*2W$dRU$KrP+F@_@Qt9<xYUgl=A8eF^eoG(tBbcSvobMJ<H?
zB~&%9@%ty%tuX7bqJgL}EeANc-i97_O~wW7PS#H1_Z_YMOT{F7Xiu38Vj60X(wI=#
zbYZmW+GqXa6ks@HZF0#iWhsrVz_0lU^Qlya=Ft_tmKw3M|4nLKF?=nC&lavSU7xxv
z&96@B_NuveeVm+!z^T|{e(7Ro_gK_>le50)vFCBd>36<CeW=_RR@|9|M0sC=%Pxs`
zFC)Uo(jP5o&slqKp}n!L;qg~(0ez9L0iedoX{a?Spgh6v)ho0cR<4YzWUPHMTls#J
zaNtK4zz+;t&kO*0RB`F(h5><As&S3u%1Wi~jo#f(O2m(5EY1Yd67?uZwJ9zfIP$Tq
zS-+`lUoOYr4;OEqkyvu}LB8qStp`SLJ0>vR2r*Ow;KgM-wg13}DtBzNeDe7+qA9}j
zP4BM?KwIS8C#I*x@cxTB3uTMdarPn>7cGcwY*w?su+SR_)hUl6_k7MYvIudTC0|`C
zo8Xh(Q~Kyi&lyBU3XUl6n;-q<@vZYys~%=Bh>9P}4O;Ax@y~@Y-AKMgD!g9Ysj;dD
zX=l}02fQ*<@h<0Yj5~Urni8s)SK^J^C_#RgEdahzGgOr`B23WQW3GEwN3`xybHSr~
zR<M*pAv7dn6@M3GF`qHvztEsri|8mDsQaj$L{VQ{2fF7+QC8GDr1<Tcyx&3U%E|B}
z$<+65?!uw)iLh7XDP8Ni_wK5$Xo{(~qn@*kR+i4MPMa#F#bKuv^6%&4vg(kK3PJNb
zZ(pra>ISm=F214k9+`w3qoptr3*DdZ^a<(+cdnD`It`Oi?~oNZ!te*@82+eBby?l6
zEZ3mDQOan$iS=3>Lmt*Ml3%8_VQK=2A;lpD3xRL%aiv5JlN``nPC3HsOFOa7YFVW=
zOKK+PpY~o~j+1g3%V*^5t-xLK9ke76%DMj3?YEtNvwFyx3TtCe6Xf?vTO4omYqqIL
zDDqmrtoxGN*N+feHUxAwKMf^7r8LheqYEbTtM}X*`-ukG(G)1>a_utg^qbg<Cg_V+
zBb9JqPAus;ZU|kN22f$$X4kwMCWIt%M%T`NB_#c1y4vDe^o()bx%y1moJvQ%O{W`c
zR|a#L6(ll0)R5Nno9m=C-x>nu+;%#EYn7X=6zqHL`yG^OTZYEY3X5Kepgw|0k$HES
zUvJrRGAdPn!1Typj{JpsQ{bbKu8m&@el#w@<ZhZ<5frktYkbagd%^U;Xv{61O)l+0
zB8NeV55ejH@!y@TXjkuR{KIZD?bw<v*$bh@dI8l1`c$z5;h^#YE<<TfZvl$RiU=wm
zVQ7=pj7+8y15-Cj+FC-zGE^aufC+=s^MWtE@zr#Q3h=vs6_MU+#P+b7$Od1MU8~kd
z>jcuOb6JMIfeos=7E0%<m!mrei2(eqVhUFG;aH+5U3QD9>>}B?hbdhABDK)XHdFBS
zqJ3VV;yNUT(L~#6K?1&uD#ra0BUXOg@JBN?XR_s$y`PXjd_~Iaul|FYP3Kun)A6K;
z|H1d$qUhIgZ9(8)$Ioe#r>OMVN;aM4!|mF)-=qweJLAx`SbekBi0LMkK+<SvYi9(3
zx(O@5EoZWD9BOp@-p*vnlGO3!aO6zueV2Ah*E{ELDwWpvMX#yONO#Qu7eBQUdr(w9
zykoM?YwCmD%7+D02LdI;Z<nt}d19@4=}-w<^*Q4Nuu$Vuk+iD4k*M3edTYqRR7Tjk
zKvRiZV!rfM2#A>2L>pqMefSauqa&1jWo47Rg>&7!RSXKYtj8^OTY3cJO+euUegjg5
zDx5cpJr_Amb{x}FV-0T%`5t>T6Y9#d7cg_43oP*#EJ<cyls$tJne}|#jTV4im4~SV
z8E$mais#AU(Ao1#wM~a>eOMib-<)VcmcO|~XTXT?xU$nAmH8^F%mFP&8889LfKB}8
zn@2akow-JEaF2k0#s|6-4+SocqBsBYT`wcDs6M_?EGwj?D^}L>v9YrL-c#ayKRM6b
zK&SU)ry4)pT7~w!Oy!(J-ftlQD6zFJrEQYes66DIEI1Krs!LN)K6x$1<#)T-NFs@-
z9)Ly~X=iA{S=o@Wp!O3~t?ESzkFz?_eR&=tBQK^a1vp%XE)kca-I<6q{!&Jx>LLWH
zVXLhf$E!ZNlAT+3uyL~g5T@CHp+{J>Z%`Gj1b)FMwWzqd=IJQ~JL6~cEM6kp0;0Fr
zYAkK48Sc=$tAB5Npg^#@%gC84I=TA(Mxdpt7atYBD!?@VBott0;@c6t{bEGQa-w=M
zOXb?QEB$Z4#CT}3M<UN+(DHyaST7HgEk&Mkj(^Zz?S*<MF{xIbsYz|dXT(g<Z(rBA
zkvq-SLE;8posNL*wtlwW>a;qm5evHfC7#+ak4W~3TX|J1lq{ZSdQkIMv;oR=N}F3(
z6B&kJvBGj%Cy+$bya5pAgXah;no!7qhYWZ!kzc9xg|~j;2cm+i?0(<t)WL?@F&mW+
zALpV)z3qgsp}!j5oi%Ul7nQm11)u4q)1#OTuX7uUus5QJXUbk=lgG0WB3@k5(^-hD
z2Cci7`>#SK(@M4g-8|o;oNv_;vD})Xq+m>XS3n+?|1hi#!!!e{fByg4yUu^M+PL36
zs1AfuqpGxawY6#$rCN<GDQedqsS#Ql?p9S%wDwliN{Ct^2~xX8C=n}0QB)$d2sOfU
z+@9xec;4KvPLdbr`kb8W{C?kco$JAOE!Hj$n~W+y1NDaOa>ojji6^E80r03hCl)B^
zO^MoP`1e)isCqdx=c4#hV5(K4FTe+GOWg)aU9S)B>)K~^iE-~HbHdt;#9Kn~h_0<~
zE3M~ZRdo4J?Hgur)rJaq9cDh22Qy(?*5PE2+Q8t)!VB8|F>Q9P@cms7{(f7g&}5B}
z0T0L$Q3)~6pp%4bp$!15u3B!Vv+NQ8{^X)oBSj1;`DA4>qttX!E;WkHN@x?IfsMQB
zROtrlLw(Y)l9*32Fe#<I0x3zJjiqjig_fE*%_H+4j0Y<CnE|f>K|tMO8S@g={r;@<
zTb0xP&$Ey4^xoyU5wbfuKTo5UkBQZPor8J(feH-Tqh-<di{d4=(1>i{<{eVxi*1We
zKOx2g<8~4H^!D8kK4OWX<7sQs35IK$c-1x9%i)=RNpoh+;+!85>pQq1MekF3&O6Xr
z!5dgywkFJHo#DChg7?R>UwVsyGjb7*lU@z4L>C|d+c(HA#ayK+mL+jS@bWg6m*A^D
z?klwS0o&0KvRc?9eJK=RcvrM#33mUwNCMHx99DK&y64|;F1M6PtkZ5=las0%=Mq)!
zA?vZW`3tiPaj{0m3}m*@V>+S(%?VP{->vBL{>Bo)!u(<y<^Fj1!WO6c8CYID?a>yg
z_}1l;xm%-(CCt0_(MX!28rwzs_Yv(A;~8DF`lG5x*2W!?-s{Z`17qw%pEwQep=N=L
z)Y$_t(|3lA24&8>u?~5O9oE2X!vk~ds5h}CiH8bdZtnfZiK#VHlNJ}MKG;(7FgZ7|
zToG39+>%9XiY~dw&X)GL(AGWFD~gz|p>z<gDbU$<Hsf_&pF*R3KS!ndg^j+xfloJ-
zj^J59wotj{1Ms~3wNqP(MMu`9#1bQgQ|hjxOdPhAO^LU-|5HZ%cSPt*!(S*yNTJtA
z&PAwe0^#wK;CYRUlhsV!q&ipWek5C<BKOuL$Y}3ND_O-M_)iT7hTUIznCm#+qP6y6
zISLAR8Qg#sX!!E^r&!AZx<hp>6Q3{WrVuGUdv~^IS(?2Pwdm7bZ~wJ-#ppDHPk3SP
zk)IzVjW;va?tuqSSIqj)OB+~uX79Kr{M!uPGH99PWebabhS&<GXaf2(61FLZf87q)
z3}-R;p0sd?$dgPi1uWf&+u}C-j|PieA%D4~`9`0J^)_yIotU<?f_d%yd_*nd&*?J`
z754h(Ts{)=Xlc|PY5v4cP|y>VJB?JH!|G=U$&SLNb?D|v@7R%6_-8lcu~M{tsC&RB
z3(I0BD8>q4Rj2no&Uq8@CvYpoG2zJA=w<0ac2_m$A}`7G_W_zH?(E`^!Z{B=oaWI~
z#|-aaT96f!hS~L@6c{a4SvfMw-3iu`;^X9Vfv?aLH%e%?ney0u(DjlFOvub^8k=~t
zBEK`5>y?bAR`pVR$GzX1NhKFj2tsu0TmEFOFQ|FI+}&5DZaF81py5{RTvd<T(4OdB
zobF!Rdw#8~3l*PTx7{}gAy52nz6k~&yDfIY!WsAS#%ika>Qt}dj%fl>e*KFfGkXI0
z@avo`2KiEjd?$JBj6LYOlOvmK@q$^cQWQVJ!OYC#<6F%(?qTAPyAZ@|T;EfD1_-yZ
z;aS4=-7x?usbuk_BhcEG>`v@uUvA{7=_U)X4%vI2)<_7qjwpf+Oqg;++?pFy;~sG8
z*1o2fY6`hGy7dmyO6aw<aI?H{%i;--<CcO*1};k6&$lDJ>cmIVa7IH%-P`q&B$W7x
zd=z*!yIfsO?z~p7+4qWgdQ9y;vn7W73<r<~pkOE$HQklbo`JpS09~p4+yirO%#C%8
z)Lg7UC)D2UN^cOZ;FUWA9=h<cCs*CaJqQi~DW)MCx<?L;<4z1Ud+-w>FqQKtfhHAs
z7lZO_PP%7u=8Nm-x+q^YUvu-bK)2a!A=pBH>jH96sGCx$<Qp)F7&{dc`NVy2)M=ez
zUI`jm7;Gy0CA39pMZnqNObIjQv@Qp?LYl4-AXm)A80^Vr-KtV$SZnf~5p*t43zL4T
z`o_URPNoAkZqzM6Kc}wI6JgcSa2ju6ZsYYYnz8=+T-6>+qOwgvs-mM1v9g0Fz{mgI
z3v%O$V`NKjP{|M6v)_s+CzqC&&(gRwwdMDUJ5#ahq)BK3FE6*=@4}kQVu2g5(;J~T
zMp$U<m+*CeJsM}9F?lB^0>OI$l=oKo7<*{>w`2ge0PzTJ!;{8=FJ6^)S)roQE%})_
z_sVY4?Bw7<T5Hu9H~!qJV_>e^IvI2?T(<P!Y{9^gs*hU`gY#HsIs9Vq4RdFcc59-u
zZ_j0y(W1)BUk^X__&+Ux!uuhAR8ZF)PgYG&mvBYvY!qB0SM2#D)|5iL_5*N}Kr7hC
zz3nzeyMg3Q(5n=;-ce~XynL?8>P<EAPv=O`Q-)Z}0Q^)okvjAigM<imJ~RgVSLV8E
zNx`pDy=NBDw?RS;e@t${)t_bBJDPVx&#k^Ve-|#En$)Du`(qC<wi_}Lxzn8<O5R*X
zL!s5#-A!ddE}18~`hMRBN(glW;9Nk!sJWc99&3mxoOKLI&TT8vx|`Jh^B5EKKw6(S
zCsndlK`^=aZGE|`ueU1e4I8J+sHAd_9M>sZNbP4zLW9|wq~{`O{pN{DopiZ$lV4e#
z>gAVdd~ck&A_emX6fS+N4eVRuPr$6tS<ZP@y0;eF@*nm{k=W2~3>EvU9s~j~hsZ64
zGQgk#KPYM#RI4f_Q!$b4n=c8GF1s#zOh_7OT;poB`#>)42-<$|x;NKHGy97fnMeDr
ze>sq4^9`=*ZHIe-!ajS58mmcPymAxO<5~(6X0I`Ow{9Ekr7&rcJO(xA9NQKrBAzCy
z-3|%+6!=I%uNiG`h4!vrsT0Hp#vCA!!`_@V`m(bD1{<@yRduG<E9R(ANvBxd2>tmb
zP!9U)T`a%+QYU6%@72wncv#V(HgZR#45vdc)Qyz(_Sgu_inAoAA&6a@-3wc+i=D6*
zba3;(P^#__>gVNCX@o(>xe9NcP``Ivng1-A^iiFu$lW~CH%cj&I50bN#u-tHiM+`k
zXZ*@uF9x}WhqKMDnLh2_R*n9~`#olMFQ4KQ)>3!HBA}V3Vh>#vY(&QZ-(>*&DXz$8
zP$<z>7c*xzK64u!Xv<V)2R5uY?ScJWzQgl_E%6<Q$FrqSPiEEcIUIZ@eJk#5G*wtc
zO!-jy$!X(aKEVuHc)!-vd3yA^J5_0CF91Wj5x<+C-dXl)r4Ui=mMAx)+f}(S!}Hs0
zt@ykYP9Q%?$y58saH1`gW;2o$@)i9<11N@>YV$9x?=z7C$-4r&jLjcQ72{c4e&S#J
zp1#}0y+;%@rx6#0(rKcR0f$|(C(+>%*8UK6@F=@rh6&;3?qj2#Z)KIL5}xmIazDwB
zn>EIeXps{mXfW4CuY%%Edbl9xc)#nIHC!&pU47XA>RP%sd>A0E=ltc|Ul6PsP4;b4
zg!l`>O6Zlq-0Qk$2cKM(zj+e$<)N+v$o#|3ud4K6nENskR!9FjN(z|uF8EgdP?p*c
zF2UbxU85#Kp<<AssfV|1(2CLNV$L;1#RG=6Wb<ydu8k_;3_cP~t<X|ytGc4c{S{79
ze*0CuRx=tBX~gZ%a61SH3Y3JD3R!=+KOo^NBgA>lC{8Cr>&<{C9z8GYsP*D)3NeG%
zLRd?Ls2@k@fVix&V`BZ*mDe;Z9SpY~j10hjx`BwoW4y)zk7>*}TFxU{<owS;h8b@<
zJ*GIjN_yhKWKHig{=n}ax4L3r#_s_f=UCaW_#Am4&<M6ao(i>I9FvCXv0TL*8<S>n
z<0eEYJ-Gtz(7bom$?=nXCuM_pN~i2K7JSEKxqkq*W^`q8rgp65yJIScZ*)iZRsF_n
z@U!Sj?|#V1!2W=3y-PL2Uto+v>mhTs!78a)@niT%06oP5;0f^7m+yA9HVC!4d6N9g
zsk^Up_%wcPR*Xln+9d1Ozv?m@ua=_NCI1;r9_KBLkM7hu-k<l$Z$R9*8$&@2)$2sH
z7C&iu?|T1Fdh{nXkx1BdR&}@(2I~D+iUh>B_PzDK10^E#h1K!YU&s$KcS<$2w%5&D
zy<aK7sl3(gf)2+>+NsW}C3#6&_R)I0HAJ1WaEmKqON@6o3*UF25Mjc{*08Zxb8fSm
zBWI9a<*@-$UfQE9vEv2Ly*yE!`egG7Wx<ofZZ1;$@tR2>F(3*&Mc3HOwz|F~IV7%?
z&WlYgu;?3o<11qZh{S%N$1B_x>Ws`p|B+qwLQ#j`{jqmv^pUw{Qao-Acxd}DEOQOS
zpPHPRxe?sW6w{C+!~~MjCddt2{q={QX3C<hxCZ_9SKUb<?RS5**0q--<aVnS*_T%K
zZ8ie{DgubA&=<jNUitSYn?rvlsqWbn)w<vu@#@lG0#qyKj^NV)S)Pff5+N+4^AUY-
z{go-*P;|pY{MTNentv*)do!qWlJvVtpWW^lUlM7TzRC9i5-xV7eQL{_62yhs!tFLW
z#cz&BB#^oL3+3I0(?OHt-UhE+-8_&d@M*L5&=v6mFzGjFWwuv0Z1_V|L>ikv@@#HZ
zQfeuLIbqgKJ-LO9k&_v5_p-3u{`Cp#lV|;)e;sji>!Mzdy&{c~>m&Psc(S;DwxD8~
zs><L*C>$@P@~qPM?=P_P4z3p&#EE<4eLwl}2|U_$w?Up&aJn=8WZgQ>>;5#?kpBK%
z@V}?-@UQul6(d#bbHvt)Iyx$p*D7Y4bW~U!F^Sv|yWbj<x=IOMJ3mj%kK#Us6OA4n
zd|Z`w=~PzG%FzI$<#;Y)qc=!ZpY;YS;ztQu4UO(c#SHK4)J-R6c~mXc!d(AEMu1-*
z(PPPz0`ciz0U%DtzJ37!b>|uBB1uUbc$>|Ru~oE@B`r>7$rK-=&I)P$&`_5r;KJ@R
zBo9*O+{N0Y-^ob2K5?oBClohv&ya8QjyQiIaoq=#mrX}?ar_~j%hNBbgLpv$x>u8S
zxN_cRKc8q?4(d*nF)sqdM{4qc(pl*ZwZe_*-1RA@Y#I-INfJ*%amlCr8bUokreKkf
z)SQ2%Cefx*?VG+)xBvMxcJsutw6u#3B^BCo!G8l}Ze{je_%gR%62hGO&cQYRbP$_~
zpcFdB#Iz>ITET(*-sJYdFj3z@_tt2=($@eTj*}aLRSiru(Uh`FhcMm{kV>!8?L?=P
zLd)GOQ(ZmRRQI@~3X6Z%#e86~7nNGg#<wx_y4lqHJYl2ycihuDyJ>sT2G5FS4!1m0
z3{ns_Zdm}jx0%9J^Z|#{t~C^S$f!{<LhWQlc~+oTe!m|x{wUtGb8QpM(%MB3yzAAw
zJYvDP!s*b4Xm6v6_#x!+FW=apKzbq+F4Z#f%DwgzU63c~%P!gqGd&&GF8W0;#V@X(
zK87s*kYwpN9%>*Z$P(NK_&djk$v}i;A2O_tpoOB@%S8vl<{o{idVQ<Kx`ufOqv}(R
z9{An+-$~nS>75R$)zx7a6T+y-6yN;sZX06@(6Ko={p|Msp_i5G+Qkm)@opx`>V9w1
zxFj=vr-&-#KXRfrm|MWF-O)#N^J+t!vc2gk(ehFEFAtNGF5;<jom~f`llt-x(Wu<s
ztMzKK;AE|A+pzaq!`)FG$i_+YOnbC7ht=5-?O0a_lq&a7&|pc*0RP<}gS*@38Fw_j
z<J_#RldsFsY4_>+u{uH(7Ku%=F?YY)v*~$;Pv8Pn!sd@L-Kc|VeZ^-xthBNAQG=!7
z;`Xjfu|pGN=^=R7k#dPfbnrp2S%sg*oxwl%Ey%H`GGzCd>IRfyh=kYz3!z@;2Nv2E
z(itl`;QXfQ^|dMQ^15qRR}L4*G-r#&4{Y_dz9~ZK?cE7xg?S=-eZF@OGiuFBm2(?B
zDKl{27DPRva`<$MUuhq<5m}+GtJLhaC|+|K9|*ME{bbT%6Rp>A$Q=ed3HO!JGmo`0
z@WoYK|4Oyrm^Jx02i^TA!X<`!cEK2qzT|>*7NYv_I0yV?E{^7q)4IkuJi=AvU8y!L
zXQj&Bp4skc`~2l;>je@dqW*I0^#I2Lf+H%Kc~5sY^gK;A*7>aBaw~FGQ?{jlrS0NW
zb9Cc9b<!3aVb*_ThHDx(!4~JpE@M1`9ERpKe`L~K3r*Z6S8;s-eTXkF^fCg)D4k*!
z8#awV45xFJvvj*`=iGs9LlSFJW<Yn)$Mr7bOh+IIcvt?xyg`}*f>j&i<mp*#D%2}#
z!)rVqVFrCmuv;D-i&-Nucmu1w7?HD?uFuChcYG9O?eIjn#LbeQ#g53Oq;;EV)uHlQ
z`!?x)vre%3U(H9R<s~1xKw!M|kb{Q_?d1I2nOgJQOJ^7lljGPx()L{j_TX5yvyI-N
zJvZC3@-@d5_<h7Az!a*@v%g9r<cog<(&_QzbGRg_xX(|;c)^}>VkQ>dx5G$R7r!y@
z4I|S8x;)ewwfW=Aoi#9DqQj_WZ&brkAinZ&0w7jT0Sfn)T5IUprrq3I1E%EGeO7E+
zD}v?aK4}Zqc7OEq_ziUv=i+xDjfIC|3y%HDa}~cNMcVuuz9s}g^ZC?(9Y7NneUoZ9
zUf6G+*QE+TbQ_M)5sE>Xwcl6U@|L2j22B!}OYo?DgUT}me=s-LtUSSE98QSzN1&LG
zcMZF^aGNRZ;?=+7wniu-ifWOfGc4!MEnt^&k_FTAc4Jd$M=Lt9o3QH0HOhP?C+z_|
zMCPt|FZq{cCB_UEK$TJ$pP$Dc<7E$7^FegjvrONSx)ahxj-PFsNf#dc{02S{GW$%v
zT;iNR!yo_p8X)uWmJHjIy)J3ACS11qX!~Irm&OOLdI@<{Pk3isYH@S#+SQ)0k@@ov
z|Cp%C)r%RcbY~To*oD2oxzX{OA+n-^X&G&cj<MCuqmfKd3U-%1U|PX1+A&)|c2RZA
z>8OQB8CZTnnV$70UwY#4GUec+FOg>xrPn{(Y`1@2yZmf{9DK{097#}}Etsr9LZ+|!
zC;T7@CvjWSbKwti%plnVX@yIn8JJ{MQet}77NaC<n~Mm>FqV)evR*7tCtSiefSz~&
z5dh62ywa)+IDfkV>T2+^*bAn3P8C`l+Du?47tOyrIlandART<JS{|d*6Oty5g=f2S
zKcG|Q-GagKZAEY=-dD~-qh|H)&{HpbJ4^R6?QH&3dYJnXa#4T|XYg;9YCjHmZaz;t
zcglL>=?QgDyO?Z<MV@cxru9Ds-wnt037pO$bWf`^o|VlD9>g@$g!Kz(zJC@bGQ<O^
z9f9A;qwe|!zAJo{(Gea@&c$;IpM!J5Y|!ugOQwK~(3XXv3F=B82d^@o`FUg~zynh>
zwckK)GnxOJ67?%Be_2L38Ibf-ctX4y3!hZ*66(zvk9{;;r&l5b6M3Tl1rC)Zjh!pv
zuaZV-vwKjEo9F(TeTmRj^#`1V3NrUBfdk_|Ecm*JY*>b$TQ5ELvXGRMGtT{5iFbKu
zTNiW3OkOXarpQ)Y3XD8^X?bX$y_5rGCfy>jt*R#8NlMPoB9~XVGlbhWaIM!k6_Ut9
z`3P#Fn~W63KpSl-<%yF=xwmt#6i9e0W=Ln;%&n6y(5vtyPaORwQoUQ{@|PoBpdC?T
z0%K<=A3DTR_28a{=?#mUK{Y9&1vLpo(7;iecpjVC*^Nrd%1#?~P-NdjfdP^hJ73KG
zcy(v;fXta{$fFlU)h!WN!9;=L72$2%N}*l<1sB(mw-?vD9qYX+-Jized5C-~u|>{K
zO82Vqyu}HKY;!ROF<bXk(zpvFrzTARXR_z)ylht%cH8ew!<k9f)Rr%NK<YCXSi`kn
zR?~KFSZ}9%9mPL@H-|$}lG_4@Us}6*z~2lAV;gcCemG#MtiQT2WTpNjW>jlfv&P>k
zQ@r9Msb<+s+ElIa;4t!~*H9A+v6O16!)=MFc&|yM5AMRqJvgm|D<S}}VwN0GlRHZ5
zQFh}ON8U%A<Nj0-pfRMm==e>><6#jtwe_~orgHMR>luBy8`z?&qNI$Cfnv_7Ph2zz
zeNg@OJ!HJ3<({ndwyk3gyIWZpf^E<N3T*V~RVJ~>b}(ZWhFiCux0f?Cpx78M$$C~?
z*gcJ=COKv6ITKYo#mGO69T{DT(o7|RlHe|jhVzk1HH7;%WNz6(j!<pBYsrs4>cG|i
zA-k7ufi;~JzLzd77A-2t3{zF>#=oL(4c2=^MVCq+#&?PVtD*}3S0&KU$&*Jnk}C_<
z)vSN_&0l%U$5KN$Zg*AzmOqO5k(LIl?EUj2v1_aFQ&o)$pWR>O$t{(JUmvm}wz*4+
zC2X3N(!kk!vw0ig3Kl^Zcb0=%Hw^N3=Y;0Guh#F1za=^sF$H)ZQnsVVS}y8ujf#r_
zT9Jg9Ps8|uD<i0$_;7dS?zkZqBwi&p$rVNIqa+xX&6#A9ZuvI+_*9+8x$20%E{VCH
z_M;YGHFavphRKJ>7e|kH^9{c|KkQypj(z_sN!poBMF-Og`vSj)GrPgweJUi=@guU%
z{D)$1_%7089$A`i_P|@kUxeMKz{vr+jFEVL8Aw#m=Y22=nIYM+uSdK0(FXnw`bmgu
z8)=`P5+=U56{I_Fnt`qs&csoDBKF?6Q3D`h^eJ40$n^2s8^@I<3nx==E(Lr}Ga)$~
zbKhRy62-{KW{#VKU9z_Gf}Yn`EG(W!n^LA<w@LTRsZp{NzoISLuy3q3SEiek53sCq
z3hy+eeV)gOH(Ns{@+JYlqxM>2RdX_s9nOD0y7QN*aUv@2Z%KAwn3ZLXtYfMBrB^?x
z5u=3k#Z8h@j8md<1b#LP8AtH!GIO>sK5o~$b^TY!<$Fc4_e${B7dxFVEK+k@KGKf^
zaQ0~U4ES?02!Wn{K7yPKFf+zVf!#@_u94GDe*Td+P@`?>3F}vdnl3O&&By(Vh||{U
z&X*UqAVrDV%QH=*teC2N-Ga%Ji5qX%eyi|D{Oxnt)H#bc@Of{Q$$IuuIZBE$16<Sl
z-PyC34jnr5b?@~1XZuI`kN*z;{RRKcg8v?b|7yX1<?#QdBkafk!|v_Xfs=ZH4=48V
c>(N7pniF4D9*M~UemV3&TmK$f)AsfM0A6x;@c;k-

diff --git a/docs/images/pr/chat-image-delivery/click-before.png b/docs/images/pr/chat-image-delivery/click-before.png
deleted file mode 100644
index 25f98ff3b82703c12aba0db4ca0686ba1d92878c..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 61189
zcmY&fWmMGL+a0>Qhwkp~p}V`gL%Jk}?x8!R8>A(b?(P!l21x}(eU*Fff35e!e3@^*
zb<TcvJp06|tIDAv1Cap$0Gfilv?c%mJ@@CQj|lzepP?1mU;qFUpdc-w?U#S?(`9A9
z3!Ntl`ob6SyKTKS+4xo}6iuls6^4cm1?}eNw})y==x#GtqnWh9u}oC}%olPj3s$v^
z-}@oIzubKj_~lOe`w8<Y<acM#uRAq?;9pPAPD5V>qw1}q(pGLBR%^kHEd0$B-&t&f
zG)-t9LyzkWgBwT&k7w=Do6rSkBn%8{&QnjjjPZ!sq;)KcpLL%G<*XGNwB}TK9r5^l
zairw7mNm39ho9RB41V=JytStKeLNB_t~dQiB$`Ad;__33103#hO#1l574pkFbI(dg
zg!Ag`8<2-Tfh6zVGtdwJgdv&Uw)^YgyW<~YOwi>chho4Q(7SLc%@1pwG#x~O_nF5t
z>vt0Yra}8X&*Hz||DH4~WEwOiV>#ai`c>SyE93Sr<|P%NXat7hH{_h3<eR=v?c@2h
z<!I)1_(c9uct+J&j4fdZdnq4}E%{jjj{;RO#`|*iJtsD04d^89-5`8Nv8w!mdy#of
zhPNo*BnAUJczUl2XA7EP0%u?bKQj)=P72|z<eXZJ5y)A5>`0JrfvO?Yt<9G7ovmXB
z(&r;(KiH$)?+%Y|XgnY<LCE{HXVMl`N=&oKze>V}3hM6GR6hTD*F+6^Z$U(;p8yQj
z^UtOVb%$t{J{~l5HDh?r6zYk-|LARMFd1HMCP2n|ev_Mr*g$P1u^P~TZ&?2Y9<iTh
zZ}0OLoNF)~b*Kd=2Q@3;;D-Db+5AN)#~bPp2ZU?|NQz|yTLJRvMUu;D<#?M})B+Cr
z#9(YDCPUodg{XAEU(W{U84E$!YbYjM@ESZJ-a1|P3iA`r+4KXy<u!LZ8|_nVid$5r
z?}71i$zQJsP}JHOGJCX1--c54YeLP5|9*LXV#U^!n2kqA4?9xZMEp4X&W;gVBo*oQ
z{0>A6qsV=(Z$?7BU#dMbCUHDX7vcr&=6HW0Q+Ocy{?FN+_cUiBD1CAhF}$9*YA!uO
z8IzyOemN66m-ykYs{oHvL6Ag*l$&Qa<+fLnFgbK9T~1-3_>#@h1g|nUIFyC24_Fy=
z0G8A0%w=zB(H&7JwKTt|f=w3&cWKluYmwGe9}z;40khfMd6}cwRv{FGicXEfp;QE2
z*g2s|7aXW#f&rd23-U};kg68+1>zrKMXqX7^z;w`Hx4Ks1m`EXk}=W@l!v~vpTKoY
zv}jgxUie)zZ9@92-VKBulJD_T5O0h8#WIsj2YdUzE`qniH?N20^}j<KrH&X4G9U|z
zS*ML6yo@<Nr_rw`4=z0HB%O4P7~8q~v<~eC1yFvDiuT9;Vs3Bn&9sR630q`Cwgl+{
zC9G`XSCfBORDWPWl<S&DxU6%Z&o^%xp9z6Wg!z{zal-X5MUNftd;SwzFvQR*D6$0F
zA9<k{^JCZKiitFY8rRyJjP9!dlkb8Ix;tMIf6P8DcA^i>o#LLts$ZYPjsl(u3|$yK
zFkdPUAard__gm(>CRW0|Shn$F2VPf5?X>tXM(XmxNYQWIw1FbBx26w0&ny1Rx7Mcw
z5IK~-B~*BWQYi!dRNaLDF^LD*<tG-QYKo~6kUIBshUh!D&h+75_|J1FPC6WZ>3FWh
zp(%~>Kp|ZQayBZW)EgiV9qUG^q2o|xkhvsI@@mwgF!R6%Ak=CDLBdtTS2r<qq9<mR
zh7*SqSUhOa<{Q$u31wRc#QJ$v);%0u7dbmek^>QT<U}@0zXdzea;$UUXYt!-iqDmc
z8)fwgSxU6J7#u2Y-%(|Q6MKcF&}?`(5`AZx&;1{U?`jUK7uZRX@UxhC9>ds+4k&-I
zmvEq}s!>v?RB=3qrSH%X<?o`4+e4|$kCPzuLs33fMa4At^s*%QS;T!J7y<}~>08R^
zwCL>bm=&3M=HfzX%Y{9ZW4I>Ul=!s9j>>}U$1tyuVWDD&xZ8jaP87Pa%wTkHgy|PT
zOL`4BNt`1VwtW)wF!yZ;i6#Uh<V1XWju>!NmuR9QFl+XW^jPE?2n#VV&xqUz_mjdD
zzgDUeZEHE!nXP?OpvQ`l8NBP)VP6l-!4laP01z_rfs$eHyJA&wpRh0}sh0M5_Prmu
zpLz&xIO`7LlRpz0)2MQ#aBu=-UXYk95;Ux_UG;;r_ZZe2)?j_t`WKOJOh7_qlw&>S
z_@>i^a-qvi)sRrF0zcaqE&VJNQ~C;3qBJR{Zmv>1K_7ePskK(c<s*%1k<$$Dba(oe
zIk#;-fAr9tjW&WmstR=e&0>U^6p4Qv7L~eNBLR!;0P9y-Z>_{3m9PHGcW1)KI+JOC
zrdc8Dy>^-?&2CKKHFQ2p>Dmd{<QPZI9jov%a67ugpy3Q5h+(l><b5r$ffts1C`UY5
zT%Q6AP&F34qr&%hNsiTKL^@;;&wv+mXDm!1ODU%TOLuPaTRQoF%3&xzgD~0y?YTno
zz&!BtoVs6<Is_ABN`8Y5z}&?WQD;9)VXDw?zTOT|3#C|-C^nAeOT81=J2-iX#sWIR
z`MOaaR(TVd2JG5dyV0){b%P9^EgBjp-kk@p^HIHbgU8Z8qh^vg%fKt=A2|7O{Q2sC
zA9fg`KN(JYa)kREXE|G#CgD-Z88CH_Mqc!ms8ucgPBP}<#I8piW=K6*%`ZhI)JZ~^
zZ&!8;+SYgvSC2Y((v5{ox{9X^7mVev%}4#EKPak9R^oYNd%i&h;W|AxCgR&#B^nLe
z1as!$*5V8COrUIVk@pDHPT%zz9yVqK%a(dLg%T>E$Z}%X^N=(aG(z*mowkzf(T5E6
z=dIAmqkGsL^nTlSXk@2El}$kWx9Q>bV4^wkMJ8MIVX1=$pM1~LSO<8U4*`F1zWoR1
z#ttZ>rL>{eIke-&1NR`9k?Y3JwM|U#lpjPRTOzW0SJuH{4_`4SV<m7LFr@-tfM6E8
zr7kbnmGwmi*Kt0&%Nbo=<0|AF`}tg?ySltJ>M`<LD(g%-;_RdtHct}y31Zk;=RN>H
zSPxTn%q(B_u+AdP%Enndv8S&|W|N74DibG;Y2w6~`UEe21j6o!NN8%kbc)=!qx|W!
zz`YcFP*@2jc7b9M{ZBeCnCI}6-%Dml(`hNF45_)PpNN`-mlgPC<=S$QqryjVQU5>R
z7)^+>w)go4h@8xrbCnq6S_g%b3813v!Kkn`#-!)(jp%$wazzLK7ERe!r*p`Og!4IH
zGNW-f?#iT+VgRJrnlvW6N$>*4xXs(Y!ETO~zeIdMl5#DC(pNSPFU|ez+bBnx&7qAD
zkk?xXWta=O91kvAm@^-9Mt$@W8W==cwe}1@*3|Pr6!>OCPw=>Tv}Zd^p6Dms>_gOB
z@WEeoXzLII5uK1GOT-`?mA7XEtqWN(Hwe^nq`xHY7~$IyqD}ldjR*dn#vzh%^7hpf
z{m!EHG;})#Vsr{<1i$CQNn(Vl4|6$i2Mt}g<Wi~aX@j@&k1};w_FJe?2DSqwIneNJ
z0DA{Kk>riX$Q(Ec%W3*NPKb`5k$YFXwUB^~e3~>```EzvWWhXjMe``lSVc09L)1|l
zMAIqUq+)oOfiso_9_X7jvm<s6Q<o94oLd$HgX3zTBoM%w@$_3=`P3^3D8^$;g>1Hr
z9LBxgR(Ve9K&mow_MB}B?Ms?Q-q-tgs<FTOcdE5ZTfB?iLK8b;bkmuv?dCehypx_;
zm?oL>m%oMu_URiUG8|#?q333;<4Fi3^A;1sLi))S<O<Hw=S0@D_^}0ck}jOcxrOH8
zig#o?zr&3uw_=PhLRsy3h7UGlttq0o!J?bvs!|2bk1XjdHYMt1mNkCr%6I0Kt2Z|;
z4akp{RJi|EEDtvdb)>G9!T8O*)NWxh7sb<PydKwhDLHxsC%^Y)W0<Q=&~Uc4P|r;0
zecfUIA1ax}=U?asbK-(Tz$6^5LROzv)JlDH0H)GStl1z0P8RY>2_ais-MP%3xrA)B
zGHKM+ajUHyNkjEiMp#hLt#g(hQ32xc*HE<*L>Q-d1`-95X*0dXULgdI#GvsxOIQ|0
z*pH(~juKmKhF0>Mg5CfN&MaO(-i5=|?={T!wO=;V!W83P1X*^63kssXltfJk8d%9)
zD%Mq?_o1<6CSrSf&P)BsT~P+O35u^cv}(u4Ji9rPS=%%52eo4ehduP1`9EabP5e>M
zKL>97pe6}FJ$XY7O!c)i#Y&B#=T*!pjJh@mC&XCNY(968y|m%aAhsFveFcNz9Q7s0
z2fSED2`;A$)4$EGD+^U}8<nsJW^)~~F%WB2XG9UAFfy8xufg6U32wDef<L#SsbOw2
z+C#^c94LB<U>zqJ24bf_1Ofcy*nUt`G$ZVR2R`lx&EkIJD<`fw*2IgmhFOuKZ~EOM
z*Xo<*(n2*#CGol70R@MfMiwKzYvu?U)Xs*f+c;ubGKr`GimEDCtGL2z)@|gZL)*Bk
zIbP<UVRrIwyl-BUi(ktkB&uu7K?A5cB=;W5c>vrR<b_He+}lVX($Q1Q2J&?v4mnH#
zN*Kibur_TBn<H<l0`QVen<`8Lo|I=37yTK+O`0Fn{kxeAXa&QR{^)x3cUzM<K~=>s
z4zOxO-DVoXx{|)b63hx}Dkv1Z9azXc+;fUAAS#`n*(vD>lffy(erMKFg5qzIoNjc)
z{BzzjJo0*^d+RCIY(_yB2pWTL@>s~qh;SlSz&j_)YzC^*$2;nJ8I&8ZV4wL<dQFZM
z1+YU)C%6fj7ktyBMqDg)?hIBrzn7eGIL0V~r(DwiQaPD9ZZ2f2DSKP4bF@c>fBzzz
z(}rYJ>puu9)UZmE%GO@sGNWaeqV8KJE&p;fz)!zYh3Uo<*#)E1h$)T`TZ@Z5&{=!P
zbD>K65|L@njNanJphT0<Uj4n9yZ`VvVVMrg)~q;8%BS?Ju}6P9fntqVTXHlg$bn;>
zAGE$;gv6ns<NL-9xl+TiLvZ8GvAXJ_JjlitM)~vL^TO8MR&_?|j8!=mo`P%7_CKdo
zn|Z9*txd*?)9-!{pB9yk6o$h_5{3fJ{DsPQW#r}|-*PZAu%nHE{Q$m#V0kh*uhE|6
zGwM|QH#32ZAa*U>k<@obL_CLvf*vkuxiXzc_b>($%JbBzy0WPm@#1&%OB?dHq?QZT
z+1*(M_yX@2s%wWPnwx^PU7Zzx@dY(g?Na$BUUXWDN$yK@84}E*cn52>%!??=*FE9r
zWneG6I$3x9pLN0tMR<b|i~s_x?oPur)oW}2o)L>M`n1{ZY1uNfz;Az%)b>YU{+$X*
z_#bM^dFsL{Br~;0s_Cc4qf21<oC-Czl$oKh@F7yec~kNf)}wT4l4(&-Wykr_c=OhH
zrdjs9u(%*rDz*<fEb=^{RE{}&3Jim;`WepyDbSk~uD&qYc|nK&vVh9Dk0t;Y8!0yP
zW~*dLRvr#H3Ojp55++o;ii&s*%<;A0^?(feTxmVZghvQPVD^4^Q66k!yIG<s#e{fV
zRq_4Q_B8RSV{ln11?!pA_oayWa`-z})TR2P1GO}(^}k2sJ5!rU|LW2D1|_c}<Wkb9
z!jyi2>#zpe-Aqm%M~4{v?60{Kv$nXIrTQZ3h`gfWnt}A)N;K+h2a<A0`@3@W%yM&X
zM1C3@q13PpIFTMW7_{trSH=ij<Iwq{goHTmAFDD6L&xkPvhlHbu<Rbn7X}i21h>Mx
zMfcz)h(Rp69x=Rsn|7WRYKdcV;<|j}<-oaPH`}+YvT4|k9*g*9Ph;;pjxb{or8sOY
z*DqJ)O%s^3PjW8aHIa$0w7=Wq=-+(*N6Z`&^kJ$;I>)kwMIAe>wO4G6`(|oqKMPUD
zF9c^qaV20zfdVdKlV#|<Lbr;T%Cv`UHXSD`x2(@~Lt`U2V}nIZCQ8NLPo_{{%5x*S
zoQG^_glX8pOT)(507T;vmSMCBcI$r$Qo7f#-}O@4M-bkEHisq9yko+;UygO3(MZFC
z-ZnZO6DBD?*mqtePmlbx%%g%m8J2G8)wk*EKAyrPrA$EU#A~)F6?q;y*h?KerV-jt
z<=W87vo$WIzq$M?HJ$!w=zkJ{oLPc5cg6=t!x-1ipWJSJcY!1&YfRYcaLCd_uoo(8
z9@F>t=vOi+zn1VmU<4`=8pg!8L0bzy`CE3!Ca~ZLOuWC+Mgu|1uDq{+NGy034S2QT
zA=-qUXTX^2kp9@g%?g(YMtw{#?ipxRqca4^+5#?UwD4GCCb{(8v9mluSU)RdLOQ2m
zu`=kTT_dpQkon_JLgS8p<<u5$NiQiBIxL!z8g8clrrNQb+j${VPD<aOWttDH`&oyY
zr#R)(5mc?sRT;*mEWfA^sx@zHk_34DgP`75F6vc0oZs{EQ7f63To@N6xMv|&7{<*h
zd0NEzWU}q5=mFzFCl}G923HHE1M-lp{l=PrRI*saimWim)GB?O@4v<quJG30msk3X
z{O82af+$V_QdkV)6k+{~EiV)|{0ej{JgTir{i{Ajdf#RWC8hLQZJDR~{N2$oVc}nn
z$y|LLO(+_0)JUsS%vk603v@50a`e%|!^3O8_ZA$2AYX_`koIqz$B!)|)Ca<~Lj|Er
zhTOSCR^wC=HfAX%jXreg;tBAyd-9oMCy@5e{e{x%A1M8aJ21oy%}dcrfDG_CMBu1~
zOEfK1rAoOqQiqtwkhSPE?wqZ@l&4?U!ip6^Le^`;j#BEJTxH&vv1wd1)A_Kjgww-A
zN^A%0se@mKmLspyc1oI4vFXy)gnB=q;g1(Tp^?i=)8DerVSXYVkJZgl8SANdE+Qg@
z3)ewLRnT#d@wuQfAtBi7SwR~LZNk&U;COE=pKxJj5>96Pi8-(JJa>5{rIat6I3FD{
zy>~d3I#i{IIb${h7v9mkK&9~`wDd=Vx!6qJYtrFk+9sm^9Jzn0d1Y$ZjHkwdBQVhA
zB%=Y)w?sD&pb3PJ*(RXAFiT=f!8%&l5lcgk)eF~0>|g+Qct|4j_7uCkUvzhsg)M{8
zov}`(r3=F4m6nrhnwvH(V|rwDxvd5qMe(%GBT43{0@{5mLvwTcj5Pv><Mn;XvU<f&
zn||7^jFXgAWu(&yDV6q6%=+40XBaPzJwW<kP@ylE9d>NRWE@AOH<lP92V}5|8KV^u
zt5tLgXhH4~@d_(nUO&O@->{~THDC!fSa*?HnIb;?EmE{4H{~rACgcS=m@b}++<vjV
z5TdWeXgVIEs#KnroiL})W+)+rJBuj$jVKf|Mj)d@V_<5;bPXC@4_qVHKIe3F8-w7T
zKynFw95fu7s_1r?wxUT0*LhIkwJohV1p4Ihz_+PWS|Lr0CH{b&ae<!FB+?{vet%`j
z8@=pqy|X;xz1!t~kfdvFl!Lrf*%bo!&~bP6PA}tiqJ8;aaCYG06J`w-SCOq&xaNra
z4$z5|c$z~u<a9wD@P+mDR@{NXRL%)i!EBkVR(DrQql+VKCWNU*my8}6y=FE~$sNlu
zZH)nEoI#u1;W);dm*bF3F(A4U(k>{qKOg6xLO=1kI*w9gWxNykJ@v&s!H>nW*$~+7
zoq;ZaqW(myH7h*WFRnahTiM>K>F?0D{T*>P$zS*C^fb(aW*a>te56da(?d=!*wul;
z+ez>8V25y$F=O*D7_$C=p;GZr_GdIU$hCp8llLwZTI%Z)SVm~5Q}6yr%8#euTB{n$
zSi|1x5}YAkG@)=}<eg~A9ZB#swBK21?(@+>yI7u0o4ctKW@O&^8*@r}Ib4oq%y-1X
zd|{#SXUFUB6?X5~9I%<ML1>C-MUh(@I}(jEvy%FqRiwKi`f>D8$R>x8&e~Cs7TXjN
z^o<Q^WVcR3E(gdA#G<m+Vd~r@oNMJXu`|lnUh{%l8<Z0=2ty$sCNEL&D=0>@<bf(4
zeW+ptjWO}{8u|V~f^I;@M2ifajA-IjK$&g1#LDK+fL|WW(*X@l$><%n7MsYVQKDF>
z^mV@lxB5r?ench{1wzn(1vdsx61&pBEYp=hWEL62j4@Jg)sV>m9oJGTuq<A?wFbpm
zo+c87-xrZC_%#}%!gtgbA*MO1s5fF+1(}FB`AB|8TTr!rm7xo<P8Lm;$x_f*o*5D~
zO_rYRrAP{<^UAYD0~)yZ2xzNOIhib5<51<vekmznVV}}QpxyB=tabf4sS7`{1V_X|
zqjLcgkww5dB?zOg`r<F&82!sPg{)vQOLei@&KXopZ9av$PSlo(pSccv4TMb2JQ7ty
zN(mNNpgl5m3)^4)J3=kibaC&MOq+s#2->Yd-9XzMTLOA0cfTa_=E{u_;-K6R7(@C-
zG~43oKaZL2Wbr1W?9ubt+E5|Czx*^c<^qH7%`7|I)ojYv<0XYpealWA8@{n7>|pV*
z(_BQHP3yp{Gn-Ii7VBf2pik*UXntV@_vMr2g;H^5l$7_N^D(Rb8T0qcJVR#(FU`{X
zty5wrL>Oj#kF0O%Sz1}#x$MNEPB%L%X^wV(ecTt`_kXO<rKW!?;798%Ix0i&7)*>v
zOs4V)$vEy!D!b|-g}4_~HzptXQ!~Asy`B73OW(v871}1VHAwgl!Na7Wc5Yd-f&#uf
ze4FEGSFeV)As80ORiBJkN9ZXYuwG0p>E}qL1LDUc0m#0Le7r`@6y_33iNDz)<R2_N
zJgH;CQqrvp`G%hGj9`$$-mmpmxlWeHzLx=xu@Uag{<ZlM&S|F@lviHN`w{Mjq7&{r
z4kE%IJBhNWR<f*;Nc2sxQofP0_)AvBbeM+OYL&jPAN8L(RU<g=3KCguG+x0+9pa(?
zeoNY|)|`>!o1kk+@ZD`7K5W}c3xx`4a9$&sd;6UuC36i7h&ow`FunjYqNEW@(B=5l
zjg*t{y{R@wD-%YM#GVWt^K4IwAw10a8aDN#CNrR5a5;#H{I|?1Z!5YZGL5->Ih<T0
z^qG9LI|7R*T7TuVZhzk=j=Yb*HV|NkO!|{4S$Wf%k<g#GB^E$)mLGCCV|p@re&}vx
z_zDy6Sqv|^CoG1RCd=(*lWa1+^5*yHR}Y6Wx=71MLi93tUWH<PKnwZFOTOw-Sf>nr
zjA}_WIa{akp_!hDi@H1(Wt6{x$86}72oQfV7fkqWg%xYHhPze8k}z?2V(tMf7y%At
zDnF7$mTL>N&e^sDP72QoB2{vV*Hetyk7I0c;Lrn#6)I9q)f|YKH>OCXgXo(YMo^t;
z%b8M#I#UHRZK2>0AWk&VtyC!F$^}8~hRQ2mco|zeYu6CZee~|n`vR_fSLiunldlLO
z{$J`DdU89MDKE6whhV@SK9_LphNuZH_M*%>&DM*VFCWuPET|1LKVX<r2CE#k#=gU{
z9dic&Y`&^mTa-o~fxlI?6A7+jp49FQ*jnlsf)BmEC5D84W?%nK@e~fX5*N*QJ=<Xq
zYUGuj7ctDkkwVHdqHe(NOv6h>Qq@kP<m}(Mg|eSYD15u1Sg+0y{>z=)`Ab~asv`9?
z>(CbZwEkuhf_JSfQ<Xm_UdLMBq!y&%{;!`Y_%9i7R%j%0VyAg7jNcyXzx2BovD6}#
zD7&t%GV23$vyl!fD1&nWqXp^6L0Iq~zHw!@SYASbC>-2M5ZqCmab7SVv!WKO8F*??
zJ`AEbuLnv`(#PN(8xu4X;Fg)LV8jWaQsJs&6)6KdgLBI3>>1P^Ni5%95W0!N`?4Z@
zAk$`o(!U=N#ARbrn)3y|Ta|xYag->WnY0q}X$IAD>KjNI>}Ls!jc@a~@KENypRTUT
zREV&;_<@`l+d%mO2$JJcfcRgrHyjqcGU)y*gTB}FZ>Jf{#TKGI3ncx%!Ad3nm86^Y
zpe45|b7g4=y-ZFyVk$5$X0n;aX`B}!^O81rPk?MwFzl@ZyupN8y%Z06$B1Z&q<%`J
z<vJKd7Xql-;gaMXQy=in?OrD({^b1Y8&!AA0r|a@)ZKwD`Wi7zjrGwUXz)3(E1Xo=
zVrU*>Ifi(Rv#YY{TmzOEIc|og&voymu4Z)w0j73ylO%YvS==N$Iqal?quj?*=(cWs
z;a>dw)YGjHP>|cxT#VEw!gR$<fl@!3#5>tT+%D~JZ_@{s%g^69ue}D-#K#%`D75vx
zK)*!3O=~L!4)d`B+33pVJDNcbmN$7|Qi__%+|D#8yA;=Ev}3CRr3bI5!0I}_5@hbh
zRVajZ;qNu*>FJ5EGAOQ-xS$hrT=5WJgUWILRiaP6`JZr1#yssy;R?bfOW1BXiZRCv
z7x|c%8;j1ee7a$;h``%us-D_lFO1gR1<Q}4{YrwcNIWXz2w(`wrC?-oZ3R(;s;xFv
z9P>`1Z}vVeNg9RdR9tq97T;Sv=02NKh3K%UZk-0#x{Bm*0P?{9R#5tXS5WaRP3~)=
z7IScqp$*{16i3>h139g3N28(izL+7ISUh9h5s?RfJVPR<E8WM@EqLbXcbm3^0RA;E
z0wy@Ux_;QpalJZB^gzBed~4RUULL;A06SG^J6D?k+H072BuLH*MMU+{M8Qy7=s5-J
zwyF(>O*7xm=qAM_8r9Jy^}JT141#r@x<jfB<tp6H7;X;>@+edzFQM+Z2JitCH-BlF
zA0x`bj*A`t>A`Zg2~Z2aZ_d@@W4FDJ%TA$_DC*JoSLNXSM>*&TMeWb0zWITA2iXe=
zFqU%>&4JFdOXuHEFutAol9|M|3Wq4Z56$nFn|P&1VQI-IPr+E&OtM!BI8FR73+U%J
zM^>N1_Ub>PN~b=lqPwhXa;aa3xHz?)Q3$=cg=rZdmiZ}=*YsSjD*4vb&gPK<4MCY^
z8yP3wQ^LW9+`|k*Z<<5@y)dU!M_O`5UT($1b#Fa9*gq`94gz<xI#+PGR@bC8Lv<;J
zH~eOLIif7SdQZMxL-d0--s1#ekRw71+RZDp?*6me<rk%mZ^Ax;9$RVa_fS4A9zF>t
z&eMfupwG3!;4msf+;uGuyouFfs@+frwd0q64N0W$+60xar_Y<V+0gF*%t!%spIiH{
z`3T1c^PAjG?yS?kxe2VJrU`T}!m#xoe56bplb*uhOAIumuCVVRIffbnA}utdcw(R@
zw?N(XxQR>S3D(GF_I{n`aMjp_n|e!P{Jqk?jrE#!FPqMuC*gb6cZ+lV!!)1o;U8Q2
zfn9DyCG&pl?*m`cUH*U5-6Z_swB0811K7y7#ch!#Av`&<vb&tgq}qrm$9$&L#Q=b%
zGn-soa%C8#qrKPTF&VCZd1OlPf=%^|%ip%@c_2L}!4a4Hr{EjaYB;DrYPh?)Z7i$^
zIle107p_c!2idBEb|byTUy(ZzhLQ)_*2wrlm9Z=|Ow-%VGn#50#*rQmdq!HOY(RQJ
zo838b`Ra>iY11g_#7N!qdy5z@_N;(X7)n|9l>x_M?u_Oumz!aa&{8T_cz6i#^*Ap7
z^9sh&bojsE*X0aKB{=a5(Ylg8BfbCVj<^c&<7>C}69y#5MlDjIP1=a{d+rk;BOVDL
zJHqFJnmo`tpc`jw{IvM~gz|JaBq=SC8z)pw?u5P6ccg=yt~nG;*-$xPX-C2{GS15)
zV@<f$ftGlgfPTmFsDpF*7I^z+&e|rNL23SvoK+mr^RcUK_!3<RY;FWUEPrscj`R6i
zGH`TiC%JajbNO1G&rG!|SWo}%#D(Za#{qtsE)VR^T2#g2mXo}qf8jL+Et(IJ9D>0{
zRrq0^L93L#W*;}p(iq60(m$kw@`b5X_2PId#-}p~%BKhj*kwTQ$w_pvb%atU9_eX8
zBy`xFF4RcZ76tLkTXYzr!y+iHTSKkd>YKMglv9ROK1f=V%o{51Z-^|A0kk6I?UTDR
zijB^syW+D5b84Hu!wB`WS8T+gDi;nnnTWi#RGN%I%hrH$-#c@PDbj0%2Z$$iP2e8Q
z8Wm)zGhWG-Aps`|S_9KJAP3%()Q_Bx3eZYs-~SS8@9QQS9}=x}@(?1fz@hz1{%Rjg
zKi^ah?PJR^Nm_smzIj9;MWTW}jc6aH%YqUHXkaNLS;H7fJ+asMA}APFqSnFbAENTi
z7bs*mtx$YWzfKU@BuqXLj%&<~Eg%#&FbuuNV1V}(3WJVyJn?Ig0lN!Y*t2`OHK_(;
zbWNcl=;j?K!}0f?Ul|619X;9Am#{SzDbeW*<6cmapW_{~>`0*<A?a1zn-e0+h$oXV
zy)0Jh$L>9uj>_Ldo+*kxG`e~s=iez?c2zU+*)K#SVTTy8Hl6%u8?4IT%zmQa;*JZ)
ziamY<YotPI@>|sn5kwdx5lmQ;$hI>z_FE%T^*KO=?!cRb*eCvX|67$ZC<)3O<3svx
zE>L#g>|PfiMxWJ4vIyn`Ljw%rEH@5mDECM>h;64QO%ML^XoT=BmR-|)4Q?cK*Glk-
z{w2t8gvrGX>^P)??k}vs<cR5M)n^f87;WboMns_9zHdlJk~~Z*fJP=9zG7=4Mxw0U
zBPt+07fP*{#&vPc=QKn2_TdY9ZSd;|;QMz3U=Zx#TMYb^Ht?uaF^=d~ec_;}5E=EZ
zcAL9g6IZH4{u)cuID0ipSe~*Y-4<~g6E}_79gDsikis}`LpWLjKoNe%=d6Vj8EyaB
zd2LFPHnDq=Yc{dZZm|`-XmX*u9(Ir#T^js;uKSyLRt6Dcn^!W!l(>dp9ClQ!R?8=)
z_)JwxnY_tjRuP5=bxs(CtI_HbV-{Y^w@i{1Z;Sn7zlOX*qs!mspLRey00Z5;umv?;
zX!t(grcCrYbj<f9hFjrLK3Sf=ruo2Ott&PIQ?CpPzk>GRI*gNE(2L-_j<w?D1U6Jp
z=_p(T+5BvI5UoOrm5vSC0fVb6<jZ}E2{9sPDeW4cI9}Hcl{z&-0^6eK^ds^@QayL-
z=88F5#Ih%D>kGRgQbf%@0)65=Fyw>E&KzU2aH(Qb91}<G%PIzP_)w#Cq6?o72YYHK
zE}A4J{M*PMuOT!4?7tzi5kM<J*)w!;O*`Qc<rk0bN%=dqtDTY_Xw>0)g#4oz`mBrv
zXe=v<8k#jX9lKbHmX8N&;lz9bt0;hSK4wXpJPLvpy9^4g6ZA@YXhx&3Q^_TcmjO8(
zE;)CQJ0FXBUGgLOF=vtE<q{}3ONmTAHR0%O*4N;uuy2wZ2L$N=s@?d?l-X0C1Ekvb
zFpBh5)_qJ$?8`CFVx~eAwM0Fe{W#D_&7QTlBn2tXg_|D2Z#cEwxV3oGwU6?0V}A&e
zZ0+{^U1@&(Q`AVxFfG5eN2>LbbkF8!^TzETJJFm@q?Cf%mN<f<@m^e+d+VfnT&fxs
zdfy+~*b~^iE6it=T3m2X=r>>|0+k1_yHb|qz^23|4W4`Xp6_oB{E$cGyWa&<=5Eba
zb}B__DF`1=0mO}>LcMchitXIrjF5f~!s~aFBJqBYDDD;Lcj!h4)kpnl+rk5GMOuvB
zgIch?1nayR(UAd_VN_jSMFu)~HeJ2{QuIvq@Cb9g^2NgOGgNf$voqHRT0@;oXdLy*
zioCtCwc9B=gW!g_S6u&%pS4~KX|8=S<7@Xt`<oJ-)^qp9bXh#f_=_S_*<T;(xIxaM
zQ!p2(=|kfvTZA0wLtOqcFwC%U#!wwxJ4h4o@M9~TeSUcgEg4%lIB(sF8V;}0qgY!L
zJ{!2?%}|K;%OTdoo<#9Pc|yaEe`#O$buX&Ahv*~p?aedmy-CuYfi=c(z*@et{}>v8
zZ6Fnk<Ci6`T%eJ>q`ioa64dU5?QauOSuriKSQH*A9Lsm!7Q|v*MXmvV(EOwOVx7cc
z3%o&>@LRL=bzKwrX9|xmuw}?8Ndn|^W(|nhhAN2rw4pNxD~PtfRedvU9`9=#qZedN
zmnxE0Jt;DgaB4;2vT$VGY=p}^^H*mkv>-XAM(CrVqlw0PDh<Orqwh&lR%k`-?4vQ~
z@HNKF4;|;s;B{lEubt8!-=n{{1W{0#&xI?4$p&h-g7Yi9*G{y=De)Gt*0P*uCT&A{
zIklN3H;d>HFJ@#85};39sL*c=A(;|Z#e3uZNLbTQ?4b0>{4VyI@4S@BxqXvuMfh^3
zT^Cmyhp!zW_CHro?Qch@>!iAnLlXX?2?Sppak^aS?l{OdxvN%$5KfSg!ly%>n#<DL
znqI;ZrnSLm0bg#hnlldWL^;ruS)f~x!tuL;;EI<lr?)b(r|OV4B2hq711&=_!F8UU
zzp0w>GnUr)2WY2Rhf@M*k6O{@z|L}o&cY;fBztQ-m~g5&z0*wn1Iabayr9DPs07$W
z?K=IVQQ?@n>AnCaaJ{^5Dm}I?&dMS**b1hetJ<KBq;Jm7Y^2~)u=n>~-m7dm{G%cp
z{w{5XRa#3>r+NGue$y>dT;AD5`KW}p-+7tZdyF?k%pn)jQ!I9n93(?~6-!kEJScAa
zYxK9^#-n_H6d+qLBY_f%&?1~KV^Z3+;vHEP7iBzx5cqqymSVw9%4PcdySl>aJ5v-}
zE!D%i<x>J-NLxPT1#Ow3Xy}Zh6kLAfTibJj&f>ngW7Col(b{Y3R{0pqu;ozdE*|5u
z72-b&9x(MW+#*xa`)2OEtjst~EAM#dw|*KhuUD)5&(&)B+YiW0)c<k1ua()f=ZzXM
z3EfR`+Dwsmqc{;=f-1J8;j}VFWSz}h&W&pz)QIi3kKlYfq6!MIF<vp%ZoM>gQ6bXg
zv^TyTuqn>`?kmM*P+hY(484tgq3BIm+m_A248Q3emh~oB+UPCxd!}U>1I3HGoRXRm
zF>4$)e!g`=z9Toox9*hlZ%vEl`T-^tH(QlU*%VCeu13G}`T;T=GR|u4&QtqboE7l(
zw(@)+{(^8m&+ydOx%~Z4NPDb^kSJz^$$1E%r8Yd8{D{H|dPuP2C=nyH!EZny7si8)
z!Fn88!{8bCpzQuaRL6U66)Ja&T52M&XRb5Ip96(d+TZR*AHI)=n3X8=OJ)eVq_XkO
za0m`Lbmj&5eaKmQvAg<!G<KiyXL=tJ8&6W>_T)C|#c~TAH6J@i>m_cYgS!NS(t=4U
zP<zFrGvtM^Twxu*b=3~!Tb*M-ZAG?NQl~G9t(=BEyn(tlB(YQOP3JtN=|PBZ_)!9Z
z`a1<Hjqm17-26YG^S?<_sf_{FX!hZ!Rw`qqmBH95KMo)VW40Q?*0_^ic`=}g@{1eh
zg{SY=Y@a%%spHMouRN#?NW`(sp7oL>5m0HN8Ljb0ZoaJ2+QjoGjMB3ZK@HZC_k%D~
zejIw~g()Y++y-M|87Z-7t@3lo=q;n%l*V+2868c1Z?S7M)+~xmK520mo6oO<aKZ}Q
zA{UO=D45g}R`$)qOB{hPS*+xl0ro<Lsa7Lx#oG3$#6$Jz?FIVK0`#LiPPsz;iYU8B
z^P7MnJDIp+rQwyo-}P_H;SXAD;2hKl6@CVKL1jCv((nM^1%hL3h8_nJVSQ3XcW)^;
z>;PhubT{&l;w||Il8YM51?VP|HB+Sr>!Nc0!WfE}yReP^HBQ6f&)Tk2F5CFAiD#T8
zOHyk@57c9C*5Es=dp78B@r~xJbzL;YHF}V%{w!QBmw4n*jPE_TnAE#-^F(f5Y`yu1
zUY0^b+o17CvmPNl*u{{stSg@OQ8IvoX6{3O`1sdiJ*hw)=d2iVWt*KCPU-Sj%pd>3
ze4`iYXbUakM+Fmr8W*z=e|+Y-p!5cbh837aI%0l3#}4+p2b*uDpYqrNN<25o@CZvp
z)Dmb$HrX5Z7jYU*sR*Ay>?UEJ7p%LMhU2|GxikH5xh>QiR!g2Shp54yU|_?vv)a_t
zP*-P&ZacJ*sEtwR$L24<`}DM5LY{xN)cX5167AixiXFXdL_|%q#&X(jo1Pe=2fUJ$
zyu}#(4-g)Smc{7Hd_K2h5_!WDouL&+L45Ub&o3*JxROB%ht;50F*fmUTcc7*+PML|
z<G)bl^_&VJ!pwx9^=4A}z-C|8`5aLUT_efshN&rUjWa>|t`^mVs7r{G(S8n&S!1O9
zg*7JjD(|VEmfepQlg@|*VxMzKgoMt6IINbKsdc=aJ)F?*+Vmi`cZhmQR{BMZ!r&$5
zzbpXxOeQ{T#K~*;0MVzo3-oNB^U{5By{t6A&-!uHfbg^i%Kl^YCv8I+s_Vj?Z?wMb
z?F0y;@J|hINtcLU5Ll5lj2x>krCtgDzs@EZD<zIKCa*F>>L=9{IPP^%oI%S?Zz$)P
zDcL+X{pMH$)4Lb6O@nMweJ6swk~dmip(kQG&S2Mrb+PtxLDYGFNn3G?2x+vDFD23R
ztlr+|a_~69$X#60WM&$+mz@;LQYI}xapNWQjvU)9<lItxLLca?Gmpsq;%)WGWh{P^
zq!b{<*b<R_7`eK0iHEDEREBga?jpzSsCVS4^kXULr0s=6??lb?$2sAlsQPQI<ikJZ
zAC%FSNVOU#W|h4%`?z@$mSmuxGB>mn=FDS)9xMqaDIt})yYo*58j73vwDx}8=^)xw
zx(z2!_*OPaL5lbTKxbw+F`Bd%NH3dPo%2NE5<0KS1>Nri(rU6eKUFqXp|vdS#ZZ=e
zp{@*Oggwurey48TXX$+2eh1weOwAU`6^-XacdgdOn=AwRVI<&XF1w!yJEM-Qn3YBJ
zBLwOeEw|nLvt%MNw5#qw4w(E~s0B~YA0NCRH5Q4KXyQ2A`CIoji2dsqI~OEMlQNMR
ztsaRlYSYI3$JVZI-yIWFWM6c)uzVuky7QF<Lp?|yn<bP2dbtKm79I=qZm?z-G37EP
zj%2f8SqIKpByX5(c7-69?*MxzR6V0>t=!i1HrOMm3RYYWEbKJNcnEtEp3W61MHkIH
zS~3FrfXT>088mgpO!Cn}GLW{^fe04Is-ksjmFPF5!M)FHXtJ=anu2@zKJDaq^>BD;
z!pU}kZ9r*dZ!S`9RkoAib-ts^HDrG#jOF$!900HU@QU?^zgYjv@8uVxh}-CO$)&8F
z*hsLeN#mSorrL<b1ISu^F^Cf&xX`L1bhRKiMzMD;6szodjIzL34<gqOr2}Ih5UF_1
z<C2m|BlT06cr4PKKSuuAk-OgxQxy6(=Eh2C49g<gIiPj5*7j}OE4Mb<ayvzWtD5l#
z*&6oeD*QR-ZfDxA=O(%Iwcd%t%yM<{&Z5xotTADVkM`CZl+G{3@t?-0isU<bB<4Cl
zq79+B-S;UAI+oNdy_JfmtKvXtA)p9}Tm^=|rg)zJTO;F@Ov@$8ZYjGCnLh+3<fzQU
z6=lwTWq~PoH-gqu=I0bxL;?@@{puM*#-^&G$<Ie$LNcGA7m<*}OrL#<u|hJj<r(vV
zhxslwgbB#1x6Dd~0<tbSi)~&mN$BgzG5Zw9B{8Rm0tL;zQu#ZZF{?De^-a>uaXgJ?
zA8v)KiK3|*)0AxW5W>;NM*1dGVg;39^NqY?xwIDbeR93XgqW3$G9=BOCw^ZK{-oF8
zZpE=D1y1No*T>b-%niA+nBd;QeUu7+y>J<?(wOs4lc`cXv#fs%g*0#&-%&Xi_*6xw
zH}R>B5x2fXddhoY>L+t-jWS?}e&d=W%@Ls5w=`kcNrcv!Tr2cJCCOgcHfj$!T&<pC
zA|pN+k0<4KY&Moegq>lS{iXqNoqclRE@H@Vmn6Sn<CD#q9^8$D#etaNo>H4sWKFft
zNz8nAgD9KDIYI@Kuvb}>2itq=8KlW&qASZasxL)rBvNOMqOK*sYfyl$9vvsr>KJL!
zT6RC?eNxrpUk~QLih>yy$EURJ@h|6r-Tb8n9V@e=KDO^sk^|=YSmkH<Mi#h@DfI<_
z%5fycZhW_C5uYO1`C#F+xs%01RZW`T^^gU7Q)?)tqBLEyMcHJ^I<~LNaLbHG__^^Y
zVG!j-Ol8=s?P6YxK8l1$Ny*1Qwlky|mfT~0ueA?A|1h{U8(gXEh;&r8B~8X~p$U+9
zkTvb?Wcw=XOu`@L)G#Z*FA}BKMa{qAmiz|7=0mP=dxk7;J&XP><o_j+v-q4zffwd7
za11B?HrFCz8y1@A!EnF>MpGUvn`q820FD5u59ig80WK4aL59Ky|2=}OwlQ@ud~9OH
z=dO#7(GN!X8h+Ta!W_S_AEiRvnU=u@o%tU~`9{mw5}_-dSS;+V5105P>xf;}krJdn
zSF!=>6J5aVbI6h_W)6ANwI(85kR}W!Iq@-Wgv`90*ul_C!4DM^I)o`fM05p~n)yBq
z*vTsTTTZ%l7TN9sr>{)-UrE_6{!K-y8cq8~<`c)0Dc2xs4R8m0$c8u%Wt_}-mU~CB
zXI5Tv?5p`tn;s*}SPW>LWpit}NybUzc%>*LdJ{wjRMcH^^9|T>37i1gd6+Y<ZPYPi
z8Vq5hw8=V0ht+L&S9C(S5?Tjh)s@k-VYpcLqZh>m!7LA>-=3Hv%q>k+Fev~blme{b
z1!Y)_F2|a3W(M|JXkJ#Srt{30kM(z=+;3DH0EiB>p932zt~KC;E(#pg`6zh@IS>$<
zl|JmrN^SbT!lLbUAx6scY(H+da_YYA*OQ;?chz`AJ|*9O7K+J9V19e~ZuS7tqg*=N
zo0n>KD%%<SL;i{DfR0+}x?sm$f&wPp|Jh8=|E&zqEeKk$I4^f_%vRJ$5K9^1aM!pv
z+e8xcOW9F&Sw<h(nknn|Ws<gGZNfYLBDhjn_U=slQwBP1x7=b+eb(KaHq5PR<M}!6
z7-i4u7?Gz+Wv@agD2l#DqL#&-WSQB7;v^;8oZM+gDdd~=o$W7@##?78n{GLzd9D$%
zo-v;Wl{kB-m^9$;M_XMWuL~oi*M-r>z>Tv((LFU3{Z$#MNB@wy&!9CjIu)-1N5Y5#
zfeeVOFi_dasXXF*{8$%6t!1;o2r#k^6W@PBEg>Y@=|6)JGf#LP_9*YcP-3gifYcej
zwAe^`M8k!(u{a{!7m(^wqZ+<<ZK(|Pu?;sA!&aDz13}-qD*HjMn+05%2{E)uTte#f
z9Wf4vF-^b=TGB#ZuQd@rKu(s}vN@nj2I}t>)#rSmQId!kcz$F&t!WqKKbR$>vs7Z5
z^g@>k^|meB8_B>?pI+0*sN;?K%pt?P@dfYK>n`~prQ90%XWe4DiFrjc0FfbRlsO1X
z9IqR8H=q?r5N2BlRYc5_Nv$x)CxNMsPH0~s&2^;!nlmXVb~?UuyNU?9FcPKq<xkGQ
zaeIgO!M8a=A*<V)pg6_0*b*tCvN#Y1rB0<Q(HLLR$)rd3r{H)E0U~X@Rk`a#cyjQW
zLMn}?bCt_uHzASAgS$nJ%z-h)2j7BtLt{<TkSGviCimGsH<$j6WYq@6JAR@xjFl^I
zPXguwsSij7O~H;pf4h@1hA;tnz2YW6VVkZ0e`fZv({%V#b<=r7e0cganc5Vg5lOCn
zVoDxf`laK%;0jgG_W48>KWP&$CjwR74gn9Kpgq;8m87I$Oq!I6*l!vewis$=)<*g+
z;Z}6Q+5Cg#10hONxd#5Iftw|sK9mP2{nYVQ<~MAOCekTG5CGanwFe1O+B|dtoQ;fS
z-L^puC{>vtz(|AB9|<s}CH4a|HeE5)HbPTIFM)w<t<j4MZu!|IZXwh+cN}A9ivLnm
z3Eif5)tpO8Dxquje-_}is|mNFh6Cbip|sxTgHnC}#N&z_K4lF{2RSZA;?OPYoliiT
z^~k;`^JkR0@vpy^9P6H0*sb`CZetS$%Z;~L+WoN)>SxL6a$Bc$JJd0GI2K2C+I^8|
zcp}yeo&*oYx~=&5w(KzB(P4PcTuiGEsv#PC3xN<(na(?1K57pKF0p&93DiM}7f8^T
z5+QUG$tv3Jl>!7OKFYe&dzu{0Y=JX%V~Q9F^qE$;$VvZIPJx!=j6d&Y7XFvPF6}cF
zYUZOyTbxh%eU-+Kcz<jq9HE`!{@??BJByVa2Gj2@>B{P}YH+vpp~QUg@p=_OlDBW1
zaDaTk&z5H3Dc+<0y-p;S5L~+k!`J-<EukbB2QX+N`MJ?6tY1FfO%Swwy`Xvmb(1Tk
zlCX;S+0>Bo@e7rg!%$(w@P5UGTiC$cC0;7k{Ld1R>wSk`-lIu!R-O1`>3+)+!gmz#
zPS<)cm`<vq+;ZXx`<XGnF@|dr_wjFZ`M&VaYm5xYu3tOsmkpUB5rrt@)z*TA(oRj#
zZ}{=PI}$@JIcF#;RoJmfAr~68)5etsUHxP=?#3NQa0a+U`PdKuX6GUgSAz@XH~Bi#
z$C<*z&1S((G+W?k(H2SU9&3c(^}J0@`L^e*u*retRNvB+sQga*F<^hk<$TIubgD1A
zYV6yD6c!zDDLy!|zex>%UM;e_@95x~s*}0X#o;x%=2^ndaw@>$g&sIQ_6bj3-h`tP
zk!5LTjgZ_?T4VT2KNd;(M=TVgSIhrz>GDs{3>!XG1vga|dKULBg(nQbK+A-)aI2b8
zbGlbGRes^F&kLoz0b+SXceP{z-vXxdi{B8zZ38orP!_Qfnj7Ds$7m5jHVck<_KF%c
zuX07k4%M6Hy16_YyeM1tVid3eq9`@9bR7{faAY{H4lB>hMw{wBLyLc|Rao(N*#K}P
zA=dK^H|I{fFYI&o)NOfdRZ8pSw4n^<*n|4cv8J86h*w#+<FGDHIazQ6nK73<+F*6E
zFW@MUu%xp49k)z|2M4C^SO%itfTsAh*((uwzY>uPIG|m-nV5iZOn`}|HKNWK`WROK
zg}bA9#`;IP&C((zuyy$;Rm4qZM@npZhsfAo4Sn2B1cwzt5QB6rV#ayNFe{0)oePL+
zL*tyBVjE9HXG_71v~faNw;_Oj6c;*1%BTsY04LBEn_Q27nG>U#Ttb&-)Rusm#aBko
z1sq@RxM1ExF)=cq{z9^bDlY9mhqaDVN6KTkS)ku_k1(}m?^L6F<(t7uJZyf0&{<8@
zFJ7U;biRbDIcWM}m9u&4VZa>U?7Igq>*c)ujs@0m&^nU+&Z~Cw`nO&>k6q&Kw?&tB
zm&}~*6i|^tM5n<)T51O*p?vCNsGACNu;rtrsH<WT*$n*&Y~fny-NQjbvy?xe4?{Cl
z@wX_UlOPGi61Nbpr68ToKvWkA%aPVy;M?Otu%M5M;9j*Kw}~<GdpaRHtMHD7T}Nt-
ztigofb;bG;b8vSSF010hg?i$vEiqWkjaQ;EvDh{lvs;>MM^I(g)=ni1<w6xK`B%m1
z=NdBjE^L|b*9nbTry?FEF)2+6cYbxX|F@0x&+8g{_ciHI{in47Z<AoBuqYVd)CC7G
z&>?}SK3_NIaUsNrht11yA=<$2jaLK=*PRg8`~y*xDN1TSMM-uCHGr|tNZuq;&L2(C
zd_cubt%^~5;#-u0nsyw+l?PEb&~DE$m7U5=-{859lIFiGK<}rzZa)yET4KpoevBvb
zs{{8DU4gc0e*$#lJ9gzrbPr~Je&M7x3?LHJr>|qOb_G1|T7u4D-VBgIrJvO;!LD>z
zH%_TgeP2R+K8-yyPk$ZL|9iP@EPY0zmL3iR2*+m}LRaAGkv*DopCb)S*3jxV8=C4Q
zZI5sme51NaU&P%4)ir;dm!-yxQz6V+B9YeYhcUL}xJ5zczTV5UevLMSLX<fE02b8U
z8P<t6h4+J?XB!SsZT*lX=OiM@*$z8V=5mRSQ<7LJdc&04NlBm3(P&Dpf>zDV<BlJX
zr%DBZtbd?ZK1VW<BCjCJsoOVTM>M-g`FuhY$HBn{(GT_FLPM--SrgFlY~QLc5{chL
zp?rPoIPt%kolJB+uDAoFPz0rK^_*UBQfY^TPGAmWt?CPWm`a}{>b3|J?a%SnKTzdU
z#xY@0g#XzWHJ&VZ-`2A|<27SU{ze;~vjZ6Fb6ZwkB8Ef`bBb;KunfRVkqb=$#22+v
z@^6Zi85b#yWrSXu_ou}WJvLLinn*G?nx*5Oa|pb@bCV_Lx@?E9d)#rS?)yeHfvWOJ
zOw+IOl+-GkZMxb9Wy-jk&qi<G{CPhsXPF8dac6K5EKIOu%j9GTrCj)r5&iG+c_Hi8
zn+Zg5hqy8VZrXQaLD0#tZ*|{{@D3kS`3h#QS$Pn#&<AcfN%Y~WVp5@PMMO=F;laAq
zDMEF`KF${uctZ{8<pmc(kJuABw|t&L%!y(C;yJJ*S#Y}MIIxr|fvyOD)UI;!r-*x?
zD7hLkVnJyv^)-Sq7;PWM$LIg3dJDd&x9|O%7`nS*29WOV?vieh?rsothDK`W?naPq
z(4j$6I;D{=K@kCO<ec-pfB%Otulek~*Sgkqy%!vTrGc7{Be9DYWXr}2ncB!~6q)*H
zjMHulSTYc)E7ylA|K%kj`w(o8s(fE{eURrKtj#pb^dRV&?S==Fux8Z44nZ!C9n?~_
zWn1{4TbNOmGd84MErmH_imtdqir%Y<^`iQ!`g5s@0IGvZB(M4$ghD*Dklp{5h49k0
zIZz`#Q8k@TAmfOW)4Q)<&W=8ce56>~fHGQI#CBAhuzlz)7FNC^Y%odsgF~MJNlg(N
z{5}cKO*ScZbE>YM-DA?QC<?aYdwX1`Jp*h^nFvlEhFT?#9K=?lIQ85zj4;AraNb0V
z@}l8^km-WMAmOge5LhK|K(B^{2}^-p)wE)J5DHb+;UqfMNUn^C9|XTYI<?b;zKWAZ
zCTm_)d~WT8>x}dNrtUnJnH(vYLNm)@uI>Fv`NBUt*_>Xm*w}c`tEg#PL{xXsS}+mk
zMcO4%*y`0_f*A}!iwLsH`q91tODGf*6{BL2^=sM_)3un5qDc|aev7z1(2n{TFeo4P
zDtJW6g~4~L25?Z8UmTpP)KZL*=7?ABf9;H$904gEcGyBaVNHLnRJxt(l!Rf1_n_!%
z?L6#F@I$nP^krM<+e&mPHcf%6axV9Idd=8*;y?!ZDD!5cUcdMBmAEI9X@thS#m|L9
z?%x=vUzM2g=h<90V`0H~jGvZV*gcCFLoDF#gi#6%PZ4)21)Y4GAs@-ZmxJ2yLy>4=
z8NWo7nNKRiz|I!3F(fb)GJy`+3JM4m*{#XSyaU@K67$fh!F5>V<LRU!HwOk5Zv3vV
ziX#dfS?&RdYu^EhIj=({W=Rhj9+NKamCRENe+}(K9D<xGv$>9%td&`wBt=`=AIi$A
zs#iY@%%z9HnIIc1)D=CRk83v@$!<6VhyF?;-9YgU?Zv@;zS%DSojWx}6qf0^h7)cj
zCH>Aca*5u`Zmj<vBAJO&r9o7AbSe04<}H_$49GG94P>+hvw}ZclCv0JgS)(HAAYcy
zz8a@0b(mS#UjoVk)Ne{!l<iw`<f4z?xoec<<PqC472icS3ZnvJ>Zeu~82jci38zKE
zn!n=23lpNEo1fW2rDVFs>ec+J!0l)w<!365Q7}d9#xtb($Q++9@3v?v9dQsO)#}D)
z+QsL5e*5XfGP%6nO(-+<dCokx{gX5Ki`A%E!Q;l(z(*y(xgzFG;zbma<BG%r*6W{T
z9a_>`d$MJfU@cQ>%oa1Fjgf82H?f6G%2<Be6*dGN>#%M<_)6(S?8V2K_%nXS!z1g;
zFyNr!X-{?4z^Fbt>{6^Vb-NgEJ<z2$N7Uj7;N5@~Jg8%f?|OU?I4>G|O5{4nFZ|Lr
zmNxmwy$3oHUq$2X(z;1izi-~@LLPtb+eLk3Yz>7d1(Vinp*(gr35#v=6p7;7G|n=o
zFf&*Gzsars7c{<gw)O$#@soOj3IVQ<MZxmFnl-|c@=~Lw{Dbn+D3eIcm*6F*pyH%+
z=(l-FmD57KFKNFKCaOIaea8|a|M-h835oj{Mn0bgPJ`vGlS#pFtwpBEgTKTym2bov
zdQrG}nc;sWM-|i({icXnqXi#|ns`wK>J!rXG|EatKUx2>VlwNuLPu+pRCmY;y7I~R
zK%D1Bsnp^k=q*Hf$8o?6ar;yB{uA|tn>XZoS^<3TTYV+5v-^L<!7v3H4#}aZSEC@(
zd18fGrY+3Gqm_APL5~EkFWfG=6W?f5&-8W4nMkEIqUlMu`})+`YeGjy@mstFg`t+p
z*#SpzSw`?bK(p_`!7V5tZ?yn57I|d59NFxr@$agX4O#l^XjZ(3h|wpq>3n{n6us?T
zvT@zQNW;KVZUlXp@O1qt0H@}f_YW2-JrdOj;vqwP#u&;s-6lbd*t`-j27}D!fzcb>
zD8<|g6RLiZ+*qJjfI&H1Xbltf$;hW3pYIw$;h-1#QFOkD3yeZ%ssAT8?E2I$+yg@&
z6!vK|e(~eZaztMT+j;v+{6dLq4VG|~=JEQ*CB6fIH=g=|s|wB|^9aR&AS>wassY7v
zJt*ZV2xz8JO`Vst#Rjr(xjS+;VIAofY25Rn9du`qB47YP!p}LaNxk2dSoVPL6g6&M
zid=kHpAo6etzJFmd<#$Jcxh#-#uPzmc0!+K1c1p7b1}zf<>II?%z4FW!`ngAK_~=<
zJK(C<7XCHUKZxGb=A=!Fisr6+HLRk3s53S3?O%{=nRQ5*-h3#HU5{htQcd*O@EKsW
z3x4%nz5RDfyMRU!;{X;*gFDd>F>a$VHf?DzLh97ok&%h@Y|82Is1d_>CicBh?Wp;Q
zjhhO{xVKbQLsa-cg$cn;(;8OX*<}l-I8aztm7f1vaGUu@d8!$|AT!FN^(se6S6-x-
z144G4rLn>*Z&j{cmH}|4h($vVU1TQ1izpG&q2@8SwLFCOyh3Gjv?<A&^J!D7rDEqL
zC?+CDL~nkl*tW4G*Bi{`<$<)I&xH)U@q+2@BeXChn2Gfy@a-h}bg!<Xrmu^@jM(JB
z;qzDd*LZ656yDnMVuK^hcb$PVVRisX^-hdEnGj2Dl&!-IQ2BYa#Yf7~--ilqM_4q4
zPDfPUasiZz7|15-?1l1@e0UbEk1~v$31B$!im0CmE_yh2vctGM>9xwjj!BDNS}5cW
zLR~u@8=Wa$JL{6naUR1+ArrjO11MxPN=fYrHdkOkpK|W-mW`z@F+4H@>6(-((P2YZ
zikYGOLxKpIqIZeLH`-B{VYb@i<n(})9sM<hwcF|>rimct*Av_SD(mML)Bz1LbhmBI
z^T<BX8|Qp#u^Ca+$Wi;LL*D~0Tpjy@uf&j58)e)oZC6m{zDZ8*0*8bN-)&*B*O^VQ
z16Z$#Av7PJSgbC$QZucWidPcnlMYvBUS+A6BIPIV@jcarQG-*{#6lphux{w}h~lYJ
z$9!QFc%j8Kr4wplAjK*PZe)z8<g^fMKhJcd=wg>2D!{IV@uyf)Z2L~uoJ{Xd=KpS_
zalkk_k0VEACCUu%+{SuVM?d~A)y)8RX6}e0-LYR|k301!pmBu92bY$_IE{sY>%nLS
zEbJvXM$a5p5pIE>;{Ad+hT7irQ;Rl+I({Zg3|LP=Z*>=K8S8*;JfLhfY>X_p#M#KC
z*ljpXoWo#NoItayg9r^5$l4*?O-3i4ZyG1VO_PH01HxYiYzVpuADhs%)pWrfS;Ur4
zC%9<rs#YhrjlORgoE_2X{}AqCSz~qYqvIQX^ciPi?32dVQTVSBSSc+X2YfAQNt6G_
zMe|;lnj<L=Jl<=&zPHUk*c^t6DbWd1WhTyre1f@TOLpX2F46M7`-)$e=Zu2;Sj)I3
zP&R^yR-?r9@IC82Dakoo1}kN?6o4s?=nN^xFM4ZK_T%(h^!Bage5KsD?{Yt(_e?Ch
z8<$zC2=#K3{i{V;(Qm?SuIA950%q%=`E*&nhHcFsmU4s&zE)QB6-<I>Vb^&%K8WtP
zFkQiL!30L6`?;*e91H?JO2m%bO2Y5N7YbaU9|Nuyc<r3^kpynN)#B^xAAjd#Wnv1H
zo*n*|x78_Qr+k^AT)-qnJTR<&ujsr_E2t01M%6j6<d0P!)Q6D>rVpeY8<%QxJQ7u7
zKpRfS2~<Gv-uMJ~P8qM?bcWU9y?MujV9*U7GF3g;n%hVJ$R-?^gjs)5j`%0xLBO#+
zy(7n%A&Hs-;)Qquyh_w6q+F{TyQaw7kbP}-S8fcSO@2FG+X24lElc?&*p;pdQ2P<G
zdpvZpuc@6E2W2L07YSR$q8e54K16WY8#QKBcGZ#_bI$k)@85PMEh2~*<tO96X;`sL
zsZ;rk-1whKs2zxvxDAIU4fsg;F<>`&oF2hq*0rW!u^)T?3XwuGn#*sE+6dKk*iqAR
zj!X?^N+m_nXunL?JHC}g)sgDf8zmGya}IuC91WGzBQ&>gqxXc{K}ub2hhbycs;g5A
zkR2-o5Jm4r&<82O$4}%VjOG#7+E{$VIf>+0$y_hx8Ij9q^5gbbIP4&z!RY^*sTsSZ
z6er8uU;^kU`6VssnOI4jhn7@`G-||7;G9ytbIqT<R^(F&zo-o1uteLL=24DEQlKK|
z^UWOI4>e(Y{uo34ORV@5m1Ir#`FaEWVgTMbp%X0`1klM4>j*NxC#MMLyCn_xm~w))
z1-5z@(`SE?IM<U#<W@JEmL`{3Wl1SZ7>VNxzg|IjVP3&B9bu(f)P<pV`be!8akPDa
z%K@ONiiNEJJO_hXfNXxbg<2K{Qi?v($qs43lD;7$9HVXy0$k!gH)p6uzf|ZAk{gy%
z<x1?^D#_65DVbm*L{f%6Y7;$e@!ib?@6lJ$?}Cha*{e}VC!>2t^)%6P)V5}P{$D*b
z;)LFkZ*oUEfxwD79CAZg$0xr=7P^L8(37uY@i~{%7xETnlpm0OJ>#fj%dUV?dr9dK
z(GyldWyz*{{GS#u0FBdiWjyS+PvR8{YobwPL{h~I<r<rlhl%L%eb0u}D6jQ`aB-mZ
z%<*9NB<7gRN+VI|A_8hLZ`f^kuco1J@Xnk^Y0;e;tYE*)37>1$LQ>F{ATXck4^9Mp
z*@2d^t|EMg{3V;43PN_yBz#4OR4xg5XR3P@?D@s{Zx;83N5JjM6J;5U<-JcmyQ>lW
z9R<A|Ne3whc+C_6hz+*i(V;C^o8Vjij3>&v3=vARm7>9BDUYj+6u>+8C%|{s6<X0`
z8GxEilj#qg)z^o&jc>}yvVSlq2Wh=AUXBlAkyj=JA@l)r#;3f`VEj9udq(zfww*Zy
zkTdgl$4I$Bpco-3yvNJl*Wr`NNn<DO{BoTOe2vQ*gNHe1@fl|$eUW}&u4jx7>MuF!
zX{TMSPeN664Xyqy2L7SGBofQL$Fj7w84%vGkS?P+|IQbV-dU{HQ9jL4EZ<9xGzK3@
zX9kqEm)^}q350ipC;?MBc9$c2y0nGIWXN++@Jc8<pk}A?UwU8pyY(S_WW7<XQJL}#
zHM7~I2uLO|VC@DZ8?5_;8*mIm%_PaR2~l5zihe^}2jnj-Hgvu38fN#yC)zwHAwO?P
zKmT+o`!3@@mdi)|`Q^!KLV>yw3J)nT@>=_=Iq!^gHK;V7!Th)7`eNR5BCYGm#L4??
z;_MK(NdD2W8UJGwdP#=EVvs~O(e;b|<<y9$tj%k;H@?~w{dWOpVj!IFpDm%U--t@b
z!l75E=wV;U{3+8606hGHJ9Fp(m2`ZT`<N}1#4JoVOZt)qNyjBSi^*{7LlFNG>g9sV
zuW8!O&b31&zta^ka=0U}7jA_X3+?IG$+$FU*K$xigv`-Ro4Y|_GqADWxE(HdNdJ&r
zug~QSTZP4pDZAEqjM-ie>rH%D+LtBijVdI5No@j<f&UO<vP8CXumwJi;ksexGfAi}
z&tT!o;%_!+3}EW;YEUc^><;ir*_o3~$8GwkPT*w1POKJIQCA_{K$^IZ8{FBBg*v;r
zfS=OLh&zxD>mO-bQ}HG%Xc(MhAk#@jZBKSEja=)dc19#HV`$N+&b~Rnpmj3L&j>&U
zSh?frwrOORHo#g@Pv-W_t8fCCfAZPW@EBuv3Ba-GNXLoUGB<(5<lN;r445S)ABtl{
zkvaDTDE;{OcjFVFdepVy3EZ@Gq#`8<;NKm3OS?UwFoRP1=7vU1_Q?Zd=Yt{3;g>|%
zNq;7`R|4yw8|<e``<edMe2>t`@P!Oa$0PL97|hW`8(((uf>)E0VGE`|xgtD6bgIsm
z+0Hcz@as067PML+41iz5oA^|`)<2q5uGS0kQjYeT<LM|bAmq)FMr?~><r25iV<_x%
zE*K@f%7I%0v;^8P5i~hdhHhOAyam$7j&Nr~;-JSkeaHC4y!nY;K_YYN+H>254CcRP
zZ#T&C`O<qlK4^F}8ed~pQFPBa$^6C@9j=1p$OGgD9tvf_!c4mZ_Wr$}coPypSYg~K
zk>#6TQF03L8nb!-RTKXObVOjxBAx)GUHD)#ibsw2<Z2}_{N8PVwy;A<60+?Q1@$KC
z*?H}Gc#<4gF4(*P>9_lBKUwsr863logpgVrZ!bp3PcVFLbukxp_srOj_oq}fKzE~x
z<#+1QbNLpT)FtB=Na;6ofTdS_u6=yN#9Lk`!4t>GO*9&G?mxy&<-|+H(#qFA%9{<w
zrA!u+EITaTNtE1`fFzx4Qt&kf#kF@hh$_Xfnp1Q>K@Eo{bK)Dg0}<n@UvSzUuf3y_
zA+kV)x*;4@{Qb9{SbhI~i>f0>=ob?e#yCB*3yusJEH0%vRS{|<H>4<78CmzkrkKzv
zclPX!c~R@nN6L1>2)U#Cm~iB9iAt%Z-!+Lq_l-i(*zk9y5u_xgt;N20*8`lGX|tr{
zk(!k=R|qUIthcz4-yD7O4*eLiCeNf4(J0l|AzIni7$;brrA9thoWm7xgdzyd?)q6A
zy#6QBT%W?H$!;5H!X~9*Qm1%K`kB~)e)ETho28?xQLA<N&rj(8LZ1$xII#8HtR7Q+
z{-;+K9>ny1yYV1k$y*}@D+7fm&IEb!87`q@3j%C_m_UzIK*53I^>@^AI&^CX39-K2
ztQeuCSeZBe_*|t-^vyOUxdJ9L#NIQ#a}=0FyO}n*<SzS|Qtykbbig4F)zB4e%H0UW
zqQ|BH)5o{x7s@Ue(;Z0-5%5j!kwl$ydIDK5@w2NIM98?5s*eTgUHcSLWdmBt5osGE
z*G&ZjAKalg=&pDs6+z1(*2YS4GRTxO)f@kh>$6F|J}Q&H=Ycbk-4V?t5vB3s%L_`(
z!C^GPQH2^XE5_nEW28t;QEw@N^ntF289jLddd4>nv|m%ePD}*1Oj35sIZdvh29Er&
zuSa+_{d1x}U1gAYz7XJi<?je@tUT-V5Q;zbXx2%=T}c+8!-hG;L{yQ5Y*(JwmP(b+
zjAOC-*aDNQgqE9uZ;4{D<pRGl25r7$1yp9=mR;}@700ZUoZVpfA*MJ{&<|;czz)`k
zt>0}1R;hgm0gD#u$~-HE|K++9)3^2PK2ykf2}~TFezpBDJ|}`WqW%E|Uuh14W0IQ8
zFsnDlw`(V1C}ZA_#m=^VR4RCAPsQNPTD4eBeM|=b)ezsIINMwLQ>;+!!Urk_sZG>H
zV?9`GB(J{2oZ)=a`mgdn?CO?6HXTwBm!|n1mfYEO4Wg))8+ms}!X@cj-C<;_o>$y3
zC_+D6Y#kPZ=4U9tU*vMDA)gJN$)yEIaN+@cNsCOxH7V5N(nm<F%5Ia@aqr#o#)1+5
zzPSbv#zx8tD4r(u1OF?L{L_qn>5J0v+YNpc|1)7vBPX4pZb<Ik#5kr%a?1xV79eFN
zU{k~`4e~_TcZOq`xs?~6B~Z{B#?FG9Vp^g%8EaIq`o?FT_3`A!KNN^S?SPA{DEk`q
zt41<e2Qg1homkY;C2jp9o-tgv`l{ZPa%;HXgjTeiL|0695gyk^#Hf(TelN_;{IwoJ
ziSN?KJ*`;sMn#rZbV4IBXF8;;Sjl)E&G{*jjGf=0o?<C@UIl(E=(BPbsZXV3N=cZ(
z%d5w<V36SHID|S&QUx9PEaKTjP4X0O8U9PUFeimi$aKF`3A3T?-+Urlths=0H5Wh<
zvDb0L)=UbSK7)>_NGfr*fB2T<z6$~Qr3dY#Md}d~jG(%%c36OLVPoL2T5&zOX5~?Y
zL5#LGzU;}AcOv=;)fq7T<Uy$W5Mzq=XIW|yg@S7hp+}>obppe8^la~P3v}#k9e3ND
zdT&AaklQT@bNfFU-3o=$9UG1U8IHp9C=}roDItBWYuz12eKy#TVwWl%L#{IiPseE;
zH(;wZJ$niKg(!v9w5Yc3ZVP4T^B?x#oPnC%W13uiS&m~#aRSOzb<$Ssc^hs|rZ6rX
z0Rr*06%}KfxVtUJAVo2~E2XUh<<_;*b!S>@`3wrUWUEMZb(6lzmrUkDSBg%*;v%3i
zGW3$KJ)v_bjsR%-1!#D%-B0RM3Zo3y73Xr*%mz=0#b|sb@?ux*07b@Ul(%LM=Dg48
z2Ccx;C%h)na&X_xEIsEFqU(iyd^@Djc)ncS@Jn<U48dU$*<QjKsEQ6&#3~%b)*cIb
z?!EuX68=pRN9%?j8`2NO@2kjO$r#2k7OdaEC;9G~Xe=>Zh{mLo;o;IiH&7_7j|@>G
zTuRs=rqePlxLT{0+9s6tC3I5exa~|B)s-6MY4krBE42sLj)>*Fg9~ehfS64(+vSNe
zCdTn-DZ51@l0>u$WbZS@iGld!X4Xhzav2UA3w=^spvs*0=O(k$-Pq!U{45;VnU$Z(
zedOr>kg7Q*)n{<0C$9CR0-pNVG7jd!*}qrX|BwhfFZ@4p5b%UsFyu5HM<I#LhGX|F
z4y@mNuM6o)d#H3;wmV=(2;xR^mjW8a7zJP4Cc!90c;zg3oL<GA;oIbTC|y(S_0cGW
zI)Ih*R5TesX%oGFr33+v36xANOwC3G)DnTz${=<RGNf-4K&G%bsW>6rX|nN=>kLZr
z%<{zwq;H5{0w(q1EZnDA$M+0}%&!(Q`JL$eTgca%%{E09%0=I4*LtqKmg#n*T0pTX
zz-H#+6bJG`__qDvpQqTa&n`nwN}P;=HY$RtVSF%^d1B_`VH_Z*uiUHG7^xRY5+8_e
z*;9#uHQ&IjesNiD8(92??n5J}BghSgYC4BZp9qv!C#Vr@48g8*1s+kAqG>Y8?C|^v
z64|gm^Ff+sBRf>Y_krayLsFw_eH3QYZ7s*&=rC*1JQSW3TB!y_*QCQu`ifD_Lo9Qn
z={;g6m?u=YL$eedVMPf*3pi0%xQ5=oLup1|)d+sac0t{3*gmO`Q_c{kAdAY+@W@r+
zOzrjOLgw&kc<|S~()1z&fDq5fOoQ3<%j|Mz%l0llr5;eAwhw}1!)DcSGf#8=h4M2o
z(*{T+sBrF2%#-K*CHEe=3#c3S007)&rYxvuzq9=o`ODuamdQSIh43*!rWg(zzd2qx
zxha2xk7@QQ8(MAyC;jGN(<+=!)phXZ^}Q$DRt0YxVibMh{erJyH<+mptwqQtw?Yxd
zN{r3m!`416D^Ji?WHv&@-S+lt(vPDy-q~=06^nUGlQB&UJL>l<2HW4#CzMxW$|4Hq
z{2X>Eb9<>6O0AyH%F&ZfW%`TesiYZA71cnNnFg@bRrq4|a4Pitel3mGmJJwz!06LH
zM?^bgj4{(4vA8X)ymgU@;FId677q6+dO+Qg$mKBcDSQMPnNj#A1G5(<kUX&BhK?jl
z%#GOh(BWV-zwm2XQqF!65i!ZbK%nbJ=H@=e67o^v5H3dP6*rWmHCvqFCG5!FJyI72
zrCXHkVhV4!t|l4_3ZCin5+nFNnj|c*2Tl_{oq`WIvsNU8({eCNvLEW!p&ZB)C(?{!
zE_3e#UMO<myUrd|i*^!(yZ+-4{i}oOKRMnUl*2eYh9;Uta0R{q@H{@+=$2}QdzECQ
zT-UHANQVwJ3zxDrzmJ5jUXY3!u1no!CndFisp(imHQeoM4NvS57u3r0VJ2XnK~>9X
zL3_-FI0l*lA=*3?iM0>`m0o?5Gzw<=-&x~A>>og<R#N6V6DW0kBz1XQ$<tn#%W@v7
zHHbdR?0r88Z|F`3(+HHQVQ*r>Viv6zNt)Xe*P)-eLDmxI_K(U~xGg)CD~X;tHl03d
z?XW*wnaAninCD3G-^9`AU-n?eE-q|ft8JY&0QpB4GN*E6OO@KL{?t#WI;;P*fSc{}
zARwAZ!^Fq(mu^HN!{Tkye_FBT0$WKEY0X$&@v6hKa>JSve_NWQep#uMxVq+Rj%53M
zAdG|G#Z%i5<W&CFOnv546o?c!sxlF78m{S5loTI%=r3D{7e8C+&S=>mV8fz79?I{f
zA518Lz-SVgpJ{|?k`g|XM#!SYzf=NFG;S&WZL}!IN{U>`EY)Zrf-9PBWm)PT+x&t*
z_xU{iMF~8Iz>oq&Vq8}34iaj+9er!Q%`1YEh}e=N2{X5WwXH!mc_)L)$*8=g<`>yI
zD45^~%wn{?{`bD!EK1+@rBNKK`FU7r*-X9_!5XgpMDHTxe_i0>B-PNX)9c^~f(g&O
z|J2cg-@rYvM8;x5op?@^NG-HwvAxA_31xAO(nzh~?j08ezQ|gZ#muB>Fe9|zjC;yL
zwkVk}agoFBc}l&eLu?@WZN+YO(-t37dGhuS7|v18p3Aij;r}QC>7mv&KY1k@8XU<B
z)OvPbTCGUo_rteetvD;+I@|^WYb_6{#%DhiKth5)!wUi3mZpH2enFox)RSooQQ)+S
zGFkL;a9_H|f$if=>L1myq@8nv<bsFN;Nbh^_;+2tcRJKwMnz`TL`)zT^uI9()nzsL
zj!SY=+*;%|TKTCmzkz~mCff1_W7B$$GEW;_HMB8pJNz!2wt|?vxW=*Ee4M632Jt(s
zqGRR~-5g5I;W7$oAKu$xSN3`cszTNO(|>m2Dwdlc*!N*7sV?<?%}xBxW6dyIZ3-V|
zr@LKqZZn>wwa2<E>JO#`$spK>ENUVAnXx=7X0H-ZaFc}SMTEDEd-E+Z!LpJSDU732
z!%$y_slcTRS#9-^&K6WqU~a!xvn<DbLoA&DFtP_0D{GNL+;m^iXRxYxZdO42tWgrs
zZUts!RUgteY-ST^4-8*`TIKCr?}mFKp=XF33c%0`FUSl}Y2-K?+SZb#9OS3mtWiUp
zji11l1<GpJ8^f^e-A`zzbPi}rUk?$HkDtq#zx*zPCw^B+#Dc+C1*MxaF5>RX>y+Xo
z@h{kD-lt@_=gsDQv9W5(9bAcrAxa|g*VtpH4sZ52VQUspauBGU4-0crk#-%`k`#|A
z?~J#t0!|yV22(eaW}-EnORR#V4(WlmrvxwKwacGm2){*tWPbozFrvPzFW)T9tf9ox
zhTNSaA9a|lj4Kj<>J!<n6Q3g2N{(B%KPC)q2cEpgGtqy_Qow-5k&%)Arg`8c<5ocu
z@i7qwnwWW;LwsJ8GR8hlX*mn;$2qNPjw6Jfp>4cz3J8_z=G8NL{T~Ps`;(X7z+v^S
z@lgYc>mRY4@-5<#njW3_2*HgPBAhv993jx|jwH;$OAJ6WZQZ2T*9UJ?a4YaYZN#Ge
zr}~h-X&lMkHGH7(_(uDpDP<myKFae&eaw#V#EM2^W+7U&NE3A&ngT8CJ;HC3B1Yx$
zH5Aw3`Yq}ucNCLU-|XEw%sJ9GZo_Cj@-N?vQ1#4$vYN4keYUSsRbdT2v^xaI#osdF
zMBY(TSHI}uR<8NUJl)=%;;S=9z$yEq)5XQ4>CExD2NL}Y?0Rxd1TRm~-eze_F0zKW
zlq+x%b1&VpH*N!XN%^cPoPU|layY}um)MF#k5(do!VKZ%)^oyc=6zV<<5%>=``yFK
zDGFZU3DI`T?O`fo-Ar_Ok!tQBw3L(`TP@6n7s}2^hCz^Hwz&VpP@1#H5|?cC6)4a+
zi)>yIp|Y3BltSc|yIZ5Ht$LDD|J|<)YG3TdDtAmq1f4JDMoml9KE%PPJGMRxP4D&D
z1!Z_E;8TY!BKYtyv1+bmpJl}V@FG(g&HMyt%E}z+vNptUR>>5%7g{8-h-V%T2m!2i
z=^C#Lz&#_#g{}`&`b?G=b#{-4RLrJQl$qn}n3by}<hY5N*a2uRumNA+qRECds|W{s
zvv)e^bGfU6^@C+_GUdN_4ZW3!^Z+J-?_?QPw4^w1EM!FNV;4C;aph|Vo=n>CLFT3F
zEf+q65UPmM)HI?rEaFP5aAg^dyFQqA&K_PTF0Cc|C+k5Kka=AScpXQ-2Gu;@208!c
zjGO2BUs2G(JXA_(H%=IP89nh5Z{_rDmeV~$TrbD%Q<xMJl0?Omf`O9LBYLl;*;YuU
zDUrT$Stg&<o9pWo-C2%Ktg~-k-lQZOGb0!osK!!Ozp#*{QtJb=9OY_)9OBhi7hL^J
z@<X5o*?sXoi+Ba@a!)%~4jGMdBW^xfr=N|zv8CH}QfN>z-cvmHzNFW-Zmf{E&&p>;
zKf(Ip#ce%p#jEhxbZW|!WSJ~a;@Lqr6_)ZF+4`r2<iAS^{zW7m^0X_%$9HNaUa8zU
z%h`)%X{ecZ$&h$niMiq;jazt5ep?C0-n!=PH<D<cAP}hXLM{x`C*~dBykO?SO70Y6
zd`~6!hs(whUmD~ywvD;rr?hkO&>;h6_}zpz%~0|f=Bp)G%ZFMb#f^c9r--M#5UqnN
zfCIHHFLU%_M)7>TTlNuQXPLNy7?TLD(nOsctl(+l^Gf}j<a=n$8}80Gr%e&7TTTqp
z^CUG#Zq}()qEhB>-Ns2dKIH6&$dkzEpy!9hytgKJc)riPp7TfsPi`DkS-5RL?Gp9!
zO=?De&UpP-pgcSkQ^(E%Z3nO*SX0>`vy))NVw}FFn1L&4tsoS7v}QsvZjCB+puM;7
zb$ACSUeh*61ZEi~P|ti@&&VGcFn{OSkX0rAVSsOW3b)LwI^R@?jJzkJ2lIxviHgzQ
zww2oXcT5LsI7|ONwn}KYUcB?G_tWt}&YvfH^tkT^k}zg>vE$a_9}lsKnL;~Iitm@-
zchjX9m1&zrNA6Q`k;D)U`Y^Q6W4+X;$jP(cASvgyNltC~S5$lAD*Ro5F;Fg%5al}B
z=%hjSh{pnx!OW504-=^;&BwXlWH9Kkb2sBrAI;xd*fS^C)RykkI^K`Tl9Q{ONJiyf
zs^&%K&SkRg#6MoJxZcYas6@c$OkNu~L23fBLcV+xD-1W>N!fSX?wX!#pa$g#prBqg
z{2Y+-c(WuO!02N>(Awc$MB}`Eo$$uZ^hj*un?7*|(CTm;?YD;`8r|FBC<sNQYOWSy
zcNk2AL3{cWe61Kt2Xnf)44Su!Mf`s0sc{n>A)Eyx@VR9Bi;He};txc{&Q6hGzNt`5
zf!d>u!+%t;N$tS@);=cDoxToXhO)DxB1aCb<UXZtq#hf!=}mb$jNyqjn6eDvhiCM;
z!;E_kk$-e?^hIq7mY{Ef=(GrUMxm->9iaDgMag^p@)8}tkc`9QnezPBLO-=6+Bw`<
zkT+(vfel^A8!y)Morv-6ITf;-%(~Nq7#-&L_fzTPOC$S52BVFG8gd+Sj-7-KrH5aB
zs-)T3bZQ6cSU|cbDHmHVlJ3~6SX8L59CWO;Nc#3o=VqR}h3%(q;ja#Fk3nq}z^zEe
zq2A4ELCOv;rxQzJco$p?<diuw^0?1mLmb;<n0GfHc0fc*+T5XR0Ey(4!}Eg)5k^&D
zp2$iGm<vkT^eJ@^Tk;r+!dQE^W-o31foUY<-Wr+H!Y3MY9uJf|OX-x4K-4qFg~-Gq
z(`B+=L^Q5#DF}bfiQ$4|jJ}{mB&Sc5&D-Jy*q1NnUaZ;BYD4OSkA*+m>H5&Rm?t}o
z<nTq@E;Z%s+m~lkQ~{B)L|T`I*ayJ3L;GfpS<g1T4blIR{%Of@CkP`G>;-7*RPHcZ
z!?`-d<hhdnTr$<+u(sPoQy%dYEtN~7K;3usSK|ni{M?KT+ZNN+(z$k9najq9VI-FV
zK8t1^yQ@a$4CN(;t%b|EyH3ZEQeFr=Ow(I6?x~7o2f{5Wa%Phgw5C1p%ziJ#fqqMp
z(HpXwZG4C%W|h-F3?0r=rK#W|smAEU%^nainGh9K7K}Gu+-@hi+lhchtd41%4XQa)
z`j|Zb7eoI#3@TLn2xtcB<(2nIr}(o7m%A4x$VwX0fq1>iz3W(N0oh1+gQmI2-JuLx
ztRnIQShSt5wJ_;Gx%Yg%y18@EvK(++gV_hYkZqHan&$E{4?ddr#+J6oTk$-32uFSz
zjFNB_eltuQSS~z8dZ}S#Z#CbC`DKsr%oStIPg_;11}2C%DNe&!UGe*rYo(<s8XYg>
zhR@bm*h_xl&P{oat{R^Rc%0uW@%J(}p7~t$`5v~;o8UXo!81zyTzF0*$39K1y#G$E
zIKmn6+X0K{yoe7MuL8*%8ooZjXJZGbF-f;)$1QXD8}IQTxR3^~Ulp$;DR5yZjpLRo
z^sWF^UZ{M4zUGi6yo<f0htsG{#o#WknnCYV__Yafh|^?s@glajHK>SW>OXCbD#12O
zNZM}Q)Ro@#TQ=tK$ox$*dz<V(ADyMPZ6__-iT9~Wwrb18-J&6C)LsE$H~QrPTvY4G
zG~~!-{g!Bqi$zk~LHU4oZfT^yzE1B)L1$_fTB%1~cJ<$DjPogD@y|6TRKUS`SMNuN
z%E6_&_N%A6I%xWP#}oji144&O*~J<9n&~C5qu|mJIa8>S2BNjwi`b+k2Bg?G+$F$_
z$`EQ`N+x1w!W`<TN{%qHv+@PMYPMd@S_d?rg$|zVXf7Ww3Y#|9Uobje>_+OMC5h2l
zU!><>;c8K!&k_X35;hh_bc`D`*Us9}+G;dU7<;fO5?J2!9)zy3VEEhCTllay(d&JW
zU$J5bpaPVFK5SufYaeveY?=ku+SiXN8Q><U<@s=ACg}u45R<o^j@K+Te`tFApPsA#
zWG?!WT$q*Q<hM&)`am!=0$*Z_kE^h9nmP$IkXjy~xB@kW!MK$RlDNp@^84E+Nbh4S
zT_RW*RL=+-8vvcFDS@};+I;am2X3KipQVoUg#4nWWuym4_Kka9h2e@4L?qFonfTf1
z=tnx<G>nv)d}tm3T8X`x^12;EKE7dsp`Os&=-8-<OmxJ-<qZg|FGGspq>@#pN>P|{
zRG!T2lN*#I-}DsBC``+w(g0~-1uQ#Ap)uFYr%iBE+n#Kt$H3JU9cId>=bO6rzvh~F
zlO*g4%}t+J39lg7rH8gQPJbi#kyMZ|)(zBjkmi~4?mqB9Gg>yX5d(lW%knxCVH%!W
z?nkp|Kbo1LZ1V14^#YC$ob?8ZuWxZ{_>blQ#!DVf7KX`eeg*?C4h|@SCe*_9sPGSX
zZaH?7dcQRD<HQ&XYDQf6fRIo|mViH3z8N~5QqQQ}qJ=?Zl$!oT_L9qobj*@38+(L>
zZK7jnP)9+)%3*@Xt;>n%hhU`5{^kN5aiNqKBcw0$p5?>84pCy7PkH}o0ndPc6Uwm%
zL|_bI92d&#Uy^3vQdNi6v{OP%h|A39DXPXGE9}x6{}K9{3s%c+C+{mk&2&}OhI<al
z_g3F0q=}fAnzus#r0DAr)EZAPY!{4H-fN3wH7Cu>QDNVW9!J|E>|dWF^Y8#5IGFlQ
zfHNoS05fjIn<j)~E^3D2!xkP|wIc-s&5~rc>Sc_ps@za?X6K2u)P`d(>)+VoV{Mu+
z9w#lsB6YJZ%9oC=+;8rdOa7|}{=wbM4JkEupvMpJ*LakGvoF6PF(gxDD@K;8Ygb+%
z)DeVWRiRbnJJ-EKm0+-8rx2{48HrK~77PAf*lUv@M0eV0(@CNCg}kmWu!eNvOB*zT
z6n5J7!(?cI8Krk_vq<l#k6IR`@>gWY9K6^VwdQwr9giyYpi7iy^;(LWh0iNzUbKMM
zs_$H8M1WUU<0Rs{NS#}~yXcgt4&1g?EB^PPu;$tfvcl)%|Lm0hi|A4FO1rtInl!n>
zI}7SbApQfihZDoHyWM$vJE-LC0Mj7g>4=WTeyha_rsgvH99P>C?Nj}7D6ohfCR7r*
zNHjahnirS~ukM1Z={YM0V+JcZ<7Jp+Y}O8WDa8rducEpfwTT82x6|Ae7o~FMNs&?d
zGIyh%q7Ftsz-=LZc8tQ-_U+s^dtD`qI4#0{W4qT=ClGmB+fEi<C~67XK8&I=9uux_
zSt|UPgq7o~RB`aiNgdPZxqbQDg0b{ue4e!>h;@yfVDt<OOHuBimRETDA}AF7&dPGz
z^tco<@^+@Wa3Zxk(oajOC-x5}0jtU^Gmwxz4inwf%ZsGOmk3_%tu$`KpYWv7FVW~;
z{T7`r6QthnlFSO@7lX0`@`6;vrYME+;HOQButb~XkoW2cHV+uKyoIm6z<~J05x4g8
z^JAH3Wh31ydh_xghKok;l$J`++2N^TriDA<N1~}rj7VGGZ$AhQ;5Ry}KrEEL=Q@((
zx3naY1`2dJFvNoU@5OMC*Zykii~nJUOI{p6hEjT{2iEF?EDGS4nc-zL?C{V<y$RfQ
zAcCJdL?7z)quTS1=s#M#W@!-r@Paf{_T=71Mhx#$QXtOZ3BO!X6aQUuv#l?3ub+>b
zeLq8zNH2Crft&i&KD(M}h?RMXtT)@aXSr8jf)1%l$AkJM0y!7XO^C{<QR*yt^g)`0
zhzWzMzF0CH3YYxJ77I>QOF!VMVVN^hOb&Et(B{)-BHWFkv_&+0r{Dq_Qc3Pekx|u2
z->3arl9Up>{(LZ=5M)nctz*XLrWXQK{j+x_`g@JSv+rW^aKP+C_JMFXc_!K~uS##!
zu;C_K*OD(ljJy+5M)kZ5XCv*`6fO*qRWPsfceh-cLN|`YYixJ>M#dK*xx9jI9{ebe
zu5SdBB`PYu*5ejT-i_G4%Ti!g<z^!0RBugMiZD+o^OpX204x@W{=PkAXS!LykCeAX
z7jw08?!4)rU_y_xt7$J}a<DyacghrJ7-I>Zqy!eGC_F$s!z200&r=?XhINIm2wl1v
zi*#vF4?o6lVwd`Tm2$fN_htESC8jy{gj%TsAM=9An*hkSH<vFr+`bx?ekXg)%EpP(
zG5ScUu+e%zsLJ;+hSk!-i1<M;d2;DKRO#5^E9NODe2{hl!0}DyE9sWv&3I%>J56E&
z9z!*=AO5W3Tl(BV;VNv0D3=%@FIp<)6k>Y)w?#y#zMhS0yY1tbd^_0RX2i~lH;#;w
zMwsfnnPBnPFKg6)n+*vol~X{H6$U5p^tbj~J6ET>OMBg}_zP9F{HrP}wrQR#vj5mH
z!>STJ0guPbh`Zq)gGl5-$gZC!vOi5V>qp^2fmmJ49j_$5%mMVg^LaH0?M%`m1nAbg
zsehMr=<_j~><_LkIXwZLQU~<mj+=A6eDjDZq*)EHT{h~~5%}dSW%U%ZoNDi9&%DIK
zuD6`SiNG&1-uK7~n?{tnl}3^G3$2nEmj$kg&h2}*`8-gO8C&QnX}ViH(4!!(X^<<?
zaW!v+KQ=v(4F*(u%oqts5Fz^?XUqLVto8igeoIDKASf5%WAJt~>j+%)?0HuG;BjA?
zg&`0*ZY9wBcFj40Mit)1g_kF5kf|oMUl%I;&YjTCHlp936Q2(E23v~l6K@B$5Ox>H
znGG4dBu~h0YN80~o>AeeL!=~gaku?Z7S!KfrohZ)cTG*E8_k12?`;I%C}$mvt9d^2
z#8x`n6O3YzvHexhe{jZ|P}Cc+|3rcA`*YAEL0I`1{wO*z+@5n(2)RwD!8WS*$Ycfh
zg+@GoMXvwjbvQce$<TOTveyHI92Rj950Jj{Hir>{g<if|SY%EfuGj!<$O(v@&~l72
znw}6u4Z|J{2|mt;wS$#9(C93K<h2L)UNRJcfbivo_~qO$b$Si%3d~ghY)Me-1Bi+q
zhF&0i_GMb5x!&EuJmR9mYmP75Q$ykP3$^2FWj7lKcq6vLBRfV3l0eqXk4gJ33Ceqq
zZD4*8t**J8_P?jvHi}v)MjInrXRtNnGc74_xF>OU=0a>$@h?ztW{c`0oBzHjPsXQz
zd4r<?zi%WB>Pg@|;?`{X;Gs5ZXU)o!jedP1Js&j)8jZvksCl{(HuW3S3~>Rdr17>3
zxg1kLD)b+w_1_H)N)glcQ})-zS)YczSjR<x?zREkQ<!tHL(Za!h;3!QB?nJYG3Sy|
z&#Tb~UOQ#R-j@nMa)Jg4X=lF=@FO2zj|^g<<Iu02OWWVl+)4L2H6rsGY1c}OyGj*O
zJNrUt#!v;!7>{{tENk$VZTOVSY;)Rz8m2$))lbTvTK?uXA3^sZFuPxgnEIdh@vr*d
z^a2-ZZf7DE-b@vlFDFCD6l1OvHzlk-(ow|_mxYFLm`DXcAQf$jBeNYxirKV}gr=<$
zdBAHQ0dU_R!{8gt^P|rvMbJII!)2@xm_-}E|ImA_*tn(-7OS$pfNBiQLx}vV2B%po
z&PZX}Uei?^q$GE&D1aGCHcaZZ*5tKV(Hzm=Z4!^Pv^lP#d_=H2cb5&H?Gqmt1)^<-
zSsTo$Hw{rwt8>^7KbYynDrZQqYs&rzv1sFl{sc)4V<9<~ean4U_FSwyJ^atbN;7UG
z$```&&7!t9Z7M1QOS~0%$pRYkjajERKUJ+}QN+H-P08?=gkH)l@}O*Q<9b)%n3m!f
znKZv8X*JNLK3ym_#Ap}_pUQ4&C|;U(olmOGc9OSZN=DhklW{WIgr6>M<Qq!%&_+>u
zU-XNv=UbJ9*Fby6oNkWXJI4>LPDHI!Y6Rj6Ccp3uS`lIN!=991!nLID%3T-5YnscB
zsmHY`<F;4Ry$;l{6C-hbt;H)A!JU|Ab1Mw5B{qYer?z=d#c=P;Up5TFKH;)5=OH1T
za`!A1U>8je;)`<0MNXH;DEg&v^NFpEkHJlyr1YKupA`ZA5Dh*Oi)G9GX0|O}0qq(d
z-SG~2GyDq+rG=Z}H0Ru;_JH;DJ-`~i#1(4a6)YHY!~Nn#-Za4W?)NF2V6U;mFROg@
z96v%S5+yINm=j#Y!tqxRoT-)*_%THA2Ok>T(%7YvET^#Z*EXbZwFpYmeHA`|qQ+aL
z>nAj)^K3y6-?Ys9?{=ReVt>~U@BE7(nvKZR?UoX?K+&ubXq{B#GppT4Fd(H+CU67@
zAfV=L52>mX+AJt;mrS1n)t3lp9SJe>$&eLNqZ;%V!F@@oHhMC8tNGTPh59DbBOwWv
z@@tVPLiO*E^@xevAnzjquERA7^rP{|p!Md&VF}hxMn)rOfABmF3oK`%mX}mzi!9w5
zX`9|U#IyFo<&5M+!|Mx<Ubnu9H|>mBp9#z`?XjCWma;p=WW5?L$#U&|enVFN3#~R2
z?j&&=)m@<tdti4(Cv;3q^ywnx4(t*rHHItdPO+e6M=Z2QMJqtl<8cWH&*)FoJg6v(
zSB2z<KNp@_1nl!b7W+QAped1YXI!YRg-Q!JD-%aL^zsCmkfr`4b%em>gla>Es3Y7l
z1)89TA9WYsW!o20J?#j{R{#dDhHlLv%l9WM2k)fs9=bCMQtusc#1Czkv|H1<r8=4P
zMnb@HUwIoXnFYV<eT9ld|2EAS6hKzXu7Ca!|357OP6Q=sq$L4IsdE_&YQyo&DOzpL
zOO{E%^run7bLp#VmPf2ieMv5GqBnh>B~%vAfxe?8vsls5BCX#8#t%erv_i%ht?7@$
zlwFNtZFNicQ+~m-^x{LuSTIVAV}c&kdNrm)g9ock<6v^4+Yy4Zoz-ZsI9Tc!OsD1k
zFm%f6h4{fp>PX)rw{@2<k&X!7!`HY$G8H9HYOSD}#WTgRI}C@4?MpcppEIPG$aX?j
zXDHZyKZd2A)O}ZhwDEh6)g$*uI@F&zub<s>|34w7w?r~+Ls02s-)^5ePv#QrM8R-r
zN;YNc8o^+UF{@_M)_}kKvZ}qNo(D0-Raa-EAQTOwoEIh``$vHYhm_U_Iw}nJFb(P;
zoPm2~zO-|w&L~BehNw^9I1fSnW7^$*jp<*C&Y#q!&(Z#QsmFIK^B@ngEcEevv9ViP
z4BiCvfm}@G!yVV`WU05t^ee*jd*>)TaERX9WmuUPIL(Qh4naLLcn(XPsV96Fk6XS}
z*__OO6LoB?j3Vsac+U@{czE&$=Xm2cc4p5f=KSfzls>^zwh%sXklcwXtBI%)xXY))
znw9VvTNPyvDADAB0nWceM~V7T-Rb?03ygB;;pr$*DI)p$##6<>oqI{ccC#^DhT2h6
zfiBp%@|*syOlQp>8EjzXr!89pp;e<kpL2{aqmmvxm@(obZCtyF;52!)X{BhyudB8Y
z(4u(=AWcHq!^;F-j!UhJ?%v0W_;aOw#OTHSA%=g{*E(c^zepnTPl<-oWMm89BQvDj
zPfbuO8HiVL1tbJ`)vuz9Mnlgnj<6|+wu})DqYj^a!{`6ImtmNW;rP~9+v6q<*W8Ig
zL*Z(pE(xw!w*ZWSav>ENI+@|TXtV)%34|t#4+@5FLwVn!*zF#U_Yo2WzmzFXC!CpP
zQi<g=%5INI>0@!?_(f!_<^UfjS~RcJSN%PF>!cHhEOa^91;OQD4zCL_Qd2(EZaURv
zwV&Ntl26^`>Ohn>;ayl5wat>;XGfkvoh>b-4(D-it;*ZN!(m$?8u|sh-)H;kH!|DX
zK4<8Hn_EdfY4=cq^5+`hX^ra3zuI_nJ1*wS5bXx8Ra~2!+pXXtBQ=?NB&vD<Qt6MK
zK7MXKA{hYD2AQ7}G&aA=7Ea<WwrRhf{`x;Hz|j%)#n|!$D5$WPRg9DN^M$gv11JQ~
z5Jpdq3w{tHQ}ghIj1?rnZ`%uvRV-=02tw#+VN(5l=iMMxf@j_t`|8`8Gf*(6NvPy2
zSAF@$^cKGgVuN3!_3MXj(NMJnxe4`jMcdyJ?%b)H7a<p!T%m8;Uat%y{b}+EdLHim
zH!+_gt_W<8Ym=eOrv9}VQ>8`=UGDXj2`mwOO9-jvdR?D6O2q`z$YoT}-J_M1f;jWW
zU-~e-bmHcwEiUWID-=T~1$<%@i9I1a@t~ABDh3Z7vvtN;;!iH5X07<t=A@bmI1}p;
znMb9`eC|aS1vK4Q=|p>aBa>YDSp0%(j>>T2A|lB+FKSL6oU7H`NM4#+zndXPn{e*w
zFDkWU{!~ekdulD%+wq<u#`3u%7WsE58K8wA!E2<BczFpKc@6BdBW@oNP}`Nw#XIIW
zQ6C~eZ^F^8#6|Qn5DOgYN74QXS6>pm0aotwR`O(P-lfKX6PCQg3l$H>wNds3zsn|l
z;W`*StTWG-ToI~;hqs4C6P6KrRjoUQDzxp3dad4rIy5S(r?kL}JWO1bovI<as9)2W
z#EZa1Qf#>y7d@3B0Tr<f(Q8=yUZgale!iGzv~mFcabhXJTwmW;D)1(L(@VM9gR>g*
z@zn69q5G%s%>R*9{sOF(Zz&?xK?+G&F3V8hpyJBNKyHp65oK8JX%93GfY1$H6{o*@
z2q^xR%j#X=g+eB+;;?z0F^e0kQ~zD(<OU(^%W(`Z`jN>e7~{F02S{;ycbf@A3FbDE
z+&oM&Uh!!LnX0G^&fKs+v)hz6L;da$y=Iz}IGGMkQp(W=lX5e)_d6-!2`P6Gd!+|U
zU@?{M=Qd6<Svi25wLd!i0dQ_$ow4-Gg7|>2d61h~*Zp^(dw!c^a{t3nRXc{#`~YEU
zyY6e3dhvl9v3F*}(8tc_I_#g`_z6CUM3zLLjM~!t_5-~j;+I{%BP-^QekNQJ!=nU-
zh5#~!N7YCGgPfYcw77{bZEa^0^`@<B-W8iDsg_KiO=q4H8txK2l>>LBjhW=A7P}1<
zk?L3`PcV#oco5BqI8H8X%a<8gYQ?o=Da@t#F;r}``D?7F-Bc<Fz1(QdWbSn>C#u2T
zNYVvw>8BAGf3Zfs!RFLkrCD1ILD#Xo7WHJaN8KUo0{UUNTNmpDnR{%<2->>$8<@~A
zM);mpUmcKVnp|n4npui;;y-xXC#R|X^G>yPW<P})Mn$mrrB7;5GLb^#9zhITtF$3$
zoGylxo+X;)R5vlTh;q8e5Ch$iw4Il$3F+x4&>d<HSG8uG0hfySea7C9akvUN<1(xn
zQD%&cN&%MoMfU*XBY{HqD{RxjFJ;NeJ1dk8*3uV9D`7R-7+f^kBiV^9xE3v%sC*MB
zv&6l%l%LWNQhprZ(hSF6QeC@i>hUdip}+JSqW;Do+l*Ba^U;US*hW4xuZ%VbTq>v~
z_*QM+mW@k0;yZmj=bv-RkDCw2e-n6rtqcEbywq|qCU#g1>)P1+-r--Exr7^6%>_^L
zI=gf3T~wgQm&aD`7276OnV1|Vk_L;^Q{qf@Due*PL%4ce#M@mx>C{WB9FW_gt()FY
z%FS0Ra6TvzASADmAXCGVh*+>1<I`H%$HT5cqd?b9;qcPQ4f#V@y6p)=7gm*=u~(6T
zg;69AF0WdlnmX;9?(?kKI-HWOnuC*yBqX{$`fcRGfRWhvZob#q*GVGu-X!6M66eS{
zQ)(p7=jm^Q_D^;LZvCo6za1kxVkRhGHaE6Qc9W0Dn#ZoOUMYjOz|7E;_q7iPfa%zF
zB+|)KV&pJ){%cw_{CM4d$||xY|7<Ox8tNHAC)%*deE2L<w@F;k;=4Dyiu6--XMoZA
z$gMTqeuo<Q%0D1l`|jq#g1I!rJ>#p9H;!xwV?;}&dTBKRD#}$gOXE4!<=HQI>`~nP
z*d2CzhCU-WB*ht$>WA%A|9?DPWk3^L+ZL1-P&%bsx?4h0Kw4V5yIZ=uq`PBu!=xJ|
zMt67jV0=@b_xrmaJ3D80UDsWT?bA{{bufz4-{l(|$NysGzqK)cxO@y2@9x&LPNkDi
zaT9Yh2}Q4kW0qg34+XHfEZzr=j@ea6ybs|x*wjaefejkUw$p?ZRS4wzUc!=U+Do#q
zGoXq>LLCIS7T=Lk`=%8rH$E7XpNdD5=pd}_%tsNZvPJ2CS05_lyY8zbwcTQ8B`}?w
z@igloy+6%EtO66I>@7igVdlZ*j$rQhe6Xx{xz8NLGG+Y(nYS)9VFBH;GA&A6Q)ISy
z(#!Yrk&8JDE*oF%mslo11<etDjJ<zHy(~g=VgGgq?X}h|!-dm%eVM?kPF359MNj5o
zQX|7;q8ON+b4XoE9biGcbpmP*B4<V#!>iN9YicZnGBQM6+qHdJevBDR{KoQb3PC%#
zQcKs6#@WBGk*mfI=3Rdm-g5HECmtWEIJ^U$8rrfqKj>QJRz%^%KUJdm6Mf8Fi(dXs
zZ%VfNLzEmc`J36AD_55-JFlXZ)|x8!%d$LJ2m{CHecgAAL%29syDt7@bRN_(BBRvW
zfIy6u;TID-4x_+g-2(q@xykUZA4-3FxfuSp;b~G7k5h@^du)h}R^kQz1c}&YTocd6
zbc+_;yu=5cl9c6F9G0hLL~3TaFb&;Oq4+j=8ohHtZVYfnIXD_x`5dp;@!Bb-k;C4n
zeJO0=6E?sk(qAp8C0&s_tE$N^|BWB80VzlkO04E9LB*(PVJMZAT8Vs4KQ@Hj{;tyx
z$!lnaC*(KUljLM+h=W^s(MM=7)T%L-^z%&S4Mq}4;dF-%;Yl^<cI11HCv6%h5N8Cz
z6V8K-CKIFH&WMRgGj-{2Airy4g8ZdoaiRH%e@lmr&f&OauSpkSCBynYQ(meZClP;n
zS0AwYD&te|lU;Q(M~K7SM*?|N=h*(SH+Nx(0yQOJaA6eAuiW(Qyoth-fnG)B&bA-M
z2+XW+h$~GD(r0jT;oz#PFs9#*yef_y+m6ugdexc!DWzoBP`44jDM?MLNWUcfdx*$Q
z;1#QkAuq);UOw(G`FViINw66Ye@nk(EIM)^`wA#gsGF2mRmP|~L!nqz2pjvZUFJC=
z4v9aMNi(T^p2oIFjBEp51ZZ#o2V(fQ<s#*Ob2+pzOp{y?1`z{_b-~Vyl>PosKN-|x
zCRwbJjU5HRZhV;&ZrvuE^EoYe=r-H%so!x6EEI_(ud8ZdQ4wwdL_?vk-W**=nVEfx
z&8d1lPoIGgU7f~Nl8ThMUKmqC`*lQA$^ShFA#IGf_NQv7n#S7|Qf~I`Q0)Rfskf+d
zhWL()iBsR&e|r<gh@_c2P$%!MV}>!hirtCYQ->p7e)&0`3-jyZb*t+5b51$mNHzn*
z8)O2hL?=4zWoC<#$ox-Vi+7z-<M=QB&Wp3n_^;2&G~#vYC7l4#N43}-8q^$#G#HhV
z6z{^r9tx{%LopW>c<aI%PU}KN(1=PYBa<I-*_-c@;CkF<Djnsl9z2;~EG2p^>4I3%
zv696c-ryzbDo#AKXGL82n=q+&Z$}S?KVbjhrVuYR)XJ0d@o8G&h|--wG}9X!a*{H`
zku<;WDnT0opna*IlPgF(NEI>CG4Vc?7s3KaZCZ$XZwaCY@@o=B-r<okTcJVd({wqO
z{vy!F{|tifC!@C#Ho05PEiMM3<YMD2+?&o>``0grnj7W#2b7_a33mJKTYf-JTFy`J
zBEwavf5jr@I$TtVh)bVzC0Wfdn8g@lX&*#@0^JWuh@yCY;tZjm`;r1{QKp_%1SJS0
zA}SI?ONR)8z7HChg(e&ENxU-4WkefwEG{28VXN<bN5jKXrrfld_p=?(edE9;Z9k`0
zVFUgFN}LC0hg(zf5oTQ9?-y3raVJTX?IlUH?t#?D{?}IWy(DnRHU56bUO-=bQ;xd+
z8{;P$*e|_u3$VQwZ%0-G1IT~u66$W<T3^KtzKQeW`~6E!LnUla2-p3<;JY@QMtg_{
zoR<C@x5DKiBMx^M*;rwoQq;DFmsHWYUxnCrG}8Oqw;9oRU9m#>$(p$?HgFUBPW}$9
zw+J1RWN*<^(&9W|!~#V*h;ihw2rCBpb!d}*4v#!{Ct-S(e?GsMCLPCQyTHmsK|~on
zRHM|ru*j#L@Z{ZK{F~JO{{?lE{(GyRBLz0hhhu+6N**CLiQ(oX`8j`xd@629nz;1%
z`Tm{Bwslu!UPMt2pJ~_v4uO#dlrtET*v=&0GUFGlzo&DJk5<C(o+l4j&)<eV0avtK
z#v8ic&Y=09&>c<LCTo?0w7%n^ZWYL(=LxuetZ=Va1&OcRIc23$xR}KR5is~<epw?s
z;sYj?%=k{$<OIfl_L8Br*18*lUM+n}+W20!>2!cf3MMY~xh&9M+*uZX#%(Du*0Szp
zD%6Vln<D<lina9#X?}V$iro8_H%ttoxWkh7uyC-hjeutxV+(69nYVo-6%(t4hnJf;
z{+)m$d>1XsjtpTva><T5{Tro&|8~yhIqHq}l|($pJLv(J-dNp1+RhHkoq{tLxYe<M
z(f4wL@o!7v!n0DbMI^@9mGQny)g}(Ta{mEnYi0_bY<@3M?Ew1{h`ki(P;Sk@*gM14
zPC72f0pSP?nZoC_iIznvYhj-gT%2KEdWDATCxIf>kqCP!O23|CvkiNy58dtH>><Cc
z^U4B!-=9_o@9!ja_5V#$&!^gekJEdF6kp&!5@<q0gQSc_SmQ;A7xcwrRG*c4Bfll_
z_j|GaQL=3;qCFwyK-P7h1v0zQ`ReV@h6Ii7lxk)=S?(|h0`tJsY`ifPE}M8CGPj8l
z6XfSW2346ZtsJKxAZD@5ptZmqXAlP}f#@<d&bRoV=A^$Qdq90H9zn+_L?R(&lZ(Qu
zMEf70>H8>0(68Fs744gE86>Wei}~8yl)FkuQu#yuRsOq7IylZ|Y;zFb<szp-A6T-#
z8`Ne0){*GY$0QFSu(uGAbj+gwx6N)B6)>okPJ2o3<@5CUM?0!l&EtAg>FKZM;YApy
z9A$GDL=o|1zp;@q4}Rzp{>jY3PL;>VkIsgN^ojWjk&<8aHKxxz$A<8Q5bi_JmwmX;
z&XLIm#KUzw@+_m%n{De_`MrZY3m&D%&?$}iIg0f!wwr_RHQ448>=f&H8y35a(sZA!
zW<4g}DE4miCtIJM*1F;DrV+gIu>~2d#5#R6%lbrB6EOZhTOw=aZwC<6ne54E@qA!>
znSObB!Sz54>FOOGu&jV{hEb!w{H*o^n(e+q=UKuc_sxXO^%m`#vWHFu!!I(=g%=^r
z`w~b6!!{oe0}@#e&(=^)pd6BF|6#4$vDIY#QPBT?TtIacneIY1nrfVYtGqR&g+K3?
zpwA#d@`eysQTiu_TUsO**Ev){_)Ij-sG(+<4iy=^WJ8ua(q*)&*8Y3!EACK=%12=<
zxBK=yYU$3pV9?JRK34H_7Ng$^)k$^80c6@uhO}9)-YEK^{H2$c{v%}bcYL4MAlzQ(
zC%>sj@%61=P-v?iY|jEV1^w-{4U8WJ&|r1sNQ>9ppek%WWrR=bdpsj(@;U1~9Ywbs
zhH0NgDWy)5`ywjhb`_e{udE#>L*#PM@;DG%{RQ+aV+Jv&dG%=bxZV1n?EOCIY)^)6
z3bui+h+fr3m4`WjbLdc?BZx?pJb)_?6XE*C6nxkaVVup~_?Kk)Q}z0nWO-tKxq7+e
zX5S$E=#2t+*_dO1$4<QHK@o+)62>`D^Rve#b$1onOap#?-cot73x5td)t-D&pwUIk
z67B#$6;ap=UKEba>778f{7O}_2F!i&{J;t%Hg&B#f8XNI{+n9pE{y!0>1nM-F<)1I
zo)}-+x@Zy_H|!lrG8-_f(B#_;s$<Bs#_lX3P8*FeN{188C|dMYX$v5K!>6q~Mqw^N
z?^W~hl#9yo5|z!Pxw`G#B&$+={%NyzfnTe$S<^;=WdZnoo5JPhoVk6=uW?8g_Jim3
z3dNtU*(C4(H8XAPM0>;0{$TMHByrfI0*|s2pcvEcuh{PBd@%P`<46HoTeW{^O~g}o
z38jBFo9sZ946_gDiF5=zF-e^IEAF}5vm8A89n!7doxs^LvviQ1adm<ZJqZtstz?&@
zU&36j#s^2d>3hpDu8%lR=iqg;=C6>UE6tuqpgD$?Kiw=i@t8gvT|BD?Yv)Z(=sH#c
z%syLy7>{<id|W=96qok;W}zhnGI5Xoe$#oq49;b+)9=a=k{E@cd@}4b)9fYB`n`%>
zouNI&D$cL2`JZ0!vR&1)Ij$SN`%0FdAplx~WJqOBmYrd-x2gRtT>h{*dtGO#>WmYA
z|LJy#IX~pf9O9TuQ@qte9h9hhFcrxgBPyGL<zx5@@Y+>xK(+SzX0$sqNmD~>G)b?F
zq~ezwc^F%ld|d?X{(foSxnxglT8?N<#7EnzR;~v#Fky}tjDoM={VA5>c6C#+iH`m3
z<kjJ24RkF!6v7uv0qvd$YbQ6>**F*;PeSfWf@P~n{3;+DiNZvY+^fs?+Gi)d;)gH(
z5qD)2y3ruSURhRGSZ@k38twj_-n!VBK_<QD%2DqzjXLjGgP~Jb)V<rdciF{pkDVm<
zKn3Wa$N?llz%l=>>WCq<pbmm`(WEWm%Y1x*>h9jM{p7~FudDw{NO;1QH=#oh`30Wz
zDMsx`_A@|Icestu_xZM52;zF&?y=8ZtA{|pD&nKvkoc0DtP{F}ApBL8@&VoMF*w_X
zlOovq>}W-%WDg`XbyX(c<^%SJMqBToWuYM`+2<50S{vFyus2)5WigQ({%N*|yNWci
z`i3CMpA=Y1ob5Cb;4iK>17i@eQFZ;5U0s^vRaM0dNwk}uX3jNQnqx2G^5zeHLq1?g
zQ6Z$Pwyc*gko{z5x+_8ieoO4=xIwj5-_&jW{k1E4aw7BJvYWZZ<25Kp8uPb)I8g+D
z0UeVg)_%YKyz?D7F5;@<G(;_(H90GH-4$FT6N0$Y#d#ViKJjw9(vRJKym?*7`cOFb
z=(v-fG_?P*yGjy`C4iI5Ab%OP{-jW|UPr{;9)e}BHdt;e=)pcSg|6k<A5>+%FTixc
ze}3w?TCvw&Ix!D=5KPSdGbq|aYc^#RYQUwTZNXY^+GVSgvnKf6lP>)3z?{p3ux%9c
z;5*296A*D-NVtvAZY?(_f)dVoaLJ!bM;xXh=RBOv=B$LY)rEma$=&MgMs}KuMEv`j
zM&42lW1qdpG3KqA9(_G|rhVnNV&Gd=Kug?hbHh0gf8dr4I6j}s6nASe?D@!h;V*Of
zLIM@_m^dhN+-Q|1{v@CuVw8V=&`uql5X!)e{s0@8XTO(!Y%8?#W=W`*!Lfi)r$i3T
z0HT?!=QM(lxX{j8h273Lf_(bK4nZ{E@-P0l8$iIoSzpJYCo9m|d(oywoFRkgA>Vh;
zi4+*m*4`-Ev~Xf2UE0<3XoY)x2g#^Ba5okNbb3NNaKxZ214$e)+%1W`3y^F?_HdJD
zgAP3dHzV}nLrvzpb==*bH~kDHa4){n7<T-u$IRucfws1i>xENpE!WDWbJWjG>}!@W
z-M1-g3Y-msb6S!o<ZF?uC`Een)yUq~iY>6wSGvQ0SS6V~?}0xS7Mfmm9ZY)L&&hLg
z(ujf};7uFsP+RZK5@@(r$ZdEELT-<6@LdZK&WF1j_F#q#oMof*!zcOD$9)HKVFLB@
zI?N3qp3ghcMYgG_E3}!wL<?VmOZnlP=a>D%IhQ}F(j-&CKUe!RY3;y)9T$h>(u>W~
zb9AI`4_ExY`ow>Uf7{19*je7o;-_t=<A*!`j)ne(JG+}9XU}bv$53;1xSQfBT|gVh
zUf*YQCdlHp>&%(U!BLpcbHizmtkxOwby<>X|7z~mjezP-Q~YZ7!qs8Nb$e^}-TnV6
ze@9R%#JwZf-LGJ%d~*nVf&ihYUpkpre|=~E>Gq3*xqZX=9sE7G?Oi=L=>`PmPA|r`
zM4A10y%YDUjKsRrGCc36`r=&?szV*nd<k-QgX_!7o}$*Oho-t<Yv<B)>77J<rn<~-
z{5h#o!CiRm4dUMnank>$FqyRo4cik{nm&t)8O25`Osti2&aAz{^y@-D+*opqkbG)y
zm7l*sq^I}mUdSP&&CI+yN<E_w<<q-Y<#CEs)PJb`z1x^uY*H4jLq7kG%vU4EZUCTe
zceDOGL(4Hp$G-kMAJfR|H5?y{wyWf0t`7|FSNA-lkBU<W{y@CV1wAM;pG6047cy%R
z5X6;HpLj%#I-l=ikTF_NlbgGn+h_3<L#?hF6Zc?pyYlC(nbZJktB5Wi^(ZW6S>!|d
z1u~<#a$tRl(L4uO4SicfNG|6seQTum;|lHP^j`X8qsVqHC)r;3=6wuHi-+sPmKKhz
z!wdtN9tQxZZS3l6z`uD7Xbt(lrlpC&C?ajS-?-vxF5AzsS7O@o-=%T=@09k4*G^&-
zoV;i^ArYgwie^sIazBAOEJZWJ`lv!aK-$U?W>c|cv~Dnb%O+Z}B%QtAG&;e$+G<E$
z9llQ~*Q(yZZE0B(@V+#owivvtTikn7_J_TLT#pEI{de@4ly)`x#4`j!(z{07(&lE1
zbDXmH@^#u%C8`NwtB}fdKFYO{6U@Kj`Qlv(f8G?NEo58eMoSOOzC}8{Pgq0mL_0)S
z^ys*B3^i!yzxFskSzntta=+QQzu4M469fq9JiVO$NfAP|N|-`j&DibA*YQKoDnzNf
zn1ZBwy8#}Ip5nuEcGcjk3;WJDJUk{PL612G_~<tI!^tE&e0W0d;o>#vroR?H`D&J_
z@0T5~-<>ZkvDv3X>Fg`QnNS~D7@ehVyQ7x|b<Te*R{MSW>pT?hd}HLERb8e>1={EA
zceD@+d~tR_)RPw*Q|!Y7aEnNG>6_>CI+%p{#*z1;5GDnU@9i$cA+Oc6vj=HaBmaeR
zK(zOchA3_K*VSCQyIjJ7t<VX;HbGN!qWn(vuHB<$7*Yz=B}%C48W=$d+c0F5bk>(V
zR<==}51R7wky>G5fO#0uTfFjz_d)d*W&%2t{$}<y2*g%#WiZdp2C52~o^3q_yoH8)
z0wcA;!(k!8K_T`ftsV5t(V(|hrsnx>j8m?AO~HKRkIx<=-hxW<B)oMl424gTO(m@!
zQbeFXY2~0`uetwrIX`J_s)vp#48*emg`6R<^1aLG)Z0AoWZtjw6EQ^qUrl$iFzws>
zwU*77ujiw_z>t)|*$3w8H6-hKZk~-qZz;Ds%7GuqPAfl&XU&MUyTp1cW%a6S4)@qs
zGL4tn&YpqOMl5sfPZEgpeLyjD8=+0Ez&%iB)gB1=zgCEs<X-vL$9wU<Ud_FpU}EEO
z1LTvt+^w|{G6O#K+m%ma^0fhO&z5ve1W&8MukT!V_cYs{9hV7=2{QpJULm89)2mG5
zff0nZXGk~S8Mc;wIf}J+K&PHXy97u_w$*?|0f=eu`@D`|&%Gq!?m0<@`*$3lz|l^R
zFvoxLY&$4{u$1El-wxEhM8di2ntNvL`ldVKv%_?8d7KW6G6fh2V>zkld~*8rdqjf-
zrI~y0s_TBF#nz$&dzU0So5WIaXJaus^hM3kirh^TuvVj&NzvBjx5upip1G-UFKPVH
z-8st`oZ)K^wcx5y3%(W$^wW6~ZhksZ<Zi1Q!;LsXnBEC8e`Fx!6<)<l0)AhWB{Sf-
zxXti%enAb;J$i~5^9pD<DToKmt!cT@<wxJ&94+;`&kv*@%~5x5)Lt}>9vPomKt|4d
z!7WgL!QiQWrRVdqH1YE1#BYDyA+D^M;62HQIw0^4nCk&J+Is@#h3Ra8>(5t(LEgIV
zb`5uCuB>~ymW6xZn0L3c$&ki&w>DR^_jG8VZ?ARKdPd;MmNu<jIvf>WKG3u$@h_4j
zTeqp)Ots*qKs=$&msxmgF-!er|3CC4Or9(3VRoeKMa@=>bY<*Ve0M3+z5ER7I|8J5
zNijUle)C=;g|-1*IKY0re{!+b!*=(dZD3?>ycQKPNF?DjK-#gSLf9R6*egi7a8Ols
z(>r^&$Ahyce7o)u@(a<{D@?Sy`N(hNoS@vmn|ozMSP)=yQcmuvdr}MW`_E<his_p5
zU(gBZ!myQ0UqjVWPH=o`%?-5Gs`g9o@Y=Qd+nnxs0*S4Nzb$h`%-q(TN5>*bO&EDc
z$C-D3=ZMqAc=L>#%A<cR-|3w4GxMjW1jP^5$bOBlkG*Y+51MYZ>Af^Y?JLV5ygqNq
zedcxaJ9OKa-Dv(GFF}w0dF#tomE$qGJM;l;`&_vj=vZe3`%gGows#$f=W2%ybn|X>
zkf|X0yFzyEM80ohNFRM(yXcH0#o9Bj8`mkssW87P=X%aPu^Cv+X_8o8f$^P0!Q14y
zxM~)2sZcye=exB~7S_6~a+mz_OQ*fR;19fH{$C+N>+;8%Cey>#V4*4+ZIWNpX~!RM
zd4P4eEQ6>3Q`R|!Y{Y5)kG%TxYuc(`$-A*EoK+^Cs$`DGo9udzzQS(|-JcLfoiGaM
zkh-GpGd`Wi{Jw>7YZLueyx4W(QhfE;LfL@)&hulmz&PSdPhb1epL=&;-JC(e#~<4L
z2@`|nR>!A#gZiSe|9@NnTU^Y!hsY2G!HLC4r_WRQdskeyXMKwMbdoh}N3Vr8=@mfR
z(k}pTV98P*PUWj5bFpsoiu-T9qh<i%(@Y1jwk<ZfZAB4dhh7+$QNmmdTaTXOf|$jV
zv81y%y=dhE_$Mx|{j+`~Cf;Y`o_m`ybb*lm7B=bhuDVtM?r17K^8uvvAe7Jr-z+>V
z>3=Qb_M$mEf}On+6GpIFmd;)LoFeu3LaU_iQ;&|kg<7{f|B~9<0(|ySbq9FdHLp9|
z+<cuVSD3mwH2<%Y<0Tv`F4Uu9`E-IoAX8oM*hl=?rmnsTV=m-T@Jna&m)G-zchuP_
z+wPFtxfF??zzwFudr<c{PaU6&`8;99vsHh?bfjeyydUce>eN$%*NfX`E?O!Moy{GC
zE_3aYi&ir(uIW?jdHlgbjLAbfM&;ifG2#D{aq%aMdgl+V`M4kR2+^wMiCqJ((mizT
z`8VNRnj2;K?}r~iw#`bD-+i(=7`Qx7MkbM(D(N>Z^kWzz`y>rriK_~|coy{N8x&?w
zLg#7^)0bo=3a^f=CwIZ|&ojpMx=J2*n`ogU9qStQ=0P(OD?gO&|ITdI`CGfkO!N|r
zxPwRtCp>5Rn^}9~8|<A4d)bI2khq4yD{zH&GU%`mZtV2->nqU0RC9`5%jlW274V9I
zmXP<t{u@5I9@a!IZC>)_L*c3H^IZ8_qDoq|Of&%(K(XVkSUaIPkv+q{u)eU(R-=Lt
zbE9&)N&>ylhGW5}zr_;VPz%oRCnQ^VM~Tz5H@gNqif$@!egoU^d6wx_UW}q--VbBR
z^QDn3qNWLblFWq*k9~|%pT1>(OW~!*s@VJ=3BjMSs#jhe$l*7c{9rjsUub~gt8dCz
zI<a;8w(R;UtS%>|=)PF(OzmD{*2aj+t{yY5P<BhHm#KOWG$0DC{_BC7yAo)ilE33m
zy4QmRj$5Mazr{SXzm)PEFomph-A0%{w0`+Cx5|7Q6MO5h!Rfk9cpnK?@UcCIKfPb?
z_HLr+%chhZvSoCuOPU9jc>zDCD006HTG|fu2tU<#-N6og);#&L<L2^+Q}Qn5GJg-G
zAwR(YE`t93e|jT*C3F=fcwLyj?$n?|G`5$Ye~5#n+GjnRiXPM9Y}?vp3(Zc3c8+zn
zR=p!85SUbf4@1IP_t21p>;A2aYpW;4@z;u`gxi%CMeAL{lG?RC?hp7>x<lqFmZg)=
zoDvsfD_))jdm!1X)u)-OLx;^mgqJfY<ov7O?3YYGPvHh3xBHznR=Uqc_QDT{d|)wb
zTeLv%UVl4#p{|0Pn8BSbVzjF#%DwGK1d!<J`7W!IPXW~vFaimHv=oZg;(FW7U^D@;
zuO~-9oTSZPeK$J?Kkapv{;fz(DSzqsPtGMrsH{#{#B`&doAx5hw?>5uhk0QPvfF(-
zlU;DYxiE9z+W85$HZc94p8J?t2qZ6i#k!tElFnUyT}4^>uTy*ZyPt~OH)p+oNl4|L
z8bPy}rnb>$fW>XisSjFh%(u%~H=fLF5H=fiJ%#s;o>1sRbn1Q+1QqhQzvPkPduBD)
zKJ+)$B<mhQ1z!}kKda{6o6k8UN|U>IC!Zm1;3`*kpb`L8VR9Pg&=!NkFSlT0boeA!
zqP5a(#fLUO%M!oFblFgnEO~L(j&>y1l{i#tpS=bl))6{<TQfW_<#`G`C0ZZM<ZD{x
zkJFS3tqa%kEZYD_bf_NP*iJA&1LVU0$3k?U<`oq^=Yp5=vFCi9G};-H_0<gY)3<b*
zi8n-~b`ZW3j~NX6;d(f`cIs7BTMQI2e*jSdtm(PFeX#3)ZI2VU8{Bbl*7p8BV&a~b
zbMQ>t@CMdADBE6aw>f_9RU2cihyPArAEdVT40h6otA^wHqVKp8t<$13OT8@&%K1d>
z{@3k3iII)=04AA;<pVl|CKQ4&J^hmE@MM3`zQu?nDqa=^e-^vlNGAy8?g;hdc_gkn
zy+j^q-^`lm($n-H`=RbG*=TOWwCSeuE~T3p^#OCSYo~o>9ft(=q`S%TMHC{cp0<*#
zkz8A|1@5f2*)Ob7KXAXP%7KO%>rlP>Q`Id@IdFwFN0CmE^~rPN-I<1_?vv<yl*URI
z*LLCUxlxfq>Q&~iZ3!xMK%)De4W6z`p2t&4VNK0%U_N93B5{Zazx*e482-Ds=iCJ!
zhAU=r_WIy8o9(lY*Pp&K7hYBU4){GV;BmJwM<EDU&4Q``v_$4Fo%j+v<Jfo*1B}4|
zGr)H+&+5JB+H{$cC5)aXhbZ?kH=lc`+Ekw-*>ag2ZO=KbCWCW-G1zuscLMnE5(oBB
zd71DYrI%MZz%epKoj@l(h{~j;A0QueMehrZ7N2*rp&o1^5$eHcdI8z!`(dbl*iR5H
zq8O4VvD}CA{^!jAmCTCn34#~dwzIvC&2C1Y4hQ7+TPn!w)wS^p*OT+6s4zE_uqIK4
zkH3T?uWu%fkS-wVz=q$#uAIk3M3A17YOw!Qmb%Nsfln{QOMar9{^E~AON9#iOJMKO
zo;m_+UhlDZt97fucndqVdN-B93R1$^Y@?2BTLj4qD3$x?tt+k$B1qx{J)Keo8@JgV
zMWr!dOCIO0=;YIYoANc2PArM(kQ$uBU8w6*hl;<RrZWy9?xRbfY8K6E5B}j})3H4A
zv30hmu6J1x6cY&k2e1KQ?185sk>i^u63QbvB!mn^auJ?QhoK8)&^e6WliDL}fI>^q
zQ|7`IXu(^X_#zkvsp2?%v=iW7iRb&o2YVMxgj)dPw$#mhqv&}bffj~oz??)$@TfQx
zRs|4q_$tER_y+JpY7coL<p|K84%bUq=oy!#K6@43=Q{!ws|=`E0jX;YiZ*W+;3%Kh
zjx%-2x#ZN=ECt!a^GnvgzfIfbe<K;dLUZWHi;^WPMfpyga*YhnkdzrCUTmur#y(V$
zMXK|Mxa4b!XoOuScq567lq7Gxo5tBPRqvB$f$190EASZm-DyghD#*JMqF#A;csejx
zX?Bs~%av5txtBBI7N$VRmzo)844v3D#`XE8Axb7?Fn&1kBenMtN0}Ad3_a8IkV%W!
z{J_uwHkRS2nuUPKfuwcus^yEqRFQ+Y9oP6517WR&7AELU0oU^6ouf2kqTISO!XWMV
z3x=n|j(cov96lm$(o`hwH=`lJN)nW;+=VrIbi3~#@K+NXN*Y_rm(#{2h57(*G4qt;
zE5(bVhFQfLL(J71Hq$6P&)MV4ELFQ_@GMnT)bSg{8p=9LlBt(vbbG%h|8kOEpYtZ9
zF|N}JcYLKlz2w5}qlz<qpS0qv4)l)@4cUUf9|7pqaF(2dN9V{wVyRN}u})ej(kYoS
z5@eJ+i$3U>G&DPyZg%QUOIe8&q!@79Xn>?r-fHghW1T2Ai+UVk!H!`B0W<g8<#%C#
z?S2_Sm8jtgU(s$)e8nc^{NsB8`rJOozW`QbcQ*{pY)(8jVk+8#iyAXNseF0qCxR*H
zgcww6FHMUxIMr{qim0ERU+Fp>_UDN2Bze6nyS*gWJ7S@?6iV2rO<|*;iKFb>4ZM46
zqNZg_8qt||Tbm{`HAoGZ*Bs)~C(VZZ&@*0Fcl~$HX#nLB`#Vjgv<pdoEGw*~r3@Iu
zGE^ll1sJ2xX^1Rp-({<8E-CxAY}`D<l;$ZEkW1V>RCJ7@MzdyGxoJIA4!%Chlb&qz
z;}<JWw+6buy}*Gymdm^Qx`c!Ie1h~=W&rEMzc-p;$fYAG881heoL6jrPIqycw`1I$
zY*Ap<ZpVEUEw9Nuv~jiVQ=8sUboSRB8FAv|C6a6W)>Q^RdiyG_Fx*03+LmZ*<$!Ei
z**C$>xwowYOHO`}A}dih|F^jL;<vL8^WO-}h}~znSnpNscQ(||y8az2<bshjYF!xl
zB21n{@afx*rC}b%nD?(QCRgkSCw;=g27(2~s3uChP0B0TG-pMoecsVUE6)^a)}SB}
zmvP^xBP-*Gz7C{MWgapmKV-R%R_e8Dm5ksMp`_o<3>z8)ajL6ud@~81`A4>~6Zb{w
ztj<6^=;>2{^)l$Ch0;ni=DJGX?dm#sUw4eZxQMRbaO0deYv)rh0S_BF^AYH+lzAB=
zEps~*i!a%lTKUpL-e@-OSn^YHV<pY1ep%>R+=x0}FlqkQD3uWfXpAk1WZE*31kbol
zRW%~eTRIj=dwVYAV*dg>s;Qek4JSFv0{zRO;`+GV>crxw9n#KAp_z<J6QTT`QGscJ
zik1~Rjq0=J5{rnPz>t|g7HY_(A$~S1J5wvb8U5L0b2;+y4Wy!8>?&b@caBY~mI=tn
zVNIhvimz_VhBrtbn|)ZFpHe6oIn(=HIP<fSAYB#KQ`sCckpAwLp_#~ur)uIhEuK!?
zr)@CaAsA;@!67%rTmJ-k?z!zlQ>_6e>d<t(wB2najwa_)uw@@5Jy++k@6Ex6OPmgx
z(lcf2fctOGIwOm$$kaJ*+ym_!&SQ~fCDiF;CU@E4)7T4!1Y{svo8fA_gEi1!7J5r+
z$~mLS$pKuT4yXV?G16DW7k_JH7`d8-6ic~an)e}4kdZGY^uyRhC!-xNI|@_U=$HDM
zH35K@jAiad%MUsGT<^>?myA+P&h2XaMD+%j4&KR~U+3kG?}2>u_5*Ow$W?ENqtmNL
zw_WE7m_+8<A;sH)qqV5>;Y}ylzW6IR8V)mKs)9?N>7riAy>_cbi677(xOuF5B~u=)
zW(Gee2<A?@hw1OXa|J5}(^wmNb9{Qdca>(RItd3K?!G;W&#8Vn*jpr!j$V5TT*ZT`
zOOQ;GCm35BpO2`C%)4B7?k%f9dq0lc-Ss(_drjFzSL9?qZ&-)yT&!#{Hdl*ghhTW}
z<s50fy*{yDT<`{n(V9AK*O=;HgomBHzkAs_c%O4w@;1VNV45qJ^g+bno`&q{X1HuC
zwvPj`k?{)qR3Viwh~#sn;nclq$qCxiA(s!FdJx)x^<bfMi7~2oWF$}0A+^h#QTEen
zz63T&ZB(rIn81Uofwpq4LU7C;nOW=Hm!gD~L?3g{6Q!oKTvpo}&fB|CD*Rl%DKmii
zGiows#bN$7eN^tyyBc)nH^!MERa_rbmbetIxb|cg;n&p(E$=}bwvJWWWB+vKb^6FS
zs>AH>ViY&e8SA0_pvgfqUmLka<BCQ^FeH!qPJ+Fdpl@lEOuwQFBj({Tb;xOPmG|9Z
z2&6NARc0vfYi;thCDkE$+t2m)_2vs1Pju0RL9Pwvc$!QLV49N_PDk)))a_<^vW1E<
zu1LyP5jjljyDjy5(D3s!G7}1MG=KF$D>!wJ$vUCF5_vAsf?HS|f5Q8JT)-Q%k|;XS
z`0st6?VTfhttVpl16a?R!qu$lf{U7&y`3@1N<e*=ct#&4z++<7K_3vDDUz>)>J|8%
zSOv*>3u|W@IoTx}#TzT<l+Vi*^`GcX+A8(Bf^vK8(fjcZv^>rqk<*9zn5DbT=%3G%
z!&P@lC;PQ8KZ;N@Pv9vY3VoI3E|=TX<Y8wcLSsQvT|#IyVpK^<jERyhr;r74aq5OQ
zcA27fUAeUc&Q{q*GTejGV1cdWdR@+cPAFRbpqpgda@)9-6}H{>TwWiU3Ne(G)fhD~
zv^8hvs4$i58`u6YlcbLE#tQA+WN5eJ#o%;Yt8o0fL1AIq?34uq{W=`P;_(m`9u-+R
zbZZxQ9rn7mz%EJP<FoU+x~%TgVfFRgg$2+bMJ!}X&FpwOLQj^`!H76Lt-oZ!0JUr)
zMWrj5+}TWfB{{CPm)wHgpdu()|Ls=V;?38pK5u)XZ?&#WOUV-5*H2#yW2bRXF^`Cr
zZd)Qd!<(i3;+sr0g1mY#F|NZ)<;<1l;PbIHcJ(TkNM0Jm1|`a&F@i;rmx2#mia*)_
z=zTseF}IuL=jvzX7ON0Cz#L~BagX=DgbJ(%^Fisp=JINlygbp7AQ*?Rw5Iw^VFSDY
zmA(9eV>n|z(n6r()X`q?o`Tk9fm?X)y;3i2Z8Sl6lIvAO<fD{cLyh~0$)>vNq0{h#
zfbi+eouAXy2tUnF8oGMSeC!W;UwQ!N<r>*{+v;|z`*zyICm!~8{PlXC7S!vw<qm?e
z^cL8H37Ev1!WE%Q*W3LrbI=mE#+_cXnKZ?wuL!6iGh3pzH7P4Mouw71A>r9Sc&yvS
zW9hf1H~Xztk7p{2I#}Vxa4G|-h!+a3vn`(}bs9Lg!(FfT(Df}+sZa1lSt>gEx}ZP7
z{OC`}1T`hxA|qXItbqA~(ZWtS-%`g{$(jw(c){TuAf4$HRa_&DG`fP393E9^t*rM=
z&eA%ght*aj+sqR65|(+=pn!X9!cS5DclG|^jAx|j<-mH8gX?;k%eE1gjqxQW@|biG
z0`Ok73*eCj{%5*eyAD55hzofu8dEIaUaHEyx#tv7pu6Jqqbl8WNoQIz#oKok(lvT_
z<K{)fuF@Q)iqxRelv`ztykA7MD8Nd3oqrmS#akIgI+fLP&YtR`<oO(KPLbjfXq~${
zV(V1UNsw|;j=>PACzmdbs$8|HZl|$tw;WDeb)f_*OS;(9o{^V3uHyu*WJ&MP(lPV&
z1Y0WkN6(d*Vmkt>xV)yfEQ)K}7Maa!qs-Ty5;0a0&C>`K<r>k&`$c*))0I7Ft7;>d
zw^HS!Hq`G`$K{^>nuR6OArFTe%e?qjf)d!0$t)d|GX~AAh-O;lIj<k4<g)5PABVA0
z$ZhDtlKSqczkF14kt<L97!*&Hrd(Idji#ig(PX_sp1d&@RuhSDMGZ98=;62go<bY3
zcTtY@L|=O0{e)bFL>z6YOm)C&FSqw-n9@d{t!H7g-=LEvPsRBYv*C>3SYexaa{-6S
zDik)al?yem$j!b;0`@|avX(<q);y+Gd{|$qST4W9-MQG~^zg1*uH_j90W;2GVeM_G
z#j<>}Ik)7JfupQhgAsKTLI;=GR=<b_wvT2v;LF%Wx$BO)og7qP2~Q><_;3!mZLPxS
z72`rxy+UL*<GItN*Fvss;SJBsZ!~Y{ddH|3cNISYOzVET*?oRGxop+=;vZY;P49Tj
zh5tGDmyc9YzS^{=nXqP$p{0eq^AP)OvW)R=T0{C$qp7q}GJgS&__<}5(h^Q7)e=qv
zCHAT0+9ESj2*o|N59qQ(66iky_3w+JDc#k|yFhr)IN|MrmAI@!_PRn>qph1|@lq{$
z=7UGH9JL)Y{SR`s2HK5gpgymW&5-2YW!4X2ODO|&wwe)%PVFErfp~0{DFGLKPe?K`
zTY81A&D$X-;W}Y#I~^jiEYMEwZn$1$#65`rf}xoO8p1>c1A~PwtY1(~EeFc&=^h5n
zX>*!cXM2ziQ)`)0A1#A)6*tuC$ChyGBL^^K$@QPZ1|I<K9QMA5Wf~%uNuzo9N{cv1
zM`64*pAU)xjT(%Yflh5%^fqp;a8L)I<hrYFrw<j^w-g-U+=(|UTI~K*7kuh<ig$DE
zFXPP&>V{$Q>eMJ+$zj*-ISuunsrtiq$p$wWlk@vGe|R`}(K(NBp)pTzrQEE{9(;4t
z)F%u$OFQ2?GoZg$RZzJTm%WEB@RWhN@nEz8Z$x!1ZTG1*;SU4W<qM&O)MOcRhQjlL
zvREl)dqf7A*qG(TM;5n;dFY{PvIkly;l1<bR_I5U1cjsd{q6nIyEk(yI4y)E*<IH^
zW$4KKsI{O*w#>#8_utnG;&rJ;WlnuJl8Cy>c3)|wb--rj=VlH=%CGm4Vq`0xIlE>+
z;qN0FU#1oF-J=vt<+ZY&qNY?Vp*$~3z+8G5vY3s;7B;Iq83UCsj$@t@3LNC-T3HYs
z0hR=Jq|#3SyQge3UL!oe>NT|cpeGNjKXm%Q%|YW6!JoNmnHij>Chn6Qu1Z_g$5Mvs
zMN0b_8a}j!&k|OA7oFS$hM>2OY2h+B3^M4ndl}d7HCpmxc5cL-fs-^~|Lxlf5mto7
z;-{f^%$)Ae)$ZxB#Z+9h4L8b$;~B2Ra=VLp^ZAIL&mxbKZz*ooWwYn(xaQv6t6ntb
z%RL>g{^w-Om5L+gQ;#@S6XYp)A|8YCwW`%7JQpiRQF$}U$&3~dOd6@APCS-uz$FQ3
z=Du7^M-v2z_|h>7lBMqflmby6$+DYUJ0lho#i*#y18qieD-L$CF$2#9#|qKx^dcb7
zfRY;begLx1O(!%IMIeqYpDtt?^uHF4KR)q`sKP&VK=jzXf@MAU$;P#rOIAJGIxnkJ
z5q9AnX_|LQQ2GwqJJ@TOfbA>4{L@a*P?1K9&D&W=lMSCSenHWf?IhsE_}Se_lcf)^
z6aM1ov2?6pV$0=Jz(EdxESD_#>7hcy2mXt4SX`(mMODvz?~pKd-D*iR4jDyp9iKzN
z^+~Ifmiwx!gM5NHJd^gD>AgkxpwS(tQcZLte^<s(_iX7R7qwQjfqb-Qrd6LQLJ@3m
zFfE74=Et9#38dU89Uzr@tQUi^3aq-CL>jG&a>dzv2_cR7aJ{6D(v3GS`Tyb~3J=oX
zamO-CpS{?>;DenFyO(4|lgduz*FVsKaF|WhNA<GUx)*5eS{kWvKF6DEg`ttC>|*m5
z_(~tS)oVMCr4@VW8jaQM+gL(#fQo3f$*J#w!@mGFd+KmZ(CD6ULqf5T!T*??KV3Oq
zR&`_m3C$_&td|SMlBKxqDVp{r-$B<XX1Ar1Qzylt-wl92a{Ic$xN>8$yKw8E@L4J~
zhZ=`U`TKkJ{;b5WqR9{~gh>}$o5+Rpa(}%JF(^(E3E7eu{REh(wsiefNh-HdJzOOJ
zwY}(Mt0L6~pO_PVSE{bJ+Eh(F`6-KFDY+_AQyY=qrSqk=Z5wB+a_ueutE#?e<0Aur
z$$q&H(0i3FOS9(0h}rR&L=}Y_xTnF`s9TH9*fi-|V&q^1H33n29SHv@i_4h_Hju1C
zARdA7c2C1`r+kvG$03t0Yf4E+ICw|cCNumay%}XUZF*SWaSDrbhcg4!U<00U1&Hm&
zfqMa5#53ou!37=Dpj3J~+tz$|L(CKsykc0Fyp!0ZXY}5{72t&#pEg4R!Ax0b&~a4y
zF8rMia%NTY#Sd!3Z$A9PP9w^~BPz^8xib{Uc<SC6rnmFFVsCt{V?HiW(NnMFf1P}%
zd%bsP`Kd$*jp4KZ`oe}bLx&H1r}TQTWk}97c~RNyIVTcu*@10dNPYxi%u;Wf%l`;#
zNxa@rBw`-ZeC(FGt}|&##fT6!qCuHT)r<OIII}*GO>2xV#;)GkMaY<X_a3wypcmxz
zAFXmKn$$<HPqMo&Oy1}QidoOEO4DD?iC*OR@^q7?*Jk0*hPsqq>qKQuGQ<=Sq}!Ey
z7&b4k%F3IU8tW;csQcX+%v#c-VJI-;U*K`N$&Rep1>(fjpX5yCQ?f+oHVwd!;YpZ*
zcv@752%bvHYClaBoQyUkJ?tV7mYgjX`2QgX#sTZCP;vkTeG<Q0qo<szpFm`=|3@w~
zcs6bi*ZkTq=}3Bjc$rr$ukd(;FQ;9q6*q-LaI;7?WR%`uWWuSFLG?`zS9ymsa##~y
zV=*RPwGCorEFwzS#AVA_as{KyjTip=W(ZMHPP3l+tXAb6P^J#&iGH`U^PfI3SVgkE
z8HczB6uwtYG!uDl^tj_B9&^IMJ^2YR<scHCr)IL``DmTQMY!knNhgYE{;o1CRWarB
zplqq&j#6yVRH{uzQ@&?jeeTd(f#=GjgIJx<waMtfZoq2TzY{QxG~9lZBeK5E5=@e7
z?tc|8kt9oGY?}bY4l9%`-}ft}s+YShxAZgu>6lWkaK7QrQlmRE>a?fvtSN01i!&|H
zL%2BgQLaok7rneRU8kGy5qh#X9ssN+=yg#+aSY~YLzb1Tx;^GtSyJ5+vz%<N(V0jl
zE<C4(jQ#YqQ)K$^PkS}ToA;+vrh!r9t+5C5=OtN-<Q>1UJk2c7m-ON2B%BP>yfW+5
z*}8w8TWNDdOkd6xW>$YqC@|N!)=7}~#I?AhU_Da0x~l)}#cV1~c#sLP7x3|3b;;BB
zAM;>yY^xqqu8=~s#dYF#Cofw?!7=?!ij~`A3{=?xYxwBBGG!>9lxOIW0tgF?_a9EG
zRY$qGYdqP4S9TKjh`swNPOKohdojDb74YR^m}#pECKVkShr#949iA~Sop6s0<h!6Z
zQ5Z>ZZKSC!hBY7DUHEf$kyE@)IZ_Y%$zpb+-v{oGS<c)i00CNANmHXRNFqHn1>-pL
z(!iRBIn*Y3Pf}dQwIkxFd}AY_Mzbq(t`s)pmbtaq-K^X!!|E@4WbwBsSgEUOne5z;
z!lO4wdaY>_#G%aw&@!-(&0L1FOt!opH)B@bwv9h`zgVSHZ=E1?oDf_Q#V@>m|AY+m
z5dQBMAYKiPrj#Eap$|v^ZSqTSZUo@j^WpJ3V&bQ68}^yR6LV)82iha0itW?OR-rZh
zDN&_#y9jylbjj#lGjCfL)!DbvnZKB;TFM@y?pVu$sLxJR+@lVsj8gA$@}Jm!eZhV<
z5=kqzddX84<+X5s(JUyZ$KIau<B<(OsAaL2LBcCcX^GxMD~XglrPIdZ^-p)fWQWX$
zf_O$L$3?AL#2O|uP5-FjXeY^&yrPjpZe{+9CIIDp_AOuHM+9shKI@PWjI{}T8>>CI
zeHU~e)$?-6#=DKbahi5Uu1I|FJBI?euGo8!1y|1Gi_QPI0Lm$<l-3mK6zy_N9$X8>
zH3c^#2z0WJmC`Bd#5!+;%iOejk1~mZrH#w9)PkL(7W3LQ7BAk{=oYk5CgHVN0-v2<
zfZ?`(VdrUA#z!iHvmX{DRvcO$!+w#1<R;;1*WOo2{tqBuC)5ELIaa?Yz~WD9oSi!6
z(9vJqbS36_S~}3=6>*t5LXcs-76zS;e@Q$}4KK|NQ9bYNLR=(Qk0qcVW+%#Bu75E`
z*Em<<ni#64!=6_R%}h=_OykW3ttAgbMllR*gl5+P?S%)4w@-{7M}V(~Tp&$Eu4inf
z*+z}u1nD!qr<JcNO9nQ@xRNWJT^?tAl+$|m&X+R5JHMB17dRS*`zaPzDFAZmNrQv5
z-P`9#iw7V|zoB&R0R!dSZyw2{wy;i|>{<MrNaqZes6aNP(}RClBSRHF1GYq>&`rDj
zKu$L^^|MFfZ&3vHJ-u-CY#i9bw@f{DrGdcwin5$k9Iuj`DponoE!|clx=Y47K|I4Y
z0&+UgSI+XpQ&cH;mD1gU(nRlGP@l?h=%k6A6@B_nI#NOA9n(S8Awj~BL6dKhY^%kV
zdWX}~q4&dIWPB$U0U|5cFVuPXT*=ictdnSx$l|O#Z1yTc>L>Y!wJzkcyj@#QcBSNw
zm$<U16C|()rhvIge9yR%YkK<(a#R2j{pnqkH(Pr9K$iWebD2oSllr1GA(tsDRjD}L
z)nuSrY)!o-j#iJ_;Y0i_EaLR;_+okhyE7~HA;6BugWxrgt@NUN=@DBSkB`Wetc{bu
zx9GYdek8{xO0($e<6F54%N9*8g84ui`h;M(m&-f??9!UXa*NK9Wd^1JBazr!&AVyn
zCqDMG_NWNn$W7FRy_k!_JjT9t6&{rm@oz6DjG)VBNd-MJW``fqq@j8{EZYhtoc_{5
z-DX$Hmq_Ox+P%#g-rwi3)_Se;-`jm|+_u!Aq@FRDk}s8ZQp>WY)p6BxcQNo;*)L5u
zX_lxtQC_+bODdC%(A*3=Y{D2mDzoh7(M$CGyz2q~m_WogtV2NiWYLzpuHFy|hQ2fO
zYImRRL>=tH9{4lUPG+~r#nl;q=N#*wT~M>LeK1zuw6l~R(G_J%k;tMQx9aT0*;X>U
zkYRAg(xPgk>~*Ve;D~Q1o+vva9Obn5c!cyGC|u;*YENge5TsY=+yy}6X8O$7)`|HK
zln}?dr&e|EIZsmIr5O1<A6?neq6%n6ZIgD?dmi@9w5v<2JIXpcVUa2RTCuAAysDaS
ze<7WIqYEk~tBBNiQOo{Zi@@|K+=-T7IH_v{m}mDwA;6KunD!qNXY(!EIX5+dK4N$T
z#n2zThylfm(KESy?sSVfR}*;ARnyy4D0;mNHyFRft<RO_Q(DVfi&ru}`67yc&`V)~
z6}VvuZ5r>f+X0cw;MYxwI_nTwZpm5}3?y<%PWMdizug!OT+EOH3-~XFJQskTYV<+9
z*Zofvr3>4)(buvSbajx2mW&99smBv#A2GfU$YD$U>^ERN4H{4IIrFuBOwqzOSfKnK
zZkRb^J$)nFM9t};QhRR@*WHp4Zpy5aHmeGXz~C)={8qDbD?F6(E7g2h9^-Z6M~qH|
zj?nA*ipt4UNwp+ftjU1Z)mJ}7O;Nbnn2N_iU#!c`4{c?fT9*mh7A#7^rRiDeYo6w+
zhh%|#cM3jtjQ6T~78)1jP$KmYg|PgJ;tfFR@IbjW<4tt$!LKt95~pAS50%|W!nQb{
z^p?|x?)SLh0LM+oQaWSAW(l&<?$Xp>2OFAxZnRTE;+=|3X*yH{Wrh0&cJ+yMFtubg
z<~IeA>WYy#@}3_*e&#0lAd^}6k>a<e%$M*#5!D1>y%zccJY=C^Z7CO{R9$Rd9zUPr
zs21|{CCifsnVQm^t{PxvD=T6_!i78<yzTiUDc($k+xX8q4i6jJtYSMw1XOSG2~eYy
zDC=pB0|G}?6`W^V7!NpB7AwC?$-0Bh*nCu@EkpHI=Ked%0&<f-L~Vvr$}UcY`GkR*
zJV*B>BAEk8GfI$kVr_{MKu;l4&|ru4O^BQ_soifRNY#2go?MotHO6G?C?f-LB7T^a
zT<a<<7AWFu+$epY)bvBIukx%HuulHxCWfKTihLk)!0D>+CIiwYCF@Yn@iMTEs^dw#
z!wI@McDVbetEXUG`eO0~K?LV<dBoeQ+)|q|CZW#yV%H&dOIl}(bY=%G8iYI=F_*Da
zI)M4f;aOWfO<^w&AEV2+gx=0gb?L5q5cry*`Q0B^fX6jnHN#u7)C*##l69iJY_=KD
zLho+n{BV3T2baVaWktQUq^QG=S8-)Fn!$YXx?K*5lajfOcCv|Qg0px<j0AoU(Iu4a
zS%OuPXyoa;!5nhZO$C~26?UUVrKOifzun`vl-A$AOI*dd-ln3<e$fJjS=(t#6TN@P
z(z`=-JHbCxsrSyRGn0C%Ua=kfR>g3VN~}vz=`>is8fjVVRLM_G4me@-#rgev)>;EY
z<;?V6Q(|z)u16Q6aTuBPER#KymYTgzY6zz4JpGjx%gQ^M_|v@V{gsKbgh$Gk%dPq#
z3vlr@36QgD=qs4kq0!(TWQYw!jyM|xtb0Ho9Up_kQ4tFa2tJ7^4CyUvD2jkFRoX0D
zn$orUeccmblONU?oMzIRyD0op5<zq;w~LC>iCCATOy0LFo7`!xCe}7sj`QNCOEk%O
z5|zvY0>oU=z^t;B0Srqk>thPa>*g1yqFU3W-{zvK3eT*fGh5f_beuyo+r<CTv|`1d
zqEUCttkb?Hi<ObpJWp{_{AQn?35j$2c4#Zga(j5Fv@a16i~)W`1*_6~TQnJTm&H~9
z8ZoN{($~`f)KfJb!>;%NvPlvA?=-kmjeQ$?)WYx^u#!yE(!|@P6G~mESpOgpvIW6^
z=!}r!G;g}4g;Forj(#q$V+HbVUe!;y`Y!agF{X#ac$q@OA}T$2^;(cx<;$pa>f|=x
z^O%wLVM#0Xm*2*c>4HrefmYwOWpCU1cIlX1&4YF{vKXP@kJDilYLot89F758=S%Vo
zGK)i|{r_w4yWiRV{`b3dXi*fkwY6vMRaCXq2&J|LHA|?yN~o&6Y7?uaqDI7u739@g
zHA0P;wfBe}E6C^R{rbNDgzs<fpB~qh>&lgrbDi^e+>iUd&pGu$u|M8yZf|}xkL%9U
zywa~lJXPaTqZYR34G^@WQth(hx)p>=ZN6p`e^VW+{slxaNSm8g?W!}4Ay(K8fT!LS
z7sxlfz=!PHjvUcx)n%)WAK^@yt;sOE==T7p1_ss-j0tA5(`GIE#<FrSH{-qhY$^EU
zoUWyBsFdeVg_Tz!)%c0=E=PJ7jLmHHi8**L=8h($JoWpdiY5Pb@FvIr`jmfDd`#3g
z3DizVOL}mk)7v21*QOAZk%gapFk@8n7!W(RvWax32teK#c=Fz?_{><j34Y@7S<z9C
zmYM0%4ph0~3x{3)JH8ijpRS9dSj^ZAaPS+jg;z>X_=$ygQca6CqlFFDmeAj-D(8#K
z(2me*1q;56nv#;-V(!|OiF+@Dt`B@X-XTdTS=dF}YOh|F3-lmh+z;s`Q$)$;joy=C
z$QuET_x4j@0O@Y8dAQE-S0u09W1!y1&tNRp`dKp0Aq6rBJ+aBA@YjOzm9VE`v&uw$
zv?rR26vVFUWH-FiR}mm&1lG0eRpHrmt~yadqrfGN*D9PQaE7lm>u_KtEgXbjU8tQN
zYva*R^e#Ku`m23t9HC@WTIoE!Q8d`nH3QJ%e32O!2>D{xnFM&mS{n7TI6nJ!1c58S
zh3Cb?Un%6u7KHT(STb=?70+wMhJp<PC2;u~F)@~o&sP3e)4xU6?q%`{VB^qg`%5_j
zAAReKCuG|X<Y+Tqek+x$OMHvCF{gPiqhsgCQ)GAy_rU6san2U&JL<2_!YYyZtTl$#
zAg$16Pa`dCS9eM>0pWo`jwKBaF-EVk8)c%sU*B@AoGcr>N<o{{X@k8c6Y$#Xlkm%)
z#yg~?D2~W$>r5!Gl*od6)1M<GOe$5e#^_pU=KO-OLBj9GgK&xl`gbv?cD+GaGPiuh
zr<3pUs{VRCYHBK>e;00^cF}#bSo{mroQoBH116k`u;dJBue34C%f$Ae7g;Z@h14gm
zzx0bGe=^6xd~e(eKmE<DLDZU@u)B<H^I@yo0fXahx-y?9!JNNf>%Y_r<TYAF^ZB)&
zwoPdp3zi0!3(}uD!bC&ojB2<4gVZ;bcV~m8-ZR!5;ua3J5}QlF(kWfR$%y96ms;_a
zY0jIBR~1uhHF$~l)fIDAe)CG`%dxd2k4mKC36av9)(*Q%b`Rti&L<HlLXmWNnnt=5
zw8>c)NIk{QentS7dBLa}Z^~)1m<nyK>0>&b4jW$O7llyiMKIyFYq}ca%}-GxdoB}#
zv%)TtPkwcu%*Lo$t|W1Jbme`4RJuu-jJc_cRI^mHw>44s<WQHlY?lb(zs<QZ9>k&h
z%(YbbO%u_$F^9(lZ42dK3&we%?ri@{D-zV{gwbVepJv<Ch&~J+k@}f~bR%h~eV=F1
zbh+OW6u#Z#p)I%#oz9z|psD)ptpcs4w8Qk;Z+Z#{!(j*-XjevR$c&6rk_k!j+}(c9
zz|^kl<q_VKVX21yd+qEpy(rp-p2vAA#~}_{THK!_NNT8tbRHRi|3Q{*8M)d5t2aj!
zed>njPJUe2R<LEdwAL5B?-euJzqtB9GrdO1C+Mi-IS+Vc`T0|!&Zp}y8K~@@coa&V
zu7<N~t^TmSeY@@40o8TQiN#u|tNk^~?N%R$U9gqDAwyCzOK4_`lM8cIUO;Rs<En+F
zky%-Tv4M>&3Li6XR3&lR#aNHA_$dkS8Gfox2X*vb8tL>wq4kUe?FJjjn?w}fHFGx8
z2QQoohKn8f0^9%owf{680b8-*PfBJ?7?#ST-<cIpXIe{bjaf5l01@Gz!5#^r@45X_
z40+t=N(QBhaDP$_taUrTde%6c4jvK<uLrEiQh=09HX|5Li)W1Hb9dtaX$z2?{J(?-
z8%CW>?<Z<Lx6{a;Gz@vcJjkiKUtan}MtLB!S)p=`%M+BwmOwd3RgXi-VDB6hN1<f-
zIWz|?P16g$nRF3u<c+DMPmm+{hLav5Hf?QLqAGk`d)0(NcpzD%fKJ)|{iO+xL~Q|&
zw}UH7L{~Kp+2PW95Mi~-PP{UyAWSC#v|k%Vbm9a!pW@TD1XHcQKMFY8YDV90_*S!@
z$*O=~Bk4~qeU-$I`6M2!bF(CseozkF3$v<zhdjDvrF~jlnz>z)L0AHK2|xj+SV5|3
z`8YQJoQxU{tU!vk|K<4k5mXHq23Jmb*4rbsVZ>IU)v21JE;!Q6m2CBhr%K#i36AOG
z#ToRPl^53L6wyBxxiu2<r}938W<B!>$?4~;>lw?mxhaU~GZteJ+TiOaiT*DaFlRKi
z00OEiIlw4?xuNIo8;tD+R{|G;4r$x>7xx4hgL=#vpjbp=IIpB~3fT^|eN*Q9!f45Q
zb%IxH)|&YknX<npTNtZWsxGeCXl{%}{ARIK*W>S+WO@1%SBtzx8g0crxNynuruI1#
zYb@Z~4F-eQ3!+u=U)MskHImoAsp}}}qYlark+#-oY(38XOK;h?Z3A$|-q#hS_+?!+
ziYh}qG>H&PvPqhhC^9wDT#YpSD+3d_#T|t>{i9_<^(M^N;ojcZuP1ER?lNj{7i}Ms
zk1E~3gdyxRf5?bKv{+sYRa+8xULUT%cjW2yXg%Y*7{WQATmt_)Iv<Uv`c|sbokjph
z%~g3{&d{Kxtv2G!kSPkcv*m9duhVM96AYN6_e?(Sh=qu0u6C~#FHzcsX;x~jX2Qc!
z%{pt{_nlb1l1o*;neh`_pJgonqfqtb^nOvZLwsvnlsDw-_hIQNF=Qr4$UCgyM)~`)
zzqDjNWtODU7Z){&v1kjR6)v>k2!r7D!QFzM!(|q}Xn41Hl$&xyWO1t#EG_6&?AMQj
zJuF;t55<HUevXN9IEPL#;9rkFw{;8}LA1X74KMf}f4d<<tI7kmZWiC_#gstb6OVU<
zKoTb&(zYNFiKD7^t6+ltP5ueb7J$R)7E6JIcAOpIyntx{{3FaWYHoY?R02mlb;^`u
zH6tHt3YG~nebdI<H+&(y%Y(A;j$qpj#^}$czk~%XGCr(V=R<Z1!1dPo_|=m}Yt0m>
zIwec64R(tG3ley;KwIfKqpg;Ii_K+NXE3dVKcZW}#yVbRl{Zo1N~QLT?%bm8@pyge
zcFQsy<Gm8~3h9cfwX|v~PaTz$zvD}9TPpqe2bQ5Z@MPJqcsvF^CZ-xNrN`+Kw(Qr6
zY*!+~j5F={xy=0QR>+3mpO<4Y@`@hhTnVn(da3ozguDF3JoH%fpLKFRn9UGdu69$*
z;B1?Izq6y}oK#e7vc~wO6`8w98eIoJ>%Dn}?s@l{BQc*-Th4=QWhox5LSRKlOuYW%
z_6RtFTFo)5X{+y}P#!4sN55AsY-xxwc;1K%10$u{9$(<#n{q5hg;-hk5nXgKu>f;j
z&snjq-YKn+ES6l0b#+cr#5&WV3jPS)Z3l}4ZfY4=s_nMROWVZhe5yIRvD{j=uLK)i
zJ+>XPhZA&b>l)`YM<dLJtB*J)hSbl_cdmz1?QLi0L1bdPOUhIs&dX<=)rJV-^-GvF
zf547&VF9{W$;3bK#9D!AzPz^RXOTZ)k*y!>3a`L!6^T3~Ph`!Oq9uB5W-k(IS>HiV
zgcW-4%G&XLFsY32O5)8mFWv2`&hukz&of20z5Dx87WU$nVfN3`iu=x~&JO-EV}&CM
z+O>829=16n*F;S`tFJ;r!Yr`&ngmbRh5-U&agc2DSx|tvlV`!ig4ibtc8+nnNa;GP
zfso-{O<CS$YK{Y>L=m5Q*UdLt%JB>mMQf_NUI{`xhObBUmpjXghH}5Fb+OGBIkdM^
z3)6K{`LtRV4+xAytQTr(sL$xpFvm=58iY%3>GZUxgNh^H3&P6jdKIfqpwdN2a6sj3
z)D>I&<XOs`K3%Gnn?66N9h6{)?)MkU<(}_D<N>~8Gn`wK_K_+P3Y`op-wAohHJh<y
zu#yWZuFNxeV6eTRhUl)5y?<b(3oeyHOWUceTeTTE5qC{9Xm&JyR80+klI3YLtLZ#p
z&hMy-&D<MsdV;i;e;hf;e0talxypz3zK$W6<U7K#o{=kF7MYAj2A!>ou*Qvi513`1
zK5FmY)eN5(&pqzZWLR(zeqZ$Wsyf5Ob)~zLQivAJ`t2~QYi?hkmdN_-L|0jR*!nmR
zeqiY^)A5eZ)gHd>LzXP{jycX$L)~ry(bjF6_rXK$giXh3H<Q32#kuP;$5wzAinMVF
z)Wl6{T|eb7VGH!q!F-DUskt?aJYPea4^G@{wDIdSmS^v{fPV80?qdD=56nFu4KbD2
z>V8fM3^wv|Wa5I5bqVVK9oI#vEbfvYaqUc~a-row34+`j$tIbgYtFZmYp_dGG@tcw
zww-YT=(ee8R9!lYa?`{@A42#==x^~QRQt*NCCytX?u+yqcuGFiHGPVm4!}b!{09`K
z_Y!xwh|vl2HW%zu+9L+)#pVZX(<LbnW@pJMbtB?jL3Y0ney<nL*uL-?@y+$Cy@x_P
z52`?ot~f@zRSSv_Ey+|bxI|7BeW4Vs?jyFf&%b>TcR!Q;8!J3jFkJxhO)eUrL<TbB
zIeV&#rJ*etRjGlGw9b*n6I?BXE~tM%|94qlT>5Q6B3Pv9^h762X2k>Bro<zF!6fgf
zmBP8J8K>tn+vPYIX4kfr`o$<qmyt?LBlix{wnFK1QS@_Ui|;6Q`bYNS<~865;*~B_
zCCOsus-dg8;(LEmWuDhH**mac<T*MitCA~O%Ur_6W3e@5P36aKub(i!tD#s`vBybb
z^$gpjw?@f>9ez0RUdJ$b@07R;U_RCE5|BY)4DIrE+wbV2kZZsk^){9`<}$34zbR<t
zG?Hg78`XT>`p%6AIn)MT?R!@;Fj8tW!RId-Go<L?+^RmT{pY|->;t=IoRv%$isAEb
zWpPoVT3AUkqY<(we5LQDlr!V}IxCtm$8UHT0iq!<&HvNku`%w$WA&(LQ{|1@?nj*Y
z;Kn^n+fda-RZ__FnK#;2Z6+XGpfP^T@@urh=%yzH?p~f6Db$xxI>FA@mUeL6igl)*
zvC*xHd(wHgl70)+^iA?}D6}V>lNF_-MOYi3{?RW=8(xEharT5YHsZ$Iqhq-c=<wS+
zanYO01DWEuJxz)Qpry3eFWsac2|FI1({1C~qfPtN(=3~5+1h$g5jwDLD#4i>)*<WA
z5P!j%4I*cpS@x+6&sXBlk9-1`eb~>M;?MU<0XrRm8y!Ih_M{!h?bo>{`mk*3IEeMh
zhUn+SWm%m0+&XTwS`sUl=Ck;D_}MZ8NB#ph*~%*;mIWiAC{}W#TP`{)WS^O5VMd(A
zzV7e#eyAoDmH<x!tDU*~x2+(d(N%pVtKOm=Pu_QmP!|&;(T;}-jvMhInFlI<i+4{Q
z5jO)3x@<2NeP)<+^KJ@qczTJ7bjW@_>~eO%(7YWgiB+Zov@cY}q)$*i;p4)q+W7+B
z_d@p`8{(Y*Jk&wX!Jq0f;LiBuW$)qwBI=x&Xw_*N3~ohAbf<wpcjC$HB)ckFFeO-5
zRsVmO*2PJvOt5BpR+8?L`+-+>>KHRUgdO7u*cqDv_PQ}eI@a|Rn4u7hqtKuo6{Y>L
zY2xHGvA++x8LmiFfxtr8E?fi;#3SB~<g#gVY|)r#8QUKG*6p3saGT&1=s2T`yw!83
zYA#27rKDl>4x|ZxT>e88#J%kIIeA809Tqe#(Q9GlRQ?SD9rXTVl42=dhKW^k<vqLn
z+(!l?{#t{k5U{5jn1{-r&^5-+FKZYE?n#p-M9$|#&WNO=t-zyjQe0GXCkHT!x6kNA
zaDBVJh)RFTniRhjwEY4+%7%LBMki9wxb$@5^1{h!POpK$Gex^MK7v}|X~$z5`_zG*
zh7!iZTpw~uRwEDSgrn=_rgf9-+Ov|>9>3$C<R0tPvrVx4zLaXU`7^CDRdR`Clj<_Y
zeZ~lo)MetQ&+#Is10rYL7DN<jdr;{(DeuL;^H_$&2PmhxaeO9nk8&f+cx3()%u<`4
z`EuThT;#M!lyBR>F%kiy`mk0l%1GPXE`HsB3X161kOEU_M#+ApaVaLYZdTp$_FyhF
zl1_8ZsWe~SwSi@K3W$F=sI4uK{vsBZ-?Gt|!Oar&Qaus1Qk~m`lFi8ND8Dfk825hQ
zdaL#tPAlOKpBDE25o}qlX{6IWi*~8=y`W<q(soDCsV$)}@TBnhl$71h22C)=pn1PQ
zq;sgB2Dt#77jjPtpES&RHeReh!8eOH-0}GXT9}b>gu=cXG%@>cJi6*JW=t!R2IafC
zv-B!eKR?26ZKMb8-WKI9D!yB}eAA|JZN`hIX0mH!{!zM6(&u)0^_YuI_Xi1FS{wNN
zAG4!1Bh1N3s|aWS(z{J{K0^hcs0WflH5lEH@d){7Oqe(yKZ$%VQ@wKYQR^M`UdH)`
z=Ym}9YAM)VxVB>KtqR5GiG-=I?Fz!W@h*83{_s>Ogrv8#)7a2+{0`)%QB{@Td(Hcp
z+S;iq#irQKY~3BQm=Vh&_LRO}R8y{;SqW-DjIwsds7(6^2f&`*84=PhX*g78G&jG+
z?P^$<3|GqTxTcnS$X<4zHF{&oQ{C#RN7edn@AvT(qp$fOCNs|@;d}P5VETSk#Uj`I
zJIdT#@Z^wb9#-<F`)_E{=YxV3IJdV{u<&i`7MknhE$zrK&}s1&8fbcbJ}I5&iv;dO
z2kE5+kq$}AI;XA6q&boEyZ|epCC^6KG@t324T0xJ7Yyx3EH~@FY92ujWRgrdGd|o4
znXcQWcM^B~o7{6G`r=fZl>RZ<kNvD1)*xSS@?`6de41fp-QyZAN<^}-cj9;x-37Ag
z*VaSV?uwp~H`AV;xSX~Joe`#eO^&ij=SqQ_%jccQ(@cx=4SOXsMNyz&XwytZHq99c
z@gD3b6I1N-$>(a*@3iqx(n3ABA*j>_o8r6nNtqKU^++qH(M|}wm+*3W*ztFN!;%1#
zPuQ#*XfF*L={Dh23Q2s+O(jX2aO@s3(&`U?D{6Nl3=~lQE#OoPC?LJ~Y&Ih~=%g?3
zJdH%aoUG=abna$<1bSCp=J2}kDUGCc#Tvfj5D)9b(eiiKRS*NAHsH{t(cJ{&U)CXD
z*PgE)tJZy7Dm~Jyc_|t2_b3sWfUHEP7~fcI7{7x=dY3^-{bwP0hrK=0GG<MjVs>cG
zyVd)bGu^Ft+u_`X>4En?i|e)Z?V>{8mX!g&7cf(QCy_IVfPLKo3g6>;(neqN{+<%4
zFKE#y@R<Fqr!Tqo3zHL?{4aSz;J04;-yf7L7@YTZY3A;yAesrE@?r^5^tr#uXTH#T
zh4gZ-CG+_y*xnLJGS^Ld5k|*8VG{D-uvkMh;7x1osO$+|JOh~^C6svI<JVX&&3%+v
zc-3;GhY(U}%}^a7^kRIIZR9?nR<9kPi9i<KNAp;m@1~JvsLn^0l}N`*q}{Y2f)NRy
z8?d9(T`~rJS+LCpq+x|AG4f$Hlt{tomZ51Rv+4IWMHHtkEyck#kC^)Ao5~wLIVT5t
ze><|YW<>FsYt?E8rq4)Mu8@-7DoF6XkmfI)f1YkwxaJLyZqMQC*Y9!~{NCE2KCW_I
z9qMFYHg_@?w$mQ$<~YP!L2ndYFuCgzmmdGnRL$4skb3^oB}y9g=gRu5nN^V%Cfg<d
z8Mx=uIS-|SdiJB>Es}rG;Z~YU&=F(vE)JP&<nj2|Pk$L<Y#NYxcD)_1z1`A4&ZZ@0
zauG`co=x#;xrlS2k(N=7lMX%x__apI9EgZrB>P^v(m5ZfuSeW#vhmw&#g5-*{`jm>
z-$p$C2nRXtJ)zs0^%Ve+vUKwS3YoISGEHonCW5C4;MEJbOwn0$9J@v&D&BLH@`jm-
zIdnPhG!*__I5w0em+ThsdBSHeVjwgH8!m7%BlGF0Xgy$FpzD{w4|*1~#Wi;k%<SZ8
z<F%w}D4D(X&h7sT1{VuFTwQ4w5RK{M1StRsc2~VYjx9=d=+w%{j&k)`aNQd&kRrda
zCiuX^-E7pxl!BGDBdj2CKDSuIZgR==h2Ho<1(U^~4R=p8cF5&6XI^%SyiZ0`rb&`8
zgv4`fl3H2;PB3{ANZ{WtnK-5kxMSYVxnTW<?Y4-jxfUzug&Ty;bbmG|u~?N@D;zUB
zrUhA(celC4szG&6i(XV7pO|}w8uoI8cQ0?vr{13u93H3ev(PmuNqV6pWOBQ~5sF)J
z&|<T$QA|K&e<I9={m~xU?oR*Fv8Fw{3DTBC>AuE3>}Q>0MiaiT9@V-SB4+_)o}zzt
z4j|#h{CLHaoUP-W-AF%C_s7BcKyM%ig0LlRfKTnNuu<&Je)nD&u(61~f)D51U}@&#
z?N2Y7){ih~)3=i6Xy|YFL9bk%)Tc=&@<G&sS?@45A|k=50&cV7m|dZyJu=AQXgIW1
z27~Thou2iKC^-zaJm{JrNF@rXrWk~Htrk8Qq67Ac(<1&vep}$^e!!tm(4oEJUPin^
zuWpBwc?=5=kkOsp4VVUZr0d~KOhVK<)QjQKvQJJ5f5PpgpbB}<(xG|?GB@>@C*Fbw
znd|FGx4%Lus@Nh1QPj|3US#BIvQu_J?Im{&go4oA`B5>^4R~*J9~Lu=E!<g^v=I+8
zwam61D(l(|^aiJ%hX{jc0H<@43joIV2Ea$>TcmTHpc8CgSu@Z)`9Aith6}pBJ@IK!
z(|Wxz?^KCy4SSOQxCNXpUOhx(3vV@<v$E0uwO`gCnmL6O-spFIPL#{kFsxr^-`dFi
z8FTDEBwi`FY%4|0cIyLI4b<3?{;HIu^yL#jzpSX71FrA54a<VuB_7PwOW_Z^1tzE#
zzdz-dFYIZ6?}2BgZLoQZ*t|7y(c4~Naz$Sg?bpqJ<&O75bf9amJ8E?W0X-Ci{sMHh
z)ukG`avWeop&_F;NwA^-2F!!TZ=)goZwKLbtQ(TY2D_G;(csaS(NOAt`hyz=>CA*F
zI_N6Lr<LO&vc)h7{-(%DjQ3BM9T%@sB-B+XZc}W1Q~%<y5s@Hp)EclqBl(ElrRL4d
z_)+j5TW??HvHeJChOeJ}lr<B%8znmh1sypmV4V`XyB{doUyTmlFt;$$|HB>W=QGZ=
z{+cSW6jEbmuA7jUy`V;>lBvi1IHfeFZ2#1-jis~$8TS*}V{W}c`7ghZ>klEE$IYwV
z<g)cx>@~}o1^<!cbf;M=Gr`l&N}!5{>r(l=byM2!DOH#)?FPS!sXrqGaS<Q32Uxut
z_>lT&55kl{xD>^@P~(SvfUQ-FmX#NmOCDL7)!SUcU;mI*vGHD{r=I%a9LR3emiW|v
z87pnoCMlRSjf?-u**qB)RQpp~nd`dQ-FDYKD}yw$*9JkEO+9>pb}MyIat%}LBy|JE
z6vIB&o?sAC98fN1zA~D};}NHd>j>Ie!Os%Lg_nN{)&xULd_pC>kl1m8X!P58#$rsk
z3<QFvE?H?&H#6mK1Gc6?VwTV0f3%ab_|MFB$hy*TI(ac1-}D*?wc`Bphr!;r-q{RU
z$f$#JZQk%w%&!2b1|17%lYyaDz3XHbYSDT_U@o7R_FByV%0=7yYf-oE)!GESomf7%
zI_R>(&xq}16Jf3@={pB|jSk3x54{79rhE_LI*=M}vMQ*Z5`RFDx+}*rvi$9fdC=M5
z+cy0ANFJ`}9I@)i|6Eu7?%PLLH*vJ)@~bR3N+COaF0YO1ndH8F@vmK1uxXMNnM4hl
z=yd)hqu6_&&xtBH=(UpdgH!Gr)cxK~-gbk&(*()J9N-<fn`*^~K;;11LhD>%9hMm*
z$$8^n$WjH2D;4IG0H9H_-JuXIIorGQC>G0c13t8=jfuB(Vp}oOd<dWYoiM<h@@hfw
z`OtKhP~??vF}R?ggTj|AA>A{d1O<ONV!xI^MjgbdNbK0GhDDN_$#LeOdU(H1R72>%
zN%474ChuvN9YE9sx8>lk1GfASz>RoQMBu|4;0^{l^ww{^1|cm-(yMn7bE=*-(T}SJ
zPBN2+IfZ|XJu$_sn09Ku#*Fkb-fU>Tj~m*T6BfjlhY6{R`6>QrH2faAJo_?=RYABf
z;_ab!+)hc;+gfUjX(bqN&US6z6~A=pQWoVS79hCFdCCA`#&g9L2>-19nFYef!EY^>
zfmo;#eiaDX;gmOkkVVN#2?QBdx&M9ff0OgSmGi&d@xRpZzx4S3yLR-FfH@|SR+Zu{
hfuwu=qC32LiOAY`bQ7=Z27Gc!{e|}PvS*f`{tu63_k{oe

diff --git a/docs/images/pr/chat-image-delivery/click-enlarged.png b/docs/images/pr/chat-image-delivery/click-enlarged.png
deleted file mode 100644
index aee0afd560cf64ca31d5cf84b2cb2eac0a3e5cf3..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 4496
zcmd^DdpOi-8-B(iIqYaZq{F0k)4^dwT4p3^JGv-|8WkU<NI8sTk<)~-rL?UM<kV)Z
zwd7DSD9o4~3WF_&avCHuc1jKj&3x}WnYKRLxBLC~UDx-A%jNmK^ZuUazVGLLo^g8n
zw#}c(&65Lw&&;-L*a09>hkk5lN}$NS#!bNhv%qY_Ivc<Efwpzu&fhuDwDSimqWW_U
zdHNT+2UX7QlO6~wJ5V0KQ&;*_#&snw?V3@ZdPQnN^A9()sA<KX-xHnd;-4-l6m+Ch
zc?*Nb_Qk||&Dq8N@?7^=?ONgF+t(c-f;YXqrYzya_(&Z3HP(He;qV59I|MBRdP2kD
zk^0T5wT-nV{({M#Dpef^L2pmhm88H|_iwq>nvC})GlZl4k_TftT^`I0CT2!x>^bBP
zG&lXXrWAH9%XNkf3{*VzT`DC5`Ub`3#D{}scjm<Ch8%}&<r(S+O9^l#@cfmPod8Ee
zC81K52#c1HfgaCA0c%;J;^MZN$FB6DZ%32DQbV*y$FDqcSq}2I>uOmKWh(mVSvPZE
zX-Uym%pRxob!GWy_ei}AE?yib%hHoiehQ9_#wij|oK_V}16`L*%xK1&w|e+hOG&_O
zb=^h-_;G8^;~fMXdH76SnVDe6)>B1KvyUYqTvQzby(V}L!Ebt8l7b9KVO((JR2xQh
zmPM*|1ifx+atH|;iu4o?ws@8VO=O*N%0_Q9e_f?hVjLovjPoq^pBO^d_~-w6jv*X-
zXu0<7I4_H>H#6$A_ji(9HNkb`Gh1EUt~w1xGjem@bXm<L0{6F?XJij|g-}WQZvFO{
zNF%a=7VAP{#49Zs8Y4}$BHlzMtJYoN4yEF3o=u>m$#4Bafhv7>Y>h)lQ?A#7xfSlj
zy_!SU452S@q=71=&Ts0awBPmjz9_R3F`(Vn^6S`O#lnz@-x+ZZfh{D@OofU?WarYH
z<*>3uD3}N+3C=Jl&p_ynT0_igmY(F#^PxI{8zWOgU}oIt2)a18RZ@3vv0fb6Gg2Ck
zGV*NfK9ghq@P_0z5X#Qd2JdIyZe1Q*$sUtYlr{qM-U6Z0gI>q(u2<B-M2AYREFA*V
z{}shg%6H9dtv;|_nH08pm>EExRD<jTCNhdWT{_@g-B@lnphQ~fAvd`Kj8#G;7oLbL
zL6Z3D((YMJP#wpOSrrfs@iKcg!ITs3v_fGu#ONs@;kcCQxe_BKXlfQ>1?AZ|vrb#V
zvzqV^wADILOPd^Na$r9$$j|rl>OsUT0CL@0>Zzeu2pmOkXQaxf2(IsyNMMRZLSg+`
zppg4A)EXSq?>q_o8o(|Gkw5)Y*Hdi_YVRH2E)Dqy@U?{jWPnpuLFaSih;bUgT%Biw
zOH+YGd3%sbfr1P1@xSS9*!gm$KP+-GmxjvU^K6VO<lw;jx~8?tv_Si8d9W#OQ$$*R
zR{}=sVD1D9BXNV#OEHj@fLY|Sa3>PbH{Qaz8$@hsd8>TqYsjV@Sp)FME$!pVY0f|U
zEj)=E6TOXG*Qu|p<0%QmV`G=*;kR(m&75lGtl?Gv-ps8mmR?y)70~A|9oy%QQ0QG6
zY|-<@nxU6m-F~1iDG)pj*-}diRIKQ4v;^Qg<C+Uxm7%#JdDP&)C_2+X2KFSQ42_zy
zZmXi44i1$v>gS@ilESw%_8%_QBLbw1cm(vwx}WL2FVqM68T~1U3N%Rba$_aHg=3Ad
zIwA}p8{d}z<9PhsBk3!Z?$3bRxeJxblpXLt^e9Xnm~2d0L9A4SlR7e(3AZ#0$F*gb
ziBKJj6ziClX*g@#b09&C2QnIZic#n1W|-smE;o%j94Hu*hd#HCrY}+2oKXX7%pU)q
zQq*91E%ik)t@KVSf&MU{UpC?q(4}LTbBQ$wRSv3jk#Co5gzF5@z99Q40lNg;&!1wk
z(*7))j1W2bdqNWLQp;KbJqAk==cY(`k|QtH{pvy9a{_%X<w^9C=tP>|KUIMfCO#;#
z>S&Wy{X`oeEAravEf(^@wCu9nAN_Ow+m5!~M^X)eeidgmv_b{A_52nckr)4I{o*;$
zY7^RBtksO(z54Ce<R;h71uGz1IaM*Lf#4twoKP`$q7J>As0K6L6KB7_7CZYladA3-
zEg`DIWNv|J5b9(3T`~w%z~WycF8?DRXl#jFIm0qr0#q=KzPv6SYM2C6<jE6H65s&#
zzKanL7XZ`B&aUy^nss{oktGPtd|r?HjQJ>P{L(#Vj}$Z~RqQ9wTTPUR-3q|9`s)n;
zvtGn_iOBd<M15FT`qakt2miOt%41Y1>P3k#80g-w`y0~taWE5?8u%i+_b6IZn`1T$
z=uC~Jq;3H1t5}5$%Bm;))aDxm`pLaK0$daM#|Mbe_4UgpmQNWv^8_*JM?e4hK)c4y
zdZatG4Pb9eNuAa*L}HXi`#)zut1e6N2%?*8IOwFQ_&hd3Cc+Ah)B7XKgzJw#;|7p-
zF@hz4W+)m-Ta$rlqL$0p_xHvK&dWQO0(JAGWuUGgIHd?Rr)HdL@i`7Mmt~IVmfO3i
zN>N?_%WwF$XjvYzHntQb5x^#1Y%E(l>wc+G2C{b|68xTt4tA&6Y~)p<=g5@icmgOg
z@Q$_3v37m3nmPg0uv=HwsFO*H33N(}i}^u`35~pCXuq+Wlm>I3q7!u?PA?RuEQEua
zS-U~@{FbYq9ERd?$tiOHQ<sV2*{FAp<uPKP;N@yrBJHeUaPjfiCzaZJh!EdyZAtzK
zc@$HMLpy{}^~IGIC|Qy%^uh7;CwsxD#k?G0BpS>7{iJe?h}(-vyR24$EZh^1tH8?o
zD0{R@iCnDpw1cH0R9Ds~YR3+Tvxf?SrY1fp8rE^cKU(=-lVJMWzKC)jr^$e(XdqAd
zqu=cbK4;JBA_6=TW#x;sh|Dbb^faZ2>wmv4{QM8nYkL+N1<lVr=M`;}e?dd$PY$AG
z5XUruHv2tySf{-s!(e)7==OKwYcb%np0o!3wS)@ByRvGe`_l<vn{9+abwtCn?*sAw
zu~#$N+b`<*g{r_WF&OT>sv!mQkZAJkY0DL0k@t~OuVmwRK0s7g*UhDT*)w=sgFvRe
zj;DSzj-K$0Z1@tG0%NpVJROat&2d3s?Em{B|HwtB;q}QtraYE@{!KMaR3!JzM`K6q
zbgFAoZu&264ATVW670%NZEOPQ+VKO<?xZza5TISOoMGZ~8XjQf<GGzy6`gQLHsZ>C
zNtlZp*MpJLMcIW`uD@T>P@XMZTgeX=*$7SsPaMtkcWc-Gm02aQ!@C>OsgetCYgBD6
z>QMB^$y{zrb>W0}-+hy8&MLg_XrFMap}|@cx%T!wmWwpc)uZRi8Cr6Ywp9LyM%Jk=
z%{vq7vvJ?&ya%F1tTn*AELs~MZB&uw_2-Cft<p#oKxap6wGiuEsZrxq{f-9jKF%sU
zu8pN&7|qQN+9XQADn?lN1Y4cAdUA&T0eh=#oa5%~fyk1~uzH7CqzgV9(Lq|NPme-{
z#hl-Eh@Rg)kIkT}eTQD`PmZF`#MA6WtGZ`of^0|Y_Ni0i-hJ-?VnuVDa*!nkG+|#i
zYKh#9Wr)qrqj)`SgfE|&(rqQG?PO18dTJtVYzi(b+v>urXtN7BrGbD7TehwefIz|j
z3qYr<Y^h?;4D>a9SDh`t5PSUe@6kw@eQr8b74e=M={2VUjmhjHo?Fq;IJJPm>lPv;
z51)Bwjb4T=Tbp(j+mqFJ{a1Z_HZ(ST&FlXzDlb!95&vFRYSM!Bly~@-);Bi%w2Wk+
zj`Kvh_1?~OORK(6^7tLWdH4^OhKQB2%NV7&;qdiytVOUXb6o9j*c0U8QR4nmub}WP
zPe~nP?GBBDHYLs7=Y&P$A;z6Aa(q;7W@e;^`s8N#^wjlvou!6s@VF80HNoyF$q(3l
zPGHh)Ad*aH81FEZx=bPJR-nP*;mRiKTbN+w%SD+2833WMfAP^f05AiCC<$hqvzyrE
S!^m6!%r<V@kok>c=)V94XUhTr

diff --git a/docs/images/pr/chat-image-delivery/remote-after.png b/docs/images/pr/chat-image-delivery/remote-after.png
deleted file mode 100644
index b9d4268f04917a8f5007f42b3b00d5a744a77825..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 60327
zcmY&fWmMGL+a0>Qhwkp~p}V`gL%Jk}?x8!R8>A(b?(P!l21x}(eU*Fff35e!e3@^*
zb<TcvJp06|tIDAv1Cap$0Gfilv?c%mJ@@CQj|lzepP?1mU;qFUpdc-w?U#S?(`9A9
z3!Ntl`ob6SyKTKS+4xo}6iuls6^4cm1?}eNw})y==x#GtqnWh9u}oC}%olPj3s$v^
z-}@oIzubKj_~lOe`w8<Y<acM#uRAq?;9pPAPD5V>qw1}q(pGLBR%^kHEd0$B-&t&f
zG)-t9LyzkWgBwT&k7w=Do6rSkBn%8{&QnjjjPZ!sq;)KcpLL%G<*XGNwB}TK9r5^l
zairw7mNm39ho9RB41V=JytStKeLNB_t~dQiB$`Ad;__33103#hO#1l574pkFbI(dg
zg!Ag`8<2-Tfh6zVGtdwJgdv&Uw)^YgyW<~YOwi>chho4Q(7SLc%@1pwG#x~O_nF5t
z>vt0Yra}8X&*Hz||DH4~WEwOiV>#ai`c>SyE93Sr<|P%NXat7hH{_h3<eR=v?c@2h
z<!I)1_(c9uct+J&j4fdZdnq4}E%{jjj{;RO#`|*iJtsD04d^89-5`8Nv8w!mdy#of
zhPNo*BnAUJczUl2XA7EP0%u?bKQj)=P72|z<eXZJ5y)A5>`0JrfvO?Yt<9G7ovmXB
z(&r;(KiH$)?+%Y|XgnY<LCE{HXVMl`N=&oKze>V}3hM6GR6hTD*F+6^Z$U(;p8yQj
z^UtOVb%$t{J{~l5HDh?r6zYk-|LARMFd1HMCP2n|ev_Mr*g$P1u^P~TZ&?2Y9<iTh
zZ}0OLoNF)~b*Kd=2Q@3;;D-Db+5AN)#~bPp2ZU?|NQz|yTLJRvMUu;D<#?M})B+Cr
z#9(YDCPUodg{XAEU(W{U84E$!YbYjM@ESZJ-a1|P3iA`r+4KXy<u!LZ8|_nVid$5r
z?}71i$zQJsP}JHOGJCX1--c54YeLP5|9*LXV#U^!n2kqA4?9xZMEp4X&W;gVBo*oQ
z{0>A6qsV=(Z$?7BU#dMbCUHDX7vcr&=6HW0Q+Ocy{?FN+_cUiBD1CAhF}$9*YA!uO
z8IzyOemN66m-ykYs{oHvL6Ag*l$&Qa<+fLnFgbK9T~1-3_>#@h1g|nUIFyC24_Fy=
z0G8A0%w=zB(H&7JwKTt|f=w3&cWKluYmwGe9}z;40khfMd6}cwRv{FGicXEfp;QE2
z*g2s|7aXW#f&rd23-U};kg68+1>zrKMXqX7^z;w`Hx4Ks1m`EXk}=W@l!v~vpTKoY
zv}jgxUie)zZ9@92-VKBulJD_T5O0h8#WIsj2YdUzE`qniH?N20^}j<KrH&X4G9U|z
zS*ML6yo@<Nr_rw`4=z0HB%O4P7~8q~v<~eC1yFvDiuT9;Vs3Bn&9sR630q`Cwgl+{
zC9G`XSCfBORDWPWl<S&DxU6%Z&o^%xp9z6Wg!z{zal-X5MUNftd;SwzFvQR*D6$0F
zA9<k{^JCZKiitFY8rRyJjP9!dlkb8Ix;tMIf6P8DcA^i>o#LLts$ZYPjsl(u3|$yK
zFkdPUAard__gm(>CRW0|Shn$F2VPf5?X>tXM(XmxNYQWIw1FbBx26w0&ny1Rx7Mcw
z5IK~-B~*BWQYi!dRNaLDF^LD*<tG-QYKo~6kUIBshUh!D&h+75_|J1FPC6WZ>3FWh
zp(%~>Kp|ZQayBZW)EgiV9qUG^q2o|xkhvsI@@mwgF!R6%Ak=CDLBdtTS2r<qq9<mR
zh7*SqSUhOa<{Q$u31wRc#QJ$v);%0u7dbmek^>QT<U}@0zXdzea;$UUXYt!-iqDmc
z8)fwgSxU6J7#u2Y-%(|Q6MKcF&}?`(5`AZx&;1{U?`jUK7uZRX@UxhC9>ds+4k&-I
zmvEq}s!>v?RB=3qrSH%X<?o`4+e4|$kCPzuLs33fMa4At^s*%QS;T!J7y<}~>08R^
zwCL>bm=&3M=HfzX%Y{9ZW4I>Ul=!s9j>>}U$1tyuVWDD&xZ8jaP87Pa%wTkHgy|PT
zOL`4BNt`1VwtW)wF!yZ;i6#Uh<V1XWju>!NmuR9QFl+XW^jPE?2n#VV&xqUz_mjdD
zzgDUeZEHE!nXP?OpvQ`l8NBP)VP6l-!4laP01z_rfs$eHyJA&wpRh0}sh0M5_Prmu
zpLz&xIO`7LlRpz0)2MQ#aBu=-UXYk95;Ux_UG;;r_ZZe2)?j_t`WKOJOh7_qlw&>S
z_@>i^a-qvi)sRrF0zcaqE&VJNQ~C;3qBJR{Zmv>1K_7ePskK(c<s*%1k<$$Dba(oe
zIk#;-fAr9tjW&WmstR=e&0>U^6p4Qv7L~eNBLR!;0P9y-Z>_{3m9PHGcW1)KI+JOC
zrdc8Dy>^-?&2CKKHFQ2p>Dmd{<QPZI9jov%a67ugpy3Q5h+(l><b5r$ffts1C`UY5
zT%Q6AP&F34qr&%hNsiTKL^@;;&wv+mXDm!1ODU%TOLuPaTRQoF%3&xzgD~0y?YTno
zz&!BtoVs6<Is_ABN`8Y5z}&?WQD;9)VXDw?zTOT|3#C|-C^nAeOT81=J2-iX#sWIR
z`MOaaR(TVd2JG5dyV0){b%P9^EgBjp-kk@p^HIHbgU8Z8qh^vg%fKt=A2|7O{Q2sC
zA9fg`KN(JYa)kREXE|G#CgD-Z88CH_Mqc!ms8ucgPBP}<#I8piW=K6*%`ZhI)JZ~^
zZ&!8;+SYgvSC2Y((v5{ox{9X^7mVev%}4#EKPak9R^oYNd%i&h;W|AxCgR&#B^nLe
z1as!$*5V8COrUIVk@pDHPT%zz9yVqK%a(dLg%T>E$Z}%X^N=(aG(z*mowkzf(T5E6
z=dIAmqkGsL^nTlSXk@2El}$kWx9Q>bV4^wkMJ8MIVX1=$pM1~LSO<8U4*`F1zWoR1
z#ttZ>rL>{eIke-&1NR`9k?Y3JwM|U#lpjPRTOzW0SJuH{4_`4SV<m7LFr@-tfM6E8
zr7kbnmGwmi*Kt0&%Nbo=<0|AF`}tg?ySltJ>M`<LD(g%-;_RdtHct}y31Zk;=RN>H
zSPxTn%q(B_u+AdP%Enndv8S&|W|N74DibG;Y2w6~`UEe21j6o!NN8%kbc)=!qx|W!
zz`YcFP*@2jc7b9M{ZBeCnCI}6-%Dml(`hNF45_)PpNN`-mlgPC<=S$QqryjVQU5>R
z7)^+>w)go4h@8xrbCnq6S_g%b3813v!Kkn`#-!)(jp%$wazzLK7ERe!r*p`Og!4IH
zGNW-f?#iT+VgRJrnlvW6N$>*4xXs(Y!ETO~zeIdMl5#DC(pNSPFU|ez+bBnx&7qAD
zkk?xXWta=O91kvAm@^-9Mt$@W8W==cwe}1@*3|Pr6!>OCPw=>Tv}Zd^p6Dms>_gOB
z@WEeoXzLII5uK1GOT-`?mA7XEtqWN(Hwe^nq`xHY7~$IyqD}ldjR*dn#vzh%^7hpf
z{m!EHG;})#Vsr{<1i$CQNn(Vl4|6$i2Mt}g<Wi~aX@j@&k1};w_FJe?2DSqwIneNJ
z0DA{Kk>riX$Q(Ec%W3*NPKb`5k$YFXwUB^~e3~>```EzvWWhXjMe``lSVc09L)1|l
zMAIqUq+)oOfiso_9_X7jvm<s6Q<o94oLd$HgX3zTBoM%w@$_3=`P3^3D8^$;g>1Hr
z9LBxgR(Ve9K&mow_MB}B?Ms?Q-q-tgs<FTOcdE5ZTfB?iLK8b;bkmuv?dCehypx_;
zm?oL>m%oMu_URiUG8|#?q333;<4Fi3^A;1sLi))S<O<Hw=S0@D_^}0ck}jOcxrOH8
zig#o?zr&3uw_=PhLRsy3h7UGlttq0o!J?bvs!|2bk1XjdHYMt1mNkCr%6I0Kt2Z|;
z4akp{RJi|EEDtvdb)>G9!T8O*)NWxh7sb<PydKwhDLHxsC%^Y)W0<Q=&~Uc4P|r;0
zecfUIA1ax}=U?asbK-(Tz$6^5LROzv)JlDH0H)GStl1z0P8RY>2_ais-MP%3xrA)B
zGHKM+ajUHyNkjEiMp#hLt#g(hQ32xc*HE<*L>Q-d1`-95X*0dXULgdI#GvsxOIQ|0
z*pH(~juKmKhF0>Mg5CfN&MaO(-i5=|?={T!wO=;V!W83P1X*^63kssXltfJk8d%9)
zD%Mq?_o1<6CSrSf&P)BsT~P+O35u^cv}(u4Ji9rPS=%%52eo4ehduP1`9EabP5e>M
zKL>97pe6}FJ$XY7O!c)i#Y&B#=T*!pjJh@mC&XCNY(968y|m%aAhsFveFcNz9Q7s0
z2fSED2`;A$)4$EGD+^U}8<nsJW^)~~F%WB2XG9UAFfy8xufg6U32wDef<L#SsbOw2
z+C#^c94LB<U>zqJ24bf_1Ofcy*nUt`G$ZVR2R`lx&EkIJD<`fw*2IgmhFOuKZ~EOM
z*Xo<*(n2*#CGol70R@MfMiwKzYvu?U)Xs*f+c;ubGKr`GimEDCtGL2z)@|gZL)*Bk
zIbP<UVRrIwyl-BUi(ktkB&uu7K?A5cB=;W5c>vrR<b_He+}lVX($Q1Q2J&?v4mnH#
zN*Kibur_TBn<H<l0`QVen<`8Lo|I=37yTK+O`0Fn{kxeAXa&QR{^)x3cUzM<K~=>s
z4zOxO-DVoXx{|)b63hx}Dkv1Z9azXc+;fUAAS#`n*(vD>lffy(erMKFg5qzIoNjc)
z{BzzjJo0*^d+RCIY(_yB2pWTL@>s~qh;SlSz&j_)YzC^*$2;nJ8I&8ZV4wL<dQFZM
z1+YU)C%6fj7ktyBMqDg)?hIBrzn7eGIL0V~r(DwiQaPD9ZZ2f2DSKP4bF@c>fBzzz
z(}rYJ>puu9)UZmE%GO@sGNWaeqV8KJE&p;fz)!zYh3Uo<*#)E1h$)T`TZ@Z5&{=!P
zbD>K65|L@njNanJphT0<Uj4n9yZ`VvVVMrg)~q;8%BS?Ju}6P9fntqVTXHlg$bn;>
zAGE$;gv6ns<NL-9xl+TiLvZ8GvAXJ_JjlitM)~vL^TO8MR&_?|j8!=mo`P%7_CKdo
zn|Z9*txd*?)9-!{pB9yk6o$h_5{3fJ{DsPQW#r}|-*PZAu%nHE{Q$m#V0kh*uhE|6
zGwM|QH#32ZAa*U>k<@obL_CLvf*vkuxiXzc_b>($%JbBzy0WPm@#1&%OB?dHq?QZT
z+1*(M_yX@2s%wWPnwx^PU7Zzx@dY(g?Na$BUUXWDN$yK@84}E*cn52>%!??=*FE9r
zWneG6I$3x9pLN0tMR<b|i~s_x?oPur)oW}2o)L>M`n1{ZY1uNfz;Az%)b>YU{+$X*
z_#bM^dFsL{Br~;0s_Cc4qf21<oC-Czl$oKh@F7yec~kNf)}wT4l4(&-Wykr_c=OhH
zrdjs9u(%*rDz*<fEb=^{RE{}&3Jim;`WepyDbSk~uD&qYc|nK&vVh9Dk0t;Y8!0yP
zW~*dLRvr#H3Ojp55++o;ii&s*%<;A0^?(feTxmVZghvQPVD^4^Q66k!yIG<s#e{fV
zRq_4Q_B8RSV{ln11?!pA_oayWa`-z})TR2P1GO}(^}k2sJ5!rU|LW2D1|_c}<Wkb9
z!jyi2>#zpe-Aqm%M~4{v?60{Kv$nXIrTQZ3h`gfWnt}A)N;K+h2a<A0`@3@W%yM&X
zM1C3@q13PpIFTMW7_{trSH=ij<Iwq{goHTmAFDD6L&xkPvhlHbu<Rbn7X}i21h>Mx
zMfcz)h(Rp69x=Rsn|7WRYKdcV;<|j}<-oaPH`}+YvT4|k9*g*9Ph;;pjxb{or8sOY
z*DqJ)O%s^3PjW8aHIa$0w7=Wq=-+(*N6Z`&^kJ$;I>)kwMIAe>wO4G6`(|oqKMPUD
zF9c^qaV20zfdVdKlV#|<Lbr;T%Cv`UHXSD`x2(@~Lt`U2V}nIZCQ8NLPo_{{%5x*S
zoQG^_glX8pOT)(507T;vmSMCBcI$r$Qo7f#-}O@4M-bkEHisq9yko+;UygO3(MZFC
z-ZnZO6DBD?*mqtePmlbx%%g%m8J2G8)wk*EKAyrPrA$EU#A~)F6?q;y*h?KerV-jt
z<=W87vo$WIzq$M?HJ$!w=zkJ{oLPc5cg6=t!x-1ipWJSJcY!1&YfRYcaLCd_uoo(8
z9@F>t=vOi+zn1VmU<4`=8pg!8L0bzy`CE3!Ca~ZLOuWC+Mgu|1uDq{+NGy034S2QT
zA=-qUXTX^2kp9@g%?g(YMtw{#?ipxRqca4^+5#?UwD4GCCb{(8v9mluSU)RdLOQ2m
zu`=kTT_dpQkon_JLgS8p<<u5$NiQiBIxL!z8g8clrrNQb+j${VPD<aOWttDH`&oyY
zr#R)(5mc?sRT;*mEWfA^sx@zHk_34DgP`75F6vc0oZs{EQ7f63To@N6xMv|&7{<*h
zd0NEzWU}q5=mFzFCl}G923HHE1M-lp{l=PrRI*saimWim)GB?O@4v<quJG30msk3X
z{O82af+$V_QdkV)6k+{~EiV)|{0ej{JgTir{i{Ajdf#RWC8hLQZJDR~{N2$oVc}nn
z$y|LLO(+_0)JUsS%vk603v@50a`e%|!^3O8_ZA$2AYX_`koIqz$B!)|)Ca<~Lj|Er
zhTOSCR^wC=HfAX%jXreg;tBAyd-9oMCy@5e{e{x%A1M8aJ21oy%}dcrfDG_CMBu1~
zOEfK1rAoOqQiqtwkhSPE?wqZ@l&4?U!ip6^Le^`;j#BEJTxH&vv1wd1)A_Kjgww-A
zN^A%0se@mKmLspyc1oI4vFXy)gnB=q;g1(Tp^?i=)8DerVSXYVkJZgl8SANdE+Qg@
z3)ewLRnT#d@wuQfAtBi7SwR~LZNk&U;COE=pKxJj5>96Pi8-(JJa>5{rIat6I3FD{
zy>~d3I#i{IIb${h7v9mkK&9~`wDd=Vx!6qJYtrFk+9sm^9Jzn0d1Y$ZjHkwdBQVhA
zB%=Y)w?sD&pb3PJ*(RXAFiT=f!8%&l5lcgk)eF~0>|g+Qct|4j_7uCkUvzhsg)M{8
zov}`(r3=F4m6nrhnwvH(V|rwDxvd5qMe(%GBT43{0@{5mLvwTcj5Pv><Mn;XvU<f&
zn||7^jFXgAWu(&yDV6q6%=+40XBaPzJwW<kP@ylE9d>NRWE@AOH<lP92V}5|8KV^u
zt5tLgXhH4~@d_(nUO&O@->{~THDC!fSa*?HnIb;?EmE{4H{~rACgcS=m@b}++<vjV
z5TdWeXgVIEs#KnroiL})W+)+rJBuj$jVKf|Mj)d@V_<5;bPXC@4_qVHKIe3F8-w7T
zKynFw95fu7s_1r?wxUT0*LhIkwJohV1p4Ihz_+PWS|Lr0CH{b&ae<!FB+?{vet%`j
z8@=pqy|X;xz1!t~kfdvFl!Lrf*%bo!&~bP6PA}tiqJ8;aaCYG06J`w-SCOq&xaNra
z4$z5|c$z~u<a9wD@P+mDR@{NXRL%)i!EBkVR(DrQql+VKCWNU*my8}6y=FE~$sNlu
zZH)nEoI#u1;W);dm*bF3F(A4U(k>{qKOg6xLO=1kI*w9gWxNykJ@v&s!H>nW*$~+7
zoq;ZaqW(myH7h*WFRnahTiM>K>F?0D{T*>P$zS*C^fb(aW*a>te56da(?d=!*wul;
z+ez>8V25y$F=O*D7_$C=p;GZr_GdIU$hCp8llLwZTI%Z)SVm~5Q}6yr%8#euTB{n$
zSi|1x5}YAkG@)=}<eg~A9ZB#swBK21?(@+>yI7u0o4ctKW@O&^8*@r}Ib4oq%y-1X
zd|{#SXUFUB6?X5~9I%<ML1>C-MUh(@I}(jEvy%FqRiwKi`f>D8$R>x8&e~Cs7TXjN
z^o<Q^WVcR3E(gdA#G<m+Vd~r@oNMJXu`|lnUh{%l8<Z0=2ty$sCNEL&D=0>@<bf(4
zeW+ptjWO}{8u|V~f^I;@M2ifajA-IjK$&g1#LDK+fL|WW(*X@l$><%n7MsYVQKDF>
z^mV@lxB5r?ench{1wzn(1vdsx61&pBEYp=hWEL62j4@Jg)sV>m9oJGTuq<A?wFbpm
zo+c87-xrZC_%#}%!gtgbA*MO1s5fF+1(}FB`AB|8TTr!rm7xo<P8Lm;$x_f*o*5D~
zO_rYRrAP{<^UAYD0~)yZ2xzNOIhib5<51<vekmznVV}}QpxyB=tabf4sS7`{1V_X|
zqjLcgkww5dB?zOg`r<F&82!sPg{)vQOLei@&KXopZ9av$PSlo(pSccv4TMb2JQ7ty
zN(mNNpgl5m3)^4)J3=kibaC&MOq+s#2->Yd-9XzMTLOA0cfTa_=E{u_;-K6R7(@C-
zG~43oKaZL2Wbr1W?9ubt+E5|Czx*^c<^qH7%`7|I)ojYv<0XYpealWA8@{n7>|pV*
z(_BQHP3yp{Gn-Ii7VBf2pik*UXntV@_vMr2g;H^5l$7_N^D(Rb8T0qcJVR#(FU`{X
zty5wrL>Oj#kF0O%Sz1}#x$MNEPB%L%X^wV(ecTt`_kXO<rKW!?;798%Ix0i&7)*>v
zOs4V)$vEy!D!b|-g}4_~HzptXQ!~Asy`B73OW(v871}1VHAwgl!Na7Wc5Yd-f&#uf
ze4FEGSFeV)As80ORiBJkN9ZXYuwG0p>E}qL1LDUc0m#0Le7r`@6y_33iNDz)<R2_N
zJgH;CQqrvp`G%hGj9`$$-mmpmxlWeHzLx=xu@Uag{<ZlM&S|F@lviHN`w{Mjq7&{r
z4kE%IJBhNWR<f*;Nc2sxQofP0_)AvBbeM+OYL&jPAN8L(RU<g=3KCguG+x0+9pa(?
zeoNY|)|`>!o1kk+@ZD`7K5W}c3xx`4a9$&sd;6UuC36i7h&ow`FunjYqNEW@(B=5l
zjg*t{y{R@wD-%YM#GVWt^K4IwAw10a8aDN#CNrR5a5;#H{I|?1Z!5YZGL5->Ih<T0
z^qG9LI|7R*T7TuVZhzk=j=Yb*HV|NkO!|{4S$Wf%k<g#GB^E$)mLGCCV|p@re&}vx
z_zDy6Sqv|^CoG1RCd=(*lWa1+^5*yHR}Y6Wx=71MLi93tUWH<PKnwZFOTOw-Sf>nr
zjA}_WIa{akp_!hDi@H1(Wt6{x$86}72oQfV7fkqWg%xYHhPze8k}z?2V(tMf7y%At
zDnF7$mTL>N&e^sDP72QoB2{vV*Hetyk7I0c;Lrn#6)I9q)f|YKH>OCXgXo(YMo^t;
z%b8M#I#UHRZK2>0AWk&VtyC!F$^}8~hRQ2mco|zeYu6CZee~|n`vR_fSLiunldlLO
z{$J`DdU89MDKE6whhV@SK9_LphNuZH_M*%>&DM*VFCWuPET|1LKVX<r2CE#k#=gU{
z9dic&Y`&^mTa-o~fxlI?6A7+jp49FQ*jnlsf)BmEC5D84W?%nK@e~fX5*N*QJ=<Xq
zYUGuj7ctDkkwVHdqHe(NOv6h>Qq@kP<m}(Mg|eSYD15u1Sg+0y{>z=)`Ab~asv`9?
z>(CbZwEkuhf_JSfQ<Xm_UdLMBq!y&%{;!`Y_%9i7R%j%0VyAg7jNcyXzx2BovD6}#
zD7&t%GV23$vyl!fD1&nWqXp^6L0Iq~zHw!@SYASbC>-2M5ZqCmab7SVv!WKO8F*??
zJ`AEbuLnv`(#PN(8xu4X;Fg)LV8jWaQsJs&6)6KdgLBI3>>1P^Ni5%95W0!N`?4Z@
zAk$`o(!U=N#ARbrn)3y|Ta|xYag->WnY0q}X$IAD>KjNI>}Ls!jc@a~@KENypRTUT
zREV&;_<@`l+d%mO2$JJcfcRgrHyjqcGU)y*gTB}FZ>Jf{#TKGI3ncx%!Ad3nm86^Y
zpe45|b7g4=y-ZFyVk$5$X0n;aX`B}!^O81rPk?MwFzl@ZyupN8y%Z06$B1Z&q<%`J
z<vJKd7Xql-;gaMXQy=in?OrD({^b1Y8&!AA0r|a@)ZKwD`Wi7zjrGwUXz)3(E1Xo=
zVrU*>Ifi(Rv#YY{TmzOEIc|og&voymu4Z)w0j73ylO%YvS==N$Iqal?quj?*=(cWs
z;a>dw)YGjHP>|cxT#VEw!gR$<fl@!3#5>tT+%D~JZ_@{s%g^69ue}D-#K#%`D75vx
zK)*!3O=~L!4)d`B+33pVJDNcbmN$7|Qi__%+|D#8yA;=Ev}3CRr3bI5!0I}_5@hbh
zRVajZ;qNu*>FJ5EGAOQ-xS$hrT=5WJgUWILRiaP6`JZr1#yssy;R?bfOW1BXiZRCv
z7x|c%8;j1ee7a$;h``%us-D_lFO1gR1<Q}4{YrwcNIWXz2w(`wrC?-oZ3R(;s;xFv
z9P>`1Z}vVeNg9RdR9tq97T;Sv=02NKh3K%UZk-0#x{Bm*0P?{9R#5tXS5WaRP3~)=
z7IScqp$*{16i3>h139g3N28(izL+7ISUh9h5s?RfJVPR<E8WM@EqLbXcbm3^0RA;E
z0wy@Ux_;QpalJZB^gzBed~4RUULL;A06SG^J6D?k+H072BuLH*MMU+{M8Qy7=s5-J
zwyF(>O*7xm=qAM_8r9Jy^}JT141#r@x<jfB<tp6H7;X;>@+edzFQM+Z2JitCH-BlF
zA0x`bj*A`t>A`Zg2~Z2aZ_d@@W4FDJ%TA$_DC*JoSLNXSM>*&TMeWb0zWITA2iXe=
zFqU%>&4JFdOXuHEFutAol9|M|3Wq4Z56$nFn|P&1VQI-IPr+E&OtM!BI8FR73+U%J
zM^>N1_Ub>PN~b=lqPwhXa;aa3xHz?)Q3$=cg=rZdmiZ}=*YsSjD*4vb&gPK<4MCY^
z8yP3wQ^LW9+`|k*Z<<5@y)dU!M_O`5UT($1b#Fa9*gq`94gz<xI#+PGR@bC8Lv<;J
zH~eOLIif7SdQZMxL-d0--s1#ekRw71+RZDp?*6me<rk%mZ^Ax;9$RVa_fS4A9zF>t
z&eMfupwG3!;4msf+;uGuyouFfs@+frwd0q64N0W$+60xar_Y<V+0gF*%t!%spIiH{
z`3T1c^PAjG?yS?kxe2VJrU`T}!m#xoe56bplb*uhOAIumuCVVRIffbnA}utdcw(R@
zw?N(XxQR>S3D(GF_I{n`aMjp_n|e!P{Jqk?jrE#!FPqMuC*gb6cZ+lV!!)1o;U8Q2
zfn9DyCG&pl?*m`cUH*U5-6Z_swB0811K7y7#ch!#Av`&<vb&tgq}qrm$9$&L#Q=b%
zGn-soa%C8#qrKPTF&VCZd1OlPf=%^|%ip%@c_2L}!4a4Hr{EjaYB;DrYPh?)Z7i$^
zIle107p_c!2idBEb|byTUy(ZzhLQ)_*2wrlm9Z=|Ow-%VGn#50#*rQmdq!HOY(RQJ
zo838b`Ra>iY11g_#7N!qdy5z@_N;(X7)n|9l>x_M?u_Oumz!aa&{8T_cz6i#^*Ap7
z^9sh&bojsE*X0aKB{=a5(Ylg8BfbCVj<^c&<7>C}69y#5MlDjIP1=a{d+rk;BOVDL
zJHqFJnmo`tpc`jw{IvM~gz|JaBq=SC8z)pw?u5P6ccg=yt~nG;*-$xPX-C2{GS15)
zV@<f$ftGlgfPTmFsDpF*7I^z+&e|rNL23SvoK+mr^RcUK_!3<RY;FWUEPrscj`R6i
zGH`TiC%JajbNO1G&rG!|SWo}%#D(Za#{qtsE)VR^T2#g2mXo}qf8jL+Et(IJ9D>0{
zRrq0^L93L#W*;}p(iq60(m$kw@`b5X_2PId#-}p~%BKhj*kwTQ$w_pvb%atU9_eX8
zBy`xFF4RcZ76tLkTXYzr!y+iHTSKkd>YKMglv9ROK1f=V%o{51Z-^|A0kk6I?UTDR
zijB^syW+D5b84Hu!wB`WS8T+gDi;nnnTWi#RGN%I%hrH$-#c@PDbj0%2Z$$iP2e8Q
z8Wm)zGhWG-Aps`|S_9KJAP3%()Q_Bx3eZYs-~SS8@9QQS9}=x}@(?1fz@hz1{%Rjg
zKi^ah?PJR^Nm_smzIj9;MWTW}jc6aH%YqUHXkaNLS;H7fJ+asMA}APFqSnFbAENTi
z7bs*mtx$YWzfKU@BuqXLj%&<~Eg%#&FbuuNV1V}(3WJVyJn?Ig0lN!Y*t2`OHK_(;
zbWNcl=;j?K!}0f?Ul|619X;9Am#{SzDbeW*<6cmapW_{~>`0*<A?a1zn-e0+h$oXV
zy)0Jh$L>9uj>_Ldo+*kxG`e~s=iez?c2zU+*)K#SVTTy8Hl6%u8?4IT%zmQa;*JZ)
ziamY<YotPI@>|sn5kwdx5lmQ;$hI>z_FE%T^*KO=?!cRb*eCvX|67$ZC<)3O<3svx
zE>L#g>|PfiMxWJ4vIyn`Ljw%rEH@5mDECM>h;64QO%ML^XoT=BmR-|)4Q?cK*Glk-
z{w2t8gvrGX>^P)??k}vs<cR5M)n^f87;WboMns_9zHdlJk~~Z*fJP=9zG7=4Mxw0U
zBPt+07fP*{#&vPc=QKn2_TdY9ZSd;|;QMz3U=Zx#TMYb^Ht?uaF^=d~ec_;}5E=EZ
zcAL9g6IZH4{u)cuID0ipSe~*Y-4<~g6E}_79gDsikis}`LpWLjKoNe%=d6Vj8EyaB
zd2LFPHnDq=Yc{dZZm|`-XmX*u9(Ir#T^js;uKSyLRt6Dcn^!W!l(>dp9ClQ!R?8=)
z_)JwxnY_tjRuP5=bxs(CtI_HbV-{Y^w@i{1Z;Sn7zlOX*qs!mspLRey00Z5;umv?;
zX!t(grcCrYbj<f9hFjrLK3Sf=ruo2Ott&PIQ?CpPzk>GRI*gNE(2L-_j<w?D1U6Jp
z=_p(T+5BvI5UoOrm5vSC0fVb6<jZ}E2{9sPDeW4cI9}Hcl{z&-0^6eK^ds^@QayL-
z=88F5#Ih%D>kGRgQbf%@0)65=Fyw>E&KzU2aH(Qb91}<G%PIzP_)w#Cq6?o72YYHK
zE}A4J{M*PMuOT!4?7tzi5kM<J*)w!;O*`Qc<rk0bN%=dqtDTY_Xw>0)g#4oz`mBrv
zXe=v<8k#jX9lKbHmX8N&;lz9bt0;hSK4wXpJPLvpy9^4g6ZA@YXhx&3Q^_TcmjO8(
zE;)CQJ0FXBUGgLOF=vtE<q{}3ONmTAHR0%O*4N;uuy2wZ2L$N=s@?d?l-X0C1Ekvb
zFpBh5)_qJ$?8`CFVx~eAwM0Fe{W#D_&7QTlBn2tXg_|D2Z#cEwxV3oGwU6?0V}A&e
zZ0+{^U1@&(Q`AVxFfG5eN2>LbbkF8!^TzETJJFm@q?Cf%mN<f<@m^e+d+VfnT&fxs
zdfy+~*b~^iE6it=T3m2X=r>>|0+k1_yHb|qz^23|4W4`Xp6_oB{E$cGyWa&<=5Eba
zb}B__DF`1=0mO}>LcMchitXIrjF5f~!s~aFBJqBYDDD;Lcj!h4)kpnl+rk5GMOuvB
zgIch?1nayR(UAd_VN_jSMFu)~HeJ2{QuIvq@Cb9g^2NgOGgNf$voqHRT0@;oXdLy*
zioCtCwc9B=gW!g_S6u&%pS4~KX|8=S<7@Xt`<oJ-)^qp9bXh#f_=_S_*<T;(xIxaM
zQ!p2(=|kfvTZA0wLtOqcFwC%U#!wwxJ4h4o@M9~TeSUcgEg4%lIB(sF8V;}0qgY!L
zJ{!2?%}|K;%OTdoo<#9Pc|yaEe`#O$buX&Ahv*~p?aedmy-CuYfi=c(z*@et{}>v8
zZ6Fnk<Ci6`T%eJ>q`ioa64dU5?QauOSuriKSQH*A9Lsm!7Q|v*MXmvV(EOwOVx7cc
z3%o&>@LRL=bzKwrX9|xmuw}?8Ndn|^W(|nhhAN2rw4pNxD~PtfRedvU9`9=#qZedN
zmnxE0Jt;DgaB4;2vT$VGY=p}^^H*mkv>-XAM(CrVqlw0PDh<Orqwh&lR%k`-?4vQ~
z@HNKF4;|;s;B{lEubt8!-=n{{1W{0#&xI?4$p&h-g7Yi9*G{y=De)Gt*0P*uCT&A{
zIklN3H;d>HFJ@#85};39sL*c=A(;|Z#e3uZNLbTQ?4b0>{4VyI@4S@BxqXvuMfh^3
zT^Cmyhp!zW_CHro?Qch@>!iAnLlXX?2?Sppak^aS?l{OdxvN%$5KfSg!ly%>n#<DL
znqI;ZrnSLm0bg#hnlldWL^;ruS)f~x!tuL;;EI<lr?)b(r|OV4B2hq711&=_!F8UU
zzp0w>GnUr)2WY2Rhf@M*k6O{@z|L}o&cY;fBztQ-m~g5&z0*wn1Iabayr9DPs07$W
z?K=IVQQ?@n>AnCaaJ{^5Dm}I?&dMS**b1hetJ<KBq;Jm7Y^2~)u=n>~-m7dm{G%cp
z{w{5XRa#3>r+NGue$y>dT;AD5`KW}p-+7tZdyF?k%pn)jQ!I9n93(?~6-!kEJScAa
zYxK9^#-n_H6d+qLBY_f%&?1~KV^Z3+;vHEP7iBzx5cqqymSVw9%4PcdySl>aJ5v-}
zE!D%i<x>J-NLxPT1#Ow3Xy}Zh6kLAfTibJj&f>ngW7Col(b{Y3R{0pqu;ozdE*|5u
z72-b&9x(MW+#*xa`)2OEtjst~EAM#dw|*KhuUD)5&(&)B+YiW0)c<k1ua()f=ZzXM
z3EfR`+Dwsmqc{;=f-1J8;j}VFWSz}h&W&pz)QIi3kKlYfq6!MIF<vp%ZoM>gQ6bXg
zv^TyTuqn>`?kmM*P+hY(484tgq3BIm+m_A248Q3emh~oB+UPCxd!}U>1I3HGoRXRm
zF>4$)e!g`=z9Toox9*hlZ%vEl`T-^tH(QlU*%VCeu13G}`T;T=GR|u4&QtqboE7l(
zw(@)+{(^8m&+ydOx%~Z4NPDb^kSJz^$$1E%r8Yd8{D{H|dPuP2C=nyH!EZny7si8)
z!Fn88!{8bCpzQuaRL6U66)Ja&T52M&XRb5Ip96(d+TZR*AHI)=n3X8=OJ)eVq_XkO
za0m`Lbmj&5eaKmQvAg<!G<KiyXL=tJ8&6W>_T)C|#c~TAH6J@i>m_cYgS!NS(t=4U
zP<zFrGvtM^Twxu*b=3~!Tb*M-ZAG?NQl~G9t(=BEyn(tlB(YQOP3JtN=|PBZ_)!9Z
z`a1<Hjqm17-26YG^S?<_sf_{FX!hZ!Rw`qqmBH95KMo)VW40Q?*0_^ic`=}g@{1eh
zg{SY=Y@a%%spHMouRN#?NW`(sp7oL>5m0HN8Ljb0ZoaJ2+QjoGjMB3ZK@HZC_k%D~
zejIw~g()Y++y-M|87Z-7t@3lo=q;n%l*V+2868c1Z?S7M)+~xmK520mo6oO<aKZ}Q
zA{UO=D45g}R`$)qOB{hPS*+xl0ro<Lsa7Lx#oG3$#6$Jz?FIVK0`#LiPPsz;iYU8B
z^P7MnJDIp+rQwyo-}P_H;SXAD;2hKl6@CVKL1jCv((nM^1%hL3h8_nJVSQ3XcW)^;
z>;PhubT{&l;w||Il8YM51?VP|HB+Sr>!Nc0!WfE}yReP^HBQ6f&)Tk2F5CFAiD#T8
zOHyk@57c9C*5Es=dp78B@r~xJbzL;YHF}V%{w!QBmw4n*jPE_TnAE#-^F(f5Y`yu1
zUY0^b+o17CvmPNl*u{{stSg@OQ8IvoX6{3O`1sdiJ*hw)=d2iVWt*KCPU-Sj%pd>3
ze4`iYXbUakM+Fmr8W*z=e|+Y-p!5cbh837aI%0l3#}4+p2b*uDpYqrNN<25o@CZvp
z)Dmb$HrX5Z7jYU*sR*Ay>?UEJ7p%LMhU2|GxikH5xh>QiR!g2Shp54yU|_?vv)a_t
zP*-P&ZacJ*sEtwR$L24<`}DM5LY{xN)cX5167AixiXFXdL_|%q#&X(jo1Pe=2fUJ$
zyu}#(4-g)Smc{7Hd_K2h5_!WDouL&+L45Ub&o3*JxROB%ht;50F*fmUTcc7*+PML|
z<G)bl^_&VJ!pwx9^=4A}z-C|8`5aLUT_efshN&rUjWa>|t`^mVs7r{G(S8n&S!1O9
zg*7JjD(|VEmfepQlg@|*VxMzKgoMt6IINbKsdc=aJ)F?*+Vmi`cZhmQR{BMZ!r&$5
zzbpXxOeQ{T#K~*;0MVzo3-oNB^U{5By{t6A&-!uHfbg^i%Kl^YCv8I+s_Vj?Z?wMb
z?F0y;@J|hINtcLU5Ll5lj2x>krCtgDzs@EZD<zIKCa*F>>L=9{IPP^%oI%S?Zz$)P
zDcL+X{pMH$)4Lb6O@nMweJ6swk~dmip(kQG&S2Mrb+PtxLDYGFNn3G?2x+vDFD23R
ztlr+|a_~69$X#60WM&$+mz@;LQYI}xapNWQjvU)9<lItxLLca?Gmpsq;%)WGWh{P^
zq!b{<*b<R_7`eK0iHEDEREBga?jpzSsCVS4^kXULr0s=6??lb?$2sAlsQPQI<ikJZ
zAC%FSNVOU#W|h4%`?z@$mSmuxGB>mn=FDS)9xMqaDIt})yYo*58j73vwDx}8=^)xw
zx(z2!_*OPaL5lbTKxbw+F`Bd%NH3dPo%2NE5<0KS1>Nri(rU6eKUFqXp|vdS#ZZ=e
zp{@*Oggwurey48TXX$+2eh1weOwAU`6^-XacdgdOn=AwRVI<&XF1w!yJEM-Qn3YBJ
zBLwOeEw|nLvt%MNw5#qw4w(E~s0B~YA0NCRH5Q4KXyQ2A`CIoji2dsqI~OEMlQNMR
ztsaRlYSYI3$JVZI-yIWFWM6c)uzVuky7QF<Lp?|yn<bP2dbtKm79I=qZm?z-G37EP
zj%2f8SqIKpByX5(c7-69?*MxzR6V0>t=!i1HrOMm3RYYWEbKJNcnEtEp3W61MHkIH
zS~3FrfXT>088mgpO!Cn}GLW{^fe04Is-ksjmFPF5!M)FHXtJ=anu2@zKJDaq^>BD;
z!pU}kZ9r*dZ!S`9RkoAib-ts^HDrG#jOF$!900HU@QU?^zgYjv@8uVxh}-CO$)&8F
z*hsLeN#mSorrL<b1ISu^F^Cf&xX`L1bhRKiMzMD;6szodjIzL34<gqOr2}Ih5UF_1
z<C2m|BlT06cr4PKKSuuAk-OgxQxy6(=Eh2C49g<gIiPj5*7j}OE4Mb<ayvzWtD5l#
z*&6oeD*QR-ZfDxA=O(%Iwcd%t%yM<{&Z5xotTADVkM`CZl+G{3@t?-0isU<bB<4Cl
zq79+B-S;UAI+oNdy_JfmtKvXtA)p9}Tm^=|rg)zJTO;F@Ov@$8ZYjGCnLh+3<fzQU
z6=lwTWq~PoH-gqu=I0bxL;?@@{puM*#-^&G$<Ie$LNcGA7m<*}OrL#<u|hJj<r(vV
zhxslwgbB#1x6Dd~0<tbSi)~&mN$BgzG5Zw9B{8Rm0tL;zQu#ZZF{?De^-a>uaXgJ?
zA8v)KiK3|*)0AxW5W>;NM*1dGVg;39^NqY?xwIDbeR93XgqW3$G9=BOCw^ZK{-oF8
zZpE=D1y1No*T>b-%niA+nBd;QeUu7+y>J<?(wOs4lc`cXv#fs%g*0#&-%&Xi_*6xw
zH}R>B5x2fXddhoY>L+t-jWS?}e&d=W%@Ls5w=`kcNrcv!Tr2cJCCOgcHfj$!T&<pC
zA|pN+k0<4KY&Moegq>lS{iXqNoqclRE@H@Vmn6Sn<CD#q9^8$D#etaNo>H4sWKFft
zNz8nAgD9KDIYI@Kuvb}>2itq=8KlW&qASZasxL)rBvNOMqOK*sYfyl$9vvsr>KJL!
zT6RC?eNxrpUk~QLih>yy$EURJ@h|6r-Tb8n9V@e=KDO^sk^|=YSmkH<Mi#h@DfI<_
z%5fycZhW_C5uYO1`C#F+xs%01RZW`T^^gU7Q)?)tqBLEyMcHJ^I<~LNaLbHG__^^Y
zVG!j-Ol8=s?P6YxK8l1$Ny*1Qwlky|mfT~0ueA?A|1h{U8(gXEh;&r8B~8X~p$U+9
zkTvb?Wcw=XOu`@L)G#Z*FA}BKMa{qAmiz|7=0mP=dxk7;J&XP><o_j+v-q4zffwd7
za11B?HrFCz8y1@A!EnF>MpGUvn`q820FD5u59ig80WK4aL59Ky|2=}OwlQ@ud~9OH
z=dO#7(GN!X8h+Ta!W_S_AEiRvnU=u@o%tU~`9{mw5}_-dSS;+V5105P>xf;}krJdn
zSF!=>6J5aVbI6h_W)6ANwI(85kR}W!Iq@-Wgv`90*ul_C!4DM^I)o`fM05p~n)yBq
z*vTsTTTZ%l7TN9sr>{)-UrE_6{!K-y8cq8~<`c)0Dc2xs4R8m0$c8u%Wt_}-mU~CB
zXI5Tv?5p`tn;s*}SPW>LWpit}NybUzc%>*LdJ{wjRMcH^^9|T>37i1gd6+Y<ZPYPi
z8Vq5hw8=V0ht+L&S9C(S5?Tjh)s@k-VYpcLqZh>m!7LA>-=3Hv%q>k+Fev~blme{b
z1!Y)_F2|a3W(M|JXkJ#Srt{30kM(z=+;3DH0EiB>p932zt~KC;E(#pg`6zh@IS>$<
zl|JmrN^SbT!lLbUAx6scY(H+da_YYA*OQ;?chz`AJ|*9O7K+J9V19e~ZuS7tqg*=N
zo0n>KD%%<SL;i{DfR0+}x?sm$f&wPp|Jh8=|E&zqEeKk$I4^f_%vRJ$5K9^1aM!pv
z+e8xcOW9F&Sw<h(nknn|Ws<gGZNfYLBDhjn_U=slQwBP1x7=b+eb(KaHq5PR<M}!6
z7-i4u7?Gz+Wv@agD2l#DqL#&-WSQB7;v^;8oZM+gDdd~=o$W7@##?78n{GLzd9D$%
zo-v;Wl{kB-m^9$;M_XMWuL~oi*M-r>z>Tv((LFU3{Z$#MNB@wy&!9CjIu)-1N5Y5#
zfeeVOFi_dasXXF*{8$%6t!1;o2r#k^6W@PBEg>Y@=|6)JGf#LP_9*YcP-3gifYcej
zwAe^`M8k!(u{a{!7m(^wqZ+<<ZK(|Pu?;sA!&aDz13}-qD*HjMn+05%2{E)uTte#f
z9Wf4vF-^b=TGB#ZuQd@rKu(s}vN@nj2I}t>)#rSmQId!kcz$F&t!WqKKbR$>vs7Z5
z^g@>k^|meB8_B>?pI+0*sN;?K%pt?P@dfYK>n`~prQ90%XWe4DiFrjc0FfbRlsO1X
z9IqR8H=q?r5N2BlRYc5_Nv$x)CxNMsPH0~s&2^;!nlmXVb~?UuyNU?9FcPKq<xkGQ
zaeIgO!M8a=A*<V)pg6_0*b*tCvN#Y1rB0<Q(HLLR$)rd3r{H)E0U~X@Rk`a#cyjQW
zLMn}?bCt_uHzASAgS$nJ%z-h)2j7BtLt{<TkSGviCimGsH<$j6WYq@6JAR@xjFl^I
zPXguwsSij7O~H;pf4h@1hA;tnz2YW6VVkZ0e`fZv({%V#b<=r7e0cganc5Vg5lOCn
zVoDxf`laK%;0jgG_W48>KWP&$CjwR74gn9Kpgq;8m87I$Oq!I6*l!vewis$=)<*g+
z;Z}6Q+5Cg#10hONxd#5Iftw|sK9mP2{nYVQ<~MAOCekTG5CGanwFe1O+B|dtoQ;fS
z-L^puC{>vtz(|AB9|<s}CH4a|HeE5)HbPTIFM)w<t<j4MZu!|IZXwh+cN}A9ivLnm
z3Eif5)tpO8Dxquje-_}is|mNFh6Cbip|sxTgHnC}#N&z_K4lF{2RSZA;?OPYoliiT
z^~k;`^JkR0@vpy^9P6H0*sb`CZetS$%Z;~L+WoN)>SxL6a$Bc$JJd0GI2K2C+I^8|
zcp}yeo&*oYx~=&5w(KzB(P4PcTuiGEsv#PC3xN<(na(?1K57pKF0p&93DiM}7f8^T
z5+QUG$tv3Jl>!7OKFYe&dzu{0Y=JX%V~Q9F^qE$;$VvZIPJx!=j6d&Y7XFvPF6}cF
zYUZOyTbxh%eU-+Kcz<jq9HE`!{@??BJByVa2Gj2@>B{P}YH+vpp~QUg@p=_OlDBW1
zaDaTk&z5H3Dc+<0y-p;S5L~+k!`J-<EukbB2QX+N`MJ?6tY1FfO%Swwy`Xvmb(1Tk
zlCX;S+0>Bo@e7rg!%$(w@P5UGTiC$cC0;7k{Ld1R>wSk`-lIu!R-O1`>3+)+!gmz#
zPS<)cm`<vq+;ZXx`<XGnF@|dr_wjFZ`M&VaYm5xYu3tOsmkpUB5rrt@)z*TA(oRj#
zZ}{=PI}$@JIcF#;RoJmfAr~68)5etsUHxP=?#3NQa0a+U`PdKuX6GUgSAz@XH~Bi#
z$C<*z&1S((G+W?k(H2SU9&3c(^}J0@`L^e*u*retRNvB+sQga*F<^hk<$TIubgD1A
zYV6yD6c!zDDLy!|zex>%UM;e_@95x~s*}0X#o;x%=2^ndaw@>$g&sIQ_6bj3-h`tP
zk!5LTjgZ_?T4VT2KNd;(M=TVgSIhrz>GDs{3>!XG1vga|dKULBg(nQbK+A-)aI2b8
zbGlbGRes^F&kLoz0b+SXceP{z-vXxdi{B8zZ38orP!_Qfnj7Ds$7m5jHVck<_KF%c
zuX07k4%M6Hy16_YyeM1tVid3eq9`@9bR7{faAY{H4lB>hMw{wBLyLc|Rao(N*#K}P
zA=dK^H|I{fFYI&o)NOfdRZ8pSw4n^<*n|4cv8J86h*w#+<FGDHIazQ6nK73<+F*6E
zFW@MUu%xp49k)z|2M4C^SO%itfTsAh*((uwzY>uPIG|m-nV5iZOn`}|HKNWK`WROK
zg}bA9#`;IP&C((zuyy$;Rm4qZM@npZhsfAo4Sn2B1cwzt5QB6rV#ayNFe{0)oePL+
zL*tyBVjE9HXG_71v~faNw;_Oj6c;*1%BTsY04LBEn_Q27nG>U#Ttb&-)Rusm#aBko
z1sq@RxM1ExF)=cq{z9^bDlY9mhqaDVN6KTkS)ku_k1(}m?^L6F<(t7uJZyf0&{<8@
zFJ7U;biRbDIcWM}m9u&4VZa>U?7Igq>*c)ujs@0m&^nU+&Z~Cw`nO&>k6q&Kw?&tB
zm&}~*6i|^tM5n<)T51O*p?vCNsGACNu;rtrsH<WT*$n*&Y~fny-NQjbvy?xe4?{Cl
z@wX_UlOPGi61Nbpr68ToKvWkA%aPVy;M?Otu%M5M;9j*Kw}~<GdpaRHtMHD7T}Nt-
ztigofb;bG;b8vSSF010hg?i$vEiqWkjaQ;EvDh{lvs;>MM^I(g)=ni1<w6xK`B%m1
z=NdBjE^L|b*9nbTry?FEF)2+6cYbxX|F@0x&+8g{_ciHI{in47Z<AoBuqYVd)CC7G
z&>?}SK3_NIaUsNrht11yA=<$2jaLK=*PRg8`~y*xDN1TSMM-uCHGr|tNZuq;&L2(C
zd_cubt%^~5;#-u0nsyw+l?PEb&~DE$m7U5=-{859lIFiGK<}rzZa)yET4KpoevBvb
zs{{8DU4gc0e*$#lJ9gzrbPr~Je&M7x3?LHJr>|qOb_G1|T7u4D-VBgIrJvO;!LD>z
zH%_TgeP2R+K8-yyPk$ZL|9iP@EPY0zmL3iR2*+m}LRaAGkv*DopCb)S*3jxV8=C4Q
zZI5sme51NaU&P%4)ir;dm!-yxQz6V+B9YeYhcUL}xJ5zczTV5UevLMSLX<fE02b8U
z8P<t6h4+J?XB!SsZT*lX=OiM@*$z8V=5mRSQ<7LJdc&04NlBm3(P&Dpf>zDV<BlJX
zr%DBZtbd?ZK1VW<BCjCJsoOVTM>M-g`FuhY$HBn{(GT_FLPM--SrgFlY~QLc5{chL
zp?rPoIPt%kolJB+uDAoFPz0rK^_*UBQfY^TPGAmWt?CPWm`a}{>b3|J?a%SnKTzdU
z#xY@0g#XzWHJ&VZ-`2A|<27SU{ze;~vjZ6Fb6ZwkB8Ef`bBb;KunfRVkqb=$#22+v
z@^6Zi85b#yWrSXu_ou}WJvLLinn*G?nx*5Oa|pb@bCV_Lx@?E9d)#rS?)yeHfvWOJ
zOw+IOl+-GkZMxb9Wy-jk&qi<G{CPhsXPF8dac6K5EKIOu%j9GTrCj)r5&iG+c_Hi8
zn+Zg5hqy8VZrXQaLD0#tZ*|{{@D3kS`3h#QS$Pn#&<AcfN%Y~WVp5@PMMO=F;laAq
zDMEF`KF${uctZ{8<pmc(kJuABw|t&L%!y(C;yJJ*S#Y}MIIxr|fvyOD)UI;!r-*x?
zD7hLkVnJyv^)-Sq7;PWM$LIg3dJDd&x9|O%7`nS*29WOV?vieh?rsothDK`W?naPq
z(4j$6I;D{=K@kCO<ec-pfB%Otulek~*Sgkqy%!vTrGc7{Be9DYWXr}2ncB!~6q)*H
zjMHulSTYc)E7ylA|K%kj`w(o8s(fE{eURrKtj#pb^dRV&?S==Fux8Z44nZ!C9n?~_
zWn1{4TbNOmGd84MErmH_imtdqir%Y<^`iQ!`g5s@0IGvZB(M4$ghD*Dklp{5h49k0
zIZz`#Q8k@TAmfOW)4Q)<&W=8ce56>~fHGQI#CBAhuzlz)7FNC^Y%odsgF~MJNlg(N
z{5}cKO*ScZbE>YM-DA?QC<?aYdwX1`Jp*h^nFvlEhFT?#9K=?lIQ85zj4;AraNb0V
z@}l8^km-WMAmOge5LhK|K(B^{2}^-p)wE)J5DHb+;UqfMNUn^C9|XTYI<?b;zKWAZ
zCTm_)d~WT8>x}dNrtUnJnH(vYLNm)@uI>Fv`NBUt*_>Xm*w}c`tEg#PL{xXsS}+mk
zMcO4%*y`0_f*A}!iwLsH`q91tODGf*6{BL2^=sM_)3un5qDc|aev7z1(2n{TFeo4P
zDtJW6g~4~L25?Z8UmTpP)KZL*=7?ABf9;H$904gEcGyBaVNHLnRJxt(l!Rf1_n_!%
z?L6#F@I$nP^krM<+e&mPHcf%6axV9Idd=8*;y?!ZDD!5cUcdMBmAEI9X@thS#m|L9
z?%x=vUzM2g=h<90V`0H~jGvZV*gcCFLoDF#gi#6%PZ4)21)Y4GAs@-ZmxJ2yLy>4=
z8NWo7nNKRiz|I!3F(fb)GJy`+3JM4m*{#XSyaU@K67$fh!F5>V<LRU!HwOk5Zv3vV
ziX#dfS?&RdYu^EhIj=({W=Rhj9+NKamCRENe+}(K9D<xGv$>9%td&`wBt=`=AIi$A
zs#iY@%%z9HnIIc1)D=CRk83v@$!<6VhyF?;-9YgU?Zv@;zS%DSojWx}6qf0^h7)cj
zCH>Aca*5u`Zmj<vBAJO&r9o7AbSe04<}H_$49GG94P>+hvw}ZclCv0JgS)(HAAYcy
zz8a@0b(mS#UjoVk)Ne{!l<iw`<f4z?xoec<<PqC472icS3ZnvJ>Zeu~82jci38zKE
zn!n=23lpNEo1fW2rDVFs>ec+J!0l)w<!365Q7}d9#xtb($Q++9@3v?v9dQsO)#}D)
z+QsL5e*5XfGP%6nO(-+<dCokx{gX5Ki`A%E!Q;l(z(*y(xgzFG;zbma<BG%r*6W{T
z9a_>`d$MJfU@cQ>%oa1Fjgf82H?f6G%2<Be6*dGN>#%M<_)6(S?8V2K_%nXS!z1g;
zFyNr!X-{?4z^Fbt>{6^Vb-NgEJ<z2$N7Uj7;N5@~Jg8%f?|OU?I4>G|O5{4nFZ|Lr
zmNxmwy$3oHUq$2X(z;1izi-~@LLPtb+eLk3Yz>7d1(Vinp*(gr35#v=6p7;7G|n=o
zFf&*Gzsars7c{<gw)O$#@soOj3IVQ<MZxmFnl-|c@=~Lw{Dbn+D3eIcm*6F*pyH%+
z=(l-FmD57KFKNFKCaOIaea8|a|M-h835oj{Mn0bgPJ`vGlS#pFtwpBEgTKTym2bov
zdQrG}nc;sWM-|i({icXnqXi#|ns`wK>J!rXG|EatKUx2>VlwNuLPu+pRCmY;y7I~R
zK%D1Bsnp^k=q*Hf$8o?6ar;yB{uA|tn>XZoS^<3TTYV+5v-^L<!7v3H4#}aZSEC@(
zd18fGrY+3Gqm_APL5~EkFWfG=6W?f5&-8W4nMkEIqUlMu`})+`YeGjy@mstFg`t+p
z*#SpzSw`?bK(p_`!7V5tZ?yn57I|d59NFxr@$agX4O#l^XjZ(3h|wpq>3n{n6us?T
zvT@zQNW;KVZUlXp@O1qt0H@}f_YW2-JrdOj;vqwP#u&;s-6lbd*t`-j27}D!fzcb>
zD8<|g6RLiZ+*qJjfI&H1Xbltf$;hW3pYIw$;h-1#QFOkD3yeZ%ssAT8?E2I$+yg@&
z6!vK|e(~eZaztMT+j;v+{6dLq4VG|~=JEQ*CB6fIH=g=|s|wB|^9aR&AS>wassY7v
zJt*ZV2xz8JO`Vst#Rjr(xjS+;VIAofY25Rn9du`qB47YP!p}LaNxk2dSoVPL6g6&M
zid=kHpAo6etzJFmd<#$Jcxh#-#uPzmc0!+K1c1p7b1}zf<>II?%z4FW!`ngAK_~=<
zJK(C<7XCHUKZxGb=A=!Fisr6+HLRk3s53S3?O%{=nRQ5*-h3#HU5{htQcd*O@EKsW
z3x4%nz5RDfyMRU!;{X;*gFDd>F>a$VHf?DzLh97ok&%h@Y|82Is1d_>CicBh?Wp;Q
zjhhO{xVKbQLsa-cg$cn;(;8OX*<}l-I8aztm7f1vaGUu@d8!$|AT!FN^(se6S6-x-
z144G4rLn>*Z&j{cmH}|4h($vVU1TQ1izpG&q2@8SwLFCOyh3Gjv?<A&^J!D7rDEqL
zC?+CDL~nkl*tW4G*Bi{`<$<)I&xH)U@q+2@BeXChn2Gfy@a-h}bg!<Xrmu^@jM(JB
z;qzDd*LZ656yDnMVuK^hcb$PVVRisX^-hdEnGj2Dl&!-IQ2BYa#Yf7~--ilqM_4q4
zPDfPUasiZz7|15-?1l1@e0UbEk1~v$31B$!im0CmE_yh2vctGM>9xwjj!BDNS}5cW
zLR~u@8=Wa$JL{6naUR1+ArrjO11MxPN=fYrHdkOkpK|W-mW`z@F+4H@>6(-((P2YZ
zikYGOLxKpIqIZeLH`-B{VYb@i<n(})9sM<hwcF|>rimct*Av_SD(mML)Bz1LbhmBI
z^T<BX8|Qp#u^Ca+$Wi;LL*D~0Tpjy@uf&j58)e)oZC6m{zDZ8*0*8bN-)&*B*O^VQ
z16Z$#Av7PJSgbC$QZucWidPcnlMYvBUS+A6BIPIV@jcarQG-*{#6lphux{w}h~lYJ
z$9!QFc%j8Kr4wplAjK*PZe)z8<g^fMKhJcd=wg>2D!{IV@uyf)Z2L~uoJ{Xd=KpS_
zalkk_k0VEACCUu%+{SuVM?d~A)y)8RX6}e0-LYR|k301!pmBu92bY$_IE{sY>%nLS
zEbJvXM$a5p5pIE>;{Ad+hT7irQ;Rl+I({Zg3|LP=Z*>=K8S8*;JfLhfY>X_p#M#KC
z*ljpXoWo#NoItayg9r^5$l4*?O-3i4ZyG1VO_PH01HxYiYzVpuADhs%)pWrfS;Ur4
zC%9<rs#YhrjlORgoE_2X{}AqCSz~qYqvIQX^ciPi?32dVQTVSBSSc+X2YfAQNt6G_
zMe|;lnj<L=Jl<=&zPHUk*c^t6DbWd1WhTyre1f@TOLpX2F46M7`-)$e=Zu2;Sj)I3
zP&R^yR-?r9@IC82Dakoo1}kN?6o4s?=nN^xFM4ZK_T%(h^!Bage5KsD?{Yt(_e?Ch
z8<$zC2=#K3{i{V;(Qm?SuIA950%q%=`E*&nhHcFsmU4s&zE)QB6-<I>Vb^&%K8WtP
zFkQiL!30L6`?;*e91H?JO2m%bO2Y5N7YbaU9|Nuyc<r3^kpynN)#B^xAAjd#Wnv1H
zo*n*|x78_Qr+k^AT)-qnJTR<&ujsr_E2t01M%6j6<d0P!)Q6D>rVpeY8<%QxJQ7u7
zKpRfS2~<Gv-uMJ~P8qM?bcWU9y?MujV9*U7GF3g;n%hVJ$R-?^gjs)5j`%0xLBO#+
zy(7n%A&Hs-;)Qquyh_w6q+F{TyQaw7kbP}-S8fcSO@2FG+X24lElc?&*p;pdQ2P<G
zdpvZpuc@6E2W2L07YSR$q8e54K16WY8#QKBcGZ#_bI$k)@85PMEh2~*<tO96X;`sL
zsZ;rk-1whKs2zxvxDAIU4fsg;F<>`&oF2hq*0rW!u^)T?3XwuGn#*sE+6dKk*iqAR
zj!X?^N+m_nXunL?JHC}g)sgDf8zmGya}IuC91WGzBQ&>gqxXc{K}ub2hhbycs;g5A
zkR2-o5Jm4r&<82O$4}%VjOG#7+E{$VIf>+0$y_hx8Ij9q^5gbbIP4&z!RY^*sTsSZ
z6er8uU;^kU`6VssnOI4jhn7@`G-||7;G9ytbIqT<R^(F&zo-o1uteLL=24DEQlKK|
z^UWOI4>e(Y{uo34ORV@5m1Ir#`FaEWVgTMbp%X0`1klM4>j*NxC#MMLyCn_xm~w))
z1-5z@(`SE?IM<U#<W@JEmL`{3Wl1SZ7>VNxzg|IjVP3&B9bu(f)P<pV`be!8akPDa
z%K@ONiiNEJJO_hXfNXxbg<2K{Qi?v($qs43lD;7$9HVXy0$k!gH)p6uzf|ZAk{gy%
z<x1?^D#_65DVbm*L{f%6Y7;$e@!ib?@6lJ$?}Cha*{e}VC!>2t^)%6P)V5}P{$D*b
z;)LFkZ*oUEfxwD79CAZg$0xr=7P^L8(37uY@i~{%7xETnlpm0OJ>#fj%dUV?dr9dK
z(GyldWyz*{{GS#u0FBdiWjyS+PvR8{YobwPL{h~I<r<rlhl%L%eb0u}D6jQ`aB-mZ
z%<*9NB<7gRN+VI|A_8hLZ`f^kuco1J@Xnk^Y0;e;tYE*)37>1$LQ>F{ATXck4^9Mp
z*@2d^t|EMg{3V;43PN_yBz#4OR4xg5XR3P@?D@s{Zx;83N5JjM6J;5U<-JcmyQ>lW
z9R<A|Ne3whc+C_6hz+*i(V;C^o8Vjij3>&v3=vARm7>9BDUYj+6u>+8C%|{s6<X0`
z8GxEilj#qg)z^o&jc>}yvVSlq2Wh=AUXBlAkyj=JA@l)r#;3f`VEj9udq(zfww*Zy
zkTdgl$4I$Bpco-3yvNJl*Wr`NNn<DO{BoTOe2vQ*gNHe1@fl|$eUW}&u4jx7>MuF!
zX{TMSPeN664Xyqy2L7SGBofQL$Fj7w84%vGkS?P+|IQbV-dU{HQ9jL4EZ<9xGzK3@
zX9kqEm)^}q350ipC;?MBc9$c2y0nGIWXN++@Jc8<pk}A?UwU8pyY(S_WW7<XQJL}#
zHM7~I2uLO|VC@DZ8?5_;8*mIm%_PaR2~l5zihe^}2jnj-Hgvu38fN#yC)zwHAwO?P
zKmT+o`!3@@mdi)|`Q^!KLV>yw3J)nT@>=_=Iq!^gHK;V7!Th)7`eNR5BCYGm#L4??
z;_MK(NdD2W8UJGwdP#=EVvs~O(e;b|<<y9$tj%k;H@?~w{dWOpVj!IFpDm%U--t@b
z!l75E=wV;U{3+8606hGHJ9Fp(m2`ZT`<N}1#4JoVOZt)qNyjBSi^*{7LlFNG>g9sV
zuW8!O&b31&zta^ka=0U}7jA_X3+?IG$+$FU*K$xigv`-Ro4Y|_GqADWxE(HdNdJ&r
zug~QSTZP4pDZAEqjM-ie>rH%D+LtBijVdI5No@j<f&UO<vP8CXumwJi;ksexGfAi}
z&tT!o;%_!+3}EW;YEUc^><;ir*_o3~$8GwkPT*w1POKJIQCA_{K$^IZ8{FBBg*v;r
zfS=OLh&zxD>mO-bQ}HG%Xc(MhAk#@jZBKSEja=)dc19#HV`$N+&b~Rnpmj3L&j>&U
zSh?frwrOORHo#g@Pv-W_t8fCCfAZPW@EBuv3Ba-GNXLoUGB<(5<lN;r445S)ABtl{
zkvaDTDE;{OcjFVFdepVy3EZ@Gq#`8<;NKm3OS?UwFoRP1=7vU1_Q?Zd=Yt{3;g>|%
zNq;7`R|4yw8|<e``<edMe2>t`@P!Oa$0PL97|hW`8(((uf>)E0VGE`|xgtD6bgIsm
z+0Hcz@as067PML+41iz5oA^|`)<2q5uGS0kQjYeT<LM|bAmq)FMr?~><r25iV<_x%
zE*K@f%7I%0v;^8P5i~hdhHhOAyam$7j&Nr~;-JSkeaHC4y!nY;K_YYN+H>254CcRP
zZ#T&C`O<qlK4^F}8ed~pQFPBa$^6C@9j=1p$OGgD9tvf_!c4mZ_Wr$}coPypSYg~K
zk>#6TQF03L8nb!-RTKXObVOjxBAx)GUHD)#ibsw2<Z2}_{N8PVwy;A<60+?Q1@$KC
z*?H}Gc#<4gF4(*P>9_lBKUwsr863logpgVrZ!bp3PcVFLbukxp_srOj_oq}fKzE~x
z<#+1QbNLpT)FtB=Na;6ofTdS_u6=yN#9Lk`!4t>GO*9&G?mxy&<-|+H(#qFA%9{<w
zrA!u+EITaTNtE1`fFzx4Qt&kf#kF@hh$_Xfnp1Q>K@Eo{bK)Dg0}<n@UvSzUuf3y_
zA+kV)x*;4@{Qb9{SbhI~i>f0>=ob?e#yCB*3yusJEH0%vRS{|<H>4<78CmzkrkKzv
zclPX!c~R@nN6L1>2)U#Cm~iB9iAt%Z-!+Lq_l-i(*zk9y5u_xgt;N20*8`lGX|tr{
zk(!k=R|qUIthcz4-yD7O4*eLiCeNf4(J0l|AzIni7$;brrA9thoWm7xgdzyd?)q6A
zy#6QBT%W?H$!;5H!X~9*Qm1%K`kB~)e)ETho28?xQLA<N&rj(8LZ1$xII#8HtR7Q+
z{-;+K9>ny1yYV1k$y*}@D+7fm&IEb!87`q@3j%C_m_UzIK*53I^>@^AI&^CX39-K2
ztQeuCSeZBe_*|t-^vyOUxdJ9L#NIQ#a}=0FyO}n*<SzS|Qtykbbig4F)zB4e%H0UW
zqQ|BH)5o{x7s@Ue(;Z0-5%5j!kwl$ydIDK5@w2NIM98?5s*eTgUHcSLWdmBt5osGE
z*G&ZjAKalg=&pDs6+z1(*2YS4GRTxO)f@kh>$6F|J}Q&H=Ycbk-4V?t5vB3s%L_`(
z!C^GPQH2^XE5_nEW28t;QEw@N^ntF289jLddd4>nv|m%ePD}*1Oj35sIZdvh29Er&
zuSa+_{d1x}U1gAYz7XJi<?je@tUT-V5Q;zbXx2%=T}c+8!-hG;L{yQ5Y*(JwmP(b+
zjAOC-*aDNQgqE9uZ;4{D<pRGl25r7$1yp9=mR;}@700ZUoZVpfA*MJ{&<|;czz)`k
zt>0}1R;hgm0gD#u$~-HE|K++9)3^2PK2ykf2}~TFezpBDJ|}`WqW%E|Uuh14W0IQ8
zFsnDlw`(V1C}ZA_#m=^VR4RCAPsQNPTD4eBeM|=b)ezsIINMwLQ>;+!!Urk_sZG>H
zV?9`GB(J{2oZ)=a`mgdn?CO?6HXTwBm!|n1mfYEO4Wg))8+ms}!X@cj-C<;_o>$y3
zC_+D6Y#kPZ=4U9tU*vMDA)gJN$)yEIaN+@cNsCOxH7V5N(nm<F%5Ia@aqr#o#)1+5
zzPSbv#zx8tD4r(u1OF?L{L_qn>5J0v+YNpc|1)7vBPX4pZb<Ik#5kr%a?1xV79eFN
zU{k~`4e~_TcZOq`xs?~6B~Z{B#?FG9Vp^g%8EaIq`o?FT_3`A!KNN^S?SPA{DEk`q
zt41<e2Qg1homkY;C2jp9o-tgv`l{ZPa%;HXgjTeiL|0695gyk^#Hf(TelN_;{IwoJ
ziSN?KJ*`;sMn#rZbV4IBXF8;;Sjl)E&G{*jjGf=0o?<C@UIl(E=(BPbsZXV3N=cZ(
z%d5w<V36SHID|S&QUx9PEaKTjP4X0O8U9PUFeimi$aKF`3A3T?-+Urlths=0H5Wh<
zvDb0L)=UbSK7)>_NGfr*fB2T<z6$~Qr3dY#Md}d~jG(%%c36OLVPoL2T5&zOX5~?Y
zL5#LGzU;}AcOv=;)fq7T<Uy$W5Mzq=XIW|yg@S7hp+}>obppe8^la~P3v}#k9e3ND
zdT&AaklQT@bNfFU-3o=$9UG1U8IHp9C=}roDItBWYuz12eKy#TVwWl%L#{IiPseE;
zH(;wZJ$niKg(!v9w5Yc3ZVP4T^B?x#oPnC%W13uiS&m~#aRSOzb<$Ssc^hs|rZ6rX
z0Rr*06%}KfxVtUJAVo2~E2XUh<<_;*b!S>@`3wrUWUEMZb(6lzmrUkDSBg%*;v%3i
zGW3$KJ)v_bjsR%-1!#D%-B0RM3Zo3y73Xr*%mz=0#b|sb@?ux*07b@Ul(%LM=Dg48
z2Ccx;C%h)na&X_xEIsEFqU(iyd^@Djc)ncS@Jn<U48dU$*<QjKsEQ6&#3~%b)*cIb
z?!EuX68=pRN9%?j8`2NO@2kjO$r#2k7OdaEC;9G~Xe=>Zh{mLo;o;IiH&7_7j|@>G
zTuRs=rqePlxLT{0+9s6tC3I5exa~|B)s-6MY4krBE42sLj)>*Fg9~ehfS64(+vSNe
zCdTn-DZ51@l0>u$WbZS@iGld!X4Xhzav2UA3w=^spvs*0=O(k$-Pq!U{45;VnU$Z(
zedOr>kg7Q*)n{<0C$9CR0-pNVG7jd!*}qrX|BwhfFZ@4p5b%UsFyu5HM<I#LhGX|F
z4y@mNuM6o)d#H3;wmV=(2;xR^mjW8a7zJP4Cc!90c;zg3oL<GA;oIbTC|y(S_0cGW
zI)Ih*R5TesX%oGFr33+v36xANOwC3G)DnTz${=<RGNf-4K&G%bsW>6rX|nN=>kLZr
z%<{zwq;H5{0w(q1EZnDA$M+0}%&!(Q`JL$eTgca%%{E09%0=I4*LtqKmg#n*T0pTX
zz-H#+6bJG`__qDvpQqTa&n`nwN}P;=HY$RtVSF%^d1B_`VH_Z*uiUHG7^xRY5+8_e
z*;9#uHQ&IjesNiD8(92??n5J}BghSgYC4BZp9qv!C#Vr@48g8*1s+kAqG>Y8?C|^v
z64|gm^Ff+sBRf>Y_krayLsFw_eH3QYZ7s*&=rC*1JQSW3TB!y_*QCQu`ifD_Lo9Qn
z={;g6m?u=YL$eedVMPf*3pi0%xQ5=oLup1|)d+sac0t{3*gmO`Q_c{kAdAY+@W@r+
zOzrjOLgw&kc<|S~()1z&fDq5fOoQ3<%j|Mz%l0llr5;eAwhw}1!)DcSGf#8=h4M2o
z(*{T+sBrF2%#-K*CHEe=3#c3S007)&rYxvuzq9=o`ODuamdQSIh43*!rWg(zzd2qx
zxha2xk7@QQ8(MAyC;jGN(<+=!)phXZ^}Q$DRt0YxVibMh{erJyH<+mptwqQtw?Yxd
zN{r3m!`416D^Ji?WHv&@-S+lt(vPDy-q~=06^nUGlQB&UJL>l<2HW4#CzMxW$|4Hq
z{2X>Eb9<>6O0AyH%F&ZfW%`TesiYZA71cnNnFg@bRrq4|a4Pitel3mGmJJwz!06LH
zM?^bgj4{(4vA8X)ymgU@;FId677q6+dO+Qg$mKBcDSQMPnNj#A1G5(<kUX&BhK?jl
z%#GOh(BWV-zwm2XQqF!65i!ZbK%nbJ=H@=e67o^v5H3dP6*rWmHCvqFCG5!FJyI72
zrCXHkVhV4!t|l4_3ZCin5+nFNnj|c*2Tl_{oq`WIvsNU8({eCNvLEW!p&ZB)C(?{!
zE_3e#UMO<myUrd|i*^!(yZ+-4{i}oOKRMnUl*2eYh9;Uta0R{q@H{@+=$2}QdzECQ
zT-UHANQVwJ3zxDrzmJ5jUXY3!u1no!CndFisp(imHQeoM4NvS57u3r0VJ2XnK~>9X
zL3_-FI0l*lA=*3?iM0>`m0o?5Gzw<=-&x~A>>og<R#N6V6DW0kBz1XQ$<tn#%W@v7
zHHbdR?0r88Z|F`3(+HHQVQ*r>Viv6zNt)Xe*P)-eLDmxI_K(U~xGg)CD~X;tHl03d
z?XW*wnaAninCD3G-^9`AU-n?eE-q|ft8JY&0QpB4GN*E6OO@KL{?t#WI;;P*fSc{}
zARwAZ!^Fq(mu^HN!{Tkye_FBT0$WKEY0X$&@v6hKa>JSve_NWQep#uMxVq+Rj%53M
zAdG|G#Z%i5<W&CFOnv546o?c!sxlF78m{S5loTI%=r3D{7e8C+&S=>mV8fz79?I{f
zA518Lz-SVgpJ{|?k`g|XM#!SYzf=NFG;S&WZL}!IN{U>`EY)Zrf-9PBWm)PT+x&t*
z_xU{iMF~8Iz>oq&Vq8}34iaj+9er!Q%`1YEh}e=N2{X5WwXH!mc_)L)$*8=g<`>yI
zD45^~%wn{?{`bD!EK1+@rBNKK`FU7r*-X9_!5XgpMDHTxe_i0>B-PNX)9c^~f(g&O
z|J2cg-@rYvM8;x5op?@^NG-HwvAxA_31xAO(nzh~?j08ezQ|gZ#muB>Fe9|zjC;yL
zwkVk}agoFBc}l&eLu?@WZN+YO(-t37dGhuS7|v18p3Aij;r}QC>7mv&KY1k@8XU<B
z)OvPbTCGUo_rteetvD;+I@|^WYb_6{#%DhiKth5)!wUi3mZpH2enFox)RSooQQ)+S
zGFkL;a9_H|f$if=>L1myq@8nv<bsFN;Nbh^_;+2tcRJKwMnz`TL`)zT^uI9()nzsL
zj!SY=+*;%|TKTCmzkz~mCff1_W7B$$GEW;_HMB8pJNz!2wt|?vxW=*Ee4M632Jt(s
zqGRR~-5g5I;W7$oAKu$xSN3`cszTNO(|>m2Dwdlc*!N*7sV?<?%}xBxW6dyIZ3-V|
zr@LKqZZn>wwa2<E>JO#`$spK>ENUVAnXx=7X0H-ZaFc}SMTEDEd-E+Z!LpJSDU732
z!%$y_slcTRS#9-^&K6WqU~a!xvn<DbLoA&DFtP_0D{GNL+;m^iXRxYxZdO42tWgrs
zZUts!RUgteY-ST^4-8*`TIKCr?}mFKp=XF33c%0`FUSl}Y2-K?+SZb#9OS3mtWiUp
zji11l1<GpJ8^f^e-A`zzbPi}rUk?$HkDtq#zx*zPCw^B+#Dc+C1*MxaF5>RX>y+Xo
z@h{kD-lt@_=gsDQv9W5(9bAcrAxa|g*VtpH4sZ52VQUspauBGU4-0crk#-%`k`#|A
z?~J#t0!|yV22(eaW}-EnORR#V4(WlmrvxwKwacGm2){*tWPbozFrvPzFW)T9tf9ox
zhTNSaA9a|lj4Kj<>J!<n6Q3g2N{(B%KPC)q2cEpgGtqy_Qow-5k&%)Arg`8c<5ocu
z@i7qwnwWW;LwsJ8GR8hlX*mn;$2qNPjw6Jfp>4cz3J8_z=G8NL{T~Ps`;(X7z+v^S
z@lgYc>mRY4@-5<#njW3_2*HgPBAhv993jx|jwH;$OAJ6WZQZ2T*9UJ?a4YaYZN#Ge
zr}~h-X&lMkHGH7(_(uDpDP<myKFae&eaw#V#EM2^W+7U&NE3A&ngT8CJ;HC3B1Yx$
zH5Aw3`Yq}ucNCLU-|XEw%sJ9GZo_Cj@-N?vQ1#4$vYN4keYUSsRbdT2v^xaI#osdF
zMBY(TSHI}uR<8NUJl)=%;;S=9z$yEq)5XQ4>CExD2NL}Y?0Rxd1TRm~-eze_F0zKW
zlq+x%b1&VpH*N!XN%^cPoPU|layY}um)MF#k5(do!VKZ%)^oyc=6zV<<5%>=``yFK
zDGFZU3DI`T?O`fo-Ar_Ok!tQBw3L(`TP@6n7s}2^hCz^Hwz&VpP@1#H5|?cC6)4a+
zi)>yIp|Y3BltSc|yIZ5Ht$LDD|J|<)YG3TdDtAmq1f4JDMoml9KE%PPJGMRxP4D&D
z1!Z_E;8TY!BKYtyv1+bmpJl}V@FG(g&HMyt%E}z+vNptUR>>5%7g{8-h-V%T2m!2i
z=^C#Lz&#_#g{}`&`b?G=b#{-4RLrJQl$qn}n3by}<hY5N*a2uRumNA+qRECds|W{s
zvv)e^bGfU6^@C+_GUdN_4ZW3!^Z+J-?_?QPw4^w1EM!FNV;4C;aph|Vo=n>CLFT3F
zEf+q65UPmM)HI?rEaFP5aAg^dyFQqA&K_PTF0Cc|C+k5Kka=AScpXQ-2Gu;@208!c
zjGO2BUs2G(JXA_(H%=IP89nh5Z{_rDmeV~$TrbD%Q<xMJl0?Omf`O9LBYLl;*;YuU
zDUrT$Stg&<o9pWo-C2%Ktg~-k-lQZOGb0!osK!!Ozp#*{QtJb=9OY_)9OBhi7hL^J
z@<X5o*?sXoi+Ba@a!)%~4jGMdBW^xfr=N|zv8CH}QfN>z-cvmHzNFW-Zmf{E&&p>;
zKf(Ip#ce%p#jEhxbZW|!WSJ~a;@Lqr6_)ZF+4`r2<iAS^{zW7m^0X_%$9HNaUa8zU
z%h`)%X{ecZ$&h$niMiq;jazt5ep?C0-n!=PH<D<cAP}hXLM{x`C*~dBykO?SO70Y6
zd`~6!hs(whUmD~ywvD;rr?hkO&>;h6_}zpz%~0|f=Bp)G%ZFMb#f^c9r--M#5UqnN
zfCIHHFLU%_M)7>TTlNuQXPLNy7?TLD(nOsctl(+l^Gf}j<a=n$8}80Gr%e&7TTTqp
z^CUG#Zq}()qEhB>-Ns2dKIH6&$dkzEpy!9hytgKJc)riPp7TfsPi`DkS-5RL?Gp9!
zO=?De&UpP-pgcSkQ^(E%Z3nO*SX0>`vy))NVw}FFn1L&4tsoS7v}QsvZjCB+puM;7
zb$ACSUeh*61ZEi~P|ti@&&VGcFn{OSkX0rAVSsOW3b)LwI^R@?jJzkJ2lIxviHgzQ
zww2oXcT5LsI7|ONwn}KYUcB?G_tWt}&YvfH^tkT^k}zg>vE$a_9}lsKnL;~Iitm@-
zchjX9m1&zrNA6Q`k;D)U`Y^Q6W4+X;$jP(cASvgyNltC~S5$lAD*Ro5F;Fg%5al}B
z=%hjSh{pnx!OW504-=^;&BwXlWH9Kkb2sBrAI;xd*fS^C)RykkI^K`Tl9Q{ONJiyf
zs^&%K&SkRg#6MoJxZcYas6@c$OkNu~L23fBLcV+xD-1W>N!fSX?wX!#pa$g#prBqg
z{2Y+-c(WuO!02N>(Awc$MB}`Eo$$uZ^hj*un?7*|(CTm;?YD;`8r|FBC<sNQYOWSy
zcNk2AL3{cWe61Kt2Xnf)44Su!Mf`s0sc{n>A)Eyx@VR9Bi;He};txc{&Q6hGzNt`5
zf!d>u!+%t;N$tS@);=cDoxToXhO)DxB1aCb<UXZtq#hf!=}mb$jNyqjn6eDvhiCM;
z!;E_kk$-e?^hIq7mY{Ef=(GrUMxm->9iaDgMag^p@)8}tkc`9QnezPBLO-=6+Bw`<
zkT+(vfel^A8!y)Morv-6ITf;-%(~Nq7#-&L_fzTPOC$S52BVFG8gd+Sj-7-KrH5aB
zs-)T3bZQ6cSU|cbDHmHVlJ3~6SX8L59CWO;Nc#3o=VqR}h3%(q;ja#Fk3nq}z^zEe
zq2A4ELCOv;rxQzJco$p?<diuw^0?1mLmb;<n0GfHc0fc*+T5XR0Ey(4!}Eg)5k^&D
zp2$iGm<vkT^eJ@^Tk;r+!dQE^W-o31foUY<-Wr+H!Y3MY9uJf|OX-x4K-4qFg~-Gq
z(`B+=L^Q5#DF}bfiQ$4|jJ}{mB&Sc5&D-Jy*q1NnUaZ;BYD4OSkA*+m>H5&Rm?t}o
z<nTq@E;Z%s+m~lkQ~{B)L|T`I*ayJ3L;GfpS<g1T4blIR{%Of@CkP`G>;-7*RPHcZ
z!?`-d<hhdnTr$<+u(sPoQy%dYEtN~7K;3usSK|ni{M?KT+ZNN+(z$k9najq9VI-FV
zK8t1^yQ@a$4CN(;t%b|EyH3ZEQeFr=Ow(I6?x~7o2f{5Wa%Phgw5C1p%ziJ#fqqMp
z(HpXwZG4C%W|h-F3?0r=rK#W|smAEU%^nainGh9K7K}Gu+-@hi+lhchtd41%4XQa)
z`j|Zb7eoI#3@TLn2xtcB<(2nIr}(o7m%A4x$VwX0fq1>iz3W(N0oh1+gQmI2-JuLx
ztRnIQShSt5wJ_;Gx%Yg%y18@EvK(++gV_hYkZqHan&$E{4?ddr#+J6oTk$-32uFSz
zjFNB_eltuQSS~z8dZ}S#Z#CbC`DKsr%oStIPg_;11}2C%DNe&!UGe*rYo(<s8XYg>
zhR@bm*h_xl&P{oat{R^Rc%0uW@%J(}p7~t$`5v~;o8UXo!81zyTzF0*$39K1y#G$E
zIKmn6+X0K{yoe7MuL8*%8ooZjXJZGbF-f;)$1QXD8}IQTxR3^~Ulp$;DR5yZjpLRo
z^sWF^UZ{M4zUGi6yo<f0htsG{#o#WknnCYV__Yafh|^?s@glajHK>SW>OXCbD#12O
zNZM}Q)Ro@#TQ=tK$ox$*dz<V(ADyMPZ6__-iT9~Wwrb18-J&6C)LsE$H~QrPTvY4G
zG~~!-{g!Bqi$zk~LHU4oZfT^yzE1B)L1$_fTB%1~cJ<$DjPogD@y|6TRKUS`SMNuN
z%E6_&_N%A6I%xWP#}oji144&O*~J<9n&~C5qu|mJIa8>S2BNjwi`b+k2Bg?G+$F$_
z$`EQ`N+x1w!W`<TN{%qHv+@PMYPMd@S_d?rg$|zVXf7Ww3Y#|9Uobje>_+OMC5h2l
zU!><>;c8K!&k_X35;hh_bc`D`*Us9}+G;dU7<;fO5?J2!9)zy3VEEhCTllay(d&JW
zU$J5bpaPVFK5SufYaeveY?=ku+SiXN8Q><U<@s=ACg}u45R<o^j@K+Te`tFApPsA#
zWG?!WT$q*Q<hM&)`am!=0$*Z_kE^h9nmP$IkXjy~xB@kW!MK$RlDNp@^84E+Nbh4S
zT_RW*RL=+-8vvcFDS@};+I;am2X3KipQVoUg#4nWWuym4_Kka9h2e@4L?qFonfTf1
z=tnx<G>nv)d}tm3T8X`x^12;EKE7dsp`Os&=-8-<OmxJ-<qZg|FGGspq>@#pN>P|{
zRG!T2lN*#I-}DsBC``+w(g0~-1uQ#Ap)uFYr%iBE+n#Kt$H3JU9cId>=bO6rzvh~F
zlO*g4%}t+J39lg7rH8gQPJbi#kyMZ|)(zBjkmi~4?mqB9Gg>yX5d(lW%knxCVH%!W
z?nkp|Kbo1LZ1V14^#YC$ob?8ZuWxZ{_>blQ#!DVf7KX`eeg*?C4h|@SCe*_9sPGSX
zZaH?7dcQRD<HQ&XYDQf6fRIo|mViH3z8N~5QqQQ}qJ=?Zl$!oT_L9qobj*@38+(L>
zZK7jnP)9+)%3*@Xt;>n%hhU`5{^kN5aiNqKBcw0$p5?>84pCy7PkH}o0ndPc6Uwm%
zL|_bI92d&#Uy^3vQdNi6v{OP%h|A39DXPXGE9}x6{}K9{3s%c+C+{mk&2&}OhI<al
z_g3F0q=}fAnzus#r0DAr)EZAPY!{4H-fN3wH7Cu>QDNVW9!J|E>|dWF^Y8#5IGFlQ
zfHNoS05fjIn<j)~E^3D2!xkP|wIc-s&5~rc>Sc_ps@za?X6K2u)P`d(>)+VoV{Mu+
z9w#lsB6YJZ%9oC=+;8rdOa7|}{=wbM4JkEupvMpJ*LakGvoF6PF(gxDD@K;8Ygb+%
z)DeVWRiRbnJJ-EKm0+-8rx2{48HrK~77PAf*lUv@M0eV0(@CNCg}kmWu!eNvOB*zT
z6n5J7!(?cI8Krk_vq<l#k6IR`@>gWY9K6^VwdQwr9giyYpi7iy^;(LWh0iNzUbKMM
zs_$H8M1WUU<0Rs{NS#}~yXcgt4&1g?EB^PPu;$tfvcl)%|Lm0hi|A4FO1rtInl!n>
zI}7SbApQfihZDoHyWM$vJE-LC0Mj7g>4=WTeyha_rsgvH99P>C?Nj}7D6ohfCR7r*
zNHjahnirS~ukM1Z={YM0V+JcZ<7Jp+Y}O8WDa8rducEpfwTT82x6|Ae7o~FMNs&?d
zGIyh%q7Ftsz-=LZc8tQ-_U+s^dtD`qI4#0{W4qT=ClGmB+fEi<C~67XK8&I=9uux_
zSt|UPgq7o~RB`aiNgdPZxqbQDg0b{ue4e!>h;@yfVDt<OOHuBimRETDA}AF7&dPGz
z^tco<@^+@Wa3Zxk(oajOC-x5}0jtU^Gmwxz4inwf%ZsGOmk3_%tu$`KpYWv7FVW~;
z{T7`r6QthnlFSO@7lX0`@`6;vrYME+;HOQButb~XkoW2cHV+uKyoIm6z<~J05x4g8
z^JAH3Wh31ydh_xghKok;l$J`++2N^TriDA<N1~}rj7VGGZ$AhQ;5Ry}KrEEL=Q@((
zx3naY1`2dJFvNoU@5OMC*Zykii~nJUOI{p6hEjT{2iEF?EDGS4nc-zL?C{V<y$RfQ
zAcCJdL?7z)quTS1=s#M#W@!-r@Paf{_T=71Mhx#$QXtOZ3BO!X6aQUuv#l?3ub+>b
zeLq8zNH2Crft&i&KD(M}h?RMXtT)@aXSr8jf)1%l$AkJM0y!7XO^C{<QR*yt^g)`0
zhzWzMzF0CH3YYxJ77I>QOF!VMVVN^hOb&Et(B{)-BHWFkv_&+0r{Dq_Qc3Pekx|u2
z->3arl9Up>{(LZ=5M)nctz*XLrWXQK{j+x_`g@JSv+rW^aKP+C_JMFXc_!K~uS##!
zu;C_K*OD(ljJy+5M)kZ5XCv*`6fO*qRWPsfceh-cLN|`YYixJ>M#dK*xx9jI9{ebe
zu5SdBB`PYu*5ejT-i_G4%Ti!g<z^!0RBugMiZD+o^OpX204x@W{=PkAXS!LykCeAX
z7jw08?!4)rU_y_xt7$J}a<DyacghrJ7-I>Zqy!eGC_F$s!z200&r=?XhINIm2wl1v
zi*#vF4?o6lVwd`Tm2$fN_htESC8jy{gj%TsAM=9An*hkSH<vFr+`bx?ekXg)%EpP(
zG5ScUu+e%zsLJ;+hSk!-i1<M;d2;DKRO#5^E9NODe2{hl!0}DyE9sWv&3I%>J56E&
z9z!*=AO5W3Tl(BV;VNv0D3=%@FIp<)6k>Y)w?#y#zMhS0yY1tbd^_0RX2i~lH;#;w
zMwsfnnPBnPFKg6)n+*vol~X{H6$U5p^tbj~J6ET>OMBg}_zP9F{HrP}wrQR#vj5mH
z!>STJ0guPbh`Zq)gGl5-$gZC!vOi5V>qp^2fmmJ49j_$5%mMVg^LaH0?M%`m1nAbg
zsehMr=<_j~><_LkIXwZLQU~<mj+=A6eDjDZq*)EHT{h~~5%}dSW%U%ZoNDi9&%DIK
zuD6`SiNG&1-uK7~n?{tnl}3^G3$2nEmj$kg&h2}*`8-gO8C&QnX}ViH(4!!(X^<<?
zaW!v+KQ=v(4F*(u%oqts5Fz^?XUqLVto8igeoIDKASf5%WAJt~>j+%)?0HuG;BjA?
zg&`0*ZY9wBcFj40Mit)1g_kF5kf|oMUl%I;&YjTCHlp936Q2(E23v~l6K@B$5Ox>H
znGG4dBu~h0YN80~o>AeeL!=~gaku?Z7S!KfrohZ)cTG*E8_k12?`;I%C}$mvt9d^2
z#8x`n6O3YzvHexhe{jZ|P}Cc+|3rcA`*YAEL0I`1{wO*z+@5n(2)RwD!8WS*$Ycfh
zg+@GoMXvwjbvQce$<TOTveyHI92Rj950Jj{Hir>{g<if|SY%EfuGj!<$O(v@&~l72
znw}6u4Z|J{2|mt;wS$#9(C93K<h2L)UNRJcfbivo_~qO$b$Si%3d~ghY)Me-1Bi+q
zhF&0i_GMb5x!&EuJmR9mYmP75Q$ykP3$^2FWj7lKcq6vLBRfV3l0eqXk4gJ33Ceqq
zZD4*8t**J8_P?jvHi}v)MjInrXRtNnGc74_xF>OU=0a>$@h?ztW{c`0oBzHjPsXQz
zd4r<?zi%WB>Pg@|;?`{X;Gs5ZXU)o!jedP1Js&j)8jZvksCl{(HuW3S3~>Rdr17>3
zxg1kLD)b+w_1_H)N)glcQ})-zS)YczSjR<x?zREkQ<!tHL(Za!h;3!QB?nJYG3Sy|
z&#Tb~UOQ#R-j@nMa)Jg4X=lF=@FO2zj|^g<<Iu02OWWVl+)4L2H6rsGY1c}OyGj*O
zJNrUt#!v;!7>{{tENk$VZTOVSY;)Rz8m2$))lbTvTK?uXA3^sZFuPxgnEIdh@vr*d
z^a2-ZZf7DE-b@vlFDFCD6l1OvHzlk-(ow|_mxYFLm`DXcAQf$jBeNYxirKV}gr=<$
zdBAHQ0dU_R!{8gt^P|rvMbJII!)2@xm_-}E|ImA_*tn(-7OS$pfNBiQLx}vV2B%po
z&PZX}Uei?^q$GE&D1aGCHcaZZ*5tKV(Hzm=Z4!^Pv^lP#d_=H2cb5&H?Gqmt1)^<-
zSsTo$Hw{rwt8>^7KbYynDrZQqYs&rzv1sFl{sc)4V<9<~ean4U_FSwyJ^atbN;7UG
z$```&&7!t9Z7M1QOS~0%$pRYkjajERKUJ+}QN+H-P08?=gkH)l@}O*Q<9b)%n3m!f
znKZv8X*JNLK3ym_#Ap}_pUQ4&C|;U(olmOGc9OSZN=DhklW{WIgr6>M<Qq!%&_+>u
zU-XNv=UbJ9*Fby6oNkWXJI4>LPDHI!Y6Rj6Ccp3uS`lIN!=991!nLID%3T-5YnscB
zsmHY`<F;4Ry$;l{6C-hbt;H)A!JU|Ab1Mw5B{qYer?z=d#c=P;Up5TFKH;)5=OH1T
za`!A1U>8je;)`<0MNXH;DEg&v^NFpEkHJlyr1YKupA`ZA5Dh*Oi)G9GX0|O}0qq(d
z-SG~2GyDq+rG=Z}H0Ru;_JH;DJ-`~i#1(4a6)YHY!~Nn#-Za4W?)NF2V6U;mFROg@
z96v%S5+yINm=j#Y!tqxRoT-)*_%THA2Ok>T(%7YvET^#Z*EXbZwFpYmeHA`|qQ+aL
z>nAj)^K3y6-?Ys9?{=ReVt>~U@BE7(nvKZR?UoX?K+&ubXq{B#GppT4Fd(H+CU67@
zAfV=L52>mX+AJt;mrS1n)t3lp9SJe>$&eLNqZ;%V!F@@oHhMC8tNGTPh59DbBOwWv
z@@tVPLiO*E^@xevAnzjquERA7^rP{|p!Md&VF}hxMn)rOfABmF3oK`%mX}mzi!9w5
zX`9|U#IyFo<&5M+!|Mx<Ubnu9H|>mBp9#z`?XjCWma;p=WW5?L$#U&|enVFN3#~R2
z?j&&=)m@<tdti4(Cv;3q^ywnx4(t*rHHItdPO+e6M=Z2QMJqtl<8cWH&*)FoJg6v(
zSB2z<KNp@_1nl!b7W+QAped1YXI!YRg-Q!JD-%aL^zsCmkfr`4b%em>gla>Es3Y7l
z1)89TA9WYsW!o20J?#j{R{#dDhHlLv%l9WM2k)fs9=bCMQtusc#1Czkv|H1<r8=4P
zMnb@HUwIoXnFYV<eT9ld|2EAS6hKzXu7Ca!|357OP6Q=sq$L4IsdE_&YQyo&DOzpL
zOO{E%^run7bLp#VmPf2ieMv5GqBnh>B~%vAfxe?8vsls5BCX#8#t%erv_i%ht?7@$
zlwFNtZFNicQ+~m-^x{LuSTIVAV}c&kdNrm)g9ock<6v^4+Yy4Zoz-ZsI9Tc!OsD1k
zFm%f6h4{fp>PX)rw{@2<k&X!7!`HY$G8H9HYOSD}#WTgRI}C@4?MpcppEIPG$aX?j
zXDHZyKZd2A)O}ZhwDEh6)g$*uI@F&zub<s>|34w7w?r~+Ls02s-)^5ePv#QrM8R-r
zN;YNc8o^+UF{@_M)_}kKvZ}qNo(D0-Raa-EAQTOwoEIh``$vHYhm_U_Iw}nJFb(P;
zoPm2~zO-|w&L~BehNw^9I1fSnW7^$*jp<*C&Y#q!&(Z#QsmFIK^B@ngEcEevv9ViP
z4BiCvfm}@G!yVV`WU05t^ee*jd*>)TaERX9WmuUPIL(Qh4naLLcn(XPsV96Fk6XS}
z*__OO6LoB?j3Vsac+U@{czE&$=Xm2cc4p5f=KSfzls>^zwh%sXklcwXtBI%)xXY))
znw9VvTNPyvDADAB0nWceM~V7T-Rb?03ygB;;pr$*DI)p$##6<>oqI{ccC#^DhT2h6
zfiBp%@|*syOlQp>8EjzXr!89pp;e<kpL2{aqmmvxm@(obZCtyF;52!)X{BhyudB8Y
z(4u(=AWcHq!^;F-j!UhJ?%v0W_;aOw#OTHSA%=g{*E(c^zepnTPl<-oWMm89BQvDj
zPfbuO8HiVL1tbJ`)vuz9Mnlgnj<6|+wu})DqYj^a!{`6ImtmNW;rP~9+v6q<*W8Ig
zL*Z(pE(xw!w*ZWSav>ENI+@|TXtV)%34|t#4+@5FLwVn!*zF#U_Yo2WzmzFXC!CpP
zQi<g=%5INI>0@!?_(f!_<^UfjS~RcJSN%PF>!cHhEOa^91;OQD4zCL_Qd2(EZaURv
zwV&Ntl26^`>Ohn>;ayl5wat>;XGfkvoh>b-4(D-it;*ZN!(m$?8u|sh-)H;kH!|DX
zK4<8Hn_EdfY4=cq^5+`hX^ra3zuI_nJ1*wS5bXx8Ra~2!+pXXtBQ=?NB&vD<Qt6MK
zK7MXKA{hYD2AQ7}G&aA=7Ea<WwrRhf{`x;Hz|j%)#n|!$D5$WPRg9DN^M$gv11JQ~
z5Jpdq3w{tHQ}ghIj1?rnZ`%uvRV-=02tw#+VN(5l=iMMxf@j_t`|8`8Gf*(6NvPy2
zSAF@$^cKGgVuN3!_3MXj(NMJnxe4`jMcdyJ?%b)H7a<p!T%m8;Uat%y{b}+EdLHim
zH!+_gt_W<8Ym=eOrv9}VQ>8`=UGDXj2`mwOO9-jvdR?D6O2q`z$YoT}-J_M1f;jWW
zU-~e-bmHcwEiUWID-=T~1$<%@i9I1a@t~ABDh3Z7vvtN;;!iH5X07<t=A@bmI1}p;
znMb9`eC|aS1vK4Q=|p>aBa>YDSp0%(j>>T2A|lB+FKSL6oU7H`NM4#+zndXPn{e*w
zFDkWU{!~ekdulD%+wq<u#`3u%7WsE58K8wA!E2<BczFpKc@6BdBW@oNP}`Nw#XIIW
zQ6C~eZ^F^8#6|Qn5DOgYN74QXS6>pm0aotwR`O(P-lfKX6PCQg3l$H>wNds3zsn|l
z;W`*StTWG-ToI~;hqs4C6P6KrRjoUQDzxp3dad4rIy5S(r?kL}JWO1bovI<as9)2W
z#EZa1Qf#>y7d@3B0Tr<f(Q8=yUZgale!iGzv~mFcabhXJTwmW;D)1(L(@VM9gR>g*
z@zn69q5G%s%>R*9{sOF(Zz&?xK?+G&F3V8hpyJBNKyHp65oK8JX%93GfY1$H6{o*@
z2q^xR%j#X=g+eB+;;?z0F^e0kQ~zD(<OU(^%W(`Z`jN>e7~{F02S{;ycbf@A3FbDE
z+&oM&Uh!!LnX0G^&fKs+v)hz6L;da$y=Iz}IGGMkQp(W=lX5e)_d6-!2`P6Gd!+|U
zU@?{M=Qd6<Svi25wLd!i0dQ_$ow4-Gg7|>2d61h~*Zp^(dw!c^a{t3nRXc{#`~YEU
zyY6e3dhvl9v3F*}(8tc_I_#g`_z6CUM3zLLjM~!t_5-~j;+I{%BP-^QekNQJ!=nU-
zh5#~!N7YCGgPfYcw77{bZEa^0^`@<B-W8iDsg_KiO=q4H8txK2l>>LBjhW=A7P}1<
zk?L3`PcV#oco5BqI8H8X%a<8gYQ?o=Da@t#F;r}``D?7F-Bc<Fz1(QdWbSn>C#u2T
zNYVvw>8BAGf3Zfs!RFLkrCD1ILD#Xo7WHJaN8KUo0{UUNTNmpDnR{%<2->>$8<@~A
zM);mpUmcKVnp|n4npui;;y-xXC#R|X^G>yPW<P})Mn$mrrB7;5GLb^#9zhITtF$3$
zoGylxo+X;)R5vlTh;q8e5Ch$iw4Il$3F+x4&>d<HSG8uG0hfySea7C9akvUN<1(xn
zQD%&cN&%MoMfU*XBY{HqD{RxjFJ;NeJ1dk8*3uV9D`7R-7+f^kBiV^9xE3v%sC*MB
zv&6l%l%LWNQhprZ(hSF6QeC@i>hUdip}+JSqW;Do+l*Ba^U;US*hW4xuZ%VbTq>v~
z_*QM+mW@k0;yZmj=bv-RkDCw2e-n6rtqcEbywq|qCU#g1>)P1+-r--Exr7^6%>_^L
zI=gf3T~wgQm&aD`7276OnV1|Vk_L;^Q{qf@Due*PL%4ce#M@mx>C{WB9FW_gt()FY
z%FS0Ra6TvzASADmAXCGVh*+>1<I`H%$HT5cqd?b9;qcPQ4f#V@y6p)=7gm*=u~(6T
zg;69AF0WdlnmX;9?(?kKI-HWOnuC*yBqX{$`fcRGfRWhvZob#q*GVGu-X!6M66eS{
zQ)(p7=jm^Q_D^;LZvCo6za1kxVkRhGHaE6Qc9W0Dn#ZoOUMYjOz|7E;_q7iPfa%zF
zB+|)KV&pJ){%cw_{CM4d$||xY|7<Ox8tNHAC)%*deE2L<w@F;k;=4Dyiu6--XMoZA
z$gMTqeuo<Q%0D1l`|jq#g1I!rJ>#p9H;!xwV?;}&dTBKRD#}$gOXE4!<=HQI>`~nP
z*d2CzhCU-WB*ht$>WA%A|9?DPg+o&h*A^5h0YyquLTbWjkd#JJT4Eq2-Q9vTNGKs7
z-Hh&@bc4hg-OWaKjBo1u`~HHv-Fwb?&hwm7ZJChktVUCv_^4d#Jo1+-|Lu+WqvaEF
z_;xg<w5cK9#*M-zzvn*`i<y6*-T#HlZT2#FXxO1d=2<Au&Z-e+40>>XhJ!9LzeG68
z{}}zHuA?jmHvmrp8RjI+H~W;9(LW_uz3$44ZeJ>z286k|G5wWXlk2O|NA3P%!PD;2
zm-cJioaE+Xlin7sFE97AvC3{JleXqix-hVBzBPpZnIJmnMb;e;m3(neZ`!#VQ}~w-
z1^GrbzHwT6vUl^B(^0dT0JoL*j&mHN(A<W|0Jg5bt6pYNwXlD;gSMKg=P@E!d=y8?
zDw4G}VhIuj*tKY%v(xuZ!JLxkl6yI@&Rrn7eK=`RW{<U5zUk`Bgs}m>o;oxu&R@s$
z#ed*<I*zFyQmSWQ!sHs*UB_4HfcCVfooqf4@m9c3E{<#mRLNZY=rc=`(t-qr)Z0?r
zK+4x?OVRVcS<PuTKTFUd$9@BC`LYbSGO|mWm~CHWDb6e3h!T>RKCAvnxQh|z?$9oj
zNFabWOlg{2^(BaKVc`Cg1CMD?fkAHIy3$xg`)9Skvs{4xE<BA%knySkKE{UH>BS$t
z7^RV1jjI<}nP}9*n3kai6(-F;;IZB>rqr^?LaXhN3wvRgt<wby_5fg*W|HXW<?uXQ
zCTpRezzKhrqL|kxC}#Ye(r7Wa>g9scL0M%6`1gx1E6Cg=(fA6%LOjCCMnI8*+(Oh{
zD%=Ep{UfLcnO)oPm_o>OOO}_THV$Lq-UzeSM6c3JHo!aaO$fGl60av}2~V<dhqK@_
zvUlcj!f~cZGO=vrP$CuH`J|-eJN9;?6`ZHd?8v`TEGeo!@$cxc=^+Nc!s*LdblLE3
zX@+ABcmkE;)0!`f4}QK4xpk;W<Oy}UculU1=Nj8H{OBSaOSrNy93!0G^?`?xgD+)7
zBE%;j>}pRvOm1O&MpgRBICYXF3j?E~jBw(~;Ddsw;q^%U_6KdLZ<7i)O$_QD*C%Mn
z<r@`7d<+#o3p(MHH+e%pPnJXaOL@9n91&t6Ak^6797})`#JvEG7wvfYMpNFj;-^Z1
zrYJG-MT`7hWE{3o7`tvl%QTaHz9j9+V{wS_4h9tP@5)8ee|tIf3C$DSF#E8+6d2sN
z&NB1_-u?h+$Bc2<;+Q!L-*^b7je2x^TAj{pBqOj}f1Lc0G}lU%Queg03LOvgyqvN>
z?7^eG)2|j5Z(}pd9!|6Ve1STh##fk(owl48Q^@>&P(m&685A>Rn5ycBW|)@FlZBW3
z-0NZbxq@;}@RUqmIM2q9e`xvbOA#ZUV(G+~xVij1oXuVGLc)<T0_#}u$4D01ucL=e
znj?3aV8Ou*0N@c0xm>&p3-LVAsxT_&?fZgFSG+i(qrdy&?0^1m&dEITVe&DHFy(8l
z*i0t8Oqmokjlv|~yxmTEn{^XOH;u=(d6m4jd8*JsjUqPo0IK3gA7yW9NE=>()YCi3
z<U@$mSoPlJ#!3tq&St&|nPV*DCBwf{C4GDrF8B1w(9Qrg@n?Q|sUj1-Y$ZRx`URe^
z29sD8hQs|Xauy`AmY3~?_=Dy6iZw8$-1wbjaZ}JI-+g6KqH?)aD=FVK5rQBgUCO8n
zGFqSwK9V)XfM@P61HJxVK=6NS`b5SqYptQt%{Yusa)g6_)ir(l^nO=&1^i-%AuQ^<
z!*<JB0ECyB_wCcD2o1(xvDjHoM`hwt?-1<?Hj@C07&9XMok(bq=PnK9SAicS{RD^p
zFCkU9<98Y&GUPImCGlZJ{p7(P`;0BZ5={kV9#~|t;SV_%fCmv=HC<1c1UQP->sPaX
zw2*nO?AWDjXI81KJibB+=OGypwhV$4KTj{W^D3(O6J(0F5@edTpxVR#jg@>X4C;6P
zcDdmwY$Ua+#8~rz?JX0!VwchkdY9Fc!Ns62be}gV4A#zVPvZI>#RUld{-va&5xyl#
z>bYb5Q6EF6CDaQ;&*+gy-h96)k0+W!te8L%UUThzvIOi`9`Oa!yY2P!pV4IPv7$MN
zx>;^^7^B-Rflf{5n5|>9PY9Ay;=Ir#gCuyUNR)^uO8SIA%n3gR2Jbo&p8J5M5055Z
zjy&f&B1*%>!X4VxVlX(e%3&P!ezU^%x2XUB2kOQGw-%+NgjXyFVt+)*?qStSl4d3Z
zxKc;m7BnV|9((<G_Vm-bZF^~UWPYZgdH4(oxv36HGw7FDPorA15E7}mWO4r%t@fg0
zn(oVT&N}K9@I@>Ae8ke#7Cij}b)zZc(^6?4v;Rn#M+r{Y;djyiPK<|(B2*`yybAAd
z`GArln1q7zzie@wUzCrjSqLJQl!QlqbkX8ARe72~AI!Z?Sov7I>av6P@`kF&?>N_J
zc4J=Zj<hk?OwYE9Jx}lJ-xBdZRjj#NRQK(pA)Kx!Z^9*!sv8{HS2H`y`j}+)G4|+=
zvf1lraxt-bWMo<KBOl3mA~x~AI?!S+N6k4frhZ^>3S7@TKEylIKau&y^YmS>TUV?>
zA9Gu)^+xW28^+@Bm!W4$eczrGVML@S6N}3XbE}hml&gyGf8hDKyt#orWUS$tOobEr
zeGu_nkQ3Mzz}7X%)$(#gi3iCO6gvLmja{??ZgC?wOk{QvIQIabG(ZMdt~DP0Sb}vq
z({3Go-w1Wv!PQH79rVD8U^|c*MD}-+y7qsY)N@{~JdQJbfc-5ua4_f-6BD*N5k;jB
z1zE77*N_n><4R6r{O@OyJwvqXM3h^i>Oq{#0yDG@L(>)O(kA3}o(x(Rpma|(OyOxr
zat7HjE}z{uKU$B`!B04MK>$tpcD+oO&rqObTJTcPhAWf@k6dD&k>ta-AC@nF$#z1!
z8@+<zxRm0d#bdK#i<H~csPg?+XXvl0ss;VC4?k(#qh@pT*BLg|u;p_4d&&Yg*+C?(
z7F;l-|9rkno*z2x-wWyrfBQ&4tTBoGnB0w&G_BLPkadgmSrtM?wf(M_m&(~jLPM<;
zi<WU+$*ioW(~rg3#+?;10TNhb3Lm&=fqm5NVn2W!+^@3Pgb29Eu-^htuo#3iA3pb+
z=2;Ot5+%I~R@}yrc8y9jrW&XgQ05q#SZ!X`%jxP9nDHutqqa2WWUAKO+pqRL)8U%_
z?x0%prgpa7G{xZ7X3A^yk!shvP@?Vrew7F5W(xTOKYOV0LafVci}bgzD!+_8%aBQ5
z_&WiF0+TIyJppRA`-%Jedr~i~(Dtr@Uh5JJS2QigV`;6=sA~5KfxsLQoqrm7majzn
zxFc#S*o%D2tjFRM*@{80(72|*p+Uu$BQkU}zccj9wS2ZUXkDwfeJv9BpB7N@mDXS;
z179;v*j?Ec*(j9#OT@2_JaI*oFF*Ay;G7wo!ySev@;D7&_iKLxTC0XUS)vKY#mjm8
zvZkI(;uHQb`qFDL8;{GDY{qwO)gjOym4cj7ha9HARVosyalX*%*PAe>KX{}XfcsZo
zn){z1o3r76w}j;PIYj(s9C~47dymUp;bedCWmP25QQz3?S{NT4r1Y|2$phuWmgA-`
znEm0CBA=ww4^wdsz-a8-9BN6`viwJ1BhMF6RsGVc5n3!hCq1tn$;Dp~?_wYnnBvo^
z-|2B4h}inQ)7FxRx)f}OIuX67kEe`=z;J5ShLK0c%kE%+!^QbNu!ro{Mw(^t*Zmb)
z{&c<m6<Kb9_b2zq{M;)PuYGaL?^j@e$HehRowyQcL}Da6S^<uvFFoDGS5qL;cWWB=
z4iR^u`}$+|Doh6W>0+%nxB2vrB1d_{Fhc}#Eucsvz1Py8EZ|0k#;&?)<L|rpbN{9a
zbqgbBV`4(DPSW2!P$0&ixjLGL$%A-9me%fuQ*`Xf&sT8dgwEy^1xYiL8E&f!(-402
zNl{~Y&Wc}iM~n*WyWxWd__&(}eD0OqwWYQ_Y>ZQ_CTG7vKR2Ms)uMhS*E;v+S+mOV
zD$LTc@z)44o%qW8bb<cQ)NF$9f5S{`8_~WP%%3^@MQEJ1Ufm3FljE8(Z!g$yfT%5f
zwRn;swl*!)P4Q&fZegr<7Gte=vf++jI-{I#T-asy168*?9XWRH0(MyzFAx~^K#o@0
z1HQJKU2lrr0vm<-==*TDlaanbU)C-#;pralKI}0_Z~6oWb<*r^5LIJn{4>o$^6k0b
zO1r?~&eCChJpsr@80fcF9^=)5kwYp-lH}G>(;zyBNh{^m(_=nu_>*`3#^rbEAWe))
za1JeTih0JIcg<GGCa8Z)wT$<@d(PW?vJ7|a44%{4kN&dY1I+TKVELEwh<R6Z;&sMA
zE4M#t&Q|+DvNqf3-!I)F0}H@8&ZLStHYZ!m1L1zXym>|Q$n=$6?>zkR(aq9H*Ov<Y
z<<)3UAWeO3Q#4JNysWC?nKGKaTaE#yeoxOke^{b7F*8rJF4nbuSrgxt#SKNK51NX<
z$mKqf>Uu?e!6%U8)Y!@HaV6?3I*P&<$Uz)#DXPX+mbrKU*ND)I!VrZrnt&4IO1v0l
z6#wG<rTzh;OKSH%F!G|9-XI!^)uq7cj_yk@$)w-2(N!HA)5mUjS32Z7tW)h9Yuvx@
zj<<Cl_cWs*?z)ZU5~6}y6xoX{QVti|)EqQHHPj)okLvYh{DJTtJWtQY^;-|lZ3ClU
zqGF@=Z@#x0;@m%ec^jj(ryyM}YcS9(=zn((7Dc+lTfDaUs|+z&7sdVbYvb>;5<y`b
zm}2iW8LkK%u0t~Hc<DoI5B3)13%8)6<0r++&3-q5sBG&gsx34WH{+0ALvKYt82xN5
zq&OyOB{0PvYg3ge*2n}Z`-7fHjkkp<@<!49talhGIizj0uxY>qU({6nDT{yB*}%KR
z%mnwL0yj{1_xs%-^Yf6!RmEL`LEMOqiS|hG$7_;%@LJ6#BXf`CXQ%E2iSfX{Z8xx4
z_!3GZjrrR@954Q2hTu6*tmAggVcSzWQmjSQ38YpkXJUHRvinV?d??mNJMVsw)ad>B
zLJx5ZeDySs^D1xn+Ib^2p?~{zN0}@>#}{5c<D7ZC8bqFM4M^P65lQ5z)d#j0@#3Bw
zC(!fm2`;nU7G^&ZI^1_&EZJ%)8l8q-iNt69SrqN1H<dJm3gGWhW5IflS`;c0(?^9o
z6OIBdZg}S@(3|O}Z!VCB^$@IOQL$zUho!8{NCphozPUg?kQ7>N=3xYv-9h2YCO3e9
zny1adnZg7gjnu~_o$R?vwr)o+`15lML)IF)G{@2p1&}A4<&AOY4Yh{?LP2YGH{Wtz
znUk)~hTrY^&iqv_?`cq`9utRBj_Yhvq;7?cLQQiHcUl;uzlQ;U1Xt)m*^XN|aC^~(
zM{}ZG0Owo^P@xjOF;X|t&}9%aex`-9jJSnu5NH3E8;NDP7Fh6l^9wnEx2BrMP(iq@
z>!?|a>Zd%GmvZ+dFLuy3u9iB9`Wb}HyQ22`Ya3Gd1@dR<j;EPOd7C$C0!I?1GSI|P
zVVu(_yFq9N6?RtzR#*srlKu?4qOMGPx=gzH<E#fzh;i@#j?h7f6AlC~2HD%oF6WJV
zG@hy#!5HuAxtFYCI?j`pRCsGeV0y9$x}~T^+<e373LIZs)kgH_6N7<2s*?PcZ||Q7
ziz+X>_a!{(;T1q2>TofIeVId?s%m^Wf=ssZ_)YeqI4zM*{!3rPaxg9iynx8wgAClB
z#|i$daUUUk&ml(Ht(L|}@4JoYeEa0&1?DtJyp_N3vGPFX-Tn41%<WI9G{Ict&tLnq
zX>G@eo0Np+*oVv7duXtFi&W~e0ueYTwC?8{;;QUp^~1i+nfgMgb*5+L!r`pn)q5TH
zI?PfV<E&uZpuCx9t6Q3Y9XY%1K6&7_vls4nSG(V-pm%_CTAZNSvzWDZCak$p|7|g2
z=47|^w52KI;_|=F-$C3GDc?wL&l9v){+Z-{!R29iifzEfUmt-#Jbv*2TUK13KEAwZ
zep<u-as`QYVHjgysLp-2+(vp*Ok>+-9g+P*d-ft9&#4+>IfuMBBlUm7out)dh_5+g
z@8H&X?3=)NpgGTNCY?~K;wiTD2<vZ!IN`r7Ocsrz1CErX=64d3rm@i~qf21k$)yL+
z1KJ68SLU1}Wp7)Wl&8<ISXl!)W-=+5)6!1%k`GwJ1Pw1W1ze(3jjpPGZ`NfMd@7Cx
z(M><4_1B4U=q=ZFI9vYxQ_ndV<XH1jkbUss5{aKx^GPC{j~ei7amzb;uONy155-%Z
zF+?fz=`5&mA&W*~5mI^W(QCY~htur<dD9s!CD;XQo5NcYucB;N%8T9OB#^gqOb4Q`
zAu+$#sWO{xm4oaNPK)NtME9q{_wMC1@ox&HIi9xmuY9*1m*)sGyzf@{O1p79#&s_^
z?PpR{Fi<TyH?wCOZW6?P-CK^=%&oly`CHdO^^pG?S{m*9N~y2(n^a26ZT&9xL{eY*
z<2%y83$-n(B}9yhix2ZEGIA(O)xzbS(hmrTBY$$h2v5`x!dyBCG?$#m@3?u~xQbsO
z%i<U?K|sE&wHR7m{lc$^Z_#k)yr{Sya#{4Vs^DhRprGrl_>X#rJRKC{``@Dv<n${D
zM(>bFnyw|P#%2$D5_r<={rd@Tjj#2XYk9BSr@y+F^4<t7c;EY$K0d4u))%!e^I&F$
zWSnE~Uw&UAXv5#dob_rwb`CRc5jyocL@Y0j?s=ZATpq1$9f*{Rf^P5k|C9((UL{7a
zt!3tM;_pn|xrkKjD4?gQSg(D2Ly+VraBx!VZ-D;PKO!O~>AN8?26F8&_SxlAM#R9V
z;nmT@m#cw#LUfDi=KhKsKEK=UIbt*R`%}3W#L`e0nHQa|ZNFidf&%A15v%1g^<g$H
ze~uYW=b{1owF>iH##3e_{R=7X@~^i(T<oz|SCBPIg}D#jcgr_4z%%DJM|o&T_<~P1
zkxto7=53wWi#j>?480Ov7fh5Xo4-zAsh&#TckD$G<@Voobw|M$ninlzjRVLclrJ%$
zpsRNfH+;o}P1e;&7OrlmJsmvm<0rSk4nVu=HJm*OeC&tkE5;6SD*6rdHx44!a0ggs
zWk57V%@5YDzdS*ud%}ZNVguo!A;F=Jg-xxjz-Z_b8*|GX54Lglt@;o_y6ZbHabFQN
zWtunDZh*YosQSVtFF8u+pR#grh!5<4x14YFR<*;1ReHa1K}21V=*nI51dQtfPvxI2
z2~n~~LLN-Caj<VY1~e5<gO_vg?$Kz9F&u-k3~Lh&y;lzgqu111oRw~_X!lFsN~KRq
zwz$Rms-<^n>kf1}ma>l&+fN<bqzqbTIU>GO<@iBkU@Kwu?vO2LTiF&A^4}=LePWmL
zL-^J=f1idf?;9$!5n~+0Mb_HVAg!^W_W8owVdbhX9(UF(_2jpUArCLy-fZbM-#O2d
zn^B~dFZhHGA@@(x%z6hgo9~bvf(OKUMqpf9-!E;3RxL76kV2C&hYIAmqyOD9rX&BH
zjHmY)E$QENe8PJhonk!yvuFE08O*s%kH;+#gJW!xi+0!@XZr_(QNIoLqhoj~<g0nP
zu^5qy2I#HJuit|@G`J1?TPN+8gN^o9t;Cx&(HS(>sv9e_(P8&mCN^{)y5&oihH3Q8
z?Ezarqi4YSx~+tfT~F6^vzwp(j;IK(iHhJ$v5)}Jtyse?LY2R{dYCkF4|8H8*zy`c
z@kVTsECKRyQGwQ&=ji;Wx9dIL7lXaq$YGx^wTRqr<*+3^50;$h%d@??9?$9C)IAtu
z+e+0@-O!%dffaJ_!2hNZMKA!~+9!s7_j9B7f1dc^FC3C8ScqKGP*+1B7mzHk^1ZEF
zNOm}A?WX2%Q4H#9;OS6%Vd2iXWni7RbrbXSd@2!H*W%IaZt;u-U;6wMq}4h2n09W}
z)~(f9^`4rkB|&JGCegN8<7~W<GzsaA0$-rm+HAV^{r3OZml$1^n3u(#x(_2)0rrWR
zbHT;2e8>D9w0o~S$wv-wJN3bL?j>pr=*S8E{pGEjts${z;8ZOeu<les+&G?w*BE=l
z`W5D8@6}dr!jY4vribCd(=7p#EwS@uuh3su_CDbf6%Bg<gNNi`V_*J-K{1hXI|P`{
z+W=984EP^p`AZsD^c=B>8lZ6%PMo6LQb}ZFe8~g4)}-~zaQD=`;sea!@H>sYc%VJ7
zBnGwy^J<-?sSKxUZ9VYqX&ZDo8flpH(6|n)65NNW-vQs&e^;fp#R;f;2=}!w*r`9)
zXZ6t;ax5)IzVUlP=Qj;9YBgvEdNBQAULs!qq4jZ-27H+1f}oe!F-z$Twboh1@hwTZ
z{Y5L*q1J9K%d`gzay*#zB9EItUhu;(_G`a~ZlJ-0SVy*Hvuc$%4d4SX-(42Mu6HrB
zUS@s)&3_D+Y*pasq(RcHMD>tB@Z3sWOz*hNQ&#a8sHG?O54{Bb*ND(G|GKi?e77k?
zw2Vog=GR0DoSIYsQccRyhgWXS2~)|ynh<*Z#%Ov;U-La(2a%Pl#^`OCJba|yp=<B`
z<CXqP1jSbbn=t65JHa;F?P1LCb0oh$<!{xaO&31Z2iJ`ZwKz|`Uq=g%VBL3ix6J+d
z->pPv2PpFKM|Qt`PRMi)@@rUOJgV#YPYd9Ri#hZX@24k6SPi!M-GZOFlX~14(O;(0
zED<~V%rw7SC~uzoRSxN$vsT8?cyA3XFlbot{B5|`P)>0>*$Sy@j!kS{P$k@86(ePn
zv6Lh>WaT-c;_zlGZ0kzRUpRvN$&0K0oF9q#=C^Xmzs?pmL&18Ep0IyWQKf>hH=dey
z1y#Ee{oek#L2N)a@KoO8UUzDcIAbFwoP4o3mA~LFN$&cdSxwuoh5%;`uX=v^KDnzA
za_6V%S?+bwu<Uep_I?zsGJdja`M*hy`v{`AFt3vN{ZW8$nzkX_PwLLDx~85G7J4nB
z*w&!<aGK(RF(YZ+6L}6xlKBByVc)%kc8myA3%XfOQ~bQM>8YKFvaWv|z<G~1ep~Bv
z@3ESNpG?AHcL6W}R?WHTHIR~;-!>h7+nI^^bd^e2`u9dm#D6v}b!%1QO5K!0`Z}8e
zzigVy{mV(Jmw}_u>SMQtI(ebXfh(wegWA|fzw}lBpEqJ~47<LRb=Ar!1`yRPYvN8-
zmggfdW5`;oGKC0(RqdwEDahoV?AeZO-h8{8G;=gi^SW5Y4;yS<)^W59o|IYmtnT=C
zXEW$;?;eoyJ_Kt6ivmLoX8s$fzw!b7;uClApe%%{65tcGz&sYb+l?{2fByafbY{FE
z$)R!Rz|{tF0$`?ibL9Bp1)U+$XclvJ;_+49zQP?0ycDmIQXwBr&R4G5`b4sY!jjSv
zuq|dJX17+SA_}ZiPu2L&>bK&Y`}S|M1V1W*1OB9BGfx>v+P9{b(1!@jg%8irYo({y
zA7sa<%4UBylRcapT%)WXHKIwIIr7>jEb{A~540AWyDp2(`TRXZny6yo!H&|4`cI!Z
z_EKkR(FAMibJP&_9v|l2AB0zDCgooiXdP%>>P*?0zH+E}o}H(#rq;z?u?6jwKz09h
zqQYGvDpASV2z<HKNpur8$Ix^BeAn?<&b!wfxy*MSX?fM8_!hPZJdcSzcUs|fU#GZ?
zx>517KYYA@x!mDfPv4!vAlq-x=24w64K4P8NGGZC-}hPD_jZci*0f)s_e$#`6gNEF
zu1N}?CLQN&L3NZz0XO-m&;MsO(qG0vRpyNw`}>Vb0;JCR{M~1%8@ZM#@A~}fR1Ev(
z7KJ<uME?dHw6^FQIf}`y3AySQOTR>=Bz%`o+}xYI>EZ87>c5{aG^*NeQWRD#b@Nld
zcxBLUsbO6-cE>AoG`!&Box259I9a@%JlS<x&BMGuKvB-W{>^>N{$n4b4|%@bR%v5!
zm+vTcg(Y|+No<cFbhFjd!kuTJ;vs2#VUHE<?u~nCKNtz2Jh{6_Zxd9(^DZAmenB?o
zNmP;gI!qGQmuH-g4MKTeHoW&=ZR>lx)mHSkBRL6t-}*m0mmPd%gW!-fh`y`eiUO|<
ziRKNwK{L*1@o!6XBe}^!gMDZbqF7sb9(a4#4dft~J?@fhzZFk7boY0c;1oJd?h@*_
z&G%fL@_{5^gWGh1r_#*rqb<s3*LBCK^_qd_^XX^aKrSSgowlLMvpR1S^`YGNJPSq{
zdE8&|Nc9;|%e|Z6Q3cJiS8%SPs=l;l)}<xPDgGUun{VO))(WY5X)7K%L=!Eu7KT3?
z5^=nS9s?4TU5M68wU_E&l~$m7_}pzpO}6mfRX^I9&Ol~Yt!3&Iid9YF^kK>5ut?xG
zXrFSqFHNw1Q7BGVDXcm|&%1c#CbCs?@63J_fJ%__{+|o6yq#86^@fGa<q*UCU36O5
z5{<NsjZ)V@4OA=QavPW*sfLXQ0!Y1F-P;UHDy(|*fz;4f<+iMRAE+IA9y*c)ZHBb&
z95g?>j2yjW=IuMsH#tMM49;+r+-&#;d(g~Q<rTQm-Hoj3IzS)u<E!L3J?e&+;<s59
zrE52bqcoq$&Hqiij}d0zU)|7*#tK55!oKH0pL+)+RFf%uW`05#MOiQ}aU(5xzLH8F
z#@`y|EpSa$wttK>*s_{F+HR=pMf+LXQ?}01lzr7h<7rX{5bx^wZ2Lyb!ZHaBI-;ZA
z`d$Jlp`EgjsFPS#xpvc5VYi)EslDTQR+foMGnP?)_ou5{jG_002u7bupZ?Z+<>`Tr
zuEDLuGu*mTH}@8?b=Z)29^)eLee-vXY6#_J=ZZl4vB32{gP5-FhZ{khaxAJ)aUtcm
z+Gs)-ad%lWet;7o9d}L0lHK~j>(jR%fq5rozrXzM?e)5tfzgYUFQ%hh0M#P%S5CZ-
zopi3-iGjqB+yEZ80;de0@vXXzD^NsF&>_{kfenXVnsyb3*!Fy%_SRv}i-|W`zX0~F
z#BJq*WbwUQcyHLruHVfs^4!G8=eI#z1d$qJ)&b=?&=XdFRJM4xk%2<6(RdVsF?E$^
z5NwCz1rXmN`6y#(ZY8s>4twrazi6bDbc~YUD>NT$wXSxs`L#OXw4A>}K3rTHIdVrF
z)_)E6zzwgL0KEPs7Ik_yx`%y))P~gl7IWu?=Tjm(5fwLq<LTONS37=PNFU`<FzeAD
zKubm$`+ZQ?-j+5dXLc7{s>!xVc%+e=QM==n@dEbugQ+@@LUSa|Jv5pB$GJNx2n#BM
zAV_7<ASP|_#MP+#vZhROk&k%W>!E(i4vM8Q@7Ka`x(IW>ZPf@g)O97HAiZ`A(oAPs
z?0m6%T@P2rf!k(y8~7IIqd0-c{|I(@ICs!KR2+VGOT)0IgpK(Vi%wi%)v5nT9eRjn
zc&l}d{zauR_%?0k1UloZPjwW6hFt=W7-}o`EG6^56-2)Xp(M>k^O)-Zo~e3YM&gG*
zHwGp!kYB6zhnJO0I=vScs(V!aS#AqwG-<EAB^9HKBF{T6U3=;zqT7EEWmZ2?W(8ra
zG|pc=o55hXTY{&BH<dJ%8RT8~Tf73#zpGLl_I*xRXdhKQn!>Z6*=65Pb{REa{I2B|
zT%>^z!IbQIC1y)z>L#6dCWKQu8xMuKvr5wC#j`9#M72)XR1N-4X;5O)J5x5wU^3@<
z4>D>~J;5FjuxdVC?D5xiOW+PXas2e`=BlU6we*@CGN)KqZapB}@!k(kWc9A6tO9IU
z3GjF=KncwJfz6NcIwXXZ``d@qfoYX45jsc*#SC~iHFN;6W4uo9XhxD%$1tN{I#Z<2
zZRSlvmBN@Mbc_k1E2^7f7}7Ut4JRQt@hhBqtp%OP)$30s+a>v7hrQ|rU(>*E)(k|G
zVx2i}t^~|P^pxF})z1<O6H!K!J_SM?yX!LP_MHtwe@bZShv?M6qOHEQSSc5SuA01_
zB=cgQm35i4=8esN*)Ht17p?-w*}hPm5+b@&4U(5Rh(}lI?^sfCSzx^QY`7p^HgJyr
ziZM3QcWdcABKB>>B`>0<jB+}me7)5TL*;Sk8n0=0EjY~>IXL-3$cCoTc=|naWjCZ$
zaSu&_b-vcL1^;D)^4yPjIb@$$7V1b(M5%I4)jszN+UCB9pBj-wq0dFR8gy)Pz7X9=
z?zsYs<#Iw>cJ=algTlS8AG&D<fLftt%l*p^EtqUm+AnMJT-IXzn5S9XUOQt%<?$6#
zrlS`YyFB}7_bX0!;Zz}Fbm0(5m{%hU(fEBFRjBI{Gt^e&<-+U+-PX8y_wsICD6L>(
zpf1<*$rT9_31;`acZ=v1bPEQxPX2q!11O!$IQ5lgQd1g#$<D`69@X&P^Q&h#3&$44
zS@qK@t{2TQ#?~8$g&5-YXPQmAl+na`Egx&|Y#)E#osx1cFm;K(+CL@Q&x1&}2(B%t
zMiMivKUdkcP~FWgftRQd*w|3j3=3~IlfmUBe5awnX=33Ql+jyjOsYGxj9mBk;TpOR
zRual%!mZf%Y3#W4e!e>ZBF~=fv9Nh_s1Gz|>>@?3n7w#~H@9a+M2(@^l4R>!w_A{`
z5-Zh?)CV<11^JJIOu-AF!P;W!Kf~9pYAWA7KWy~*T*mR-%1N86TJHBvs2o?lg5xw_
zziSRG2<$xaDS2O=^+kbpzIFY4+dK81D(K~|ec7^e<0qwae>R)FV1vR672+C>@;qcu
z;K1H2`7E58aC=3|1`$86p*f@F>RK?)Zf{yHO5atL?a9}6C11rA5*12yr@kf)nWZVT
zSx6>EP`MTuJZL7@lT57yzlQ-3IO#a}y(dMkJI3gZN}jmEKWu=?Q<-#(hU_zJ%#ORp
zBGNOnJmL<b{o8>=3Zb0F$v-Mt^%3*C&#p_mTscXecU6xQuqkKj84kkxLvGK1*JLQV
zn$H`@6@4y7J1bHak^%8`$N_LD3)D3(z7txtm&t%D0G{=r_O)Lt9-_V0@<~s-5yg4~
z#JUY)-NEcz1J}fMTkay%X5CCF-^|UDo(?$cZbRW@W#I}8qHUD^h`km3xCQ+2RfeWf
z&kB)hEh~el<a&P68QrgJl;ZPKPhd%Qo_XsoebWgF!Jx*4H|6odb7jkMD9a66O(9AZ
zZR<gNV)v!cA<5X4pN;(b#_NXht*)tIxXjb@+Fg_+<RZ4!_Hw;M9&5~0Q;O!M^duy&
zia0SHS3o1_8g^#an^4Rz32YX>Q@7`DdOnB$q<NR35)39+5&r$pa)WFc{Tmo<ahs;j
zAPh`qQzpL{E8&HgbK7;hi8;1*yE993@vGHzA(3XqQ69`~?K>|;>uR?$WoT0<vC~GZ
z@g)lyZj!isb|~g@&;)xRc|#hffE92mpac-uab*6}+EC8%cAqIK*hqU?(<;6N_22$@
zWyo=<mn8RO_z|_9%R=?w-1@5Knjxoh%oM{pEl8dHi`M1(=Gi%`Zm}T>sDo`E%Or+q
z$DAfxXu&jdlRQ6ZfUvFWDYENbXx^|F?<w8{1+HTDuVmyO^0R`6CADC*mu;{4JcP~2
ziTt!`W8Rr)7u7OVfMF=FA*PImy;s=N7$mtCc!ABz8zBJtZgPARMy_Pi$0teXe6sEy
zjtvU-eIaTP`f<a6KUrBt{kj%aM9G=N8T9O~7g(g9G7j=nFv-b7@J}mO=tO-><;iE4
zgo?Gq#=BBAU3vWWS!#*6c;h}G`k+}bJ_J;{>N}EFF!T4({0<H9j+f@Rz9FA4WEbk9
zRLRn!qPM1M40|@ghX=r2rvo16BGtCxpM;wvHb)<9GEx=I@6sL?`I8+8k+;U%;pBOX
z<Y-#aRt;i{il_FktOFh6sTXU@jI0{94l+)+riKyD{Ijpz*h=3|s6S#W3eaK{-0wwU
zOWMU8u`mf`G{1wx!rIVDY@NcaYOtRCNvaq+541-!OS*zEyP@t?Tb;T5Y4?u{f8x?9
zbwwp?!)tQs+{~%EZ(A=<d=~Ag0?SVY3sWmiOLF~Zjly<_yIG*6wXLa*tUCaz#s9Pb
zg|lgIUySAyyq+?rIv5IG$S9-TIeO*pBQfn!Me2sjTDc#QtYR%@y9saJ)d0#o5;MOg
z*$*+FQ5Gho4l`kk{G@oHjQJs``0k-zleU%Kz-Uh?Y^>BWl*C^1X1O|e*|p_$Q9T94
z365KB!LPDKEA2yl2Z6=*Z*zm-V~D<Yuj8o1aVHX_yQz5Jm{&klKa)^@_9Af#T(+vA
zPc_+3^A5f4u?N_6ZxPbad}2@p@TF2ee@*KCBAiL4Q<tpuPHL6j#L(1VK%%z`Z9y$a
z#$XD`Ujb$Vy1DAyEL~QE+P}1~cn~N0dVRGHmKrH>R)>)}>-hwboDeG=)>=@I*H@V3
z$LmY)$>>`ang8f)D08Kc-*Ysi#+=$s8*D2W;}H?#W!Z>I=<TZOsWV|OC@(fr%bdE?
zfo4u0<vz+W+Ej0vEbZLZ9Jsc&z1f2JVL>f;QCL$N4>8p~WOfipj}~kt3u@N`2HyF1
zn+Zimcr6fKan8q}nC$PnZw3)|gy;CKIIGk9GZ)i+`q+B!XLU0T2x0N9nbU&Jv65tY
zIlhiwNLGa}L_p5T50Qe>bu$uY$NPS9Gt^XIQNDv2{abS7G`2T}TTDN%Ib-+zu0B56
zW61L}KJPe*w45e(tDQYjK%qEB=-STo@5soxthHHgel)|Dfv<1nhX7u$nD}b_60?ma
zk|^dR_k0{?lOiRmr-thC_&x~cJ|pcRlwFWKXdbwBkXwD!rP*^I{ZeVGpc_=_T0c?O
zgzV9*@#1->z*k)qm0^u!kgR3f7;ry<5v=IyFjBox<FLu;ZAV$O=2ZDV5KQ{$#EB-f
zza6utLiH3l0Tp_rQbM~m9b4Aq?KR^nUZ0mB5&FdHeL~e%vg2IrWa)?0S2vhf-QiPk
zr4kD-La`&X$&yROaycJg(iw@HS_1i`0?o)JkomKfmNdHKmKo#2ND#Ig?{Ul0ztDwI
z{xFT`DoT3di^I(ztmNr3<dF#79&dme&r!p09RlzqN=OXI)#oJ)`JPNZ-z~2OV6(BX
zPCyT_3>Q_w$670FCebV#|MYZc)aW`{U(7PcclEljl*&@i>f)RNR8+oU2A6mGQVG`l
zG}iI00QDbHZmS*F&1+aZRl{ZYGj%pO(l@%Bre0g^jdd}g>~JMTe*B2!3~o#f8xFO1
zTY#&%T^#2rx-kp7iP7zRjV)_dtv0@qa;279^c2WTS}iWP<jUBo;y@vJv1d4_-2`RK
zc)BH|+7Mz^OK&u#2W&}Ou<@IS^GiD5?szTPa$_GCPgVpMZ*HGnF0&cn_9<gT5(ow$
zRw(*3+?_nfEr^)_n({TQ4>$92HZC*4NbR;~@%Grl6?j#=>IpA?)Xb`TOWho3j!GG9
zQW$(0%Vu=%;W*kG7Yb}oTF(c$3v=^UCvTe{_ddT$^*EPSqNw`(0|EMy0ydCT<qnWx
zQ(I`tDXmih6+68c*MTt`wgjuUx_$LtDO)`H{3TLOX@vh_75T;U{p;bG`pfwgFE&vB
zo%jLOY>VT|=8p1j6#$qMe769Ola7twTU~hs&rr{FsMNbWY2Sly$x}XGouU-flc#aM
z08d}vt7SsdC4}|Icd0R=yy{qoF`3Bilj?_e33C<i)RUd-2MYx;&JDRzOLg<|kU8$c
zZF&0|3Tcj~8u<X2)xxZsutG6-k)@j@a0xIqRc`^FxhPcQ@u2iQfbdX78>1j_^diy?
zBL?L;GZyh3HR>=3zJHwmdhSx3!ESX`g1hO-*}Sx6yuQIWg6eH+e`Am<PfjHEj8hTq
z<{ZiW8N+_`k>Wf=*uZx}S99P<Yw5^BGcMlqw&Up5R>;LwCufoJ+l=QYf0pIC7a@Mu
zgR;YT&9kJHU>X#);1Hl3?HM=h{c-7r45<b(6<5lMIHj=0a`bq;5pPwSVw><N{Y^tY
z4?g$o4ea-Mt%`$9p(0i0zmOBYCCLG1olRXQ;hh?<x6lPfs2e6wSutznd0m-JpJ_Ty
zGy^ICaCyI>vgLLZxIbay*~%J47fRZEq;TSDXP1*!es!64^uBz9yw*;U_|oS2&fZ(=
zy-0@M@O@gj@K*zx=8ob*Zz>b(HpoH;>xZi#b4`@EKnl3Yp*kt@4x|_e`YL6s!j9cs
z9O3^B)czf1u>?C-g8;*pn?1+*Hr=lubf0xdi$s4}0L$PN$&9c}Y4SFD)|G3;yzKdG
z0W9*d4zP$$+dQu+^H&`Zv?|flH(m5!Fi9vlIwDpaEs9Se{7^~U+)*}Lmr()m;1Zxb
z`1n|x&5iX-95HX1|CB35b|0wgcD{v<acKM+Si75|=09G}3fFKKu+CAw1ARYr**Gj^
zX^xf1iueUqQig98Sm^*2S2JtR__YtLnw34^hb}=OUKWma5UPv51il+Xws|v)t2)Qe
zn)yK?CMdJ8Irc`Swz&AcLLaiUQh(Nd`XoK(;;wd50askpPE?yt(eYz3S(CAObL8hj
z?hM6qZVIs?2JB)n!+xH=&<V~NJwv@A$OO}U;5xD-py45vI?^Q~sj<azx<#dryPrya
z?{0{AYovLY-T6TERyDWv=;a!H$cuY$!l-o+*Ttjhgsv**<Y{O#0*4v{zjtCs%{+Cw
zagS%|J3GBVOm{F?ufkwdb~a~7>5V>^#q<s4r#2?$!LMeah-#(H{JX0L8)560fN$v;
z(OgUh(jF;iC5c_5gGs{~Dm3IhG44Bz%}$Q78NGKJBTP(0#qXf9p%#taJ!OxYuWg$H
zw*oqkTtX&a>HI#DjclcNs1%XZQx+ffGI+_9rrz^Om<MAjsSK&6ZP;}y+QYAU6{%6U
zslmQ_)X$Lqor7_H<ik{d`VewHF<sF-X5FnOW2k2t0vC%ZCDcFjZYB569OLi({-y~p
zl_jlDPne&??W1-z5qwt`F8|kBvHbDstTj~l)1~XEn%L)g4S}Fbvk`XQcb>Lj7e!`n
z!yvqH4sGdI&Hix_zBM9PoAQZu?9g-088;$pr}-sQfS6DP5r?Z(5%<LVKyVwD6ZrR>
zzNGYOBrjNZUM3ExR|(dE6-aaH%tnCTCFIUt-=i|`KW-BC4C_fv)41}pB^>olKOv%L
zg8+$y{C)9dQI=utay#u2pkeZg4M~IUTm+$Jq}^I1z9G*hfsl*OyFIU(d7Dw)f?ET#
z!Rj5mgL_dXRbbV?Kp05#qjq^UAOQ1A=Mh~8b1}a3Z*|ixXDi2|lv|a+hjXh!XP{ry
zLo+P?F9+{!^oeG`o_5{}7kMdf7WaCp*4~!F+2*|)oP<HwF&fxbs@YmNCA&S-k>m_!
zFCeajh{MgEpLorL@LkM*W)k@!VDX0$?BKJvxNgTv!f;@wl#)=d4q$;#a2MwT{cuWW
zI#hq*SXS2tAo)T`0;|}s?Y>QKm++)?2}kUK-D+=@Euh?t4D1N;U*yWrJ-b^kbl%TU
zQs9TcbcmPOMM4vMx5ap?1i0W<xjkim?PbeZ%MQZn=Q{ar??#?>Rz=-5Cw9V$1{6j+
zy21N|XWB;%w_By^P$i5sDFHL*${+WH`G|Tu&2Rc(^`5EMuri15zBU8S3-xC1dl$?J
zBzCRV7K_u*oIcEo@Tb}owA|CBJ`MHW2#uZ0LtbQr3}qeYen;;`19w5dy-via@C^l`
z(pePo?wt@FoMi7Wn&gK6(DqF?Kc8uo2=cHUeGPq8%)U^dR!d|MwY97F)`AoN`51$T
zp8!n3{%61eVbIDf3v*6HUNM^wTSs|?{*$`ViDQ+MYgkR%^5br|X9#@`Rew6)%A7$P
z`wcg|H!_{OgO=ZlIltp?uzN{>T0f=A3fu^aWmFM5!>thQWom5~|9(*YZ_~<m(~vjU
z8DVUOXWW+-U^_DYq8wMe36It(SXpD{(D-@TYsq&vvQ=gPBOZrhFIv6~cf}D4#tj2i
z4WbW1eow4y>nI7%UKXV_-$qGjIp8ix>plVH4^Q%S3`31J>B|^gZ_^X?en;O-JXg3)
zF3D(Yt6IEWet4#y!GKB$&z#*bMp3ZF<|Ac}V~$&1M`rz)HWZx_v0Bf(rZoAD%dhDn
zn`|t<2%Z<0!RYp?yii2^*>8)QGP(TT5;bD$jn(3I>!v2g10xM6_x6;(929<D-5-)K
zYIm@x`=0b+i|WVXj&mmZ$&&4{rk1^_xA5X2)@jrficfRkA8TjziQ>W-xxXTKHC!m+
zgiTUk+g!e3@rl`SBKpirruXcNEqPUbXVs!bz2h)uO>1oAv5Ecar%BCc$69-Gjhd!;
zE{PN{#CBXE+@cu04LOBy*)F2h91R5-X^R<aAAWQYFbK56rSW={W%tWD_Za(v?CoHo
zQ)JGq?eTrY=4>thX?7u74cociwzmsx;k{g=HIAKVDeH}Cn<tYuU_v=Gdr1q*zPfOd
zKg9<No;)l6r4G6CnTF2CfbLL`MvsCt?0sEe-37QI^3%k?#<?|&&~--kJ!x>eK1m#h
z$na)E(Z~yPHW=ATA}76#7H81VW{AqkkoJpUncJ*nG5BZFT*|Rw%VXP-bd6lj6=>rJ
z;sR)^f|ya!D`{BOPBU@ZXX+a7pR?%`#-2$=cLfT2=a~gBpEe(V)b>5NLHRQ(JDL+%
zDofYSuzj;>JA1XCmOlT<;!`7`Bfr-I)HVmr`Pz4m%UDXi@=YV4PD)+r-G<bNmC?~+
zo&WsD@aSEvW6=nUlXrcBi@M&%u|=vguA%~&d*b3p#-!=y9I8U|0<b*f9MX;5weBMW
zH#U{(Dj7~>!=j*zRDpUFD#NawJv9FJEg3^(zJl%W<+O6TNORH+R9s>Tr`pm5i%_GR
zV&B=4DY?c1l`pvHK(;Xmk+9TVgCgo+hY`G?V_xJ{SnfT#bY8vE*8Eqbzw=#BQrVO<
zW^tA-U|{=Ikf=#*+5Q`ulLec*4<!xzioO~7CkV`(gOn4>h?$2k{zzL?|N8~wK3o?Y
ztoPTQjhtmS%*C=I8SO(Q;>rirxu?D&O$yJ<ifa!Xf%H|H4JuGO$i?PfR^h8n(rh&r
zttah6cum*Z+>->r*Ot77iPsbZz3Ig&i$X=m)X;=})+6GATfn`?O#qclLZ>}Y4>6rU
z+5VTr@;C@kN9UUfA!>ozsWRPtK-FD6sI4_2(dKx)lJA3RyIw7O<~9pcg7Ls}d1Bf+
z41o2a>P*7^55pQK9T|RCLjQaDz!OV*$$qb~&)^9+Pv)z;pF2Hnpa80ikJ^DC->SQi
zf813-{Y%Xg+EaO4HF0uny-Joi+s4-|in>;%yDR!u(%xb#nn$FQ@6KY6^$&5<!4~df
zzHGu@k7}UZ)PgKDcGPpk&D3L&Xd6HGvZoPSLWv<Dj0(Wji+`^Ue@e`?fa^akz?4PP
zA9J$jW6m6xnzGBjDr#T13tX?9sH7YTwiY0;D8{uhp4hahew|?=?uyYSEe(3!xtlJ4
z1J`KfWB!=~V##&E&CV@Zbx@vtv+WEA(<l4NOd1S690*-4C9{TjB?SA9xuZVZH^XXx
z2fF|zfw_U2<m9Sp)hMwJ9#4<B!H%FAy?@MN4<KG9c~e2otOua)J7d?bYcoz5T91BO
zEE-8OGhJ0Tv!ieWvQ5e8JaFHympqu$hD}nW#%z1Uw7A+D&~aDeB+)Z&7r-JOvD=?f
zMM{2gLTCmy;a0T%xSB6g_zb!luK*-1r=ddNqtLY#IM-96U#|h(TdQpL$Fl<^g4sdT
zf(>u(Syg?#uq*%#ik*2W$dRU$KrP+F@_@Qt9<xYUgl=A8eF^eoG(tBbcSvobMJ<H?
zB~&%9@%ty%tuX7bqJgL}EeANc-i97_O~wW7PS#H1_Z_YMOT{F7Xiu38Vj60X(wI=#
zbYZmW+GqXa6ks@HZF0#iWhsrVz_0lU^Qlya=Ft_tmKw3M|4nLKF?=nC&lavSU7xxv
z&96@B_NuveeVm+!z^T|{e(7Ro_gK_>le50)vFCBd>36<CeW=_RR@|9|M0sC=%Pxs`
zFC)Uo(jP5o&slqKp}n!L;qg~(0ez9L0iedoX{a?Spgh6v)ho0cR<4YzWUPHMTls#J
zaNtK4zz+;t&kO*0RB`F(h5><As&S3u%1Wi~jo#f(O2m(5EY1Yd67?uZwJ9zfIP$Tq
zS-+`lUoOYr4;OEqkyvu}LB8qStp`SLJ0>vR2r*Ow;KgM-wg13}DtBzNeDe7+qA9}j
zP4BM?KwIS8C#I*x@cxTB3uTMdarPn>7cGcwY*w?su+SR_)hUl6_k7MYvIudTC0|`C
zo8Xh(Q~Kyi&lyBU3XUl6n;-q<@vZYys~%=Bh>9P}4O;Ax@y~@Y-AKMgD!g9Ysj;dD
zX=l}02fQ*<@h<0Yj5~Urni8s)SK^J^C_#RgEdahzGgOr`B23WQW3GEwN3`xybHSr~
zR<M*pAv7dn6@M3GF`qHvztEsri|8mDsQaj$L{VQ{2fF7+QC8GDr1<Tcyx&3U%E|B}
z$<+65?!uw)iLh7XDP8Ni_wK5$Xo{(~qn@*kR+i4MPMa#F#bKuv^6%&4vg(kK3PJNb
zZ(pra>ISm=F214k9+`w3qoptr3*DdZ^a<(+cdnD`It`Oi?~oNZ!te*@82+eBby?l6
zEZ3mDQOan$iS=3>Lmt*Ml3%8_VQK=2A;lpD3xRL%aiv5JlN``nPC3HsOFOa7YFVW=
zOKK+PpY~o~j+1g3%V*^5t-xLK9ke76%DMj3?YEtNvwFyx3TtCe6Xf?vTO4omYqqIL
zDDqmrtoxGN*N+feHUxAwKMf^7r8LheqYEbTtM}X*`-ukG(G)1>a_utg^qbg<Cg_V+
zBb9JqPAus;ZU|kN22f$$X4kwMCWIt%M%T`NB_#c1y4vDe^o()bx%y1moJvQ%O{W`c
zR|a#L6(ll0)R5Nno9m=C-x>nu+;%#EYn7X=6zqHL`yG^OTZYEY3X5Kepgw|0k$HES
zUvJrRGAdPn!1Typj{JpsQ{bbKu8m&@el#w@<ZhZ<5frktYkbagd%^U;Xv{61O)l+0
zB8NeV55ejH@!y@TXjkuR{KIZD?bw<v*$bh@dI8l1`c$z5;h^#YE<<TfZvl$RiU=wm
zVQ7=pj7+8y15-Cj+FC-zGE^aufC+=s^MWtE@zr#Q3h=vs6_MU+#P+b7$Od1MU8~kd
z>jcuOb6JMIfeos=7E0%<m!mrei2(eqVhUFG;aH+5U3QD9>>}B?hbdhABDK)XHdFBS
zqJ3VV;yNUT(L~#6K?1&uD#ra0BUXOg@JBN?XR_s$y`PXjd_~Iaul|FYP3Kun)A6K;
z|H1d$qUhIgZ9(8)$Ioe#r>OMVN;aM4!|mF)-=qweJLAx`SbekBi0LMkK+<SvYi9(3
zx(O@5EoZWD9BOp@-p*vnlGO3!aO6zueV2Ah*E{ELDwWpvMX#yONO#Qu7eBQUdr(w9
zykoM?YwCmD%7+D02LdI;Z<nt}d19@4=}-w<^*Q4Nuu$Vuk+iD4k*M3edTYqRR7Tjk
zKvRiZV!rfM2#A>2L>pqMefSauqa&1jWo47Rg>&7!RSXKYtj8^OTY3cJO+euUegjg5
zDx5cpJr_Amb{x}FV-0T%`5t>T6Y9#d7cg_43oP*#EJ<cyls$tJne}|#jTV4im4~SV
z8E$mais#AU(Ao1#wM~a>eOMib-<)VcmcO|~XTXT?xU$nAmH8^F%mFP&8889LfKB}8
zn@2akow-JEaF2k0#s|6-4+SocqBsBYT`wcDs6M_?EGwj?D^}L>v9YrL-c#ayKRM6b
zK&SU)ry4)pT7~w!Oy!(J-ftlQD6zFJrEQYes66DIEI1Krs!LN)K6x$1<#)T-NFs@-
z9)Ly~X=iA{S=o@Wp!O3~t?ESzkFz?_eR&=tBQK^a1vp%XE)kca-I<6q{!&Jx>LLWH
zVXLhf$E!ZNlAT+3uyL~g5T@CHp+{J>Z%`Gj1b)FMwWzqd=IJQ~JL6~cEM6kp0;0Fr
zYAkK48Sc=$tAB5Npg^#@%gC84I=TA(Mxdpt7atYBD!?@VBott0;@c6t{bEGQa-w=M
zOXb?QEB$Z4#CT}3M<UN+(DHyaST7HgEk&Mkj(^Zz?S*<MF{xIbsYz|dXT(g<Z(rBA
zkvq-SLE;8posNL*wtlwW>a;qm5evHfC7#+ak4W~3TX|J1lq{ZSdQkIMv;oR=N}F3(
z6B&kJvBGj%Cy+$bya5pAgXah;no!7qhYWZ!kzc9xg|~j;2cm+i?0(<t)WL?@F&mW+
zALpV)z3qgsp}!j5oi%Ul7nQm11)u4q)1#OTuX7uUus5QJXUbk=lgG0WB3@k5(^-hD
z2Cci7`>#SK(@M4g-8|o;oNv_;vD})Xq+m>XS3n+?|1hi#!!!e{fByg4yUu^M+PL36
zs1AfuqpGxawY6#$rCN<GDQedqsS#Ql?p9S%wDwliN{Ct^2~xX8C=n}0QB)$d2sOfU
z+@9xec;4KvPLdbr`kb8W{C?kco$JAOE!Hj$n~W+y1NDaOa>ojji6^E80r03hCl)B^
zO^MoP`1e)isCqdx=c4#hV5(K4FTe+GOWg)aU9S)B>)K~^iE-~HbHdt;#9Kn~h_0<~
zE3M~ZRdo4J?Hgur)rJaq9cDh22Qy(?*5PE2+Q8t)!VB8|F>Q9P@cms7{(f7g&}5B}
z0T0L$Q3)~6pp%4bp$!15u3B!Vv+NQ8{^X)oBSj1;`DA4>qttX!E;WkHN@x?IfsMQB
zROtrlLw(Y)l9*32Fe#<I0x3zJjiqjig_fE*%_H+4j0Y<CnE|f>K|tMO8S@g={r;@<
zTb0xP&$Ey4^xoyU5wbfuKTo5UkBQZPor8J(feH-Tqh-<di{d4=(1>i{<{eVxi*1We
zKOx2g<8~4H^!D8kK4OWX<7sQs35IK$c-1x9%i)=RNpoh+;+!85>pQq1MekF3&O6Xr
z!5dgywkFJHo#DChg7?R>UwVsyGjb7*lU@z4L>C|d+c(HA#ayK+mL+jS@bWg6m*A^D
z?klwS0o&0KvRc?9eJK=RcvrM#33mUwNCMHx99DK&y64|;F1M6PtkZ5=las0%=Mq)!
zA?vZW`3tiPaj{0m3}m*@V>+S(%?VP{->vBL{>Bo)!u(<y<^Fj1!WO6c8CYID?a>yg
z_}1l;xm%-(CCt0_(MX!28rwzs_Yv(A;~8DF`lG5x*2W!?-s{Z`17qw%pEwQep=N=L
z)Y$_t(|3lA24&8>u?~5O9oE2X!vk~ds5h}CiH8bdZtnfZiK#VHlNJ}MKG;(7FgZ7|
zToG39+>%9XiY~dw&X)GL(AGWFD~gz|p>z<gDbU$<Hsf_&pF*R3KS!ndg^j+xfloJ-
zj^J59wotj{1Ms~3wNqP(MMu`9#1bQgQ|hjxOdPhAO^LU-|5HZ%cSPt*!(S*yNTJtA
z&PAwe0^#wK;CYRUlhsV!q&ipWek5C<BKOuL$Y}3ND_O-M_)iT7hTUIznCm#+qP6y6
zISLAR8Qg#sX!!E^r&!AZx<hp>6Q3{WrVuGUdv~^IS(?2Pwdm7bZ~wJ-#ppDHPk3SP
zk)IzVjW;va?tuqSSIqj)OB+~uX79Kr{M!uPGH99PWebabhS&<GXaf2(61FLZf87q)
z3}-R;p0sd?$dgPi1uWf&+u}C-j|PieA%D4~`9`0J^)_yIotU<?f_d%yd_*nd&*?J`
z754h(Ts{)=Xlc|PY5v4cP|y>VJB?JH!|G=U$&SLNb?D|v@7R%6_-8lcu~M{tsC&RB
z3(I0BD8>q4Rj2no&Uq8@CvYpoG2zJA=w<0ac2_m$A}`7G_W_zH?(E`^!Z{B=oaWI~
z#|-aaT96f!hS~L@6c{a4SvfMw-3iu`;^X9Vfv?aLH%e%?ney0u(DjlFOvub^8k=~t
zBEK`5>y?bAR`pVR$GzX1NhKFj2tsu0TmEFOFQ|FI+}&5DZaF81py5{RTvd<T(4OdB
zobF!Rdw#8~3l*PTx7{}gAy52nz6k~&yDfIY!WsAS#%ika>Qt}dj%fl>e*KFfGkXI0
z@avo`2KiEjd?$JBj6LYOlOvmK@q$^cQWQVJ!OYC#<6F%(?qTAPyAZ@|T;EfD1_-yZ
z;aS4=-7x?usbuk_BhcEG>`v@uUvA{7=_U)X4%vI2)<_7qjwpf+Oqg;++?pFy;~sG8
z*1o2fY6`hGy7dmyO6aw<aI?H{%i;--<CcO*1};k6&$lDJ>cmIVa7IH%-P`q&B$W7x
zd=z*!yIfsO?z~p7+4qWgdQ9y;vn7W73<r<~pkOE$HQklbo`JpS09~p4+yirO%#C%8
z)Lg7UC)D2UN^cOZ;FUWA9=h<cCs*CaJqQi~DW)MCx<?L;<4z1Ud+-w>FqQKtfhHAs
z7lZO_PP%7u=8Nm-x+q^YUvu-bK)2a!A=pBH>jH96sGCx$<Qp)F7&{dc`NVy2)M=ez
zUI`jm7;Gy0CA39pMZnqNObIjQv@Qp?LYl4-AXm)A80^Vr-KtV$SZnf~5p*t43zL4T
z`o_URPNoAkZqzM6Kc}wI6JgcSa2ju6ZsYYYnz8=+T-6>+qOwgvs-mM1v9g0Fz{mgI
z3v%O$V`NKjP{|M6v)_s+CzqC&&(gRwwdMDUJ5#ahq)BK3FE6*=@4}kQVu2g5(;J~T
zMp$U<m+*CeJsM}9F?lB^0>OI$l=oKo7<*{>w`2ge0PzTJ!;{8=FJ6^)S)roQE%})_
z_sVY4?Bw7<T5Hu9H~!qJV_>e^IvI2?T(<P!Y{9^gs*hU`gY#HsIs9Vq4RdFcc59-u
zZ_j0y(W1)BUk^X__&+Ux!uuhAR8ZF)PgYG&mvBYvY!qB0SM2#D)|5iL_5*N}Kr7hC
zz3nzeyMg3Q(5n=;-ce~XynL?8>P<EAPv=O`Q-)Z}0Q^)okvjAigM<imJ~RgVSLV8E
zNx`pDy=NBDw?RS;e@t${)t_bBJDPVx&#k^Ve-|#En$)Du`(qC<wi_}Lxzn8<O5R*X
zL!s5#-A!ddE}18~`hMRBN(glW;9Nk!sJWc99&3mxoOKLI&TT8vx|`Jh^B5EKKw6(S
zCsndlK`^=aZGE|`ueU1e4I8J+sHAd_9M>sZNbP4zLW9|wq~{`O{pN{DopiZ$lV4e#
z>gAVdd~ck&A_emX6fS+N4eVRuPr$6tS<ZP@y0;eF@*nm{k=W2~3>EvU9s~j~hsZ64
zGQgk#KPYM#RI4f_Q!$b4n=c8GF1s#zOh_7OT;poB`#>)42-<$|x;NKHGy97fnMeDr
ze>sq4^9`=*ZHIe-!ajS58mmcPymAxO<5~(6X0I`Ow{9Ekr7&rcJO(xA9NQKrBAzCy
z-3|%+6!=I%uNiG`h4!vrsT0Hp#vCA!!`_@V`m(bD1{<@yRduG<E9R(ANvBxd2>tmb
zP!9U)T`a%+QYU6%@72wncv#V(HgZR#45vdc)Qyz(_Sgu_inAoAA&6a@-3wc+i=D6*
zba3;(P^#__>gVNCX@o(>xe9NcP``Ivng1-A^iiFu$lW~CH%cj&I50bN#u-tHiM+`k
zXZ*@uF9x}WhqKMDnLh2_R*n9~`#olMFQ4KQ)>3!HBA}V3Vh>#vY(&QZ-(>*&DXz$8
zP$<z>7c*xzK64u!Xv<V)2R5uY?ScJWzQgl_E%6<Q$FrqSPiEEcIUIZ@eJk#5G*wtc
zO!-jy$!X(aKEVuHc)!-vd3yA^J5_0CF91Wj5x<+C-dXl)r4Ui=mMAx)+f}(S!}Hs0
zt@ykYP9Q%?$y58saH1`gW;2o$@)i9<11N@>YV$9x?=z7C$-4r&jLjcQ72{c4e&S#J
zp1#}0y+;%@rx6#0(rKcR0f$|(C(+>%*8UK6@F=@rh6&;3?qj2#Z)KIL5}xmIazDwB
zn>EIeXps{mXfW4CuY%%Edbl9xc)#nIHC!&pU47XA>RP%sd>A0E=ltc|Ul6PsP4;b4
zg!l`>O6Zlq-0Qk$2cKM(zj+e$<)N+v$o#|3ud4K6nENskR!9FjN(z|uF8EgdP?p*c
zF2UbxU85#Kp<<AssfV|1(2CLNV$L;1#RG=6Wb<ydu8k_;3_cP~t<X|ytGc4c{S{79
ze*0CuRx=tBX~gZ%a61SH3Y3JD3R!=+KOo^NBgA>lC{8Cr>&<{C9z8GYsP*D)3NeG%
zLRd?Ls2@k@fVix&V`BZ*mDe;Z9SpY~j10hjx`BwoW4y)zk7>*}TFxU{<owS;h8b@<
zJ*GIjN_yhKWKHig{=n}ax4L3r#_s_f=UCaW_#Am4&<M6ao(i>I9FvCXv0TL*8<S>n
z<0eEYJ-Gtz(7bom$?=nXCuM_pN~i2K7JSEKxqkq*W^`q8rgp65yJIScZ*)iZRsF_n
z@U!Sj?|#V1!2W=3y-PL2Uto+v>mhTs!78a)@niT%06oP5;0f^7m+yA9HVC!4d6N9g
zsk^Up_%wcPR*Xln+9d1Ozv?m@ua=_NCI1;r9_KBLkM7hu-k<l$Z$R9*8$&@2)$2sH
z7C&iu?|T1Fdh{nXkx1BdR&}@(2I~D+iUh>B_PzDK10^E#h1K!YU&s$KcS<$2w%5&D
zy<aK7sl3(gf)2+>+NsW}C3#6&_R)I0HAJ1WaEmKqON@6o3*UF25Mjc{*08Zxb8fSm
zBWI9a<*@-$UfQE9vEv2Ly*yE!`egG7Wx<ofZZ1;$@tR2>F(3*&Mc3HOwz|F~IV7%?
z&WlYgu;?3o<11qZh{S%N$1B_x>Ws`p|B+qwLQ#j`{jqmv^pUw{Qao-Acxd}DEOQOS
zpPHPRxe?sW6w{C+!~~MjCddt2{q={QX3C<hxCZ_9SKUb<?RS5**0q--<aVnS*_T%K
zZ8ie{DgubA&=<jNUitSYn?rvlsqWbn)w<vu@#@lG0#qyKj^NV)S)Pff5+N+4^AUY-
z{go-*P;|pY{MTNentv*)do!qWlJvVtpWW^lUlM7TzRC9i5-xV7eQL{_62yhs!tFLW
z#cz&BB#^oL3+3I0(?OHt-UhE+-8_&d@M*L5&=v6mFzGjFWwuv0Z1_V|L>ikv@@#HZ
zQfeuLIbqgKJ-LO9k&_v5_p-3u{`Cp#lV|;)e;sji>!Mzdy&{c~>m&Psc(S;DwxD8~
zs><L*C>$@P@~qPM?=P_P4z3p&#EE<4eLwl}2|U_$w?Up&aJn=8WZgQ>>;5#?kpBK%
z@V}?-@UQul6(d#bbHvt)Iyx$p*D7Y4bW~U!F^Sv|yWbj<x=IOMJ3mj%kK#Us6OA4n
zd|Z`w=~PzG%FzI$<#;Y)qc=!ZpY;YS;ztQu4UO(c#SHK4)J-R6c~mXc!d(AEMu1-*
z(PPPz0`ciz0U%DtzJ37!b>|uBB1uUbc$>|Ru~oE@B`r>7$rK-=&I)P$&`_5r;KJ@R
zBo9*O+{N0Y-^ob2K5?oBClohv&ya8QjyQiIaoq=#mrX}?ar_~j%hNBbgLpv$x>u8S
zxN_cRKc8q?4(d*nF)sqdM{4qc(pl*ZwZe_*-1RA@Y#I-INfJ*%amlCr8bUokreKkf
z)SQ2%Cefx*?VG+)xBvMxcJsutw6u#3B^BCo!G8l}Ze{je_%gR%62hGO&cQYRbP$_~
zpcFdB#Iz>ITET(*-sJYdFj3z@_tt2=($@eTj*}aLRSiru(Uh`FhcMm{kV>!8?L?=P
zLd)GOQ(ZmRRQI@~3X6Z%#e86~7nNGg#<wx_y4lqHJYl2ycihuDyJ>sT2G5FS4!1m0
z3{ns_Zdm}jx0%9J^Z|#{t~C^S$f!{<LhWQlc~+oTe!m|x{wUtGb8QpM(%MB3yzAAw
zJYvDP!s*b4Xm6v6_#x!+FW=apKzbq+F4Z#f%DwgzU63c~%P!gqGd&&GF8W0;#V@X(
zK87s*kYwpN9%>*Z$P(NK_&djk$v}i;A2O_tpoOB@%S8vl<{o{idVQ<Kx`ufOqv}(R
z9{An+-$~nS>75R$)zx7a6T+y-6yN;sZX06@(6Ko={p|Msp_i5G+Qkm)@opx`>V9w1
zxFj=vr-&-#KXRfrm|MWF-O)#N^J+t!vc2gk(ehFEFAtNGF5;<jom~f`llt-x(Wu<s
ztMzKK;AE|A+pzaq!`)FG$i_+YOnbC7ht=5-?O0a_lq&a7&|pc*0RP<}gS*@38Fw_j
z<J_#RldsFsY4_>+u{uH(7Ku%=F?YY)v*~$;Pv8Pn!sd@L-Kc|VeZ^-xthBNAQG=!7
z;`Xjfu|pGN=^=R7k#dPfbnrp2S%sg*oxwl%Ey%H`GGzCd>IRfyh=kYz3!z@;2Nv2E
z(itl`;QXfQ^|dMQ^15qRR}L4*G-r#&4{Y_dz9~ZK?cE7xg?S=-eZF@OGiuFBm2(?B
zDKl{27DPRva`<$MUuhq<5m}+GtJLhaC|+|K9|*ME{bbT%6Rp>A$Q=ed3HO!JGmo`0
z@WoYK|4Oyrm^Jx02i^TA!X<`!cEK2qzT|>*7NYv_I0yV?E{^7q)4IkuJi=AvU8y!L
zXQj&Bp4skc`~2l;>je@dqW*I0^#I2Lf+H%Kc~5sY^gK;A*7>aBaw~FGQ?{jlrS0NW
zb9Cc9b<!3aVb*_ThHDx(!4~JpE@M1`9ERpKe`L~K3r*Z6S8;s-eTXkF^fCg)D4k*!
z8#awV45xFJvvj*`=iGs9LlSFJW<Yn)$Mr7bOh+IIcvt?xyg`}*f>j&i<mp*#D%2}#
z!)rVqVFrCmuv;D-i&-Nucmu1w7?HD?uFuChcYG9O?eIjn#LbeQ#g53Oq;;EV)uHlQ
z`!?x)vre%3U(H9R<s~1xKw!M|kb{Q_?d1I2nOgJQOJ^7lljGPx()L{j_TX5yvyI-N
zJvZC3@-@d5_<h7Az!a*@v%g9r<cog<(&_QzbGRg_xX(|;c)^}>VkQ>dx5G$R7r!y@
z4I|S8x;)ewwfW=Aoi#9DqQj_WZ&brkAinZ&0w7jT0Sfn)T5IUprrq3I1E%EGeO7E+
zD}v?aK4}Zqc7OEq_ziUv=i+xDjfIC|3y%HDa}~cNMcVuuz9s}g^ZC?(9Y7NneUoZ9
zUf6G+*QE+TbQ_M)5sE>Xwcl6U@|L2j22B!}OYo?DgUT}me=s-LtUSSE98QSzN1&LG
zcMZF^aGNRZ;?=+7wniu-ifWOfGc4!MEnt^&k_FTAc4Jd$M=Lt9o3QH0HOhP?C+z_|
zMCPt|FZq{cCB_UEK$TJ$pP$Dc<7E$7^FegjvrONSx)ahxj-PFsNf#dc{02S{GW$%v
zT;iNR!yo_p8X)uWmJHjIy)J3ACS11qX!~Irm&OOLdI@<{Pk3isYH@S#+SQ)0k@@ov
z|Cp%C)r%RcbY~To*oD2oxzX{OA+n-^X&G&cj<MCuqmfKd3U-%1U|PX1+A&)|c2RZA
z>8OQB8CZTnnV$70UwY#4GUec+FOg>xrPn{(Y`1@2yZmf{9DK{097#}}Etsr9LZ+|!
zC;T7@CvjWSbKwti%plnVX@yIn8JJ{MQet}77NaC<n~Mm>FqV)evR*7tCtSiefSz~&
z5dh62ywa)+IDfkV>T2+^*bAn3P8C`l+Du?47tOyrIlandART<JS{|d*6Oty5g=f2S
zKcG|Q-GagKZAEY=-dD~-qh|H)&{HpbJ4^R6?QH&3dYJnXa#4T|XYg;9YCjHmZaz;t
zcglL>=?QgDyO?Z<MV@cxru9Ds-wnt037pO$bWf`^o|VlD9>g@$g!Kz(zJC@bGQ<O^
z9f9A;qwe|!zAJo{(Gea@&c$;IpM!J5Y|!ugOQwK~(3XXv3F=B82d^@o`FUg~zynh>
zwckK)GnxOJ67?%Be_2L38Ibf-ctX4y3!hZ*66(zvk9{;;r&l5b6M3Tl1rC)Zjh!pv
zuaZV-vwKjEo9F(TeTmRj^#`1V3NrUBfdk_|Ecm*JY*>b$TQ5ELvXGRMGtT{5iFbKu
zTNiW3OkOXarpQ)Y3XD8^X?bX$y_5rGCfy>jt*R#8NlMPoB9~XVGlbhWaIM!k6_Ut9
z`3P#Fn~W63KpSl-<%yF=xwmt#6i9e0W=Ln;%&n6y(5vtyPaORwQoUQ{@|PoBpdC?T
z0%K<=A3DTR_28a{=?#mUK{Y9&1vLpo(7;iecpjVC*^Nrd%1#?~P-NdjfdP^hJ73KG
zcy(v;fXta{$fFlU)h!WN!9;=L72$2%N}*l<1sB(mw-?vD9qYX+-Jized5C-~u|>{K
zO82Vqyu}HKY;!ROF<bXk(zpvFrzTARXR_z)ylht%cH8ew!<k9f)Rr%NK<YCXSi`kn
zR?~KFSZ}9%9mPL@H-|$}lG_4@Us}6*z~2lAV;gcCemG#MtiQT2WTpNjW>jlfv&P>k
zQ@r9Msb<+s+ElIa;4t!~*H9A+v6O16!)=MFc&|yM5AMRqJvgm|D<S}}VwN0GlRHZ5
zQFh}ON8U%A<Nj0-pfRMm==e>><6#jtwe_~orgHMR>luBy8`z?&qNI$Cfnv_7Ph2zz
zeNg@OJ!HJ3<({ndwyk3gyIWZpf^E<N3T*V~RVJ~>b}(ZWhFiCux0f?Cpx78M$$C~?
z*gcJ=COKv6ITKYo#mGO69T{DT(o7|RlHe|jhVzk1HH7;%WNz6(j!<pBYsrs4>cG|i
zA-k7ufi;~JzLzd77A-2t3{zF>#=oL(4c2=^MVCq+#&?PVtD*}3S0&KU$&*Jnk}C_<
z)vSN_&0l%U$5KN$Zg*AzmOqO5k(LIl?EUj2v1_aFQ&o)$pWR>O$t{(JUmvm}wz*4+
zC2X3N(!kk!vw0ig3Kl^Zcb0=%Hw^N3=Y;0Guh#F1za=^sF$H)ZQnsVVS}y8ujf#r_
zT9Jg9Ps8|uD<i0$_;7dS?zkZqBwi&p$rVNIqa+xX&6#A9ZuvI+_*9+8x$20%E{VCH
z_M;YGHFavphRKJ>7e|kH^9{c|KkQypj(z_sN!poBMF-Og`vSj)GrPgweJUi=@guU%
z{D)$1_%7089$A`i_P|@kUxeMKz{vr+jFEVL8Aw#m=Y22=nIYM+uSdK0(FXnw`bmgu
z8)=`P5+=U56{I_Fnt`qs&csoDBKF?6Q3D`h^eJ40$n^2s8^@I<3nx==E(Lr}Ga)$~
zbKhRy62-{KW{#VKU9z_Gf}Yn`EG(W!n^LA<w@LTRsZp{NzoISLuy3q3SEiek53sCq
z3hy+eeV)gOH(Ns{@+JYlqxM>2RdX_s9nOD0y7QN*aUv@2Z%KAwn3ZLXtYfMBrB^?x
z5u=3k#Z8h@j8md<1b#LP8AtH!GIO>sK5o~$b^TY!<$Fc4_e${B7dxFVEK+k@KGKf^
zaQ0~U4ES?02!Wn{K7yPKFf+zVf!#@_u94GDe*Td+P@`?>3F}vdnl3O&&By(Vh||{U
z&X*UqAVrDV%QH=*teC2N-Ga%Ji5qX%eyi|D{Oxnt)H#bc@Of{Q$$IuuIZBE$16<Sl
z-PyC34jnr5b?@~1XZuI`kN*z;{RRKcg8v?b|7yX1<?#QdBkafk!|v_Xfs=ZH4=48V
c>(N7pniF4D9*M~UemV3&TmK$f)AsfM0A6x;@c;k-

diff --git a/docs/images/pr/chat-image-delivery/remote-before.png b/docs/images/pr/chat-image-delivery/remote-before.png
deleted file mode 100644
index 8ecc682abaf93f3c2e7dcc35da60939885685224..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 19007
zcmeIaXH-+&_b!SR6@k|R2qH+64odH+D7{DxHS}H$y+%Yu0g)a$B29YlBoXPo6MCo#
zp@kA!AaM74&iH@1_nv#t80UODKgP(HJ$AxgYt8b^XFhX(d#9;Hd57T+85tR+it-yB
zGP0|~z{l{`Rp3hdq+$pe**|0|Z(iy7rEksOuy}}CINqDS)jEHl@5<|sx^sE_9og?p
zjemBSMJRl}+QCiL8gbK?cSnb>;l|Y(iS`elrVy9&(=K9)*;<2vvw_I0zP#q@YGM1q
z{`AuU$@oPJ5r*2S*9r=3tgL?re*O9-a^Cz%WZ?G|m8g|FJm=QYywcLrO2Xvi;j2CI
z&hP$MJeF9kMIw>o&EpN=!+qmxWQ)kuIkV0BX$X=Z_LqPgdwlmMr3%k8k58XJtITxA
zuqag7^oWp=U2wvK&%~ZS{ZMQfSACsI<#A|es8N;82pQQ))-eI6i^D$kWM>)s`b{qG
z^$Z!=OPHv$L8DM7wErG7joV|Ljhlgt?CUdGMxnZ2EZ?R+fB7;qJw4)lo$LcYCnsm4
zT(7>4f{w@6uU|bpJb>+c=>iE(D9-(oYeC1vw6nhc`wH2IDRz(U|900?4>Gctr;T#=
zCE_9!^z<Gg=PAfOoU9VN-RCrU-cXW}{bUTiMn=Y^v<RF)?>z}JvJa5!RR6cj!5)i#
z2bh70V$`bpcGhZpPkcBvGq9RJ@}uO}qq}}Ei@PuUou9Av-W0<iXXS#4dS~`iHSZ5*
zYMtfRdDUP7NMAhSCK=iI*@r(P&Aw;?PWXhl(BiQ)S89Ta=hPC=t%3g2Mm`|xH0}#3
z2TuSG5y1S9gn(I-X{{4Y5B<KBZEu3Gz2@a9_B~PQ%9ShdfI|Vj3gvJ2^AMLy1>N1s
z1LK<&g|4$cU@-Uw1?}k?j9zH%?~SZU*V)Fk0d(&BYU?gdLs*OB7)Hu_W33OgnC31e
z8+7t6OTwzXn_D-Z^0Am{fNrXYW1TxXBsf4>Ss9HW-Fe8x9{EJd=47_s-S(HZu<G0+
zX}k1rrR>qXK7RAczfHRoa&n{eD;udupY0}RgYsBzL30G3_Af6Bi=TYhcr7O<;B+df
zZ!wBGhY;JSbHq!~zvch1q_j<l{%DEu8$kps$s^AW;26?wn{S%9>my;i5_Rf30p9Dw
z_fCa9I|<J;82V1siVa-n4%SSNZW<k`Ycn;Dn^<2hJ88(O!w)97ajjErz+utXuiZYb
zv*DjV_jsj1CrhS{gzXQHz_FZKJLSloTx{}4PM2x3Pw?5%KwlF7bhR%&UD8uT7yHHX
zEIQ*}Y;3Usf4Odf0UjLej&9-@<3NbGPYQu{OdpGvxK1?L;^jyoXRcbnzlM^$wKv8K
z&j>i#V4@&krtkWfNcK<ULrmYid4qDB&-wL>2UIlPq)}`)kjilPW)=mVW~Pky;YMB*
zy>PFKfPg?8i->1=*g4#$hn1Xs%-F6!c`Z}^l3G4Uuv{&P&mYr2?Y%ik$tYog={JH0
z9-r^`)d>YJv`A)Vejdt{HP3!6>2FeEID#OZbw~dFOi^yyxY7PCK9LvH6tt$=5kWIQ
zKW|ICAO*IyY2e=6S1L1YRQ%4sBB++YRp~MvA#6W{_4PGxw#!H>-t_a->Q~~BCm#F=
z_r&y*wyIM*BI&B@>xVXz>OGcT|GT=aYgd&b9&+0aWlGxhuZM+Gl^%iT8$D5D1w-no
zA{T!<`Z6<_0%raJ>@!Jz|F6aH{#su_0cEB8WoVmH^xel&{SF~hR;V)c*4?9htK%JX
zZgCr0{?Fjx;3JwfJRXW0<?vjr;9bWRLP4GH?=)ZmPszL<Emmp*?7~X#T3^;g(e!Wa
z96qC}WXy9_uF8JCK5pZh?gP3Z(Xr>lc~xtwCgRyapR2%N3M;W5i}C;FI_K7v^g=cc
z=cm|(h2qZWQ^%e-j_mC0drM1HRMEHlc~%&|B$G?B{rzk6kgZvb3U~Fr&wC~*8|ATl
z^L6I60c<LpQuNkzwRCgC-6v8FhLu*SjbZJrFP>4;Z}Gi#9r<<o?SWDxjUd8rul(~J
znt4QUxUJfjRqxZ3Hj8Lc_qM<3ags&_oSt5Bdki@v4%}#RIeQ@FUt}I{FZrGBuc6F+
z<Cv)I?d^kA9X-VrZESMy2A!X*tjEOsgS#5b4ZS$s1$;N)aKk|{Y$TsNTPLwMMaXu2
zzE~-p15{*M8Boh$*5oycR%IBrj%YpaluF~~c++)_n)=5*wl6(d?&OrQ_fmkbZ&bGn
z`c(dU3za`;KHLV*Hj<Y6{*$mMq1U-r$jA;C>cbTj)jxjx7<h~;xZJsOde$|PWBY+k
zzetZm_2Ez=FZRO)8d&4&n@Un%>kZB*fq@`W{q{?Tsfvq*U~&UKbM6e*dbfEVP}wqp
zzS<_BkCy+Lda~cfI398;@3(6a&Dc1UAzff}U$KPgmURLS?=<0bmq|#SmNl5>2eWK1
zOt2gwkn_T4@j0>-gj@i86vk)t%wPHD2jFMMf9X?@Jcm9qAxTFj78Wr;_<VTwfhCcK
zH|filPY(qzv?ogjIaCw8Dm)DvhSh}SEh?QRdYgUm0Rgl?;4FC)Kav9-S9fGHxXxwz
zd$^^sx_~6qHZ5u25dkc)a4shhl(JA}HmjL|a769&0S4x~zB@2gX|0;X=SXa7wW#TN
zoWErmvTD_vphAAk+#SzZUhIrOm7}8=C0PT$Os%l_<kthoZ(1?ze3U*dAka8d6H603
zpG^W0vGdJ7vOWaAp13?wAeSUBjpQgzSKC7`1+SBnpPkP8diKQwfmnhW9zvRFZEfx8
z!Og4f9v{Q-Qc|74TPvprSm4AX(jMPuk$s@4*+VeDvoCk`>eaCVEjnnES3J8~lKM5W
zrz}61<u85~v)?~x1(Mi@%O}^PbN?b~DagnY*nqr8wswmV2*8q8$pKG}{sWx(|DMZd
z)a217^=@Vo_=6q)GIM0e>1g7~7_(eZ1CTtn%{M;|0k$USc*%q+GiwgQ?Vt72-@jjF
z+c!Bp{Ep=M&SLn2L{7ylS3&|!Romlplzxb`#E&@4!JUtbLFKEpL!TpI0;C7j-rTEY
z>#vsupGXI&8=Fy{G|N5p2)dl7-kdBQiyNO7wm;sPe*h&S;Afd~!9_^9kgfLEHl^hu
z&+XpY?b$k&_-vAJy0q^Fv33(Le>u{oq{%2>MhZ-q@LBeFEzOE3(8}DILj1ee#92J@
z>|(ezY{_yd)#~_s=ZSQZh&}@&BOmM+05c@UfUsWYI_<N9(Fo4WkbaPiHOFpDI1i+X
zq2dzKlfegcEkUO`U}ibUNqZ%9Ia}bf>7p(7D)jpScBoIo_#^Z7{DZMF1ofCvg(vLr
z7O-P&r6%?0%T4TH#@Wwj_bv~Cr9GnDhiY6=I9E}F@gsdN5#9re)_Ujua)qZo35B|M
zZ-yNWRX{H<bPF`$m*=v9hwG!Ykw=17erOL^m*~)(zb6FK&t0Au+6=vH{SbOh?v(IA
zqY~Iqx0x0dwL6e|acbIreseK4_V&kpQH~SE`eRt5<YAdhMV>)6Yp=kOV$jgw<(vX3
z3(^&*ceFDfxUq`6E^mwoIwb{C*BskPQP8$CE@2KXuN66?!H)N}oL`EZg<d1i*UTUW
z+a;!ryG&Qn@aS<3dYPM}PY+shz2!VHQSh*^VrQmcV%a=$;Ka5wf`)f6t2qWOYu@CA
zBjB2SFU6cOe0cqZaxgN<NAtB;hbm2}T6{g}jQZ~GF>K*%r7Ie0e4vYy{2CS2u)Qhm
zI#UB=aY+uX9Sr7~CvflqJ<ECe#Rjn`y5OK^S}DZMxV!?bte!+(drW_dtJ(<=$6ukT
ze0r9IEYClA+7Ia$8o!m&UORHW2r9Q$il*PX>wkbroL<FD1?C;64aeM;*P3b!wjWGy
z1S9-j_{=pV@)|54FO_hkd8<~|3k%W**q)n$5@%=h<VxW({_3;R#I6@GL9>=Xlsi5X
z&Y_m59{+40L)sS;=+B>w^~Q~^@ugJT^rUiV!b=S+_le&hf2N?53OR2tN?c&c&R(&F
zOZRUEpIY@NSMtIF(NGU`6S#3H^F?s}Lq#zbWMBwfZVh9-^sD0lJ2+eEs?-@ppGU#N
z$7hPZq4UB2K;x`Kk4*RWGVM#qT&k!uoq%aW$b3^^$T3AgfE0&s98TxEFMdwae|fwl
zMc8(Z)2vAZ$ZXE}XNeTCv9Y$jN%WEsy`lu}Lm8HQ;J4(T{*i@-Y{rpDfRCQk1spn6
z;q%o~X!kLPJ@K6Qvw0Za7;8k_994q}((xLoLz_LjqJh;W@qz}8i-4pJM7QcBr=9dh
zK`^2}OFm2PvilxewM}mvf1udrRRG;q10WP82xgM-c(-AG)VFKdmXV%L%V*f&Hxk#W
z!En4O|MNq0;Fr7fHW)fV@Lk5|>nmDL5>isC?5R@TMKILgYiHEGR0A+UbYnHPKr@YD
z|JmwPY>rl@-06DG50}mDGd!X%MsB4|iMpUS|MM3{*?=uvJSTJFd3Q}Zx2}yOIW;51
zBW7*&yY5mx{WC4I#afTci?Ay2=G{?US?I;p!Wd^%nf*{Eziz&|(EFnjNx^g5zyp(d
zanJnzDmYRA9Dt3+hmy$iwX(Ep97fbrgnChQ{pJ-8d-t;r<or!NHy?9NG`MX`N&c;O
zohP18NB(*nxvr%BF;g}$WOuREZXnHZ??=ppGp&GWO~^bk@YpIkrlO+49BRfBXw&vZ
z!`JPMR#4kiOv!w(#orU#pW?f*%3a^$c6PK=s^6T%_<Qu0DN-Ojz*2G?RJNNG=Cj=1
zv+rn=Ffu=16-p;a>`xK)UHbSIQSaUZKC_)6q>9Ra*JWa6&f<>eFYq5+A2Yqv=rdp}
zi2`EU{&}OV+Cahi&lb1SXIiNZ0RuCOKc7l=#dE0T)9Dz9xDT2((yFomp|*fdM@)6*
z`l-X&<hGDj?60?5+uN=vw}lPcD*wlm?gaR@32Q)cX)XZCd!?Uq`7M9C9jmRKnVIRk
zlREgys3eNZ_Qe=Bq4k+jY)xo33k$^FdvURKG*4CKa?Y0xS*}}OCpYvhzQBObM7vSd
z)<44{kfY9RTFkmLYGT3J4UE+O?UDVETPNybub>ZBuB=c4#mh-PTYEE%6{#%_Ccl3D
zM9tab{Nz2{?FW-AkH#@jrP$zYBIR~Vax+rI)?nf+5L(8-{gXW<4mH)W4Ag-4Sf|DT
zW)Nn!wSjr&8Vwd!OFEZwA8es~EIzka%SbJM@toM3$Qu$868J0a&Fp9Q`6_Qrlu<Dp
zgl>6X{Vw~X4y4acwQZx;0*@eF2%6Ih=omsO8jTUfy7kd{#+vD-l|hYqk%&k$Q&RxZ
zaG7!I7bTl`mw%>cX~{)v8|SiO%KJbzg8kyPpTKk)8t*YD8hhq(97wFb{*QFo|KbAf
z<BwQm8E<#Y0`3s~L|DMNu7nNwSi3af5HJqFrVNBdDd}LOrW&KZd~~q9s?YAwN+<5%
zGK6^C5lIW=;J}lwmQ{2dFWVcPHB*Gv{#+peHRpx@isF2L*O>Y-cm|KmdZGB1@`+Tg
z7j6`Yk)(qmdE0>Xv>2?Qdd3k%;5)r=nOlaGZh;23S<|YPb!Yc&i)MAlMJD+WzEYiP
zJB`^oXEylqSiUC3t-A>{q7LJWC=O(%Sl4chxVwN^V-R}CeK+QnZC@gQYBq`zd8NIH
z`R11h$V;`hTzCACb(d{VlJ|IbtbQ>lO*pVDh<!}j>zoIA<ygqJH|T8prKJ0{t5-vq
z#1}Z4558)%QP2_?<wMTnIo}5gUAuPG{Kk!*NT38aMFdUbcg)5D`jTQJ(Y<TDQobAG
z(4UTQNRtyrd)HPCCgwciHSWt+ZPz2^wq+R10(r69=#j099h40?oU3<7=GLIx7rMRF
zuB4kOMltR<^8ER9awDeNtjvVpq;3m^guZ;Yc=GMRAwu_bXR>s5G*3(1uiN5VGO%(O
zgE0P9j@*aDAyIs#br<2Y@{$&#ymqdK<t&GqfdBsLw|+isP*?O58&$j<{4sQ7%7=+s
zYbcDI%2=tL>WP%j&zD#Hm$tY0>5xgK#)o*cAQzX%GP_zK7(sy2FuIVMqEMe&C@akt
zIkSS!ahzGoq2yGIPwB3W$pE3sr0JJVM}$H+Wo-QqX1P0&Op~$q0UqLw`C0qz_$vE8
zIosaVI#&}xaKi~^AdM;W#td`<EVnUH00O9lmGLyw@2}fl%gV?goY3H;;bz~VfJ2P~
z^+)m})6+%)^D}jhwGJb{(lC~ECJ(x_dUw);_s4s-XKIaVhK1TbQ^-}@4V3BR?RUqr
zrJJSOmiO!*!gnzfo5_iC(4(VmlQF{255NZIs#woROF|k<35^ognEpF7ydmOFZ`@FG
zY)V0NE@gR?o8pWTe(S}8$gR=5NYerszga#!jAiM}VC)`b@h2lomEhH@*GkT;wr9Mn
z7Bb<1J%ucxE+Zc~QcwBfbus$yc4Jt=7(|`8Q0$wKk5|J8!JGwCYrL?v4S>MFYssD3
z;Nm!dWH`}3WUcW?US+@47YzmFI=uMy1ajWa9d#<g48YoqLZmvkZc{?bq?YIOs6seZ
zT3wAZiXxxitjI|7loQAeZnHamN87V%TrwWJALN4fb9>yuNCqLVio%!!j1de8S>x$B
zmXE%$T>Kd-Cr7vX@T)G_Z4XG<;nswjlfq#BTMD|a6c%>&)zOZ~D*yQ=-(tPOI2<FR
zv|M;~U$=G}1q~lp{R^U`gVQxS!P64E0n4`VUYRQKYou#70e){zRyco@s!>q-=TNIY
zn*{ej#9Zd4a+Hn%tLx5KC`qXn)m0b=?<nSGB*?v;C9`w_A)hR+CbX!;4>kLW*B0x5
z?mO{<N@ZSC$zZouI!PtWeg;gLkWWxsdnt;5N$24|LCM{}dpmV(Rr@MoVrIrY`bnuq
z)kkqd94Vy$cGcMq81Oo83TqAzEF8@{d^Y0KV;>@4ZP}(+nD^egYifFSD8-ehF+J`9
zr)I$3xj#TC&D6MZ@JHE<tvh{_e6;Z8)5ZjAv(AR+{LEp#0lc(OKTF0j;>{(3M67d0
z5l{B4iw#Og`>`V@FIF-JG~Q=_%#71quK#p$*}0@(C+4t6H2c9M$*R#3qTK@%M4JAn
zcb^3p>2Wu{2NItTz|z<T<ol!m&d++B0GZmJYs>+Y0&1P0cA4_%(zN<zKJ6Wz)w;HY
zK{>#w1F)eYpN*>RT<7y^Tap}*Q1k_0E!ghZHirnce0QLZ4QHROTI=mqnW!-u+Yl|{
z^b<x^hNVaB>@Od=nyU~fXaiJAV(ahct?d{i1RgusKlfUn(nbi><7eyfztKNK7jksV
zg6LItQgL<!<)jiL<j&NH-o^RpxjE5&wyD&nCr${Os^@4En76whJ6D4Bc<**>EA7uO
zz9zKGO>_8mOmG?HKrn}d7*964o*jLmeB48dQ0Fr*OV4V2>m&H|P_j!W%iMTFcR|%P
z=y;wh*iKv=<&MCWm`ejy*4Fa!`5Mf1;6}ILVGv<=NibEkw#;a72=GTLCYj$2r!!j{
zGv#X7GM!3@$+H`AFJhl*sGq*{X>GkmZu4}q<xW^g*Skv9yb<}RqzB-g727|Cz3IFl
z0e%*U$<rsA`?9!%QM_QOYSOu~z$1VSh)ZXYt%uMFxlFwqdvM>R9xA;)d%rHP$=gIo
zS6#!1SMX?r>$o{Z$X*qbppL$g?>b&X^mgte71!2LibXzGM75Cuk7sL~t#_{X^7$fk
zG#k-z&W(*^Wkfj0CBO2cUZKufKfUk|K5T0kIS_)X&7!w`)p-N{@qH^~7M(?eD2@wd
z-8(%{K_+Z93nCn>bQRU6zu(L`{fyZG|C|T85^xZ+5|jGO5EH&|-x(3d)j_SI;FV4d
zoh)MLNRIvSQk!D;$RljhyieFNClz-E-&~X6&4!~*#^6um#UKzBHQesw2FiR5ZVc{r
ziyPjmwLpXjI@r5&stg*N6PG!%dc5;Y>dPRj4b9DJ%x!r4!R`yGpcCbbAb;d}F9e|s
znp{9H%gxvZrb0)yBArBwdQMp><{B(lDwf&^{M(Mxqk@N0@l!<wQ}WC*5}rhtFd}7c
z41mC@X-6&W#T|d;#XtnXzdbA+4Ob5vvbs8;A_Z>nrtdlRO_puM(UfeCcR#*dxpuaB
z*kXG?YY*Gn{x#H^2BAuQe8rJ*L;QC+bJFNd;OyCXvRmwB4e)b~X#mtBLF4Rfe3fen
zxLN7$pkr3f92eszf@7(DsHQvU$<~u9yT1JTV(Ge_7?NSL0Y7}un%VCe<P)|VXH_Fh
zaW|EqxViETV3K3N>WxQz{-F90c&E8Y<+ys-&EgjLVO*|i3Xj>0*L&4ppxQT{jSu4E
zj=u{uK75&4cnUrsn8ow>_hxlQ0c`8%kg2IjHFX7x=XLnq#O6kQSkh|e_s0jAp^0W4
zA=|+c`K6GPVHPaoV3Go_`Lf1~3*<@6A4}!MD;l`w0|KD}k%(&c*%|K-HJ&lYZ3Pnv
zDP9%M`G4GqDK`MN8RE4etQM$U@l)vobl1Gppc*{1$_uHxPM(6alG^AOpF7>}Eww}<
zNIV8b?66AKw-N2kF-h#P!T~I!e7*3mQC92jYe{MW+ajJI)gu?9!wOcqYm#q;?RtL?
z#q;Q=l0nDfZ4rnNh_ka<$y`2O#J&8hkfM>+^~Qo0KU~C|z+(;9)Ms!xAD_Lh?$Ygw
zr1|OTCNO#6+1(VOH|64oYM$Fho4U)5wQ_5n+GTfkZp`J_YbHvA1cGBBXg=BENIHR$
zNOoBcpGrZo(X|J(3<iI4K3o_i38F>u8d}o>jh-f*9l0_BlId$cy6(f?H|{h5MG|Io
zO^rG6MA@wlVC!;&C2(H+pzOKAv4XX@-LsTxAS1;FK5HCHJoBSY(^0ARMhy+!mx!v|
zc)o=FY^@=(`jzQ;1kK<oxP*b}Y)=${(nKt+PWNe67rD*yz0!Zi4D(psv7!skO-a(N
z-S~9-0gvAA-4P`Yn_aF!h`O*|@iSOGzzok0E@FM_eKL$Er)6Yic9Plh!HTnq8@4~<
z##rpBHdg`mZe!1^fI3npfWRdpLICgt<Q1%}_4n`Yue%;Ny8aC5`lIO52#x5N`s~W1
zw{FvP7&dm`ghx#TGL}Z)2d{Ql{(Lz`NhFa|LsH6pi03zCDQ5U)f1>Krtw%SXIVxmr
zVK$D&gPQ$^hK3Z-9d@5(WLL<kBnLbjR=3dgSzcIWI(SHGU(%NrQCFNwBTk$_!-U};
zi-{A%*7HZDIU!|kWuyAm+%{#Vldn~~!n{vKi$Jil{Iif_n<W~agnFtgCPsBc;s7l4
ziV`*RgkXGS@$gfWm~&CQz$ab^m4NXt`E#G6IV1AGG0718LRiz`=Egy{HjAy_J|QLP
z>A{6o37p3qF_*-jMo!6O3LaHzteR9DP0)+FEgx%L^9_ga4VEv~9V2RoUS;wP#<QQ$
zq=|RVjX00!M(TaM9=)F0xWxRA-)i^B;^NPC+Mn^UV*_boeIJw?A!~h!^$Di?x`T`_
zx_&e(g?b#kD(+|;sW8hNiQ&!HKaSTH+x(+(MR=fvj@_Rx4*s<EzO8yLcjqN1vrsOp
zaF?{--?lbJMys1bPvRw&$DV;c0{I<a_)R-=$MRM9L2ou|Uq!QY86HT#6@Obv@3Lc_
z$J{2DpDrZX>%brPE$Sqi`O<T?&h;AjdeoD%1Ax?DzFX*E+z)D>t$5z3Y15mo-HBYo
z@7wnE4rGl8S=rDPJeo{o7;w*B^HHY_3}j;^;2B(g`TF_UM67ZP+4iJ!t9=2Srp{rc
zMCU5VcKXfO#_DFJ))j@Vfaj#+lW!|JS&*D~0W$`b+e8N4d{u7268T^rFfybRl{Q{I
zM{V1m{z~k*H707nM5J7Y!{Ca|%`kZDQ4&btT9x>r)pXYeYt@{IvskHqVsB!u5~z-J
z-gppqP~*3NJss_(;mwc?Rs<_M73xfg7(8L3bu(_(C`^yzprC*j3y##q<!&plJFZN<
zSBRY8u>UG-PB?R$Z&oD_gcR6N(DCm~=fDn?zz;}QxTZ};n5UUQLRY!0#e3qVRl@y$
z?8vTMu9uW3D-Ng&pEorq9WxQ{T3X)gaf#-drm$SH+(S7=$u+6N9yBKtzuo##0Y;Xp
zcOkXo%No>E)X6_Y`H8uY0Ff)f_}6_uyYU*qtu2@1&pBI>&&Lokp)G~F`Le+mrcDVE
zwEQk+g<gUkE?;w83;F6dA&k?~Qza?^T>YGtHf!SL3x=G1mW-EVabxG$J?q&T*G)Y0
zbGNM_p)x_|1V5h0q~@dk6d}98xSp20fkS>#`(WwKBV4$epJB4=nKh3MA%fjkGev58
zV89z_UX6x5x^z^Ml*!j1z5Vijtwz8!_uW-W&{o%mE#J$*SJOA>`?uABCISzTskm!%
z6t*Hp>1@AxcfU=^OcaM}l)!rvrBNkD)kUB}9=fv-paEynBtwkU{w8<DrTUKJ?<Y^J
zBVzks7)_azS`uqOJ~x}!Q8zbVv5B&EwH;suZRj3y8%s=z-{<*OxLR$mUv5C^o!})A
zjaA*65~di1A&WgQe(RrNYA+b>%k0^H;+T7pP1W*sw|kX4&R%Q+{6*bJsMcX&3qSvq
zMJ4DZbvPU+$FcJU=Ne!3decN6-RwVSy7qFqHqaM<C9^f6-@}yKnjB)+iW|)ilppeg
zTN>n$<>l_F<BrSaYWRTKmTy8c)0s0qFUTtoS7XyUc=U_Av+4xFg!M^XfqtNs_r3N_
z8pUrLuG~9@|HTCyh&Yaomz$$!n0g?D&z;kMrZggO8cg*v^=_T#7RhrD8k#V554#<{
zM%0{(e6RT%SHmFY@)I7W9Z>px<VMBzhWN~67-ARggO8Onq%RsL5KSG3dN-?c^W=io
zJ!Cx#Mrxf=OtK**&}N5NR>!e?$MN6VR=lt>>*=7zrFb{R0hy;f<!NG~KN=rdxi+3&
zM@8BXGh_aV%L-wT1$aUsNyu7v62J5L+G8tpI_GbP%3tLl%}*DO;QlL}AFhzp^LkSh
z7*ffP@mOJbKJL6GUwlZspgJi_lUv6y9I`fb>((9h3g(&LZ>J|ST_smlFIV@h;R>3>
zyiyQD;S%fH+`kcZ_$kZv;p}iKCa3A5JULm+(;Avhhw+kwWSI3RLg6f1A>0IJt;_l4
zmz_{sMRpqib;gVI)x_&%e0Sz}4f-L9-P5tCbM=~pqmh;5ZAt=lP4v}ix%U9cg+TbK
zCU9jVWqmJ#sOad%2E8kI^^0;t9v4kBDt~*<urmLk4-wPXM>;z`nB9sLOcjfz3q0OR
zT+J=_LN5e^1kDra{2^HI3f!34VXXh!l@~BAYeL@?JlAJLDT&bJK3kVFk!CRZgSBf4
zfUgf)-qvSggfh8ecZlE9gm?r~l$-LGT?*6L_IC2rd6VRr+|yn!B)*=}izIxlahg}X
z;4`f7n4K(LQ*SGw%`aVmD}5}KyUuMAyxl9xAHp%iH!$u9d*<5ahy57^S~xu92hZ&{
z)Zn+Jxph)+vc*Yrz@C&+>o{OI%MU-pbKr5BtpSu9eOW*t*US*AwJoN_lsyT1!4t~7
zSsf%y<h;lY#O*vmE{|xrq8m5UPy?c^f<`|)9LuBjtdhXO`729oeS01qK{ClGS{nM4
z-D!6Lf7w&d{ga*^Ok6YO{UMm9+IjU)yep8nftImW-fXWiztEgrlxLSCW&=}ab;_f=
zA?nN6dyf_ScDl+I=rr@yqADyEC@;yF3B$i%Jm*@ErJQaa<?uP&NCdj!J<jy6O{#t1
za(`iRt~1iUZhaXMUT5W|h|w9CSuJGka8tZHPkX1Y-W~n^tgbxioix`yL&Yl#$yrd5
z)HcK+n*xDjnt0xZ(=CwlIUyoWyBy40{OBE{AU=ak_MvqJ-<ktM8Z`xtYb2&z_E)*B
zyGSnc-O1Y%R%WM^81OCJ-IgE@yFgT_iFvJ)s9K6ArX^szw+|+m*O4$SaAGRsvG}3?
z8T?~#!0~*QZ6s~EdXmNurpHy&?dzbMeWD9`S@pq(L{pYSdNW6}W*;M<xsv-W-hLo`
zt=1ycD`1oV;}(npn@4tbc$Kg{>+ZRAwcCha1=@OkW7P9vW1^TN5|*o;*gM}QBlUph
zY++$=P>Rf*KSku@=;>)+4K9%fG;*P8MJMI>l2@<jIk9U5(g@@I4(4g3NXOR>>lAUQ
z>EvnZ|1sqeN67%pgc};cZ&EW8=xt-8ciy3zwUI^5)EoO#JT_moYWhA1R1dHpvVljY
z#87dUsh`k){`qIP$krK0o>Ur7IKX&+y*uQHdCuut?*(Tk=$0q#+)Lq130o<QFR)=U
z(%dv~jb^G9z}6xddB-A*J4)7p(-FYX7omP5Lgu9;*=(9uKg2Rw;CN8ZC(AebjsnW}
zqoX3CqH8Nt&wt35RlX-F;zY!tq{Wj;d9~71AGf?-pq~b-e9k?auaPG0bz+P^I@mY%
zkZDC<Sc%MJ&WwW7XaN@L<9cwV-`+A%D5{Frs>A3&<)-n@ZDD8BbuP8%0*ttB^^9i&
zA3sOh*wHhXG+MpwpFmkqPF4=Ka}7Wif&8L-mALpyfmXm!B53MXU|{%((f}^LK&q}@
za)6C3quO5By%6_&vfk?e!~bN)x5mqZ!CL-`bqLF6pz(9~@iWEYYXNh_-zEm!l6j5a
zw;)hm-(`my{aTG#a|xICh8_$M_|yk%CYA0{J0Bc%mW&5c5e*-Q0_jX;Ped1Qu?Eo3
zX7B)wCVQW)sStjmubqUnG^ZK{=zD3>zl<H2tM@Gj-~Lt$5;7D9Vm7Hh2{<AVT}(ew
zYe1RpsVsSb!oz}3qh*<ro(ArqJSEPfP~Xb*(?8X=l7DlCK1yiRBG7quI{BL3hsK1x
z3ftntTLT%ws9I;x3anjk-;#|GC+~m3?uk*)XP)WJ5>)s?pn%i%iuEoK_Kmr6;^Uaq
zCze-hti$t+skUaBFB?Ytwc2b3Q*9SoP9Z*h4F{_#x`XE-if9TsI;*4CS#l&ozM(O`
zC;nL%o+4a_nQ%AUGTi2qtMsq4wYxb=mroVWNW>$vCaaE?#)Hv(4U+=R($uV!&Kr3Y
zzJE_{ZzDHiSpD}kGo&*l{B_K~%;jI6?k-KeSb44RS~Zc|tl6Lx==Zgo>jOllL75@9
z_=`vwU)6T=m^!yKv5t#q!K>fowbl#DtBo7f2_$bWn{Rry%l1>OJkQ-{YS&U2khKsr
z>?KtIEHql+o^?{)vElRFaEE7&s?Z#X7}W&!2Bhe3>nT@kOaH3ew6+RpZUg<U3@Ps_
zQ~rSC4FFj88dYPucR!7*kcfw9?OflWpYDOxv;&+`SzO->A0j+qnw&YC)vr75j1H#@
zQ>)iGj@k9DatEv>-x+SkM$i=Z->4`*owlc3runIc5)iiUXOLJlDg4ypKmR4=%Qbba
zJbKE?fY%znYM7)Bkt0W8xK5(#0xz6bzhoEocrSW{rqOt7rm;BU)c(@Ttl6tBfk);q
zf7a~qy3Rx?2!;LI!4meRS2HOy8Q@LYk<Wl8t#Ux!s<Ol71gKV>TCu%%?1@wz>>kk3
zZ&qn=9BVpk^u&rD{0V{yWUNVv`wq%XH!x(4|F&UbiAxl77`HgBqQMH9K6?HWx^-wc
z>6}@Rtyh(MJ*7amz@0XLKW?pCi5a^8K5vRmBcH~55+njDLP;rnXAsR5G@e0x`16#`
z9tMU7;^Ytc;RZlYgGpw}OHbT+Qp7qxN-@WK{)MP<t?>kQC`%*lNDWYu5gZS3C?)xm
zW}i(Vpw_!WB1cdLZ^pIRcE_}i`lvNSFV6kBeE__)qL)EvJKmU<4hW~u%fg&7Bk@)<
zbi(9E%#ZHfOA*hStyoex3?3=;gaLe?+g!s7fd2D#LK!39hk+koLq2)#jB%0NwB>@E
z9J`HPeIqyoSxk=R4I9v`#AP!|I^{-{&jUH=p!2&8`Fy$vhvx0P#@}9R8$Vwu#7U~6
z8^id}O?krkLyv~tf8Let&ghKER^ZbbdSrFXz`)<UHS113m@H|c$)VCO)NRY3E20b7
z-dweFeH5EN?f%wylWzLeps~iWt(0nU_qk+IXCKFP_Ug`*)^VPh8hQxT5pK-+bU(4$
zexS0tzW5YZK*^9i_)7Qj3AXLMbspv2#4BF`Nr{ZG@4N~ce9SZt#|*&+X}(EM6ocf0
ziN5@MM@8@Bhiu!BJ15^=${CqP1#p{*$?Gegl>qrC^!g#z(M`9xDd_DG6P%78{BC81
zVaU8CS;Sv82KqBHQVqX;Z74|()Hd|E%n)Hpl?HVF+fT=5RK0fQ909@IWAX02m{QG*
znavz$#nd;FqRX&1s&by4QRUJ>{8!X&2Av(^3*0fomI{Ek?hT+a*xQvajeHNZxK(Sr
z5l5-`T7awKwy$-XAUKU!QU6rs0Hjwo`He|7N(p>M`^87*8-dwC;NvwYiMcN|B^?Ba
z0^r<94cxWtESU1F>DQw#4rKwEn%S9re46{WrT5QN4HE0vE~@t+Gs-pN?oQ~|8TgT0
z?u*3kl1s*}z&J3ir2Xnkl$`0u+2Rh~>W3<tGsox%-$?VUa4P1WMB(rY&(r(c&0ae~
zK_?!#=YE%0yEA@W{0Tn_oh$)+0&38EY)TH7<S;?=l;@VeV5k;}K$c3Ko`DpXzUJ9m
zr)6_%oMIoJ*0O_APvpDU&6Enq+B4iXK14^T62hhLr*gKgov%gIyovsOJPkJch~#-$
z^g2~<7N;}ro526-_727L#^O&4TuHR~kj{NcRe1;gQKETsfQCRQu|7$_%x4obFe3jw
zTHfBO!2g^-xW4_)>CPQ!mjN=+Y;WilcSVhSRTron9E`?a)Q2H!%|1s-w3};w+)iBJ
zc!1;&R$8IQ=Cr2@6(7q`+%HaPSB*35u@!#Ozbq)<>h$f>o7*YfJoXny4c)?}X^bX<
zy-}6bQQ%YRX=VAzgO&3tSaNNrbmsjujX-zEdeFO>;r>&zv*!EKZ&wl|9ie9G=R^W@
z&uZ`QTN)mNga=!5DZ)2oWMo}4kDyssr_vmmUn_DP;b)Nmn|-hCixU(k(jX0>diYs=
z=Xd!ZS*Q1TC(OU-k(%)*B9&q6t#y2Z4@z!F2oIUpefu^Lvv}`NZnjv>LrJZ5S^aXj
zCYz&5(5CpoYz*>!e_!Y}JYb+zA^Z+4pBD<h^W7PBM%d0+O#haF*{dha-%mT8r@4qO
zy%_dZ2|bi``zmace!_F#r93XBBkLl%Q+QAbulaZ;Fzd!Q8tKY7c7y%v;s+#Wxk>}s
z3-HNf?A41OaV6o`F1bNv-CwtBcXywI#8E&72zCfKd3<rQ@*|9#I*~`e$YKkiS5`50
z9aV|`2iV#tTCJCSIAe*RlkPE2Et{_uZ@w)P@ogvO9;BJ?e}0lldWxRwj<m(<{VUjF
zkN6X-x2_9F!v9Bl<o_;H_F?6zgyP5n-IpbF1$Myt!Y4X9`Zno6kBscRJbu&q+&m!~
z84k$4UjAieWxd6y(m@b3Qu_>Oa-WJdvS<}SgCF<+nhtS>@9t;>pgDdi(kRq>xOcff
z6!bR<XOs-+yMd;<18{q)DZQ{w_fM8@$ydW$En=jAC|n5W@kF+PujhWxwT-!8CFvU)
zCIeb=f{%oxq$BVIT5+)t;qGjJ?3*D@Q+@HDePbshDH+BmPo6L`uDXX@JR;jQ7v$mL
zk&%)4s}3Hk&wgF<C!2zjGLeB=e8u<U6|#%Xp849GlsT7!gx{>U|J7uF$nE%g`+rW#
zb`c-ihC=xQYTD4ySMT!yL4X|~KCOWw>+fl!m~Xr-ywu=q&Az7#ZN4D7wx9L$<)wNq
zP8JUzr_z&sU|-tJJeVld9cmr1+)NrU9&HRd?frU>Z4*_VCSYc~*$!yJfL`UN&&X2!
zO<_RrR)X%!b{0%;IS>j~?Gkrqb9&e>2G`)m61YV~&okkvN3#PnZ%yws<&yeRIA8?R
zfc%g>#=>|ce&Ldn>v&}cTmCmn(b_L}uQfrDfo#!y?V5n(%~SI@Rgd>nR8&~O^ofgs
z=((Uti;YKdOELe&1!QY~k8oMn*B96r3PV$w1ZMXF9&{6$&Z*0z5&Elf6rDD{dktZs
zylj@T`uZ;`TnimY!yr(u%jvoPP840JUCWvim8noqf3f$OoUHvAp}>=m{*XD`{b8s>
zZF?p-Q825kAZs#JHZa<on1UV}FEx?(bwgFz@~U6je(@#(34lTLT*h4P7?4{c14vS>
z-V;S;SeWD3S_dGGQ-ulmF1HstO%ydZu4PHQUk2(wlNyH<UYJSg(8e4*5R`R!j2==Z
zkMcL8fu_9ZYf6_5JQj5tmv9Fgf$9g+>JtQXFP7TEiFNA964^Q(JZ~duftDK7!=oZ8
z_Zhxvp(<$SqE_}$;8VY2I>v{K7kU{muD2K{2yUjH3Bc_1sahY|Y&9ZIx2%1$;G;+`
z@AH+UzR%(KZh61Wr}%?=u}KW&Qa<?nYN$xMkA!picXL4*|82{;SHG36u<V4@-)MPZ
zmdP>gB4eM~c>E=rLaQTdy5-rxvC3}OgJauu#Ki$Fy!@R0x7Nkv*?Ge@NQz%F5i#2|
z<_qplm?+rMKl3-ofFCnx$p6wZ3i(?;Ft<WHFW71EV6NGAeE0jppl<yW-qW9DMVhIt
z&VHj2u}5g5zV@1+WsacQtU2+D4oU01*q!~@=1chItckv~>Wob}bHi-Z`!5eVPhRyg
z@xi>^HL*^3wehC>rtZw6s_n^>o2!&$C*lF<KbB3UBJCQC)J*3iC61nr5kDA2e|Z(^
zw0-%WEbWd^r@nQ|VR-idP}2bF^g^q=J2{B6kiMkS)YI(mKHD=$zdgv}pNpH)ZR;b}
z_f1jr(jfqSCo0If3$(qhyP`=O#ezW5D{j|6bl)I?mRriEd$A8xM!<`|GY7SO$tqA!
zaRLMni9AV{ZmV29v_d4nAk6E|cqC3HhO@)sr8yo;xtwg9)c<YMpcaT?mUrCGbsR_&
zfAZX75fL1SJk9qUy$BP+o`VgJ`|YGV1}%OYKaCuch5A2Xy626ZE*@0VJTAml=J`&D
zXD<!dJqdnnNmSbJ1iD~b$>`i94orxV-EpE)*koqCUiSeCT_%aH`?Z<6LxYF=3A<!y
zrHd-Qp~uTmOfu8%1ztD}Z%}OWG?ncb;1&)*ZDJ?v@7{z>y5jIpc-Q8qk*V=v!SN|d
zVFN$BWT@_@v}`J3^fc4X^bS2Vo3Z;V(UF?<d})Ecmm4>#@*E{dyCgby)m2sG1UB3B
z!uDbw#ylUqxABK^Y%uP};6ktwpFOdZ4uGs@6Q8&Hm>z@2MiwqM-xjRua;LQ?bcJR+
zH-R=leb$Q`o@qlQma#Ae)+4jPpv9T^8|E-)ZLuG<AC%l=o){Kb;D_!I%5ZxcwLwWW
zFS0{}68OIt#d4E<kYW~zU_PE4oecz_UwI20WY-h-c7aHKT|JEm)E61sTU!7_xwEts
zE91YPuYsIuv_=8ifyZJl6_7k%8=KXpL+2{{A%O$vscoR=KQGuTSo=iA^j!(-%m6ty
z(&B$$+Gr}zV+3jMUJ}~72s<l=!$rsB_w13LSTQXvt%Ii2ow>%%lW*|=<~MDG<mKeF
z5f7aSP}>G)nA<`z$^m2l22hPkxva;?1qb$-h}X{ncg7m7?Cg|r+_*$pLT`S0=%qqu
z-=uB?#k?XM(IZMtD*UJC_93?Qs{S`!<U%%6Y!ddQ%UtlF(g-Dk6vWBqeq!fN%J3E&
zd7!RYkeO(f9FiRwpiABJRUyLW=-b2AUGIsOfqr4N;X-l#)|BtE@`ny4BN|{*DyPCl
z>#UD?z<7<ifJ)-pfgK~N<dfW34cd)x)}J%mm7mJJmb6!bR>LhkGA@6os&p1feO0bE
z{?*6V#|%5<Wpa+%&yM$IhkCKFlI6t%KtE|Rqq<{c<Ji}v=V!NbDS^d8=Z>edbQ#pj
zwK#k=nq=*^n<swTXdVcNmFyT8q5H4n*tmfiiY~>VA|UO#E=YSksy$KQ0SFpdihvDA
z1-(*Z|HF+5p^aEk=Se_iTWVf^(K+z=;v!TlQ|5MvErVzSpwnFX`}wejMecO<f#>2^
zbh8ES{jky|hk7@<P`AJb0)cqf&Rw@3OnAZG?!}>&Cib1rgVaQcayNx7M0aUrw%ie-
zj5S3-YJq77;8{fF%CgC$H&N~_!Dm2em5A_FhZ9>dDS~EA33{Py8jvm<Djz{}_;+E_
zbaB1WsFV@fz^7i%c;;dBTS)%FDce)~&V=$dR!}Bk)&X%y9r^W6<a03eA$wNu?CTM&
zFxsIE7IwbZO?T$1+Cv!IA9=P$iyq8&U$>i7mlYruuSOr`LF{9+X>K#>Y=4HdzsaMZ
zK5vGmqltB|FZ$_rPW$9e8$2eh>oZm8x(B*i)ui=L{LVv83GJo!%yc4$n<4@!o}<yl
zw$Q1G2ECmjwKXoAK``CU8S>6|#@fAKBjd$(Q_$_64*9Eu4%+V2XW2EDl05y6*3D75
z-J3VU-5-l86cn9`ko`dpoE>|x@BX8t+--sb0lnpy7MYI%fI=Urwd{N1Y8AgbHG1}$
zmE^UtiV$3Z@i!|>z5kQ&46}a2ABQZjbnjLMy8;pQu<4M&W*{yvpth(HlD6_S!!c8j
zTleC$i+S>MOUR*AQ-6N)@&+b#e%c7*>Ei>4%bbD9omzHQ)ZkyqQ8OajPsLWl93Bw!
zO<*vil{neMVs|Zr@yWuMx2p1=^eUW_#-n|{a2*hs<pf#Zvj<croodj;SeSnpcoQf+
zoAQ8xUx*=Ia)$PgoCx3REVR#bwq@*o?4c`!y!oF47f}jZwCCFUE7%(SJ2pLuFKi)7
zVdw*tlDllyNL@k@Pa4$ub(=mX$;UKE0una#Q|d;SsNkL=!eJbetK}$?95+Ij=UG>{
z?lc{K+t<}FKeOpzdGdrfx&May@}4!>hx_=)66)JQEfflsR&SwZ`_2vyznP>5vyg!M
z6J`7%mm+p9hK5tw3THaG%J*n!L<5gxNX4HiXiO1S9ckk3I{E6{?pl`@fmX%U=Q|N6
zKMdaBP|L}$V26*zKEZ<ncYoTNdD;z)$a5K0t(KWJ4`s<81I_2W=c9SqL*@-0uT-8>
zGKe^!%D($kcK-SE5-y{X7lcp;hwlXG@<V&qL+_#s%EdBBo~p%h#$NoHNUVAB@9LJX
zUq!$dY%diBWHQE74GT^B^Be{V#Cn$l{gMjU;#+Y${3FV5K^D>)of0xt1rsRNd1^}e
z-fXCa$(oP@<N|S7@R?s$2g`iY_t0NE$KnWIZ`u>joybn@e`a(KJAl1xINSH0Zb><m
ztj>MEVK%04QF2LoRqWq|bk|WQ8VeP8Z-8do1fB_{)(zH(HD9N2(0&26+id^+Df$**
zn19J-M2K5Gz|i5O$>quEsi@oeX<AGSlWahiJQQ5Eet-?Eb(+_)8%&iP1CXn2!z!Ts
zLx)HkmaP-Lf4$22^6FJ9z+%ZkR;SXZJptY`ZJqe5OK&-`EdcL!%Jr|<xeP#I-Ay+s
z8CW+*+f=cG=vCl?+x!;|260}aDzA+iN5UzGNzjFV4s*!)djMd&%{PhKbPu1O$`Z1`
zDm?O{+yeE>=7aJfgZR9ts4e(@!*qJiDE%;^3YT)56d@VZ*0D()c5WU{xhn_jUnqlw
z@(KMj_RDmKNo{B@b_DkIw@P!F?Pm4J__pQ3oM9zPYu1?Z)`I*}k55iLI5zzrBf|@)
z9IcnieqKe-X9P^8SUO#ikS&ZbcV`@%ua9}qT&|Zu%1)|eVoqxX;bdMbG8w^v&Zsy@
zy?Y<W#zq2V6bt#_`%sptxc4Z~=nd9+N!vLgTjj(Od_=V%7@jE4k70Bs^sxl%@{uGf
zX?jxxF5ckK$_M4dc@{FVVrmCOIl5tQKs=+=-F_f-Bwu3_5cdKznOzK`avE83X24(}
zl!25JG+w2@i9Xue9L-CE!-FrckYr^j)=_;B+dlP7k@x4Hz5xcxXV9_^$j)w3GbJrH
z@hR}!HZ}Y{a#?AbZ(Q$I3zTSpW%o7R>~4~gAsCJ3ssJOM2DfEV<>s5imGF^A-s_7j
zviZtAfQDkCaz#8&&(stG3^jF6Oz5jg;dG_kHuUp`BB~R+w!eS<8t1%P@HqqP%jInE
z$<J(1{_b$^ER!6`zZ&PG@k15YufTbL;F%3+?YYn9i}?1HFGh4be?h;5I<PZ>@-}th
zBP%(v^R@m?yqw^u$IMcAD9eqi0;7q%*GFDGhqY7FC4~xWEzlOfF{_=*t}EF))1!Qw
zI*2!JeZPk}KUY6#Ia0r@W!0y!3BE@-vK}fSDur#*IN`njHV$<@?Ae0YDA!gwzfIxF
zkTp5eBlT{+iAJRT&G{wApWy0<jYy(Y`~3+n&;9h<>OOO*SejkQMy$6_v(UeVQ+Euz
z{5^(${)rKDHJ&9Gd;`=9VPRoWUhP?E;EyO_ANLh0z?>BsPW8lXw$2+ErC4(<UkK(1
z2F7vYOn(jibMGEYM}^#8(Q604TrW_!;WyXu1`_*}b@$QFMhy=2>n*p3l6iK*_=LLe
zKTQ2YVCM{6xYU?BD^c#{=2kuXr)qmtD_-F3oICu^_lj!aTy=ty3mMsE#@)`#QSJBi
z9EAqkD+%1XdPRmfAc13t%ujFyBlFF^6BlDaS=Z?vHOV??j_GMe0mbeG=p1#EYGCe1
zmD@Z~+II)ww&0MpJ9(;!lNVQV>;G&HZzHn&C1wt^4zK=uvp9M5<*l>m1q}0_VW=TH
zkzQSap!-OXL|4Z!AXuXHd|kf6@<RJz7|Wz5W!(>nM>*&znbLc3!viHBOouUyzB*<-
zaYL6+o^;=x|2<Q|SIOsua;0*0^VAVythc5@|Ce>>EWH(tmU(Cft#FuK#c7#=fO+Q%
z+eOEv6*Jl5lm9+y7H|j*U;jS`sQ(9Z)&IHtzp_=sycs)WWVhS@eP6);$ME`pHu-;L
zlmD}^|L?Cv_>Wcn$EyBkUY+qDJNb{D{KroIf8H<iA1C=g+et2|fg<73#giNfz>S;#
d;<;;NhS=FAGphcVz!fr;x0-LtUR!+pzW~aJ)R6!H

diff --git a/package-lock.json b/package-lock.json
index d92affb9f28..296840d3a52 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -17727,7 +17727,8 @@
       "license": "Apache-2.0",
       "dependencies": {
         "intl-messageformat": "11.2.15",
-        "marked": "18.0.11"
+        "marked": "18.0.11",
+        "mdast-util-from-markdown": "^2.1.0"
       }
     },
     "packages/core/node_modules/@formatjs/icu-messageformat-parser": {
@@ -17933,7 +17934,6 @@
         "clsx": "^2.1.1",
         "katex": "0.18.9",
         "lucide-react": "^1.48.0",
-        "mdast-util-from-markdown": "^2.1.0",
         "mermaid": "^11.17.2",
         "react": "^19.3.0",
         "react-dom": "^19.3.0",
diff --git a/packages/cli/THIRD_PARTY_NOTICES.txt b/packages/cli/THIRD_PARTY_NOTICES.txt
index c127e54002d..009d0f561c9 100644
--- a/packages/cli/THIRD_PARTY_NOTICES.txt
+++ b/packages/cli/THIRD_PARTY_NOTICES.txt
@@ -1723,6 +1723,96 @@ SOFTWARE.
 
 ================================================================================
 
+Package: @types/debug@4.1.13
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/DefinitelyTyped/DefinitelyTyped.git#types/debug
+
+--- LICENSE ---
+MIT License
+
+    Copyright (c) Microsoft Corporation.
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE
+
+================================================================================
+
+Package: @types/mdast@4.0.4
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/DefinitelyTyped/DefinitelyTyped.git#types/mdast
+
+--- LICENSE ---
+MIT License
+
+    Copyright (c) Microsoft Corporation.
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE
+
+================================================================================
+
+Package: @types/ms@2.1.0
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/DefinitelyTyped/DefinitelyTyped.git#types/ms
+
+--- LICENSE ---
+MIT License
+
+    Copyright (c) Microsoft Corporation.
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE
+
+================================================================================
+
 Package: @types/node@26.6.3
 Declared license: MIT
 Selected license: MIT
@@ -1813,6 +1903,36 @@ MIT License
 
 ================================================================================
 
+Package: @types/unist@3.0.3
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/DefinitelyTyped/DefinitelyTyped.git#types/unist
+
+--- LICENSE ---
+MIT License
+
+    Copyright (c) Microsoft Corporation.
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE
+
+================================================================================
+
 Package: @vercel/oidc@3.2.0
 Declared license: Apache-2.0
 Selected license: Apache-2.0
@@ -3114,6 +3234,37 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 
 ================================================================================
 
+Package: character-entities@2.0.2
+Declared license: MIT
+Selected license: MIT
+Repository: wooorm/character-entities
+
+--- license ---
+(The MIT License)
+
+Copyright (c) 2015 Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
 Package: cliui@6.0.0
 Declared license: ISC
 Selected license: ISC
@@ -3368,6 +3519,37 @@ THE SOFTWARE.
 
 ================================================================================
 
+Package: decode-named-character-reference@1.3.0
+Declared license: MIT
+Selected license: MIT
+Repository: wooorm/decode-named-character-reference
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
 Package: delayed-stream@1.0.0
 Declared license: MIT
 Selected license: MIT
@@ -3396,6 +3578,67 @@ THE SOFTWARE.
 
 ================================================================================
 
+Package: dequal@2.0.3
+Declared license: MIT
+Selected license: MIT
+Repository: lukeed/dequal
+
+--- license ---
+The MIT License (MIT)
+
+Copyright (c) Luke Edwards <luke.edwards05@gmail.com> (lukeed.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+
+================================================================================
+
+Package: devlop@1.1.0
+Declared license: MIT
+Selected license: MIT
+Repository: wooorm/devlop
+
+--- license ---
+(The MIT License)
+
+Copyright (c) 2023 Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
 Package: dijkstrajs@1.0.3
 Declared license: MIT
 Selected license: MIT
@@ -5657,16 +5900,15 @@ SOFTWARE.
 
 ================================================================================
 
-Package: mime-db@1.52.0
+Package: mdast-util-from-markdown@2.1.0
 Declared license: MIT
 Selected license: MIT
-Repository: jshttp/mime-db
+Repository: syntax-tree/mdast-util-from-markdown
 
---- LICENSE ---
+--- license ---
 (The MIT License)
 
-Copyright (c) 2014 Jonathan Ong <me@jongleberry.com>
-Copyright (c) 2015-2022 Douglas Christopher Wilson <doug@somethingdoug.com>
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the
@@ -5689,16 +5931,15 @@ SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ================================================================================
 
-Package: mime-types@2.1.35
+Package: mdast-util-to-string@4.0.0
 Declared license: MIT
 Selected license: MIT
-Repository: jshttp/mime-types
+Repository: syntax-tree/mdast-util-to-string
 
---- LICENSE ---
+--- license ---
 (The MIT License)
 
-Copyright (c) 2014 Jonathan Ong <me@jongleberry.com>
-Copyright (c) 2015 Douglas Christopher Wilson <doug@somethingdoug.com>
+Copyright (c) 2015 Titus Wormer <tituswormer@gmail.com>
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the
@@ -5721,20 +5962,766 @@ SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ================================================================================
 
-Package: minimatch@10.2.5
-Declared license: BlueOak-1.0.0
-Selected license: BlueOak-1.0.0
-Repository: git@github.com:isaacs/minimatch
+Package: micromark@4.0.3
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark
 
---- LICENSE.md ---
-# Blue Oak Model License
+--- license ---
+(The MIT License)
 
-Version 1.0.0
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
 
-## Purpose
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
 
-This license gives everyone as much permission to work with
-this software as possible, while protecting contributors
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-core-commonmark@2.0.4
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-core-commonmark
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-factory-destination@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-factory-destination
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-factory-label@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-factory-label
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-factory-space@2.1.0
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-factory-space
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-factory-title@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-factory-title
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-factory-whitespace@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-factory-whitespace
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-character@2.1.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-character
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-chunked@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-chunked
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-classify-character@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-classify-character
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-combine-extensions@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-combine-extensions
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-decode-numeric-character-reference@2.0.2
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-decode-numeric-character-reference
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-decode-string@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-decode-string
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-edit-map@1.0.0
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-edit-map
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-encode@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-encode
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-html-tag-name@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-html-tag-name
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-normalize-identifier@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-normalize-identifier
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-resolve-all@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-resolve-all
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-sanitize-uri@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-sanitize-uri
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-subtokenize@2.1.0
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-subtokenize
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-symbol@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-symbol
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-types@2.0.3
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-types
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: mime-db@1.52.0
+Declared license: MIT
+Selected license: MIT
+Repository: jshttp/mime-db
+
+--- LICENSE ---
+(The MIT License)
+
+Copyright (c) 2014 Jonathan Ong <me@jongleberry.com>
+Copyright (c) 2015-2022 Douglas Christopher Wilson <doug@somethingdoug.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: mime-types@2.1.35
+Declared license: MIT
+Selected license: MIT
+Repository: jshttp/mime-types
+
+--- LICENSE ---
+(The MIT License)
+
+Copyright (c) 2014 Jonathan Ong <me@jongleberry.com>
+Copyright (c) 2015 Douglas Christopher Wilson <doug@somethingdoug.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: minimatch@10.2.5
+Declared license: BlueOak-1.0.0
+Selected license: BlueOak-1.0.0
+Repository: git@github.com:isaacs/minimatch
+
+--- LICENSE.md ---
+# Blue Oak Model License
+
+Version 1.0.0
+
+## Purpose
+
+This license gives everyone as much permission to work with
+this software as possible, while protecting contributors
 from liability.
 
 ## Acceptance
@@ -7534,6 +8521,37 @@ SOFTWARE.
 
 ================================================================================
 
+Package: unist-util-stringify-position@4.0.0
+Declared license: MIT
+Selected license: MIT
+Repository: syntax-tree/unist-util-stringify-position
+
+--- license ---
+(The MIT License)
+
+Copyright (c) 2016 Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
 Package: which@2.0.2
 Declared license: ISC
 Selected license: ISC
diff --git a/packages/core/package.json b/packages/core/package.json
index 61739d9608a..eaafb3135cb 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -2,7 +2,7 @@
   "name": "@maka/core",
   "version": "0.1.0",
   "license": "Apache-2.0",
-  "description": "Pure types for Maka — events, session, permission, connections.",
+  "description": "Pure types for Maka \u2014 events, session, permission, connections.",
   "type": "module",
   "sideEffects": false,
   "private": true,
@@ -180,6 +180,7 @@
   },
   "dependencies": {
     "intl-messageformat": "11.2.15",
+    "mdast-util-from-markdown": "^2.1.0",
     "marked": "18.0.11"
   }
 }
diff --git a/packages/core/src/__tests__/artifacts.test.ts b/packages/core/src/__tests__/artifacts.test.ts
index b2489ad63a2..66fd52cb004 100644
--- a/packages/core/src/__tests__/artifacts.test.ts
+++ b/packages/core/src/__tests__/artifacts.test.ts
@@ -59,29 +59,6 @@ describe('Artifact turn key', () => {
 });
 
 describe('Artifact source policy', () => {
-  test('image delivery placeholders are not child-result outputs', () => {
-    for (const status of ['pending', 'failed'] as const) {
-      assert.equal(
-        isArtifactChildResultOutput({
-          source: 'tool_result_projection',
-          imageDelivery: { messageId: 'message', source: '/tmp/image.png', status },
-        }),
-        false,
-      );
-    }
-    assert.equal(
-      isArtifactChildResultOutput({
-        source: 'tool_result_projection',
-        imageDelivery: {
-          messageId: 'message',
-          source: '/tmp/image.png',
-          status: 'ready',
-          contentSha256: 'a'.repeat(64),
-        },
-      }),
-      true,
-    );
-  });
   test('keeps workflow-owned evidence out of independent user deletion', () => {
     for (const source of ARTIFACT_SOURCES) {
       assert.equal(
diff --git a/packages/core/src/__tests__/image-markdown.test.ts b/packages/core/src/__tests__/image-markdown.test.ts
index c983b397ab1..b383995701c 100644
--- a/packages/core/src/__tests__/image-markdown.test.ts
+++ b/packages/core/src/__tests__/image-markdown.test.ts
@@ -19,7 +19,11 @@
 
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
-import { markdownImageSources, parseMarkdownImageDestination } from '../image-markdown.js';
+import {
+  positionedMarkdownImages,
+  markdownImageSources,
+  parseMarkdownImageDestination,
+} from '../image-markdown.js';
 import { IMAGE_MARKDOWN_MAX_LENGTH } from '../image-delivery.js';
 
 test('canonical destinations retain document order, references and explicit attachments', () => {
@@ -68,3 +72,32 @@ test('inline destinations require one complete image token with no trailing synt
   ])
     assert.equal(parseMarkdownImageDestination(source), undefined);
 });
+
+test('canonical image ranges address exact occurrences without touching shared definitions or examples', () => {
+  const text =
+    '`![code][p]`\n\n> ![one][p]\n\n![two][p]\n\n[p]: <https://example.com/a.png?token=secret>\n';
+  const refs = positionedMarkdownImages(text);
+  assert.deepEqual(
+    refs.map((ref) => ref.raw),
+    ['![one][p]', '![two][p]'],
+  );
+  assert.deepEqual(
+    refs.map((ref) => text.slice(ref.start, ref.end)),
+    refs.map((ref) => ref.raw),
+  );
+  assert.deepEqual(
+    refs.map((ref) => ref.alt),
+    ['one', 'two'],
+  );
+  assert.ok(refs.every((ref) => ref.source === 'https://example.com/a.png?token=secret'));
+});
+
+test('position adapters preserve existing GFM exclusions and archived entity identities', () => {
+  for (const text of ['https://example.com/![x](/tmp/a.png)', 'www.example.com/![x](/tmp/a.png)']) {
+    assert.deepEqual(markdownImageSources(text), []);
+    assert.deepEqual(positionedMarkdownImages(text), []);
+  }
+  const text = '![x](https://example.com/a?token=secret&amp;v=1)';
+  assert.deepEqual(markdownImageSources(text), ['https://example.com/a?token=secret&amp;v=1']);
+  assert.equal(positionedMarkdownImages(text)[0]?.source, markdownImageSources(text)[0]);
+});
diff --git a/packages/core/src/artifacts.ts b/packages/core/src/artifacts.ts
index 6a0e99e1021..1cd87adc5c0 100644
--- a/packages/core/src/artifacts.ts
+++ b/packages/core/src/artifacts.ts
@@ -186,11 +186,7 @@ export function isArtifactSharedSessionReadable(record: Pick<ArtifactRecord, 'so
   return ARTIFACT_SOURCE_POLICIES[record.source].sharedReadable;
 }
 
-export function isArtifactChildResultOutput(
-  record: Pick<ArtifactRecord, 'source'> & Partial<Pick<ArtifactRecord, 'imageDelivery'>>,
-): boolean {
-  if (record.imageDelivery?.status === 'pending' || record.imageDelivery?.status === 'failed')
-    return false;
+export function isArtifactChildResultOutput(record: Pick<ArtifactRecord, 'source'>): boolean {
   return CHILD_RESULT_OUTPUT_SOURCES.has(record.source);
 }
 
diff --git a/packages/core/src/image-delivery.ts b/packages/core/src/image-delivery.ts
index 81f3b897be1..da283ea307a 100644
--- a/packages/core/src/image-delivery.ts
+++ b/packages/core/src/image-delivery.ts
@@ -71,7 +71,19 @@ export interface ImageDeliveryRequest {
   /** Client permits remote media loading; the Host also checks application outbound policy. */
   readonly loadRemote?: boolean;
 }
+/** Stable source identity, independent of retry or display authority. */
+export interface ImageDeliveryIdentity {
+  readonly sessionId: string;
+  readonly turnId: string;
+  readonly messageId: string;
+  readonly source: string;
+}
+/** Attempts are workflow state; only successful captures become Artifacts. */
+export type ImageDeliveryAttempt =
+  | { readonly status: 'pending' }
+  | { readonly status: 'failed'; readonly reason: ImageDeliveryFailure };
 export type ImageDeliveryResult =
+  // Legacy wire spelling: the client has not granted remote display authority.
   | { readonly status: 'requires_confirmation' }
   | { readonly status: 'pending' }
   | { readonly status: 'ready'; readonly artifactId: string }
diff --git a/packages/core/src/image-markdown.ts b/packages/core/src/image-markdown.ts
index 5d823080c69..ae27460cfe2 100644
--- a/packages/core/src/image-markdown.ts
+++ b/packages/core/src/image-markdown.ts
@@ -18,6 +18,8 @@
  */
 
 import { Lexer, Marked } from 'marked';
+import { fromMarkdown } from 'mdast-util-from-markdown';
+import type { Nodes } from 'mdast';
 import { IMAGE_MARKDOWN_MAX_LENGTH } from './image-delivery.js';
 
 const parser = new Marked({ gfm: true });
@@ -45,3 +47,30 @@ export function parseMarkdownImageDestination(source: string): string | undefine
   const [token] = Lexer.lexInline(markdown, { gfm: true });
   return token?.type === 'image' && token.raw === markdown ? token.href : undefined;
 }
+
+/** Source ranges are an adapter detail; canonical destinations retain Marked's
+ * existing GFM and entity semantics, including identities saved by older Hosts. */
+export function positionedMarkdownImages(text: string) {
+  const images = markdownImages(text);
+  if (!images.length) return [];
+  const destinations = new Map(images.map((image) => [image.raw, image.source]));
+  const canonical = new Set(images.map((image) => image.source));
+  const positioned: { raw: string; source: string; alt: string; start: number; end: number }[] = [];
+  const pending: Nodes[] = [fromMarkdown(text)];
+  while (pending.length) {
+    const node = pending.pop()!;
+    if (node.type === 'image' || node.type === 'imageReference') {
+      const start = node.position?.start.offset;
+      const end = node.position?.end.offset;
+      if (start === undefined || end === undefined) continue;
+      const raw = text.slice(start, end);
+      const source =
+        destinations.get(raw) ??
+        (node.type === 'image' && canonical.has(node.url) ? node.url : undefined);
+      if (source !== undefined) positioned.push({ raw, source, alt: node.alt ?? '', start, end });
+    } else if ('children' in node) {
+      for (let i = node.children.length - 1; i >= 0; i--) pending.push(node.children[i]!);
+    }
+  }
+  return positioned;
+}
diff --git a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
index 98c759453e8..94be54d8e31 100644
--- a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
+++ b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
@@ -125,7 +125,7 @@ async function fixture(
         return authority.store.create(input);
       },
       findImageDelivery: authority.store.findImageDelivery,
-      deleteOwnedArtifactInSession: authority.store.deleteOwnedArtifactInSession,
+      setImageDeliveryAttempt: authority.store.setImageDeliveryAttempt,
     },
     admission: new SessionAdmissionGate(),
     limits,
@@ -278,7 +278,7 @@ test('automatically saves a local delivery without any UI request; deletion and
         input.messageId,
         source,
       );
-      assert.equal(record?.imageDelivery?.status, 'ready');
+      assert.equal(record?.status, 'ready');
       const bytes = await reopened.store.readBinaryInSession(input.sessionId, result.artifactId);
       assert.equal(bytes.ok, true);
       if (bytes.ok) assert.equal(bytes.base64, PNG.toString('base64'));
@@ -570,8 +570,7 @@ test('truncated HTTP images are rejected, and an explicit retry archives the rep
     });
     assert.equal(requests, 1);
     const failed = await f.authority.store.listPage(REQUEST.sessionId, { offset: 0, limit: 10 });
-    assert.equal(failed.total, 1);
-    assert.equal(failed.records[0]?.imageDelivery?.status, 'failed');
+    assert.equal(failed.total, 0, 'failed delivery is not a file');
     content = PNG;
     assert.equal((await f.service.resolve({ ...identity, retry: true })).status, 'pending');
     await f.service.waitForIdle();
@@ -678,8 +677,16 @@ test('pending capture survives persistence failure and is removed only after a d
     observe(f.service, REQUEST.source);
     await f.service.waitForIdle();
     const pending = await f.authority.store.listPage(REQUEST.sessionId, { offset: 0, limit: 10 });
-    assert.equal(pending.total, 1);
-    assert.equal(pending.records[0]?.imageDelivery?.status, 'pending');
+    assert.equal(pending.total, 0, 'pending capture is not an artifact');
+    assert.deepEqual(
+      await f.authority.store.findImageDelivery(
+        REQUEST.sessionId,
+        REQUEST.turnId,
+        REQUEST.messageId,
+        REQUEST.source,
+      ),
+      { status: 'pending' },
+    );
     assert.equal(f.errors.length, 1);
     failPublication = false;
     assert.equal((await f.service.resolve(REQUEST)).status, 'pending');
@@ -1397,3 +1404,34 @@ test('automatic capture and PublishImage share content quota without merging the
     await f.close();
   }
 });
+
+test('a queued retry reports pending instead of replaying the previous failure', async () => {
+  let release!: () => void;
+  const blocked = new Promise<void>((resolve) => {
+    release = resolve;
+  });
+  let fail = true;
+  const f = await fixture(undefined, async (_sessionId, path) => {
+    if (path !== REQUEST.source) await blocked;
+    else if (fail) throw Object.assign(new Error('missing'), { code: 'ENOENT' });
+    return checkedChatImage(PNG);
+  });
+  try {
+    observe(f.service, REQUEST.source);
+    await f.service.waitForIdle();
+    assert.deepEqual(await f.service.resolve(REQUEST), { status: 'failed', reason: 'not_found' });
+    observe(f.service, '/tmp/blocker-one.png');
+    observe(f.service, '/tmp/blocker-two.png');
+    while (f.reads < 3) await new Promise((resolve) => setImmediate(resolve));
+    fail = false;
+    assert.deepEqual(await f.service.resolve({ ...REQUEST, retry: true }), { status: 'pending' });
+    assert.deepEqual(await f.service.resolve(REQUEST), { status: 'pending' });
+    release();
+    await f.service.waitForIdle();
+    assert.equal((await f.service.resolve(REQUEST)).status, 'ready');
+    assert.deepEqual(f.errors, []);
+  } finally {
+    release();
+    await f.close();
+  }
+});
diff --git a/packages/runtime-host/src/server/chat-image-delivery.ts b/packages/runtime-host/src/server/chat-image-delivery.ts
index 54f067b22d4..5de026cccbf 100644
--- a/packages/runtime-host/src/server/chat-image-delivery.ts
+++ b/packages/runtime-host/src/server/chat-image-delivery.ts
@@ -27,6 +27,8 @@ import {
   type ImageDeliveryRequest,
   type ImageDeliveryResult,
   type ImageDeliveryFailure,
+  type ImageDeliveryIdentity,
+  type ImageDeliveryAttempt,
 } from '@maka/core/image-delivery';
 import {
   ImageArchiveQuotaError,
@@ -44,9 +46,7 @@ import {
   type ChatImageBytes,
 } from './chat-image-source.js';
 
-interface DeliveryIdentity extends ImageDeliveryRequest {
-  readonly sessionId: string;
-}
+type DeliveryIdentity = ImageDeliveryIdentity & ImageDeliveryRequest;
 interface DeliveryJob {
   readonly done: Promise<void>;
   run(): Promise<void>;
@@ -55,7 +55,7 @@ interface DeliveryJob {
 export interface ChatImageDeliveryPorts {
   readonly artifacts: Pick<
     InteractiveArtifactStoreWriter,
-    'create' | 'findImageDelivery' | 'deleteOwnedArtifactInSession'
+    'create' | 'findImageDelivery' | 'setImageDeliveryAttempt'
   >;
   readonly admission: SessionAdmissionGate;
   isPresent(sessionId: string): Promise<boolean>;
@@ -99,18 +99,16 @@ export class ChatImageDeliveryService {
 
   async resolve(identity: DeliveryIdentity): Promise<ImageDeliveryResult> {
     if (this.#closed) return { status: 'unavailable' };
-    const record = await this.ports.artifacts.findImageDelivery(
+    const metadata = await this.ports.artifacts.findImageDelivery(
       identity.sessionId,
       identity.turnId,
       identity.messageId,
       identity.source,
     );
-    const metadata = record?.imageDelivery;
     // A browser decode/read failure is not authority to destroy saved history.
-    if (metadata?.status === 'ready') return { status: 'ready', artifactId: record!.id };
-    if (metadata?.status === 'failed' && !identity.retry)
-      return { status: 'failed', reason: metadata.reason! };
+    if (metadata?.status === 'ready') return metadata;
     if (this.#jobs.has(deliveryKey(identity))) return { status: 'pending' };
+    if (metadata?.status === 'failed' && !identity.retry) return metadata;
     // A client-provided path is never a read grant. Legacy/restarted deliveries
     // must be found in canonical assistant text before any source is opened.
     if (!metadata) {
@@ -123,22 +121,6 @@ export class ChatImageDeliveryService {
         return { status: 'failed', reason: 'not_allowed' };
       if (!identity.loadRemote) return { status: 'requires_confirmation' };
     }
-    if (metadata?.status === 'failed') {
-      return this.ports.admission.runOrJoin(identity.sessionId, async () => {
-        if (this.#closed) return { status: 'unavailable' };
-        if (this.#jobs.has(deliveryKey(identity))) return { status: 'pending' };
-        if (this.#jobs.size >= 128) return { status: 'failed', reason: 'queue_full' };
-        await this.ports.artifacts.deleteOwnedArtifactInSession(
-          identity.sessionId,
-          record!.id,
-          'tool_result_projection',
-        );
-        // Capture outlives this admission and takes its own write admissions.
-        return this.ports.admission.detach(() => this.#enqueue(identity))
-          ? { status: 'pending' }
-          : { status: 'failed', reason: 'queue_full' };
-      });
-    }
     return this.#enqueue(identity)
       ? { status: 'pending' }
       : { status: 'failed', reason: 'queue_full' };
@@ -197,49 +179,24 @@ export class ChatImageDeliveryService {
       messageId,
       source,
     );
-    if (existing?.imageDelivery?.status !== 'pending' && existing) return;
+    if (existing?.status === 'ready' || (existing?.status === 'failed' && !identity.retry)) return;
     const metadata = { messageId, source };
     const resultId = `chat_image_result_${deliveryKey(identity)}`;
-    const pendingId = existing?.id ?? `chat_image_request_${deliveryKey(identity)}`;
-    const base = {
-      sessionId,
-      turnId,
-      name: 'chat-image',
-      source: 'tool_result_projection' as const,
-    };
-    const publish = async (input: Parameters<InteractiveArtifactStoreWriter['create']>[0]) =>
+    const publish = async (write: () => Promise<unknown>) =>
       this.ports.admission.runOrJoin(sessionId, async () => {
         if (this.#abort.signal.aborted || !(await this.ports.isPresent(sessionId))) return;
         try {
-          await this.ports.artifacts.create(input);
-          // Retain a pending request only until a terminal record is durable.
-          // A crash between these writes still replays the terminal record.
-          if (input.imageDelivery?.status !== 'pending')
-            await this.ports.artifacts.deleteOwnedArtifactInSession(
-              sessionId,
-              pendingId,
-              'tool_result_projection',
-            );
+          await write();
         } catch (error) {
           if (error instanceof ImageArchiveQuotaError) throw error;
           throw new ImagePersistenceError('Image persistence failed', { cause: error });
         }
       });
+    const publishAttempt = (attempt: ImageDeliveryAttempt) =>
+      publish(() => this.ports.artifacts.setImageDeliveryAttempt(identity, attempt));
     const publishFailure = (reason: ImageDeliveryFailure) =>
-      publish({
-        ...base,
-        id: resultId,
-        kind: 'file',
-        content: '',
-        imageDelivery: { ...metadata, status: 'failed', reason },
-      });
-    await publish({
-      ...base,
-      id: pendingId,
-      kind: 'file',
-      content: '',
-      imageDelivery: { ...metadata, status: 'pending' },
-    });
+      publishAttempt({ status: 'failed', reason });
+    await publishAttempt({ status: 'pending' });
     if (this.#abort.signal.aborted || !(await this.ports.isPresent(sessionId))) return;
     const readAbort = new AbortController();
     // Keep the read deadline alive even when a source has no active handles.
@@ -285,16 +242,18 @@ export class ChatImageDeliveryService {
       return;
     }
     try {
-      await publish(
-        readyChatImageArtifact({
-          id: resultId,
-          sessionId,
-          turnId,
-          name: base.name,
-          ...metadata,
-          image,
-          limits: this.ports.limits,
-        }),
+      await publish(() =>
+        this.ports.artifacts.create(
+          readyChatImageArtifact({
+            id: resultId,
+            sessionId,
+            turnId,
+            name: 'chat-image',
+            ...metadata,
+            image,
+            limits: this.ports.limits,
+          }),
+        ),
       );
     } catch (error) {
       if (!(error instanceof ImageArchiveQuotaError)) throw error;
diff --git a/packages/runtime-host/src/server/execution-composition.ts b/packages/runtime-host/src/server/execution-composition.ts
index 08a946b4f3d..6d60790a539 100644
--- a/packages/runtime-host/src/server/execution-composition.ts
+++ b/packages/runtime-host/src/server/execution-composition.ts
@@ -17,6 +17,7 @@
  * under the License.
  */
 
+import { createAssistantMessageReader } from './session-transcript-reader.js';
 import { createImageFileReader } from '@maka/runtime/image-file-reader';
 import { ChatImageDeliveryService } from './chat-image-delivery.js';
 import { downloadChatImage, ImageSourceError } from './chat-image-source.js';
@@ -635,52 +636,11 @@ export async function createExecutionRuntimeHostComposition(
         });
         return result;
       },
-      readMessage: async (identity) => {
-        await requireSessionManager(manager).ensureTranscriptLedgerForRead(identity.sessionId);
-        const [turn] = await stores.runtimeEventStore.readTranscriptTurns(identity.sessionId, {
-          turnId: identity.turnId,
-        });
-        if (!turn) return undefined;
-        for (
-          let position = turn.firstOrdinal, runs = 0;
-          position <= turn.lastOrdinal && runs < 16;
-          runs++
-        ) {
-          const found = await stores.runtimeEventStore.readTranscriptRun(
-            identity.sessionId,
-            {
-              direction: 'newer',
-              throughOrdinal: turn.lastOrdinal,
-              position,
-              maxEvents: 4096,
-              maxBytes: 16 * 1024 * 1024,
-              maxRecordBytes: 8 * 1024 * 1024,
-            },
-            (run, events) => {
-              let text: string | undefined;
-              for (const { event } of events) {
-                if (
-                  event.partial ||
-                  event.turnId !== identity.turnId ||
-                  event.role !== 'model' ||
-                  event.content?.kind !== 'text'
-                )
-                  continue;
-                if (
-                  (event.refs?.storedMessageId ?? event.refs?.providerEventId ?? event.id) ===
-                  identity.messageId
-                )
-                  text = event.content.text;
-              }
-              return { text, next: run.lastOrdinal + 1 };
-            },
-          );
-          if (!found) break;
-          if (found.text !== undefined) return found.text;
-          position = found.next;
-        }
-        return undefined;
-      },
+      readMessage: createAssistantMessageReader({
+        events: stores.runtimeEventStore,
+        ensureTranscriptLedger: (sessionId) =>
+          requireSessionManager(manager).ensureTranscriptLedgerForRead(sessionId),
+      }),
     });
     // Shared with recall's material fetch, so a file brought in from another
     // Session is answered by the same reader that answers one stored here.
@@ -823,13 +783,9 @@ export async function createExecutionRuntimeHostComposition(
         return Uint8Array.from(Buffer.from(result.base64, 'base64'));
       },
       list: async (invocation) =>
-        (await openedArtifactStore.listTurnArtifacts(invocation.sessionId, invocation.turnId))
-          .filter(
-            (record) =>
-              record.imageDelivery?.status !== 'pending' &&
-              record.imageDelivery?.status !== 'failed',
-          )
-          .map(pluginAttachmentRef),
+        (await openedArtifactStore.listTurnArtifacts(invocation.sessionId, invocation.turnId)).map(
+          pluginAttachmentRef,
+        ),
     });
     const webSearchService = createHostWebSearchService({
       policy: runtimePolicyStores.operations,
@@ -1970,7 +1926,9 @@ export async function createExecutionRuntimeHostComposition(
           return undefined;
         }
       },
-      (sessionId, event) => imageDelivery?.observe(sessionId, event),
+      (sessionId, event) => {
+        if (event.type === 'text_complete') imageDelivery?.observe(sessionId, event);
+      },
     );
     const coordinator = rootCoordinator;
     const pluginModel = createHostPluginModel({
diff --git a/packages/runtime-host/src/server/session-transcript-reader.ts b/packages/runtime-host/src/server/session-transcript-reader.ts
index 2749bf1372e..abce9aa0959 100644
--- a/packages/runtime-host/src/server/session-transcript-reader.ts
+++ b/packages/runtime-host/src/server/session-transcript-reader.ts
@@ -650,3 +650,63 @@ function createTranscriptProjection(invocations: readonly RuntimeInvocationRecor
     },
   };
 }
+
+/** Resolves only settled canonical assistant text; presentation cannot grant a file read. */
+export function createAssistantMessageReader(input: {
+  events: Pick<
+    ExecutionStoresWriter<'interactive'>['runtimeEventStore'],
+    'readTranscriptTurns' | 'readTranscriptRun'
+  >;
+  ensureTranscriptLedger(sessionId: string): Promise<void>;
+}) {
+  return async (identity: {
+    sessionId: string;
+    turnId: string;
+    messageId: string;
+  }): Promise<string | undefined> => {
+    await input.ensureTranscriptLedger(identity.sessionId);
+    const [turn] = await input.events.readTranscriptTurns(identity.sessionId, {
+      turnId: identity.turnId,
+    });
+    if (!turn) return undefined;
+    for (
+      let position = turn.firstOrdinal, runs = 0;
+      position <= turn.lastOrdinal && runs < 16;
+      runs++
+    ) {
+      const found = await input.events.readTranscriptRun(
+        identity.sessionId,
+        {
+          direction: 'newer',
+          throughOrdinal: turn.lastOrdinal,
+          position,
+          maxEvents: 4096,
+          maxBytes: 16 * 1024 * 1024,
+          maxRecordBytes: 8 * 1024 * 1024,
+        },
+        (run, events) => {
+          let text: string | undefined;
+          for (const { event } of events) {
+            if (
+              event.partial ||
+              event.turnId !== identity.turnId ||
+              event.role !== 'model' ||
+              event.content?.kind !== 'text'
+            )
+              continue;
+            if (
+              (event.refs?.storedMessageId ?? event.refs?.providerEventId ?? event.id) ===
+              identity.messageId
+            )
+              text = event.content.text;
+          }
+          return { text, next: run.lastOrdinal + 1 };
+        },
+      );
+      if (!found) break;
+      if (found.text !== undefined) return found.text;
+      position = found.next;
+    }
+    return undefined;
+  };
+}
diff --git a/packages/storage/src/__tests__/image-delivery-storage.test.ts b/packages/storage/src/__tests__/image-delivery-storage.test.ts
new file mode 100644
index 00000000000..86972386adc
--- /dev/null
+++ b/packages/storage/src/__tests__/image-delivery-storage.test.ts
@@ -0,0 +1,219 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { DatabaseSync } from 'node:sqlite';
+import { mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createHash } from 'node:crypto';
+import { createSqliteArtifactStoreWriteAuthority } from '../artifact-store.js';
+import { migrateSqliteArtifactDatabase } from '../sqlite-artifact-schema.js';
+import { assertImageArchiveQuota, ImageArchiveQuotaError } from '../artifact-image-storage.js';
+import { DEFAULT_IMAGE_ARCHIVE_LIMITS } from '@maka/core/image-delivery';
+import { readImageDeliveryAttempt } from '../sqlite-image-delivery.js';
+
+const identity = {
+  sessionId: 'session-1',
+  turnId: 'turn-1',
+  messageId: 'message-1',
+  source: '/tmp/image.png',
+};
+const lookup = (
+  store: ReturnType<typeof createSqliteArtifactStoreWriteAuthority>['store'],
+  i = identity,
+) => store.findImageDelivery(i.sessionId, i.turnId, i.messageId, i.source);
+
+test('attempts survive reopen and copy, never appear as files, and purge without an artifact', async () => {
+  const root = await mkdtemp(join(tmpdir(), 'maka-image-attempt-'));
+  let authority = createSqliteArtifactStoreWriteAuthority(root);
+  try {
+    await authority.store.setImageDeliveryAttempt(identity, {
+      status: 'failed',
+      reason: 'not_found',
+    });
+    assert.equal(
+      (await authority.store.listPage(identity.sessionId, { offset: 0, limit: 10 })).total,
+      0,
+    );
+    assert.deepEqual(
+      await authority.store.listTurnArtifacts(identity.sessionId, identity.turnId),
+      [],
+    );
+    authority.close();
+    authority = createSqliteArtifactStoreWriteAuthority(root);
+    assert.deepEqual(await lookup(authority.store), { status: 'failed', reason: 'not_found' });
+    await authority.store.copyConversationArtifacts({
+      sourceSessionId: identity.sessionId,
+      targetSessionId: 'session-2',
+      turnIds: [identity.turnId],
+    });
+    const copied = { ...identity, sessionId: 'session-2' };
+    assert.deepEqual(await lookup(authority.store, copied), {
+      status: 'failed',
+      reason: 'not_found',
+    });
+    await authority.store.purgeSessionArtifacts(identity.sessionId);
+    assert.equal(await lookup(authority.store), undefined);
+    assert.deepEqual(await lookup(authority.store, copied), {
+      status: 'failed',
+      reason: 'not_found',
+    });
+  } finally {
+    authority.close();
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test('successful publication atomically supersedes attempts and cannot be downgraded by retries', async () => {
+  const root = await mkdtemp(join(tmpdir(), 'maka-image-publish-'));
+  const authority = createSqliteArtifactStoreWriteAuthority(root);
+  try {
+    await authority.store.setImageDeliveryAttempt(identity, { status: 'pending' });
+    const content = new Uint8Array([1, 2, 3]);
+    const record = await authority.store.create({
+      ...identity,
+      id: 'image-result',
+      name: 'image',
+      source: 'tool_result_projection',
+      kind: 'image',
+      content,
+      imageDelivery: {
+        messageId: identity.messageId,
+        source: identity.source,
+        status: 'ready',
+        contentSha256: createHash('sha256').update(content).digest('hex'),
+      },
+    });
+    await authority.store.setImageDeliveryAttempt(identity, {
+      status: 'failed',
+      reason: 'read_failed',
+    });
+    assert.deepEqual(await lookup(authority.store), { status: 'ready', artifactId: record.id });
+    const db = new DatabaseSync(join(root, 'runtime.sqlite'), { readOnly: true });
+    try {
+      assert.equal(readImageDeliveryAttempt(db, identity), undefined);
+    } finally {
+      db.close();
+    }
+    await assert.rejects(
+      authority.store.create({
+        ...identity,
+        id: 'empty-placeholder',
+        name: 'image',
+        kind: 'file',
+        source: 'tool_result_projection',
+        content: '',
+        imageDelivery: {
+          messageId: identity.messageId,
+          source: identity.source,
+          status: 'pending',
+        },
+      }),
+      /Invalid image delivery metadata/,
+    );
+  } finally {
+    authority.close();
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test('v4 placeholder migration preserves terminal precedence and schedules safe file cleanup', () => {
+  const db = new DatabaseSync(':memory:');
+  try {
+    migrateSqliteArtifactDatabase(db);
+    for (const status of ['pending', 'failed'] as const) {
+      const record = {
+        sessionId: identity.sessionId,
+        turnId: identity.turnId,
+        id: status,
+        name: 'chat-image',
+        kind: 'file',
+        sizeBytes: 0,
+        createdAt: 1,
+        relativePath: `session-1/${status}-chat-image`,
+        source: 'tool_result_projection',
+        imageDelivery: {
+          messageId: identity.messageId,
+          source: identity.source,
+          status,
+          ...(status === 'failed' ? { reason: 'not_found' } : {}),
+        },
+      };
+      db.prepare('INSERT INTO artifact_records VALUES (?, ?, ?, ?, ?)').run(
+        record.id,
+        record.sessionId,
+        record.createdAt,
+        record.relativePath,
+        JSON.stringify(record),
+      );
+    }
+    migrateSqliteArtifactDatabase(db);
+    assert.deepEqual(readImageDeliveryAttempt(db, identity), {
+      status: 'failed',
+      reason: 'not_found',
+    });
+    assert.equal(db.prepare('SELECT COUNT(*) AS n FROM artifact_records').get()?.n, 0);
+    assert.equal(db.prepare('SELECT COUNT(*) AS n FROM artifact_upgrade_orphan_paths').get()?.n, 2);
+    migrateSqliteArtifactDatabase(db);
+    assert.deepEqual(readImageDeliveryAttempt(db, identity), {
+      status: 'failed',
+      reason: 'not_found',
+    });
+  } finally {
+    db.close();
+  }
+});
+
+test('archive policy enforces defaults even when a caller omits its limits', () => {
+  const existing = {
+    id: 'existing',
+    sessionId: identity.sessionId,
+    turnId: identity.turnId,
+    name: 'image',
+    kind: 'image' as const,
+    source: 'tool_result_projection' as const,
+    createdAt: 1,
+    relativePath: 'session-1/existing-image',
+    sizeBytes: DEFAULT_IMAGE_ARCHIVE_LIMITS.sessionBytes,
+    imageDelivery: {
+      messageId: identity.messageId,
+      source: identity.source,
+      status: 'ready' as const,
+      contentSha256: 'a'.repeat(64),
+    },
+  };
+  assert.throws(
+    () =>
+      assertImageArchiveQuota([existing], {
+        sessionId: identity.sessionId,
+        sizeBytes: 1,
+        imageDelivery: { ...existing.imageDelivery, contentSha256: 'b'.repeat(64) },
+      }),
+    ImageArchiveQuotaError,
+  );
+  assert.doesNotThrow(() =>
+    assertImageArchiveQuota([existing], {
+      sessionId: identity.sessionId,
+      sizeBytes: existing.sizeBytes,
+      imageDelivery: existing.imageDelivery,
+    }),
+  );
+});
diff --git a/packages/storage/src/__tests__/session-bundle-policy.test.ts b/packages/storage/src/__tests__/session-bundle-policy.test.ts
index 6caaad0f43f..ab3035a348d 100644
--- a/packages/storage/src/__tests__/session-bundle-policy.test.ts
+++ b/packages/storage/src/__tests__/session-bundle-policy.test.ts
@@ -32,6 +32,7 @@ import {
   importSessionBundleState,
   listSessionBundleMergeTables,
 } from '../session-bundle-policy.js';
+import { writeImageDeliveryAttempt, readImageDeliveryAttempt } from '../sqlite-image-delivery.js';
 import { createSqliteRuntimeStore } from '../sqlite-runtime-store.js';
 
 test('exports one Session as filtered SQLite', async () => {
@@ -51,6 +52,13 @@ test('exports one Session as filtered SQLite', async () => {
     sourceDatabase
       .prepare('INSERT INTO usage_pricing_overrides(model_key, record_json) VALUES (?, ?)')
       .run('private-model', '{}');
+    for (const sessionId of [selected.id, excluded.id]) {
+      writeImageDeliveryAttempt(
+        sourceDatabase,
+        { sessionId, turnId: 'turn-1', messageId: 'image-message', source: '/tmp/image.png' },
+        { status: 'failed', reason: 'not_found' },
+      );
+    }
     sourceDatabase.close();
 
     const plan = await exportSessionBundleState({
@@ -67,6 +75,13 @@ test('exports one Session as filtered SQLite', async () => {
         .all()
         .map((row) => (row as { session_id: string }).session_id);
       assert.deepEqual(ids, [selected.id]);
+      assert.deepEqual(
+        database
+          .prepare('SELECT session_id FROM image_delivery_attempts')
+          .all()
+          .map((row) => row.session_id),
+        [selected.id],
+      );
       assert.equal(
         (
           database.prepare('SELECT COUNT(*) AS count FROM session_messages').get() as {
@@ -86,6 +101,22 @@ test('exports one Session as filtered SQLite', async () => {
     } finally {
       database.close();
     }
+    const targetRoot = join(base, 'imported');
+    await importSessionBundleState({ stateRoot: targetRoot, bundleStateRoot: destinationRoot });
+    const imported = new DatabaseSync(join(targetRoot, 'runtime.sqlite'), { readOnly: true });
+    try {
+      assert.deepEqual(
+        readImageDeliveryAttempt(imported, {
+          sessionId: selected.id,
+          turnId: 'turn-1',
+          messageId: 'image-message',
+          source: '/tmp/image.png',
+        }),
+        { status: 'failed', reason: 'not_found' },
+      );
+    } finally {
+      imported.close();
+    }
   } finally {
     await rm(base, { recursive: true, force: true });
   }
diff --git a/packages/storage/src/artifact-image-storage.ts b/packages/storage/src/artifact-image-storage.ts
index c0c477e71f4..16c33498a69 100644
--- a/packages/storage/src/artifact-image-storage.ts
+++ b/packages/storage/src/artifact-image-storage.ts
@@ -18,7 +18,11 @@
  */
 
 import type { ArtifactRecord } from '@maka/core/artifacts';
-import type { ImageArchiveLimits, ImageDeliveryMetadata } from '@maka/core/image-delivery';
+import {
+  DEFAULT_IMAGE_ARCHIVE_LIMITS,
+  type ImageArchiveLimits,
+  type ImageDeliveryMetadata,
+} from '@maka/core/image-delivery';
 
 export class ImageArchiveQuotaError extends Error {
   readonly name = 'ImageArchiveQuotaError';
@@ -66,8 +70,8 @@ export function assertImageArchiveQuota(
   const digest =
     input.imageDelivery?.status === 'ready' ? input.imageDelivery.contentSha256 : undefined;
   const size = input.sizeBytes;
-  const limits = input.imageArchiveLimits;
-  if (digest && limits) {
+  const limits = input.imageArchiveLimits ?? DEFAULT_IMAGE_ARCHIVE_LIMITS;
+  if (digest) {
     if (
       ![limits.sessionBytes, limits.workspaceBytes].every((v) => Number.isSafeInteger(v) && v >= 0)
     )
diff --git a/packages/storage/src/artifact-store.ts b/packages/storage/src/artifact-store.ts
index df20d55b777..8202c1b6c71 100644
--- a/packages/storage/src/artifact-store.ts
+++ b/packages/storage/src/artifact-store.ts
@@ -22,6 +22,9 @@ import {
   DEFAULT_IMAGE_ARCHIVE_LIMITS,
   isImageDeliveryMetadata,
   type ImageDeliveryMetadata,
+  type ImageDeliveryIdentity,
+  type ImageDeliveryAttempt,
+  type ImageDeliveryResult,
   type ImageArchiveLimits,
 } from '@maka/core/image-delivery';
 import { createHash, randomUUID } from 'node:crypto';
@@ -205,7 +208,11 @@ export interface ArtifactAuthorityStore extends DurableArtifactAttachmentReader
     turnId: string,
     messageId: string,
     source: string,
-  ): Promise<ArtifactRecord | undefined>;
+  ): Promise<ImageDeliveryResult | undefined>;
+  setImageDeliveryAttempt(
+    identity: ImageDeliveryIdentity,
+    attempt: ImageDeliveryAttempt,
+  ): Promise<void>;
   close(): void;
   copyConversationArtifacts(
     input: ConversationArtifactCopyInput,
@@ -291,12 +298,25 @@ class SqliteArtifactStore implements ArtifactAuthorityStore {
     turnId: string,
     messageId: string,
     source: string,
-  ): Promise<ArtifactRecord | undefined> {
+  ): Promise<ImageDeliveryResult | undefined> {
     return this.enqueue(async () =>
       this.metadataRepository.findImageDelivery(sessionId, turnId, messageId, source),
     );
   }
 
+  setImageDeliveryAttempt(
+    identity: ImageDeliveryIdentity,
+    attempt: ImageDeliveryAttempt,
+  ): Promise<void> {
+    assertCanonicalArtifactEntityId(identity.sessionId, 'sessionId');
+    assertArtifactTurnKey(identity.turnId);
+    const acceptedIdentity = Object.freeze({ ...identity });
+    const acceptedAttempt = Object.freeze({ ...attempt });
+    return this.enqueueMutation(async () =>
+      this.metadataRepository.setImageDeliveryAttempt(acceptedIdentity, acceptedAttempt),
+    );
+  }
+
   async create(input: CreateArtifactInput): Promise<ArtifactRecord> {
     const acceptedInput: CreateArtifactInput = Object.freeze({
       ...input,
@@ -308,7 +328,8 @@ class SqliteArtifactStore implements ArtifactAuthorityStore {
     });
     if (
       acceptedInput.imageDelivery !== undefined &&
-      !isImageDeliveryMetadata(acceptedInput.imageDelivery)
+      (!isImageDeliveryMetadata(acceptedInput.imageDelivery) ||
+        acceptedInput.imageDelivery.status !== 'ready')
     )
       throw new Error('Invalid image delivery metadata');
     if (
@@ -402,7 +423,7 @@ class SqliteArtifactStore implements ArtifactAuthorityStore {
       }
       requestedLinkedArtifactIds.set(linked.sessionId, artifactIds);
     }
-    const records = await this.enqueue(async () => {
+    const { records, attempts } = await this.enqueue(async () => {
       await this.load();
       const selected = this.records
         .filter(
@@ -433,7 +454,12 @@ class SqliteArtifactStore implements ArtifactAuthorityStore {
           selectedIds.add(record.id);
         }
       }
-      return selected;
+      return {
+        records: selected,
+        attempts: this.metadataRepository.readImageDeliveryAttempts(input.sourceSessionId, [
+          ...turnIds,
+        ]),
+      };
     });
 
     const artifactIds = new Map<string, string>();
@@ -458,6 +484,9 @@ class SqliteArtifactStore implements ArtifactAuthorityStore {
       artifactIds.set(record.id, created.id);
       relativePaths.set(record.relativePath, created.relativePath);
     }
+    await this.enqueueMutation(async () =>
+      this.metadataRepository.copyImageDeliveryAttempts(attempts, input.targetSessionId),
+    );
     return { artifactIds, relativePaths };
   }
 
@@ -561,6 +590,7 @@ class SqliteArtifactStore implements ArtifactAuthorityStore {
       await this.purgeRecordsUnlocked(
         this.records.filter((record) => record.sessionId === sessionId),
       );
+      this.metadataRepository.purgeImageDeliveryAttempts(sessionId);
     });
   }
 
diff --git a/packages/storage/src/artifact-stores.ts b/packages/storage/src/artifact-stores.ts
index 383bef82e1e..7f9246392ec 100644
--- a/packages/storage/src/artifact-stores.ts
+++ b/packages/storage/src/artifact-stores.ts
@@ -59,6 +59,7 @@ export interface InteractiveArtifactStoreWriter extends DurableArtifactAttachmen
   readonly [writerBrand]: true;
   create(input: CreateArtifactInput): Promise<ArtifactRecord>;
   findImageDelivery: ArtifactAuthorityStore['findImageDelivery'];
+  setImageDeliveryAttempt: ArtifactAuthorityStore['setImageDeliveryAttempt'];
   /**
    * Narrow system delete for one Session-owned artifact of a declared source.
    *
@@ -140,6 +141,11 @@ function createWriterFacade(
     [writerBrand]: true,
     findImageDelivery: (sessionId, turnId, messageId, source) =>
       run(() => store.findImageDelivery(sessionId, turnId, messageId, source)),
+    setImageDeliveryAttempt: (identity, attempt) => {
+      const acceptedIdentity = Object.freeze({ ...identity });
+      const acceptedAttempt = Object.freeze({ ...attempt });
+      return run(() => store.setImageDeliveryAttempt(acceptedIdentity, acceptedAttempt));
+    },
     listPage: (sessionId, options) => run(() => store.listPage(sessionId, options)),
     listTurnArtifacts: (sessionId, turnId) => run(() => store.listTurnArtifacts(sessionId, turnId)),
     getInSession: (sessionId, artifactId) => run(() => store.getInSession(sessionId, artifactId)),
diff --git a/packages/storage/src/sqlite-artifact-metadata.ts b/packages/storage/src/sqlite-artifact-metadata.ts
index c29e65abeba..2184a1617b6 100644
--- a/packages/storage/src/sqlite-artifact-metadata.ts
+++ b/packages/storage/src/sqlite-artifact-metadata.ts
@@ -18,6 +18,18 @@
  */
 
 import { resolve } from 'node:path';
+import type {
+  ImageDeliveryIdentity,
+  ImageDeliveryAttempt,
+  ImageDeliveryResult,
+} from '@maka/core/image-delivery';
+import {
+  readImageDeliveryAttempt,
+  writeImageDeliveryAttempt,
+  removeImageDeliveryAttempt,
+  readImageDeliveryAttempts,
+  type StoredImageDeliveryAttempt,
+} from './sqlite-image-delivery.js';
 import type { ArtifactRecord } from '@maka/core/artifacts';
 import { decodeArtifactRecordJsons } from './artifact-metadata-codec.js';
 import {
@@ -47,7 +59,7 @@ class SqliteArtifactMetadataRepository {
     turnId: string,
     messageId: string,
     source: string,
-  ): ArtifactRecord | undefined {
+  ): ImageDeliveryResult | undefined {
     this.assertOpen();
     const rows = this.#lease.database
       .prepare(`
@@ -57,11 +69,74 @@ class SqliteArtifactMetadataRepository {
         AND json_extract(record_json, '$.turnId') = ?
         AND json_extract(record_json, '$.imageDelivery.messageId') = ?
         AND json_extract(record_json, '$.imageDelivery.source') = ?
-      ORDER BY CASE json_extract(record_json, '$.imageDelivery.status') WHEN 'pending' THEN 1 ELSE 0 END,
-        created_at DESC, artifact_id DESC LIMIT 1
+        AND json_extract(record_json, '$.imageDelivery.status') = 'ready'
+      ORDER BY created_at DESC, artifact_id DESC LIMIT 1
     `)
       .all(sessionId, turnId, messageId, source) as Array<{ record_json: string }>;
-    return decodeRows(rows)[0];
+    const record = decodeRows(rows)[0];
+    if (record?.imageDelivery?.status === 'ready')
+      return { status: 'ready', artifactId: record.id };
+    return readImageDeliveryAttempt(this.#lease.database, { sessionId, turnId, messageId, source });
+  }
+
+  setImageDeliveryAttempt(identity: ImageDeliveryIdentity, attempt: ImageDeliveryAttempt): void {
+    this.assertOpen();
+    this.#lease.transaction('write', () => {
+      // Saved history is immutable, including when a retry races publication.
+      if (
+        this.findImageDelivery(
+          identity.sessionId,
+          identity.turnId,
+          identity.messageId,
+          identity.source,
+        )?.status === 'ready'
+      )
+        return;
+      writeImageDeliveryAttempt(this.#lease.database, identity, attempt);
+    });
+  }
+
+  readImageDeliveryAttempts(
+    sessionId: string,
+    turnIds: readonly string[],
+  ): StoredImageDeliveryAttempt[] {
+    this.assertOpen();
+    return readImageDeliveryAttempts(this.#lease.database, sessionId, turnIds);
+  }
+
+  copyImageDeliveryAttempts(
+    attempts: readonly StoredImageDeliveryAttempt[],
+    targetSessionId: string,
+  ): void {
+    this.assertOpen();
+    this.#lease.transaction('write', () => {
+      for (const record of attempts) {
+        const identity = { ...record.identity, sessionId: targetSessionId };
+        if (
+          !this.findImageDelivery(
+            identity.sessionId,
+            identity.turnId,
+            identity.messageId,
+            identity.source,
+          )
+        )
+          writeImageDeliveryAttempt(
+            this.#lease.database,
+            identity,
+            record.attempt,
+            record.createdAt,
+          );
+      }
+    });
+  }
+
+  purgeImageDeliveryAttempts(sessionId: string): void {
+    this.assertOpen();
+    this.#lease.transaction('write', () => {
+      this.#lease.database
+        .prepare('DELETE FROM image_delivery_attempts WHERE session_id = ?')
+        .run(sessionId);
+    });
   }
 
   readAll(): ArtifactRecord[] {
@@ -103,6 +178,13 @@ class SqliteArtifactMetadataRepository {
            OR record_json IS NOT excluded.record_json
       `);
       for (const record of changes.upserts ?? []) {
+        if (record.imageDelivery?.status === 'ready')
+          removeImageDeliveryAttempt(this.#lease.database, {
+            sessionId: record.sessionId,
+            turnId: record.turnId,
+            messageId: record.imageDelivery.messageId,
+            source: record.imageDelivery.source,
+          });
         upsert.run(
           record.id,
           record.sessionId,
diff --git a/packages/storage/src/sqlite-artifact-schema.ts b/packages/storage/src/sqlite-artifact-schema.ts
index 9d90a4eb44b..f272553be69 100644
--- a/packages/storage/src/sqlite-artifact-schema.ts
+++ b/packages/storage/src/sqlite-artifact-schema.ts
@@ -23,7 +23,9 @@ import {
   isSafeRelativeArtifactPath,
 } from './artifact-metadata-codec.js';
 
-export const SQLITE_ARTIFACT_SCHEMA_VERSION = 4;
+import { migrateImageDeliveryAttempts } from './sqlite-image-delivery.js';
+
+export const SQLITE_ARTIFACT_SCHEMA_VERSION = 5;
 
 export function migrateSqliteArtifactDatabase(db: DatabaseSync): void {
   const columns = db.prepare('PRAGMA table_info(artifact_records)').all() as Array<{
@@ -107,4 +109,5 @@ export function migrateSqliteArtifactDatabase(db: DatabaseSync): void {
       JSON.stringify(record),
     );
   }
+  migrateImageDeliveryAttempts(db);
 }
diff --git a/packages/storage/src/sqlite-image-delivery.ts b/packages/storage/src/sqlite-image-delivery.ts
new file mode 100644
index 00000000000..0b846653ec4
--- /dev/null
+++ b/packages/storage/src/sqlite-image-delivery.ts
@@ -0,0 +1,144 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import type { DatabaseSync } from 'node:sqlite';
+import type { ImageDeliveryIdentity, ImageDeliveryAttempt } from '@maka/core/image-delivery';
+import { isImageDeliveryMetadata, IMAGE_DELIVERY_FAILURES } from '@maka/core/image-delivery';
+import { decodeArtifactRecordJsons } from './artifact-metadata-codec.js';
+
+/** Shares the Artifact writer's transaction and lock; no payload files for attempts. */
+export function migrateImageDeliveryAttempts(db: DatabaseSync): void {
+  db.exec(`CREATE TABLE IF NOT EXISTS image_delivery_attempts (
+    session_id TEXT NOT NULL, turn_id TEXT NOT NULL, message_id TEXT NOT NULL,
+    source TEXT NOT NULL, status TEXT NOT NULL CHECK (status IN ('pending', 'failed')),
+    reason TEXT, created_at INTEGER NOT NULL CHECK (created_at >= 0),
+    CHECK ((status = 'pending' AND reason IS NULL) OR (status = 'failed' AND reason IS NOT NULL)),
+    PRIMARY KEY (session_id, turn_id, message_id, source)
+  )`);
+  const rows = db
+    .prepare(`SELECT record_json FROM artifact_records
+    WHERE json_valid(record_json) AND json_extract(record_json, '$.imageDelivery.status') IN ('pending', 'failed')
+    ORDER BY CASE json_extract(record_json, '$.imageDelivery.status') WHEN 'pending' THEN 1 ELSE 0 END,
+      created_at DESC, artifact_id DESC`)
+    .all() as { record_json: string }[];
+  for (const record of decodeArtifactRecordJsons(rows.map((row) => row.record_json))) {
+    const metadata = record.imageDelivery!;
+    const identity = { sessionId: record.sessionId, turnId: record.turnId, ...metadata };
+    // An interrupted older capture can leave both a pending and a terminal row.
+    if (!readImageDeliveryAttempt(db, identity)) {
+      writeImageDeliveryAttempt(db, identity, metadata as ImageDeliveryAttempt, record.createdAt);
+    }
+    db.prepare('INSERT OR IGNORE INTO artifact_upgrade_orphan_paths VALUES (?)').run(
+      record.relativePath,
+    );
+    db.prepare('DELETE FROM artifact_records WHERE artifact_id = ?').run(record.id);
+  }
+}
+
+export function readImageDeliveryAttempt(
+  db: DatabaseSync,
+  identity: ImageDeliveryIdentity,
+): ImageDeliveryAttempt | undefined {
+  const row = db
+    .prepare(`SELECT status, reason FROM image_delivery_attempts
+    WHERE session_id = ? AND turn_id = ? AND message_id = ? AND source = ?`)
+    .get(...identityValues(identity)) as { status: string; reason: unknown } | undefined;
+  return row ? decodeAttempt(row) : undefined;
+}
+
+function decodeAttempt(row: { status: string; reason: unknown }): ImageDeliveryAttempt {
+  if (row.status === 'pending' && row.reason === null) return { status: 'pending' };
+  if (row.status === 'failed' && IMAGE_DELIVERY_FAILURES.includes(row.reason as never))
+    return {
+      status: 'failed',
+      reason: row.reason as Extract<ImageDeliveryAttempt, { status: 'failed' }>['reason'],
+    };
+  throw new Error('Invalid image delivery attempt');
+}
+
+export function writeImageDeliveryAttempt(
+  db: DatabaseSync,
+  identity: ImageDeliveryIdentity,
+  attempt: ImageDeliveryAttempt,
+  now = Date.now(),
+): void {
+  if (
+    !isImageDeliveryMetadata({
+      messageId: identity.messageId,
+      source: identity.source,
+      ...attempt,
+    }) ||
+    (attempt.status !== 'pending' && attempt.status !== 'failed')
+  )
+    throw new Error('Invalid image delivery attempt');
+  db.prepare(`INSERT INTO image_delivery_attempts VALUES (?, ?, ?, ?, ?, ?, ?)
+    ON CONFLICT(session_id, turn_id, message_id, source) DO UPDATE SET status = excluded.status, reason = excluded.reason`).run(
+    ...identityValues(identity),
+    attempt.status,
+    attempt.status === 'failed' ? attempt.reason : null,
+    now,
+  );
+}
+
+export function removeImageDeliveryAttempt(
+  db: DatabaseSync,
+  identity: ImageDeliveryIdentity,
+): void {
+  db.prepare(
+    'DELETE FROM image_delivery_attempts WHERE session_id = ? AND turn_id = ? AND message_id = ? AND source = ?',
+  ).run(...identityValues(identity));
+}
+
+export interface StoredImageDeliveryAttempt {
+  readonly identity: ImageDeliveryIdentity;
+  readonly attempt: ImageDeliveryAttempt;
+  readonly createdAt: number;
+}
+
+export function readImageDeliveryAttempts(
+  db: DatabaseSync,
+  sessionId: string,
+  turnIds: readonly string[],
+): StoredImageDeliveryAttempt[] {
+  const query = db.prepare(
+    'SELECT message_id, source, status, reason, created_at FROM image_delivery_attempts WHERE session_id = ? AND turn_id = ?',
+  );
+  return turnIds.flatMap((turnId) =>
+    (
+      query.all(sessionId, turnId) as {
+        message_id: string;
+        source: string;
+        status: string;
+        reason: unknown;
+        created_at: number;
+      }[]
+    ).map((row) => {
+      const identity = { sessionId, turnId, messageId: row.message_id, source: row.source };
+      return {
+        identity,
+        attempt: decodeAttempt(row),
+        createdAt: row.created_at,
+      };
+    }),
+  );
+}
+
+function identityValues(identity: ImageDeliveryIdentity): [string, string, string, string] {
+  return [identity.sessionId, identity.turnId, identity.messageId, identity.source];
+}
diff --git a/packages/ui/package.json b/packages/ui/package.json
index a1d61c248bb..8de5e24cdb8 100644
--- a/packages/ui/package.json
+++ b/packages/ui/package.json
@@ -33,7 +33,6 @@
     "clsx": "^2.1.1",
     "katex": "0.18.9",
     "lucide-react": "^1.48.0",
-    "mdast-util-from-markdown": "^2.1.0",
     "mermaid": "^11.17.2",
     "react": "^19.3.0",
     "react-dom": "^19.3.0",
diff --git a/packages/ui/src/chat-image-resource.ts b/packages/ui/src/chat-image-resource.ts
new file mode 100644
index 00000000000..c2fc49bf2c9
--- /dev/null
+++ b/packages/ui/src/chat-image-resource.ts
@@ -0,0 +1,71 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { useState } from 'react';
+import { parseAttachmentResourceRef } from '@maka/core/attachments';
+import { isRemoteImageSource, type ImageDeliveryFailure } from '@maka/core/image-delivery';
+import { useAttachmentImage } from './attachment-image.js';
+import { useImageDelivery } from './image-delivery.js';
+
+export type ChatImagePresentation =
+  | { readonly kind: 'loading' }
+  | { readonly kind: 'ready'; readonly src: string }
+  | { readonly kind: 'unavailable'; readonly reason: 'attachment' | 'remote' | 'redacted' | 'unsupported' }
+  | { readonly kind: 'failed'; readonly reason: 'saved_bytes' | ImageDeliveryFailure };
+
+/** Owns delivery, saved-byte and decode transitions. The component only renders this view. */
+export function useChatImageResource(input: { source: string; redacted: boolean; visible: boolean }) {
+  const explicit = parseAttachmentResourceRef(input.source);
+  const delivery = useImageDelivery(input.source, input.visible && !explicit, !input.redacted);
+  const artifactId = explicit?.artifactId ?? (delivery.status === 'ready' ? delivery.artifactId : undefined);
+  const image = useAttachmentImage(input.visible && artifactId ? { artifactId } : undefined);
+  const [failedSource, setFailedSource] = useState<string>();
+  const [attempt, setAttempt] = useState(0);
+  const source = artifactId ? image.src : undefined;
+  const remote = isRemoteImageSource(input.source);
+  const hiddenRemote = remote && input.redacted;
+  const remotePlaceholder = input.visible && remote && !artifactId;
+  let presentation: ChatImagePresentation;
+  if ((source && failedSource === source) || (artifactId && image.status === 'failed'))
+    presentation = { kind: 'failed', reason: 'saved_bytes' };
+  else if (source) presentation = { kind: 'ready', src: source };
+  else if (!input.visible) presentation = { kind: 'loading' };
+  else if (explicit && image.status === 'unavailable') presentation = { kind: 'unavailable', reason: 'attachment' };
+  else if (remotePlaceholder && hiddenRemote) presentation = { kind: 'unavailable', reason: 'redacted' };
+  else if (remotePlaceholder && (!delivery.available || delivery.status === 'requires_confirmation'))
+    presentation = { kind: 'unavailable', reason: 'remote' };
+  else if (delivery.status === 'failed') presentation = { kind: 'failed', reason: delivery.reason };
+  else if (delivery.status === 'pending' || artifactId) presentation = { kind: 'loading' };
+  else presentation = { kind: 'unavailable', reason: 'unsupported' };
+
+  const retry = presentation.kind === 'failed' && (!hiddenRemote || artifactId) ? () => {
+    setFailedSource(undefined);
+    setAttempt(value => value + 1);
+    // Once saved, only reread archived bytes; never recapture an expired/deleted source.
+    if (artifactId) image.retry();
+    else delivery.retry();
+  } : undefined;
+  const openSource = remote && !hiddenRemote && (presentation.kind === 'failed' ||
+    presentation.kind === 'unavailable' && presentation.reason === 'remote') ? input.source : undefined;
+  return {
+    presentation, attempt, retry, openSource,
+    framed: !input.visible || !!source || !!artifactId || delivery.status === 'pending',
+    onDecodeError: () => { if (source) setFailedSource(source); },
+  };
+}
diff --git a/packages/ui/src/markdown-image-redaction.ts b/packages/ui/src/markdown-image-redaction.ts
index efaebe2b3a1..d274ed9e3d9 100644
--- a/packages/ui/src/markdown-image-redaction.ts
+++ b/packages/ui/src/markdown-image-redaction.ts
@@ -17,23 +17,11 @@
  * under the License.
  */
 
-import { fromMarkdown } from 'mdast-util-from-markdown';
-import { markdownImages } from '@maka/core/image-markdown';
+import { positionedMarkdownImages } from '@maka/core/image-markdown';
 import { redactSecrets } from './redact.js';
 
-interface PositionedNode {
-  type: string;
-  position?: { start: { offset?: number }; end: { offset?: number } };
-  children?: readonly PositionedNode[];
-  url?: string;
-  alt?: string | null;
-}
-
-/** Hide destinations behind opaque image-only aliases before redacting prose.
- * Source positions keep identical examples in code, links and HTML untouched.
- * Marked remains the authority for the destinations sent to the Host; mdast
- * supplies only source ranges, which Marked does not expose.
- */
+/** Preserve resource identities using the canonical parser's exact source ranges.
+ * The alias map is presentation-only and never grants source loading. */
 export function redactMarkdownImages(text: string, settledText?: string) {
   let prefix = 'maka-image-display:';
   while (text.includes(prefix) || settledText?.includes(prefix)) prefix += 'x';
@@ -42,33 +30,19 @@ export function redactMarkdownImages(text: string, settledText?: string) {
   const prepare = (original: string): string => {
     const redacted = redactSecrets(original);
     if (redacted === original) return redacted;
-    const images = markdownImages(original).filter(image =>
+    const images = positionedMarkdownImages(original).filter(image =>
       redactSecrets(image.source) !== image.source || redactSecrets(image.raw) !== image.raw);
     if (!images.length) return redacted;
-    const destinations = new Map(images.map(image => [image.raw, image.source]));
-    const canonical = new Set(images.map(image => image.source));
-    const replacements: { start: number; end: number; value: string }[] = [];
-    const visit = (node: PositionedNode) => {
-      if (node.type === 'image' || node.type === 'imageReference') {
-        const start = node.position?.start.offset;
-        const end = node.position?.end.offset;
-        if (start === undefined || end === undefined) return;
-        const raw = original.slice(start, end);
-        const source = destinations.get(raw) ?? (node.url && canonical.has(node.url) ? node.url : undefined);
-        if (!source || (redactSecrets(source) === source && redactSecrets(raw) === raw)) return;
-        let alias = aliases.get(source);
-        if (!alias) {
-          alias = `${prefix}${aliases.size}`;
-          aliases.set(source, alias);
-          sources.set(alias, source);
-        }
-        const alt = redactSecrets(node.alt ?? '').replace(/[\\[\]`*_<>|]/g, '\\$&');
-        replacements.push({ start, end, value: `![${alt}](${alias})` });
-        return;
+    const replacements = images.map(image => {
+      let alias = aliases.get(image.source);
+      if (!alias) {
+        alias = `${prefix}${aliases.size}`;
+        aliases.set(image.source, alias);
+        sources.set(alias, image.source);
       }
-      node.children?.forEach(visit);
-    };
-    visit(fromMarkdown(original));
+      const alt = redactSecrets(image.alt).replace(/[\\[\]`*_<>|]/g, '\\$&');
+      return { start: image.start, end: image.end, value: `![${alt}](${alias})` };
+    });
     let protectedText = original;
     for (const replacement of replacements.sort((a, b) => b.start - a.start)) {
       protectedText = protectedText.slice(0, replacement.start) + replacement.value + protectedText.slice(replacement.end);
diff --git a/packages/ui/src/markdown-image.tsx b/packages/ui/src/markdown-image.tsx
index e4069cfd33b..fdba5971dd2 100644
--- a/packages/ui/src/markdown-image.tsx
+++ b/packages/ui/src/markdown-image.tsx
@@ -23,10 +23,7 @@ import { createMarkdownPlugin, type MarkdownExtensionNode } from '@astryxdesign/
 import type { MarkdownAstNode, MarkdownAstRoot } from '@astryxdesign/core/Markdown';
 import { RotateCw, AlertTriangle } from './icons.js';
 import { Link } from '@astryxdesign/core/Link';
-import { parseAttachmentResourceRef } from '@maka/core/attachments';
-import { isRemoteImageSource } from '@maka/core/image-delivery';
-import { useAttachmentImage } from './attachment-image.js';
-import { useImageDelivery } from './image-delivery.js';
+import { useChatImageResource } from './chat-image-resource.js';
 import { getSharedUiCopy } from './shared-ui-copy.js';
 import { useUiLocale } from './locale-context.js';
 import { createMarkdownImageSourceResolver } from './markdown-image-source.js';
@@ -98,59 +95,39 @@ function ImageResource(props: { src: string; redacted: boolean; alt: string; inl
     }, { rootMargin: '300px' });
     observer.observe(anchor.current); return () => observer.disconnect();
   }, [visible]);
-  const explicit = parseAttachmentResourceRef(props.src);
-  const delivery = useImageDelivery(props.src, visible && !explicit, !props.redacted);
-  const artifactId = explicit?.artifactId ?? (delivery.status === 'ready' ? delivery.artifactId : undefined);
-  const image = useAttachmentImage(visible && artifactId ? { artifactId } : undefined);
-  const [failedSource, setFailedSource] = useState<string>();
-  const [attempt, setAttempt] = useState(0);
-  const remote = isRemoteImageSource(props.src);
-  const source = artifactId ? image.src : undefined;
-  const failed = !!source && failedSource === source || !!artifactId && image.status === 'failed';
-  const retry = () => {
-    setFailedSource(undefined); setAttempt(a => a + 1);
-    if (artifactId) image.retry();
-    if (!artifactId) delivery.retry();
-  };
-  // Redaction preserves the original identity for saved replay, never for a
-  // network action whose destination the user cannot inspect.
-  const hiddenRemote = remote && props.redacted;
-  const remoteBlocked = remote && delivery.status === 'failed' && delivery.reason === 'not_allowed';
-  const sourceActions = <span className="maka-markdown-image-actions">
-    {(!hiddenRemote || artifactId) && <Button variant="ghost" size="sm" label={copy.imageRetry} onClick={retry} />}
-    {remote && !hiddenRemote && <Link href={props.src} isExternalLink type="inherit" hasUnderline>{copy.imageOpen}</Link>}
+  const resource = useChatImageResource({ source: props.src, redacted: props.redacted, visible });
+  const state = resource.presentation;
+  const message = state.kind === 'loading' ? copy.imageLoading
+    : state.kind === 'failed' ? state.reason === 'saved_bytes' ? copy.imageLoadFailed : copy.imageArchiveFailure(state.reason)
+    : state.kind === 'unavailable' ? {
+      attachment: copy.imageUnavailable,
+      remote: copy.imageRemoteUnavailable,
+      redacted: copy.imageRemoteRedacted,
+      unsupported: copy.imageUnsupported,
+    }[state.reason] : undefined;
+  const hasFrame = props.inline || resource.framed;
+  const actions = <span className="maka-markdown-image-actions">
+    {resource.retry && <Button variant="ghost" size="sm" label={copy.imageRetry} onClick={resource.retry} />}
+    {resource.openSource && <Link href={resource.openSource} isExternalLink type="inherit" hasUnderline>{copy.imageOpen}</Link>}
   </span>;
-  let message: string | undefined;
-  const remotePlaceholder = visible && remote && !artifactId;
-  const remoteUnavailable = remotePlaceholder && !hiddenRemote && (!delivery.available || delivery.status === 'requires_confirmation');
-  const remoteNotice = remotePlaceholder && (hiddenRemote || remoteUnavailable || remoteBlocked);
-  if (failed) message = copy.imageLoadFailed;
-  else if (!source) message = !visible ? copy.imageLoading
-    : explicit && image.status === 'unavailable' ? copy.imageUnavailable
-    : remotePlaceholder && hiddenRemote ? copy.imageRemoteRedacted
-    : remoteUnavailable ? copy.imageRemoteUnavailable
-    : delivery.status === 'failed' ? copy.imageArchiveFailure(delivery.reason)
-    : delivery.status === 'pending' || artifactId ? copy.imageLoading : copy.imageUnsupported;
-  const hasFrame = props.inline || !visible || !!source || !!artifactId || delivery.status === 'pending';
   return <span ref={anchor} className={`maka-markdown-image-resource${hasFrame ? props.inline ? ' maka-markdown-image-inline' : ' maka-markdown-image-frame' : ''}`}
-    data-maka-image-state={message ? failed ? 'failed' : 'loading' : 'ready'}>
+    data-maka-image-state={state.kind === 'failed' ? 'failed' : state.kind === 'ready' ? 'ready' : 'loading'}>
     {message && props.inline ? <Tooltip content={message}>
       <span className="maka-markdown-image-placeholder" role="status" aria-label={message}>
-        {(failed || delivery.status === 'failed') && (!hiddenRemote || artifactId)
-          ? <IconButton icon={<RotateCw size={14} />} size="sm" label={copy.imageRetry} onClick={retry} />
-          : remoteNotice || delivery.status === 'unavailable' && visible
+        {resource.retry
+          ? <IconButton icon={<RotateCw size={14} />} size="sm" label={copy.imageRetry} onClick={resource.retry} />
+          : state.kind === 'unavailable'
             ? <AlertTriangle size={14} aria-hidden="true" /> : <Spinner size="sm" shade="subtle" aria-hidden="true" />}
       </span>
     </Tooltip> : message ? <span className="maka-markdown-image-placeholder">
       {props.alt && <span className="maka-markdown-image-caption">{props.alt}</span>}
-      <span role="status">{hasFrame && !failed && !remoteNotice && delivery.status !== 'failed' && <Spinner size="sm" shade="subtle" aria-hidden="true" />} {message}</span>
-      {(failed || delivery.status === 'failed') && sourceActions}
-    </span> : source && <DisplayImage key={`${source}\0${attempt}`} src={source} alt={props.alt} onError={() => setFailedSource(source)} />}
-    {remoteUnavailable && <span className="maka-markdown-image-actions">
-      <Link href={props.src} isExternalLink type="inherit" hasUnderline>{copy.imageOpen}</Link>
-    </span>}
+      <span role="status">{hasFrame && state.kind === 'loading' && <Spinner size="sm" shade="subtle" aria-hidden="true" />} {message}</span>
+      {state.kind === 'failed' && actions}
+    </span> : state.kind === 'ready' && <DisplayImage key={`${state.src}\0${resource.attempt}`} src={state.src} alt={props.alt} onError={resource.onDecodeError} />}
+    {state.kind === 'unavailable' && resource.openSource && actions}
   </span>;
 }
+
 function DisplayImage(props: { src: string; alt: string; onError(): void }) {
   const copy = getSharedUiCopy(useUiLocale()).markdown;
   const [loaded, setLoaded] = useState(false);

From f56ceb166f69cd8aca018adf1700a8ec9242df66 Mon Sep 17 00:00:00 2001
From: Sun-GLiang <81428141+Sun-GLiang@users.noreply.github.com>
Date: Sat, 10 Oct 2026 13:29:08 +0800
Subject: [PATCH 28/37] fix(desktop): leave room for Linux usage timestamps

The usage request time column was 168px wide, while Linux system-font text plus padding measures 168.03125px. Increase the column to 176px and retain the strict Storybook fit assertion.

Generated-by: Codex (GPT-6)
---
 .../src/renderer/features/usage/ui/usage-settings-view.tsx    | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/apps/desktop/src/renderer/features/usage/ui/usage-settings-view.tsx b/apps/desktop/src/renderer/features/usage/ui/usage-settings-view.tsx
index 83377c41562..484f81c6a8d 100644
--- a/apps/desktop/src/renderer/features/usage/ui/usage-settings-view.tsx
+++ b/apps/desktop/src/renderer/features/usage/ui/usage-settings-view.tsx
@@ -592,7 +592,9 @@ function UsageRequestsPanel(props: {
           </div>
         ) : undefined}
         columns={[
-          { header: props.copy.tables.requestHeaders[0], width: 168 },
+          // Linux's system font needs slightly more than 168px for the timestamp
+          // and cell padding. Leave room so the full time survives truncation.
+          { header: props.copy.tables.requestHeaders[0], width: 176 },
           { header: props.copy.tables.requestHeaders[1], width: 72 },
           { header: props.copy.tables.requestHeaders[2], grow: true },
           { header: props.copy.tables.requestHeaders[3], width: 168 },

From 9ed0e5dc4939d191810bd9bda02b0ebd046519cb Mon Sep 17 00:00:00 2001
From: Sun-GLiang <81428141+Sun-GLiang@users.noreply.github.com>
Date: Sat, 10 Oct 2026 13:38:37 +0800
Subject: [PATCH 29/37] fix(release): tolerate Linux profile cleanup races

The packaged Runtime Host can still write into its temporary profile after Desktop exits. Match Windows verification's bounded fs.rm retry policy so transient ENOTEMPTY and EBUSY errors do not fail Linux package validation.

Generated-by: Codex (GPT-6)
---
 scripts/verify-linux.mjs | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/scripts/verify-linux.mjs b/scripts/verify-linux.mjs
index 77129fcad2f..b7add8afddf 100644
--- a/scripts/verify-linux.mjs
+++ b/scripts/verify-linux.mjs
@@ -226,7 +226,15 @@ export async function verifyLinuxRelease(
 
     return { appImagePath, debPath, checksums };
   } finally {
-    await rm(workingDirectory, { recursive: true, force: true });
+    // The Runtime Host outlives Desktop for its idle grace period and can still
+    // write into the profile during cleanup. Use the same bounded filesystem
+    // retries as Windows verification for transient ENOTEMPTY/EBUSY errors.
+    await rm(workingDirectory, {
+      recursive: true,
+      force: true,
+      maxRetries: 20,
+      retryDelay: 250,
+    });
   }
 }
 

From a73ab9b0427eb239d496aba050d486db7a401b81 Mon Sep 17 00:00:00 2001
From: Sun-GLiang <81428141+Sun-GLiang@users.noreply.github.com>
Date: Sat, 10 Oct 2026 15:13:38 +0800
Subject: [PATCH 30/37] fix(runtime): align image guidance with automatic
 loading

Describe remote image loading under application outbound/privacy and proxy policy, independently of session subprocess network restrictions.

Generated-by: Codex (GPT-6)
---
 packages/runtime/src/system-prompt/main-session-prompt.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/runtime/src/system-prompt/main-session-prompt.ts b/packages/runtime/src/system-prompt/main-session-prompt.ts
index c9f8914b73b..517e984f9b6 100644
--- a/packages/runtime/src/system-prompt/main-session-prompt.ts
+++ b/packages/runtime/src/system-prompt/main-session-prompt.ts
@@ -52,7 +52,7 @@ Keep simple answers simple; do not add headings or lists to simple answers.
 Use short headings and flat lists to organize longer answers.
 Use fenced code blocks for multiline code and backticks for inline commands, paths, identifiers, and literal values.
 Prefer descriptive link text for external sources when it is available.
-To deliver a generated screenshot or local image, include a Markdown image with its absolute path. The Host automatically saves supported local images after the assistant message completes. Remote images require the user to choose Load image and the session to allow network access; include them only when relevant to the user's request. Reading an image for your own inspection does not deliver it.
+To deliver a generated screenshot or local image, include a Markdown image with its absolute path. The Host automatically saves supported local images after the assistant message completes. Supported remote images in completed assistant messages load automatically near the viewport, subject to the application's outbound/privacy policy and proxy settings. This media loading is independent of session subprocess network restrictions; include remote images only when relevant to the user's request. Reading an image for your own inspection does not deliver it.
 If you need to delete or replace the source file immediately, use PublishImage when available first and include its returned Markdown. Keep source files available until capture finishes. Images above the save limits cannot be previewed automatically.
 Only claim an image was saved after publication succeeds. Saving does not confirm that the client displayed it.
 Follow a more specific format requested by the user or task.`;

From 4037399d9532f7d3430649db39bf12371f29a5c6 Mon Sep 17 00:00:00 2001
From: Sun-GLiang <81428141+Sun-GLiang@users.noreply.github.com>
Date: Sat, 10 Oct 2026 15:31:11 +0800
Subject: [PATCH 31/37] refactor(network): scope image connection policy per
 request

Move destination validation and direct DNS pinning into the existing fetch transport. Image downloads opt in; ordinary callers retain their defaults. Let configured proxies resolve original hostnames and remove VPN fake-DNS exceptions.

Generated-by: Codex (GPT-6)
---
 .../src/__tests__/chat-image-delivery.test.ts |  76 ++--
 .../__tests__/execution-composition.test.ts   |  37 +-
 .../src/server/chat-image-source.ts           | 219 ++++--------
 .../src/server/execution-composition.ts       |   1 -
 .../__tests__/public-network-policy.test.ts   | 327 ++++++++++++++++++
 .../__tests__/scoped-fetch-transport.test.ts  |  44 ++-
 .../src/network/public-network-policy.ts      | 107 ++++++
 .../src/network/scoped-fetch-transport.ts     |  91 ++++-
 8 files changed, 651 insertions(+), 251 deletions(-)
 create mode 100644 packages/runtime/src/network/__tests__/public-network-policy.test.ts
 create mode 100644 packages/runtime/src/network/public-network-policy.ts

diff --git a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
index 94be54d8e31..5b720eeeaea 100644
--- a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
+++ b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
@@ -23,8 +23,9 @@ import { mkdtemp, mkdir, readFile, writeFile, rm, stat } from 'node:fs/promises'
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { pathToFileURL } from 'node:url';
-import http, { createServer, type RequestOptions, type IncomingMessage } from 'node:http';
-import https from 'node:https';
+import { createServer } from 'node:http';
+import net from 'node:net';
+import tls from 'node:tls';
 import dns from 'node:dns/promises';
 import { syncBuiltinESMExports } from 'node:module';
 import { createHash } from 'node:crypto';
@@ -60,30 +61,28 @@ function publicImageOrigin(
   const source = new URL(localSource);
   source.hostname = 'image.example';
   source.protocol = protocol;
-  const request = http.request;
+  const connect = net.connect;
   t.mock.method(dns, 'lookup', async (host: string) => {
     assert.equal(host, source.hostname);
     return [{ address, family: address.includes(':') ? 6 : 4 }];
   });
-  const transport = (
-    url: URL,
-    options: RequestOptions,
-    callback: (res: IncomingMessage) => void,
-  ) => {
-    assert.equal(url.origin, source.origin);
+  const transport = (options: net.TcpNetConnectOpts & { servername?: string }) => {
+    assert.equal(options.host, source.hostname);
     assert.ok(options.lookup);
-    options.lookup(url.hostname, { all: true }, (error, addresses) => {
+    options.lookup(source.hostname, { all: true }, (error, addresses) => {
       assert.equal(error, null);
       assert.deepEqual(addresses, [{ address, family: address.includes(':') ? 6 : 4 }]);
     });
-    return request(
-      new URL(url.pathname + url.search, local),
-      { ...options, lookup: undefined },
-      callback,
-    );
+    const socket = connect({ host: local.hostname, port: Number(local.port) });
+    if (protocol === 'https:') {
+      assert.equal(options.servername, source.hostname);
+      // This HTTP fixture exercises HTTPS redirect policy, not TLS verification.
+      socket.once('connect', () => socket.emit('secureConnect'));
+    }
+    return socket;
   };
-  t.mock.method(http, 'request', transport);
-  t.mock.method(https, 'request', transport);
+  t.mock.method(net, 'connect', transport);
+  t.mock.method(tls, 'connect', transport);
   syncBuiltinESMExports();
   t.after(() => {
     t.mock.restoreAll();
@@ -860,7 +859,7 @@ test('HTTP download enforces header/stream limits, redirect budget and cancellat
       );
     }
     await assert.rejects(downloadChatImage(source + 'stalled', AbortSignal.timeout(50)), {
-      name: 'AbortError',
+      name: 'TimeoutError',
     });
   } finally {
     server.closeAllConnections();
@@ -895,7 +894,7 @@ test('DNS answers containing any private address are denied before a request', a
     { address: '127.0.0.1', family: 4 },
   ];
   const lookup = t.mock.method(dns, 'lookup', async () => answers);
-  const request = t.mock.method(http, 'request', () => {
+  const request = t.mock.method(net, 'connect', () => {
     assert.fail('unsafe DNS must not reach transport');
   });
   syncBuiltinESMExports();
@@ -912,27 +911,10 @@ test('DNS answers containing any private address are denied before a request', a
   }
 });
 
-for (const address of ['198.18.0.2', '198.19.255.254', '2001:2::6', '2001:2:0:1::2']) {
-  test(`named images load through VPN fake DNS ${address} with pinned lookup`, async (t) => {
-    const server = createServer((_req, res) => res.end(PNG));
-    await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
-    try {
-      const local = `http://127.0.0.1:${(server.address() as import('node:net').AddressInfo).port}/image.png`;
-      const source = publicImageOrigin(t, local, 'https:', address);
-      assert.deepEqual(
-        await downloadChatImage(source, AbortSignal.timeout(2000)),
-        checkedChatImage(PNG),
-      );
-    } finally {
-      await new Promise<void>((resolve) => server.close(() => resolve()));
-    }
-  });
-}
-
-test('fake DNS never authorizes literal private addresses, local names or mixed private answers', async (t) => {
-  let answers = [{ address: '198.18.0.2', family: 4 }];
+test('literal benchmark addresses, local names and mixed private answers are denied', async (t) => {
+  let answers = [{ address: '93.184.216.34', family: 4 }];
   t.mock.method(dns, 'lookup', async () => answers);
-  const request = t.mock.method(http, 'request', () =>
+  const request = t.mock.method(net, 'connect', () =>
     assert.fail('blocked source reached transport'),
   );
   syncBuiltinESMExports();
@@ -953,7 +935,7 @@ test('fake DNS never authorizes literal private addresses, local names or mixed
     }
     for (const address of ['127.0.0.1', '192.168.1.2', '169.254.169.254', '::1']) {
       answers = [
-        { address: '198.18.0.2', family: 4 },
+        { address: '93.184.216.34', family: 4 },
         { address, family: address.includes(':') ? 6 : 4 },
       ];
       await assert.rejects(
@@ -968,7 +950,7 @@ test('fake DNS never authorizes literal private addresses, local names or mixed
   }
 });
 
-test('a configured HTTP proxy receives the original hostname despite fake DNS and checks redirects and limits', async (t) => {
+test('a configured HTTP proxy receives the original hostname and checks redirects and limits', async (t) => {
   const tunnels: string[] = [];
   const imageRequests: string[] = [];
   const server = createServer((request, response) => {
@@ -1027,9 +1009,8 @@ test('a configured HTTP proxy receives the original hostname despite fake DNS an
     });
   });
   await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
-  t.mock.method(dns, 'lookup', async (host: string) => {
-    assert.equal(host, 'image.example');
-    return [{ address: '198.18.0.2', family: 4 }];
+  const lookup = t.mock.method(dns, 'lookup', async () => {
+    throw Object.assign(new Error('local DNS is unavailable'), { code: 'ENOTFOUND' });
   });
   syncBuiltinESMExports();
   const transport = createProxiedFetchTransport({
@@ -1065,11 +1046,14 @@ test('a configured HTTP proxy receives the original hostname despite fake DNS an
       downloadChatImage('http://image.example/stalled', AbortSignal.timeout(50), options),
       { name: 'TimeoutError' },
     );
+    assert.equal(lookup.mock.callCount(), 0);
     assert.ok(tunnels.every((target) => target === 'image.example:80'));
     assert.equal(imageRequests.length, 9);
     assert.ok(imageRequests.every((request) => /host: image\.example/i.test(request)));
     assert.ok(
-      imageRequests.every((request) => !/198\.18|cookie:|authorization:|referer:/i.test(request)),
+      imageRequests.every(
+        (request) => !/93\.184\.216\.34|cookie:|authorization:|referer:/i.test(request),
+      ),
     );
   } finally {
     await transport.close();
@@ -1091,7 +1075,7 @@ test('proxy bypass preserves the checked and pinned direct image connection', as
   });
   try {
     const local = `http://127.0.0.1:${(server.address() as import('node:net').AddressInfo).port}/image.png`;
-    const source = publicImageOrigin(t, local, 'http:', '198.18.0.2');
+    const source = publicImageOrigin(t, local, 'http:');
     assert.deepEqual(
       await downloadChatImage(source, AbortSignal.timeout(2000), { fetch: transport.fetch }),
       checkedChatImage(PNG),
diff --git a/packages/runtime-host/src/__tests__/execution-composition.test.ts b/packages/runtime-host/src/__tests__/execution-composition.test.ts
index 7edc57da33e..fbb5fb9494b 100644
--- a/packages/runtime-host/src/__tests__/execution-composition.test.ts
+++ b/packages/runtime-host/src/__tests__/execution-composition.test.ts
@@ -20,7 +20,8 @@
 import assert from 'node:assert/strict';
 import { execFileSync } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
-import http, { createServer } from 'node:http';
+import { createServer } from 'node:http';
+import net from 'node:net';
 import dns from 'node:dns/promises';
 import { syncBuiltinESMExports } from 'node:module';
 import { WORKHUB_COORDINATION_SESSION_ID } from '@maka/core/session';
@@ -4629,32 +4630,20 @@ test('production Host loads visible remote media independently of agent sandbox
   });
   await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
   const origin = `http://127.0.0.1:${(server.address() as import('node:net').AddressInfo).port}`;
-  const realRequest = http.request;
+  const realConnect = net.connect;
   t.mock.method(dns, 'lookup', async (host: string) => {
     assert.equal(host, 'image.example');
-    return [{ address: '198.18.0.2', family: 4 }];
+    return [{ address: '93.184.216.34', family: 4 }];
+  });
+  t.mock.method(net, 'connect', (options: net.TcpNetConnectOpts) => {
+    assert.equal(options.host, 'image.example');
+    assert.ok(options.lookup);
+    options.lookup(options.host, { all: true }, (error, addresses) => {
+      assert.equal(error, null);
+      assert.deepEqual(addresses, [{ address: '93.184.216.34', family: 4 }]);
+    });
+    return realConnect({ host: '127.0.0.1', port: Number(new URL(origin).port) });
   });
-  t.mock.method(
-    http,
-    'request',
-    (
-      url: URL,
-      options: import('node:http').RequestOptions,
-      callback: (response: import('node:http').IncomingMessage) => void,
-    ) => {
-      assert.equal(url.hostname, 'image.example');
-      assert.ok(options.lookup);
-      options.lookup(url.hostname, { all: true }, (error, addresses) => {
-        assert.equal(error, null);
-        assert.deepEqual(addresses, [{ address: '198.18.0.2', family: 4 }]);
-      });
-      return realRequest(
-        new URL(url.pathname, origin),
-        { ...options, lookup: undefined },
-        callback,
-      );
-    },
-  );
   syncBuiltinESMExports();
   try {
     await withCompositionRoot(async ({ root, owner }) => {
diff --git a/packages/runtime-host/src/server/chat-image-source.ts b/packages/runtime-host/src/server/chat-image-source.ts
index 43aa34a999d..36b09f119be 100644
--- a/packages/runtime-host/src/server/chat-image-source.ts
+++ b/packages/runtime-host/src/server/chat-image-source.ts
@@ -17,10 +17,6 @@
  * under the License.
  */
 
-import { lookup } from 'node:dns/promises';
-import { request as httpRequest } from 'node:http';
-import { request as httpsRequest } from 'node:https';
-import { isIP } from 'node:net';
 import { fileURLToPath } from 'node:url';
 import { ARTIFACT_IMAGE_PREVIEW_MAX_BYTES } from '@maka/core/artifacts';
 import {
@@ -33,8 +29,11 @@ import {
   isRemoteImageSource,
   type ImageDeliveryFailure,
 } from '@maka/core/image-delivery';
-import { abortable } from '../client/wait-for-ready.js';
-import { usesFetchProxy } from '@maka/runtime/network/scoped-fetch-transport';
+import {
+  createProxiedFetchTransport,
+  PublicNetworkPolicyError,
+  type ScopedFetch,
+} from '@maka/runtime/network/scoped-fetch-transport';
 export class ImageSourceError extends Error {
   constructor(readonly reason: ImageDeliveryFailure) {
     super(reason);
@@ -78,169 +77,67 @@ export function decodedLocalImagePath(source: string): string | undefined {
     return undefined;
   }
 }
-/** Pin direct DNS and check each redirect; never send cookies, auth or referer.
- * A configured proxy resolves the original hostname and is trusted to enforce
- * its own egress boundary; local DNS checks cannot pin the proxy's destination. */
+/** Network routing and public destination checks belong to the transport.
+ * Only validated image bytes cross the archive boundary. */
 export async function downloadChatImage(
   source: string,
   signal: AbortSignal,
-  options: { readonly fetch?: typeof globalThis.fetch } = {},
+  options: { readonly fetch?: ScopedFetch } = {},
 ): Promise<ChatImageBytes> {
-  let url = new URL(source);
-  for (let redirect = 0; redirect <= 3; redirect++) {
-    signal.throwIfAborted();
-    if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password)
-      throw new ImageSourceError('not_allowed');
-    const host = url.hostname.replace(/^\[|\]$/g, '');
-    // Fake DNS addresses are routing handles for a named destination, never
-    // authority to load a literal private address or a local/metadata hostname.
-    // This compatibility exception assumes trusted VPN/TUN routing: a fake-IP
-    // answer alone does not prove that the eventual destination is public.
-    const namedHost = !isIP(host) && publicHostname(host);
-    if (!isIP(host) && !namedHost) throw new ImageSourceError('not_allowed');
-    const addresses = isIP(host)
-      ? [{ address: host, family: isIP(host) }]
-      : await abortable(() => lookup(host, { all: true }), signal);
-    if (
-      !addresses.length ||
-      addresses.some((a) => !publicAddress(a.address) && !(namedHost && fakeAddress(a.address)))
-    )
-      throw new ImageSourceError('not_allowed');
-    const target = addresses[0]!;
-    const headers = { accept: 'image/png,image/jpeg,image/webp,image/gif' };
-    const proxyFetch =
-      options.fetch && usesFetchProxy(options.fetch, url) ? options.fetch : undefined;
-    const response = proxyFetch
-      ? proxyImageResponse(
-          await proxyFetch(url, { signal, headers, redirect: 'manual', credentials: 'omit' }),
-        )
-      : directImageResponse(
-          await new Promise<import('node:http').IncomingMessage>((resolve, reject) => {
-            const req = (url.protocol === 'https:' ? httpsRequest : httpRequest)(
-              url,
-              {
-                signal,
-                headers,
-                lookup: (_host, options, callback) =>
-                  options.all
-                    ? callback(null, [target])
-                    : callback(null, target.address, target.family),
-              },
-              resolve,
-            );
-            req.on('error', reject);
-            req.end();
-          }),
-        );
-    const location = response.header('location');
-    if ([301, 302, 303, 307, 308].includes(response.status) && location) {
-      await response.close();
-      const next = new URL(location, url);
-      if (url.protocol === 'https:' && next.protocol !== 'https:')
-        throw new ImageSourceError('not_allowed');
-      url = next;
-      continue;
-    }
-    if (response.status !== 200) {
-      await response.close();
-      throw new ImageSourceError('download_failed');
-    }
-    const length = Number(response.header('content-length'));
-    if (length > ARTIFACT_IMAGE_PREVIEW_MAX_BYTES) {
-      await response.close();
-      throw new ImageSourceError('too_large');
-    }
-    const chunks: Buffer[] = [];
-    let size = 0;
-    for await (const chunk of response.chunks) {
-      size += chunk.length;
-      if (size > ARTIFACT_IMAGE_PREVIEW_MAX_BYTES) {
-        await response.close();
+  const owned = options.fetch ? undefined : createProxiedFetchTransport(null);
+  const fetch = options.fetch ?? owned!.fetch;
+  try {
+    let url = new URL(source);
+    for (let redirect = 0; redirect <= 3; redirect++) {
+      signal.throwIfAborted();
+      const response = await fetch(url, {
+        targetPolicy: 'public',
+        signal,
+        headers: { accept: 'image/png,image/jpeg,image/webp,image/gif' },
+        redirect: 'manual',
+        credentials: 'omit',
+      });
+      const location = response.headers.get('location');
+      if ([301, 302, 303, 307, 308].includes(response.status) && location) {
+        await response.body?.cancel();
+        const next = new URL(location, url);
+        if (url.protocol === 'https:' && next.protocol !== 'https:')
+          throw new ImageSourceError('not_allowed');
+        url = next;
+        continue;
+      }
+      if (response.status !== 200) {
+        await response.body?.cancel();
+        throw new ImageSourceError('download_failed');
+      }
+      if (Number(response.headers.get('content-length')) > ARTIFACT_IMAGE_PREVIEW_MAX_BYTES) {
+        await response.body?.cancel();
         throw new ImageSourceError('too_large');
       }
-      chunks.push(Buffer.from(chunk));
-    }
-    return checkedChatImage(Buffer.concat(chunks, size));
-  }
-  throw new ImageSourceError('download_failed');
-}
-interface ImageResponse {
-  readonly status: number;
-  readonly chunks: AsyncIterable<Uint8Array>;
-  header(name: string): string | undefined;
-  close(): void | Promise<void>;
-}
-function directImageResponse(response: import('node:http').IncomingMessage): ImageResponse {
-  return {
-    status: response.statusCode ?? 0,
-    chunks: response,
-    header: (name) => {
-      const value = response.headers[name];
-      return typeof value === 'string' ? value : undefined;
-    },
-    close: () => {
-      response.destroy();
-    },
-  };
-}
-function proxyImageResponse(response: Response): ImageResponse {
-  return {
-    status: response.status,
-    header: (name) => response.headers.get(name) ?? undefined,
-    close: async () => {
-      await response.body?.cancel().catch(() => {});
-    },
-    chunks: (async function* () {
+      const chunks: Buffer[] = [];
+      let size = 0;
       const reader = response.body?.getReader();
-      if (!reader) return;
-      try {
-        while (true) {
-          const chunk = await reader.read();
-          if (chunk.done) break;
-          yield chunk.value;
+      if (reader) {
+        try {
+          while (true) {
+            const chunk = await reader.read();
+            if (chunk.done) break;
+            size += chunk.value.length;
+            if (size > ARTIFACT_IMAGE_PREVIEW_MAX_BYTES) throw new ImageSourceError('too_large');
+            chunks.push(Buffer.from(chunk.value));
+          }
+        } finally {
+          await reader.cancel().catch(() => {});
+          reader.releaseLock();
         }
-      } finally {
-        await reader.cancel().catch(() => {});
-        reader.releaseLock();
       }
-    })(),
-  };
-}
-function publicHostname(host: string): boolean {
-  const name = host.toLowerCase().replace(/\.$/, '');
-  return (
-    name.includes('.') &&
-    !/(^|\.)(localhost|local|lan|internal|home|arpa|test|invalid)$/.test(name) &&
-    ![
-      'metadata.google.internal',
-      'metadata.goog',
-      'metadata.tencentyun.com',
-      'instance-data.ec2.internal',
-    ].includes(name)
-  );
-}
-function fakeAddress(address: string): boolean {
-  if (isIP(address) === 4) return /^198\.(18|19)\./.test(address);
-  if (isIP(address) !== 6) return false;
-  // RFC 5180's benchmarking prefix is also used by VPN fake DNS for IPv6.
-  const normalized = new URL(`http://[${address}]`).hostname;
-  return /^\[2001:2:(?::|0:)/i.test(normalized);
-}
-function publicAddress(address: string): boolean {
-  if (isIP(address) === 4) {
-    const [a = 0, b = 0] = address.split('.').map(Number);
-    return (
-      a > 0 &&
-      a !== 10 &&
-      a !== 127 &&
-      a < 224 &&
-      !(a === 169 && b === 254) &&
-      !(a === 172 && b >= 16 && b <= 31) &&
-      !(a === 192 && b === 168) &&
-      !(a === 100 && b >= 64 && b <= 127) &&
-      !(a === 198 && (b === 18 || b === 19))
-    );
+      return checkedChatImage(Buffer.concat(chunks, size));
+    }
+    throw new ImageSourceError('download_failed');
+  } catch (error) {
+    if (error instanceof PublicNetworkPolicyError) throw new ImageSourceError('not_allowed');
+    throw error;
+  } finally {
+    await owned?.close();
   }
-  // Only global-unicast IPv6 is eligible. Mapped IPv4/ULA/link-local are excluded.
-  return /^[23][0-9a-f]{3}:/i.test(address) && !fakeAddress(address);
 }
diff --git a/packages/runtime-host/src/server/execution-composition.ts b/packages/runtime-host/src/server/execution-composition.ts
index 6d60790a539..1b531c31b06 100644
--- a/packages/runtime-host/src/server/execution-composition.ts
+++ b/packages/runtime-host/src/server/execution-composition.ts
@@ -614,7 +614,6 @@ export async function createExecutionRuntimeHostComposition(
           resolved.networkProxy,
           resolved.secretMaterial.networkProxy?.secret,
         );
-        if (!proxy) return downloadChatImage(source, signal);
         const transport = createProxiedFetchTransport(proxy);
         try {
           return await downloadChatImage(source, signal, { fetch: transport.fetch });
diff --git a/packages/runtime/src/network/__tests__/public-network-policy.test.ts b/packages/runtime/src/network/__tests__/public-network-policy.test.ts
new file mode 100644
index 00000000000..1378bd8fd3a
--- /dev/null
+++ b/packages/runtime/src/network/__tests__/public-network-policy.test.ts
@@ -0,0 +1,327 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import assert from 'node:assert/strict';
+import dns from 'node:dns/promises';
+import { getEventListeners } from 'node:events';
+import { createServer } from 'node:http';
+import { syncBuiltinESMExports } from 'node:module';
+import net from 'node:net';
+import tls from 'node:tls';
+import { test, type TestContext } from 'node:test';
+import { withTimeout } from '@maka/core/test-only/async-primitives';
+import {
+  createProxiedFetchTransport,
+  PublicNetworkPolicyError,
+} from '../scoped-fetch-transport.js';
+import { preparePublicNetworkTarget } from '../public-network-policy.js';
+
+const policy = { targetPolicy: 'public', redirect: 'manual' } as const;
+function restore(t: TestContext) {
+  t.after(() => {
+    t.mock.restoreAll();
+    syncBuiltinESMExports();
+  });
+  syncBuiltinESMExports();
+}
+
+test('public policy is per request; ordinary private requests and automatic redirects still work', async () => {
+  let hits = 0;
+  const server = createServer((req, res) => {
+    hits++;
+    if (req.url === '/redirect') res.writeHead(302, { location: '/image' }).end();
+    else res.end('ok');
+  });
+  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+  const url = `http://127.0.0.1:${(server.address() as net.AddressInfo).port}`;
+  const transport = createProxiedFetchTransport(null);
+  try {
+    assert.equal(await (await transport.fetch(url + '/redirect')).text(), 'ok');
+    await assert.rejects(transport.fetch(url, policy), PublicNetworkPolicyError);
+    assert.equal(hits, 2);
+    assert.equal(await (await transport.fetch(url)).text(), 'ok');
+    assert.equal(hits, 3);
+    await assert.rejects(
+      transport.fetch('http://image.example', { targetPolicy: 'public' }),
+      /manual redirects/,
+    );
+  } finally {
+    await transport.close();
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+  }
+});
+
+for (const address of ['198.18.0.2', '198.19.255.254', '2001:2::6', '2001:2:0:1::2']) {
+  test(`public policy rejects benchmark DNS and literal ${address} without exceptions`, async (t) => {
+    const benchmark = { address, family: address.includes(':') ? 6 : 4 };
+    let answers = [benchmark];
+    const lookup = t.mock.method(dns, 'lookup', async () => answers);
+    const connect = t.mock.method(net, 'connect', () =>
+      assert.fail('blocked target reached transport'),
+    );
+    restore(t);
+    const direct = createProxiedFetchTransport(null);
+    const proxy = createProxiedFetchTransport({
+      enabled: true,
+      type: 'http',
+      host: '127.0.0.1',
+      port: 1,
+      bypassList: [],
+    });
+    try {
+      for (const resolved of [[benchmark], [{ address: '93.184.216.34', family: 4 }, benchmark]]) {
+        answers = resolved;
+        await assert.rejects(
+          direct.fetch('http://image.example', policy),
+          PublicNetworkPolicyError,
+        );
+      }
+      assert.equal(lookup.mock.callCount(), 2);
+      const literal = `http://${benchmark.family === 6 ? `[${address}]` : address}/`;
+      for (const transport of [direct, proxy]) {
+        await assert.rejects(transport.fetch(literal, policy), PublicNetworkPolicyError);
+      }
+      assert.equal(lookup.mock.callCount(), 2);
+      assert.equal(connect.mock.callCount(), 0);
+    } finally {
+      await direct.close();
+      await proxy.close();
+    }
+  });
+}
+
+test('public policy rejects local names and private literals before DNS on either route', async (t) => {
+  const lookup = t.mock.method(dns, 'lookup', async () => assert.fail('forbidden URL reached DNS'));
+  restore(t);
+  for (const proxy of [
+    null,
+    { enabled: true, type: 'http' as const, host: '127.0.0.1', port: 1, bypassList: [] },
+  ]) {
+    const transport = createProxiedFetchTransport(proxy);
+    try {
+      for (const url of [
+        'http://127.0.0.1',
+        'http://0x7f000001',
+        'http://10.0.0.1',
+        'http://192.168.0.1',
+        'http://169.254.169.254',
+        'http://100.64.0.1',
+        'http://[::1]',
+        'http://[::ffff:127.0.0.1]',
+        'http://[fd00::1]',
+        'http://localhost.',
+        'http://router.lan',
+        'http://metadata.goog',
+        'http://user:password@image.example',
+        'file:///tmp/image.png',
+      ]) {
+        await assert.rejects(transport.fetch(url, policy), PublicNetworkPolicyError);
+      }
+    } finally {
+      await transport.close();
+    }
+  }
+  assert.equal(lookup.mock.callCount(), 0);
+});
+
+test('public direct requests pin admitted DNS, isolate ordinary sockets, and recheck each request', async (t) => {
+  let hits = 0;
+  const server = createServer((req, res) => {
+    assert.equal(req.headers.host, 'image.example');
+    hits++;
+    res.end('ok');
+  });
+  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+  const port = (server.address() as net.AddressInfo).port;
+  const realConnect = net.connect;
+  let answers = [{ address: '93.184.216.34', family: 4 }];
+  const lookup = t.mock.method(dns, 'lookup', async () => answers);
+  let pinnedConnections = 0;
+  t.mock.method(net, 'connect', (options: net.TcpNetConnectOpts) => {
+    assert.equal(options.host, 'image.example');
+    if (options.lookup) {
+      pinnedConnections++;
+      // A fresh lookup would now resolve privately. The connector must use
+      // the admitted answer, not re-resolve or reuse an ordinary socket.
+      answers = [{ address: '127.0.0.1', family: 4 }];
+      options.lookup(options.host, { all: true }, (error, addresses) => {
+        assert.equal(error, null);
+        assert.deepEqual(addresses, [{ address: '93.184.216.34', family: 4 }]);
+      });
+      options.lookup(options.host, {}, (error, address, family) => {
+        assert.equal(error, null);
+        assert.equal(address, '93.184.216.34');
+        assert.equal(family, 4);
+      });
+    }
+    return realConnect({ host: '127.0.0.1', port });
+  });
+  restore(t);
+  const transport = createProxiedFetchTransport(null);
+  try {
+    assert.equal(await (await transport.fetch('http://image.example')).text(), 'ok');
+    const mutableUrl = new URL('http://image.example');
+    const checked = transport.fetch(mutableUrl, policy);
+    mutableUrl.hostname = '127.0.0.1';
+    assert.equal(await (await checked).text(), 'ok');
+    assert.equal(pinnedConnections, 1);
+    assert.equal(lookup.mock.callCount(), 1);
+    await assert.rejects(transport.fetch('http://image.example', policy), PublicNetworkPolicyError);
+    assert.equal(hits, 2);
+    // The policy on the previous requests did not alter this transport's default.
+    assert.equal(await (await transport.fetch('http://image.example')).text(), 'ok');
+  } finally {
+    await transport.close();
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+  }
+});
+
+test('proxy bypass applies public DNS checks only to the direct route', async (t) => {
+  const lookup = t.mock.method(dns, 'lookup', async () => [{ address: '127.0.0.1', family: 4 }]);
+  const connect = t.mock.method(net, 'connect', () => assert.fail('blocked bypass reached socket'));
+  restore(t);
+  const transport = createProxiedFetchTransport({
+    enabled: true,
+    type: 'http',
+    host: '127.0.0.1',
+    port: 1,
+    bypassList: ['image.example'],
+  });
+  try {
+    await assert.rejects(transport.fetch('http://image.example', policy), PublicNetworkPolicyError);
+    assert.equal(lookup.mock.callCount(), 1);
+    assert.equal(connect.mock.callCount(), 0);
+  } finally {
+    await transport.close();
+  }
+});
+
+for (const cancel of ['request', 'transport'] as const) {
+  test(`public DNS lookup is interruptible by ${cancel} cancellation`, async (t) => {
+    let entered!: () => void;
+    const started = new Promise<void>((resolve) => {
+      entered = resolve;
+    });
+    let finish!: (addresses: { address: string; family: number }[]) => void;
+    t.mock.method(dns, 'lookup', () => {
+      entered();
+      return new Promise((resolve) => {
+        finish = resolve;
+      });
+    });
+    const connect = t.mock.method(net, 'connect', () => assert.fail('canceled DNS reached socket'));
+    restore(t);
+    const transport = createProxiedFetchTransport(null);
+    const controller = new AbortController();
+    const pending = assert.rejects(
+      transport.fetch('http://image.example', { ...policy, signal: controller.signal }),
+      /stopped|transport closed/,
+    );
+    try {
+      await started;
+      if (cancel === 'request') controller.abort(new Error('stopped'));
+      else await transport.close();
+      await withTimeout(pending, 1000, 'DNS cancellation did not settle');
+      finish([{ address: '93.184.216.34', family: 4 }]);
+      await new Promise((resolve) => setImmediate(resolve));
+      assert.equal(connect.mock.callCount(), 0);
+    } finally {
+      await transport.close();
+    }
+  });
+}
+
+test('public DNS validation cleans abort listeners on success and failure', async (t) => {
+  let answers = [{ address: '2606:4700:4700::1111', family: 6 }];
+  t.mock.method(dns, 'lookup', async () => answers);
+  restore(t);
+  const controller = new AbortController();
+  assert.deepEqual(
+    await preparePublicNetworkTarget(new URL('https://image.example'), false, controller.signal),
+    answers[0],
+  );
+  answers = [];
+  await assert.rejects(
+    preparePublicNetworkTarget(new URL('https://image.example'), false, controller.signal),
+    PublicNetworkPolicyError,
+  );
+  assert.equal(getEventListeners(controller.signal, 'abort').length, 0);
+});
+
+for (const cancel of ['request', 'transport'] as const) {
+  test(`public direct TLS handshake preserves SNI and closes on ${cancel} cancellation`, async (t) => {
+    let entered!: () => void;
+    const started = new Promise<void>((resolve) => {
+      entered = resolve;
+    });
+    let disconnected!: () => void;
+    const closed = new Promise<void>((resolve) => {
+      disconnected = resolve;
+    });
+    const sockets = new Set<net.Socket>();
+    const server = net.createServer((socket) => {
+      sockets.add(socket);
+      socket.on('error', () => {});
+      socket.on('close', () => {
+        sockets.delete(socket);
+        disconnected();
+      });
+      socket.once('data', (chunk) => {
+        assert.equal(chunk[0], 22, 'expected a real TLS ClientHello');
+        entered();
+      });
+    });
+    await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+    const port = (server.address() as net.AddressInfo).port;
+    const realConnect = tls.connect;
+    t.mock.method(dns, 'lookup', async () => [{ address: '93.184.216.34', family: 4 }]);
+    t.mock.method(
+      tls,
+      'connect',
+      (options: tls.ConnectionOptions & { lookup?: net.TcpNetConnectOpts['lookup'] }) => {
+        assert.equal(options.host, 'image.example');
+        assert.equal(options.servername, 'image.example');
+        assert.notEqual(options.rejectUnauthorized, false);
+        assert.ok(options.lookup);
+        options.lookup(options.host!, { all: true }, (error, addresses) => {
+          assert.equal(error, null);
+          assert.deepEqual(addresses, [{ address: '93.184.216.34', family: 4 }]);
+        });
+        return realConnect({ ...options, host: '127.0.0.1', port, lookup: undefined });
+      },
+    );
+    restore(t);
+    const transport = createProxiedFetchTransport(null);
+    const controller = new AbortController();
+    const pending = assert.rejects(
+      transport.fetch('https://image.example', { ...policy, signal: controller.signal }),
+    );
+    try {
+      await withTimeout(started, 2000, 'TLS handshake did not start');
+      if (cancel === 'request') controller.abort();
+      else await transport.close();
+      await withTimeout(pending, 1000, 'fetch did not stop');
+      await withTimeout(closed, 1000, 'TLS socket survived cancellation');
+    } finally {
+      await transport.close();
+      for (const socket of sockets) socket.destroy();
+      await new Promise<void>((resolve) => server.close(() => resolve()));
+    }
+  });
+}
diff --git a/packages/runtime/src/network/__tests__/scoped-fetch-transport.test.ts b/packages/runtime/src/network/__tests__/scoped-fetch-transport.test.ts
index ceb2ec4be93..759da372245 100644
--- a/packages/runtime/src/network/__tests__/scoped-fetch-transport.test.ts
+++ b/packages/runtime/src/network/__tests__/scoped-fetch-transport.test.ts
@@ -33,7 +33,10 @@ import {
 } from '../../connection-effect-fetch.js';
 import { runConnectionModelDiscoveryEffect } from '../../model-fetcher.js';
 import { runConnectionTestEffect, testConnection } from '../../test-connection.js';
-import { createConnectionEffectFetchTransport } from '../scoped-fetch-transport.js';
+import {
+  createConnectionEffectFetchTransport,
+  createProxiedFetchTransport,
+} from '../scoped-fetch-transport.js';
 import { testProxyConnection } from '../proxy-test.js';
 import { proxiedFetch } from '../../bots/proxied-fetch.js';
 import { setActiveProxy } from '../active-proxy-state.js';
@@ -226,6 +229,37 @@ describe('connection effect network transport', () => {
     });
   }
 
+  for (const authenticated of [false, true]) {
+    test(`public requests preserve SOCKS remote DNS (auth: ${authenticated})`, async () => {
+      const proxy = await startStalledProxy(
+        authenticated ? 'socks-auth-http' : 'socks-http',
+        false,
+        'image.example',
+      );
+      const transport = createProxiedFetchTransport({
+        ...PROXY_DEFAULTS,
+        enabled: true,
+        type: 'socks5',
+        host: '127.0.0.1',
+        port: proxy.port,
+        username: authenticated ? 'proxy-user' : '',
+        password: authenticated ? 'proxy-password' : '',
+        bypassList: [],
+      });
+      try {
+        const response = await transport.fetch('http://image.example/models', {
+          targetPolicy: 'public',
+          redirect: 'manual',
+          signal: AbortSignal.timeout(2000),
+        });
+        assert.equal(await response.text(), 'proxy-ok');
+      } finally {
+        await transport.close();
+        await proxy.close();
+      }
+    });
+  }
+
   for (const type of ['http', 'https', 'socks5'] as const) {
     test(`immediate close rejects pending and subsequent requests (${type})`, async () => {
       const proxy = await startStalledProxy(
@@ -803,7 +837,11 @@ describe('connection effect network transport', () => {
   });
 });
 
-async function startStalledProxy(stage: string, rejectTls = false) {
+async function startStalledProxy(
+  stage: string,
+  rejectTls = false,
+  targetHost = 'provider.invalid',
+) {
   const sockets = new Set<net.Socket>();
   let started!: () => void;
   const reachedStage = new Promise<void>((resolve) => {
@@ -864,7 +902,7 @@ async function startStalledProxy(stage: string, rejectTls = false) {
       } else if (phase === 'socks-connect' && buffer.length >= 5) {
         assert.equal(buffer[3], 3, 'the destination hostname must be resolved by the proxy');
         if (buffer.length < 7 + buffer[4]!) return;
-        assert.equal(buffer.subarray(5, 5 + buffer[4]!).toString(), 'provider.invalid');
+        assert.equal(buffer.subarray(5, 5 + buffer[4]!).toString(), targetHost);
         buffer = Buffer.alloc(0);
         if (stage === 'socks-connect') {
           phase = 'stalled';
diff --git a/packages/runtime/src/network/public-network-policy.ts b/packages/runtime/src/network/public-network-policy.ts
new file mode 100644
index 00000000000..9d1e4e98e83
--- /dev/null
+++ b/packages/runtime/src/network/public-network-policy.ts
@@ -0,0 +1,107 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { lookup } from 'node:dns/promises';
+import type { LookupAddress } from 'node:dns';
+import { isIP } from 'node:net';
+
+export class PublicNetworkPolicyError extends Error {
+  readonly name = 'PublicNetworkPolicyError';
+  constructor() {
+    super('Network target is not allowed by the public network policy');
+  }
+}
+
+/** Validate every URL, then resolve and pin direct destinations. Configured
+ * proxies resolve named destinations themselves and are trusted to enforce
+ * their egress boundary. Local DNS cannot establish a proxy's final address. */
+export async function preparePublicNetworkTarget(
+  url: URL,
+  useProxy: boolean,
+  signal: AbortSignal,
+): Promise<LookupAddress | undefined> {
+  signal.throwIfAborted();
+  if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password)
+    throw new PublicNetworkPolicyError();
+  const host = url.hostname.replace(/^\[|\]$/g, '');
+  const family = isIP(host);
+  if (family) {
+    if (!publicAddress(host)) throw new PublicNetworkPolicyError();
+    return useProxy ? undefined : { address: host, family };
+  }
+  if (!publicHostname(host)) throw new PublicNetworkPolicyError();
+  if (useProxy) return undefined;
+  const addresses = await lookupWithSignal(host, signal);
+  signal.throwIfAborted();
+  if (!addresses.length || addresses.some(({ address }) => !publicAddress(address)))
+    throw new PublicNetworkPolicyError();
+  return addresses[0];
+}
+
+function lookupWithSignal(host: string, signal: AbortSignal): Promise<LookupAddress[]> {
+  return new Promise((resolve, reject) => {
+    const abort = () => {
+      signal.removeEventListener('abort', abort);
+      reject(signal.reason);
+    };
+    signal.addEventListener('abort', abort, { once: true });
+    if (signal.aborted) abort();
+    else
+      void lookup(host, { all: true })
+        .then(resolve, reject)
+        .finally(() => {
+          signal.removeEventListener('abort', abort);
+        });
+  });
+}
+
+function publicHostname(host: string): boolean {
+  const name = host.toLowerCase().replace(/\.$/, '');
+  return (
+    name.includes('.') &&
+    !/(^|\.)(localhost|local|lan|internal|home|arpa|test|invalid)$/.test(name) &&
+    ![
+      'metadata.google.internal',
+      'metadata.goog',
+      'metadata.tencentyun.com',
+      'instance-data.ec2.internal',
+    ].includes(name)
+  );
+}
+
+function publicAddress(address: string): boolean {
+  if (isIP(address) === 4) {
+    const [a = 0, b = 0] = address.split('.').map(Number);
+    return (
+      a > 0 &&
+      a !== 10 &&
+      a !== 127 &&
+      a < 224 &&
+      !(a === 169 && b === 254) &&
+      !(a === 172 && b >= 16 && b <= 31) &&
+      !(a === 192 && b === 168) &&
+      !(a === 100 && b >= 64 && b <= 127) &&
+      !(a === 198 && (b === 18 || b === 19))
+    );
+  }
+  if (isIP(address) !== 6) return false;
+  // Only global-unicast IPv6 is eligible, excluding the benchmarking prefix.
+  const normalized = new URL(`http://[${address}]`).hostname;
+  return /^[23][0-9a-f]{3}:/i.test(address) && !/^\[2001:2:(?::|0:)/i.test(normalized);
+}
diff --git a/packages/runtime/src/network/scoped-fetch-transport.ts b/packages/runtime/src/network/scoped-fetch-transport.ts
index 1d3ddc72f98..aa5a37632a7 100644
--- a/packages/runtime/src/network/scoped-fetch-transport.ts
+++ b/packages/runtime/src/network/scoped-fetch-transport.ts
@@ -23,6 +23,8 @@ import type { ConnectionEffectFetch } from '../connection-effect-fetch.js';
 import { matchesBypassList } from './bypass-matcher.js';
 import { buildProxyDispatcher } from './proxy-dispatcher.js';
 import { buildAbortableConnector } from './abortable-connector.js';
+import { preparePublicNetworkTarget } from './public-network-policy.js';
+export { PublicNetworkPolicyError } from './public-network-policy.js';
 
 export const FETCH_PROXY_SNAPSHOT = Symbol.for('maka.fetch.proxy-snapshot');
 
@@ -43,17 +45,20 @@ export interface ConnectionEffectFetchTransport {
 
 export type ProxiedFetchProxy = ConnectionEffectProxySnapshot;
 
-/** Use the same immutable route decision when a caller also owns a pinned direct connection. */
-export function usesFetchProxy(fetch: typeof globalThis.fetch, url: URL): boolean {
-  const proxy = Object.getOwnPropertyDescriptor(fetch, FETCH_PROXY_SNAPSHOT)?.value as
-    | ProxySettings
-    | null
-    | undefined;
-  return !!proxy?.enabled && !matchesBypassList(url.hostname, proxy.bypassList);
+export interface ScopedFetchInit extends RequestInit {
+  /** Opt-in public destination policy. Direct DNS is checked and pinned;
+   * configured proxies own final resolution/egress. Redirects must be manual
+   * (each next URL is a new checked request) or error. Defaults stay unchanged. */
+  readonly targetPolicy?: 'public';
 }
 
+export type ScopedFetch = (
+  input: Parameters<typeof globalThis.fetch>[0],
+  init?: ScopedFetchInit,
+) => Promise<Response>;
+
 export interface ProxiedFetchTransport {
-  readonly fetch: typeof globalThis.fetch;
+  readonly fetch: ScopedFetch;
   close(): Promise<void>;
 }
 
@@ -83,27 +88,78 @@ export function createProxiedFetchTransport(
   // direct and proxy connection establishment too, including TLS handshakes.
   const connections = new AbortController();
   const directDispatcher = new Agent({ connect: buildAbortableConnector(connections.signal) });
+  const publicDispatchers = new Set<Agent>();
   let proxyDispatcher: Dispatcher | undefined;
   let closePromise: Promise<void> | undefined;
   let closed = false;
 
-  const fetch: typeof globalThis.fetch = async (input, init) => {
+  const fetch: ScopedFetch = async (input, init) => {
     if (closed) throw new Error('Proxied fetch transport is closed');
 
     const url =
       typeof input === 'string' ? input : input instanceof URL ? input.toString() : input.url;
     const useProxy =
       proxySnapshot !== null && !matchesBypassList(new URL(url).hostname, proxySnapshot.bypassList);
+    const { targetPolicy, ...requestInit } = init ?? {};
+    let publicDispatcher: Agent | undefined;
+    if (targetPolicy !== undefined) {
+      if (targetPolicy !== 'public') throw new Error('Unknown network target policy');
+      const inputRequest = typeof input === 'string' || input instanceof URL ? undefined : input;
+      const redirect = requestInit.redirect ?? inputRequest?.redirect ?? 'follow';
+      if (redirect !== 'manual' && redirect !== 'error')
+        throw new Error('Public network requests require manual redirects or redirect: error');
+      const requestSignal =
+        requestInit.signal === undefined ? inputRequest?.signal : requestInit.signal;
+      const signal = requestSignal
+        ? AbortSignal.any([connections.signal, requestSignal])
+        : connections.signal;
+      const target = await preparePublicNetworkTarget(new URL(url), useProxy, signal);
+      signal.throwIfAborted();
+      requestInit.signal = signal;
+      if (target) {
+        // A separate dispatcher prevents reuse of an unchecked connection and
+        // binds this request to exactly the DNS answer admitted above.
+        publicDispatcher = new Agent({
+          connect: buildAbortableConnector(signal, {
+            lookup: (_host, options, callback) =>
+              options.all
+                ? callback(null, [target])
+                : callback(null, target.address, target.family),
+          }),
+        });
+        publicDispatchers.add(publicDispatcher);
+      }
+    }
     if (useProxy)
       proxyDispatcher ??= buildProxyDispatcher(proxySnapshot, connections.signal) as Dispatcher;
 
-    return (await undiciFetch(
-      input as Parameters<typeof undiciFetch>[0],
-      {
-        ...init,
-        dispatcher: useProxy ? proxyDispatcher : directDispatcher,
-      } as Parameters<typeof undiciFetch>[1],
-    )) as unknown as Response;
+    try {
+      const response = (await undiciFetch(
+        // Keep a mutable URL object bound to the destination checked before DNS awaited.
+        (targetPolicy === 'public' && input instanceof URL ? url : input) as Parameters<
+          typeof undiciFetch
+        >[0],
+        {
+          ...requestInit,
+          dispatcher: publicDispatcher ?? (useProxy ? proxyDispatcher : directDispatcher),
+        } as Parameters<typeof undiciFetch>[1],
+      )) as unknown as Response;
+      if (publicDispatcher) {
+        const dispatcher = publicDispatcher;
+        // Graceful close waits for the body, without delaying delivery of headers.
+        void dispatcher
+          .close()
+          .catch(() => {})
+          .finally(() => publicDispatchers.delete(dispatcher));
+      }
+      return response;
+    } catch (error) {
+      if (publicDispatcher) {
+        await publicDispatcher.destroy().catch(() => {});
+        publicDispatchers.delete(publicDispatcher);
+      }
+      throw error;
+    }
   };
   Object.defineProperty(fetch, FETCH_PROXY_SNAPSHOT, {
     value: proxySnapshot,
@@ -115,6 +171,9 @@ export function createProxiedFetchTransport(
     closed = true;
     connections.abort(new Error('Connection effect fetch transport closed'));
     closePromise = Promise.all([
+      ...[...publicDispatchers].map((dispatcher) =>
+        dispatcher.destroy(new Error('Connection effect fetch transport closed')).catch(() => {}),
+      ),
       directDispatcher
         .destroy(new Error('Connection effect fetch transport closed'))
         .catch(() => {}),

From 7833fe84672b9ba83509cd7863bb26a13e011087 Mon Sep 17 00:00:00 2001
From: Sun-GLiang <81428141+Sun-GLiang@users.noreply.github.com>
Date: Sat, 10 Oct 2026 16:14:37 +0800
Subject: [PATCH 32/37] fix(ui): render reasoning images as links

Generated-by: Codex (GPT-6)
---
 .../scripts/markdown-images.browser.test.mjs  | 60 ++++++++++++++++++-
 packages/ui/src/chat-turn.tsx                 |  1 +
 packages/ui/src/markdown-body.tsx             | 26 +++++++-
 packages/ui/src/markdown.tsx                  |  2 +
 4 files changed, 86 insertions(+), 3 deletions(-)

diff --git a/packages/ui/scripts/markdown-images.browser.test.mjs b/packages/ui/scripts/markdown-images.browser.test.mjs
index 0374c29bad6..c16a930b8c3 100644
--- a/packages/ui/scripts/markdown-images.browser.test.mjs
+++ b/packages/ui/scripts/markdown-images.browser.test.mjs
@@ -90,6 +90,17 @@ before(async () => {
   await new Promise(resolve => imageServer.listen(0, '127.0.0.1', resolve));
   imageUrl = `http://127.0.0.1:${imageServer.address().port}`;
   const destinations = {
+    'links-formats': [
+      `![Screenshot](${imageUrl}/image.png)`,
+      '![Reference][picture]',
+      `[picture]: <${imageUrl}/reference.png>`,
+      `Build ![Badge](${imageUrl}/badge.png) passing.`,
+      `![](${imageUrl}/empty.png)`,
+      '![Local](/tmp/private.png)',
+      '`![Example](https://example.com/code.png)`',
+    ].join('\n\n'),
+    'links-redacted': `![Signed](${imageUrl}/image.png?token=reasoning-secret)\n\n![Blocked](javascript:alert)`,
+    'links-streaming': `![Streaming](${imageUrl}/stream`,
     'badge-remote': `Build ![Badge](${imageUrl}/badge.png) passing.`,
     'badge-saved': `Build ![Badge](${imageUrl}/badge.png) passing.`,
     'badge-saving': `Build ![Badge](${imageUrl}/badge.png) passing.`,
@@ -188,12 +199,12 @@ before(async () => {
         await new Promise(resolve=>setTimeout(resolve,100));
         return mode.endsWith('saving') && window.deliveryQueries===1 ? {status:'pending'} : {status:'ready',artifactId:mode.startsWith('layout-') ? request.source : 'saved-image'};
       };
-      const markdown=(streaming)=>React.createElement(Markdown,{text,streaming,settledText:race ? text : undefined,density:'compact',imageIdentity:{turnId:'turn',messageId}});
+      const markdown=(streaming)=>React.createElement(Markdown,{text,streaming,settledText:race ? text : undefined,density:'compact',imageIdentity:{turnId:'turn',messageId},imageDisplay:mode.startsWith('links-') ? 'link' : undefined});
       const surface=(streaming)=>mode.startsWith('layout-') ? React.createElement('section',{className:mode==='layout-side' ? 'maka-quote-companion' : '',style:{width:mode==='layout-side' ? '360px' : '100%',maxWidth:'100%'}},
         React.createElement(ChatMessageList,{className:'maka-chat-message-list maka-chatContent',align:'top'},
           React.createElement('div',{className:'maka-transcript-turn maka-turn',style:{width:'100%',maxWidth:'var(--maka-reading-measure)',marginInline:'auto'}},
             React.createElement(ChatMessage,{sender:'assistant'},React.createElement(ChatMessageBubble,{variant:'ghost',width:'100%',className:'maka-chat-message-bubble maka-chat-message-bubble-assistant'},markdown(streaming)))))) : markdown(streaming);
-      const render=(streaming=race)=>root.render(
+      const render=(streaming=race || mode==='links-streaming')=>root.render(
         React.createElement(Theme,{theme:makaTheme,mode:'light'},
           React.createElement(LocaleProvider,{locale:'en'},
             React.createElement(SessionAttachmentProvider,{sessionId:'session',readBytes},
@@ -253,6 +264,51 @@ async function loaded(page) {
   await page.waitForFunction(() => [...document.images].some(image => image.naturalWidth === 1));
 }
 
+test('image links preserve Markdown destinations without loading image or attachment bytes', async () => {
+  requests = [];
+  const page = await pageFor('links-formats');
+  try {
+    await page.getByRole('link', {name:/^Screenshot/}).waitFor();
+    assert.equal(await page.getByRole('link', {name:/^Screenshot/}).getAttribute('href'), `${imageUrl}/image.png`);
+    assert.equal(await page.getByRole('link', {name:/^Reference/}).getAttribute('href'), `${imageUrl}/reference.png`);
+    assert.equal(await page.getByRole('link', {name:/^Badge/}).getAttribute('href'), `${imageUrl}/badge.png`);
+    assert.equal(await page.locator('a').filter({hasText:`${imageUrl}/empty.png`}).getAttribute('href'), `${imageUrl}/empty.png`);
+    assert.equal(await page.locator('a a').count(), 0);
+    assert.equal(await page.getByRole('link', {name:'Local', exact:true}).count(), 0);
+    assert.equal(await page.locator('code').innerText(), '![Example](https://example.com/code.png)');
+    assert.equal(await page.locator('img, .maka-markdown-image-resource').count(), 0);
+    assert.deepEqual(await page.evaluate(() => [window.deliveryQueries, window.imageReads]), [0, 0]);
+    assert.deepEqual(requests, []);
+  } finally { await page.close(); }
+});
+
+test('image links do not expose signed destinations or enable unsafe schemes', async () => {
+  requests = [];
+  const page = await pageFor('links-redacted');
+  try {
+    await page.getByText('Signed', {exact:true}).waitFor();
+    assert.equal(await page.locator('a, img, .maka-markdown-image-resource').count(), 0);
+    assert.doesNotMatch(await page.locator('#root').innerHTML(), /reasoning-secret|maka-image-display:/);
+    assert.deepEqual(await page.evaluate(() => [window.deliveryQueries, window.imageReads]), [0, 0]);
+    assert.deepEqual(requests, []);
+  } finally { await page.close(); }
+});
+
+test('streaming reasoning completes image syntax as a link without fetching it', async () => {
+  requests = [];
+  const page = await pageFor('links-streaming');
+  try {
+    await page.waitForFunction(() => typeof window.appendText === 'function');
+    await page.evaluate(() => window.appendText('.png)'));
+    await page.getByRole('link', {name:/^Streaming/}).waitFor();
+    await page.evaluate(() => window.finishStream());
+    assert.equal(await page.getByRole('link', {name:/^Streaming/}).getAttribute('href'), `${imageUrl}/stream.png`);
+    assert.equal(await page.locator('img, .maka-markdown-image-resource').count(), 0);
+    assert.deepEqual(await page.evaluate(() => [window.deliveryQueries, window.imageReads]), [0, 0]);
+    assert.deepEqual(requests, []);
+  } finally { await page.close(); }
+});
+
 test('a remote image loads automatically and renders Host-owned bytes', async () => {
   requests = [];
   const page = await pageFor('remote');
diff --git a/packages/ui/src/chat-turn.tsx b/packages/ui/src/chat-turn.tsx
index 5bc1a3349e8..14022400f8a 100644
--- a/packages/ui/src/chat-turn.tsx
+++ b/packages/ui/src/chat-turn.tsx
@@ -1533,6 +1533,7 @@ function DeepThinking(props: { text: string; live: boolean; settledText?: string
       <Markdown
         text={props.text}
         streaming={props.live}
+        imageDisplay="link"
         // A truncated reasoning buffer slides at the head. It is a current
         // snapshot, not an append-only prefix for the reveal cursor to replay.
         settledText={props.truncated ? props.text : props.settledText}
diff --git a/packages/ui/src/markdown-body.tsx b/packages/ui/src/markdown-body.tsx
index f9ecab9d3f6..553c3369f40 100644
--- a/packages/ui/src/markdown-body.tsx
+++ b/packages/ui/src/markdown-body.tsx
@@ -31,8 +31,11 @@
 
 import { MarkdownImage, MarkdownImageSourceProvider, MARKDOWN_IMAGE_PLUGINS } from './markdown-image.js';
 import { ImageMessageScope } from './image-delivery.js';
+import { createMarkdownPlugin } from '@astryxdesign/core/Markdown/plugins';
+import type { MarkdownAstNode, MarkdownAstRoot } from '@astryxdesign/core/Markdown';
 import { useCallback, useContext, useMemo, useRef, type ReactNode } from 'react';
 import { redactMarkdownImages } from './markdown-image-redaction.js';
+import { redactSecrets } from './redact.js';
 import {
   Markdown as AstryxMarkdown,
   type MarkdownComponents,
@@ -148,6 +151,7 @@ export function MarkdownBody(props: {
   /** The lazy entry redacts its fallback; the body also preserves image identities. */
   redact?: boolean;
   imageIdentity?: { turnId: string; messageId: string };
+  imageDisplay?: 'image' | 'link';
   streaming?: boolean;
   settledText?: string;
   density?: 'default' | 'compact';
@@ -161,6 +165,26 @@ export function MarkdownBody(props: {
     ? redactMarkdownImages(props.text, props.settledText)
     : { text: props.text, settledText: props.settledText, sources: undefined },
   [props.redact, props.text, props.settledText]);
+  const plugins = useMemo(() => props.imageDisplay === 'link' ? [createMarkdownPlugin({
+    name: 'maka-image-links', apiVersion: 1,
+    transform(document) {
+      // Use parsed nodes so references and code examples retain their semantics.
+      // No image component mounts in this mode, so display cannot load bytes.
+      const rewrite = (node: MarkdownAstNode, insideLink = false, phrasing = false): MarkdownAstNode => {
+        if (node.type === 'image') {
+          const source = presentation.sources?.get(node.url) ?? node.url;
+          const text = { type: 'text' as const, value: node.alt || redactSecrets(source) };
+          const link = insideLink || source !== redactSecrets(source) ? text
+            : { type: 'link' as const, url: source, children: [text] };
+          return phrasing ? link : { type: 'paragraph', children: [link] };
+        }
+        if (!('children' in node)) return node;
+        const childPhrasing = ['paragraph', 'heading', 'tableCell', 'link', 'strong', 'emphasis', 'delete'].includes(node.type);
+        return { ...node, children: node.children.map(child => rewrite(child, insideLink || node.type === 'link', childPhrasing)) } as MarkdownAstNode;
+      };
+      return rewrite(document) as MarkdownAstRoot;
+    },
+  })] : MARKDOWN_IMAGE_PLUGINS, [props.imageDisplay, presentation.sources]);
   const budgetedText = props.streaming ? presentation.text : applyMermaidRenderBudget(presentation.text);
   const density = props.density ?? 'default';
   const components = props.streaming
@@ -205,7 +229,7 @@ export function MarkdownBody(props: {
             // the one combination neither half of the argument asks for.
             density={density}
             components={components}
-            plugins={MARKDOWN_IMAGE_PLUGINS}
+            plugins={plugins}
             isStreaming={props.streaming}
             settledText={presentation.settledText}
             transformSource={transformMathSource}
diff --git a/packages/ui/src/markdown.tsx b/packages/ui/src/markdown.tsx
index 57ef8fb3dea..22058909518 100644
--- a/packages/ui/src/markdown.tsx
+++ b/packages/ui/src/markdown.tsx
@@ -58,6 +58,7 @@ const MarkdownBody = lazy(() => import('./markdown-body.js').then((m) => ({ defa
 export function Markdown(props: {
   text: string;
   imageIdentity?: { turnId: string; messageId: string };
+  imageDisplay?: 'image' | 'link';
   streaming?: boolean;
   settledText?: string;
   /** Block rhythm. Transcript turns pass `compact`; documents leave it. */
@@ -80,6 +81,7 @@ export function Markdown(props: {
         text={props.text}
         redact
         imageIdentity={props.imageIdentity}
+        imageDisplay={props.imageDisplay}
         streaming={streaming}
         settledText={props.settledText}
         density={props.density}

From 47f24b9a828efe55937c43aa4ba252d19179a9c4 Mon Sep 17 00:00:00 2001
From: Sun-GLiang <81428141+Sun-GLiang@users.noreply.github.com>
Date: Sat, 10 Oct 2026 16:25:59 +0800
Subject: [PATCH 33/37] fix(ui): keep execution process images as links

Generated-by: Codex (GPT-6)
---
 .../chat-turn-answer-identity.test.tsx        | 55 +++++++++++++++++++
 packages/ui/src/chat-turn.tsx                 | 10 +++-
 2 files changed, 63 insertions(+), 2 deletions(-)

diff --git a/packages/ui/src/__tests__/chat-turn-answer-identity.test.tsx b/packages/ui/src/__tests__/chat-turn-answer-identity.test.tsx
index f81ac17c9d1..ce1dbd6b96e 100644
--- a/packages/ui/src/__tests__/chat-turn-answer-identity.test.tsx
+++ b/packages/ui/src/__tests__/chat-turn-answer-identity.test.tsx
@@ -28,6 +28,8 @@ import { LocalizedChatMessage, TurnView } from '../chat-turn.js';
 import { LocaleProvider } from '../locale-context.js';
 import type { TurnTimelineItem, TurnViewModel } from '../materialize.js';
 import { applyThinkingDelta } from '../thinking-stream.js';
+import { ImageDeliveryProvider, type ResolveImageDelivery } from '../image-delivery.js';
+import { SessionAttachmentProvider } from '../attachment-image.js';
 
 const originalGlobals = {
   document: globalThis.document,
@@ -208,6 +210,59 @@ test('keeps reasoning expanded when its last neighboring tool is projected away'
   assert.equal(after.getAttribute('aria-expanded'), 'true');
 });
 
+test('process image links never load bytes while the completed final reply still displays an image', async () => {
+  const { container, root } = domRoot();
+  const sources: string[] = [];
+  let reads = 0;
+  const resolve: ResolveImageDelivery = async (_session, request) => {
+    sources.push(request.source);
+    return { status: 'ready', artifactId: 'final-image' };
+  };
+  const readBytes = async () => {
+    reads++;
+    return { ok: true as const, mimeType: 'image/png', base64: 'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8DwHwAFBQIAX8jx0gAAAABJRU5ErkJggg==' };
+  };
+  const thinking: TurnTimelineItem = { kind: 'thinking', messageId: 'reasoning', text: '![Reasoning](https://example.com/reasoning.png)' };
+  const commentary: TurnTimelineItem = { kind: 'text', messageId: 'commentary', text: '![Intermediate](https://example.com/commentary.png)', live: true, complete: true };
+  const final: TurnTimelineItem = { kind: 'text', messageId: 'final', text: '![Final](https://example.com/final.png)' };
+  const render = async (timeline: TurnTimelineItem[], completed = false) => {
+    await act(async () => {
+      root.render(<LocaleProvider locale="en">
+        <SessionAttachmentProvider sessionId="session" readBytes={readBytes}>
+          <ImageDeliveryProvider sessionId="session" resolve={resolve}>
+            <TurnView turn={{ ...turnWith(timeline), status: completed ? 'completed' : 'running' }}
+              liveStreaming={completed ? undefined : { runningStatus: true }} />
+          </ImageDeliveryProvider>
+        </SessionAttachmentProvider>
+      </LocaleProvider>);
+    });
+  };
+
+  // The live last text step is provisional: the next tool can move it into the process.
+  await render([thinking, commentary]);
+  assert.ok(container.querySelector('a[href="https://example.com/commentary.png"]'));
+  assert.equal(container.querySelectorAll('img, .maka-markdown-image-resource').length, 0);
+  assert.deepEqual(sources, []);
+  assert.equal(reads, 0);
+
+  await render([thinking, commentary, RUNNING_TOOL]);
+  assert.ok(container.querySelector('.maka-processing-body a[href="https://example.com/commentary.png"]'));
+  assert.deepEqual(sources, []);
+  assert.equal(reads, 0);
+
+  await render([thinking, commentary, { ...RUNNING_TOOL, items: RUNNING_TOOL.items.map(item => ({ ...item, status: 'completed' })) }, final], true);
+  assert.deepEqual(sources, ['https://example.com/final.png']);
+  assert.equal(reads, 1);
+  assert.equal(container.querySelectorAll('img').length, 1);
+  await act(() => { container.querySelector('.maka-processing-summary')?.dispatchEvent(new window.Event('click', { bubbles: true })); });
+  await act(() => { container.querySelector('.maka-deep-thinking [data-slot="activity-card-header"]')?.dispatchEvent(new window.Event('click', { bubbles: true })); });
+  assert.ok(container.querySelector('.maka-processing-body a[href="https://example.com/reasoning.png"]'));
+  assert.ok(container.querySelector('.maka-processing-body a[href="https://example.com/commentary.png"]'));
+  assert.equal(container.querySelectorAll('.maka-processing-body img, .maka-processing-body .maka-markdown-image-resource').length, 0);
+  assert.deepEqual(sources, ['https://example.com/final.png']);
+  assert.equal(reads, 1);
+});
+
 test('redacts secrets before rendering a settled collapsed reasoning preview', async () => {
   const { container, root } = domRoot();
   await renderTurn(root, turnWith([
diff --git a/packages/ui/src/chat-turn.tsx b/packages/ui/src/chat-turn.tsx
index 14022400f8a..fad32b96900 100644
--- a/packages/ui/src/chat-turn.tsx
+++ b/packages/ui/src/chat-turn.tsx
@@ -767,6 +767,8 @@ export const TurnView = memo(function TurnView(props: {
                   <TurnTimelineEntry
                     key={timelineEntryKey(item, index)}
                     activityObserved={props.activityObserved}
+                    // The next tool can still turn a live reply into process commentary.
+                    imageDisplay={statusBarStatus === 'running' ? 'link' : undefined}
                     item={item}
                     turnId={turn.turnId}
                     onStreamingSettled={props.liveStreaming?.onStreamingSettled}
@@ -1289,7 +1291,7 @@ export function ModelProviderRetryIndicator(props: { retry: LiveProviderRetry })
  */
 type AssistantAnswerPhase = 'historical' | 'streaming' | 'settled';
 
-type AssistantAnswerBubbleProps = { imageIdentity?: { turnId: string; messageId: string } } & (
+type AssistantAnswerBubbleProps = { imageIdentity?: { turnId: string; messageId: string }; imageDisplay?: 'image' | 'link' } & (
   | { text: string; phase: 'historical'; interrupted?: true }
   | {
       text: string;
@@ -1348,6 +1350,7 @@ const AssistantAnswerBubble = memo(function AssistantAnswerBubble(props: Assista
       <Markdown
         text={props.text}
         imageIdentity={props.imageIdentity}
+        imageDisplay={props.imageDisplay}
         streaming={props.phase === 'streaming'}
         settledText={settledText}
         // Names the surface, and not exclusively: the desktop Artifact
@@ -1404,6 +1407,7 @@ const TurnTimelineEntry = memo(function TurnTimelineEntry(props: {
   turnId?: string;
   activityObserved?: boolean;
   item: Exclude<TurnTimelineItem, { kind: 'user' }>;
+  imageDisplay?: 'image' | 'link';
   onStreamingSettled?: (messageId?: string) => void;
   onOpenLinkedSession?(sessionId: string): void;
   initialLiveContent?: ReadonlyMap<string, string>;
@@ -1429,10 +1433,11 @@ const TurnTimelineEntry = memo(function TurnTimelineEntry(props: {
     );
   }
   // Same component either way — a type swap here would remount the answer.
-  if (item.live !== true) return <AssistantAnswerBubble imageIdentity={props.turnId ? { turnId: props.turnId, messageId: item.messageId } : undefined} text={item.text} interrupted={item.interrupted} phase="historical" />;
+  if (item.live !== true) return <AssistantAnswerBubble imageIdentity={props.turnId ? { turnId: props.turnId, messageId: item.messageId } : undefined} imageDisplay={props.imageDisplay} text={item.text} interrupted={item.interrupted} phase="historical" />;
   return (
     <AssistantAnswerBubble
       imageIdentity={props.turnId ? { turnId: props.turnId, messageId: item.messageId } : undefined}
+      imageDisplay={props.imageDisplay}
       text={item.text}
       interrupted={item.interrupted}
       phase={item.complete === true ? 'settled' : 'streaming'}
@@ -1506,6 +1511,7 @@ const ProcessingBlock = memo(function ProcessingBlock(props: {
           <TurnTimelineEntry
             key={timelineEntryKey(entry, index)}
             activityObserved={open && props.activityObserved !== false}
+            imageDisplay="link"
             item={entry}
             turnId={props.turnId}
             onStreamingSettled={props.onStreamingSettled}

From 03f7ed6abb5a87df8f1eddae24b258a111bb5014 Mon Sep 17 00:00:00 2001
From: Sun-GLiang <81428141+Sun-GLiang@users.noreply.github.com>
Date: Sat, 10 Oct 2026 16:41:54 +0800
Subject: [PATCH 34/37] refactor(ui): unify chat image rendering and service
 contracts

Share image AST traversal and canonical destination handling across image and link modes. Move message identity scope into assistant bubbles and reuse narrow chat image service contracts across desktop surfaces.

Cover canonical image links and the renamed WorkHub preload capability. Validate 164 related Node tests, 57 browser scenarios, 166 architecture fixtures, desktop typechecks and Biome checks.

Generated-by: Codex (GPT-6)
---
 ...ub-coordination-transcript-preload.test.ts |  12 +-
 apps/desktop/src/preload/bridge-contract.d.ts |   4 +-
 apps/desktop/src/preload/preload.ts           |   2 +-
 .../features/conversation/staging-services.ts |   7 +-
 .../ui/staged-quote-chat-view.tsx             |   4 +-
 .../src/renderer/features/workbar/ports.ts    |   5 +-
 .../tools/side-chat/quote-companion-panel.tsx |   2 +-
 .../src/renderer/features/workhub/ports.ts    |   6 +-
 .../features/workhub/ui/workhub-root.tsx      |   2 +-
 .../desktop/create-workhub-services.ts        |   4 +-
 apps/desktop/stories/workhub.stories.tsx      |   2 +-
 packages/core/src/image-delivery.ts           |  17 +++
 .../scripts/markdown-images.browser.test.mjs  |  11 +-
 .../src/__tests__/attachment-image.test.tsx   |   6 +-
 .../ui/src/__tests__/markdown-body.test.ts    |  15 +++
 packages/ui/src/attachment-image.tsx          |   7 +-
 packages/ui/src/chat-turn.tsx                 |  40 +++---
 packages/ui/src/chat-view.tsx                 |   2 +-
 packages/ui/src/image-delivery.tsx            |  17 ++-
 packages/ui/src/markdown-body.tsx             | 115 +++++++-----------
 packages/ui/src/markdown-image.tsx            |  88 +++++++-------
 packages/ui/src/markdown.tsx                  |   2 -
 22 files changed, 198 insertions(+), 172 deletions(-)

diff --git a/apps/desktop/src/main/__tests__/workhub-coordination-transcript-preload.test.ts b/apps/desktop/src/main/__tests__/workhub-coordination-transcript-preload.test.ts
index 3545fcf3987..e312f5594b9 100644
--- a/apps/desktop/src/main/__tests__/workhub-coordination-transcript-preload.test.ts
+++ b/apps/desktop/src/main/__tests__/workhub-coordination-transcript-preload.test.ts
@@ -84,6 +84,12 @@ test('WorkHub upload references round-trip through idle answers, both queue mode
             return { ok: true, disposition: args[2] === 'current_turn' ? 'steering' : 'followup', attachments: [uploaded] };
           }
           if (channel === 'attachments:readBytes') return { ok: true, base64: 'aGVsbG8=' };
+          if (channel === 'attachments:resolveImage') {
+            assert.deepEqual(structuredClone(args[2]), {
+              turnId: 'image-turn', messageId: 'image-message', source: '/tmp/image.png',
+            });
+            return { status: 'ready', artifactId: 'image-1' };
+          }
           throw new Error(`Unexpected channel: ${channel}`);
         },
       },
@@ -108,7 +114,11 @@ test('WorkHub upload references round-trip through idle answers, both queue mode
     assert.equal(await services.enqueueMessage(sessionId, `message-${placement}`, 'read this', attachments, placement), 'admitted');
   }
   assert.deepEqual(structuredClone(sent.map(({ attachments }) => attachments)), [[uploaded], [uploaded], [uploaded]]);
-  assert.equal((await services.readAttachmentBytes(sessionId, 'brief.txt')).ok, true);
+  assert.equal((await services.readBytes(sessionId, 'brief.txt')).ok, true);
+  assert.ok(services.resolveImageDelivery);
+  assert.deepEqual(await services.resolveImageDelivery(sessionId, {
+    turnId: 'image-turn', messageId: 'image-message', source: '/tmp/image.png',
+  }), { status: 'ready', artifactId: 'image-1' });
   preparationResult = { ok: false, code: 'item_too_large' };
   await assert.rejects(
     services.prepareAttachments(sessionId, [
diff --git a/apps/desktop/src/preload/bridge-contract.d.ts b/apps/desktop/src/preload/bridge-contract.d.ts
index bb79bbb7bcd..36a7b8f36d0 100644
--- a/apps/desktop/src/preload/bridge-contract.d.ts
+++ b/apps/desktop/src/preload/bridge-contract.d.ts
@@ -1719,8 +1719,8 @@ export interface MakaBridge {
       | { ok: true; base64: string; mimeType: string }
       | { ok: false; reason: string }
     >;
-    resolveImage(sessionId: string, request: import('@maka/core/image-delivery').ImageDeliveryRequest): Promise<import('@maka/core/image-delivery').ImageDeliveryResult>;
-    readBytes(sessionId: string, artifactId: string): Promise<ArtifactBinaryReadResult>;
+    resolveImageDelivery: import('@maka/core/image-delivery').ResolveImageDelivery;
+    readBytes: import('@maka/core/image-delivery').ReadAttachmentBytes;
   };
   search: {
     recall(
diff --git a/apps/desktop/src/preload/preload.ts b/apps/desktop/src/preload/preload.ts
index 13028b3a4a0..f1c27695a7c 100644
--- a/apps/desktop/src/preload/preload.ts
+++ b/apps/desktop/src/preload/preload.ts
@@ -3379,7 +3379,7 @@ const makaBridge = {
     },
   },
   attachments: {
-    resolveImage: (sessionId, request) => invokeSessionRuntimeHost('attachments:resolveImage', sessionId, request),
+    resolveImageDelivery: (sessionId, request) => invokeSessionRuntimeHost('attachments:resolveImage', sessionId, request),
     pickDirectory: () => invokeWhenReady('directories:pick'),
     // The renderer hands over the dropped or pasted File objects, never paths:
     // only a File backed by something the user dropped or pasted has a path,
diff --git a/apps/desktop/src/renderer/features/conversation/staging-services.ts b/apps/desktop/src/renderer/features/conversation/staging-services.ts
index d8bfc678748..643871d9bcb 100644
--- a/apps/desktop/src/renderer/features/conversation/staging-services.ts
+++ b/apps/desktop/src/renderer/features/conversation/staging-services.ts
@@ -19,13 +19,10 @@
 
 import { createServicesContext } from '../../application/contracts/feature-services.js';
 import type { ComposerAttachmentService } from '@maka/ui/use-composer-attachments';
-import type { ArtifactBinaryReadResult } from '@maka/core/artifacts';
+import type { ChatImageServices } from '@maka/core/image-delivery';
 
 /** One attachment port: the Composer stages through it and the transcript reads image bytes through it. */
-export interface ComposerStagingServices extends ComposerAttachmentService {
-  resolveImage?: (sessionId: string, request: import('@maka/core/image-delivery').ImageDeliveryRequest) => Promise<import('@maka/core/image-delivery').ImageDeliveryResult>;
-  readBytes(sessionId: string, artifactId: string): Promise<ArtifactBinaryReadResult>;
-}
+export type ComposerStagingServices = ComposerAttachmentService & ChatImageServices;
 const context = createServicesContext<ComposerStagingServices>('ComposerStagingServicesProvider');
 export const ComposerStagingServicesProvider = context.Provider;
 export const useComposerStagingServices = context.useServices;
diff --git a/apps/desktop/src/renderer/features/conversation/ui/staged-quote-chat-view.tsx b/apps/desktop/src/renderer/features/conversation/ui/staged-quote-chat-view.tsx
index b81e97d9297..78366070d5e 100644
--- a/apps/desktop/src/renderer/features/conversation/ui/staged-quote-chat-view.tsx
+++ b/apps/desktop/src/renderer/features/conversation/ui/staged-quote-chat-view.tsx
@@ -26,6 +26,6 @@ import { useComposerStagingServices } from '../staging-services.js';
 export function StagedQuoteChatView(props: Omit<ComponentProps<typeof PlanChatView>,
   'handleRef' | 'pendingQuotes' | 'onQuoteAnnotationSubmit' | 'onReadAttachmentBytes' | 'onResolveImageDelivery'>) {
   const staging = useComposerStaging();
-  const { readBytes, resolveImage } = useComposerStagingServices();
-  return <PlanChatView {...props} {...staging.chatViewQuoteProps} onReadAttachmentBytes={readBytes} onResolveImageDelivery={resolveImage} />;
+  const { readBytes, resolveImageDelivery } = useComposerStagingServices();
+  return <PlanChatView {...props} {...staging.chatViewQuoteProps} onReadAttachmentBytes={readBytes} onResolveImageDelivery={resolveImageDelivery} />;
 }
diff --git a/apps/desktop/src/renderer/features/workbar/ports.ts b/apps/desktop/src/renderer/features/workbar/ports.ts
index 8e8ed1af9bf..b3c1e418918 100644
--- a/apps/desktop/src/renderer/features/workbar/ports.ts
+++ b/apps/desktop/src/renderer/features/workbar/ports.ts
@@ -17,6 +17,7 @@
  * under the License.
  */
 
+import type { ChatImageServices } from '@maka/core/image-delivery';
 import type { SessionInspectorService } from '../../application/contracts/session-inspector/service.js';
 export type { SessionInspectorService, SessionTracePage, SessionUsageSummary } from '../../application/contracts/session-inspector/service.js';
 
@@ -164,9 +165,7 @@ export interface WorkbarArtifactsService {
   saveAs(sessionId: string, artifactId: string): Promise<ArtifactSaveResult>;
 }
 
-export interface WorkbarAttachmentsService {
-  resolveImage?: (sessionId: string, request: import('@maka/core/image-delivery').ImageDeliveryRequest) => Promise<import('@maka/core/image-delivery').ImageDeliveryResult>;
-  readBytes(sessionId: string, artifactId: string): Promise<ArtifactBinaryReadResult>;
+export interface WorkbarAttachmentsService extends ChatImageServices {
   pickFiles(): Promise<
     | {
         ok: true;
diff --git a/apps/desktop/src/renderer/features/workbar/tools/side-chat/quote-companion-panel.tsx b/apps/desktop/src/renderer/features/workbar/tools/side-chat/quote-companion-panel.tsx
index 68adc96a405..672ccc0e699 100644
--- a/apps/desktop/src/renderer/features/workbar/tools/side-chat/quote-companion-panel.tsx
+++ b/apps/desktop/src/renderer/features/workbar/tools/side-chat/quote-companion-panel.tsx
@@ -403,7 +403,7 @@ export function QuoteCompanionPanel(props: {
           liveTurns={companion.liveTurns}
           activeTurn={companion.activeTurn}
           activeSession={companion.companionSession}
-          onReadAttachmentBytes={attachments.readBytes} onResolveImageDelivery={attachments.resolveImage}
+          onReadAttachmentBytes={attachments.readBytes} onResolveImageDelivery={attachments.resolveImageDelivery}
           deriveTurnPresentation={deriveTurnPresentation}
           onEditUserMessage={(turnId) => {
             const message = companion.messages.find(
diff --git a/apps/desktop/src/renderer/features/workhub/ports.ts b/apps/desktop/src/renderer/features/workhub/ports.ts
index 545b23a5bcd..5172facf369 100644
--- a/apps/desktop/src/renderer/features/workhub/ports.ts
+++ b/apps/desktop/src/renderer/features/workhub/ports.ts
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-import type { ArtifactBinaryReadResult } from '@maka/core/artifacts';
+import type { ChatImageServices } from '@maka/core/image-delivery';
 import type { ChatModelChoice } from '@maka/core/chat-model-choice';
 import type { UiLocale } from '@maka/core/ui-locale';
 import type { StoredMessage, SessionSummary, WorkHubCreateDefaults } from '@maka/core/session';
@@ -39,7 +39,7 @@ export interface WorkHubTranscript {
   loadEarlier(): Promise<void>;
   close(): Promise<void>;
 }
-export interface WorkHubServices extends WorkHubWorkspaceServices {
+export interface WorkHubServices extends WorkHubWorkspaceServices, ChatImageServices {
   readonly inspector: import('../../application/contracts/session-inspector/service.js').SessionInspectorService;
   readonly surface: 'main' | 'workhub';
   readonly initialLocale: UiLocale;
@@ -56,8 +56,6 @@ export interface WorkHubServices extends WorkHubWorkspaceServices {
     model: string;
   }): Promise<void>;
   readonly attachments: ComposerAttachmentService;
-  resolveImageDelivery?: (sessionId: string, request: import('@maka/core/image-delivery').ImageDeliveryRequest) => Promise<import('@maka/core/image-delivery').ImageDeliveryResult>;
-  readAttachmentBytes(sessionId: string, artifactId: string): Promise<ArtifactBinaryReadResult>;
   prepareAttachments(sessionId: string, items: Array<{ approvalId: string; name: string; mimeType?: string } | { file: File }>): Promise<AttachmentRef[]>;
   listActiveInteractions(sessionId: string): Promise<import('@maka/core/events').ActiveInteractionRequestEvent[]>;
   subscribeActiveInteractions(handler: (event: { sessionId: string; interactions: import('@maka/core/events').ActiveInteractionRequestEvent[] }) => void): () => void;
diff --git a/apps/desktop/src/renderer/features/workhub/ui/workhub-root.tsx b/apps/desktop/src/renderer/features/workhub/ui/workhub-root.tsx
index 091edfff8e3..e41421efe5f 100644
--- a/apps/desktop/src/renderer/features/workhub/ui/workhub-root.tsx
+++ b/apps/desktop/src/renderer/features/workhub/ui/workhub-root.tsx
@@ -396,7 +396,7 @@ export function WorkHubRoot() {
         <div ref={history} className="workHubHistory" aria-hidden={!showConversation} inert={!showConversation}>
         <WorkHubConversation
           workLinks={links}
-          onReadAttachmentBytes={services.readAttachmentBytes} onResolveImageDelivery={services.resolveImageDelivery}
+          onReadAttachmentBytes={services.readBytes} onResolveImageDelivery={services.resolveImageDelivery}
           onOpenWork={(id) => call(services.presentation.openSession(id))}
           scrollBehavior="auto"
           onNew={() => composer.current?.focus()}
diff --git a/apps/desktop/src/renderer/platform/desktop/create-workhub-services.ts b/apps/desktop/src/renderer/platform/desktop/create-workhub-services.ts
index 9609793a2e6..fa123a9d553 100644
--- a/apps/desktop/src/renderer/platform/desktop/create-workhub-services.ts
+++ b/apps/desktop/src/renderer/platform/desktop/create-workhub-services.ts
@@ -92,8 +92,8 @@ export function createDesktopWorkHubServices(
     setDefaultModel: ({ llmConnectionSlug, model }) =>
       bridge.connections.setDefaultModel({ slug: llmConnectionSlug, model }),
     attachments: bridge.attachments,
-    readAttachmentBytes: bridge.attachments.readBytes,
-    resolveImageDelivery: bridge.attachments.resolveImage,
+    readBytes: bridge.attachments.readBytes,
+    resolveImageDelivery: bridge.attachments.resolveImageDelivery,
     prepareAttachments: async (sessionId, items) => {
       const result = await bridge.workHub.prepareAttachments(sessionId, items);
       if (!result.ok) throw new AttachmentIngestBlockedError(result.code);
diff --git a/apps/desktop/stories/workhub.stories.tsx b/apps/desktop/stories/workhub.stories.tsx
index ba3f55f7cc0..34a17b25ac4 100644
--- a/apps/desktop/stories/workhub.stories.tsx
+++ b/apps/desktop/stories/workhub.stories.tsx
@@ -114,7 +114,7 @@ function makeServices(failFirst: boolean, withHistory: boolean | 'usage', colore
     listSessions: async () => coloredHistory ? [target, secondTarget] : [target], subscribeSessions: (handler) => { updateSessions = handler; return () => { updateSessions = undefined; }; }, modelChoices: async () => repairModel ? repairChoices : choices,
     setDefaultModel: async () => {},
     attachments: { pickFiles: async () => ({ ok: true, files: [{ approvalId: 'file-1', name: 'requirements.txt', size: 12, mimeType: 'text/plain' }] }), previewApproval: async () => ({ ok: false, reason: 'not-image' }) },
-    readAttachmentBytes: async () => { throw new Error('Not an image'); },
+    readBytes: async () => { throw new Error('Not an image'); },
     prepareAttachments: async (id, items) => { writes.upload(id, items); return [{ name: 'requirements.txt', kind: 'other', mimeType: 'text/plain', bytes: 12, ref: { kind: 'session_file', sessionId: 'maka_workhub_coordination', relativePath: 'artifact-1' } }]; },
     listActiveInteractions: async () => pendingForm ? [pendingForm] : questionPending ? [questionRequest] : [],
     subscribeActiveInteractions: (handler) => { interactionUpdate = handler; return () => { interactionUpdate = undefined; }; },
diff --git a/packages/core/src/image-delivery.ts b/packages/core/src/image-delivery.ts
index da283ea307a..23ec2352600 100644
--- a/packages/core/src/image-delivery.ts
+++ b/packages/core/src/image-delivery.ts
@@ -17,6 +17,8 @@
  * under the License.
  */
 
+import type { ArtifactBinaryReadResult } from './artifacts.js';
+
 /** Client-safe delivery contract. No filesystem or networking capabilities live here. */
 export const IMAGE_DELIVERY_IDENTITY_MAX_LENGTH = 512;
 export const IMAGE_DELIVERY_SOURCE_MAX_LENGTH = 4096;
@@ -89,6 +91,21 @@ export type ImageDeliveryResult =
   | { readonly status: 'ready'; readonly artifactId: string }
   | { readonly status: 'failed'; readonly reason: ImageDeliveryFailure }
   | { readonly status: 'unavailable' };
+
+export type ResolveImageDelivery = (
+  sessionId: string,
+  request: ImageDeliveryRequest,
+) => Promise<ImageDeliveryResult>;
+export type ReadAttachmentBytes = (
+  sessionId: string,
+  artifactId: string,
+) => Promise<ArtifactBinaryReadResult>;
+
+/** Narrow transcript image capabilities shared by the UI and desktop adapters. */
+export interface ChatImageServices {
+  readBytes: ReadAttachmentBytes;
+  resolveImageDelivery?: ResolveImageDelivery;
+}
 /** Stored with its Artifact, so session copy/export carries both provenance and bytes. */
 export interface ImageDeliveryMetadata {
   readonly messageId: string;
diff --git a/packages/ui/scripts/markdown-images.browser.test.mjs b/packages/ui/scripts/markdown-images.browser.test.mjs
index c16a930b8c3..61a45be9186 100644
--- a/packages/ui/scripts/markdown-images.browser.test.mjs
+++ b/packages/ui/scripts/markdown-images.browser.test.mjs
@@ -92,6 +92,9 @@ before(async () => {
   const destinations = {
     'links-formats': [
       `![Screenshot](${imageUrl}/image.png)`,
+      `![Title](${imageUrl}/title.png "Screenshot title")`,
+      `![Angle](<${imageUrl}/angle.png>)`,
+      '![Escaped](' + imageUrl + String.raw`/a\(1\).png)`,
       '![Reference][picture]',
       `[picture]: <${imageUrl}/reference.png>`,
       `Build ![Badge](${imageUrl}/badge.png) passing.`,
@@ -156,7 +159,7 @@ before(async () => {
       import {makaTheme} from './apps/desktop/src/renderer/astryx-theme/maka.js';
       import {Markdown} from './packages/ui/dist/markdown.js';
       import {LocaleProvider} from './packages/ui/dist/locale-context.js';
-      import {ImageDeliveryProvider} from './packages/ui/dist/image-delivery.js';
+      import {ImageDeliveryProvider, ImageMessageProvider} from './packages/ui/dist/image-delivery.js';
       import {SessionAttachmentProvider} from './packages/ui/dist/attachment-image.js';
       import './apps/desktop/src/renderer/styles.css';
       const mode=new URLSearchParams(location.search).get('case') || 'remote';
@@ -199,7 +202,8 @@ before(async () => {
         await new Promise(resolve=>setTimeout(resolve,100));
         return mode.endsWith('saving') && window.deliveryQueries===1 ? {status:'pending'} : {status:'ready',artifactId:mode.startsWith('layout-') ? request.source : 'saved-image'};
       };
-      const markdown=(streaming)=>React.createElement(Markdown,{text,streaming,settledText:race ? text : undefined,density:'compact',imageIdentity:{turnId:'turn',messageId},imageDisplay:mode.startsWith('links-') ? 'link' : undefined});
+      const markdown=(streaming)=>React.createElement(ImageMessageProvider,{identity:{turnId:'turn',messageId},streaming},
+        React.createElement(Markdown,{text,streaming,settledText:race ? text : undefined,density:'compact',imageDisplay:mode.startsWith('links-') ? 'link' : undefined}));
       const surface=(streaming)=>mode.startsWith('layout-') ? React.createElement('section',{className:mode==='layout-side' ? 'maka-quote-companion' : '',style:{width:mode==='layout-side' ? '360px' : '100%',maxWidth:'100%'}},
         React.createElement(ChatMessageList,{className:'maka-chat-message-list maka-chatContent',align:'top'},
           React.createElement('div',{className:'maka-transcript-turn maka-turn',style:{width:'100%',maxWidth:'var(--maka-reading-measure)',marginInline:'auto'}},
@@ -270,6 +274,9 @@ test('image links preserve Markdown destinations without loading image or attach
   try {
     await page.getByRole('link', {name:/^Screenshot/}).waitFor();
     assert.equal(await page.getByRole('link', {name:/^Screenshot/}).getAttribute('href'), `${imageUrl}/image.png`);
+    assert.equal(await page.getByRole('link', {name:/^Title/}).getAttribute('href'), `${imageUrl}/title.png`);
+    assert.equal(await page.getByRole('link', {name:/^Angle/}).getAttribute('href'), `${imageUrl}/angle.png`);
+    assert.equal(await page.getByRole('link', {name:/^Escaped/}).getAttribute('href'), `${imageUrl}/a(1).png`);
     assert.equal(await page.getByRole('link', {name:/^Reference/}).getAttribute('href'), `${imageUrl}/reference.png`);
     assert.equal(await page.getByRole('link', {name:/^Badge/}).getAttribute('href'), `${imageUrl}/badge.png`);
     assert.equal(await page.locator('a').filter({hasText:`${imageUrl}/empty.png`}).getAttribute('href'), `${imageUrl}/empty.png`);
diff --git a/packages/ui/src/__tests__/attachment-image.test.tsx b/packages/ui/src/__tests__/attachment-image.test.tsx
index ad59683d76c..e9e327ed901 100644
--- a/packages/ui/src/__tests__/attachment-image.test.tsx
+++ b/packages/ui/src/__tests__/attachment-image.test.tsx
@@ -30,7 +30,7 @@ import {
 import { LocaleProvider } from '../locale-context.js';
 import { MarkdownBody } from '../markdown-body.js';
 import { Markdown } from '../markdown.js';
-import { ImageDeliveryProvider } from '../image-delivery.js';
+import { ImageDeliveryProvider, ImageMessageProvider } from '../image-delivery.js';
 import type { TurnViewModel } from '../materialize.js';
 
 const originalGlobals = {
@@ -104,7 +104,9 @@ test('the complete Markdown entry resolves original signed and hashed destinatio
             assert.ok(sources.includes(request.source));
             return { status: 'ready', artifactId: `saved-${sources.indexOf(request.source)}` };
           }}>
-            <Markdown text={sources.map(source => `![Screenshot](${source})`).join('\n\n') + '\n\nAuthorization: Bearer prose-secret'} imageIdentity={{ turnId: 'turn-1', messageId: 'message-1' }} />
+            <ImageMessageProvider identity={{ turnId: 'turn-1', messageId: 'message-1' }}>
+              <Markdown text={sources.map(source => `![Screenshot](${source})`).join('\n\n') + '\n\nAuthorization: Bearer prose-secret'} />
+            </ImageMessageProvider>
           </ImageDeliveryProvider>
         </SessionAttachmentProvider>
       </LocaleProvider>,
diff --git a/packages/ui/src/__tests__/markdown-body.test.ts b/packages/ui/src/__tests__/markdown-body.test.ts
index 60082e79177..c8c9bc88b15 100644
--- a/packages/ui/src/__tests__/markdown-body.test.ts
+++ b/packages/ui/src/__tests__/markdown-body.test.ts
@@ -37,6 +37,21 @@ import {
   MAX_MERMAID_SOURCE_LENGTH,
 } from '../mermaid-diagram.js';
 
+it('image links use canonical destinations for titles, angle brackets and escaped parentheses', () => {
+  for (const [text, destination] of [
+    ['![Title](https://example.com/image.png "Screenshot title")', 'https://example.com/image.png'],
+    ['![Angle](<https://example.com/image.png>)', 'https://example.com/image.png'],
+    [String.raw`![Escaped](https://example.com/a\(1\).png)`, 'https://example.com/a(1).png'],
+  ]) {
+    const markup = renderToStaticMarkup(createElement(LocaleProvider, {
+      locale: 'en',
+      children: createElement(MarkdownBody, { text, imageDisplay: 'link' }),
+    }));
+    assert.ok(markup.includes(`href="${destination}"`), markup);
+    assert.doesNotMatch(markup, /<img\b|maka-markdown-image-resource|unsafe-scheme/);
+  }
+});
+
 it('keeps raw HTML inert instead of expanding the Markdown trust surface', () => {
   const markup = renderToStaticMarkup(createElement(MarkdownBody, {
     text: '<details open><summary>Click</summary>payload</details>',
diff --git a/packages/ui/src/attachment-image.tsx b/packages/ui/src/attachment-image.tsx
index 66511959f60..460966dbcad 100644
--- a/packages/ui/src/attachment-image.tsx
+++ b/packages/ui/src/attachment-image.tsx
@@ -26,14 +26,11 @@ import {
   useState,
   type ReactNode,
 } from 'react';
-import type { ArtifactBinaryReadResult } from '@maka/core/artifacts';
+import type { ReadAttachmentBytes } from '@maka/core/image-delivery';
 import { decideImageReadOutcome } from './artifact-preview-registry.js';
 
 /** Host capability for reading bytes from the Runtime Host attachment authority. */
-export type ReadAttachmentBytes = (
-  sessionId: string,
-  artifactId: string,
-) => Promise<ArtifactBinaryReadResult>;
+export type { ReadAttachmentBytes } from '@maka/core/image-delivery';
 
 type SessionAttachmentContextValue = {
   sessionId: string;
diff --git a/packages/ui/src/chat-turn.tsx b/packages/ui/src/chat-turn.tsx
index fad32b96900..6dc5ee2ec4b 100644
--- a/packages/ui/src/chat-turn.tsx
+++ b/packages/ui/src/chat-turn.tsx
@@ -23,7 +23,8 @@ import { useClipboardCopyFeedback } from './clipboard-feedback.js';
 import { Markdown } from './markdown.js';
 import { formatTurnDuration } from './chat-display-helpers.js';
 import { formatAbsoluteTimestamp } from '@maka/core/relative-time';
-import { isTimeDrivenMotionEnabled } from './streaming-presentation.js';
+import { isTimeDrivenMotionEnabled, isProgressiveStreamingEnabled } from './streaming-presentation.js';
+import { ImageMessageProvider } from './image-delivery.js';
 import { computerRunningLabel } from './tool-activity/computer-action-label.js';
 import {
   Badge,
@@ -1347,24 +1348,25 @@ const AssistantAnswerBubble = memo(function AssistantAnswerBubble(props: Assista
           : 'maka-chat-message-bubble maka-chat-message-bubble-assistant maka-bubble-streaming'
       }
     >
-      <Markdown
-        text={props.text}
-        imageIdentity={props.imageIdentity}
-        imageDisplay={props.imageDisplay}
-        streaming={props.phase === 'streaming'}
-        settledText={settledText}
-        // Names the surface, and not exclusively: the desktop Artifact
-        // Preview asks for compact too and takes the same rules, so retuning
-        // them here is retuning them there. What this prop does NOT do is set
-        // this turn's block spacing. Every top-level gap in a transcript turn
-        // comes from the rhythm table in styles.css, which keys on the
-        // `data-density="compact"` this prop reflects and overrides Astryx's
-        // own margins outright. So `compact` still buys the transcript
-        // heading scale and the tighter rhythm inside a list item or a quote,
-        // and reading it as "paragraphs are squeezed here" is the wrong
-        // file — retune `--md-gap-block` instead.
-        density="compact"
-      />
+      <ImageMessageProvider identity={props.imageIdentity} streaming={isProgressiveStreamingEnabled(props.phase === 'streaming')}>
+        <Markdown
+          text={props.text}
+          imageDisplay={props.imageDisplay}
+          streaming={props.phase === 'streaming'}
+          settledText={settledText}
+          // Names the surface, and not exclusively: the desktop Artifact
+          // Preview asks for compact too and takes the same rules, so retuning
+          // them here is retuning them there. What this prop does NOT do is set
+          // this turn's block spacing. Every top-level gap in a transcript turn
+          // comes from the rhythm table in styles.css, which keys on the
+          // `data-density="compact"` this prop reflects and overrides Astryx's
+          // own margins outright. So `compact` still buys the transcript
+          // heading scale and the tighter rhythm inside a list item or a quote,
+          // and reading it as "paragraphs are squeezed here" is the wrong
+          // file — retune `--md-gap-block` instead.
+          density="compact"
+        />
+      </ImageMessageProvider>
       {truncated && (
         <Tooltip content={copy.outputTruncatedTitle}>
           {/* Colour-name archive, not the semantic one: Astryx paints
diff --git a/packages/ui/src/chat-view.tsx b/packages/ui/src/chat-view.tsx
index 3a3f0725721..e52d2084da3 100644
--- a/packages/ui/src/chat-view.tsx
+++ b/packages/ui/src/chat-view.tsx
@@ -295,7 +295,7 @@ export function ChatView(props: {
    * host-agnostic with no direct host-global access.
    */
   onReadAttachmentBytes?: ReadAttachmentBytes;
-  onResolveImageDelivery?: import('./image-delivery.js').ResolveImageDelivery;
+  onResolveImageDelivery?: import('@maka/core/image-delivery').ResolveImageDelivery;
   /**
    * Open a linked subagent child session in the main chat column (option A).
    * Threaded into linked subagent rows inside ToolTrow.
diff --git a/packages/ui/src/image-delivery.tsx b/packages/ui/src/image-delivery.tsx
index b2fd1c0a76c..388677b6587 100644
--- a/packages/ui/src/image-delivery.tsx
+++ b/packages/ui/src/image-delivery.tsx
@@ -18,10 +18,21 @@
  */
 
 import { createContext, useCallback, useContext, useEffect, useMemo, useState, type ReactNode } from 'react';
-import type { ImageDeliveryRequest, ImageDeliveryResult } from '@maka/core/image-delivery';
+import type { ImageDeliveryRequest, ImageDeliveryResult, ResolveImageDelivery } from '@maka/core/image-delivery';
 import { isRemoteImageSource } from '@maka/core/image-delivery';
-export type ResolveImageDelivery = (sessionId: string, request: ImageDeliveryRequest) => Promise<ImageDeliveryResult>;
-export const ImageMessageScope = createContext<{ turnId: string; messageId: string; streaming?: boolean } | undefined>(undefined);
+export type { ResolveImageDelivery } from '@maka/core/image-delivery';
+const ImageMessageScope = createContext<{ turnId: string; messageId: string; streaming?: boolean } | undefined>(undefined);
+/** Installed by assistant messages, outside the generic Markdown renderer. */
+export function ImageMessageProvider(props: {
+  identity?: { turnId: string; messageId: string };
+  streaming?: boolean;
+  children: ReactNode;
+}) {
+  const value = useMemo(() => props.identity
+    ? { turnId: props.identity.turnId, messageId: props.identity.messageId, streaming: props.streaming }
+    : undefined, [props.identity?.turnId, props.identity?.messageId, props.streaming]);
+  return <ImageMessageScope.Provider value={value}>{props.children}</ImageMessageScope.Provider>;
+}
 const DeliveryContext = createContext<{ resolve(request: ImageDeliveryRequest): Promise<ImageDeliveryResult> } | undefined>(undefined);
 export function ImageDeliveryProvider(props: { sessionId: string; resolve?: ResolveImageDelivery; children: ReactNode }) {
   const value = useMemo(() => {
diff --git a/packages/ui/src/markdown-body.tsx b/packages/ui/src/markdown-body.tsx
index 553c3369f40..c0670d2dbc8 100644
--- a/packages/ui/src/markdown-body.tsx
+++ b/packages/ui/src/markdown-body.tsx
@@ -29,13 +29,9 @@
  * product-specific trust boundaries around that renderer.
  */
 
-import { MarkdownImage, MarkdownImageSourceProvider, MARKDOWN_IMAGE_PLUGINS } from './markdown-image.js';
-import { ImageMessageScope } from './image-delivery.js';
-import { createMarkdownPlugin } from '@astryxdesign/core/Markdown/plugins';
-import type { MarkdownAstNode, MarkdownAstRoot } from '@astryxdesign/core/Markdown';
+import { MarkdownImage, createMarkdownImagePlugins } from './markdown-image.js';
 import { useCallback, useContext, useMemo, useRef, type ReactNode } from 'react';
 import { redactMarkdownImages } from './markdown-image-redaction.js';
-import { redactSecrets } from './redact.js';
 import {
   Markdown as AstryxMarkdown,
   type MarkdownComponents,
@@ -150,7 +146,6 @@ export function MarkdownBody(props: {
   text: string;
   /** The lazy entry redacts its fallback; the body also preserves image identities. */
   redact?: boolean;
-  imageIdentity?: { turnId: string; messageId: string };
   imageDisplay?: 'image' | 'link';
   streaming?: boolean;
   settledText?: string;
@@ -165,26 +160,8 @@ export function MarkdownBody(props: {
     ? redactMarkdownImages(props.text, props.settledText)
     : { text: props.text, settledText: props.settledText, sources: undefined },
   [props.redact, props.text, props.settledText]);
-  const plugins = useMemo(() => props.imageDisplay === 'link' ? [createMarkdownPlugin({
-    name: 'maka-image-links', apiVersion: 1,
-    transform(document) {
-      // Use parsed nodes so references and code examples retain their semantics.
-      // No image component mounts in this mode, so display cannot load bytes.
-      const rewrite = (node: MarkdownAstNode, insideLink = false, phrasing = false): MarkdownAstNode => {
-        if (node.type === 'image') {
-          const source = presentation.sources?.get(node.url) ?? node.url;
-          const text = { type: 'text' as const, value: node.alt || redactSecrets(source) };
-          const link = insideLink || source !== redactSecrets(source) ? text
-            : { type: 'link' as const, url: source, children: [text] };
-          return phrasing ? link : { type: 'paragraph', children: [link] };
-        }
-        if (!('children' in node)) return node;
-        const childPhrasing = ['paragraph', 'heading', 'tableCell', 'link', 'strong', 'emphasis', 'delete'].includes(node.type);
-        return { ...node, children: node.children.map(child => rewrite(child, insideLink || node.type === 'link', childPhrasing)) } as MarkdownAstNode;
-      };
-      return rewrite(document) as MarkdownAstRoot;
-    },
-  })] : MARKDOWN_IMAGE_PLUGINS, [props.imageDisplay, presentation.sources]);
+  const plugins = useMemo(() => createMarkdownImagePlugins(props.imageDisplay, presentation.sources),
+    [props.imageDisplay, presentation.sources]);
   const budgetedText = props.streaming ? presentation.text : applyMermaidRenderBudget(presentation.text);
   const density = props.density ?? 'default';
   const components = props.streaming
@@ -194,51 +171,47 @@ export function MarkdownBody(props: {
     : MARKDOWN_COMPONENTS[density];
 
   return (
-    <MarkdownImageSourceProvider text={budgetedText} sources={presentation.sources}>
-      <ImageMessageScope.Provider value={props.imageIdentity ? { ...props.imageIdentity, streaming: props.streaming } : undefined}>
-        <div
-          data-maka-contract="markdown"
-          data-maka-script={hasHanProse(props.text) ? 'han' : undefined}
-          // Migration-only identity wrapper. `display: contents` gives the
-          // contract harness a stable declared subtree without adding a layout
-          // box or interfering with Astryx's document root.
-          style={{ display: 'contents' }}
-        >
-          <AstryxMarkdown
-            autolink="gfm"
-            // Markdown holds no reading measure; the container it lands in does.
-            //
-            // Astryx caps prose at 680px by default but renders a supplied
-            // `components.code` bare — no spacing, no width, no alignment. Maka
-            // always supplies one, so any container that leans on the default gets
-            // prose at 680 and code blocks at whatever the container is: two right
-            // edges, which is the defect this whole change exists to remove. One
-            // authority per column, and it is the container.
-            contentWidth="100%"
-            // Chosen by the caller, and defaulting to document rhythm.
-            //
-            // The transcript passes `compact`: Astryx's default heading spacing
-            // assumes a page with a handful of sections, while an agent turn
-            // emits headings every few lines, so the default margins push each
-            // one into its own visual slab. That is the same argument that
-            // flattens transcript heading SIZES in styles/chat-message.css — and
-            // that rule is scoped to `.maka-turn` precisely because the other
-            // caller, the Daily Review panel, renders a report, which is a
-            // document. Hardcoding `compact` here contradicted that scoping: the
-            // review kept full heading sizes but got transcript block spacing,
-            // the one combination neither half of the argument asks for.
-            density={density}
-            components={components}
-            plugins={plugins}
-            isStreaming={props.streaming}
-            settledText={presentation.settledText}
-            transformSource={transformMathSource}
-          >
-            {budgetedText}
-          </AstryxMarkdown>
-        </div>
-      </ImageMessageScope.Provider>
-    </MarkdownImageSourceProvider>
+    <div
+      data-maka-contract="markdown"
+      data-maka-script={hasHanProse(props.text) ? 'han' : undefined}
+      // Migration-only identity wrapper. `display: contents` gives the
+      // contract harness a stable declared subtree without adding a layout
+      // box or interfering with Astryx's document root.
+      style={{ display: 'contents' }}
+    >
+      <AstryxMarkdown
+        autolink="gfm"
+        // Markdown holds no reading measure; the container it lands in does.
+        //
+        // Astryx caps prose at 680px by default but renders a supplied
+        // `components.code` bare — no spacing, no width, no alignment. Maka
+        // always supplies one, so any container that leans on the default gets
+        // prose at 680 and code blocks at whatever the container is: two right
+        // edges, which is the defect this whole change exists to remove. One
+        // authority per column, and it is the container.
+        contentWidth="100%"
+        // Chosen by the caller, and defaulting to document rhythm.
+        //
+        // The transcript passes `compact`: Astryx's default heading spacing
+        // assumes a page with a handful of sections, while an agent turn
+        // emits headings every few lines, so the default margins push each
+        // one into its own visual slab. That is the same argument that
+        // flattens transcript heading SIZES in styles/chat-message.css — and
+        // that rule is scoped to `.maka-turn` precisely because the other
+        // caller, the Daily Review panel, renders a report, which is a
+        // document. Hardcoding `compact` here contradicted that scoping: the
+        // review kept full heading sizes but got transcript block spacing,
+        // the one combination neither half of the argument asks for.
+        density={density}
+        components={components}
+        plugins={plugins}
+        isStreaming={props.streaming}
+        settledText={presentation.settledText}
+        transformSource={transformMathSource}
+      >
+        {budgetedText}
+      </AstryxMarkdown>
+    </div>
   );
 }
 
diff --git a/packages/ui/src/markdown-image.tsx b/packages/ui/src/markdown-image.tsx
index fdba5971dd2..bee94ba1655 100644
--- a/packages/ui/src/markdown-image.tsx
+++ b/packages/ui/src/markdown-image.tsx
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-import { createContext, useContext, useEffect, useMemo, useRef, useState, type ReactNode } from 'react';
+import { useEffect, useRef, useState } from 'react';
 import { Button, IconButton, Spinner, Tooltip, useLightbox } from '@astryxdesign/core';
 import { createMarkdownPlugin, type MarkdownExtensionNode } from '@astryxdesign/core/Markdown/plugins';
 import type { MarkdownAstNode, MarkdownAstRoot } from '@astryxdesign/core/Markdown';
@@ -29,36 +29,49 @@ import { useUiLocale } from './locale-context.js';
 import { createMarkdownImageSourceResolver } from './markdown-image-source.js';
 import { redactSecrets } from './redact.js';
 
-const ImageSourceContext = createContext<(source: string) => { source: string; redacted: boolean }>(
-  (source) => ({ source, redacted: false }),
-);
-
-type PlacedImage = MarkdownExtensionNode<'maka-images', 'image', { src: string; alt: string; inline: boolean }>;
+type PlacedImage = MarkdownExtensionNode<'maka-images', 'image', { src: string; alt: string; inline: boolean; redacted: boolean }>;
 // Placement comes from Markdown structure before bytes arrive. Never change a
 // message's geometry in response to network/decode timing or archive resolution.
-export const MARKDOWN_IMAGE_PLUGINS = [createMarkdownPlugin<'maka-images', PlacedImage>({
-  name: 'maka-images', apiVersion: 1,
-  transform(document, context) {
-    if (!context.source.includes('![')) return document;
-    const rewrite = (node: MarkdownAstNode, inline = false, phrasing = false): MarkdownAstNode => {
-      if (node.type === 'image') return {
-        type: 'extension', plugin: 'maka-images', name: 'image',
-        display: phrasing ? 'inline' : 'block',
-        data: { src: node.url, alt: node.alt, inline },
-      } satisfies PlacedImage;
-      if (!('children' in node)) return node;
-      const childInline = node.type === 'paragraph' ? !isSingleImage(node.children)
-        : node.type === 'heading' || node.type === 'tableCell' ? true : inline;
-      const childPhrasing = ['paragraph', 'heading', 'tableCell', 'link', 'strong', 'emphasis', 'delete'].includes(node.type);
-      return { ...node, children: node.children.map(child => rewrite(child, childInline, childPhrasing)) } as MarkdownAstNode;
-    };
-    return rewrite(document) as MarkdownAstRoot<MarkdownExtensionNode>;
-  },
-  renderers: { image: {
-    render: ({ node }) => <MarkdownImage {...node.data} />,
-    toText: node => node.data.alt,
-  } },
-})];
+export function createMarkdownImagePlugins(
+  display: 'image' | 'link' = 'image',
+  sources?: ReadonlyMap<string, string>,
+) {
+  return [createMarkdownPlugin<'maka-images', PlacedImage>({
+    name: 'maka-images', apiVersion: 1,
+    transform(document, context) {
+      if (!context.source.includes('![')) return document;
+      const canonical = createMarkdownImageSourceResolver(context.source);
+      const rewrite = (node: MarkdownAstNode, inline = false, phrasing = false, insideLink = false): MarkdownAstNode => {
+        if (node.type === 'image') {
+          const destination = canonical(node.url);
+          const source = sources?.get(destination) ?? destination;
+          const redacted = source !== redactSecrets(source);
+          if (display === 'link') {
+            const text = { type: 'text' as const, value: node.alt || redactSecrets(source) };
+            const link = insideLink || redacted ? text
+              : { type: 'link' as const, url: source, children: [text] };
+            return phrasing ? link : { type: 'paragraph', children: [link] };
+          }
+          return {
+            type: 'extension', plugin: 'maka-images', name: 'image',
+            display: phrasing ? 'inline' : 'block',
+            data: { src: source, alt: node.alt, inline, redacted: sources?.has(destination) === true && redacted },
+          } satisfies PlacedImage;
+        }
+        if (!('children' in node)) return node;
+        const childInline = node.type === 'paragraph' ? !isSingleImage(node.children)
+          : node.type === 'heading' || node.type === 'tableCell' ? true : inline;
+        const childPhrasing = ['paragraph', 'heading', 'tableCell', 'link', 'strong', 'emphasis', 'delete'].includes(node.type);
+        return { ...node, children: node.children.map(child => rewrite(child, childInline, childPhrasing, insideLink || node.type === 'link')) } as MarkdownAstNode;
+      };
+      return rewrite(document) as MarkdownAstRoot<MarkdownExtensionNode>;
+    },
+    renderers: { image: {
+      render: ({ node }) => <MarkdownImage {...node.data} />,
+      toText: node => node.data.alt,
+    } },
+  })];
+}
 
 function isSingleImage(nodes: readonly MarkdownAstNode[]): boolean {
   const meaningful = nodes.filter(node => node.type !== 'text' || node.value.trim());
@@ -67,22 +80,9 @@ function isSingleImage(nodes: readonly MarkdownAstNode[]): boolean {
   return node.type === 'image' || (['link', 'strong', 'emphasis', 'delete'].includes(node.type)
     && 'children' in node && isSingleImage(node.children));
 }
-export function MarkdownImageSourceProvider(props: { text: string; sources?: ReadonlyMap<string, string>; children: ReactNode }) {
-  const resolve = useMemo(() => {
-    const canonical = createMarkdownImageSourceResolver(props.text);
-    return (source: string) => {
-      const resolved = canonical(source);
-      const original = props.sources?.get(resolved) ?? resolved;
-      return { source: original, redacted: props.sources?.has(resolved) === true && original !== redactSecrets(original) };
-    };
-  }, [props.text, props.sources]);
-  return <ImageSourceContext.Provider value={resolve}>{props.children}</ImageSourceContext.Provider>;
-}
-
 /** Presentation only: Host resolves local addresses and archives; UI receives artifact identities. */
-export function MarkdownImage(props: { src: string; alt: string; inline?: boolean }) {
-  const { source, redacted } = useContext(ImageSourceContext)(props.src);
-  return <ImageResource key={source} src={source} redacted={redacted} alt={props.alt} inline={props.inline} />;
+export function MarkdownImage(props: { src: string; alt: string; inline?: boolean; redacted?: boolean }) {
+  return <ImageResource key={props.src} {...props} redacted={props.redacted === true} />;
 }
 function ImageResource(props: { src: string; redacted: boolean; alt: string; inline?: boolean }) {
   const copy = getSharedUiCopy(useUiLocale()).markdown;
diff --git a/packages/ui/src/markdown.tsx b/packages/ui/src/markdown.tsx
index 22058909518..79ad4f977d3 100644
--- a/packages/ui/src/markdown.tsx
+++ b/packages/ui/src/markdown.tsx
@@ -57,7 +57,6 @@ const MarkdownBody = lazy(() => import('./markdown-body.js').then((m) => ({ defa
 
 export function Markdown(props: {
   text: string;
-  imageIdentity?: { turnId: string; messageId: string };
   imageDisplay?: 'image' | 'link';
   streaming?: boolean;
   settledText?: string;
@@ -80,7 +79,6 @@ export function Markdown(props: {
       <MarkdownBody
         text={props.text}
         redact
-        imageIdentity={props.imageIdentity}
         imageDisplay={props.imageDisplay}
         streaming={streaming}
         settledText={props.settledText}

From c19d60ecb72f7cce0eb90ff56e65049aff263fb1 Mon Sep 17 00:00:00 2001
From: Sun-GLiang <81428141+Sun-GLiang@users.noreply.github.com>
Date: Sat, 10 Oct 2026 17:16:25 +0800
Subject: [PATCH 35/37] fix(ui): size markdown image previews to natural
 dimensions

---
 .../scripts/markdown-images.browser.test.mjs  | 79 +++++++++++++++----
 packages/ui/src/markdown-image.tsx            | 11 ++-
 packages/ui/src/styles.css                    | 52 ++++++------
 3 files changed, 90 insertions(+), 52 deletions(-)

diff --git a/packages/ui/scripts/markdown-images.browser.test.mjs b/packages/ui/scripts/markdown-images.browser.test.mjs
index 61a45be9186..a23780ce4bd 100644
--- a/packages/ui/scripts/markdown-images.browser.test.mjs
+++ b/packages/ui/scripts/markdown-images.browser.test.mjs
@@ -33,6 +33,10 @@ import { chromium } from '@playwright/test';
 const root = fileURLToPath(new URL('../../../', import.meta.url));
 const png = Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8DwHwAFBQIAX8jx0gAAAABJRU5ErkJggg==', 'base64');
 const badge = Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAFAAAAAUCAYAAAAa2LrXAAAATklEQVR4nO3OsQ0AIAzAsJ7O5/QIhsgSg3fPnLnfgzygywO6PKDLA7o8oMsDujygywO6PKDLA7o8oMsDujygywO6PKDLA7o8oMsDujyAW5KWWkgoVkkSAAAAAElFTkSuQmCC', 'base64');
+const dimensions = [
+  ['small', 80, 20], ['square', 1000, 1000], ['landscape', 1600, 900],
+  ['portrait', 900, 1600], ['panorama', 2000, 100], ['tall', 100, 2000], ['pixel', 1, 1],
+];
 let appServer, imageServer, browser, appUrl, imageUrl;
 let requests = [], failedOnce = false;
 let releaseImage;
@@ -41,8 +45,7 @@ const delayedImage = new Promise(resolve => { releaseImage = resolve; });
 const delayedAttachment = new Promise(resolve => { releaseAttachment = resolve; });
 
 // Keep the screenshot's original dimensions without committing evidence images.
-function screenshotFixture() {
-  const width = 900, height = 730;
+function screenshotFixture(width = 900, height = 730) {
   const header = Buffer.alloc(13);
   header.writeUInt32BE(width, 0); header.writeUInt32BE(height, 4);
   header[8] = 8; header[9] = 2; // 8-bit RGB.
@@ -67,8 +70,12 @@ function screenshotFixture() {
 
 before(async () => {
   const screenshot = screenshotFixture();
+  const sizedImages = new Map(dimensions.map(([name, width, height]) => [`/${name}.png`, screenshotFixture(width, height)]));
   imageServer = createServer((req, res) => {
     requests.push({ path: req.url, referer: req.headers.referer });
+    if (sizedImages.has(req.url)) {
+      res.setHeader('Content-Type', 'image/png'); res.end(sizedImages.get(req.url)); return;
+    }
     if (req.url === '/delayed.png') {
       void delayedImage.then(() => { res.setHeader('Content-Type', 'image/png'); res.end(screenshot); });
       return;
@@ -90,6 +97,7 @@ before(async () => {
   await new Promise(resolve => imageServer.listen(0, '127.0.0.1', resolve));
   imageUrl = `http://127.0.0.1:${imageServer.address().port}`;
   const destinations = {
+    ...Object.fromEntries(dimensions.map(([name]) => [`size-${name}`, `![Screenshot](${imageUrl}/${name}.png)`])),
     'links-formats': [
       `![Screenshot](${imageUrl}/image.png)`,
       `![Title](${imageUrl}/title.png "Screenshot title")`,
@@ -110,8 +118,8 @@ before(async () => {
     'badge-list': `- Build ![Badge](${imageUrl}/badge.png) passing.`,
     'badge-table': `| Build | Result |\n| --- | --- |\n| ![Badge](${imageUrl}/badge.png) | passing |`,
     'badge-strip': `![Badge](${imageUrl}/badge.png) ![Badge](${imageUrl}/badge.png)`,
-    'layout-main': `## Image delivery\n\nBuild ![Badge](${imageUrl}/badge.png) passing.\n\n![Screenshot](${imageUrl}/screenshot.png)\n\nFollowing paragraph stays in place.`,
-    'layout-side': `## Image delivery\n\nBuild ![Badge](${imageUrl}/badge.png) passing.\n\n![Screenshot](${imageUrl}/screenshot.png)\n\nFollowing paragraph stays in place.`,
+    'layout-main': `## Image delivery\n\nBuild ![Badge](${imageUrl}/badge.png) passing.\n\n![Screenshot](${imageUrl}/screenshot.png)\n\nFollowing paragraph.`,
+    'layout-side': `## Image delivery\n\nBuild ![Badge](${imageUrl}/badge.png) passing.\n\n![Screenshot](${imageUrl}/screenshot.png)\n\nFollowing paragraph.`,
     'screenshot-saved': '![Screenshot](/tmp/screenshot.png)',
     'angle-saved': '![Screenshot](</tmp/my image.png>)',
     'title-saved': `![Screenshot](${imageUrl}/image.png "Screenshot title")`,
@@ -623,7 +631,7 @@ for (const scenario of ['angle-saved', 'title-saved', 'escaped-saved', 'referenc
 }
 
 for (const scenario of ['geometry-remote', 'geometry-saved']) {
-  test(`${scenario}: loading and ready images preserve the position of subsequent content`, async () => {
+  test(`${scenario}: a compact placeholder expands to the decoded image's natural proportions`, async () => {
     const page = await pageFor(scenario);
     try {
       await page.getByText('Loading image…', { exact: true }).waitFor();
@@ -632,7 +640,10 @@ for (const scenario of ['geometry-remote', 'geometry-saved']) {
       await page.waitForFunction(() => [...document.images].some(image => image.naturalWidth > 1));
       await page.getByText('Loading image…', { exact: true }).waitFor({ state: 'hidden' });
       const after = await page.getByText('Following paragraph', { exact: true }).boundingBox();
-      assert.equal(after.y, before.y);
+      assert.ok(after.y > before.y);
+      const block = await page.locator('.maka-markdown-image-block').boundingBox();
+      const image = await page.locator('.maka-markdown-image-preview img').boundingBox();
+      assert.ok(Math.abs(block.width - image.width) < 1 && Math.abs(block.height - image.height) < 1);
     } finally {
       if (scenario === 'geometry-remote') releaseImage(); else releaseAttachment();
       await page.close();
@@ -640,14 +651,14 @@ for (const scenario of ['geometry-remote', 'geometry-saved']) {
   });
 }
 
-test('image frames fit narrow viewports without distorting screenshots or limiting the enlarged preview', async () => {
+test('natural image containers fit narrow viewports without distorting screenshots or limiting the enlarged preview', async () => {
   const page = await pageFor('screenshot');
   try {
     await page.waitForFunction(() => [...document.images].some(image => image.naturalWidth > 1));
     for (const width of [720, 360]) {
       await page.setViewportSize({ width, height: 600 });
       const geometry = await page.locator('.maka-markdown-image-preview img').evaluate(image => {
-        const frame = image.closest('.maka-markdown-image-frame').getBoundingClientRect();
+        const frame = image.closest('.maka-markdown-image-block').getBoundingClientRect();
         const box = image.getBoundingClientRect();
         return { frame: { x: frame.x, y: frame.y, right: frame.right, bottom: frame.bottom },
           box: { x: box.x, y: box.y, right: box.right, bottom: box.bottom, width: box.width, height: box.height },
@@ -662,12 +673,42 @@ test('image frames fit narrow viewports without distorting screenshots or limiti
     await page.waitForFunction(() => document.images.length > 1);
     assert.equal(await page.locator('.maka-markdown-image-preview img').count(), 1);
     const dialog = await page.getByRole('dialog').boundingBox();
-    const frame = await page.locator('.maka-markdown-image-frame').boundingBox();
+    const frame = await page.locator('.maka-markdown-image-block').boundingBox();
     assert.ok(dialog.height > frame.height);
     assert.equal(await page.getByRole('dialog').locator('img').getAttribute('src'), await page.locator('.maka-markdown-image-preview img').getAttribute('src'));
   } finally { await page.close(); }
 });
 
+for (const [name, naturalWidth, naturalHeight] of dimensions) {
+  test(`${name}: body images shrink proportionally without upscaling or empty frames`, async () => {
+    const page = await pageFor(`size-${name}`);
+    try {
+      await page.waitForFunction(() => [...document.images].some(image => image.complete && image.naturalWidth > 0));
+      for (const [width, height] of [[1280, 900], [320, 600]]) {
+        await page.setViewportSize({ width, height });
+        const geometry = await page.locator('.maka-markdown-image-preview img').evaluate(image => {
+          const block = image.closest('.maka-markdown-image-block');
+          const column = block.parentElement;
+          const style = getComputedStyle(column);
+          const availableWidth = column.clientWidth - parseFloat(style.paddingLeft) - parseFloat(style.paddingRight);
+          const box = image.getBoundingClientRect();
+          const container = block.getBoundingClientRect();
+          return { width: box.width, height: box.height, right: box.right, availableWidth,
+            containerWidth: container.width, containerHeight: container.height };
+        });
+        const scale = Math.min(1, 640 / naturalWidth, geometry.availableWidth / naturalWidth,
+          Math.min(480, height * 0.6) / naturalHeight);
+        assert.ok(Math.abs(geometry.width - naturalWidth * scale) < 1, JSON.stringify(geometry));
+        assert.ok(Math.abs(geometry.height - naturalHeight * scale) < 1, JSON.stringify(geometry));
+        assert.ok(Math.abs(geometry.containerWidth - geometry.width) < 1, JSON.stringify(geometry));
+        assert.ok(Math.abs(geometry.containerHeight - geometry.height) < 1, JSON.stringify(geometry));
+        assert.ok(geometry.right <= width);
+        assert.equal(await page.evaluate(() => document.documentElement.scrollWidth > innerWidth), false);
+      }
+    } finally { await page.close(); }
+  });
+}
+
 for (const scenario of ['badge-remote', 'badge-saved', 'badge-saving']) {
   test(`${scenario}: a badge keeps its intrinsic size and surrounding text on one line`, async () => {
     requests = [];
@@ -737,7 +778,7 @@ for (const scenario of ['badge-list', 'badge-table', 'badge-strip']) {
     try {
       await page.goto(`${appUrl}/?case=${scenario}`, { waitUntil: 'domcontentloaded' });
       await page.locator('.maka-markdown-image-inline').first().waitFor();
-      assert.equal(await page.locator('.maka-markdown-image-frame').count(), 0);
+      assert.equal(await page.locator('.maka-markdown-image-block').count(), 0);
       const before = await page.locator('.maka-markdown-image-resource').first().boundingBox();
       assert.ok(before.width <= 120 && before.height <= 32);
       release();
@@ -751,7 +792,7 @@ for (const [scenario, width, height] of [
   ['layout-main', 1280, 900], ['layout-main', 480, 700],
   ['layout-side', 720, 700], ['layout-side', 320, 600],
 ]) {
-  test(`${scenario} ${width}x${height}: production chat columns preserve image geometry through loading`, async () => {
+  test(`${scenario} ${width}x${height}: production chat columns fit natural image dimensions`, async () => {
     const page = await browser.newPage({ viewport: { width, height } });
     page.setDefaultTimeout(5000);
     let release;
@@ -764,12 +805,11 @@ for (const [scenario, width, height] of [
     try {
       await page.goto(`${appUrl}/?case=${scenario}`, { waitUntil: 'domcontentloaded' });
       await page.waitForFunction(() => document.querySelectorAll('.maka-markdown-image-resource').length === 2);
-      await page.getByText('Following paragraph stays in place.').waitFor();
+      await page.getByText('Following paragraph.').waitFor();
       const before = await measure();
-      const followingBefore = await page.getByText('Following paragraph stays in place.').boundingBox();
       assert.equal(before.length, 2);
       assert.ok(before[0].width <= 120 && before[0].height <= 32);
-      assert.ok(before[1].width <= 800 && before[1].height <= Math.min(480, height * 0.6));
+      assert.ok(before[1].width <= 640 && before[1].height < 100);
       for (const box of before) assert.ok(box.x >= 0 && box.x + box.width <= width);
       const evidence = process.env.MAKA_IMAGE_LAYOUT_EVIDENCE_DIR;
       if (evidence) {
@@ -778,12 +818,17 @@ for (const [scenario, width, height] of [
       }
       release();
       await page.waitForFunction(() => document.images.length === 2 && [...document.images].every(image => image.complete && image.naturalWidth > 0));
-      assert.deepEqual(await measure(), before);
-      assert.deepEqual(await page.getByText('Following paragraph stays in place.').boundingBox(), followingBefore);
+      const ready = await measure();
+      assert.deepEqual(ready[0], before[0]);
+      const image = await page.locator('.maka-markdown-image-block img').boundingBox();
+      assert.ok(ready[1].width <= 640 && ready[1].height <= Math.min(480, height * 0.6));
+      assert.ok(Math.abs(ready[1].width - image.width) < 1 && Math.abs(ready[1].height - image.height) < 1);
+      assert.ok(Math.abs(image.width / image.height - 900 / 730) < 0.01);
+      assert.ok((await page.getByText('Following paragraph.').boundingBox()).y >= image.y + image.height);
       assert.equal(await page.evaluate(() => document.documentElement.scrollWidth > innerWidth), false);
       if (evidence) {
         await page.screenshot({ path: join(evidence, `${scenario}-${width}-ready.png`), fullPage: true });
-        console.log(JSON.stringify({ scenario, viewport: { width, height }, images: before, layoutShift: 0 }));
+        console.log(JSON.stringify({ scenario, viewport: { width, height }, loading: before, ready }));
       }
     } finally { release(); await page.close(); }
   });
diff --git a/packages/ui/src/markdown-image.tsx b/packages/ui/src/markdown-image.tsx
index bee94ba1655..9d34b90f431 100644
--- a/packages/ui/src/markdown-image.tsx
+++ b/packages/ui/src/markdown-image.tsx
@@ -30,8 +30,8 @@ import { createMarkdownImageSourceResolver } from './markdown-image-source.js';
 import { redactSecrets } from './redact.js';
 
 type PlacedImage = MarkdownExtensionNode<'maka-images', 'image', { src: string; alt: string; inline: boolean; redacted: boolean }>;
-// Placement comes from Markdown structure before bytes arrive. Never change a
-// message's geometry in response to network/decode timing or archive resolution.
+// Markdown structure determines inline/block placement; decoded images supply
+// their natural dimensions within the presentation's CSS bounds.
 export function createMarkdownImagePlugins(
   display: 'image' | 'link' = 'image',
   sources?: ReadonlyMap<string, string>,
@@ -105,12 +105,11 @@ function ImageResource(props: { src: string; redacted: boolean; alt: string; inl
       redacted: copy.imageRemoteRedacted,
       unsupported: copy.imageUnsupported,
     }[state.reason] : undefined;
-  const hasFrame = props.inline || resource.framed;
   const actions = <span className="maka-markdown-image-actions">
     {resource.retry && <Button variant="ghost" size="sm" label={copy.imageRetry} onClick={resource.retry} />}
     {resource.openSource && <Link href={resource.openSource} isExternalLink type="inherit" hasUnderline>{copy.imageOpen}</Link>}
   </span>;
-  return <span ref={anchor} className={`maka-markdown-image-resource${hasFrame ? props.inline ? ' maka-markdown-image-inline' : ' maka-markdown-image-frame' : ''}`}
+  return <span ref={anchor} className={`maka-markdown-image-resource ${props.inline ? 'maka-markdown-image-inline' : 'maka-markdown-image-block'}`}
     data-maka-image-state={state.kind === 'failed' ? 'failed' : state.kind === 'ready' ? 'ready' : 'loading'}>
     {message && props.inline ? <Tooltip content={message}>
       <span className="maka-markdown-image-placeholder" role="status" aria-label={message}>
@@ -121,7 +120,7 @@ function ImageResource(props: { src: string; redacted: boolean; alt: string; inl
       </span>
     </Tooltip> : message ? <span className="maka-markdown-image-placeholder">
       {props.alt && <span className="maka-markdown-image-caption">{props.alt}</span>}
-      <span role="status">{hasFrame && state.kind === 'loading' && <Spinner size="sm" shade="subtle" aria-hidden="true" />} {message}</span>
+      <span role="status">{state.kind === 'loading' && <Spinner size="sm" shade="subtle" aria-hidden="true" />} {message}</span>
       {state.kind === 'failed' && actions}
     </span> : state.kind === 'ready' && <DisplayImage key={`${state.src}\0${resource.attempt}`} src={state.src} alt={props.alt} onError={resource.onDecodeError} />}
     {state.kind === 'unavailable' && resource.openSource && actions}
@@ -144,7 +143,7 @@ function DisplayImage(props: { src: string; alt: string; onError(): void }) {
   return <>
     <Button ref={trigger} variant="ghost" className="maka-markdown-image-preview maka-markdown-image-trigger"
         label={copy.imageExpand(props.alt)} aria-haspopup="dialog" isDisabled={!loaded}
-        style={{ width: '100%', height: '100%', padding: 0, background: 'transparent' }}
+        style={{ padding: 0, background: 'transparent' }}
         onClick={event => { event.preventDefault(); event.stopPropagation(); if (loaded) lightbox.open(); }}>
       {content}
     </Button>
diff --git a/packages/ui/src/styles.css b/packages/ui/src/styles.css
index e7ff65f486c..13828445fec 100644
--- a/packages/ui/src/styles.css
+++ b/packages/ui/src/styles.css
@@ -602,15 +602,15 @@
   color: var(--muted-foreground);
 }
 
-/* Astryx hands custom images no inline/block placement or spacing wrapper.
-   Session artifacts are content previews rather than sentence badges, so they
-   own a bounded block presentation; compact transcript rhythm resets the
-   top-level margin above through the shared adjacency rules. */
+/* Preserve natural dimensions and aspect ratio; only shrink images that exceed
+   the message column or preview bounds. The lightbox owns enlarged viewing. */
 .maka-markdown-attachment-image {
   display: block;
   max-width: 100%;
+  max-height: min(480px, 60vh);
+  width: auto;
   height: auto;
-  margin-block: var(--space-3) var(--space-4);
+  margin: 0;
 }
 
 .maka-markdown-image-placeholder {
@@ -632,14 +632,13 @@
   gap: var(--space-3);
 }
 .maka-markdown-image-resource { display: inline-block; position: relative; max-width: 100%; }
-/* The conversation owns the width (up to the 800px reading measure). A preview
-   fits that column, but cannot consume more than 60% of a short viewport.
-   Markdown placement, not decoded dimensions, fixes the loading/ready box. */
-.maka-markdown-image-frame {
-  display: block;
-  width: 100%;
-  aspect-ratio: 16 / 10;
-  max-height: min(480px, 60vh);
+/* Hug the content instead of reserving a fixed aspect-ratio frame. */
+.maka-markdown-image-block {
+  display: flex;
+  flex-direction: column;
+  align-items: flex-start;
+  width: fit-content;
+  max-width: min(100%, 640px);
 }
 /* Six text ems leave room for a typical badge; one inherited line keeps it in
    the prose rhythm. Scale down wider images and use the lightbox for detail. */
@@ -648,7 +647,6 @@
   height: 1lh;
   vertical-align: middle;
 }
-.maka-markdown-image-frame > .maka-markdown-image-placeholder,
 .maka-markdown-image-inline .maka-markdown-image-placeholder {
   position: absolute;
   inset: 0;
@@ -656,25 +654,21 @@
   justify-content: center;
   border: 0;
 }
-.maka-markdown-image-preview {
-  display: flex;
-  position: absolute;
-  inset: 0;
-  align-items: center;
-  justify-content: center;
+.maka-markdown-image-resource .maka-markdown-image-preview {
+  max-width: 100%;
+  height: auto;
+  vertical-align: top;
+  cursor: default;
 }
-.maka-markdown-image-inline .maka-markdown-image-placeholder { padding: 0; }
-.maka-markdown-image-inline .maka-markdown-image-loading-label { display: none; }
-/* The image is the lightbox trigger, including keyboard and touch activation. */
-.maka-markdown-image-trigger { cursor: default; }
-.maka-markdown-image-trigger > span > span {
-  display: flex;
-  align-items: center;
-  justify-content: center;
+.maka-markdown-image-inline .maka-markdown-image-preview {
   width: 100%;
   height: 100%;
 }
-.maka-markdown-image-preview img { margin: 0; max-height: 100%; max-width: 100%; object-fit: contain; }
+.maka-markdown-image-inline .maka-markdown-attachment-image {
+  max-height: 1lh;
+}
+.maka-markdown-image-inline .maka-markdown-image-placeholder { padding: 0; }
+.maka-markdown-image-inline .maka-markdown-image-loading-label { display: none; }
 .maka-markdown-image-loading {
   position: absolute;
   inset: 0;

From 6b7d012b377f3cab2d02255a6aafbfbfda6124f0 Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Sun, 11 Oct 2026 13:40:28 +0800
Subject: [PATCH 36/37] docs: refresh Astryx inventory totals after main merge

Regenerate the surface inventory so its summary matches all 335 entries.

Generated-by: Codex (GPT-6)
---
 docs/astryx-surface-file-inventory.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/astryx-surface-file-inventory.md b/docs/astryx-surface-file-inventory.md
index 2f8a910af29..bd3ee8dac7f 100644
--- a/docs/astryx-surface-file-inventory.md
+++ b/docs/astryx-surface-file-inventory.md
@@ -6,7 +6,7 @@ Generated against `@astryxdesign/core@0.6.3` (195 component exports).
 
 Wiki bar: Design Conventions · API Use-the-System · Theming · Container Padding.
 
-**Totals:** 333 files — blocker 0, reimplementation 0, polish 4, aligned 329.
+**Totals:** 335 files — blocker 0, reimplementation 0, polish 4, aligned 331.
 
 ## Exclusions (explicit)
 

From 87b0bc8245c8df1e850bf0ef1fe910b9d07aec25 Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Sun, 11 Oct 2026 15:15:45 +0800
Subject: [PATCH 37/37] test(images): trim redundant PR image coverage

Consolidate overlapping image delivery, saved preview, and DNS cases while preserving their unique assertions. Remove obsolete test-only expectations and require decoded images before checking inline layout.

Generated-by: Codex (GPT-6)
---
 .../src/__tests__/chat-image-delivery.test.ts | 41 ++---------
 .../scripts/markdown-images.browser.test.mjs  | 68 ++++++-------------
 2 files changed, 27 insertions(+), 82 deletions(-)

diff --git a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
index 5b720eeeaea..9b535e75c05 100644
--- a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
+++ b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
@@ -252,7 +252,7 @@ test('parses real Markdown image nodes, including references and balanced destin
     '/tmp/a(1).png',
   ]);
 });
-test('automatically saves a local delivery without any UI request; deletion and Host restart do not break replay', async () => {
+test('automatically saves a local delivery without any UI request; deletion and ArtifactStore reopen do not break replay', async () => {
   const f = await fixture();
   try {
     const source = join(f.root, 'original.png');
@@ -804,8 +804,7 @@ test('copying a conversation carries delivery provenance and saved bytes; it doe
     await f.close();
   }
 });
-test('source readers reject oversized payloads, unsafe MIME and redirects to private networks', async (t) => {
-  assert.throws(() => checkedChatImage(Buffer.alloc(2 * 1024 * 1024 + 1)), /too_large/);
+test('source readers reject unsafe MIME and redirects to private networks', async (t) => {
   assert.throws(() => checkedChatImage(Buffer.from('<svg/>')), /unsupported_mime/);
   const server = createServer((_req, res) => {
     res.writeHead(302, { location: 'http://169.254.169.254/latest/meta-data/' });
@@ -888,32 +887,9 @@ test('HTTPS download cannot redirect to HTTP', async (t) => {
   }
 });
 
-test('DNS answers containing any private address are denied before a request', async (t) => {
-  const answers = [
-    { address: '93.184.216.34', family: 4 },
-    { address: '127.0.0.1', family: 4 },
-  ];
-  const lookup = t.mock.method(dns, 'lookup', async () => answers);
-  const request = t.mock.method(net, 'connect', () => {
-    assert.fail('unsafe DNS must not reach transport');
-  });
-  syncBuiltinESMExports();
-  try {
-    await assert.rejects(
-      downloadChatImage('http://image.example/image.png', AbortSignal.timeout(1000)),
-      /not_allowed/,
-    );
-    assert.equal(lookup.mock.callCount(), 1);
-    assert.equal(request.mock.callCount(), 0);
-  } finally {
-    t.mock.restoreAll();
-    syncBuiltinESMExports();
-  }
-});
-
 test('literal benchmark addresses, local names and mixed private answers are denied', async (t) => {
   let answers = [{ address: '93.184.216.34', family: 4 }];
-  t.mock.method(dns, 'lookup', async () => answers);
+  const lookup = t.mock.method(dns, 'lookup', async () => answers);
   const request = t.mock.method(net, 'connect', () =>
     assert.fail('blocked source reached transport'),
   );
@@ -938,10 +914,12 @@ test('literal benchmark addresses, local names and mixed private answers are den
         { address: '93.184.216.34', family: 4 },
         { address, family: address.includes(':') ? 6 : 4 },
       ];
+      const previousLookups = lookup.mock.callCount();
       await assert.rejects(
         downloadChatImage('http://image.example/a.png', AbortSignal.timeout(1000)),
         /not_allowed/,
       );
+      assert.equal(lookup.mock.callCount(), previousLookups + 1);
     }
     assert.equal(request.mock.callCount(), 0);
   } finally {
@@ -1236,15 +1214,6 @@ test('loopback is denied before GET, including redirects from a public origin',
   });
   await new Promise<void>((resolve) => origin.listen(0, '127.0.0.1', resolve));
   try {
-    // An untyped caller passing the former fixture option cannot grant access.
-    await assert.rejects(
-      Reflect.apply(downloadChatImage, undefined, [
-        targetUrl,
-        AbortSignal.timeout(1000),
-        { loopbackOrigin: new URL(targetUrl).origin },
-      ]),
-      /not_allowed/,
-    );
     const source = publicImageOrigin(
       t,
       `http://127.0.0.1:${(origin.address() as import('node:net').AddressInfo).port}/redirect`,
diff --git a/packages/ui/scripts/markdown-images.browser.test.mjs b/packages/ui/scripts/markdown-images.browser.test.mjs
index a23780ce4bd..04517d3f8a2 100644
--- a/packages/ui/scripts/markdown-images.browser.test.mjs
+++ b/packages/ui/scripts/markdown-images.browser.test.mjs
@@ -112,7 +112,6 @@ before(async () => {
     ].join('\n\n'),
     'links-redacted': `![Signed](${imageUrl}/image.png?token=reasoning-secret)\n\n![Blocked](javascript:alert)`,
     'links-streaming': `![Streaming](${imageUrl}/stream`,
-    'badge-remote': `Build ![Badge](${imageUrl}/badge.png) passing.`,
     'badge-saved': `Build ![Badge](${imageUrl}/badge.png) passing.`,
     'badge-saving': `Build ![Badge](${imageUrl}/badge.png) passing.`,
     'badge-list': `- Build ![Badge](${imageUrl}/badge.png) passing.`,
@@ -324,7 +323,7 @@ test('streaming reasoning completes image syntax as a link without fetching it',
   } finally { await page.close(); }
 });
 
-test('a remote image loads automatically and renders Host-owned bytes', async () => {
+test('remote images load automatically as Host-owned bytes with a separate identity per message', async () => {
   requests = [];
   const page = await pageFor('remote');
   try {
@@ -332,15 +331,6 @@ test('a remote image loads automatically and renders Host-owned bytes', async ()
     assert.equal(await page.getByRole('button', { name: 'Load image', exact: true }).count(), 0);
     assert.deepEqual(requests, [{ path: '/image.png', referer: undefined }]);
     assert.match(await page.locator('img').getAttribute('src'), /^data:/);
-  } finally { await page.close(); }
-});
-
-test('each message automatically resolves its own remote image identity', async () => {
-  requests = [];
-  const page = await pageFor('remote');
-  try {
-    await loaded(page);
-    assert.equal(requests.length, 1);
     await page.evaluate(() => window.nextMessage());
     await page.waitForFunction(() => window.deliveryQueries >= 2);
     await loaded(page);
@@ -364,12 +354,14 @@ for (const scenario of ['preview', 'signed-preview']) {
       assert.equal(await page.locator('img').count(), 0);
       assert.equal(await page.getByRole('button', { name: 'Load image', exact: true }).count(), 0);
       assert.ok(!(await page.locator('body').innerText()).includes('preview-secret'));
-      // Prove the production CSP blocks a bypass of the Markdown component too.
-      await page.evaluate(url => {
-        const img=document.createElement('img'); img.src=url; document.body.append(img);
-        return new Promise(resolve=> { img.onerror=resolve; img.onload=()=>resolve(); });
-      }, `${imageUrl}/blocked.png`);
-      assert.deepEqual(requests, []);
+      if (scenario === 'preview') {
+        // Prove the production CSP blocks a bypass of the Markdown component too.
+        await page.evaluate(url => {
+          const img=document.createElement('img'); img.src=url; document.body.append(img);
+          return new Promise(resolve=> { img.onerror=resolve; img.onload=()=>resolve(); });
+        }, `${imageUrl}/blocked.png`);
+        assert.deepEqual(requests, []);
+      }
     } finally { await page.close(); }
   });
 }
@@ -502,22 +494,6 @@ test('a transient saved attachment read retries its bytes without invalidating a
   } finally { await page.close(); }
 });
 
-for (const scenario of ['remote-saved', 'local-saved']) {
-  test(`${scenario}: saved mapping avoids the original source and the image supports zoom`, async () => {
-    requests = [];
-    const page = await pageFor(scenario);
-    try {
-      await loaded(page);
-      assert.deepEqual(requests, []);
-      assert.equal(await page.evaluate(() => window.imageReads), 1);
-      assert.equal(await page.locator('img').count(), 1);
-      assert.match(await page.locator('img').getAttribute('src'), /^data:image\/png;base64,/);
-      await page.getByRole('button', { name: 'Enlarge image: Screenshot', exact: true }).focus();
-      await page.keyboard.press('Enter');
-      await page.waitForFunction(() => document.images.length > 1);
-    } finally { await page.close(); }
-  });
-}
 for (const scenario of ['local-saved', 'remote-saved', 'badge-saved', 'screenshot-saved']) {
   test(`${scenario}: clicking the image itself opens the enlarged preview`, async () => {
     requests = [];
@@ -526,6 +502,9 @@ for (const scenario of ['local-saved', 'remote-saved', 'badge-saved', 'screensho
       const image = page.locator('.maka-markdown-image-preview img');
       await image.waitFor();
       await image.evaluate(image => image.decode());
+      assert.equal(await page.evaluate(() => window.imageReads), 1);
+      assert.equal(await page.locator('img').count(), 1);
+      assert.match(await image.getAttribute('src'), /^data:image\/png;base64,/);
       assert.equal(await page.locator('.maka-markdown-image-expand').count(), 0);
       assert.equal(await page.getByRole('button', { name: /^Enlarge image:/ }).count(), 1);
       const source = await image.getAttribute('src');
@@ -550,11 +529,13 @@ for (const scenario of ['local-saved', 'remote-saved', 'badge-saved', 'screensho
   });
 }
 
-for (const key of ['Enter', 'Space']) {
-  test(`the image itself supports keyboard enlargement with ${key}`, async () => {
-    const page = await pageFor('local-saved');
+for (const [scenario, key] of [['local-saved', 'Enter'], ['local-saved', 'Space'], ['remote-saved', 'Enter']]) {
+  test(`${scenario}: the image itself supports keyboard enlargement with ${key}`, async () => {
+    requests = [];
+    const page = await pageFor(scenario);
     try {
       await loaded(page);
+      assert.deepEqual(requests, []);
       const trigger = page.locator('.maka-markdown-image-trigger');
       await trigger.focus();
       await page.keyboard.press(key);
@@ -589,7 +570,6 @@ test('a pending archive stays a placeholder until saved bytes are available', as
     assert.equal(await page.locator('img').count(), 0);
     await page.waitForFunction(() => [...document.images].some(img=>img.src.startsWith('data:image/png;') && img.naturalWidth===1));
     await page.getByText('Loading image…', { exact: true }).waitFor({ state: 'hidden' });
-    await page.getByText('Saving image…', { exact: true }).waitFor({ state: 'hidden' });
     assert.equal(await page.getByRole('status').filter({ hasText: /\S/ }).count(), 0);
     assert.equal(await page.evaluate(() => window.deliveryQueries), 2);
     assert.equal(requests.length, 0);
@@ -709,7 +689,7 @@ for (const [name, naturalWidth, naturalHeight] of dimensions) {
   });
 }
 
-for (const scenario of ['badge-remote', 'badge-saved', 'badge-saving']) {
+for (const scenario of ['badge-saved', 'badge-saving']) {
   test(`${scenario}: a badge keeps its intrinsic size and surrounding text on one line`, async () => {
     requests = [];
     const page = await pageFor(scenario);
@@ -735,13 +715,8 @@ for (const scenario of ['badge-remote', 'badge-saved', 'badge-saving']) {
       assert.equal(geometry.textBoxes.length, 2);
       assert.equal(geometry.textBoxes[0], geometry.textBoxes[1]);
       if (scenario === 'badge-saved') assert.deepEqual(requests, []);
-      if (scenario === 'badge-remote') {
-        await page.locator('.maka-markdown-image-preview').hover();
-        await page.getByRole('button', { name: 'Enlarge image: Badge', exact: true }).click();
-      } else {
-        await page.getByRole('button', { name: 'Enlarge image: Badge', exact: true }).focus();
-        await page.keyboard.press('Enter');
-      }
+      await page.getByRole('button', { name: 'Enlarge image: Badge', exact: true }).focus();
+      await page.keyboard.press('Enter');
       await page.getByRole('dialog').waitFor();
     } finally { await page.close(); }
   });
@@ -782,7 +757,8 @@ for (const scenario of ['badge-list', 'badge-table', 'badge-strip']) {
       const before = await page.locator('.maka-markdown-image-resource').first().boundingBox();
       assert.ok(before.width <= 120 && before.height <= 32);
       release();
-      await page.waitForFunction(() => [...document.images].every(image => image.naturalWidth === 80));
+      await page.waitForFunction(expected => document.images.length === expected &&
+        [...document.images].every(image => image.naturalWidth === 80), scenario === 'badge-strip' ? 2 : 1);
       assert.deepEqual(await page.locator('.maka-markdown-image-resource').first().boundingBox(), before);
     } finally { release(); await page.close(); }
   });