From bedaccbc46d0ced7a01a5f29df3477ee4f5eb7be Mon Sep 17 00:00:00 2001
From: guicybercode <euguigom@gmail.com>
Date: Sun, 30 Aug 2026 11:48:30 -0300
Subject: [PATCH 01/23] test(session): stabilize force-kill timing

Keep the assertion tied to the two-second supervisor interval while using the production-like one-second reap deadline from the shared test configuration. This avoids treating a loaded macOS runner's inability to reap within 50 ms as a runtime failure.
---
 crates/session/tests/pty_sessions/lifecycle.rs | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/crates/session/tests/pty_sessions/lifecycle.rs b/crates/session/tests/pty_sessions/lifecycle.rs
index 0010d70..bee8e27 100644
--- a/crates/session/tests/pty_sessions/lifecycle.rs
+++ b/crates/session/tests/pty_sessions/lifecycle.rs
@@ -71,9 +71,9 @@ fn stop_force_kills_a_process_that_ignores_graceful_signals() {
 
 #[test]
 fn force_kill_reaps_without_waiting_for_the_supervisor_interval() {
+    let supervisor_interval = Duration::from_secs(2);
     let config = SessionManagerConfig {
-        supervisor_interval: Duration::from_secs(2),
-        kill_wait: Duration::from_millis(50),
+        supervisor_interval,
         ..test_config()
     };
     let runtime = TestRuntime::with_config(config);
@@ -83,8 +83,12 @@ fn force_kill_reaps_without_waiting_for_the_supervisor_interval() {
 
     let started = Instant::now();
     let snapshot = runtime.manager.kill(session_id).unwrap();
+    let elapsed = started.elapsed();
 
-    assert!(started.elapsed() < Duration::from_millis(500));
+    assert!(
+        elapsed < supervisor_interval,
+        "force kill took {elapsed:?}, so it may have waited for the supervisor"
+    );
     assert_eq!(snapshot.status, SessionStatus::Exited);
     let (terminal_transitions, exit_events) = count_terminal_events(&mut events);
     assert_eq!(terminal_transitions, 1);

From c69be7b63cb00dedfe5885a408d84636d28a85d7 Mon Sep 17 00:00:00 2001
From: guicybercode <euguigom@gmail.com>
Date: Thu, 3 Sep 2026 10:28:38 -0300
Subject: [PATCH 02/23] fix(session): keep process snapshots monotonic

---
 crates/session/src/runtime/process_tree.rs | 87 +++++++++++++++++++++-
 1 file changed, 83 insertions(+), 4 deletions(-)

diff --git a/crates/session/src/runtime/process_tree.rs b/crates/session/src/runtime/process_tree.rs
index 50eca30..d2b14b6 100644
--- a/crates/session/src/runtime/process_tree.rs
+++ b/crates/session/src/runtime/process_tree.rs
@@ -1,7 +1,10 @@
 use std::{
     collections::{BTreeMap, BTreeSet, HashMap},
     io,
-    sync::{Arc, OnceLock},
+    sync::{
+        Arc, OnceLock,
+        atomic::{AtomicU64, Ordering},
+    },
     time::{Duration, Instant},
 };
 
@@ -12,11 +15,13 @@ const SNAPSHOT_CACHE_TTL: Duration = Duration::from_millis(20);
 
 #[derive(Clone)]
 struct CachedSnapshot {
+    sequence: u64,
     captured_at: Instant,
     records: Arc<[ProcessRecord]>,
 }
 
 static PROCESS_SNAPSHOT_CACHE: OnceLock<Mutex<Option<CachedSnapshot>>> = OnceLock::new();
+static NEXT_SNAPSHOT_SEQUENCE: AtomicU64 = AtomicU64::new(1);
 
 #[derive(Clone, Debug, Eq, PartialEq)]
 struct ProcessIdentity {
@@ -40,6 +45,7 @@ pub(super) struct TrackedProcess {
 
 pub(super) struct ProcessTree {
     known: BTreeMap<i32, ProcessIdentity>,
+    root_snapshot_sequence: u64,
     scan_timeout: Duration,
     max_tracked_processes: usize,
 }
@@ -54,6 +60,7 @@ impl ProcessTree {
         let root_pid = root_pid.as_raw();
         let mut tree = Self {
             known: BTreeMap::new(),
+            root_snapshot_sequence: records.sequence,
             scan_timeout,
             max_tracked_processes,
         };
@@ -69,7 +76,10 @@ impl ProcessTree {
     }
 
     pub fn refresh(&mut self) -> io::Result<Vec<TrackedProcess>> {
-        let snapshot = process_snapshot(self.scan_timeout, false)?;
+        // A global scan can begin before this tree's root exists and publish
+        // after the root-proving scan. Never let that older view prune the root.
+        let snapshot =
+            process_snapshot_after(self.scan_timeout, false, Some(self.root_snapshot_sequence))?;
         self.absorb(&snapshot.records)
     }
 
@@ -144,6 +154,7 @@ impl ProcessTree {
     fn with_root_for_test(root: ProcessRecord, max_tracked_processes: usize) -> Self {
         Self {
             known: BTreeMap::from([(root.identity.pid, root.identity)]),
+            root_snapshot_sequence: 1,
             scan_timeout: Duration::from_secs(1),
             max_tracked_processes,
         }
@@ -151,7 +162,16 @@ impl ProcessTree {
 }
 
 fn process_snapshot(timeout: Duration, force: bool) -> io::Result<CachedSnapshot> {
+    process_snapshot_after(timeout, force, None)
+}
+
+fn process_snapshot_after(
+    timeout: Duration,
+    force: bool,
+    minimum_sequence: Option<u64>,
+) -> io::Result<CachedSnapshot> {
     let started = Instant::now();
+    let sequence = next_snapshot_sequence()?;
     let cache = PROCESS_SNAPSHOT_CACHE.get_or_init(|| Mutex::new(None));
     if !force {
         let Some(cached) = cache.try_lock_for(timeout) else {
@@ -161,7 +181,7 @@ fn process_snapshot(timeout: Duration, force: bool) -> io::Result<CachedSnapshot
             ));
         };
         if let Some(snapshot) = cached.as_ref() {
-            if snapshot.captured_at.elapsed() <= SNAPSHOT_CACHE_TTL {
+            if cached_snapshot_is_usable(snapshot, minimum_sequence) {
                 return Ok(snapshot.clone());
             }
         }
@@ -175,6 +195,7 @@ fn process_snapshot(timeout: Duration, force: bool) -> io::Result<CachedSnapshot
     }
     let records = Arc::from(scan_processes_uncached(remaining)?);
     let snapshot = CachedSnapshot {
+        sequence,
         captured_at: Instant::now(),
         records,
     };
@@ -184,11 +205,37 @@ fn process_snapshot(timeout: Duration, force: bool) -> io::Result<CachedSnapshot
     // itself is already complete and identity-checked.
     let remaining = timeout.saturating_sub(started.elapsed());
     if let Some(mut cache) = cache.try_lock_for(remaining) {
-        *cache = Some(snapshot.clone());
+        // Concurrent scans finish out of order, so only their start sequence is
+        // a reliable publication order.
+        publish_snapshot(&mut cache, snapshot.clone());
     }
     Ok(snapshot)
 }
 
+fn next_snapshot_sequence() -> io::Result<u64> {
+    // The counter is only an ordering token; the cache mutex publishes the
+    // snapshot data, so no cross-thread memory ordering is required here.
+    NEXT_SNAPSHOT_SEQUENCE
+        .fetch_update(Ordering::Relaxed, Ordering::Relaxed, |sequence| {
+            sequence.checked_add(1)
+        })
+        .map_err(|_| io::Error::other("process-tree snapshot sequence exhausted"))
+}
+
+fn cached_snapshot_is_usable(snapshot: &CachedSnapshot, minimum_sequence: Option<u64>) -> bool {
+    snapshot.captured_at.elapsed() <= SNAPSHOT_CACHE_TTL
+        && minimum_sequence.is_none_or(|minimum| snapshot.sequence >= minimum)
+}
+
+fn publish_snapshot(cache: &mut Option<CachedSnapshot>, snapshot: CachedSnapshot) {
+    let should_publish = cache
+        .as_ref()
+        .is_none_or(|cached| snapshot.sequence > cached.sequence);
+    if should_publish {
+        *cache = Some(snapshot);
+    }
+}
+
 #[cfg(target_os = "linux")]
 fn scan_processes_uncached(timeout: Duration) -> io::Result<Vec<ProcessRecord>> {
     const MAX_PROCESS_SNAPSHOT_RECORDS: usize = 262_144;
@@ -365,6 +412,38 @@ mod tests {
         }
     }
 
+    fn snapshot(
+        sequence: u64,
+        captured_at: Instant,
+        records: impl Into<Arc<[ProcessRecord]>>,
+    ) -> CachedSnapshot {
+        CachedSnapshot {
+            sequence,
+            captured_at,
+            records: records.into(),
+        }
+    }
+
+    #[test]
+    fn out_of_order_scan_cannot_replace_a_newer_cached_snapshot() {
+        let newer = snapshot(2, Instant::now(), vec![record(200, 1, 200, "newer")]);
+        let older = snapshot(1, Instant::now(), vec![record(100, 1, 100, "older")]);
+        let mut cache = Some(newer);
+
+        publish_snapshot(&mut cache, older);
+
+        let cached = cache.expect("newer cache entry should be retained");
+        assert_eq!(cached.sequence, 2);
+        assert_eq!(cached.records[0].identity.pid, 200);
+    }
+
+    #[test]
+    fn cached_snapshot_from_before_root_proof_is_not_usable() {
+        let stale = snapshot(1, Instant::now(), Vec::<ProcessRecord>::new());
+
+        assert!(!cached_snapshot_is_usable(&stale, Some(2)));
+    }
+
     #[test]
     fn only_proven_descendants_are_retained_across_group_changes() {
         let root = record(100, 1, 100, "root");

From b843c1975f59b3633f1c065a0779f6b51143be43 Mon Sep 17 00:00:00 2001
From: guicybercode <euguigom@gmail.com>
Date: Thu, 3 Sep 2026 10:32:05 -0300
Subject: [PATCH 03/23] fix(session): advance process snapshot floor

---
 crates/session/src/runtime/process_tree.rs | 54 ++++++++++++++++------
 1 file changed, 41 insertions(+), 13 deletions(-)

diff --git a/crates/session/src/runtime/process_tree.rs b/crates/session/src/runtime/process_tree.rs
index d2b14b6..04bc9b5 100644
--- a/crates/session/src/runtime/process_tree.rs
+++ b/crates/session/src/runtime/process_tree.rs
@@ -45,7 +45,7 @@ pub(super) struct TrackedProcess {
 
 pub(super) struct ProcessTree {
     known: BTreeMap<i32, ProcessIdentity>,
-    root_snapshot_sequence: u64,
+    latest_snapshot_sequence: u64,
     scan_timeout: Duration,
     max_tracked_processes: usize,
 }
@@ -56,36 +56,45 @@ impl ProcessTree {
         scan_timeout: Duration,
         max_tracked_processes: usize,
     ) -> io::Result<Self> {
-        let records = process_snapshot(scan_timeout, true)?;
+        let snapshot = process_snapshot(scan_timeout, true)?;
         let root_pid = root_pid.as_raw();
         let mut tree = Self {
             known: BTreeMap::new(),
-            root_snapshot_sequence: records.sequence,
+            latest_snapshot_sequence: snapshot.sequence,
             scan_timeout,
             max_tracked_processes,
         };
-        if let Some(root) = records
+        if let Some(root) = snapshot
             .records
             .iter()
             .find(|record| record.identity.pid == root_pid && !record.zombie)
         {
             tree.known.insert(root_pid, root.identity.clone());
         }
-        let _ = tree.absorb(&records.records)?;
+        let _ = tree.absorb_snapshot(&snapshot)?;
         Ok(tree)
     }
 
     pub fn refresh(&mut self) -> io::Result<Vec<TrackedProcess>> {
-        // A global scan can begin before this tree's root exists and publish
-        // after the root-proving scan. Never let that older view prune the root.
-        let snapshot =
-            process_snapshot_after(self.scan_timeout, false, Some(self.root_snapshot_sequence))?;
-        self.absorb(&snapshot.records)
+        // A global scan can begin before this tree's latest evidence and
+        // publish afterward. Never let that older view prune a proven process.
+        let snapshot = process_snapshot_after(
+            self.scan_timeout,
+            false,
+            Some(self.latest_snapshot_sequence),
+        )?;
+        self.absorb_snapshot(&snapshot)
     }
 
     pub fn refresh_fresh(&mut self) -> io::Result<Vec<TrackedProcess>> {
         let snapshot = process_snapshot(self.scan_timeout, true)?;
-        self.absorb(&snapshot.records)
+        self.absorb_snapshot(&snapshot)
+    }
+
+    fn absorb_snapshot(&mut self, snapshot: &CachedSnapshot) -> io::Result<Vec<TrackedProcess>> {
+        let processes = self.absorb(&snapshot.records)?;
+        self.latest_snapshot_sequence = self.latest_snapshot_sequence.max(snapshot.sequence);
+        Ok(processes)
     }
 
     fn absorb(&mut self, records: &[ProcessRecord]) -> io::Result<Vec<TrackedProcess>> {
@@ -154,7 +163,7 @@ impl ProcessTree {
     fn with_root_for_test(root: ProcessRecord, max_tracked_processes: usize) -> Self {
         Self {
             known: BTreeMap::from([(root.identity.pid, root.identity)]),
-            root_snapshot_sequence: 1,
+            latest_snapshot_sequence: 1,
             scan_timeout: Duration::from_secs(1),
             max_tracked_processes,
         }
@@ -438,12 +447,31 @@ mod tests {
     }
 
     #[test]
-    fn cached_snapshot_from_before_root_proof_is_not_usable() {
+    fn cached_snapshot_from_before_latest_tree_evidence_is_not_usable() {
         let stale = snapshot(1, Instant::now(), Vec::<ProcessRecord>::new());
 
         assert!(!cached_snapshot_is_usable(&stale, Some(2)));
     }
 
+    #[test]
+    fn fresh_snapshot_advances_the_tree_cache_floor() {
+        let root = record(100, 1, 100, "root");
+        let child = record(101, 100, 101, "child");
+        let mut tree = ProcessTree::with_root_for_test(root.clone(), 8);
+        let newer = snapshot(3, Instant::now(), vec![root.clone(), child]);
+
+        tree.absorb_snapshot(&newer)
+            .expect("newer process-tree evidence should be accepted");
+
+        let stale = snapshot(2, Instant::now(), vec![root]);
+        assert_eq!(tree.latest_snapshot_sequence, 3);
+        assert!(tree.known.contains_key(&101));
+        assert!(!cached_snapshot_is_usable(
+            &stale,
+            Some(tree.latest_snapshot_sequence)
+        ));
+    }
+
     #[test]
     fn only_proven_descendants_are_retained_across_group_changes() {
         let root = record(100, 1, 100, "root");

From 569449ff3c2e2fd9942ccc89ac75b65bee79e1dd Mon Sep 17 00:00:00 2001
From: guicybercode <euguigom@gmail.com>
Date: Sat, 5 Sep 2026 21:36:15 -0300
Subject: [PATCH 04/23] docs(xirp): record local scope and integration
 contracts

---
 docs/adr/0005-local-knowledge.md       | 74 ++++++++++++++++++++++++++
 docs/codex/xirp-context-report.md      | 37 +++++++++++++
 docs/codex/xirp-integration-request.md | 25 +++++++++
 docs/xirp-local-parity.md              | 36 +++++++++++++
 4 files changed, 172 insertions(+)
 create mode 100644 docs/adr/0005-local-knowledge.md
 create mode 100644 docs/codex/xirp-context-report.md
 create mode 100644 docs/codex/xirp-integration-request.md
 create mode 100644 docs/xirp-local-parity.md

diff --git a/docs/adr/0005-local-knowledge.md b/docs/adr/0005-local-knowledge.md
new file mode 100644
index 0000000..abdea73
--- /dev/null
+++ b/docs/adr/0005-local-knowledge.md
@@ -0,0 +1,74 @@
+# ADR 0005: Local prompts, reusable context, and organization
+
+Status: proposed; shared contract and migration registration await S2 agreement.
+
+## Context
+
+CLI Master needs global/project prompts, reusable local context, and work
+organization without assuming ownership of coding agents. The XIRP reference
+separates optional Portal workspaces from local project/terminal operations.
+The canvas remains the primary UI. Linux and macOS remain first-class.
+
+## Decision
+
+`knowledge` modules hold explicit user-authored saved prompts and context
+records. Core types are pure. Storage uses the existing SQLite database;
+daemon handlers expose the agreed versioned wire contract. No additional
+Tauri client, file service, process executor, or database is introduced.
+
+A record has a UUIDv7 identity, a `prompt` or `context` kind, a nullable project
+ID (null means global), title/body, monotonically increasing integer revision,
+and epoch-millisecond timestamps. Project queries include project and global
+records; global queries include only global records. Project deletion must
+have a documented foreign-key policy, while archive preserves all records.
+
+Creation omits ID and expected revision. Updates/deletes supply both identity
+and the last observed revision. A concurrent edit fails with a stable conflict
+error and preserves the editor draft. Save-as-copy is explicit. Input and list
+response sizes are bounded to fit the daemon's transport limits. Content must
+not appear in Debug, error details, or logs.
+
+Selecting a saved prompt or context inserts editable text in the composer.
+Only a separate explicit runtime action delivers it to an agent. Saving text
+never writes terminal input. Reusing context is not restoring a vendor
+conversation and does not persist a terminal transcript. The initial objective
+must eventually be delivered through SessionManager/verified adapter options;
+a stored text field alone is not completion of that requirement.
+
+Project/session pin/archive and session workflow are organization metadata.
+They neither replace process status nor signal a process. Workflow states are
+`backlog`, `in_progress`, `in_review`, `blocked`, and `done`; archive is a
+separate flag. The runtime owner coordinates their shared types/storage.
+
+Rule/skill discovery inventories explicitly supported locations with origin,
+format, scope, and precedence explanations. It reuses the runtime owner's
+file-access boundary; discovered content is data and is never executed.
+Credential paths are excluded. Symlinks, external changes, size/count limits,
+encoding, and edit conflicts must have explicit behavior and real filesystem
+tests. Reference support for symlinked skill directories is a parity item,
+not permission to traverse arbitrary links or read unrelated home files.
+
+Agent-specific resume/fork/options require verified adapter capabilities.
+Attention needs explicit trustworthy events. Token/cost usage needs native
+records with provenance; unknown data is unavailable, never inferred from
+terminal byte counts, silence, or process duration.
+
+## Integration and dependencies
+
+S2 owns shared Rust wire registration, catalog mirrors, migrations, daemon
+composition/dispatch, runtime/adapters, and the generic file service. S3 sends
+small contracts before editing those boundaries. S1 owns mounting the isolated
+components in the canvas/palette and composer draft insertion. Working
+components and green unit tests do not prove their integrated application flow.
+
+Portal authentication, shared workspaces, MCP exposure and transcript sharing
+remain separate capabilities requiring real contracts/account verification.
+Local context is a CLI Master extension and is not branded as Portal support.
+
+## Verification
+
+Contract tests reject malformed inputs. Persistence tests use real SQLite
+files, reopen, competing connections, project scope, and FK behavior. Socket
+roundtrips prove handlers and effects. Frontend tests use typed callbacks/the
+project IPC client. Canvas integration, Linux/macOS CI and runtime evidence
+are tracked separately from isolated component tests.
diff --git a/docs/codex/xirp-context-report.md b/docs/codex/xirp-context-report.md
new file mode 100644
index 0000000..2fe3b56
--- /dev/null
+++ b/docs/codex/xirp-context-report.md
@@ -0,0 +1,37 @@
+# XIRP local workflows report
+
+Branch: `feat/xirp-local-workflows`.
+Worktree: `/Users/eguimacs/cli-master-xirp`.
+Base: `0ac8dd7`, fetched from `origin/refactor/canvas-only-shell` on 2026-09-05.
+
+## Scope and evidence
+
+The source/acceptance inventory is [xirp-local-parity.md](../xirp-local-parity.md).
+The architecture proposal is [ADR 0005](../adr/0005-local-knowledge.md).
+The full user request remains open; documentation and isolated components are
+intermediate deliverables.
+
+## Coordination
+
+A concrete proposal was placed in `docs/codex/xirp-integration-request.md` in
+S1, S2 and S3 worktrees. S2 acknowledgment is pending for shared contracts,
+module registrations, migration allocation and dispatch. S1 acknowledgment is
+pending for canvas mounting and composer insertion. No shared code has been
+changed by S3 at this point.
+
+Baseline drift reported to owners: active daemon dispatch is `server.rs`;
+`client.rs` is uncompiled. Frontend currently has `types.ts`/`schema.ts` rather
+than the mirrors named in AGENTS. Runtime registry/adapters need consolidation
+by S2; S3 will not introduce another registry or Tauri client.
+
+## Work in progress
+
+- Pure validated knowledge types and contract tests (new module only).
+- Isolated saved prompt/context editor/picker with typed callbacks and tests.
+- Persisted handlers and integration follow the agreed shared boundaries.
+
+## Commits and checks
+
+Initial documentation commit: source review completed; `git diff --check`.
+Implementation tests and runtime/platform evidence will be recorded here as
+executed. No Linux/macOS runtime parity is claimed yet.
diff --git a/docs/codex/xirp-integration-request.md b/docs/codex/xirp-integration-request.md
new file mode 100644
index 0000000..0522dbf
--- /dev/null
+++ b/docs/codex/xirp-integration-request.md
@@ -0,0 +1,25 @@
+# XIRP S3 integration request — 2026-09-05
+
+S3 is active in `/Users/eguimacs/cli-master-xirp`, branch `feat/xirp-local-workflows`, based on latest `origin/refactor/canvas-only-shell` (`0ac8dd7`). The user explicitly requested coordination before shared changes. This file is a coordination message, not part of your commit unless useful.
+
+## S2 runtime / shared-contract owner
+
+Please reply in `/Users/eguimacs/cli-master-xirp/docs/codex/xirp-coordination-reply.md` or append below in this copy. I will inspect both main and runtime copies.
+
+Proposed S3 ownership: new `knowledge/` modules under core/storage/daemon; isolated React components under `app/features/knowledge/`; domain tests and XIRP report. No parallel process executor, file service, database, or Tauri client.
+
+First vertical increment: global/project saved prompts (UUIDv7, title/body/projectId nullable, created/updated epoch-ms, integer revision) and reusable local context documents (same scope/revision plus kind). Explicit insert creates composer draft, never hidden send. Suggest `knowledge.list`, `knowledge.save`, `knowledge.delete` with tagged kind `prompt|context`; optimistic revision on update/delete; `knowledge.updated` event for refresh. Stable existing `invalid_input`/not_found + agreed conflict error. Storage tables in current SQLite with project FK; no runtime side effects.
+
+Next: `knowledge.discover`/`knowledge.read` for explicitly known rule/skill paths, bounded UTF-8/no credentials/no symlink traversal; edit via your file service once available (no duplicate generic file service). Please advise your file contract/reusable safe reader.
+
+Organization metadata: propose separate project/session organization records for pinned/archived, session workflow (backlog/in_progress/in_review/blocked/done) separate from process status, initial objective + explicit local context references. Do you own these fields as planned? Please reserve/implement contracts or delegate an agreed narrow patch. Initial objective execution must use SessionManager/adapters; S3 can own drafting/context composition.
+
+Please confirm migration allocation, shared lib.rs registration, wire/mirrors/dispatch ownership. Can you delegate a small additive S3 patch to these files after review of this proposal, or supply a commit? No shared files have been changed by S3.
+
+## S1 canvas owner
+
+Will deliver isolated components with typed callbacks for saved prompts/context library, rules/skills inspector, and organization controls. Please identify preferred integration surface (canvas contextual panel/toolbar/palette) and coordinate real mounting/composer insertion. Your AppShell/canvas/global styles remain yours. S3 will publish commits and integration API in `docs/codex/xirp-context-report.md`; main canvas remains Maestri.
+
+## Responses
+
+Pending owner acknowledgment.
diff --git a/docs/xirp-local-parity.md b/docs/xirp-local-parity.md
new file mode 100644
index 0000000..4e56b21
--- /dev/null
+++ b/docs/xirp-local-parity.md
@@ -0,0 +1,36 @@
+# XIRP local parity
+
+Sources checked 2026-09-05 against XIRP changelog through v0.25.0 (2026-09-03).
+Baseline: `0ac8dd7`, `origin/refactor/canvas-only-shell`.
+This matrix covers the user's local XIRP request. It complements the main
+session's `docs/maestri-xirp-parity.md`; Portal product features are not silently
+added to this implementation's scope.
+
+| ID | Requirement and source | Owner / integration | Evidence / remaining work |
+| --- | --- | --- | --- |
+| X01 | Local project pin, rename, remove registration, non-Git folders, discover child repositories. [Projects](https://backstage.spotify.com/docs/xirp/projects) | S2 project base, S3 organization UI, S1 canvas | Baseline registers Git projects; pin/archive metadata, non-Git support and child discovery pending. Project archive is a user-requested extension. |
+| X02 | Initial objective delivered to agent, attachments, checkout/worktree and agent-specific options. [Sessions](https://backstage.spotify.com/docs/xirp/sessions) | S2 execution/contracts, S3 draft/context selection, S1 composer | Goal delivery requires verified runtime path, not metadata only. Attachments/options pending runtime contract. |
+| X03 | Resume/fork, agent switch preserving supported history, linked shell. [Sessions](https://backstage.spotify.com/docs/xirp/sessions), [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S2 adapters/runtime, S1 canvas | Current adapter capabilities do not expose verified conversation IDs, fork or usage. Await trusted native contracts and runtime integration. Local context reuse is a separate feature. |
+| X04 | Working/idle/needs-input attention separate from process lifecycle. [Sessions](https://backstage.spotify.com/docs/xirp/sessions) | S2 event source, S3 indicators, S1 canvas | PTY silence is not proof of approval/input need. Explicit hooks or native signals required. |
+| X05 | Local preferences, shortcuts, supported native settings, diagnostics. [Settings](https://backstage.spotify.com/docs/xirp/settings) | S2 settings/runtime, S3 rules/skills, S1 UI | Existing diagnostics/custom-agent creation are baseline only; do not expose unsupported options. Credentials excluded from editors. |
+| X06 | Global/project rules and skills, including symlinked skill directories. [Projects](https://backstage.spotify.com/docs/xirp/projects), [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S3 discovery, S2 file boundary | Need verified location inventory and safe bounded reads with origins/scopes; docs do not enumerate complete formats or precedence. Symlink policy and editing depend on file service. |
+| X07a | Saved global/project prompts, searchable picker and insertion. [Changelog v0.19.1](https://backstage.spotify.com/docs/xirp/changelog) | S3 knowledge, S2 shared registration, S1 canvas insertion | Isolated module implementation underway; persistence, socket, UI integration and cross-platform evidence pending. |
+| X07b | Session archive and workflow: backlog/in_progress/in_review/blocked/done. [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S2 organization metadata, S3 controls, S1 filtering | Workflow must not mutate lifecycle. Session pin is a user-requested extension. |
+| X07c | Tokens/spend per session/day. [Changelog v0.18.0](https://backstage.spotify.com/docs/xirp/changelog) | S2 verified native data, S3 presentation | Source documents feature existence, not a collector/format/pricing algorithm. Currently unavailable, not zero. No proxy or PTY-based estimates. |
+| X07d | PR review, Doctor, cleanup. [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S2 runtime/Git, S1 UI | Existing Git status/diagnostics/removal-token safety are baseline; review and expanded cleanup require their real contracts. |
+| X08 | Agent-specific options, including Cursor. [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S2 adapter registry, S1 UI | No flags invented from agent display name; support requires installed-version tests and authoritative CLI sources. |
+| X09-local | Explicit reusable local context between sessions (user request). | S3 knowledge, S1 composer, S2 delivery | Local text records and explicit draft insertion planned. No transcript capture, autonomous summarization, or Portal connection implied. |
+| X09-Portal | Shared workspaces, members, catalog links, resources, decisions/wiki. [Workspaces](https://backstage.spotify.com/docs/xirp/workspaces) | Separate authenticated connector | Portal-dependent; no account/API verification supplied. Not implemented or simulated. |
+| X10 | Workspace context via MCP, manual transcript sharing, configured external integrations. [Workspaces](https://backstage.spotify.com/docs/xirp/workspaces) | Separate authenticated connector + S2 transport | Requires real account, scopes/API and explicit outbound preview. No silent publishing, account linking or telemetry. |
+
+The [XIRP overview](https://backstage.spotify.com/docs/xirp) confirms local
+projects, terminals, files, rules, skills and worktrees can operate without
+Portal. XIRP's macOS platform statement does not replace CLI Master's Linux
+requirement. A macOS test does not count as Linux verification.
+
+## Completion evidence required
+
+Each implemented row must link its commit, relevant automated tests, persistent
+or filesystem effect, real socket behavior and canvas consumption. Portable
+source code alone does not demonstrate execution on both supported platforms.
+Unknown capabilities remain open dependencies rather than claimed parity.

From 7693468ed7dba150a0d8fc5ea56e37f18bf85e45 Mon Sep 17 00:00:00 2001
From: guicybercode <euguigom@gmail.com>
Date: Sat, 5 Sep 2026 21:47:04 -0300
Subject: [PATCH 05/23] refactor(session): separate worktree preparation from
 process launch

---
 crates/session/src/create.rs             | 227 ++++++++++++----
 crates/session/src/lib.rs                |   5 +-
 crates/session/src/remove.rs             |  20 ++
 crates/session/src/saga.rs               | 115 ++++++--
 crates/session/tests/prepare_saga.rs     | 328 +++++++++++++++++++++++
 crates/storage/src/sessions.rs           |  65 +++--
 crates/storage/src/worktrees.rs          |  45 +++-
 crates/storage/tests/agents_worktrees.rs |  78 ++++++
 8 files changed, 773 insertions(+), 110 deletions(-)
 create mode 100644 crates/session/tests/prepare_saga.rs

diff --git a/crates/session/src/create.rs b/crates/session/src/create.rs
index c64f9d9..2504449 100644
--- a/crates/session/src/create.rs
+++ b/crates/session/src/create.rs
@@ -1,7 +1,7 @@
-use std::path::PathBuf;
+use std::path::{Path, PathBuf};
 use std::sync::Arc;
 
-use cli_master_core::wire::SessionIsolation;
+use cli_master_core::wire::{RelativeDirectory, SessionIsolation};
 use cli_master_core::{
     AgentId, ProjectId, Session, SessionId, SessionStatus, Worktree, WorktreeId,
 };
@@ -18,6 +18,25 @@ use crate::token::now_ms;
 const DEFAULT_PTY_COLS: u16 = 80;
 const DEFAULT_PTY_ROWS: u16 = 24;
 
+#[derive(Clone, Copy)]
+pub(crate) enum Launch<'a> {
+    Prepare(Option<&'a RelativeDirectory>),
+    Start,
+}
+
+impl<'a> Launch<'a> {
+    fn relative_directory(self) -> Option<&'a RelativeDirectory> {
+        match self {
+            Self::Prepare(relative) => relative,
+            Self::Start => None,
+        }
+    }
+
+    fn starts_process(self) -> bool {
+        matches!(self, Self::Start)
+    }
+}
+
 /// Named saga effect after which tests may inject a failure.
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 pub enum CreateStep {
@@ -82,7 +101,7 @@ pub struct CreateSession {
 /// Durable result of a completed create saga.
 #[derive(Clone, Debug, Eq, PartialEq)]
 pub struct CreatedSession {
-    /// Persisted session, including daemon-observed pid after spawn.
+    /// Persisted session; preparing metadata alone never assigns a pid.
     pub session: Session,
     /// Managed worktree when isolation requested one.
     pub worktree: Option<Worktree>,
@@ -94,10 +113,11 @@ pub(crate) fn create<S: SessionSpawner>(
     saga: &SessionWorktreeSaga<S>,
     request: &CreateSession,
     faults: &CreateFaults,
+    launch: Launch<'_>,
 ) -> Result<CreatedSession, SagaError> {
     match request.isolation {
-        SessionIsolation::Current => create_current(saga, request, faults),
-        SessionIsolation::NewWorktree => create_worktree(saga, request, faults),
+        SessionIsolation::Current => create_current(saga, request, faults, launch),
+        SessionIsolation::NewWorktree => create_worktree(saga, request, faults, launch),
     }
 }
 
@@ -105,21 +125,31 @@ fn create_current<S: SessionSpawner>(
     saga: &SessionWorktreeSaga<S>,
     request: &CreateSession,
     faults: &CreateFaults,
+    launch: Launch<'_>,
 ) -> Result<CreatedSession, SagaError> {
     let now = now_ms();
     let project = require_project(saga, request.project_id)?;
     let agent = require_agent(saga, request.agent_id)?;
+    let cwd = resolve_session_directory(&project.path, launch.relative_directory())?;
+    let command = agent
+        .command_for_cwd(cwd.clone())
+        .map_err(SagaError::from)?;
     maybe_fail(faults, CreateStep::Plan)?;
     maybe_fail(faults, CreateStep::PersistCreating)?;
     maybe_fail(faults, CreateStep::GitAdd)?;
     let session_id = SessionId::new();
-    insert_starting_session(saga, session_id, request, project.path.clone(), now)?;
+    let session = session_row(saga, session_id, request, cwd, now, launch);
+    saga.storage().insert_session(&session)?;
     maybe_fail(faults, CreateStep::PersistActive).inspect_err(|_| {
         discard_session(saga, session_id);
     })?;
-    let command = agent
-        .command_for_cwd(project.path.clone())
-        .map_err(SagaError::from)?;
+    if !launch.starts_process() {
+        return Ok(CreatedSession {
+            session: session_dto(session, None, None),
+            worktree: None,
+            plan: None,
+        });
+    }
     let spawned = saga
         .spawner
         .spawn(SpawnRequest {
@@ -159,10 +189,11 @@ fn create_worktree<S: SessionSpawner>(
     saga: &SessionWorktreeSaga<S>,
     request: &CreateSession,
     faults: &CreateFaults,
+    launch: Launch<'_>,
 ) -> Result<CreatedSession, SagaError> {
     let now = now_ms();
     let project = require_project(saga, request.project_id)?;
-    let agent = require_agent(saga, request.agent_id)?;
+    require_agent(saga, request.agent_id)?;
     let worktree_id = WorktreeId::new();
     let session_id = SessionId::new();
     let short_id = request
@@ -170,11 +201,22 @@ fn create_worktree<S: SessionSpawner>(
         .clone()
         .unwrap_or_else(|| short_id_for(worktree_id));
     let plan = saga.git.plan_worktree(
-        &project.path,
+        project.repository_root.as_ref().unwrap_or(&project.path),
         &request.managed_root,
         &request.name,
         &short_id,
     )?;
+    let selected_directory = canonical_directory(&project.path)?;
+    let project_relative = selected_directory
+        .strip_prefix(plan.repository_root())
+        .map_err(|_| {
+            SagaError::new(
+                SagaErrorKind::InvalidInput,
+                "selected project directory is outside its Git repository root",
+                "Register a directory inside the repository and try again",
+            )
+            .with_path(&project.path)
+        })?;
     if let Some(hook) = &faults.after_plan {
         hook(&plan);
     }
@@ -208,10 +250,10 @@ fn create_worktree<S: SessionSpawner>(
         saga,
         request,
         faults,
-        &agent,
         &plan,
-        (worktree_id, session_id),
+        (worktree_id, session_id, project_relative),
         now,
+        launch,
     )
 }
 
@@ -219,33 +261,50 @@ fn persist_spawn_and_run<S: SessionSpawner>(
     saga: &SessionWorktreeSaga<S>,
     request: &CreateSession,
     faults: &CreateFaults,
-    agent: &cli_master_storage::StoredAgent,
     plan: &WorktreePlan,
-    ids: (WorktreeId, SessionId),
+    ids: (WorktreeId, SessionId, &Path),
     now: i64,
+    launch: Launch<'_>,
 ) -> Result<CreatedSession, SagaError> {
-    let (worktree_id, session_id) = ids;
-    if let Err(error) = insert_starting_session(
-        saga,
-        session_id,
-        request,
-        plan.destination().to_path_buf(),
-        now,
-    ) {
-        return Err(compensate(saga, plan, worktree_id, None, error));
-    }
-    if let Err(error) = activate_worktree(saga, worktree_id, session_id, now) {
-        discard_session(saga, session_id);
-        return Err(compensate(saga, plan, worktree_id, None, error));
+    let (worktree_id, session_id, project_relative) = ids;
+    let selected_root = resolve_directory(
+        plan.destination(),
+        &plan.destination().join(project_relative),
+    )
+    .map_err(|error| compensate(saga, plan, worktree_id, None, error))?;
+    let cwd = resolve_session_directory(&selected_root, launch.relative_directory())
+        .map_err(|error| compensate(saga, plan, worktree_id, None, error))?;
+    let agent = require_agent(saga, request.agent_id)
+        .map_err(|error| compensate(saga, plan, worktree_id, None, error))?;
+    let command = agent
+        .command_for_cwd(cwd.clone())
+        .map_err(|error| compensate(saga, plan, worktree_id, None, SagaError::from(error)))?;
+    let session = session_row(saga, session_id, request, cwd, now, launch);
+    let persisted =
+        saga.storage()
+            .insert_prepared_session_with_worktree(&session, worktree_id, now);
+    if let Err(error) = persisted {
+        return Err(compensate(
+            saga,
+            plan,
+            worktree_id,
+            None,
+            SagaError::from(error),
+        ));
     }
     if let Err(error) = maybe_fail(faults, CreateStep::PersistActive) {
-        discard_session(saga, session_id);
         return Err(compensate(saga, plan, worktree_id, Some(session_id), error));
     }
 
-    let command = agent
-        .command_for_cwd(plan.destination().to_path_buf())
-        .map_err(SagaError::from)?;
+    if !launch.starts_process() {
+        let worktree = require_worktree(saga, worktree_id)
+            .map_err(|error| compensate(saga, plan, worktree_id, Some(session_id), error))?;
+        return Ok(CreatedSession {
+            session: session_dto(session, Some(&worktree), None),
+            worktree: Some(worktree_dto(worktree)),
+            plan: Some(plan.clone()),
+        });
+    }
     let spawned = match saga.spawner.spawn(SpawnRequest {
         session_id,
         project_id: request.project_id,
@@ -311,46 +370,35 @@ fn persist_creating<S: SessionSpawner>(
         .map_err(SagaError::from)
 }
 
-fn insert_starting_session<S: SessionSpawner>(
+fn session_row<S: SessionSpawner>(
     saga: &SessionWorktreeSaga<S>,
     session_id: SessionId,
     request: &CreateSession,
     cwd: PathBuf,
     now: i64,
-) -> Result<(), SagaError> {
-    let row = StoredSession {
+    launch: Launch<'_>,
+) -> StoredSession {
+    StoredSession {
         id: session_id,
         project_id: request.project_id,
         agent_id: request.agent_id,
         name: request.name.clone(),
         cwd,
-        status: SessionStatus::Starting,
+        status: if launch.starts_process() {
+            SessionStatus::Starting
+        } else {
+            SessionStatus::Unknown
+        },
         runtime_pid: None,
-        daemon_instance_id: Some(saga.daemon_instance_id.clone()),
+        daemon_instance_id: launch
+            .starts_process()
+            .then(|| saga.daemon_instance_id.clone()),
         exit_code: None,
         error_code: None,
         created_at_ms: now,
         updated_at_ms: now,
-        last_activity_at_ms: Some(now),
-    };
-    saga.storage().insert_session(&row).map_err(SagaError::from)
-}
-
-fn activate_worktree<S: SessionSpawner>(
-    saga: &SessionWorktreeSaga<S>,
-    worktree_id: WorktreeId,
-    session_id: SessionId,
-    now: i64,
-) -> Result<(), SagaError> {
-    saga.storage()
-        .update_worktree_state(
-            worktree_id,
-            WorktreeState::Active,
-            false,
-            Some(session_id),
-            now,
-        )
-        .map_err(SagaError::from)
+        last_activity_at_ms: launch.starts_process().then_some(now),
+    }
 }
 
 fn persist_running<S: SessionSpawner>(
@@ -424,7 +472,15 @@ fn compensate<S: SessionSpawner>(
             original
         }
         Err(error) => {
-            mark_orphaned(saga, worktree_id, session_id);
+            // Successful session deletion clears the foreign-key association;
+            // do not try to reattach an identifier that no longer exists.
+            let remaining_session = saga
+                .storage()
+                .get_worktree(worktree_id)
+                .ok()
+                .flatten()
+                .and_then(|worktree| worktree.session_id);
+            mark_orphaned(saga, worktree_id, remaining_session);
             if error.kind() == cli_master_git::GitErrorKind::PartialWorktree {
                 return SagaError::from(error).with_worktree_id(worktree_id);
             }
@@ -510,3 +566,58 @@ pub(crate) fn require_worktree<S: SessionSpawner>(
         .with_worktree_id(worktree_id)
     })
 }
+
+/// Resolves an existing session directory inside its daemon-selected root.
+///
+/// Both paths are canonicalized so a child symlink cannot escape the project
+/// or managed worktree. The typed relative directory has already passed wire
+/// validation for parent traversal and absolute paths.
+///
+/// # Errors
+///
+/// Returns an error when either directory is unavailable or the resolved child
+/// is outside the canonical root.
+pub fn resolve_session_directory(
+    root: &Path,
+    relative_directory: Option<&RelativeDirectory>,
+) -> Result<PathBuf, SagaError> {
+    let directory = relative_directory.map_or_else(
+        || root.to_path_buf(),
+        |relative| root.join(relative.as_str()),
+    );
+    resolve_directory(root, &directory)
+}
+
+fn resolve_directory(root: &Path, directory: &Path) -> Result<PathBuf, SagaError> {
+    let canonical_root = canonical_directory(root)?;
+    let canonical_directory = canonical_directory(directory)?;
+    if !canonical_directory.starts_with(&canonical_root) {
+        return Err(SagaError::new(
+            SagaErrorKind::InvalidInput,
+            "session directory resolves outside its project or worktree root",
+            "Choose an existing directory inside the session root",
+        )
+        .with_path(directory));
+    }
+    Ok(canonical_directory)
+}
+
+fn canonical_directory(directory: &Path) -> Result<PathBuf, SagaError> {
+    let resolved = directory.canonicalize().map_err(|error| {
+        SagaError::new(
+            SagaErrorKind::InvalidInput,
+            format!("session directory could not be opened: {error}"),
+            "Choose an existing directory inside the session root and check its permissions",
+        )
+        .with_path(directory)
+    })?;
+    if !resolved.is_dir() {
+        return Err(SagaError::new(
+            SagaErrorKind::InvalidInput,
+            "session working directory is not a directory",
+            "Choose an existing directory inside the session root",
+        )
+        .with_path(directory));
+    }
+    Ok(resolved)
+}
diff --git a/crates/session/src/lib.rs b/crates/session/src/lib.rs
index cc56796..3d57e91 100644
--- a/crates/session/src/lib.rs
+++ b/crates/session/src/lib.rs
@@ -30,7 +30,10 @@ pub use config::{
     DEFAULT_REPLAY_MAX_BYTES, DEFAULT_REPLAY_MAX_CHUNKS, MAX_EVENT_CAPACITY, MAX_TRACKED_PROCESSES,
     SessionManagerConfig,
 };
-pub use create::{CreateFaults, CreateSession, CreateStep, CreatedSession, LockHook, PlanHook};
+pub use create::{
+    CreateFaults, CreateSession, CreateStep, CreatedSession, LockHook, PlanHook,
+    resolve_session_directory,
+};
 pub use error::{SagaError, SagaErrorKind, SessionError};
 pub use event::{
     IoOperation, OutputChunk, ReconnectSnapshot, SessionEvent, SessionHandle, SessionSnapshot,
diff --git a/crates/session/src/remove.rs b/crates/session/src/remove.rs
index 8d9a54e..ae309f0 100644
--- a/crates/session/src/remove.rs
+++ b/crates/session/src/remove.rs
@@ -15,6 +15,26 @@ use crate::saga::{SessionWorktreeSaga, require_project};
 use crate::spawn::SessionSpawner;
 use crate::token::now_ms;
 
+pub(crate) fn cancel_pending_removal<S: SessionSpawner>(
+    saga: &SessionWorktreeSaga<S>,
+    worktree_id: WorktreeId,
+) -> Result<(), SagaError> {
+    let _mutation = lock_mutation(&saga.mutations, worktree_id)?;
+    let stored = require_worktree(saga, worktree_id)?;
+    let _destination = lock_destination(&saga.destinations, stored.path.clone())?;
+    saga.tokens.discard_for(worktree_id);
+    if stored.state == WorktreeState::RemovePending {
+        saga.storage().update_worktree_state(
+            worktree_id,
+            WorktreeState::Active,
+            stored.is_dirty,
+            stored.session_id,
+            now_ms(),
+        )?;
+    }
+    Ok(())
+}
+
 pub(crate) fn prepare_remove<S: SessionSpawner>(
     saga: &SessionWorktreeSaga<S>,
     worktree_id: WorktreeId,
diff --git a/crates/session/src/saga.rs b/crates/session/src/saga.rs
index 3be54aa..3b4cab2 100644
--- a/crates/session/src/saga.rs
+++ b/crates/session/src/saga.rs
@@ -1,6 +1,8 @@
-use std::sync::{Mutex, MutexGuard, PoisonError};
+use std::sync::{Arc, Mutex, MutexGuard, PoisonError};
 
-use cli_master_core::wire::{ConfirmationToken, SessionIsolation, WorktreePrepareRemoveResponse};
+use cli_master_core::wire::{
+    ConfirmationToken, RelativeDirectory, SessionIsolation, WorktreePrepareRemoveResponse,
+};
 use cli_master_core::{AgentId, Project, ProjectId, SessionId, WorktreeId};
 use cli_master_git::Git;
 use cli_master_storage::{Storage, StoredAgent};
@@ -15,7 +17,7 @@ use crate::{
 /// Orchestrates recoverable worktree-backed session creation and removal.
 pub struct SessionWorktreeSaga<S> {
     pub(crate) git: Git,
-    storage: Mutex<Storage>,
+    storage: Arc<Mutex<Storage>>,
     pub(crate) spawner: S,
     pub(crate) daemon_instance_id: String,
     pub(crate) destinations: DestinationLocks,
@@ -34,6 +36,25 @@ impl<S: SessionSpawner> SessionWorktreeSaga<S> {
         storage: Storage,
         spawner: S,
         daemon_instance_id: impl Into<String>,
+    ) -> Result<Self, SagaError> {
+        Self::new_with_shared_storage(
+            git,
+            Arc::new(Mutex::new(storage)),
+            spawner,
+            daemon_instance_id,
+        )
+    }
+
+    /// Builds a saga sharing the daemon's single metadata owner.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error when `daemon_instance_id` is blank.
+    pub fn new_with_shared_storage(
+        git: Git,
+        storage: Arc<Mutex<Storage>>,
+        spawner: S,
+        daemon_instance_id: impl Into<String>,
     ) -> Result<Self, SagaError> {
         let daemon_instance_id = daemon_instance_id.into();
         if daemon_instance_id.trim().is_empty() {
@@ -45,7 +66,7 @@ impl<S: SessionSpawner> SessionWorktreeSaga<S> {
         }
         Ok(Self {
             git,
-            storage: Mutex::new(storage),
+            storage,
             spawner,
             daemon_instance_id,
             destinations: DestinationLocks::default(),
@@ -73,23 +94,44 @@ impl<S: SessionSpawner> SessionWorktreeSaga<S> {
         request: &CreateSession,
         faults: &CreateFaults,
     ) -> Result<CreatedSession, SagaError> {
-        if request.name.trim().is_empty() {
-            return Err(SagaError::new(
-                SagaErrorKind::InvalidInput,
-                "session name must not be blank",
-                "Provide a user-facing session name",
-            ));
-        }
-        if request.isolation == SessionIsolation::NewWorktree && !request.managed_root.is_absolute()
-        {
-            return Err(SagaError::new(
-                SagaErrorKind::InvalidInput,
-                "managed worktree root must be an absolute path",
-                "Pass the daemon-owned managed worktree root",
-            )
-            .with_path(&request.managed_root));
-        }
-        crate::create::create(self, request, faults)
+        validate_create(request)?;
+        crate::create::create(self, request, faults, crate::create::Launch::Start)
+    }
+
+    /// Prepares durable session metadata and optional Git isolation without launching a process.
+    ///
+    /// The returned session has `unknown` status and no runtime owner until the
+    /// daemon starts it through `SessionManager`.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error when directory validation, persistence, or Git preparation fails.
+    pub fn prepare_session(
+        &self,
+        request: &CreateSession,
+        relative_directory: Option<&RelativeDirectory>,
+    ) -> Result<CreatedSession, SagaError> {
+        self.prepare_session_injected(request, relative_directory, &CreateFaults::default())
+    }
+
+    /// Prepares session metadata with deterministic fault hooks for compensation tests.
+    ///
+    /// # Errors
+    ///
+    /// Returns the same failures as [`Self::prepare_session`] plus injected faults.
+    pub fn prepare_session_injected(
+        &self,
+        request: &CreateSession,
+        relative_directory: Option<&RelativeDirectory>,
+        faults: &CreateFaults,
+    ) -> Result<CreatedSession, SagaError> {
+        validate_create(request)?;
+        crate::create::create(
+            self,
+            request,
+            faults,
+            crate::create::Launch::Prepare(relative_directory),
+        )
     }
 
     /// Inspects whether a managed worktree can be removed and issues a token when safe.
@@ -104,6 +146,18 @@ impl<S: SessionSpawner> SessionWorktreeSaga<S> {
         crate::remove::prepare_remove(self, worktree_id)
     }
 
+    /// Invalidates removal confirmation before a daemon-owned session starts again.
+    ///
+    /// The daemon serializes this operation with session launch and removal.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error when the worktree is missing, a mutation is already in
+    /// progress, or the pending state cannot be restored.
+    pub fn cancel_pending_removal(&self, worktree_id: WorktreeId) -> Result<(), SagaError> {
+        crate::remove::cancel_pending_removal(self, worktree_id)
+    }
+
     /// Removes a clean unused worktree using a matching confirmation token.
     ///
     /// # Errors
@@ -195,3 +249,22 @@ pub(crate) fn require_agent<S: SessionSpawner>(
     }
     Ok(agent)
 }
+
+fn validate_create(request: &CreateSession) -> Result<(), SagaError> {
+    if request.name.trim().is_empty() {
+        return Err(SagaError::new(
+            SagaErrorKind::InvalidInput,
+            "session name must not be blank",
+            "Provide a user-facing session name",
+        ));
+    }
+    if request.isolation == SessionIsolation::NewWorktree && !request.managed_root.is_absolute() {
+        return Err(SagaError::new(
+            SagaErrorKind::InvalidInput,
+            "managed worktree root must be an absolute path",
+            "Pass the daemon-owned managed worktree root",
+        )
+        .with_path(&request.managed_root));
+    }
+    Ok(())
+}
diff --git a/crates/session/tests/prepare_saga.rs b/crates/session/tests/prepare_saga.rs
new file mode 100644
index 0000000..0bf8522
--- /dev/null
+++ b/crates/session/tests/prepare_saga.rs
@@ -0,0 +1,328 @@
+mod support;
+
+use std::fs;
+use std::os::unix::fs::symlink;
+use std::sync::{Arc, Mutex};
+
+use cli_master_core::{
+    SessionStatus,
+    wire::{RelativeDirectory, SessionIsolation},
+};
+use cli_master_git::Git;
+use cli_master_session::{
+    CreateFaults, CreateStep, FakeSpawner, SagaErrorKind, SessionWorktreeSaga,
+};
+use cli_master_storage::{Storage, WorktreeState};
+use support::{Fixture, git};
+
+#[test]
+fn prepared_worktree_has_no_runtime_and_survives_recovery() {
+    let fixture = Fixture::new();
+    let shared = Arc::new(Mutex::new(
+        Storage::open_migrated(&fixture.database).unwrap(),
+    ));
+    let saga = SessionWorktreeSaga::new_with_shared_storage(
+        Git::discover().unwrap(),
+        Arc::clone(&shared),
+        FakeSpawner::failing(),
+        support::DAEMON_ID,
+    )
+    .unwrap();
+    let prepared = saga
+        .prepare_session(&fixture.request("Prepare", None), None)
+        .unwrap();
+    let worktree = prepared.worktree.unwrap();
+    assert_eq!(prepared.session.status, SessionStatus::Unknown);
+    assert!(prepared.session.pid.is_none());
+    assert!(prepared.session.pty_id.is_none());
+    assert!(worktree.path.is_dir());
+    assert_eq!(worktree.session_id, Some(prepared.session.id));
+    assert_eq!(worktree.state, cli_master_core::WorktreeState::Active);
+    let storage = shared.lock().unwrap();
+    let stored = storage.get_session(prepared.session.id).unwrap().unwrap();
+    assert!(stored.daemon_instance_id.is_none());
+    assert!(stored.last_activity_at_ms.is_none());
+    assert_eq!(
+        storage
+            .recover_stale_sessions_for_daemon("next-daemon", stored.updated_at_ms + 1)
+            .unwrap(),
+        0
+    );
+    drop(storage);
+    assert_eq!(saga.recover().unwrap(), Default::default());
+    saga.delete_session(prepared.session.id).unwrap();
+    assert!(
+        worktree.path.is_dir(),
+        "deleting metadata must preserve the worktree"
+    );
+    assert!(
+        shared
+            .lock()
+            .unwrap()
+            .get_worktree(worktree.id)
+            .unwrap()
+            .unwrap()
+            .session_id
+            .is_none()
+    );
+}
+
+#[test]
+fn relative_directory_is_resolved_in_the_new_checkout() {
+    let fixture = Fixture::new();
+    fs::create_dir_all(fixture.repository.join("apps/api")).unwrap();
+    fs::write(fixture.repository.join("apps/api/README.md"), "api\n").unwrap();
+    git(&fixture.repository, ["add", "."]);
+    git(&fixture.repository, ["commit", "-m", "api directory"]);
+    let saga = fixture.saga(FakeSpawner::failing());
+    let relative = RelativeDirectory::try_new("apps/api").unwrap();
+    let prepared = saga
+        .prepare_session(&fixture.request("API", None), Some(&relative))
+        .unwrap();
+    let root = prepared.worktree.unwrap().path;
+    assert_eq!(
+        prepared.session.cwd,
+        root.join("apps/api").canonicalize().unwrap()
+    );
+    assert!(
+        !prepared
+            .session
+            .cwd
+            .starts_with(fixture.repository.canonicalize().unwrap())
+    );
+}
+
+#[test]
+fn project_subdirectory_is_preserved_for_current_and_worktree_sessions() {
+    for isolation in [SessionIsolation::Current, SessionIsolation::NewWorktree] {
+        let fixture = Fixture::new();
+        fs::create_dir_all(fixture.repository.join("apps/api")).unwrap();
+        fs::write(fixture.repository.join("apps/api/README.md"), "api\n").unwrap();
+        git(&fixture.repository, ["add", "."]);
+        git(&fixture.repository, ["commit", "-m", "api directory"]);
+        let storage = Storage::open(&fixture.database).unwrap();
+        let mut project = storage.get_project(fixture.project_id).unwrap().unwrap();
+        storage.remove_project_metadata(project.id).unwrap();
+        project.path = fixture.repository.join("apps");
+        project.repository_root = Some(fixture.repository.canonicalize().unwrap());
+        storage.insert_project(&project).unwrap();
+        let saga = fixture.saga(FakeSpawner::failing());
+        let mut request = fixture.request("API", None);
+        request.isolation = isolation;
+        let prepared = saga
+            .prepare_session(&request, Some(&RelativeDirectory::try_new("api").unwrap()))
+            .unwrap();
+        let root = prepared
+            .worktree
+            .map_or(fixture.repository, |worktree| worktree.path);
+        assert_eq!(
+            prepared.session.cwd,
+            root.join("apps/api").canonicalize().unwrap()
+        );
+    }
+}
+
+#[test]
+fn cancelled_removal_invalidates_the_old_token_and_restores_active_metadata() {
+    let fixture = Fixture::new();
+    let saga = fixture.saga(FakeSpawner::failing());
+    let prepared = saga
+        .prepare_session(&fixture.request("Cancel removal", None), None)
+        .unwrap();
+    let worktree = prepared.worktree.unwrap();
+    let cli_master_core::wire::WorktreePrepareRemoveResponse::Ready {
+        confirmation_token, ..
+    } = saga.prepare_remove(worktree.id).unwrap()
+    else {
+        panic!("prepared clean worktree should be removable");
+    };
+    saga.cancel_pending_removal(worktree.id).unwrap();
+    let stored = Storage::open(&fixture.database)
+        .unwrap()
+        .get_worktree(worktree.id)
+        .unwrap()
+        .unwrap();
+    assert_eq!(stored.state, WorktreeState::Active);
+    assert_eq!(stored.session_id, Some(prepared.session.id));
+    assert_eq!(
+        saga.remove_worktree(worktree.id, &confirmation_token)
+            .unwrap_err()
+            .kind(),
+        SagaErrorKind::InvalidToken
+    );
+    assert!(worktree.path.is_dir());
+    let cli_master_core::wire::WorktreePrepareRemoveResponse::Ready {
+        confirmation_token: new_token,
+        ..
+    } = saga.prepare_remove(worktree.id).unwrap()
+    else {
+        panic!("a fresh confirmation should still be available");
+    };
+    saga.remove_worktree(worktree.id, &new_token).unwrap();
+    assert!(!worktree.path.exists());
+}
+
+#[test]
+fn current_directory_can_be_prepared_without_a_git_repository() {
+    let fixture = Fixture::new();
+    fs::remove_dir_all(fixture.repository.join(".git")).unwrap();
+    fs::create_dir(fixture.repository.join("child")).unwrap();
+    let saga = fixture.saga(FakeSpawner::failing());
+    let mut request = fixture.request("Current", None);
+    request.isolation = SessionIsolation::Current;
+    let prepared = saga
+        .prepare_session(
+            &request,
+            Some(&RelativeDirectory::try_new("child").unwrap()),
+        )
+        .unwrap();
+    assert_eq!(
+        prepared.session.cwd,
+        fixture.repository.join("child").canonicalize().unwrap()
+    );
+    assert!(prepared.worktree.is_none());
+    assert!(!fixture.managed.exists());
+}
+
+#[test]
+fn current_directory_rejects_symlink_escape_without_metadata() {
+    let fixture = Fixture::new();
+    symlink(fixture.temp.path(), fixture.repository.join("outside")).unwrap();
+    let saga = fixture.saga(FakeSpawner::failing());
+    let mut request = fixture.request("Escape", None);
+    request.isolation = SessionIsolation::Current;
+    let error = saga
+        .prepare_session(
+            &request,
+            Some(&RelativeDirectory::try_new("outside").unwrap()),
+        )
+        .unwrap_err();
+    assert_eq!(error.kind(), SagaErrorKind::InvalidInput);
+    assert!(
+        Storage::open(&fixture.database)
+            .unwrap()
+            .list_sessions()
+            .unwrap()
+            .is_empty()
+    );
+}
+
+#[test]
+fn worktree_symlink_escape_is_compensated_without_deleting_the_target() {
+    let fixture = Fixture::new();
+    let outside = fixture.temp.path().join("outside");
+    fs::create_dir(&outside).unwrap();
+    fs::write(outside.join("keep.txt"), "keep\n").unwrap();
+    symlink(&outside, fixture.repository.join("outside")).unwrap();
+    git(&fixture.repository, ["add", "."]);
+    git(&fixture.repository, ["commit", "-m", "linked directory"]);
+    let saga = fixture.saga(FakeSpawner::failing());
+    let error = saga
+        .prepare_session(
+            &fixture.request("Escape", None),
+            Some(&RelativeDirectory::try_new("outside").unwrap()),
+        )
+        .unwrap_err();
+    assert_eq!(error.kind(), SagaErrorKind::InvalidInput);
+    assert_eq!(
+        fs::read_to_string(outside.join("keep.txt")).unwrap(),
+        "keep\n"
+    );
+    let storage = Storage::open(&fixture.database).unwrap();
+    assert!(storage.list_sessions().unwrap().is_empty());
+    assert!(storage.list_worktrees().unwrap().is_empty());
+    assert_eq!(
+        Git::discover()
+            .unwrap()
+            .list_worktrees(&fixture.repository)
+            .unwrap()
+            .len(),
+        1
+    );
+}
+
+#[test]
+fn missing_directory_in_checkout_rolls_back_git_and_metadata() {
+    let fixture = Fixture::new();
+    fs::create_dir(fixture.repository.join("untracked-directory")).unwrap();
+    let saga = fixture.saga(FakeSpawner::failing());
+    let error = saga
+        .prepare_session(
+            &fixture.request("Missing", None),
+            Some(&RelativeDirectory::try_new("untracked-directory").unwrap()),
+        )
+        .unwrap_err();
+    assert_eq!(error.kind(), SagaErrorKind::InvalidInput);
+    let storage = Storage::open(&fixture.database).unwrap();
+    assert!(storage.list_sessions().unwrap().is_empty());
+    assert!(storage.list_worktrees().unwrap().is_empty());
+    assert_eq!(
+        Git::discover()
+            .unwrap()
+            .list_worktrees(&fixture.repository)
+            .unwrap()
+            .len(),
+        1
+    );
+}
+
+#[test]
+fn metadata_only_faults_compensate_each_durable_effect() {
+    for step in [
+        CreateStep::Plan,
+        CreateStep::PersistCreating,
+        CreateStep::GitAdd,
+        CreateStep::PersistActive,
+    ] {
+        let fixture = Fixture::new();
+        let saga = fixture.saga(FakeSpawner::failing());
+        let error = saga
+            .prepare_session_injected(
+                &fixture.request("Fault", None),
+                None,
+                &CreateFaults {
+                    fail_after: Some(step),
+                    ..CreateFaults::default()
+                },
+            )
+            .unwrap_err();
+        assert_eq!(error.kind(), SagaErrorKind::InjectedFailure);
+        let storage = Storage::open(&fixture.database).unwrap();
+        assert!(storage.list_sessions().unwrap().is_empty(), "{step:?}");
+        assert!(storage.list_worktrees().unwrap().is_empty(), "{step:?}");
+        assert_eq!(
+            Git::discover()
+                .unwrap()
+                .list_worktrees(&fixture.repository)
+                .unwrap()
+                .len(),
+            1
+        );
+    }
+}
+
+#[test]
+fn compensation_preserves_dirty_user_data_after_metadata_preparation() {
+    let fixture = Fixture::new();
+    let saga = fixture.saga(FakeSpawner::failing());
+    let error = saga
+        .prepare_session_injected(
+            &fixture.request("Dirty", None),
+            None,
+            &CreateFaults {
+                fail_after: Some(CreateStep::PersistActive),
+                after_git_add: Some(Arc::new(|plan| {
+                    fs::write(plan.destination().join("keep.txt"), "keep\n").unwrap();
+                })),
+                ..CreateFaults::default()
+            },
+        )
+        .unwrap_err();
+    assert_eq!(error.kind(), SagaErrorKind::PartialWorktree);
+    let storage = Storage::open(&fixture.database).unwrap();
+    assert!(storage.list_sessions().unwrap().is_empty());
+    let worktrees = storage.list_worktrees().unwrap();
+    assert_eq!(worktrees.len(), 1);
+    assert_eq!(worktrees[0].state, WorktreeState::Orphaned);
+    assert!(worktrees[0].path.join("keep.txt").is_file());
+}
diff --git a/crates/storage/src/sessions.rs b/crates/storage/src/sessions.rs
index ad3633d..0a3c1f2 100644
--- a/crates/storage/src/sessions.rs
+++ b/crates/storage/src/sessions.rs
@@ -25,36 +25,8 @@ impl Storage {
     /// Returns an error for invalid metadata, missing project/agent references,
     /// duplicate IDs, or database failures.
     pub fn insert_session(&self, session: &StoredSession) -> Result<(), StorageError> {
-        session.validate()?;
-        let cwd = path_to_sql_value(&session.cwd, "session cwd")?;
         self.with_connection("insert session", |connection| {
-            connection
-                .execute(
-                    "INSERT INTO sessions (
-                    id, project_id, agent_id, name, cwd, status, runtime_pid,
-                    daemon_instance_id, exit_code, error_code, created_at,
-                    updated_at, last_activity_at
-                 ) VALUES (
-                    ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12, ?13
-                 )",
-                    params![
-                        session.id.to_string(),
-                        session.project_id.to_string(),
-                        session.agent_id.to_string(),
-                        session.name,
-                        cwd,
-                        session_status_to_database(session.status),
-                        session.runtime_pid.map(i64::from),
-                        session.daemon_instance_id,
-                        session.exit_code,
-                        session.error_code,
-                        session.created_at_ms,
-                        session.updated_at_ms,
-                        session.last_activity_at_ms,
-                    ],
-                )
-                .map_err(|error| map_write_error(error, "session"))?;
-            Ok(())
+            insert_session_on_connection(connection, session)
         })
     }
 
@@ -269,3 +241,38 @@ fn require_changed(changed: usize, id: SessionId) -> Result<(), StorageError> {
         Ok(())
     }
 }
+
+pub(crate) fn insert_session_on_connection(
+    connection: &Connection,
+    session: &StoredSession,
+) -> Result<(), StorageError> {
+    session.validate()?;
+    let cwd = path_to_sql_value(&session.cwd, "session cwd")?;
+    connection
+        .execute(
+            "INSERT INTO sessions (
+                    id, project_id, agent_id, name, cwd, status, runtime_pid,
+                    daemon_instance_id, exit_code, error_code, created_at,
+                    updated_at, last_activity_at
+                 ) VALUES (
+                    ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12, ?13
+                 )",
+            params![
+                session.id.to_string(),
+                session.project_id.to_string(),
+                session.agent_id.to_string(),
+                session.name,
+                cwd,
+                session_status_to_database(session.status),
+                session.runtime_pid.map(i64::from),
+                session.daemon_instance_id,
+                session.exit_code,
+                session.error_code,
+                session.created_at_ms,
+                session.updated_at_ms,
+                session.last_activity_at_ms,
+            ],
+        )
+        .map_err(|error| map_write_error(error, "session"))?;
+    Ok(())
+}
diff --git a/crates/storage/src/worktrees.rs b/crates/storage/src/worktrees.rs
index 913299f..bcd1fa7 100644
--- a/crates/storage/src/worktrees.rs
+++ b/crates/storage/src/worktrees.rs
@@ -7,7 +7,7 @@ use rusqlite::{Row, params};
 
 use crate::Storage;
 use crate::error::{StorageError, corrupt_data, map_write_error, persisted_validation};
-use crate::models::{StoredWorktree, WorktreeState, validate_timestamp};
+use crate::models::{StoredSession, StoredWorktree, WorktreeState, validate_timestamp};
 use crate::paths::{path_from_sql_value, path_to_sql_value};
 use crate::values::timestamp_from_sql_value;
 
@@ -15,6 +15,49 @@ const WORKTREE_COLUMNS: &str = "id, project_id, session_id, path, branch, state,
     is_dirty, created_at, updated_at";
 
 impl Storage {
+    /// Inserts a session and activates its previously prepared worktree atomically.
+    ///
+    /// Git has already created the working copy. A failed association must leave
+    /// no unassociated session row, while the `creating` worktree remains available
+    /// for compensation or crash recovery.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error for invalid session metadata, missing or non-creating
+    /// worktrees, cross-project associations, or database failures.
+    pub fn insert_prepared_session_with_worktree(
+        &self,
+        session: &StoredSession,
+        worktree_id: WorktreeId,
+        updated_at_ms: i64,
+    ) -> Result<(), StorageError> {
+        validate_timestamp("worktree updated_at_ms", updated_at_ms)?;
+        self.transaction(|transaction| {
+            crate::sessions::insert_session_on_connection(transaction, session)?;
+            let changed = transaction
+                .execute(
+                    "UPDATE worktrees SET state = 'active', session_id = ?1, updated_at = ?2
+                 WHERE id = ?3 AND project_id = ?4 AND state = 'creating' AND session_id IS NULL",
+                    params![
+                        session.id.to_string(),
+                        updated_at_ms,
+                        worktree_id.to_string(),
+                        session.project_id.to_string(),
+                    ],
+                )
+                .map_err(|error| map_write_error(error, "worktree"))?;
+            if changed == 0 {
+                return Err(StorageError::InvalidInput {
+                    field: "worktree association",
+                    reason:
+                        "worktree must be unassociated, creating, and belong to the session project"
+                            .to_owned(),
+                });
+            }
+            Ok(())
+        })
+    }
+
     /// Inserts worktree metadata without running Git or creating directories.
     ///
     /// # Errors
diff --git a/crates/storage/tests/agents_worktrees.rs b/crates/storage/tests/agents_worktrees.rs
index 575ed6c..9a9e501 100644
--- a/crates/storage/tests/agents_worktrees.rs
+++ b/crates/storage/tests/agents_worktrees.rs
@@ -336,6 +336,84 @@ struct WorktreeScenario {
     worktree: StoredWorktree,
 }
 
+#[test]
+fn prepared_session_and_worktree_commit_together_or_roll_back() {
+    let scenario = seeded_worktree_scenario();
+    let candidate = session(
+        scenario.first_project_id,
+        scenario.agent_id,
+        SessionStatus::Unknown,
+        None,
+        None,
+    );
+    let mut prepared = worktree(
+        scenario.first_project_id,
+        None,
+        std::path::Path::new("/tmp/prepared-worktree"),
+        "agent/prepared",
+    );
+    scenario.storage.insert_worktree(&prepared).unwrap();
+    scenario
+        .storage
+        .insert_prepared_session_with_worktree(&candidate, prepared.id, CREATED_AT_MS + 1)
+        .unwrap();
+    assert_eq!(
+        scenario.storage.get_session(candidate.id).unwrap(),
+        Some(candidate.clone())
+    );
+    prepared.state = WorktreeState::Active;
+    prepared.session_id = Some(candidate.id);
+    prepared.updated_at_ms = CREATED_AT_MS + 1;
+    assert_eq!(
+        scenario.storage.get_worktree(prepared.id).unwrap(),
+        Some(prepared.clone())
+    );
+
+    let replacement = session(
+        scenario.first_project_id,
+        scenario.agent_id,
+        SessionStatus::Unknown,
+        None,
+        None,
+    );
+    assert!(
+        scenario
+            .storage
+            .insert_prepared_session_with_worktree(&replacement, prepared.id, CREATED_AT_MS + 2)
+            .is_err()
+    );
+    assert!(
+        scenario
+            .storage
+            .get_session(replacement.id)
+            .unwrap()
+            .is_none()
+    );
+    assert_eq!(
+        scenario.storage.get_worktree(prepared.id).unwrap(),
+        Some(prepared)
+    );
+
+    let invalid = session(
+        scenario.first_project_id,
+        scenario.agent_id,
+        SessionStatus::Unknown,
+        None,
+        None,
+    );
+    assert!(
+        scenario
+            .storage
+            .insert_prepared_session_with_worktree(
+                &invalid,
+                cli_master_core::WorktreeId::new(),
+                CREATED_AT_MS + 2
+            )
+            .is_err()
+    );
+    assert!(scenario.storage.get_session(invalid.id).unwrap().is_none());
+}
+
 fn seeded_worktree_scenario() -> WorktreeScenario {
     let storage = Storage::open_in_memory().expect("database should open");
     storage.migrate().expect("database should migrate");

From 3c25a85eeceaeb4d924784c681e301191b2bc6f8 Mon Sep 17 00:00:00 2001
From: guicybercode <euguigom@gmail.com>
Date: Sat, 5 Sep 2026 21:49:11 -0300
Subject: [PATCH 06/23] feat(daemon): expose isolated session and safe worktree
 lifecycle over IPC

---
 apps/desktop/src/ipc/domain.ts          |  12 +
 apps/desktop/src/ipc/methods.ts         |  34 +
 crates/core/src/protocol.rs             |  19 +
 crates/core/src/wire/method.rs          |   3 +
 crates/core/src/wire/mod.rs             |   4 +-
 crates/core/src/wire/request.rs         |   9 +
 crates/core/src/wire/response.rs        |   8 +
 crates/daemon/src/server.rs             |  94 ++-
 crates/daemon/src/sessions.rs           | 155 ++++-
 crates/daemon/src/sessions/worktrees.rs | 267 ++++++++
 crates/daemon/tests/worktree_ipc.rs     | 831 ++++++++++++++++++++++++
 protocol/catalog.json                   |   1 +
 12 files changed, 1389 insertions(+), 48 deletions(-)
 create mode 100644 apps/desktop/src/ipc/domain.ts
 create mode 100644 apps/desktop/src/ipc/methods.ts
 create mode 100644 crates/daemon/src/sessions/worktrees.rs
 create mode 100644 crates/daemon/tests/worktree_ipc.rs

diff --git a/apps/desktop/src/ipc/domain.ts b/apps/desktop/src/ipc/domain.ts
new file mode 100644
index 0000000..7cb4aa6
--- /dev/null
+++ b/apps/desktop/src/ipc/domain.ts
@@ -0,0 +1,12 @@
+/** Additive daemon contracts. Existing UI DTOs remain owned by types.ts. */
+export type * from "./types";
+import type { Worktree } from "./types";
+
+/** List managed worktrees; omission includes every registered project. */
+export interface WorktreeListRequest {
+  readonly projectId?: string;
+}
+
+export interface WorktreeListResponse {
+  readonly worktrees: readonly Worktree[];
+}
diff --git a/apps/desktop/src/ipc/methods.ts b/apps/desktop/src/ipc/methods.ts
new file mode 100644
index 0000000..7b00a06
--- /dev/null
+++ b/apps/desktop/src/ipc/methods.ts
@@ -0,0 +1,34 @@
+/** Mirror of cli_master_core::wire::method; protocol/catalog.json is checked in tests. */
+export const IPC_METHODS = [
+  "system.hello",
+  "state.snapshot",
+  "project.add",
+  "project.list",
+  "project.rename",
+  "project.remove",
+  "agent.list",
+  "agent.detect",
+  "agent.set_enabled",
+  "agent.custom.create",
+  "agent.custom.update",
+  "agent.custom.remove",
+  "session.create",
+  "session.list",
+  "session.rename",
+  "session.start",
+  "session.restart",
+  "session.stop",
+  "session.delete",
+  "session.write",
+  "session.resize",
+  "session.subscribe",
+  "session.unsubscribe",
+  "git.status",
+  "git.diff",
+  "worktree.list",
+  "worktree.prepare_remove",
+  "worktree.remove",
+  "diagnostics.get"
+] as const;
+
+export type IpcMethod = (typeof IPC_METHODS)[number];
diff --git a/crates/core/src/protocol.rs b/crates/core/src/protocol.rs
index 254ee50..49b3cd4 100644
--- a/crates/core/src/protocol.rs
+++ b/crates/core/src/protocol.rs
@@ -278,6 +278,25 @@ mod tests {
         assert_eq!(catalog["protocolVersion"], PROTOCOL_V1);
         assert_eq!(catalog["applicationVersion"], APPLICATION_VERSION);
         assert_eq!(APPLICATION_VERSION, env!("CARGO_PKG_VERSION"));
+        assert_eq!(
+            catalog["methods"],
+            serde_json::json!(crate::wire::method::ALL)
+        );
+        assert_eq!(
+            catalog["events"],
+            serde_json::json!(crate::wire::event_name::ALL)
+        );
+    }
+
+    #[test]
+    fn typescript_method_mirror_matches_the_rust_catalog() {
+        let mirror = include_str!("../../../apps/desktop/src/ipc/methods.ts");
+        let (_, array) = mirror.split_once("= ").expect("method array assignment");
+        let (array, _) = array
+            .split_once(" as const;")
+            .expect("readonly method array");
+        let methods: Vec<String> = serde_json::from_str(array).expect("JSON method literals");
+        assert_eq!(methods, crate::wire::method::ALL);
     }
 
     #[test]
diff --git a/crates/core/src/wire/method.rs b/crates/core/src/wire/method.rs
index d4633ea..96bffd5 100644
--- a/crates/core/src/wire/method.rs
+++ b/crates/core/src/wire/method.rs
@@ -55,6 +55,8 @@ pub const GIT_STATUS: &str = "git.status";
 /// Read a bounded textual diff for a registered project, session, or worktree.
 pub const GIT_DIFF: &str = "git.diff";
 
+/// List managed worktrees, optionally constrained to a project.
+pub const WORKTREE_LIST: &str = "worktree.list";
 /// Inspect whether a managed worktree can be safely removed.
 pub const WORKTREE_PREPARE_REMOVE: &str = "worktree.prepare_remove";
 /// Remove a managed worktree after token-bound state confirmation.
@@ -90,6 +92,7 @@ pub const ALL: &[&str] = &[
     SESSION_UNSUBSCRIBE,
     GIT_STATUS,
     GIT_DIFF,
+    WORKTREE_LIST,
     WORKTREE_PREPARE_REMOVE,
     WORKTREE_REMOVE,
     DIAGNOSTICS_GET,
diff --git a/crates/core/src/wire/mod.rs b/crates/core/src/wire/mod.rs
index cc73091..71737a2 100644
--- a/crates/core/src/wire/mod.rs
+++ b/crates/core/src/wire/mod.rs
@@ -26,7 +26,7 @@ pub use request::{
     GitTarget, ProjectAddRequest, ProjectRemoveRequest, ProjectRenameRequest, SessionCreateRequest,
     SessionDeleteRequest, SessionIsolation, SessionListRequest, SessionRenameRequest,
     SessionResizeRequest, SessionRestartRequest, SessionStartRequest, SessionStopRequest,
-    SessionSubscribeRequest, SessionUnsubscribeRequest, SessionWriteRequest,
+    SessionSubscribeRequest, SessionUnsubscribeRequest, SessionWriteRequest, WorktreeListRequest,
     WorktreePrepareRemoveRequest, WorktreeRemoveRequest, validate_agent_command,
 };
 pub use response::{
@@ -37,7 +37,7 @@ pub use response::{
     ProjectListResponse, ProjectRemoveResponse, ProjectRenameResponse, SessionCreateResponse,
     SessionDeleteResponse, SessionListResponse, SessionRenameResponse, SessionResizeResponse,
     SessionRestartResponse, SessionStartResponse, SessionStopResponse, SessionSubscribeResponse,
-    SessionUnsubscribeResponse, SessionWriteResponse, StateSnapshotResponse,
+    SessionUnsubscribeResponse, SessionWriteResponse, StateSnapshotResponse, WorktreeListResponse,
     WorktreePrepareRemoveResponse, WorktreeRemovalBlocker, WorktreeRemoveResponse,
 };
 pub use value::{
diff --git a/crates/core/src/wire/request.rs b/crates/core/src/wire/request.rs
index 34632b1..2fbff93 100644
--- a/crates/core/src/wire/request.rs
+++ b/crates/core/src/wire/request.rs
@@ -464,6 +464,15 @@ pub struct GitDiffRequest {
     pub path: Option<GitRelativePath>,
 }
 
+/// Request to list managed worktrees, optionally for one project.
+#[derive(Clone, Copy, Debug, Default, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(deny_unknown_fields, rename_all = "camelCase")]
+pub struct WorktreeListRequest {
+    /// Project filter; omitted to return all managed worktrees.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub project_id: Option<ProjectId>,
+}
+
 /// Request to prepare safe managed-worktree removal.
 #[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
 #[serde(deny_unknown_fields, rename_all = "camelCase")]
diff --git a/crates/core/src/wire/response.rs b/crates/core/src/wire/response.rs
index 20afb29..1a059a9 100644
--- a/crates/core/src/wire/response.rs
+++ b/crates/core/src/wire/response.rs
@@ -235,6 +235,14 @@ pub struct GitDiffResponse {
     pub binary: bool,
 }
 
+/// Durable managed worktrees visible to the local client.
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct WorktreeListResponse {
+    /// Managed worktrees matching the requested project filter.
+    pub worktrees: Vec<Worktree>,
+}
+
 /// Safe reason a worktree cannot currently be removed.
 #[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
 #[serde(rename_all = "snake_case")]
diff --git a/crates/daemon/src/server.rs b/crates/daemon/src/server.rs
index 43ce49d..855d60a 100644
--- a/crates/daemon/src/server.rs
+++ b/crates/daemon/src/server.rs
@@ -17,7 +17,8 @@ use cli_master_core::{
         SessionOutputEvent, SessionOutputGapEvent, SessionRenameRequest,
         SessionReplayCompleteEvent, SessionResizeRequest, SessionRestartRequest,
         SessionStartRequest, SessionStatusChangedEvent, SessionStopRequest,
-        SessionSubscribeRequest, SessionWriteRequest, event_name, method,
+        SessionSubscribeRequest, SessionWriteRequest, WorktreeListRequest,
+        WorktreePrepareRemoveRequest, WorktreeRemoveRequest, event_name, method,
     },
 };
 use cli_master_git::Git;
@@ -59,13 +60,13 @@ pub struct HelloResponse {
 pub struct StateSnapshot {
     /// Applied `SQLite` schema migration version.
     pub schema_version: u32,
-    /// Registered projects. Empty until project persistence is wired in.
+    /// Registered projects.
     pub projects: Vec<Project>,
-    /// Available agent definitions. Empty until registry persistence is wired in.
+    /// Available agent definitions.
     pub agents: Vec<AgentRecord>,
-    /// Known sessions. Empty until the session manager is wired in.
+    /// Known sessions, including managed worktree associations.
     pub sessions: Vec<Session>,
-    /// Managed worktrees. Empty until Git orchestration is wired in.
+    /// Durable managed worktrees, including recoverable partial operations.
     pub worktrees: Vec<Worktree>,
 }
 
@@ -146,6 +147,8 @@ impl Daemon {
             sessions: SessionRegistry::new(
                 session_storage,
                 DaemonInstanceId::from_uuid(instance_id),
+                config.data_directory().join("worktrees"),
+                git.clone(),
             )
             .map_err(|error| {
                 DaemonError::initialization(
@@ -525,7 +528,10 @@ fn validate_peer(_stream: &UnixStream) -> Result<(), io::Error> {
     clippy::too_many_lines,
     reason = "the versioned IPC method table is intentionally kept in one auditable dispatcher"
 )]
-async fn dispatch(request: RequestEnvelope<Value>, state: &ServerState) -> ResponseEnvelope<Value> {
+async fn dispatch(
+    request: RequestEnvelope<Value>,
+    state: &Arc<ServerState>,
+) -> ResponseEnvelope<Value> {
     if request.kind != EnvelopeKind::Request {
         return ResponseEnvelope::failure(
             request.request_id,
@@ -560,7 +566,7 @@ async fn dispatch(request: RequestEnvelope<Value>, state: &ServerState) -> Respo
                 projects,
                 agents,
                 sessions,
-                worktrees: Vec::new(),
+                worktrees: state.sessions.worktrees()?,
             })
         }),
         method::PROJECT_ADD => decode_payload(request.payload)
@@ -582,27 +588,34 @@ async fn dispatch(request: RequestEnvelope<Value>, state: &ServerState) -> Respo
                 state.sessions.create_custom_agent(payload)
             })
             .and_then(encode_response),
-        method::SESSION_CREATE => decode_payload(request.payload)
-            .and_then(|payload: SessionCreateRequest| state.sessions.create(payload))
-            .and_then(encode_response),
+        method::SESSION_CREATE => match decode_payload::<SessionCreateRequest>(request.payload) {
+            Ok(payload) => session_operation(state, move |sessions| sessions.create(payload)).await,
+            Err(error) => Err(error),
+        },
         method::SESSION_LIST => decode_payload(request.payload)
             .and_then(|payload: SessionListRequest| state.sessions.list_sessions(payload))
             .and_then(encode_response),
         method::SESSION_RENAME => decode_payload(request.payload)
             .and_then(|payload: SessionRenameRequest| state.sessions.rename(&payload))
             .and_then(encode_response),
-        method::SESSION_START => decode_payload(request.payload)
-            .and_then(|payload: SessionStartRequest| state.sessions.start(payload))
-            .and_then(encode_response),
-        method::SESSION_RESTART => decode_payload(request.payload)
-            .and_then(|payload: SessionRestartRequest| state.sessions.restart(payload))
-            .and_then(encode_response),
-        method::SESSION_STOP => decode_payload(request.payload)
-            .and_then(|payload: SessionStopRequest| state.sessions.stop(payload))
-            .and_then(encode_response),
-        method::SESSION_DELETE => decode_payload(request.payload)
-            .and_then(|payload: SessionDeleteRequest| state.sessions.delete(payload))
-            .and_then(encode_response),
+        method::SESSION_START => match decode_payload::<SessionStartRequest>(request.payload) {
+            Ok(payload) => session_operation(state, move |sessions| sessions.start(payload)).await,
+            Err(error) => Err(error),
+        },
+        method::SESSION_RESTART => match decode_payload::<SessionRestartRequest>(request.payload) {
+            Ok(payload) => {
+                session_operation(state, move |sessions| sessions.restart(payload)).await
+            }
+            Err(error) => Err(error),
+        },
+        method::SESSION_STOP => match decode_payload::<SessionStopRequest>(request.payload) {
+            Ok(payload) => session_operation(state, move |sessions| sessions.stop(payload)).await,
+            Err(error) => Err(error),
+        },
+        method::SESSION_DELETE => match decode_payload::<SessionDeleteRequest>(request.payload) {
+            Ok(payload) => session_operation(state, move |sessions| sessions.delete(payload)).await,
+            Err(error) => Err(error),
+        },
         method::SESSION_WRITE => decode_payload(request.payload)
             .and_then(|payload: SessionWriteRequest| state.sessions.write(&payload))
             .and_then(encode_response),
@@ -610,6 +623,26 @@ async fn dispatch(request: RequestEnvelope<Value>, state: &ServerState) -> Respo
             .and_then(|payload: SessionResizeRequest| state.sessions.resize(payload))
             .and_then(encode_response),
         method::SESSION_UNSUBSCRIBE => encode_response(EmptyResponse::default()),
+        method::WORKTREE_LIST => decode_payload(request.payload)
+            .and_then(|payload: WorktreeListRequest| state.sessions.list_worktrees(payload))
+            .and_then(encode_response),
+        method::WORKTREE_PREPARE_REMOVE => {
+            match decode_payload::<WorktreePrepareRemoveRequest>(request.payload) {
+                Ok(payload) => {
+                    session_operation(state, move |sessions| {
+                        sessions.prepare_worktree_removal(payload)
+                    })
+                    .await
+                }
+                Err(error) => Err(error),
+            }
+        }
+        method::WORKTREE_REMOVE => match decode_payload::<WorktreeRemoveRequest>(request.payload) {
+            Ok(payload) => {
+                session_operation(state, move |sessions| sessions.remove_worktree(&payload)).await
+            }
+            Err(error) => Err(error),
+        },
         method::DIAGNOSTICS_GET => encode_response(&state.diagnostics),
         method::GIT_STATUS => match decode_payload::<GitStatusRequest>(request.payload) {
             Ok(payload) => {
@@ -642,6 +675,23 @@ async fn dispatch(request: RequestEnvelope<Value>, state: &ServerState) -> Respo
     }
 }
 
+/// Git and PTY lifecycle calls may block; keep client I/O and output delivery responsive.
+async fn session_operation<T, F>(state: &Arc<ServerState>, operation: F) -> Result<Value, ApiError>
+where
+    T: Serialize,
+    F: FnOnce(&SessionRegistry) -> Result<T, ApiError> + Send + 'static,
+{
+    let state = Arc::clone(state);
+    tokio::task::spawn_blocking(move || operation(&state.sessions).and_then(encode_response))
+        .await
+        .map_err(|_| {
+            ApiError::new(
+                "session_operation_failed",
+                "The session operation could not complete.",
+            )
+        })?
+}
+
 fn decode_payload<T>(payload: Value) -> Result<T, ApiError>
 where
     T: for<'de> Deserialize<'de>,
diff --git a/crates/daemon/src/sessions.rs b/crates/daemon/src/sessions.rs
index 1192e5c..625938b 100644
--- a/crates/daemon/src/sessions.rs
+++ b/crates/daemon/src/sessions.rs
@@ -1,7 +1,7 @@
 use std::collections::BTreeMap;
 use std::env;
 use std::path::{Path, PathBuf};
-use std::sync::{Arc, Mutex, MutexGuard};
+use std::sync::{Arc, Mutex, MutexGuard, Weak};
 use std::time::{SystemTime, UNIX_EPOCH};
 
 use cli_master_core::wire::{
@@ -14,12 +14,16 @@ use cli_master_core::wire::{
 use cli_master_core::{
     AgentId, AgentSource, ApiError, DaemonInstanceId, Project, Session, SessionId, SessionStatus,
 };
+use cli_master_git::Git;
 use cli_master_session::{
-    SessionError, SessionManager, SessionSnapshot, SessionSubscription, TerminalSize,
+    SessionError, SessionManager, SessionSnapshot, SessionSubscription, SessionWorktreeSaga,
+    TerminalSize,
 };
 use cli_master_storage::{SessionRuntimeUpdate, Storage, StorageError, StoredAgent, StoredSession};
 use uuid::Uuid;
 
+mod worktrees;
+
 const INITIAL_COLUMNS: u16 = 100;
 const INITIAL_ROWS: u16 = 30;
 const SHELL_AGENT_ID: u128 = 0x018f_0000_0000_7000_8000_0000_0000_0001;
@@ -32,17 +36,44 @@ pub(super) struct SessionRegistry {
     storage: Arc<Mutex<Storage>>,
     manager: SessionManager,
     daemon_instance_id: DaemonInstanceId,
+    worktree_saga: Option<SessionWorktreeSaga<SessionManager>>,
+    git: Option<Git>,
+    managed_root: PathBuf,
+    /// Serializes start/delete/removal so Git cannot remove a directory during spawn.
+    lifecycle: Mutex<()>,
+    session_operations: Mutex<BTreeMap<SessionId, Weak<Mutex<()>>>>,
 }
 
 impl SessionRegistry {
     pub(super) fn new(
         storage: Storage,
         daemon_instance_id: DaemonInstanceId,
+        managed_root: PathBuf,
+        git: Option<Git>,
     ) -> Result<Self, ApiError> {
+        let storage = Arc::new(Mutex::new(storage));
+        let manager = SessionManager::default();
+        let worktree_saga = git
+            .clone()
+            .map(|git| {
+                SessionWorktreeSaga::new_with_shared_storage(
+                    git,
+                    Arc::clone(&storage),
+                    manager.clone(),
+                    daemon_instance_id.to_string(),
+                )
+            })
+            .transpose()
+            .map_err(worktrees::saga_error)?;
         let registry = Self {
-            storage: Arc::new(Mutex::new(storage)),
-            manager: SessionManager::default(),
+            storage,
+            manager,
             daemon_instance_id,
+            worktree_saga,
+            git,
+            managed_root,
+            lifecycle: Mutex::new(()),
+            session_operations: Mutex::new(BTreeMap::new()),
         };
         registry.seed_builtin_agents()?;
         let now = unix_timestamp_ms()?;
@@ -50,6 +81,9 @@ impl SessionRegistry {
             .storage()?
             .recover_stale_sessions_for_daemon(&daemon_instance_id.to_string(), now)
             .map_err(storage_error)?;
+        if let Some(saga) = &registry.worktree_saga {
+            saga.recover().map_err(worktrees::saga_error)?;
+        }
         Ok(registry)
     }
 
@@ -115,10 +149,8 @@ impl SessionRegistry {
     }
 
     pub(super) fn sessions(&self) -> Result<Vec<Session>, ApiError> {
-        self.storage()?
-            .list_sessions()
-            .map_err(storage_error)
-            .map(|sessions| sessions.into_iter().map(stored_session).collect())
+        self.list_sessions(SessionListRequest { project_id: None })
+            .map(|response| response.sessions)
     }
 
     pub(super) fn list_sessions(
@@ -132,18 +164,18 @@ impl SessionRegistry {
         }
         .map_err(storage_error)?
         .into_iter()
-        .map(stored_session)
-        .collect();
+        .map(|session| worktrees::session_with_worktree(&storage, session))
+        .collect::<Result<Vec<_>, _>>()?;
         Ok(SessionListResponse { sessions })
     }
 
     pub(super) fn create(&self, request: SessionCreateRequest) -> Result<Session, ApiError> {
-        if request.isolation != SessionIsolation::Current {
-            return Err(ApiError::new(
-                "worktree_sessions_unavailable",
-                "Isolated worktree sessions are not available in this canvas yet.",
-            )
-            .with_action("Choose the current project directory and try again."));
+        let _lifecycle = self.lifecycle()?;
+        if let Some(saga) = &self.worktree_saga {
+            return self.prepare_with_saga(saga, request);
+        }
+        if request.isolation == SessionIsolation::NewWorktree {
+            return Err(worktrees::git_unavailable());
         }
         let storage = self.storage()?;
         let project = storage
@@ -192,10 +224,16 @@ impl SessionRegistry {
     }
 
     pub(super) fn start(&self, request: SessionStartRequest) -> Result<Session, ApiError> {
+        let operation = self.session_operation(request.session_id)?;
+        let _session = operation.lock().map_err(|_| session_state_unavailable())?;
+        let _lifecycle = self.lifecycle()?;
         self.start_id(request.session_id)
     }
 
     pub(super) fn restart(&self, request: SessionRestartRequest) -> Result<Session, ApiError> {
+        let operation = self.session_operation(request.session_id)?;
+        let _session = operation.lock().map_err(|_| session_state_unavailable())?;
+        let _lifecycle = self.lifecycle()?;
         if let Ok(snapshot) = self.manager.snapshot(request.session_id) {
             if is_live(snapshot.status) {
                 self.manager
@@ -210,6 +248,9 @@ impl SessionRegistry {
     }
 
     pub(super) fn stop(&self, request: SessionStopRequest) -> Result<Session, ApiError> {
+        // Stopping only reduces worktree use. Do not queue it behind a slow checkout.
+        let operation = self.session_operation(request.session_id)?;
+        let _session = operation.lock().map_err(|_| session_state_unavailable())?;
         let snapshot = self
             .manager
             .stop(request.session_id)
@@ -219,6 +260,9 @@ impl SessionRegistry {
     }
 
     pub(super) fn delete(&self, request: SessionDeleteRequest) -> Result<EmptyResponse, ApiError> {
+        let operation = self.session_operation(request.session_id)?;
+        let _session = operation.lock().map_err(|_| session_state_unavailable())?;
+        let _lifecycle = self.lifecycle()?;
         if let Ok(snapshot) = self.manager.snapshot(request.session_id) {
             if is_live(snapshot.status) {
                 return Err(ApiError::new(
@@ -227,10 +271,17 @@ impl SessionRegistry {
                 )
                 .with_action("Stop the session, then try deleting it again."));
             }
+            // A process may have exited while no client was subscribed to its events.
+            self.persist_snapshot(&snapshot)?;
             self.manager
                 .remove(request.session_id)
                 .map_err(session_error)?;
         }
+        if let Some(saga) = &self.worktree_saga {
+            saga.delete_session(request.session_id)
+                .map_err(worktrees::saga_error)?;
+            return Ok(EmptyResponse::default());
+        }
         self.storage()?
             .remove_session_metadata(request.session_id)
             .map_err(storage_error)?;
@@ -311,7 +362,7 @@ impl SessionRegistry {
             .ok_or_else(|| not_found("session", session_id))?;
         if let Ok(snapshot) = self.manager.snapshot(session_id) {
             if is_live(snapshot.status) {
-                return Ok(stored_session(stored));
+                return worktrees::session_with_worktree(&storage, stored);
             }
             self.manager.remove(session_id).map_err(session_error)?;
         }
@@ -319,8 +370,19 @@ impl SessionRegistry {
             .get_agent(stored.agent_id)
             .map_err(storage_error)?
             .ok_or_else(|| not_found("agent", stored.agent_id))?;
+        if !agent.enabled {
+            return Err(ApiError::new(
+                "agent_disabled",
+                "The selected terminal command is disabled.",
+            ));
+        }
         let command = agent.command_for_cwd(&stored.cwd).map_err(storage_error)?;
         drop(storage);
+        let worktree_id = self.validate_start_directory(&stored)?;
+        if let (Some(saga), Some(worktree_id)) = (&self.worktree_saga, worktree_id) {
+            saga.cancel_pending_removal(worktree_id)
+                .map_err(worktrees::saga_error)?;
+        }
         let size = TerminalSize::new(INITIAL_ROWS, INITIAL_COLUMNS).map_err(session_error)?;
         let handle = self
             .manager
@@ -328,7 +390,11 @@ impl SessionRegistry {
             .map_err(session_error)?;
         let snapshot = self.manager.snapshot(session_id).map_err(session_error)?;
         debug_assert_eq!(handle.id, session_id);
-        self.persist_snapshot(&snapshot)?;
+        if let Err(error) = self.persist_snapshot(&snapshot) {
+            cli_master_session::SessionSpawner::rollback(&self.manager, session_id)
+                .map_err(worktrees::saga_error)?;
+            return Err(error);
+        }
         self.get(session_id)
     }
 
@@ -378,6 +444,34 @@ impl SessionRegistry {
             .with_action("Restart Jig and try again.")
         })
     }
+
+    fn lifecycle(&self) -> Result<MutexGuard<'_, ()>, ApiError> {
+        self.lifecycle
+            .lock()
+            .map_err(|_| session_state_unavailable())
+    }
+
+    fn session_operation(&self, session_id: SessionId) -> Result<Arc<Mutex<()>>, ApiError> {
+        let mut operations = self
+            .session_operations
+            .lock()
+            .map_err(|_| session_state_unavailable())?;
+        operations.retain(|_, operation| operation.strong_count() > 0);
+        if let Some(operation) = operations.get(&session_id).and_then(Weak::upgrade) {
+            return Ok(operation);
+        }
+        let operation = Arc::new(Mutex::new(()));
+        operations.insert(session_id, Arc::downgrade(&operation));
+        Ok(operation)
+    }
+}
+
+fn session_state_unavailable() -> ApiError {
+    ApiError::new(
+        "session_state_unavailable",
+        "Session operations are unavailable.",
+    )
+    .with_action("Restart the daemon and try again.")
 }
 
 fn agent_record(agent: StoredAgent) -> Result<AgentRecord, ApiError> {
@@ -421,18 +515,18 @@ fn stored_session(session: StoredSession) -> Session {
 }
 
 fn load_session(storage: &Storage, session_id: SessionId) -> Result<Session, ApiError> {
-    storage
+    let session = storage
         .get_session(session_id)
         .map_err(storage_error)?
-        .map(stored_session)
-        .ok_or_else(|| not_found("session", session_id))
+        .ok_or_else(|| not_found("session", session_id))?;
+    worktrees::session_with_worktree(storage, session)
 }
 
 fn session_directory(
     project: &Project,
     relative_directory: Option<&cli_master_core::wire::RelativeDirectory>,
 ) -> Result<PathBuf, ApiError> {
-    let root = project.repository_root.as_ref().unwrap_or(&project.path);
+    let root = &project.path;
     let directory =
         relative_directory.map_or_else(|| root.clone(), |relative| root.join(relative.as_str()));
     if !directory.is_dir() {
@@ -442,14 +536,27 @@ fn session_directory(
         )
         .with_action("Choose an existing directory inside the project."));
     }
-    directory.canonicalize().map_err(|error| {
+    let canonical = directory.canonicalize().map_err(|error| {
         ApiError::new(
             "session_directory_unavailable",
             "The terminal working directory could not be opened.",
         )
         .with_action("Check the directory permissions and try again.")
         .with_detail("reason", error.to_string())
-    })
+    })?;
+    let root = root.canonicalize().map_err(|_| {
+        ApiError::new(
+            "session_directory_unavailable",
+            "The project directory could not be opened.",
+        )
+    })?;
+    if !canonical.starts_with(&root) {
+        return Err(ApiError::new(
+            "session_invalid_input",
+            "The terminal directory escapes the project.",
+        ));
+    }
+    Ok(canonical)
 }
 
 fn resolve_executable(executable: &str) -> Option<PathBuf> {
diff --git a/crates/daemon/src/sessions/worktrees.rs b/crates/daemon/src/sessions/worktrees.rs
new file mode 100644
index 0000000..9c8f4d0
--- /dev/null
+++ b/crates/daemon/src/sessions/worktrees.rs
@@ -0,0 +1,267 @@
+use cli_master_core::wire::{
+    SessionCreateRequest, WorktreeListRequest, WorktreeListResponse, WorktreePrepareRemoveRequest,
+    WorktreePrepareRemoveResponse, WorktreeRemovalBlocker, WorktreeRemoveRequest,
+};
+use cli_master_core::{ApiError, Session, Worktree, WorktreeState};
+use cli_master_session::{CreateSession, SagaError, SessionManager, SessionWorktreeSaga};
+use cli_master_storage::{Storage, StoredSession, StoredWorktree};
+
+use super::{SessionRegistry, not_found, storage_error, stored_session};
+
+impl SessionRegistry {
+    pub(super) fn prepare_with_saga(
+        &self,
+        saga: &SessionWorktreeSaga<SessionManager>,
+        request: SessionCreateRequest,
+    ) -> Result<Session, ApiError> {
+        // The root belongs to the daemon; callers cannot supply paths or branches.
+        let creation = CreateSession {
+            project_id: request.project_id,
+            agent_id: request.agent_id,
+            name: request.name.into_inner(),
+            isolation: request.isolation,
+            managed_root: self.managed_root.join(request.project_id.to_string()),
+            short_id: None,
+        };
+        saga.prepare_session(&creation, request.relative_directory.as_ref())
+            .map(|created| created.session)
+            .map_err(saga_error)
+    }
+
+    pub(crate) fn worktrees(&self) -> Result<Vec<Worktree>, ApiError> {
+        self.list_worktrees(WorktreeListRequest::default())
+            .map(|response| response.worktrees)
+    }
+
+    pub(crate) fn list_worktrees(
+        &self,
+        request: WorktreeListRequest,
+    ) -> Result<WorktreeListResponse, ApiError> {
+        let storage = self.storage()?;
+        let worktrees = match request.project_id {
+            Some(project_id) => storage.list_worktrees_for_project(project_id),
+            None => storage.list_worktrees(),
+        }
+        .map_err(storage_error)?;
+        Ok(WorktreeListResponse {
+            worktrees: worktrees.into_iter().map(worktree_dto).collect(),
+        })
+    }
+
+    pub(crate) fn prepare_worktree_removal(
+        &self,
+        request: WorktreePrepareRemoveRequest,
+    ) -> Result<WorktreePrepareRemoveResponse, ApiError> {
+        let _lifecycle = self.lifecycle()?;
+        let saga = self.worktree_saga.as_ref().ok_or_else(git_unavailable)?;
+        if self.has_live_worktree_user(request.worktree_id)? {
+            return Ok(WorktreePrepareRemoveResponse::Blocked {
+                worktree_id: request.worktree_id,
+                is_dirty: self
+                    .storage()?
+                    .get_worktree(request.worktree_id)
+                    .map_err(storage_error)?
+                    .is_some_and(|worktree| worktree.is_dirty),
+                blockers: vec![
+                    WorktreeRemovalBlocker::Running,
+                    WorktreeRemovalBlocker::InUse,
+                ],
+            });
+        }
+        saga.prepare_remove(request.worktree_id).map_err(saga_error)
+    }
+
+    pub(crate) fn remove_worktree(
+        &self,
+        request: &WorktreeRemoveRequest,
+    ) -> Result<cli_master_core::wire::EmptyResponse, ApiError> {
+        let _lifecycle = self.lifecycle()?;
+        let saga = self.worktree_saga.as_ref().ok_or_else(git_unavailable)?;
+        if self.has_live_worktree_user(request.worktree_id)? {
+            return Err(ApiError::new(
+                "worktree_confirmation_invalid",
+                "A live session now uses this worktree.",
+            )
+            .with_action("Stop its sessions and prepare removal again."));
+        }
+        saga.remove_worktree(request.worktree_id, &request.confirmation_token)
+            .map_err(saga_error)?;
+        Ok(cli_master_core::wire::EmptyResponse::default())
+    }
+
+    fn has_live_worktree_user(
+        &self,
+        worktree_id: cli_master_core::WorktreeId,
+    ) -> Result<bool, ApiError> {
+        let (worktree, sessions) = {
+            let storage = self.storage()?;
+            let worktree = storage
+                .get_worktree(worktree_id)
+                .map_err(storage_error)?
+                .ok_or_else(|| not_found("worktree", worktree_id))?;
+            let sessions = storage.list_sessions().map_err(storage_error)?;
+            (worktree, sessions)
+        };
+        let root = worktree.path.canonicalize().unwrap_or(worktree.path);
+        let mut live = false;
+        for session in sessions {
+            // Also cover sessions registered directly at this worktree or a child folder.
+            let cwd = session.cwd.canonicalize().unwrap_or(session.cwd);
+            if worktree.session_id == Some(session.id) || cwd.starts_with(&root) {
+                if let Ok(snapshot) = self.manager.snapshot(session.id) {
+                    self.persist_snapshot(&snapshot)?;
+                    live |= snapshot.status.is_live();
+                } else {
+                    live |= session.status.is_live();
+                }
+            }
+        }
+        Ok(live)
+    }
+}
+
+pub(super) fn session_with_worktree(
+    storage: &Storage,
+    stored: StoredSession,
+) -> Result<Session, ApiError> {
+    let worktree = storage
+        .list_worktrees_for_project(stored.project_id)
+        .map_err(storage_error)?
+        .into_iter()
+        .find(|worktree| worktree.session_id == Some(stored.id));
+    let mut session = stored_session(stored);
+    if let Some(worktree) = worktree {
+        session.branch = Some(worktree.branch);
+        session.worktree_id = Some(worktree.id);
+        session.worktree_path = Some(worktree.path);
+    }
+    Ok(session)
+}
+
+impl SessionRegistry {
+    pub(super) fn validate_start_directory(
+        &self,
+        stored: &StoredSession,
+    ) -> Result<Option<cli_master_core::WorktreeId>, ApiError> {
+        let (project, worktree) = {
+            let storage = self.storage()?;
+            let project = storage
+                .get_project(stored.project_id)
+                .map_err(storage_error)?
+                .ok_or_else(|| not_found("project", stored.project_id))?;
+            let worktree = storage
+                .list_worktrees_for_project(stored.project_id)
+                .map_err(storage_error)?
+                .into_iter()
+                .find(|worktree| worktree.session_id == Some(stored.id));
+            (project, worktree)
+        };
+        let worktree_id = worktree.as_ref().map(|worktree| worktree.id);
+        let root = if let Some(worktree) = worktree {
+            if !matches!(
+                worktree.state,
+                cli_master_storage::WorktreeState::Active
+                    | cli_master_storage::WorktreeState::RemovePending
+            ) {
+                return Err(
+                    ApiError::new("worktree_not_active", "This worktree needs recovery.")
+                        .with_action("Resolve the incomplete operation before starting."),
+                );
+            }
+            if worktree
+                .path
+                .canonicalize()
+                .map_err(|_| directory_unavailable())?
+                != worktree.path
+            {
+                return Err(directory_unavailable());
+            }
+            let git = self.git.as_ref().ok_or_else(git_unavailable)?;
+            let registered = git
+                .list_worktrees(&project.path)
+                .map_err(|error| saga_error(error.into()))?;
+            let inspection = git
+                .inspect_repository(&worktree.path)
+                .map_err(|error| saga_error(error.into()))?;
+            if inspection.repository_root.as_ref() != Some(&worktree.path)
+                || inspection.branch.as_deref() != Some(worktree.branch.as_str())
+                || !registered.iter().any(|entry| {
+                    entry.path == worktree.path
+                        && entry.branch.as_deref() == Some(worktree.branch.as_str())
+                        && !entry.prunable
+                })
+            {
+                return Err(ApiError::new(
+                    "worktree_identity_changed",
+                    "The managed Git worktree identity changed.",
+                )
+                .with_action("Restore the original worktree or create a new isolated session."));
+            }
+            worktree.path
+        } else {
+            project.path
+        };
+        let canonical_root = root.canonicalize().map_err(|_| directory_unavailable())?;
+        let cwd = stored
+            .cwd
+            .canonicalize()
+            .map_err(|_| directory_unavailable())?;
+        if canonical_root != root || cwd != stored.cwd || !cwd.is_dir() || !cwd.starts_with(root) {
+            return Err(directory_unavailable());
+        }
+        Ok(worktree_id)
+    }
+}
+
+fn directory_unavailable() -> ApiError {
+    ApiError::new(
+        "session_directory_unavailable",
+        "The session directory is missing or outside its project/worktree.",
+    )
+    .with_action("Restore the directory or create a session in an existing project folder.")
+}
+
+fn worktree_dto(stored: StoredWorktree) -> Worktree {
+    Worktree {
+        id: stored.id,
+        project_id: stored.project_id,
+        session_id: stored.session_id,
+        path: stored.path,
+        branch: stored.branch,
+        is_dirty: stored.is_dirty,
+        state: match stored.state {
+            cli_master_storage::WorktreeState::Creating => WorktreeState::Creating,
+            cli_master_storage::WorktreeState::Active => WorktreeState::Active,
+            cli_master_storage::WorktreeState::RemovePending => WorktreeState::RemovePending,
+            cli_master_storage::WorktreeState::Orphaned => WorktreeState::Orphaned,
+        },
+        created_at_ms: stored.created_at_ms,
+        updated_at_ms: stored.updated_at_ms,
+    }
+}
+
+pub(super) fn git_unavailable() -> ApiError {
+    ApiError::new(
+        "git_unavailable",
+        "Git is required to manage isolated worktrees.",
+    )
+    .with_action("Install Git and restart the daemon.")
+}
+
+#[allow(
+    clippy::needless_pass_by_value,
+    reason = "owned adapter for Result::map_err"
+)]
+pub(super) fn saga_error(error: SagaError) -> ApiError {
+    let mut api = ApiError::new(error.code(), error.message()).with_action(error.action());
+    if let Some(path) = error.path() {
+        api = api.with_detail("path", path.to_string_lossy().into_owned());
+    }
+    if let Some(id) = error.worktree_id() {
+        api = api.with_detail("worktreeId", id.to_string());
+    }
+    if let Some(id) = error.session_id() {
+        api = api.with_detail("sessionId", id.to_string());
+    }
+    api
+}
diff --git a/crates/daemon/tests/worktree_ipc.rs b/crates/daemon/tests/worktree_ipc.rs
new file mode 100644
index 0000000..98f36fe
--- /dev/null
+++ b/crates/daemon/tests/worktree_ipc.rs
@@ -0,0 +1,831 @@
+use std::collections::BTreeMap;
+use std::fs;
+use std::os::unix::fs::symlink;
+use std::path::{Path, PathBuf};
+use std::process::Command;
+use std::time::Duration;
+
+use cli_master_core::wire::{
+    AgentRecord, ConfirmationToken, StateSnapshotResponse, WorktreeListResponse,
+    WorktreePrepareRemoveResponse, WorktreeRemovalBlocker, method,
+};
+use cli_master_core::{
+    AgentId, CommandSpec, Project, ProjectId, RequestEnvelope, ResponseEnvelope, ResponsePayload,
+    Session, SessionStatus, Worktree, WorktreeId, WorktreeState,
+};
+use cli_master_daemon::{Daemon, DaemonConfig, DaemonError, MAX_FRAME_LENGTH};
+use cli_master_session::{SessionManager, SessionManagerConfig, TerminalSize};
+use cli_master_storage::{SessionRuntimeUpdate, Storage};
+use futures_util::{SinkExt, StreamExt};
+use serde::de::DeserializeOwned;
+use serde_json::{Value, json};
+use tempfile::TempDir;
+use tokio::net::UnixStream;
+use tokio::task::JoinHandle;
+use tokio_util::codec::{Framed, LengthDelimitedCodec};
+use tokio_util::sync::CancellationToken;
+
+type Client = Framed<UnixStream, LengthDelimitedCodec>;
+
+struct RunningDaemon {
+    config: DaemonConfig,
+    cancellation: CancellationToken,
+    task: JoinHandle<Result<(), DaemonError>>,
+}
+
+impl RunningDaemon {
+    fn start(root: &Path) -> Self {
+        let config = DaemonConfig::from_paths(root.join("data"), root.join("run"));
+        let daemon = Daemon::bind(config.clone()).expect("daemon should bind");
+        let cancellation = CancellationToken::new();
+        let task_cancellation = cancellation.clone();
+        let task = tokio::spawn(async move { daemon.run(task_cancellation).await });
+        Self {
+            config,
+            cancellation,
+            task,
+        }
+    }
+
+    async fn connect(&self) -> Client {
+        let stream = UnixStream::connect(self.config.socket_path())
+            .await
+            .expect("client should connect");
+        LengthDelimitedCodec::builder()
+            .max_frame_length(MAX_FRAME_LENGTH)
+            .new_framed(stream)
+    }
+
+    async fn stop(self) {
+        self.cancellation.cancel();
+        tokio::time::timeout(Duration::from_secs(10), self.task)
+            .await
+            .expect("daemon should stop before timeout")
+            .expect("daemon task should join")
+            .expect("daemon should stop cleanly");
+    }
+}
+
+struct Fixture {
+    root: TempDir,
+    repository: PathBuf,
+    observed_cwd: PathBuf,
+    project_id: ProjectId,
+    agent_id: AgentId,
+}
+
+impl Fixture {
+    async fn new(project_directory: &str) -> (Self, RunningDaemon, Client) {
+        let root = TempDir::new().expect("temporary directory should exist");
+        let repository = root.path().join("repository");
+        fs::create_dir_all(repository.join("apps/api")).unwrap();
+        fs::write(repository.join("apps/api/tracked.txt"), "original\n").unwrap();
+        git(&repository, &["init", "-b", "main"]);
+        git(
+            &repository,
+            &["config", "user.email", "tests@example.invalid"],
+        );
+        git(&repository, &["config", "user.name", "CLI Master Tests"]);
+        git(&repository, &["add", "."]);
+        git(&repository, &["commit", "-m", "initial"]);
+        let script = root.path().join("observe-cwd.sh");
+        fs::write(&script, "pwd -P > \"$1\"\nexec /bin/cat\n").unwrap();
+        let observed_cwd = root.path().join("observed-cwd");
+        let daemon = RunningDaemon::start(root.path());
+        let mut client = daemon.connect().await;
+        let project: Project = call(
+            &mut client,
+            method::PROJECT_ADD,
+            json!({"path": repository.join(project_directory)}),
+        )
+        .await;
+        let agent: AgentRecord = call(
+            &mut client,
+            method::AGENT_CUSTOM_CREATE,
+            json!({
+                "displayName": "Worktree fixture",
+                "command": {
+                    "executable": "/bin/sh",
+                    "args": [script, observed_cwd],
+                    "env": {}
+                }
+            }),
+        )
+        .await;
+        (
+            Self {
+                root,
+                repository,
+                observed_cwd,
+                project_id: project.id,
+                agent_id: agent.id,
+            },
+            daemon,
+            client,
+        )
+    }
+
+    async fn create(&self, client: &mut Client, relative_directory: Option<&str>) -> Session {
+        let mut payload = json!({
+            "projectId": self.project_id,
+            "agentId": self.agent_id,
+            "name": "Isolated task",
+            "isolation": "new_worktree"
+        });
+        if let Some(relative_directory) = relative_directory {
+            payload["relativeDirectory"] = json!(relative_directory);
+        }
+        call(client, method::SESSION_CREATE, payload).await
+    }
+}
+
+fn git(cwd: &Path, args: &[&str]) {
+    let output = Command::new("git")
+        .args(args)
+        .current_dir(cwd)
+        .env("GIT_TERMINAL_PROMPT", "0")
+        .output()
+        .expect("git fixture should start");
+    assert!(
+        output.status.success(),
+        "git {args:?}: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+}
+
+async fn exchange(client: &mut Client, method: &str, payload: Value) -> ResponseEnvelope<Value> {
+    let request = RequestEnvelope::v1(method, payload);
+    client
+        .send(serde_json::to_vec(&request).unwrap().into())
+        .await
+        .expect("request should send");
+    tokio::time::timeout(Duration::from_secs(5), async {
+        loop {
+            let bytes = client
+                .next()
+                .await
+                .expect("response frame should arrive")
+                .expect("frame should be valid");
+            let envelope: Value = serde_json::from_slice(&bytes).unwrap();
+            if envelope["kind"] == "event" {
+                continue;
+            }
+            let response: ResponseEnvelope<Value> = serde_json::from_value(envelope).unwrap();
+            assert_eq!(response.request_id, request.request_id);
+            return response;
+        }
+    })
+    .await
+    .unwrap_or_else(|_| panic!("{method} should respond before timeout"))
+}
+
+async fn call<T: DeserializeOwned>(client: &mut Client, method: &str, payload: Value) -> T {
+    match exchange(client, method, payload).await.payload {
+        ResponsePayload::Success { data } => {
+            serde_json::from_value(data).expect("response should match its wire DTO")
+        }
+        ResponsePayload::Error { error } => panic!("{method} failed: {error:?}"),
+    }
+}
+
+async fn failure(client: &mut Client, method: &str, payload: Value) -> String {
+    match exchange(client, method, payload).await.payload {
+        ResponsePayload::Error { error } => error.code,
+        ResponsePayload::Success { data } => panic!("{method} unexpectedly succeeded: {data}"),
+    }
+}
+
+async fn worktrees(client: &mut Client, project_id: Option<ProjectId>) -> Vec<Worktree> {
+    let payload = project_id.map_or_else(|| json!({}), |id| json!({"projectId": id}));
+    let response: WorktreeListResponse = call(client, method::WORKTREE_LIST, payload).await;
+    response.worktrees
+}
+
+async fn prepare(client: &mut Client, worktree_id: WorktreeId) -> WorktreePrepareRemoveResponse {
+    call(
+        client,
+        method::WORKTREE_PREPARE_REMOVE,
+        json!({"worktreeId": worktree_id}),
+    )
+    .await
+}
+
+async fn ready_token(client: &mut Client, worktree_id: WorktreeId) -> ConfirmationToken {
+    let response = prepare(client, worktree_id).await;
+    let WorktreePrepareRemoveResponse::Ready {
+        worktree_id: prepared_id,
+        confirmation_token,
+        expires_at_ms,
+    } = response
+    else {
+        panic!("clean unused worktree should be removable: {response:?}");
+    };
+    assert_eq!(prepared_id, worktree_id);
+    assert!(expires_at_ms > 1_700_000_000_000);
+    confirmation_token
+}
+
+async fn remove(client: &mut Client, worktree_id: WorktreeId, token: ConfirmationToken) {
+    let _: Value = call(
+        client,
+        method::WORKTREE_REMOVE,
+        json!({"worktreeId": worktree_id, "confirmationToken": token}),
+    )
+    .await;
+}
+
+async fn wait_for_file(path: &Path) -> String {
+    tokio::time::timeout(Duration::from_secs(5), async {
+        loop {
+            if let Ok(contents) = fs::read_to_string(path) {
+                if !contents.is_empty() {
+                    return contents;
+                }
+            }
+            tokio::time::sleep(Duration::from_millis(10)).await;
+        }
+    })
+    .await
+    .expect("child should report before timeout")
+}
+
+#[tokio::test]
+#[allow(
+    clippy::too_many_lines,
+    reason = "one socket lifecycle proves preparation, launch and independent metadata deletion"
+)]
+async fn create_prepares_without_spawning_then_start_uses_the_isolated_subdirectory() {
+    let (fixture, daemon, mut client) = Fixture::new("").await;
+    let created = fixture.create(&mut client, Some("apps/api")).await;
+    let worktree_id = created
+        .worktree_id
+        .expect("session should identify its worktree");
+    let path = created.worktree_path.as_ref().expect("worktree path");
+    assert_eq!(created.status, SessionStatus::Unknown);
+    assert_eq!(created.pid, None);
+    assert_eq!(created.pty_id, None);
+    assert_eq!(
+        failure(
+            &mut client,
+            method::SESSION_WRITE,
+            json!({"sessionId": created.id, "base64": "eA=="})
+        )
+        .await,
+        "session_not_found",
+        "prepared metadata must not have a writable PTY"
+    );
+    assert_eq!(created.cwd, path.join("apps/api"));
+    assert!(
+        !fixture.observed_cwd.exists(),
+        "create must not run the command"
+    );
+    assert_eq!(
+        fs::read_to_string(created.cwd.join("tracked.txt")).unwrap(),
+        "original\n"
+    );
+    assert_ne!(path, &fixture.repository);
+
+    let snapshot: StateSnapshotResponse =
+        call(&mut client, method::STATE_SNAPSHOT, json!({})).await;
+    assert_eq!(snapshot.sessions, std::slice::from_ref(&created));
+    let listed = worktrees(&mut client, Some(fixture.project_id)).await;
+    assert_eq!(snapshot.worktrees, listed);
+    assert_eq!(listed.len(), 1);
+    assert_eq!(listed[0].id, worktree_id);
+    assert_eq!(listed[0].session_id, Some(created.id));
+    assert_eq!(listed[0].path, *path);
+    assert_eq!(Some(&listed[0].branch), created.branch.as_ref());
+    assert_eq!(listed[0].state, WorktreeState::Active);
+    assert!(
+        worktrees(&mut client, Some(ProjectId::new()))
+            .await
+            .is_empty()
+    );
+
+    let started: Session = call(
+        &mut client,
+        method::SESSION_START,
+        json!({"sessionId": created.id}),
+    )
+    .await;
+    assert!(started.status.is_live());
+    assert!(started.pid.is_some());
+    assert!(started.pty_id.is_some());
+    assert_eq!(started.worktree_id, Some(worktree_id));
+    assert_eq!(started.cwd, created.cwd);
+    assert_eq!(
+        PathBuf::from(wait_for_file(&fixture.observed_cwd).await.trim()),
+        created.cwd
+    );
+
+    let _: Session = call(
+        &mut client,
+        method::SESSION_STOP,
+        json!({"sessionId": created.id}),
+    )
+    .await;
+    let _: Value = call(
+        &mut client,
+        method::SESSION_DELETE,
+        json!({"sessionId": created.id}),
+    )
+    .await;
+    assert!(
+        path.join("apps/api/tracked.txt").is_file(),
+        "deleting metadata must preserve the checkout"
+    );
+    let snapshot: StateSnapshotResponse =
+        call(&mut client, method::STATE_SNAPSHOT, json!({})).await;
+    assert!(snapshot.sessions.is_empty());
+    assert_eq!(snapshot.worktrees.len(), 1);
+    assert_eq!(snapshot.worktrees[0].session_id, None);
+
+    let token = ready_token(&mut client, worktree_id).await;
+    remove(&mut client, worktree_id, token).await;
+    assert!(!path.exists());
+    assert!(fixture.repository.join("apps/api/tracked.txt").is_file());
+    assert!(worktrees(&mut client, None).await.is_empty());
+    daemon.stop().await;
+}
+
+#[tokio::test]
+async fn start_rejects_a_worktree_replaced_by_a_symlink_to_the_original_project() {
+    let (fixture, daemon, mut client) = Fixture::new("").await;
+    let created = fixture.create(&mut client, Some("apps/api")).await;
+    let path = created.worktree_path.unwrap();
+    let moved = fixture.root.path().join("moved-worktree");
+    fs::rename(&path, &moved).unwrap();
+    symlink(&fixture.repository, &path).unwrap();
+
+    let response = exchange(
+        &mut client,
+        method::SESSION_START,
+        json!({"sessionId": created.id}),
+    )
+    .await;
+    // Restore Git's registered path before checking the result so the fixture
+    // stays recoverable even if a regression unexpectedly starts the command.
+    fs::remove_file(&path).unwrap();
+    fs::rename(&moved, &path).unwrap();
+
+    let ResponsePayload::Error { error } = response.payload else {
+        panic!("a substituted worktree path must not launch an agent");
+    };
+    assert_eq!(error.code, "session_directory_unavailable");
+    assert!(!fixture.observed_cwd.exists());
+    for root in [&path, &fixture.repository] {
+        assert_eq!(
+            fs::read_to_string(root.join("apps/api/tracked.txt")).unwrap(),
+            "original\n"
+        );
+    }
+    let snapshot: StateSnapshotResponse =
+        call(&mut client, method::STATE_SNAPSHOT, json!({})).await;
+    assert_eq!(snapshot.sessions[0].status, SessionStatus::Unknown);
+    assert_eq!(snapshot.sessions[0].pid, None);
+    assert_eq!(snapshot.worktrees[0].path, path);
+    daemon.stop().await;
+}
+
+#[tokio::test]
+async fn concurrent_stop_and_restart_keep_the_same_session_metadata_consistent_with_its_runtime() {
+    let (fixture, daemon, mut control) = Fixture::new("").await;
+    let created = fixture.create(&mut control, None).await;
+    let mut stopping = daemon.connect().await;
+    let mut restarting = daemon.connect().await;
+
+    for _ in 0..3 {
+        let _: Session = call(
+            &mut control,
+            method::SESSION_START,
+            json!({"sessionId": created.id}),
+        )
+        .await;
+        let (stopped, restarted) = tokio::join!(
+            call::<Session>(
+                &mut stopping,
+                method::SESSION_STOP,
+                json!({"sessionId": created.id})
+            ),
+            call::<Session>(
+                &mut restarting,
+                method::SESSION_RESTART,
+                json!({"sessionId": created.id})
+            ),
+        );
+        assert!(!stopped.status.is_live());
+        assert_eq!(stopped.pid, None);
+        assert!(restarted.status.is_live());
+        assert!(restarted.pid.is_some());
+        assert_eq!(restarted.worktree_id, created.worktree_id);
+
+        let snapshot: StateSnapshotResponse =
+            call(&mut control, method::STATE_SNAPSHOT, json!({})).await;
+        assert_eq!(snapshot.sessions.len(), 1);
+        let durable = &snapshot.sessions[0];
+        assert_eq!(durable.id, created.id);
+        let write = exchange(
+            &mut control,
+            method::SESSION_WRITE,
+            json!({"sessionId": created.id, "base64": "cHJvYmUK"}),
+        )
+        .await;
+        match write.payload {
+            ResponsePayload::Success { .. } => {
+                assert!(
+                    durable.status.is_live(),
+                    "a writable runtime must be recorded live"
+                );
+                assert_eq!(durable.pid, restarted.pid);
+            }
+            ResponsePayload::Error { error } => {
+                assert_eq!(error.code, "session_not_running");
+                assert!(!durable.status.is_live());
+                assert_eq!(durable.pid, None);
+            }
+        }
+    }
+
+    let stopped: Session = call(
+        &mut control,
+        method::SESSION_STOP,
+        json!({"sessionId": created.id}),
+    )
+    .await;
+    assert!(!stopped.status.is_live());
+    assert_eq!(stopped.pid, None);
+    let token = ready_token(&mut control, created.worktree_id.unwrap()).await;
+    remove(&mut control, created.worktree_id.unwrap(), token).await;
+    daemon.stop().await;
+}
+
+#[tokio::test]
+async fn dirty_worktrees_block_removal_and_changes_after_confirmation_invalidate_the_token() {
+    let (fixture, daemon, mut client) = Fixture::new("").await;
+    let created = fixture.create(&mut client, None).await;
+    let worktree_id = created.worktree_id.unwrap();
+    let path = created.worktree_path.unwrap();
+    let token = ready_token(&mut client, worktree_id).await;
+    fs::write(path.join("user-notes.txt"), "preserve this\n").unwrap();
+
+    assert_eq!(
+        failure(
+            &mut client,
+            method::WORKTREE_REMOVE,
+            json!({
+                "worktreeId": worktree_id, "confirmationToken": token
+            })
+        )
+        .await,
+        "worktree_confirmation_invalid"
+    );
+    assert_eq!(
+        fs::read_to_string(path.join("user-notes.txt")).unwrap(),
+        "preserve this\n"
+    );
+    let blocked = prepare(&mut client, worktree_id).await;
+    let WorktreePrepareRemoveResponse::Blocked {
+        is_dirty, blockers, ..
+    } = blocked
+    else {
+        panic!("untracked content must block removal: {blocked:?}");
+    };
+    assert!(is_dirty);
+    assert!(blockers.contains(&WorktreeRemovalBlocker::UntrackedFiles));
+    assert_eq!(
+        worktrees(&mut client, None).await[0].state,
+        WorktreeState::Active
+    );
+
+    fs::remove_file(path.join("user-notes.txt")).unwrap();
+    let token = ready_token(&mut client, worktree_id).await;
+    remove(&mut client, worktree_id, token).await;
+    assert!(!path.exists());
+    daemon.stop().await;
+}
+
+#[tokio::test]
+async fn a_live_session_blocks_removal_and_old_tokens_cannot_override_changed_ownership() {
+    let (fixture, daemon, mut client) = Fixture::new("").await;
+    let created = fixture.create(&mut client, None).await;
+    let worktree_id = created.worktree_id.unwrap();
+    let path = created.worktree_path.unwrap();
+    let token = ready_token(&mut client, worktree_id).await;
+    let _: Session = call(
+        &mut client,
+        method::SESSION_START,
+        json!({"sessionId": created.id}),
+    )
+    .await;
+    wait_for_file(&fixture.observed_cwd).await;
+    assert_eq!(
+        failure(
+            &mut client,
+            method::WORKTREE_REMOVE,
+            json!({
+                "worktreeId": worktree_id, "confirmationToken": token
+            })
+        )
+        .await,
+        "worktree_confirmation_invalid"
+    );
+    let blocked = prepare(&mut client, worktree_id).await;
+    let WorktreePrepareRemoveResponse::Blocked {
+        is_dirty, blockers, ..
+    } = blocked
+    else {
+        panic!("the live session must block removal: {blocked:?}");
+    };
+    assert!(!is_dirty);
+    assert!(
+        blockers.contains(&WorktreeRemovalBlocker::Running)
+            || blockers.contains(&WorktreeRemovalBlocker::InUse)
+    );
+    assert_eq!(
+        failure(
+            &mut client,
+            method::SESSION_DELETE,
+            json!({"sessionId": created.id})
+        )
+        .await,
+        "session_still_running"
+    );
+    assert!(path.is_dir());
+
+    let _: Session = call(
+        &mut client,
+        method::SESSION_STOP,
+        json!({"sessionId": created.id}),
+    )
+    .await;
+    let token = ready_token(&mut client, worktree_id).await;
+    let _: Value = call(
+        &mut client,
+        method::SESSION_DELETE,
+        json!({"sessionId": created.id}),
+    )
+    .await;
+    assert_eq!(
+        failure(
+            &mut client,
+            method::WORKTREE_REMOVE,
+            json!({
+                "worktreeId": worktree_id, "confirmationToken": token
+            })
+        )
+        .await,
+        "worktree_confirmation_invalid"
+    );
+    assert!(path.is_dir());
+    let token = ready_token(&mut client, worktree_id).await;
+    remove(&mut client, worktree_id, token).await;
+    daemon.stop().await;
+}
+
+#[tokio::test]
+async fn an_unsubscribed_session_can_be_deleted_after_its_process_exits_on_its_own() {
+    let (fixture, daemon, mut client) = Fixture::new("").await;
+    fs::write(
+        fixture.root.path().join("observe-cwd.sh"),
+        "pwd -P > \"$1\"\nIFS= read -r line\n",
+    )
+    .unwrap();
+    let created = fixture.create(&mut client, None).await;
+    let worktree_id = created.worktree_id.unwrap();
+    let path = created.worktree_path.unwrap();
+    let started: Session = call(
+        &mut client,
+        method::SESSION_START,
+        json!({"sessionId": created.id}),
+    )
+    .await;
+    assert!(started.status.is_live());
+    wait_for_file(&fixture.observed_cwd).await;
+
+    // Let the command return normally, with no subscription driving durable
+    // status updates and no explicit stop operation that could hide the bug.
+    let _: Value = call(
+        &mut client,
+        method::SESSION_WRITE,
+        json!({"sessionId": created.id, "base64": "ZG9uZQo="}),
+    )
+    .await;
+    tokio::time::timeout(Duration::from_secs(5), async {
+        loop {
+            match exchange(
+                &mut client,
+                method::SESSION_DELETE,
+                json!({"sessionId": created.id}),
+            )
+            .await
+            .payload
+            {
+                ResponsePayload::Success { .. } => break,
+                ResponsePayload::Error { error } => {
+                    assert_eq!(error.code, "session_still_running");
+                }
+            }
+            tokio::time::sleep(Duration::from_millis(10)).await;
+        }
+    })
+    .await
+    .expect("metadata should become deletable after the child exits");
+
+    assert!(path.join("apps/api/tracked.txt").is_file());
+    let snapshot: StateSnapshotResponse =
+        call(&mut client, method::STATE_SNAPSHOT, json!({})).await;
+    assert!(snapshot.sessions.is_empty());
+    assert_eq!(snapshot.worktrees[0].id, worktree_id);
+    assert_eq!(snapshot.worktrees[0].session_id, None);
+    daemon.stop().await;
+}
+
+#[tokio::test]
+async fn another_session_using_the_checkout_blocks_removal_without_a_worktree_association() {
+    let (fixture, daemon, mut client) = Fixture::new("").await;
+    let isolated = fixture.create(&mut client, None).await;
+    let worktree_id = isolated.worktree_id.unwrap();
+    let path = isolated.worktree_path.unwrap();
+    let token = ready_token(&mut client, worktree_id).await;
+    let project: Project = call(
+        &mut client,
+        method::PROJECT_ADD,
+        json!({"path": path.join("apps/api")}),
+    )
+    .await;
+    let other: Session = call(
+        &mut client,
+        method::SESSION_CREATE,
+        json!({
+            "projectId": project.id,
+            "agentId": fixture.agent_id,
+            "name": "Independent terminal",
+            "isolation": "current"
+        }),
+    )
+    .await;
+    assert_eq!(other.worktree_id, None);
+    let _: Session = call(
+        &mut client,
+        method::SESSION_START,
+        json!({"sessionId": other.id}),
+    )
+    .await;
+    wait_for_file(&fixture.observed_cwd).await;
+    let error = failure(
+        &mut client,
+        method::WORKTREE_REMOVE,
+        json!({"worktreeId": worktree_id, "confirmationToken": token}),
+    )
+    .await;
+    assert!(
+        ["worktree_confirmation_invalid", "worktree_in_use"].contains(&error.as_str()),
+        "removal should reject changed usage: {error}"
+    );
+    let blocked = prepare(&mut client, worktree_id).await;
+    let WorktreePrepareRemoveResponse::Blocked { blockers, .. } = blocked else {
+        panic!("another session using this checkout must block removal: {blocked:?}");
+    };
+    assert!(blockers.contains(&WorktreeRemovalBlocker::InUse));
+    assert!(path.is_dir());
+
+    let _: Session = call(
+        &mut client,
+        method::SESSION_STOP,
+        json!({"sessionId": other.id}),
+    )
+    .await;
+    let token = ready_token(&mut client, worktree_id).await;
+    remove(&mut client, worktree_id, token).await;
+    assert!(!path.exists());
+    daemon.stop().await;
+}
+
+#[tokio::test]
+async fn prepared_worktrees_survive_restart_with_the_project_subdirectory_preserved() {
+    let (fixture, first, mut client) = Fixture::new("apps").await;
+    let created = fixture.create(&mut client, Some("api")).await;
+    let worktree_id = created.worktree_id.unwrap();
+    let path = created.worktree_path.as_ref().unwrap();
+    assert_eq!(created.cwd, path.join("apps/api"));
+    drop(client);
+    first.stop().await;
+
+    let second = RunningDaemon::start(fixture.root.path());
+    let mut client = second.connect().await;
+    let snapshot: StateSnapshotResponse =
+        call(&mut client, method::STATE_SNAPSHOT, json!({})).await;
+    assert_eq!(snapshot.sessions.len(), 1);
+    assert_eq!(snapshot.sessions[0].id, created.id);
+    assert_eq!(snapshot.sessions[0].cwd, created.cwd);
+    assert_eq!(snapshot.sessions[0].worktree_id, Some(worktree_id));
+    assert_eq!(snapshot.sessions[0].status, SessionStatus::Unknown);
+    assert_eq!(snapshot.sessions[0].pid, None);
+    assert_eq!(snapshot.worktrees.len(), 1);
+    assert_eq!(snapshot.worktrees[0].state, WorktreeState::Active);
+    assert_eq!(snapshot.worktrees[0].path, *path);
+    assert_eq!(snapshot.worktrees, worktrees(&mut client, None).await);
+    assert!(!fixture.observed_cwd.exists());
+
+    let started: Session = call(
+        &mut client,
+        method::SESSION_START,
+        json!({"sessionId": created.id}),
+    )
+    .await;
+    assert_eq!(started.cwd, created.cwd);
+    assert_eq!(
+        PathBuf::from(wait_for_file(&fixture.observed_cwd).await.trim()),
+        created.cwd
+    );
+    let _: Session = call(
+        &mut client,
+        method::SESSION_STOP,
+        json!({"sessionId": created.id}),
+    )
+    .await;
+    second.stop().await;
+}
+
+#[tokio::test]
+async fn restart_reconciles_a_worktree_session_without_signalling_an_unowned_stale_pid() {
+    let (fixture, first, mut client) = Fixture::new("").await;
+    let created = fixture.create(&mut client, None).await;
+    let database = first.config.database_path().to_path_buf();
+    drop(client);
+    first.stop().await;
+
+    // This separate manager owns the canary process. Its PID simulates an old
+    // persisted PID that now belongs to an unrelated process after a crash.
+    let canary_script = fixture.root.path().join("canary.sh");
+    let canary_reply = fixture.root.path().join("canary-reply");
+    fs::write(
+        &canary_script,
+        "IFS= read -r line\nprintf '%s' \"$line\" > \"$1\"\n",
+    )
+    .unwrap();
+    let canary_manager = SessionManager::new(SessionManagerConfig::default()).unwrap();
+    let command = CommandSpec::try_from_parts(
+        "/bin/sh",
+        [
+            canary_script.to_string_lossy().into_owned(),
+            canary_reply.to_string_lossy().into_owned(),
+        ],
+        fixture.root.path(),
+        BTreeMap::new(),
+    )
+    .unwrap();
+    let canary = canary_manager
+        .spawn(&command, TerminalSize::default())
+        .unwrap();
+    let canary_pid = canary_manager.snapshot(canary.id).unwrap().pid.unwrap();
+    Storage::open(&database)
+        .unwrap()
+        .update_session_runtime(
+            created.id,
+            &SessionRuntimeUpdate {
+                status: SessionStatus::Running,
+                runtime_pid: Some(canary_pid),
+                daemon_instance_id: Some("crashed-daemon".to_owned()),
+                exit_code: None,
+                error_code: None,
+                last_activity_at_ms: None,
+                updated_at_ms: created.updated_at_ms,
+            },
+        )
+        .unwrap();
+
+    let second = RunningDaemon::start(fixture.root.path());
+    let mut client = second.connect().await;
+    let snapshot: StateSnapshotResponse =
+        call(&mut client, method::STATE_SNAPSHOT, json!({})).await;
+    let recovered = &snapshot.sessions[0];
+    assert_eq!(recovered.id, created.id);
+    assert_eq!(recovered.status, SessionStatus::Unknown);
+    assert_eq!(recovered.pid, None);
+    assert_eq!(recovered.pty_id, None);
+    assert_eq!(recovered.worktree_id, created.worktree_id);
+    assert_eq!(recovered.worktree_path, created.worktree_path);
+    assert_eq!(snapshot.worktrees[0].state, WorktreeState::Active);
+    assert_eq!(
+        failure(
+            &mut client,
+            method::SESSION_STOP,
+            json!({"sessionId": created.id})
+        )
+        .await,
+        "session_not_found"
+    );
+    canary_manager.write(canary.id, b"still-alive\n").unwrap();
+    assert_eq!(wait_for_file(&canary_reply).await, "still-alive");
+    let durable = Storage::open(&database)
+        .unwrap()
+        .get_session(created.id)
+        .unwrap()
+        .unwrap();
+    assert_eq!(durable.status, SessionStatus::Unknown);
+    assert_eq!(durable.runtime_pid, None);
+    assert_eq!(durable.daemon_instance_id, None);
+    canary_manager.shutdown().unwrap();
+    second.stop().await;
+}
diff --git a/protocol/catalog.json b/protocol/catalog.json
index fff6729..0efc949 100644
--- a/protocol/catalog.json
+++ b/protocol/catalog.json
@@ -27,6 +27,7 @@
     "session.unsubscribe",
     "git.status",
     "git.diff",
+    "worktree.list",
     "worktree.prepare_remove",
     "worktree.remove",
     "diagnostics.get"

From 2f3b7c810f62c0ee2f6022e19e173bb1d4f6e0d4 Mon Sep 17 00:00:00 2001
From: guicybercode <euguigom@gmail.com>
Date: Sat, 5 Sep 2026 21:50:20 -0300
Subject: [PATCH 07/23] feat(knowledge): persist scoped prompts and context
 over IPC

---
 apps/desktop/src/ipc/client.test.ts           |  31 +
 apps/desktop/src/ipc/client.ts                |  17 +
 apps/desktop/src/ipc/domain.ts                |  47 ++
 apps/desktop/src/ipc/knowledge-schema.test.ts |  39 ++
 apps/desktop/src/ipc/knowledge-schema.ts      |  64 +++
 apps/desktop/src/ipc/methods.ts               |  36 ++
 apps/desktop/src/test/mockIpc.ts              |   6 +
 crates/core/src/knowledge/mod.rs              | 530 ++++++++++++++++++
 crates/core/src/lib.rs                        |   1 +
 crates/core/src/wire/method.rs                |  10 +
 crates/core/src/wire/mod.rs                   |   6 +
 crates/core/tests/knowledge_catalog.rs        |  19 +
 crates/core/tests/knowledge_contract.rs       | 271 +++++++++
 crates/daemon/src/knowledge/mod.rs            |  68 +++
 crates/daemon/src/lib.rs                      |   1 +
 crates/daemon/src/server.rs                   |   3 +
 crates/daemon/tests/knowledge_ipc.rs          | 248 ++++++++
 .../migrations/0004_knowledge_documents.sql   |  29 +
 crates/storage/src/durability_tests.rs        |   1 +
 crates/storage/src/knowledge/mod.rs           | 402 +++++++++++++
 crates/storage/src/lib.rs                     |   4 +-
 crates/storage/src/migrate.rs                 |  21 +
 crates/storage/tests/knowledge.rs             | 509 +++++++++++++++++
 docs/adr/0005-local-knowledge.md              |   3 +-
 docs/codex/xirp-context-report.md             | 100 +++-
 docs/codex/xirp-coordination-reply.md         |  44 ++
 docs/codex/xirp-integration-request.md        |  21 +
 docs/xirp-local-parity.md                     |   6 +-
 protocol/catalog.json                         |   5 +-
 protocol/fixtures/knowledge-page.json         |  25 +
 30 files changed, 2538 insertions(+), 29 deletions(-)
 create mode 100644 apps/desktop/src/ipc/domain.ts
 create mode 100644 apps/desktop/src/ipc/knowledge-schema.test.ts
 create mode 100644 apps/desktop/src/ipc/knowledge-schema.ts
 create mode 100644 apps/desktop/src/ipc/methods.ts
 create mode 100644 crates/core/src/knowledge/mod.rs
 create mode 100644 crates/core/tests/knowledge_catalog.rs
 create mode 100644 crates/core/tests/knowledge_contract.rs
 create mode 100644 crates/daemon/src/knowledge/mod.rs
 create mode 100644 crates/daemon/tests/knowledge_ipc.rs
 create mode 100644 crates/storage/migrations/0004_knowledge_documents.sql
 create mode 100644 crates/storage/src/knowledge/mod.rs
 create mode 100644 crates/storage/tests/knowledge.rs
 create mode 100644 docs/codex/xirp-coordination-reply.md
 create mode 100644 protocol/fixtures/knowledge-page.json

diff --git a/apps/desktop/src/ipc/client.test.ts b/apps/desktop/src/ipc/client.test.ts
index f487293..be45fab 100644
--- a/apps/desktop/src/ipc/client.test.ts
+++ b/apps/desktop/src/ipc/client.test.ts
@@ -379,3 +379,34 @@ function requestFromArgs(value: unknown): RequestEnvelope<unknown> {
   }
   return value.request as RequestEnvelope<unknown>;
 }
+
+// Knowledge uses the same versioned request transport as all domain methods.
+describe("knowledge IPC transport", () => {
+  it("keeps revisions and scope and surfaces conflicts without issuing session writes", async () => {
+    const entry = {
+      id: "0198f000-0000-7000-8000-000000000010", kind: "prompt", projectId: null,
+      title: "Review", body: "Review the selected changes", revision: 1,
+      createdAtMs: 100, updatedAtMs: 100,
+    };
+    transport.invoke.mockReset();
+    installWireResponder({
+      "knowledge.list": { entries: [entry], nextCursor: null },
+      "knowledge.save": entry,
+      "knowledge.delete": {},
+    });
+    const client = createTauriIpcClient();
+    expect(await client.listKnowledge({ projectId: null, query: "review" })).toEqual({ entries: [entry], nextCursor: null });
+    const input = { kind: "prompt" as const, projectId: null, title: entry.title, body: entry.body };
+    expect(await client.saveKnowledge(input)).toEqual(entry);
+    await client.deleteKnowledge({ id: entry.id, expectedRevision: 1 });
+    expect(capturedRequests().map((request) => request.method)).toEqual(["knowledge.list", "knowledge.save", "knowledge.delete"]);
+    expect(capturedRequests()[1].payload).toEqual(input);
+    expect(capturedRequests()[2].payload).toEqual({ id: entry.id, expectedRevision: 1 });
+
+    transport.invoke.mockImplementation(async (_command, { request }) => ({
+      kind: "response", version: 1, requestId: request.requestId, status: "error",
+      error: { code: "knowledge_conflict", message: "This entry changed. Reload or save a copy." },
+    }));
+    await expect(client.saveKnowledge({ ...input, id: entry.id, expectedRevision: 1 })).rejects.toMatchObject({ code: "knowledge_conflict" });
+  });
+});
diff --git a/apps/desktop/src/ipc/client.ts b/apps/desktop/src/ipc/client.ts
index e30335d..62b2cdb 100644
--- a/apps/desktop/src/ipc/client.ts
+++ b/apps/desktop/src/ipc/client.ts
@@ -1,3 +1,5 @@
+import { decodeKnowledgeEntry, decodeKnowledgePage } from "./knowledge-schema";
+import type { KnowledgeEntry, KnowledgeListRequest, KnowledgeListResponse, KnowledgeSaveRequest, KnowledgeDeleteRequest } from "./domain";
 import { invoke } from "@tauri-apps/api/core";
 import { listen } from "@tauri-apps/api/event";
 import { openPath } from "@tauri-apps/plugin-opener";
@@ -60,6 +62,9 @@ export interface TerminalResizeInput {
 /** The sole frontend interface to daemon and native desktop capabilities. */
 export interface IpcClient {
   readonly platform: AppPlatform;
+  listKnowledge(input: KnowledgeListRequest): Promise<KnowledgeListResponse>;
+  saveKnowledge(input: KnowledgeSaveRequest): Promise<KnowledgeEntry>;
+  deleteKnowledge(input: KnowledgeDeleteRequest): Promise<void>;
   initialize(): Promise<BootstrapResult>;
   subscribe(
     handler: IpcEventHandler,
@@ -136,6 +141,18 @@ export function toIpcError(error: unknown): IpcError {
 class TauriIpcClient implements IpcClient {
   readonly platform = detectPlatform();
 
+  async listKnowledge(input: KnowledgeListRequest): Promise<KnowledgeListResponse> {
+    return decodeKnowledgePage(await this.request("knowledge.list", input));
+  }
+
+  async saveKnowledge(input: KnowledgeSaveRequest): Promise<KnowledgeEntry> {
+    return decodeKnowledgeEntry(await this.request("knowledge.save", input));
+  }
+
+  async deleteKnowledge(input: KnowledgeDeleteRequest): Promise<void> {
+    await this.request("knowledge.delete", input);
+  }
+
   async initialize(): Promise<BootstrapResult> {
     const hello = decodeHello(await this.request("system.hello", {}));
     if (hello.protocolVersion !== 1) {
diff --git a/apps/desktop/src/ipc/domain.ts b/apps/desktop/src/ipc/domain.ts
new file mode 100644
index 0000000..4dcfdaf
--- /dev/null
+++ b/apps/desktop/src/ipc/domain.ts
@@ -0,0 +1,47 @@
+/** Additive daemon contracts. Existing UI DTOs remain owned by types.ts. */
+export type * from "./types";
+
+/** User-authored local text; no Portal connection or transcript capture. */
+export type KnowledgeKind = "prompt" | "context";
+
+/** Mirrors the validated Rust knowledge entry. */
+export interface KnowledgeEntry {
+  readonly id: string;
+  readonly kind: KnowledgeKind;
+  readonly projectId: string | null;
+  readonly title: string;
+  readonly body: string;
+  readonly revision: number;
+  readonly createdAtMs: number;
+  readonly updatedAtMs: number;
+}
+
+/** Null/omitted project selects globals; a project includes its global entries. */
+export interface KnowledgeListRequest {
+  readonly projectId?: string | null;
+  readonly kind?: KnowledgeKind;
+  readonly cursor?: string;
+  readonly query?: string;
+}
+
+/** Bodies are included in bounded, cursor-based result pages. */
+export interface KnowledgeListResponse {
+  readonly entries: readonly KnowledgeEntry[];
+  readonly nextCursor: string | null;
+}
+
+/** A create omits id/revision; an update requires both. */
+export interface KnowledgeSaveRequest {
+  readonly id?: string;
+  readonly expectedRevision?: number;
+  readonly kind: KnowledgeKind;
+  readonly projectId: string | null;
+  readonly title: string;
+  readonly body: string;
+}
+
+/** A stale delete leaves the existing text intact. */
+export interface KnowledgeDeleteRequest {
+  readonly id: string;
+  readonly expectedRevision: number;
+}
diff --git a/apps/desktop/src/ipc/knowledge-schema.test.ts b/apps/desktop/src/ipc/knowledge-schema.test.ts
new file mode 100644
index 0000000..3004c9f
--- /dev/null
+++ b/apps/desktop/src/ipc/knowledge-schema.test.ts
@@ -0,0 +1,39 @@
+import { describe, expect, it } from "vitest";
+import catalog from "../../../../protocol/catalog.json";
+import fixture from "../../../../protocol/fixtures/knowledge-page.json";
+import { IPC_METHODS } from "./methods";
+import { decodeKnowledgeEntry, decodeKnowledgePage } from "./knowledge-schema";
+
+describe("knowledge Rust/TypeScript contract", () => {
+  it("decodes the same fixture as the Rust contract, including explicit nulls", () => {
+    expect(decodeKnowledgePage(fixture)).toEqual(fixture);
+    expect(fixture.nextCursor).toBeNull();
+    expect(fixture.entries[0].projectId).toBeNull();
+  });
+
+  it("mirrors every public method", () => {
+    expect(IPC_METHODS).toEqual(catalog.methods);
+  });
+
+  it("rejects unknown variants without echoing text", () => {
+    expect(() => decodeKnowledgeEntry({ ...fixture.entries[0], kind: "private content" })).toThrow("Invalid knowledge kind");
+  });
+
+  it("rejects unsafe revisions, text bounds and timestamps", () => {
+    for (const change of [
+      { revision: 0 }, { revision: Number.MAX_SAFE_INTEGER + 1 },
+      { updatedAtMs: -1 }, { body: "\0" }, { title: "é".repeat(129) },
+      { body: "a".repeat(65_537) },
+    ]) expect(() => decodeKnowledgeEntry({ ...fixture.entries[0], ...change })).toThrow();
+  });
+
+  it("shares Rust Unicode whitespace validation", () => {
+    expect(decodeKnowledgeEntry({ ...fixture.entries[0], body: "\uFEFF" }).body).toBe("\uFEFF");
+    expect(() => decodeKnowledgeEntry({ ...fixture.entries[0], body: "\u0085" })).toThrow();
+  });
+
+  it("rejects a cursor that cannot advance and repeated rows", () => {
+    expect(() => decodeKnowledgePage({ entries: [], nextCursor: fixture.entries[0].id })).toThrow();
+    expect(() => decodeKnowledgePage({ entries: [fixture.entries[0], fixture.entries[0]], nextCursor: null })).toThrow();
+  });
+});
diff --git a/apps/desktop/src/ipc/knowledge-schema.ts b/apps/desktop/src/ipc/knowledge-schema.ts
new file mode 100644
index 0000000..5b3d890
--- /dev/null
+++ b/apps/desktop/src/ipc/knowledge-schema.ts
@@ -0,0 +1,64 @@
+import { IpcContractError, requireArray, requireRecord, requireString } from "./schema";
+import type { KnowledgeEntry, KnowledgeListResponse } from "./domain";
+
+/** Keep constants aligned with core::knowledge validation. */
+export const KNOWLEDGE_TITLE_BYTES = 256;
+export const KNOWLEDGE_BODY_BYTES = 65_536;
+
+function uuid(value: unknown, version7 = false): string {
+  const text = requireString(value, "knowledge identifier");
+  const pattern = version7
+    ? /^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i
+    : /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+  if (!pattern.test(text)) throw new IpcContractError("Invalid knowledge identifier");
+  return text;
+}
+
+function integer(value: unknown, minimum: number): number {
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < minimum) {
+    throw new IpcContractError("Invalid knowledge revision or timestamp");
+  }
+  return value;
+}
+
+function content(value: unknown, maximum: number): string {
+  const text = requireString(value, "knowledge text");
+  if (!/[^\p{White_Space}]/u.test(text) || text.includes("\0") || new TextEncoder().encode(text).length > maximum) {
+    throw new IpcContractError("Invalid knowledge text length or encoding");
+  }
+  return text;
+}
+
+/** Validate content without including its text in contract failures. */
+export function decodeKnowledgeEntry(value: unknown): KnowledgeEntry {
+  const row = requireRecord(value, "knowledge entry");
+  if (row.kind !== "prompt" && row.kind !== "context") {
+    throw new IpcContractError("Invalid knowledge kind");
+  }
+  const createdAtMs = integer(row.createdAtMs, 0);
+  const updatedAtMs = integer(row.updatedAtMs, createdAtMs);
+  return {
+    id: uuid(row.id, true),
+    kind: row.kind,
+    projectId: row.projectId === null ? null : uuid(row.projectId),
+    title: content(row.title, KNOWLEDGE_TITLE_BYTES),
+    body: content(row.body, KNOWLEDGE_BODY_BYTES),
+    revision: integer(row.revision, 1),
+    createdAtMs,
+    updatedAtMs,
+  };
+}
+
+/** Enforce page shape, stable ordering and a usable continuation cursor. */
+export function decodeKnowledgePage(value: unknown): KnowledgeListResponse {
+  const page = requireRecord(value, "knowledge page");
+  const entries = requireArray(page.entries, "knowledge entries").map(decodeKnowledgeEntry);
+  if (entries.length > 50 || entries.some((entry, index) => index > 0 && entry.id <= entries[index - 1].id)) {
+    throw new IpcContractError("Invalid knowledge page ordering or size");
+  }
+  const nextCursor = page.nextCursor === null ? null : uuid(page.nextCursor, true);
+  if (nextCursor !== null && nextCursor !== entries[entries.length - 1]?.id) {
+    throw new IpcContractError("Invalid knowledge page cursor");
+  }
+  return { entries, nextCursor };
+}
diff --git a/apps/desktop/src/ipc/methods.ts b/apps/desktop/src/ipc/methods.ts
new file mode 100644
index 0000000..cb3a528
--- /dev/null
+++ b/apps/desktop/src/ipc/methods.ts
@@ -0,0 +1,36 @@
+/** Mirror of cli_master_core::wire::method; checked against the JSON catalog. */
+export const IPC_METHODS = [
+  "system.hello",
+  "state.snapshot",
+  "project.add",
+  "project.list",
+  "project.rename",
+  "project.remove",
+  "agent.list",
+  "agent.detect",
+  "agent.set_enabled",
+  "agent.custom.create",
+  "agent.custom.update",
+  "agent.custom.remove",
+  "session.create",
+  "session.list",
+  "session.rename",
+  "session.start",
+  "session.restart",
+  "session.stop",
+  "session.delete",
+  "session.write",
+  "session.resize",
+  "session.subscribe",
+  "session.unsubscribe",
+  "git.status",
+  "git.diff",
+  "worktree.prepare_remove",
+  "worktree.remove",
+  "diagnostics.get",
+  "knowledge.list",
+  "knowledge.save",
+  "knowledge.delete"
+] as const;
+
+export type IpcMethod = (typeof IPC_METHODS)[number];
diff --git a/apps/desktop/src/test/mockIpc.ts b/apps/desktop/src/test/mockIpc.ts
index 0b13c8d..c5bdb6a 100644
--- a/apps/desktop/src/test/mockIpc.ts
+++ b/apps/desktop/src/test/mockIpc.ts
@@ -24,6 +24,9 @@ export interface MockIpcClientOptions {
 
 /** An injected IPC fake whose unconfigured application calls fail loudly. */
 export interface MockIpcClient extends IpcClient {
+  readonly listKnowledge: Mock<IpcClient["listKnowledge"]>;
+  readonly saveKnowledge: Mock<IpcClient["saveKnowledge"]>;
+  readonly deleteKnowledge: Mock<IpcClient["deleteKnowledge"]>;
   readonly initialize: Mock<IpcClient["initialize"]>;
   readonly subscribe: Mock<IpcClient["subscribe"]>;
   readonly subscribeTerminal: Mock<IpcClient["subscribeTerminal"]>;
@@ -146,6 +149,9 @@ export function createMockIpcClient(
     getDiagnostics: vi.fn<IpcClient["getDiagnostics"]>(
       handlers.getDiagnostics ?? (() => rejectUnhandled("getDiagnostics")),
     ),
+    listKnowledge: vi.fn<IpcClient["listKnowledge"]>(handlers.listKnowledge ?? (() => rejectUnhandled("listKnowledge"))),
+    saveKnowledge: vi.fn<IpcClient["saveKnowledge"]>(handlers.saveKnowledge ?? (() => rejectUnhandled("saveKnowledge"))),
+    deleteKnowledge: vi.fn<IpcClient["deleteKnowledge"]>(handlers.deleteKnowledge ?? (() => rejectUnhandled("deleteKnowledge"))),
     openPath: vi.fn<IpcClient["openPath"]>(
       handlers.openPath ?? (() => rejectUnhandled("openPath")),
     ),
diff --git a/crates/core/src/knowledge/mod.rs b/crates/core/src/knowledge/mod.rs
new file mode 100644
index 0000000..e093754
--- /dev/null
+++ b/crates/core/src/knowledge/mod.rs
@@ -0,0 +1,530 @@
+//! Pure contracts for saved local prompts and reusable context.
+//!
+//! Text crosses the local IPC boundary intentionally, but is excluded from
+//! diagnostic formatting. This module performs no filesystem or process I/O.
+
+use std::{error::Error, fmt, str::FromStr};
+
+use serde::{Deserialize, Deserializer, Serialize, de};
+use uuid::{Uuid, Variant};
+
+use crate::ProjectId;
+
+/// Maximum saved title length in UTF-8 bytes.
+pub const MAX_KNOWLEDGE_TITLE_BYTES: usize = 256;
+/// Maximum saved prompt or context length in UTF-8 bytes.
+pub const MAX_KNOWLEDGE_BODY_BYTES: usize = 64 * 1_024;
+/// Highest revision that JavaScript can represent without rounding.
+pub const MAX_KNOWLEDGE_REVISION: u64 = 9_007_199_254_740_991;
+
+/// Safe validation failure containing only static labels and explanations.
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct KnowledgeValidationError {
+    field: &'static str,
+    message: &'static str,
+}
+
+impl KnowledgeValidationError {
+    const fn new(field: &'static str, message: &'static str) -> Self {
+        Self { field, message }
+    }
+
+    /// Returns the invalid field's stable label.
+    #[must_use]
+    pub const fn field(&self) -> &'static str {
+        self.field
+    }
+
+    /// Returns an explanation that never includes submitted content.
+    #[must_use]
+    pub const fn message(&self) -> &'static str {
+        self.message
+    }
+}
+
+impl fmt::Display for KnowledgeValidationError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(formatter, "{} {}", self.field, self.message)
+    }
+}
+
+impl Error for KnowledgeValidationError {}
+
+/// UUID version 7 identifier for one saved prompt or context entry.
+#[derive(Clone, Copy, Debug, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(transparent)]
+pub struct KnowledgeId(Uuid);
+
+impl KnowledgeId {
+    /// Generates a time-ordered UUID version 7 identifier.
+    #[must_use]
+    pub fn new() -> Self {
+        Self(Uuid::now_v7())
+    }
+
+    /// Validates an existing UUID without changing it.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error unless the UUID uses version 7 and the RFC variant.
+    pub fn try_from_uuid(value: Uuid) -> Result<Self, KnowledgeValidationError> {
+        if value.get_version_num() != 7 || value.get_variant() != Variant::RFC4122 {
+            return Err(KnowledgeValidationError::new(
+                "id",
+                "must be a UUID version 7",
+            ));
+        }
+        Ok(Self(value))
+    }
+
+    /// Returns the underlying UUID.
+    #[must_use]
+    pub const fn as_uuid(&self) -> &Uuid {
+        &self.0
+    }
+
+    /// Consumes the identifier and returns the underlying UUID.
+    #[must_use]
+    pub const fn into_uuid(self) -> Uuid {
+        self.0
+    }
+}
+
+impl Default for KnowledgeId {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl fmt::Display for KnowledgeId {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        self.0.fmt(formatter)
+    }
+}
+
+impl FromStr for KnowledgeId {
+    type Err = KnowledgeValidationError;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        let uuid = Uuid::parse_str(value)
+            .map_err(|_| KnowledgeValidationError::new("id", "must be a UUID version 7"))?;
+        Self::try_from_uuid(uuid)
+    }
+}
+
+impl<'de> Deserialize<'de> for KnowledgeId {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        let value = String::deserialize(deserializer)
+            .map_err(|_| de::Error::custom("id must be a UUID version 7 string"))?;
+        value.parse().map_err(de::Error::custom)
+    }
+}
+
+/// The local purpose of a saved knowledge entry.
+#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum KnowledgeKind {
+    /// Reusable instructions selected explicitly by a user.
+    Prompt,
+    /// Reusable local background information selected explicitly by a user.
+    Context,
+}
+
+macro_rules! knowledge_text {
+    ($name:ident, $description:literal, $field:literal, $maximum:ident) => {
+        #[doc = $description]
+        #[derive(Clone, Eq, PartialEq, Serialize)]
+        #[serde(transparent)]
+        pub struct $name(String);
+
+        impl $name {
+            /// Validates text while preserving its exact whitespace and content.
+            ///
+            /// # Errors
+            ///
+            /// Returns an error for blank text, a NUL byte, or an exceeded byte limit.
+            pub fn try_new(value: impl Into<String>) -> Result<Self, KnowledgeValidationError> {
+                let value = value.into();
+                validate_text($field, &value, $maximum)?;
+                Ok(Self(value))
+            }
+
+            /// Returns validated text for explicit use or local persistence.
+            #[must_use]
+            pub fn as_str(&self) -> &str {
+                &self.0
+            }
+
+            /// Consumes the value and returns its text.
+            #[must_use]
+            pub fn into_inner(self) -> String {
+                self.0
+            }
+        }
+
+        impl fmt::Debug for $name {
+            fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+                formatter
+                    .debug_struct(stringify!($name))
+                    .field("bytes", &self.0.len())
+                    .finish_non_exhaustive()
+            }
+        }
+
+        impl<'de> Deserialize<'de> for $name {
+            fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+            where
+                D: Deserializer<'de>,
+            {
+                let value = String::deserialize(deserializer)
+                    .map_err(|_| de::Error::custom(concat!($field, " must be text")))?;
+                Self::try_new(value).map_err(de::Error::custom)
+            }
+        }
+    };
+}
+
+knowledge_text!(
+    KnowledgeTitle,
+    "Non-blank saved title bounded to 256 UTF-8 bytes; diagnostic output is redacted.",
+    "title",
+    MAX_KNOWLEDGE_TITLE_BYTES
+);
+knowledge_text!(
+    KnowledgeBody,
+    "Non-blank prompt or context bounded to 64 KiB; diagnostic output is redacted.",
+    "body",
+    MAX_KNOWLEDGE_BODY_BYTES
+);
+
+/// One persisted local prompt or context entry.
+#[derive(Clone, Debug, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct KnowledgeEntry {
+    /// Stable identifier generated by the local owner.
+    pub id: KnowledgeId,
+    /// Prompt or context classification.
+    pub kind: KnowledgeKind,
+    /// Owning project, or no project for a globally reusable entry.
+    pub project_id: Option<ProjectId>,
+    /// User-facing title, excluded from diagnostic formatting.
+    pub title: KnowledgeTitle,
+    /// Explicitly saved user content, excluded from diagnostic formatting.
+    pub body: KnowledgeBody,
+    /// Positive revision used for optimistic concurrency.
+    pub revision: u64,
+    /// Creation time as Unix epoch milliseconds.
+    pub created_at_ms: i64,
+    /// Most recent edit time as Unix epoch milliseconds.
+    pub updated_at_ms: i64,
+}
+
+impl KnowledgeEntry {
+    /// Checks invariants for a programmatically assembled entry.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error for invalid revisions or timestamps outside the ordered,
+    /// non-negative JavaScript-safe epoch millisecond range.
+    pub const fn validate(&self) -> Result<(), KnowledgeValidationError> {
+        match validate_revision("revision", self.revision) {
+            Ok(()) => (),
+            Err(error) => return Err(error),
+        }
+        if self.created_at_ms < 0
+            || self.updated_at_ms < self.created_at_ms
+            || self.updated_at_ms > 9_007_199_254_740_991
+        {
+            return Err(KnowledgeValidationError::new(
+                "timestamps",
+                "must satisfy 0 <= createdAtMs <= updatedAtMs <= 9007199254740991",
+            ));
+        }
+        Ok(())
+    }
+}
+
+impl<'de> Deserialize<'de> for KnowledgeEntry {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        #[derive(Deserialize)]
+        #[serde(deny_unknown_fields, rename_all = "camelCase")]
+        struct Fields {
+            id: KnowledgeId,
+            kind: KnowledgeKind,
+            project_id: Option<ProjectId>,
+            title: KnowledgeTitle,
+            body: KnowledgeBody,
+            revision: u64,
+            created_at_ms: i64,
+            updated_at_ms: i64,
+        }
+
+        let fields = Fields::deserialize(deserializer)
+            .map_err(|_| de::Error::custom("invalid saved knowledge entry"))?;
+        let entry = Self {
+            id: fields.id,
+            kind: fields.kind,
+            project_id: fields.project_id,
+            title: fields.title,
+            body: fields.body,
+            revision: fields.revision,
+            created_at_ms: fields.created_at_ms,
+            updated_at_ms: fields.updated_at_ms,
+        };
+        entry.validate().map_err(de::Error::custom)?;
+        Ok(entry)
+    }
+}
+
+/// Selects global entries, optionally including entries owned by one project.
+#[derive(Clone, Default, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct KnowledgeListRequest {
+    /// When absent, list global entries only; when present, include this project.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub project_id: Option<ProjectId>,
+    /// Optional prompt/context filter applied to both scopes.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub kind: Option<KnowledgeKind>,
+    /// Exclusive cursor in ascending identifier order.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cursor: Option<KnowledgeId>,
+    /// Literal case-insensitive title/body search, bounded to 256 UTF-8 bytes.
+    ///
+    /// Empty text means no search filter. The daemon trims surrounding whitespace.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub query: Option<String>,
+}
+
+impl KnowledgeListRequest {
+    /// Checks search limits for programmatic callers.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error for an oversized or NUL-containing search query.
+    pub fn validate(&self) -> Result<(), KnowledgeValidationError> {
+        if let Some(query) = &self.query {
+            if query.len() > MAX_KNOWLEDGE_TITLE_BYTES {
+                return Err(KnowledgeValidationError::new(
+                    "query",
+                    "exceeds its UTF-8 byte limit",
+                ));
+            }
+            if query.contains('\0') {
+                return Err(KnowledgeValidationError::new(
+                    "query",
+                    "must not contain a NUL byte",
+                ));
+            }
+        }
+        Ok(())
+    }
+}
+
+impl fmt::Debug for KnowledgeListRequest {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("KnowledgeListRequest")
+            .field("project_id", &self.project_id)
+            .field("kind", &self.kind)
+            .field("cursor", &self.cursor)
+            .field("query_bytes", &self.query.as_ref().map(String::len))
+            .finish()
+    }
+}
+
+impl<'de> Deserialize<'de> for KnowledgeListRequest {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        #[derive(Deserialize)]
+        #[serde(deny_unknown_fields, rename_all = "camelCase")]
+        struct Fields {
+            project_id: Option<ProjectId>,
+            kind: Option<KnowledgeKind>,
+            cursor: Option<KnowledgeId>,
+            query: Option<String>,
+        }
+
+        let fields = Fields::deserialize(deserializer)
+            .map_err(|_| de::Error::custom("invalid knowledge list request"))?;
+        let mut request = Self {
+            project_id: fields.project_id,
+            kind: fields.kind,
+            cursor: fields.cursor,
+            query: fields.query,
+        };
+        request.validate().map_err(de::Error::custom)?;
+        request.query = request.query.map(|query| query.trim().to_owned());
+        Ok(request)
+    }
+}
+
+/// Bounded page of local knowledge in ascending identifier order.
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(deny_unknown_fields, rename_all = "camelCase")]
+pub struct KnowledgeListResponse {
+    /// Entries selected and packed within the daemon's row and byte limits.
+    pub entries: Vec<KnowledgeEntry>,
+    /// Exclusive cursor for the next page, or null when the result is exhausted.
+    pub next_cursor: Option<KnowledgeId>,
+}
+
+/// Creates a local entry or replaces its text with an optimistic revision check.
+#[derive(Clone, Debug, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct KnowledgeSaveRequest {
+    /// Absent for creation; identifies the existing entry for an update.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub id: Option<KnowledgeId>,
+    /// Absent for creation; must equal the persisted revision for an update.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub expected_revision: Option<u64>,
+    /// Owning project, or global scope when absent.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub project_id: Option<ProjectId>,
+    /// Explicit prompt/context classification.
+    pub kind: KnowledgeKind,
+    /// Validated saved title.
+    pub title: KnowledgeTitle,
+    /// Validated saved content.
+    pub body: KnowledgeBody,
+}
+
+impl KnowledgeSaveRequest {
+    /// Checks mutation shape and revision bounds for programmatic callers.
+    ///
+    /// Persistence must check the expected revision atomically with the write.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error for a partial id/revision pair or an invalid revision.
+    pub const fn validate(&self) -> Result<(), KnowledgeValidationError> {
+        match (self.id, self.expected_revision) {
+            (None, None) => Ok(()),
+            (Some(_), Some(revision)) => validate_revision("expectedRevision", revision),
+            _ => Err(KnowledgeValidationError::new(
+                "id and expectedRevision",
+                "must either both be absent for creation or both be present for an update",
+            )),
+        }
+    }
+}
+
+impl<'de> Deserialize<'de> for KnowledgeSaveRequest {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        #[derive(Deserialize)]
+        #[serde(deny_unknown_fields, rename_all = "camelCase")]
+        struct Fields {
+            id: Option<KnowledgeId>,
+            expected_revision: Option<u64>,
+            project_id: Option<ProjectId>,
+            kind: KnowledgeKind,
+            title: KnowledgeTitle,
+            body: KnowledgeBody,
+        }
+
+        let fields = Fields::deserialize(deserializer)
+            .map_err(|_| de::Error::custom("invalid knowledge save request"))?;
+        let request = Self {
+            id: fields.id,
+            expected_revision: fields.expected_revision,
+            project_id: fields.project_id,
+            kind: fields.kind,
+            title: fields.title,
+            body: fields.body,
+        };
+        request.validate().map_err(de::Error::custom)?;
+        Ok(request)
+    }
+}
+
+/// Removes one local entry only if its revision still matches the user's copy.
+#[derive(Clone, Copy, Debug, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct KnowledgeDeleteRequest {
+    /// Stable identifier of the entry to remove.
+    pub id: KnowledgeId,
+    /// Revision observed when removal was requested.
+    pub expected_revision: u64,
+}
+
+impl KnowledgeDeleteRequest {
+    /// Checks revision bounds for programmatic callers.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error for a zero or JavaScript-unsafe revision.
+    pub const fn validate(&self) -> Result<(), KnowledgeValidationError> {
+        validate_revision("expectedRevision", self.expected_revision)
+    }
+}
+
+impl<'de> Deserialize<'de> for KnowledgeDeleteRequest {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        #[derive(Deserialize)]
+        #[serde(deny_unknown_fields, rename_all = "camelCase")]
+        struct Fields {
+            id: KnowledgeId,
+            expected_revision: u64,
+        }
+
+        let fields = Fields::deserialize(deserializer)
+            .map_err(|_| de::Error::custom("invalid knowledge delete request"))?;
+        let request = Self {
+            id: fields.id,
+            expected_revision: fields.expected_revision,
+        };
+        request.validate().map_err(de::Error::custom)?;
+        Ok(request)
+    }
+}
+
+fn validate_text(
+    field: &'static str,
+    value: &str,
+    maximum_bytes: usize,
+) -> Result<(), KnowledgeValidationError> {
+    if value.len() > maximum_bytes {
+        return Err(KnowledgeValidationError::new(
+            field,
+            "exceeds its UTF-8 byte limit",
+        ));
+    }
+    if value.trim().is_empty() {
+        return Err(KnowledgeValidationError::new(field, "must not be blank"));
+    }
+    if value.contains('\0') {
+        return Err(KnowledgeValidationError::new(
+            field,
+            "must not contain a NUL byte",
+        ));
+    }
+    Ok(())
+}
+
+const fn validate_revision(
+    field: &'static str,
+    revision: u64,
+) -> Result<(), KnowledgeValidationError> {
+    if revision == 0 || revision > MAX_KNOWLEDGE_REVISION {
+        return Err(KnowledgeValidationError::new(
+            field,
+            "must be an integer between 1 and 9007199254740991",
+        ));
+    }
+    Ok(())
+}
diff --git a/crates/core/src/lib.rs b/crates/core/src/lib.rs
index 2fcd66d..2cb3f64 100644
--- a/crates/core/src/lib.rs
+++ b/crates/core/src/lib.rs
@@ -9,6 +9,7 @@ mod catalog;
 mod command;
 mod error;
 mod ids;
+pub mod knowledge;
 mod model;
 mod protocol;
 mod redact;
diff --git a/crates/core/src/wire/method.rs b/crates/core/src/wire/method.rs
index d4633ea..dcc4a0b 100644
--- a/crates/core/src/wire/method.rs
+++ b/crates/core/src/wire/method.rs
@@ -63,6 +63,13 @@ pub const WORKTREE_REMOVE: &str = "worktree.remove";
 /// Read a sanitized local diagnostic snapshot.
 pub const DIAGNOSTICS_GET: &str = "diagnostics.get";
 
+/// List scoped saved prompts/context in bounded pages.
+pub const KNOWLEDGE_LIST: &str = "knowledge.list";
+/// Create or revision-check an explicit saved prompt/context.
+pub const KNOWLEDGE_SAVE: &str = "knowledge.save";
+/// Delete a saved prompt/context after checking its revision.
+pub const KNOWLEDGE_DELETE: &str = "knowledge.delete";
+
 /// Every method implemented by the Beta v1 contract.
 pub const ALL: &[&str] = &[
     SYSTEM_HELLO,
@@ -93,6 +100,9 @@ pub const ALL: &[&str] = &[
     WORKTREE_PREPARE_REMOVE,
     WORKTREE_REMOVE,
     DIAGNOSTICS_GET,
+    KNOWLEDGE_LIST,
+    KNOWLEDGE_SAVE,
+    KNOWLEDGE_DELETE,
 ];
 
 /// Returns whether a dotted method belongs to the Beta v1 contract.
diff --git a/crates/core/src/wire/mod.rs b/crates/core/src/wire/mod.rs
index cc73091..b69af5a 100644
--- a/crates/core/src/wire/mod.rs
+++ b/crates/core/src/wire/mod.rs
@@ -13,6 +13,12 @@ mod request;
 mod response;
 mod value;
 
+pub use crate::knowledge::{
+    KnowledgeBody, KnowledgeDeleteRequest, KnowledgeEntry, KnowledgeId, KnowledgeKind,
+    KnowledgeListRequest, KnowledgeListResponse, KnowledgeSaveRequest, KnowledgeTitle,
+    KnowledgeValidationError, MAX_KNOWLEDGE_BODY_BYTES, MAX_KNOWLEDGE_REVISION,
+    MAX_KNOWLEDGE_TITLE_BYTES,
+};
 pub use event::{
     AgentChangedEvent, AgentRemovedEvent, DaemonShuttingDownEvent, GitStatusChangedEvent,
     ProjectChangedEvent, ProjectRemovedEvent, SessionChangedEvent, SessionDeletedEvent,
diff --git a/crates/core/tests/knowledge_catalog.rs b/crates/core/tests/knowledge_catalog.rs
new file mode 100644
index 0000000..b28cd66
--- /dev/null
+++ b/crates/core/tests/knowledge_catalog.rs
@@ -0,0 +1,19 @@
+use cli_master_core::wire::{event_name, method};
+use serde_json::{Value, json};
+
+#[test]
+fn knowledge_operations_share_the_authoritative_catalog() {
+    let catalog: Value =
+        serde_json::from_str(include_str!("../../../protocol/catalog.json")).unwrap();
+    assert_eq!(catalog["methods"], json!(method::ALL));
+    assert_eq!(catalog["events"], json!(event_name::ALL));
+    for name in [
+        method::KNOWLEDGE_LIST,
+        method::KNOWLEDGE_SAVE,
+        method::KNOWLEDGE_DELETE,
+    ] {
+        assert!(method::is_supported(name));
+    }
+    // The metadata event is deliberately not advertised until its transport exists.
+    assert!(!event_name::is_supported("knowledge.updated"));
+}
diff --git a/crates/core/tests/knowledge_contract.rs b/crates/core/tests/knowledge_contract.rs
new file mode 100644
index 0000000..5920876
--- /dev/null
+++ b/crates/core/tests/knowledge_contract.rs
@@ -0,0 +1,271 @@
+use cli_master_core::{
+    ProjectId,
+    knowledge::{
+        KnowledgeBody, KnowledgeDeleteRequest, KnowledgeEntry, KnowledgeId, KnowledgeKind,
+        KnowledgeListRequest, KnowledgeListResponse, KnowledgeSaveRequest, KnowledgeTitle,
+        MAX_KNOWLEDGE_BODY_BYTES, MAX_KNOWLEDGE_REVISION, MAX_KNOWLEDGE_TITLE_BYTES,
+    },
+};
+use serde_json::{Value, json};
+use uuid::Uuid;
+
+fn create_payload() -> Value {
+    json!({"kind": "prompt", "title": "Review", "body": "  Review this change.\n"})
+}
+
+fn entry() -> KnowledgeEntry {
+    KnowledgeEntry {
+        id: KnowledgeId::new(),
+        kind: KnowledgeKind::Context,
+        project_id: Some(ProjectId::new()),
+        title: KnowledgeTitle::try_new("Architecture").unwrap(),
+        body: KnowledgeBody::try_new("Keep the process owner in the daemon.\n").unwrap(),
+        revision: 2,
+        created_at_ms: 1_778_000_000_000,
+        updated_at_ms: 1_778_000_000_001,
+    }
+}
+
+#[test]
+fn shared_page_fixture_matches_the_typed_contract_exactly() {
+    let fixture: Value = serde_json::from_str(include_str!(
+        "../../../protocol/fixtures/knowledge-page.json"
+    ))
+    .unwrap();
+    let page: KnowledgeListResponse = serde_json::from_value(fixture.clone()).unwrap();
+    assert!(page.entries[0].id < page.entries[1].id);
+    assert_eq!(page.entries[0].project_id, None);
+    assert!(page.entries[1].project_id.is_some());
+    assert_eq!(page.next_cursor, None);
+    assert_eq!(serde_json::to_value(page).unwrap(), fixture);
+}
+
+#[test]
+fn entry_timestamps_reject_negative_reversed_and_unsafe_values() {
+    for (created, updated) in [(-1, 0), (2, 1), (0, 9_007_199_254_740_992)] {
+        let mut invalid = entry();
+        invalid.created_at_ms = created;
+        invalid.updated_at_ms = updated;
+        assert!(invalid.validate().is_err());
+        assert!(serde_json::from_value::<KnowledgeEntry>(json!(invalid)).is_err());
+    }
+}
+
+#[test]
+fn identifiers_validate_version_and_variant_without_echoing_input() {
+    let id = KnowledgeId::new();
+    assert_eq!(id.as_uuid().get_version_num(), 7);
+    assert_eq!(id.to_string().parse::<KnowledgeId>().unwrap(), id);
+    assert_eq!(KnowledgeId::try_from_uuid(id.into_uuid()).unwrap(), id);
+    assert_eq!(
+        serde_json::from_value::<KnowledgeId>(json!(id)).unwrap(),
+        id
+    );
+    assert_eq!(KnowledgeId::default().as_uuid().get_version_num(), 7);
+
+    for invalid in [
+        "secret prompt text",
+        "00000000-0000-0000-0000-000000000000",
+        "550e8400-e29b-41d4-a716-446655440000",
+        "01900000-0000-7000-0000-000000000000",
+    ] {
+        let error = invalid.parse::<KnowledgeId>().unwrap_err();
+        assert_eq!(error.field(), "id");
+        assert!(!error.message().contains(invalid));
+        assert!(!error.to_string().contains(invalid));
+        assert!(serde_json::from_value::<KnowledgeId>(json!(invalid)).is_err());
+    }
+    assert!(KnowledgeId::try_from_uuid(Uuid::nil()).is_err());
+    assert!(serde_json::from_value::<KnowledgeId>(json!(5)).is_err());
+}
+
+#[test]
+fn text_validation_counts_utf8_bytes_preserves_whitespace_and_redacts_debug() {
+    let title = "á".repeat(MAX_KNOWLEDGE_TITLE_BYTES / 2);
+    assert_eq!(
+        KnowledgeTitle::try_new(title.clone()).unwrap().into_inner(),
+        title
+    );
+    assert!(KnowledgeTitle::try_new(format!("{title}a")).is_err());
+    let body = "á".repeat(MAX_KNOWLEDGE_BODY_BYTES / 2);
+    assert_eq!(
+        KnowledgeBody::try_new(body.clone()).unwrap().into_inner(),
+        body
+    );
+    assert!(KnowledgeBody::try_new(format!("{body}a")).is_err());
+
+    for invalid in ["", " \t\n", "private\0body"] {
+        assert!(KnowledgeTitle::try_new(invalid).is_err());
+        assert!(KnowledgeBody::try_new(invalid).is_err());
+    }
+    let text = "  private-content\n";
+    let title = KnowledgeTitle::try_new(text).unwrap();
+    let body = KnowledgeBody::try_new(text).unwrap();
+    assert_eq!(title.as_str(), text);
+    assert_eq!(body.as_str(), text);
+    assert!(!format!("{title:?} {body:?}").contains("private-content"));
+}
+
+#[test]
+fn create_and_update_require_matching_id_revision_presence() {
+    let created: KnowledgeSaveRequest = serde_json::from_value(create_payload()).unwrap();
+    assert_eq!(created.id, None);
+    assert_eq!(created.expected_revision, None);
+    assert_eq!(created.body.as_str(), "  Review this change.\n");
+    assert_eq!(serde_json::to_value(&created).unwrap(), create_payload());
+
+    let mut updated = create_payload();
+    updated["id"] = json!(KnowledgeId::new());
+    assert!(serde_json::from_value::<KnowledgeSaveRequest>(updated.clone()).is_err());
+    updated["expectedRevision"] = json!(1);
+    let request: KnowledgeSaveRequest = serde_json::from_value(updated.clone()).unwrap();
+    assert_eq!(request.expected_revision, Some(1));
+    assert_eq!(serde_json::to_value(&request).unwrap(), updated);
+    updated.as_object_mut().unwrap().remove("id");
+    assert!(serde_json::from_value::<KnowledgeSaveRequest>(updated).is_err());
+
+    let mut invalid_programmatic = created;
+    invalid_programmatic.expected_revision = Some(1);
+    assert!(invalid_programmatic.validate().is_err());
+}
+
+#[test]
+fn every_mutation_rejects_zero_fractional_and_unsafe_revisions() {
+    for revision in [
+        json!(0),
+        json!(-1),
+        json!(1.5),
+        json!(MAX_KNOWLEDGE_REVISION + 1),
+        json!("1"),
+    ] {
+        let mut update = create_payload();
+        update["id"] = json!(KnowledgeId::new());
+        update["expectedRevision"] = revision.clone();
+        assert!(serde_json::from_value::<KnowledgeSaveRequest>(update).is_err());
+        assert!(
+            serde_json::from_value::<KnowledgeDeleteRequest>(json!({
+                "id": KnowledgeId::new(), "expectedRevision": revision,
+            }))
+            .is_err()
+        );
+        let mut invalid_entry = serde_json::to_value(entry()).unwrap();
+        invalid_entry["revision"] = revision;
+        assert!(serde_json::from_value::<KnowledgeEntry>(invalid_entry).is_err());
+    }
+
+    for revision in [1, MAX_KNOWLEDGE_REVISION] {
+        let deletion = KnowledgeDeleteRequest {
+            id: KnowledgeId::new(),
+            expected_revision: revision,
+        };
+        let round_trip: KnowledgeDeleteRequest = serde_json::from_value(json!(deletion)).unwrap();
+        assert_eq!(round_trip, deletion);
+        let mut valid_entry = entry();
+        valid_entry.revision = revision;
+        assert!(serde_json::from_value::<KnowledgeEntry>(json!(valid_entry)).is_ok());
+    }
+}
+
+#[test]
+fn wire_contract_uses_camel_case_epoch_milliseconds_and_optional_scope() {
+    let entry = entry();
+    let encoded = serde_json::to_value(&entry).unwrap();
+    assert_eq!(encoded["createdAtMs"], 1_778_000_000_000_i64);
+    assert_eq!(encoded["updatedAtMs"], 1_778_000_000_001_i64);
+    assert_eq!(encoded["projectId"], json!(entry.project_id));
+    assert_eq!(encoded["kind"], "context");
+    assert_eq!(
+        serde_json::from_value::<KnowledgeEntry>(encoded).unwrap(),
+        entry
+    );
+
+    let mut global = entry;
+    global.project_id = None;
+    assert_eq!(
+        serde_json::to_value(global).unwrap()["projectId"],
+        Value::Null
+    );
+    assert_eq!(
+        serde_json::to_value(KnowledgeListRequest::default()).unwrap(),
+        json!({})
+    );
+}
+
+#[test]
+fn list_contract_validates_pagination_search_and_response() {
+    let id = KnowledgeId::new();
+    let project_id = ProjectId::new();
+    let request: KnowledgeListRequest = serde_json::from_value(json!({
+        "projectId": project_id, "kind": "prompt", "cursor": id, "query": "  secret_%query  ",
+    }))
+    .unwrap();
+    assert_eq!(request.project_id, Some(project_id));
+    assert_eq!(request.kind, Some(KnowledgeKind::Prompt));
+    assert_eq!(request.cursor, Some(id));
+    assert_eq!(request.query.as_deref(), Some("secret_%query"));
+    assert!(!format!("{request:?}").contains("secret_%query"));
+    assert!(serde_json::from_value::<KnowledgeListRequest>(json!({"query": "   "})).is_ok());
+    assert!(
+        serde_json::from_value::<KnowledgeListRequest>(json!({"query": "a".repeat(256)})).is_ok()
+    );
+    for invalid in ["a".repeat(257), "secret\0query".into()] {
+        assert!(serde_json::from_value::<KnowledgeListRequest>(json!({"query": invalid})).is_err());
+    }
+
+    let response = KnowledgeListResponse {
+        entries: vec![entry()],
+        next_cursor: Some(id),
+    };
+    let encoded = serde_json::to_value(&response).unwrap();
+    assert_eq!(encoded["nextCursor"], json!(id));
+    assert_eq!(
+        serde_json::from_value::<KnowledgeListResponse>(encoded).unwrap(),
+        response
+    );
+    assert_eq!(
+        serde_json::to_value(KnowledgeListResponse {
+            entries: vec![],
+            next_cursor: None
+        })
+        .unwrap(),
+        json!({"entries": [], "nextCursor": null}),
+    );
+}
+
+#[test]
+fn schemas_reject_unknown_duplicate_and_unsafe_fields_without_text_leaks() {
+    let mut save = create_payload();
+    save["private_unknown_content"] = json!(true);
+    let error = serde_json::from_value::<KnowledgeSaveRequest>(save).unwrap_err();
+    assert!(!error.to_string().contains("private_unknown_content"));
+    assert!(
+        serde_json::from_str::<KnowledgeSaveRequest>(
+            r#"{"kind":"prompt","title":"One","title":"Two","body":"Text"}"#,
+        )
+        .is_err()
+    );
+    assert!(serde_json::from_value::<KnowledgeListRequest>(json!({"limit": 99})).is_err());
+    assert!(
+        serde_json::from_value::<KnowledgeDeleteRequest>(json!({
+            "id": KnowledgeId::new(), "expectedRevision": 1, "force": true,
+        }))
+        .is_err()
+    );
+    let mut saved = serde_json::to_value(entry()).unwrap();
+    saved["extra"] = json!(true);
+    assert!(serde_json::from_value::<KnowledgeEntry>(saved).is_err());
+
+    for field in ["title", "body"] {
+        let mut invalid = create_payload();
+        invalid[field] = json!("private-content\0");
+        let error = serde_json::from_value::<KnowledgeSaveRequest>(invalid).unwrap_err();
+        assert!(!error.to_string().contains("private-content"));
+    }
+    let request: KnowledgeSaveRequest = serde_json::from_value(json!({
+        "kind": "prompt", "title": "private-title", "body": "private-body",
+    }))
+    .unwrap();
+    let debug = format!("{request:?}");
+    assert!(!debug.contains("private-title"));
+    assert!(!debug.contains("private-body"));
+}
diff --git a/crates/daemon/src/knowledge/mod.rs b/crates/daemon/src/knowledge/mod.rs
new file mode 100644
index 0000000..cce9d75
--- /dev/null
+++ b/crates/daemon/src/knowledge/mod.rs
@@ -0,0 +1,68 @@
+//! Local user-authored knowledge; no session or process side effects.
+
+use cli_master_core::ApiError;
+use cli_master_core::wire::{
+    EmptyResponse, KnowledgeDeleteRequest, KnowledgeListRequest, KnowledgeSaveRequest,
+};
+use cli_master_storage::Storage;
+use serde::de::DeserializeOwned;
+use serde_json::Value;
+use std::time::{SystemTime, UNIX_EPOCH};
+
+/// Handle only the registered knowledge methods through the existing database.
+pub(crate) fn dispatch(method: &str, payload: Value, storage: &Storage) -> Result<Value, ApiError> {
+    use cli_master_core::wire::method;
+    match method {
+        method::KNOWLEDGE_LIST => {
+            let request: KnowledgeListRequest = decode(payload)?;
+            encode(
+                storage
+                    .list_knowledge(&request)
+                    .map_err(|error| error.to_api_error())?,
+            )
+        }
+        method::KNOWLEDGE_SAVE => {
+            let request: KnowledgeSaveRequest = decode(payload)?;
+            let now = SystemTime::now()
+                .duration_since(UNIX_EPOCH)
+                .ok()
+                .and_then(|elapsed| i64::try_from(elapsed.as_millis()).ok())
+                .ok_or_else(|| {
+                    ApiError::new("clock_unavailable", "The local clock is unavailable.")
+                })?;
+            encode(
+                storage
+                    .save_knowledge(&request, now)
+                    .map_err(|error| error.to_api_error())?,
+            )
+        }
+        method::KNOWLEDGE_DELETE => {
+            let request: KnowledgeDeleteRequest = decode(payload)?;
+            storage
+                .delete_knowledge(&request)
+                .map_err(|error| error.to_api_error())?;
+            encode(EmptyResponse::default())
+        }
+        _ => Err(ApiError::new(
+            "unsupported_method",
+            "Unknown knowledge operation.",
+        )),
+    }
+}
+
+fn decode<T: DeserializeOwned>(payload: Value) -> Result<T, ApiError> {
+    // Serde errors can quote a user value (e.g. an invalid enum variant). Never
+    // attach them to errors for a text-bearing knowledge request.
+    serde_json::from_value(payload).map_err(|_| {
+        ApiError::new(
+            "invalid_payload",
+            "The saved prompt or context request is invalid.",
+        )
+        .with_action("Check the title, text, scope and revision, then retry.")
+    })
+}
+
+fn encode(value: impl serde::Serialize) -> Result<Value, ApiError> {
+    serde_json::to_value(value)
+        .map_err(|_| ApiError::new("internal_error", "The local response could not be encoded."))
+}
diff --git a/crates/daemon/src/lib.rs b/crates/daemon/src/lib.rs
index 7575f9f..685d628 100644
--- a/crates/daemon/src/lib.rs
+++ b/crates/daemon/src/lib.rs
@@ -14,6 +14,7 @@ mod diagnostics;
 mod error;
 mod events;
 mod git_inspection;
+mod knowledge;
 mod lock;
 mod paths;
 mod preflight;
diff --git a/crates/daemon/src/server.rs b/crates/daemon/src/server.rs
index 43ce49d..4825586 100644
--- a/crates/daemon/src/server.rs
+++ b/crates/daemon/src/server.rs
@@ -551,6 +551,9 @@ async fn dispatch(request: RequestEnvelope<Value>, state: &ServerState) -> Respo
     }
 
     let result = match request.method.as_str() {
+        method::KNOWLEDGE_LIST | method::KNOWLEDGE_SAVE | method::KNOWLEDGE_DELETE => {
+            crate::knowledge::dispatch(&request.method, request.payload, &state.git_storage)
+        }
         method::SYSTEM_HELLO => encode_response(&state.hello),
         method::STATE_SNAPSHOT => state.projects.snapshot().and_then(|projects| {
             let agents = state.sessions.agents()?;
diff --git a/crates/daemon/tests/knowledge_ipc.rs b/crates/daemon/tests/knowledge_ipc.rs
new file mode 100644
index 0000000..1417ade
--- /dev/null
+++ b/crates/daemon/tests/knowledge_ipc.rs
@@ -0,0 +1,248 @@
+//! Real socket/SQLite acceptance for local prompts and context.
+use std::{path::Path, process::Command, time::Duration};
+
+use cli_master_core::{RequestEnvelope, ResponseEnvelope, ResponsePayload};
+use cli_master_daemon::{Daemon, DaemonConfig, MAX_FRAME_LENGTH};
+use futures_util::{SinkExt, StreamExt};
+use serde_json::{Value, json};
+use tempfile::TempDir;
+use tokio::net::UnixStream;
+use tokio_util::{
+    codec::{Framed, LengthDelimitedCodec},
+    sync::CancellationToken,
+};
+
+type Client = Framed<UnixStream, LengthDelimitedCodec>;
+
+struct Running {
+    config: DaemonConfig,
+    cancellation: CancellationToken,
+    task: tokio::task::JoinHandle<Result<(), cli_master_daemon::DaemonError>>,
+}
+
+impl Running {
+    fn start(root: &Path) -> Self {
+        let config = DaemonConfig::from_paths(root.join("data"), root.join("run"));
+        let daemon = Daemon::bind(config.clone()).unwrap();
+        let cancellation = CancellationToken::new();
+        let token = cancellation.clone();
+        let task = tokio::spawn(async move { daemon.run(token).await });
+        Self {
+            config,
+            cancellation,
+            task,
+        }
+    }
+
+    async fn connect(&self) -> Client {
+        LengthDelimitedCodec::builder()
+            .max_frame_length(MAX_FRAME_LENGTH)
+            .new_framed(
+                UnixStream::connect(self.config.socket_path())
+                    .await
+                    .unwrap(),
+            )
+    }
+
+    async fn stop(self) {
+        self.cancellation.cancel();
+        tokio::time::timeout(Duration::from_secs(5), self.task)
+            .await
+            .unwrap()
+            .unwrap()
+            .unwrap();
+    }
+}
+
+async fn exchange(client: &mut Client, method: &str, payload: Value) -> ResponseEnvelope<Value> {
+    let request = RequestEnvelope::v1(method, payload);
+    client
+        .send(serde_json::to_vec(&request).unwrap().into())
+        .await
+        .unwrap();
+    let bytes = tokio::time::timeout(Duration::from_secs(5), client.next())
+        .await
+        .unwrap()
+        .unwrap()
+        .unwrap();
+    assert!(bytes.len() <= MAX_FRAME_LENGTH);
+    let response: ResponseEnvelope<Value> = serde_json::from_slice(&bytes).unwrap();
+    assert_eq!(response.request_id, request.request_id);
+    response
+}
+
+async fn success(client: &mut Client, method: &str, payload: Value) -> Value {
+    match exchange(client, method, payload).await.payload {
+        ResponsePayload::Success { data } => data,
+        ResponsePayload::Error { error } => panic!("{method}: {}", error.code),
+    }
+}
+
+fn error_code(response: ResponseEnvelope<Value>) -> String {
+    match response.payload {
+        ResponsePayload::Error { error } => error.code,
+        ResponsePayload::Success { .. } => panic!("expected request failure"),
+    }
+}
+
+async fn project(client: &mut Client, root: &Path, name: &str) -> Value {
+    let path = root.join(name);
+    std::fs::create_dir(&path).unwrap();
+    assert!(
+        Command::new("git")
+            .args(["init", "--initial-branch=main"])
+            .current_dir(&path)
+            .output()
+            .unwrap()
+            .status
+            .success()
+    );
+    success(client, "project.add", json!({"path":path, "name":name})).await["id"].clone()
+}
+
+#[tokio::test]
+async fn knowledge_scopes_conflicts_restart_and_no_session_effects() {
+    let root = TempDir::new().unwrap();
+    let daemon = Running::start(root.path());
+    let mut client = daemon.connect().await;
+    let mut second = daemon.connect().await;
+    let first_project = project(&mut client, root.path(), "first").await;
+    let other_project = project(&mut client, root.path(), "other").await;
+    let before = success(&mut client, "state.snapshot", json!({})).await;
+    let global = success(&mut client, "knowledge.save", json!({
+        "kind":"prompt", "projectId":null, "title":"Review % literal", "body":"Review this change without sending anything."
+    })).await;
+    assert!(global["projectId"].is_null());
+    let local = success(&mut client, "knowledge.save", json!({
+        "kind":"context", "projectId":first_project, "title":"Decision", "body":"Keep the original process owner."
+    })).await;
+    let page = success(
+        &mut second,
+        "knowledge.list",
+        json!({"projectId":first_project}),
+    )
+    .await;
+    assert_eq!(page["entries"].as_array().unwrap().len(), 2);
+    assert!(page["nextCursor"].is_null());
+    let other = success(
+        &mut second,
+        "knowledge.list",
+        json!({"projectId":other_project}),
+    )
+    .await;
+    assert_eq!(other["entries"], json!([global]));
+    let literal = success(&mut second, "knowledge.list", json!({"query":"%"})).await;
+    assert_eq!(literal["entries"], json!([global]));
+    let updated = success(
+        &mut client,
+        "knowledge.save",
+        json!({
+            "id":global["id"], "expectedRevision":1, "kind":"prompt", "projectId":null,
+            "title":"Reviewed", "body":"Updated prompt"
+        }),
+    )
+    .await;
+    assert_eq!(updated["revision"], 2);
+    assert_eq!(updated["createdAtMs"], global["createdAtMs"]);
+    for method in ["knowledge.save", "knowledge.delete"] {
+        let payload = if method == "knowledge.save" {
+            json!({
+                "id":global["id"], "expectedRevision":1, "kind":"prompt", "projectId":null,
+                "title":"stale", "body":"must not replace updated text"
+            })
+        } else {
+            json!({"id":global["id"], "expectedRevision":1})
+        };
+        assert_eq!(
+            error_code(exchange(&mut second, method, payload).await),
+            "knowledge_conflict"
+        );
+    }
+    let after = success(&mut client, "state.snapshot", json!({})).await;
+    assert_eq!(after["sessions"], before["sessions"]);
+    assert_eq!(after["worktrees"], before["worktrees"]);
+    drop(client);
+    drop(second);
+    daemon.stop().await;
+
+    let daemon = Running::start(root.path());
+    let mut client = daemon.connect().await;
+    let page = success(
+        &mut client,
+        "knowledge.list",
+        json!({"projectId":first_project}),
+    )
+    .await;
+    assert!(page["entries"].as_array().unwrap().contains(&updated));
+    assert!(page["entries"].as_array().unwrap().contains(&local));
+    success(
+        &mut client,
+        "knowledge.delete",
+        json!({"id":updated["id"],"expectedRevision":2}),
+    )
+    .await;
+    success(
+        &mut client,
+        "project.remove",
+        json!({"projectId":first_project}),
+    )
+    .await;
+    assert!(root.path().join("first/.git").is_dir());
+    let empty = success(&mut client, "knowledge.list", json!({})).await;
+    assert_eq!(empty, json!({"entries":[],"nextCursor":null}));
+    daemon.stop().await;
+}
+
+#[tokio::test]
+async fn knowledge_worst_case_escaped_pages_and_safe_invalid_payloads() {
+    let root = TempDir::new().unwrap();
+    let daemon = Running::start(root.path());
+    let mut client = daemon.connect().await;
+    let body = "\u{1}".repeat(65_536);
+    let mut ids = Vec::new();
+    for index in 0..3 {
+        let entry = success(
+            &mut client,
+            "knowledge.save",
+            json!({
+                "kind":"prompt", "title":format!("Large {index}"), "body":body, "projectId":null
+            }),
+        )
+        .await;
+        ids.push(entry["id"].clone());
+    }
+    let mut seen = Vec::new();
+    let mut cursor = Value::Null;
+    for _ in 0..4 {
+        let page = success(&mut client, "knowledge.list", json!({"cursor":cursor})).await;
+        for entry in page["entries"].as_array().unwrap() {
+            assert_eq!(entry["body"], body);
+            seen.push(entry["id"].clone());
+        }
+        cursor = page["nextCursor"].clone();
+        if cursor.is_null() {
+            break;
+        }
+    }
+    assert!(cursor.is_null());
+    assert_eq!(seen, ids);
+    for payload in [
+        json!({"kind":"private-submitted-content", "title":"text", "body":"private-submitted-content"}),
+        json!({"kind":"prompt", "title":"text", "body":"private-submitted-content", "expectedRevision":0}),
+        json!({"kind":"prompt", "title":"text", "body":"x".repeat(65_537)}),
+        json!({"kind":"prompt", "title":"text", "body":"\0"}),
+    ] {
+        let response = exchange(&mut client, "knowledge.save", payload).await;
+        assert!(
+            !serde_json::to_string(&response)
+                .unwrap()
+                .contains("private-submitted-content")
+        );
+        assert_eq!(error_code(response), "invalid_payload");
+    }
+    assert_eq!(
+        success(&mut client, "state.snapshot", json!({})).await["sessions"],
+        json!([])
+    );
+    daemon.stop().await;
+}
diff --git a/crates/storage/migrations/0004_knowledge_documents.sql b/crates/storage/migrations/0004_knowledge_documents.sql
new file mode 100644
index 0000000..e663cb5
--- /dev/null
+++ b/crates/storage/migrations/0004_knowledge_documents.sql
@@ -0,0 +1,29 @@
+-- Explicitly saved local content. Project removal deletes scoped metadata only.
+CREATE TABLE knowledge_documents (
+    id              TEXT PRIMARY KEY NOT NULL,
+    kind            TEXT NOT NULL CHECK (kind IN ('prompt', 'context')),
+    project_id      TEXT REFERENCES projects(id) ON DELETE CASCADE,
+    title           TEXT NOT NULL CHECK (
+                        length(CAST(title AS BLOB)) BETWEEN 1 AND 256
+                        AND instr(title, char(0)) = 0
+                    ),
+    body            TEXT NOT NULL CHECK (
+                        length(CAST(body AS BLOB)) BETWEEN 1 AND 65536
+                        AND instr(body, char(0)) = 0
+                    ),
+    revision        INTEGER NOT NULL CHECK (
+                        typeof(revision) = 'integer'
+                        AND revision BETWEEN 1 AND 9007199254740991
+                    ),
+    created_at_ms   INTEGER NOT NULL CHECK (
+                        typeof(created_at_ms) = 'integer'
+                        AND created_at_ms BETWEEN 0 AND 9007199254740991
+                    ),
+    updated_at_ms   INTEGER NOT NULL CHECK (
+                        typeof(updated_at_ms) = 'integer'
+                        AND updated_at_ms BETWEEN created_at_ms AND 9007199254740991
+                    )
+);
+
+CREATE INDEX knowledge_by_scope_id ON knowledge_documents(project_id, id);
+CREATE INDEX knowledge_by_scope_kind_id ON knowledge_documents(project_id, kind, id);
diff --git a/crates/storage/src/durability_tests.rs b/crates/storage/src/durability_tests.rs
index 004168a..f29fc29 100644
--- a/crates/storage/src/durability_tests.rs
+++ b/crates/storage/src/durability_tests.rs
@@ -35,6 +35,7 @@ fn configured_file_database_uses_full_wal_and_verified_schema() {
             (1, "initial"),
             (2, "worktree_dirty_state"),
             (3, "recovery_metadata"),
+            (4, "knowledge_documents"),
         ]
     );
 
diff --git a/crates/storage/src/knowledge/mod.rs b/crates/storage/src/knowledge/mod.rs
new file mode 100644
index 0000000..917514f
--- /dev/null
+++ b/crates/storage/src/knowledge/mod.rs
@@ -0,0 +1,402 @@
+//! Durable, explicitly saved local prompts and context with optimistic writes.
+
+use std::{error::Error, fmt};
+
+use cli_master_core::{
+    ApiError, ProjectId,
+    knowledge::{
+        KnowledgeBody, KnowledgeDeleteRequest, KnowledgeEntry, KnowledgeId, KnowledgeKind,
+        KnowledgeListRequest, KnowledgeListResponse, KnowledgeSaveRequest, KnowledgeTitle,
+        KnowledgeValidationError, MAX_KNOWLEDGE_REVISION,
+    },
+};
+use rusqlite::{Connection, OptionalExtension, Row, TransactionBehavior, params};
+
+use crate::{Storage, StorageError};
+
+/// Maximum rows returned in one knowledge page.
+pub const MAX_KNOWLEDGE_PAGE_ENTRIES: usize = 50;
+/// Maximum serialized page size, leaving space for the socket response envelope.
+pub const MAX_KNOWLEDGE_PAGE_BYTES: usize = 512 * 1_024;
+
+const ENTRY_COLUMNS: &str =
+    "id, kind, project_id, title, body, revision, created_at_ms, updated_at_ms";
+// Reserve more than the fixed JSON wrapper plus a UUID next-page cursor.
+const PAGE_OVERHEAD_BYTES: usize = 128;
+
+/// Safe knowledge repository failure. Diagnostic formatting never includes text.
+pub enum KnowledgeStorageError {
+    /// Caller supplied a malformed request.
+    InvalidInput(KnowledgeValidationError),
+    /// The supplied clock value cannot be represented safely on the wire.
+    InvalidTimestamp,
+    /// The requested saved entry no longer exists.
+    NotFound,
+    /// The selected project does not exist.
+    ProjectNotFound,
+    /// Another writer changed the entry after the caller loaded it.
+    Conflict,
+    /// The entry exhausted the revision range and cannot be incremented.
+    RevisionExhausted,
+    /// Persisted content violates the typed contract.
+    CorruptData,
+    /// The underlying metadata store could not complete the operation.
+    Storage(StorageError),
+}
+
+impl KnowledgeStorageError {
+    /// Projects a failure into a stable error without SQL or saved content.
+    #[must_use]
+    pub fn to_api_error(&self) -> ApiError {
+        let (code, action) = match self {
+            Self::InvalidInput(_) | Self::InvalidTimestamp => {
+                ("invalid_request", "Correct the request and retry")
+            }
+            Self::NotFound => ("knowledge_not_found", "Reload the saved library"),
+            Self::ProjectNotFound => ("project_not_found", "Select an existing project"),
+            Self::Conflict => (
+                "knowledge_conflict",
+                "Reload the entry before saving or deleting",
+            ),
+            Self::RevisionExhausted => (
+                "knowledge_revision_exhausted",
+                "Save the content as a new entry",
+            ),
+            Self::CorruptData => (
+                "knowledge_corrupt_data",
+                "Restore a known-good database backup",
+            ),
+            Self::Storage(error) => return error.to_api_error(),
+        };
+        ApiError::new(code, self.to_string()).with_action(action)
+    }
+}
+
+impl fmt::Display for KnowledgeStorageError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::InvalidInput(error) => error.fmt(formatter),
+            Self::InvalidTimestamp => {
+                formatter.write_str("Knowledge timestamp is outside the supported range")
+            }
+            Self::NotFound => formatter.write_str("The saved entry no longer exists"),
+            Self::ProjectNotFound => formatter.write_str("The selected project no longer exists"),
+            Self::Conflict => {
+                formatter.write_str("The saved entry has changed since it was loaded")
+            }
+            Self::RevisionExhausted => {
+                formatter.write_str("The saved entry cannot advance its revision")
+            }
+            Self::CorruptData => {
+                formatter.write_str("Stored knowledge does not match the supported contract")
+            }
+            Self::Storage(error) => fmt::Display::fmt(error, formatter),
+        }
+    }
+}
+
+impl fmt::Debug for KnowledgeStorageError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        fmt::Display::fmt(self, formatter)
+    }
+}
+
+// Deliberately avoid exposing underlying SQLite errors through a source chain.
+impl Error for KnowledgeStorageError {}
+
+impl From<StorageError> for KnowledgeStorageError {
+    fn from(value: StorageError) -> Self {
+        Self::Storage(value)
+    }
+}
+
+impl From<rusqlite::Error> for KnowledgeStorageError {
+    fn from(value: rusqlite::Error) -> Self {
+        Self::Storage(StorageError::Database(value))
+    }
+}
+
+impl From<KnowledgeValidationError> for KnowledgeStorageError {
+    fn from(value: KnowledgeValidationError) -> Self {
+        Self::InvalidInput(value)
+    }
+}
+
+impl Storage {
+    /// Lists globals or globals plus one existing project's entries in ID order.
+    ///
+    /// The page is bounded by row count and actual JSON size. Literal search
+    /// uses `SQLite`'s built-in case folding, which is case-insensitive for ASCII.
+    /// Project validation and the page read share one database snapshot.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error for invalid input, a missing project, corrupt rows, or database failure.
+    pub fn list_knowledge(
+        &self,
+        request: &KnowledgeListRequest,
+    ) -> Result<KnowledgeListResponse, KnowledgeStorageError> {
+        request.validate()?;
+        self.with_connection_mut("list knowledge", |connection| {
+            Ok(list_knowledge(connection, request))
+        })?
+    }
+
+    /// Creates an entry or atomically replaces the caller's expected revision.
+    ///
+    /// An update may explicitly change kind or scope. Saved text is never
+    /// executed or sent to an agent by this operation. Clock rollback does not
+    /// decrease the entry's update timestamp.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error for invalid input, a missing row/project, a stale or
+    /// exhausted revision, or database failure. Failed writes roll back fully.
+    pub fn save_knowledge(
+        &self,
+        request: &KnowledgeSaveRequest,
+        now: i64,
+    ) -> Result<KnowledgeEntry, KnowledgeStorageError> {
+        request.validate()?;
+        if !(0..=9_007_199_254_740_991).contains(&now) {
+            return Err(KnowledgeStorageError::InvalidTimestamp);
+        }
+        self.with_connection_mut("save knowledge", |connection| {
+            Ok(save_knowledge(connection, request, now))
+        })?
+    }
+
+    /// Atomically deletes only the entry revision observed by the caller.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error for invalid input, a missing entry, a stale revision, or database failure.
+    pub fn delete_knowledge(
+        &self,
+        request: &KnowledgeDeleteRequest,
+    ) -> Result<(), KnowledgeStorageError> {
+        request.validate()?;
+        self.with_connection_mut("delete knowledge", |connection| {
+            Ok(delete_knowledge(connection, request))
+        })?
+    }
+}
+
+fn list_knowledge(
+    connection: &mut Connection,
+    request: &KnowledgeListRequest,
+) -> Result<KnowledgeListResponse, KnowledgeStorageError> {
+    let transaction = connection.transaction()?;
+    require_project(&transaction, request.project_id)?;
+    let sql = format!(
+        "SELECT {ENTRY_COLUMNS} FROM knowledge_documents
+         WHERE (project_id IS NULL OR project_id = ?1)
+           AND (?2 IS NULL OR kind = ?2)
+           AND (?3 IS NULL OR id > ?3)
+           AND (?4 = '' OR instr(lower(title), lower(?4)) > 0
+                        OR instr(lower(body), lower(?4)) > 0)
+         ORDER BY id ASC LIMIT 51"
+    );
+    let mut statement = transaction.prepare(&sql)?;
+    let mut rows = statement.query(params![
+        request.project_id.map(|id| id.to_string()),
+        request.kind.map(kind_name),
+        request.cursor.map(|id| id.to_string()),
+        request.query.as_deref().unwrap_or("").trim(),
+    ])?;
+    let mut page = KnowledgeListResponse {
+        entries: Vec::new(),
+        next_cursor: None,
+    };
+    let mut page_bytes = PAGE_OVERHEAD_BYTES;
+    while let Some(row) = rows.next()? {
+        if page.entries.len() == MAX_KNOWLEDGE_PAGE_ENTRIES {
+            page.next_cursor = page.entries.last().map(|entry| entry.id);
+            break;
+        }
+        let entry = decode_entry(row)?;
+        let serialized =
+            serde_json::to_vec(&entry).map_err(|_| KnowledgeStorageError::CorruptData)?;
+        if page_bytes + serialized.len() + 1 > MAX_KNOWLEDGE_PAGE_BYTES {
+            let Some(last) = page.entries.last() else {
+                return Err(KnowledgeStorageError::CorruptData);
+            };
+            page.next_cursor = Some(last.id);
+            break;
+        }
+        page_bytes += serialized.len() + 1;
+        page.entries.push(entry);
+    }
+    drop(rows);
+    drop(statement);
+    transaction.commit()?;
+    Ok(page)
+}
+
+fn save_knowledge(
+    connection: &mut Connection,
+    request: &KnowledgeSaveRequest,
+    now: i64,
+) -> Result<KnowledgeEntry, KnowledgeStorageError> {
+    let transaction = connection.transaction_with_behavior(TransactionBehavior::Immediate)?;
+    require_project(&transaction, request.project_id)?;
+    let (id, revision, created_at_ms, updated_at_ms) = match (request.id, request.expected_revision)
+    {
+        (Some(id), Some(expected_revision)) => {
+            let current = load_entry(&transaction, id)?.ok_or(KnowledgeStorageError::NotFound)?;
+            if current.revision != expected_revision {
+                return Err(KnowledgeStorageError::Conflict);
+            }
+            if current.revision == MAX_KNOWLEDGE_REVISION {
+                return Err(KnowledgeStorageError::RevisionExhausted);
+            }
+            (
+                id,
+                current.revision + 1,
+                current.created_at_ms,
+                now.max(current.updated_at_ms),
+            )
+        }
+        (None, None) => (KnowledgeId::new(), 1, now, now),
+        _ => return Err(KnowledgeStorageError::CorruptData),
+    };
+    let entry = KnowledgeEntry {
+        id,
+        kind: request.kind,
+        project_id: request.project_id,
+        title: request.title.clone(),
+        body: request.body.clone(),
+        revision,
+        created_at_ms,
+        updated_at_ms,
+    };
+    entry.validate()?;
+    let revision_sql =
+        i64::try_from(entry.revision).map_err(|_| KnowledgeStorageError::RevisionExhausted)?;
+    let changed = if let Some(expected_revision) = request.expected_revision {
+        let expected_sql = i64::try_from(expected_revision)
+            .map_err(|_| KnowledgeStorageError::RevisionExhausted)?;
+        transaction.execute(
+            "UPDATE knowledge_documents SET kind = ?2, project_id = ?3, title = ?4,
+             body = ?5, revision = ?6, updated_at_ms = ?7 WHERE id = ?1 AND revision = ?8",
+            params![
+                id.to_string(),
+                kind_name(entry.kind),
+                entry.project_id.map(|id| id.to_string()),
+                entry.title.as_str(),
+                entry.body.as_str(),
+                revision_sql,
+                updated_at_ms,
+                expected_sql
+            ],
+        )?
+    } else {
+        transaction.execute(
+            "INSERT INTO knowledge_documents
+             (id, kind, project_id, title, body, revision, created_at_ms, updated_at_ms)
+             VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8)",
+            params![
+                id.to_string(),
+                kind_name(entry.kind),
+                entry.project_id.map(|id| id.to_string()),
+                entry.title.as_str(),
+                entry.body.as_str(),
+                revision_sql,
+                created_at_ms,
+                updated_at_ms
+            ],
+        )?
+    };
+    if changed != 1 {
+        return Err(KnowledgeStorageError::Conflict);
+    }
+    transaction.commit()?;
+    Ok(entry)
+}
+
+fn delete_knowledge(
+    connection: &mut Connection,
+    request: &KnowledgeDeleteRequest,
+) -> Result<(), KnowledgeStorageError> {
+    let transaction = connection.transaction_with_behavior(TransactionBehavior::Immediate)?;
+    let current = load_entry(&transaction, request.id)?.ok_or(KnowledgeStorageError::NotFound)?;
+    if current.revision != request.expected_revision {
+        return Err(KnowledgeStorageError::Conflict);
+    }
+    let revision = i64::try_from(request.expected_revision)
+        .map_err(|_| KnowledgeStorageError::RevisionExhausted)?;
+    let changed = transaction.execute(
+        "DELETE FROM knowledge_documents WHERE id = ?1 AND revision = ?2",
+        params![request.id.to_string(), revision],
+    )?;
+    if changed != 1 {
+        return Err(KnowledgeStorageError::Conflict);
+    }
+    transaction.commit()?;
+    Ok(())
+}
+
+fn require_project(
+    connection: &Connection,
+    project: Option<ProjectId>,
+) -> Result<(), KnowledgeStorageError> {
+    if let Some(id) = project {
+        let exists: bool = connection.query_row(
+            "SELECT EXISTS(SELECT 1 FROM projects WHERE id = ?1)",
+            [id.to_string()],
+            |row| row.get(0),
+        )?;
+        if !exists {
+            return Err(KnowledgeStorageError::ProjectNotFound);
+        }
+    }
+    Ok(())
+}
+
+fn load_entry(
+    connection: &Connection,
+    id: KnowledgeId,
+) -> Result<Option<KnowledgeEntry>, KnowledgeStorageError> {
+    let sql = format!("SELECT {ENTRY_COLUMNS} FROM knowledge_documents WHERE id = ?1");
+    connection
+        .query_row(&sql, [id.to_string()], |row| Ok(decode_entry(row)))
+        .optional()?
+        .transpose()
+}
+
+fn decode_entry(row: &Row<'_>) -> Result<KnowledgeEntry, KnowledgeStorageError> {
+    let id: String = row.get(0)?;
+    let kind: String = row.get(1)?;
+    let project: Option<String> = row.get(2)?;
+    let revision: i64 = row.get(5)?;
+    let entry = KnowledgeEntry {
+        id: id.parse().map_err(|_| KnowledgeStorageError::CorruptData)?,
+        kind: match kind.as_str() {
+            "prompt" => KnowledgeKind::Prompt,
+            "context" => KnowledgeKind::Context,
+            _ => return Err(KnowledgeStorageError::CorruptData),
+        },
+        project_id: project
+            .map(|id| id.parse())
+            .transpose()
+            .map_err(|_| KnowledgeStorageError::CorruptData)?,
+        title: KnowledgeTitle::try_new(row.get::<_, String>(3)?)
+            .map_err(|_| KnowledgeStorageError::CorruptData)?,
+        body: KnowledgeBody::try_new(row.get::<_, String>(4)?)
+            .map_err(|_| KnowledgeStorageError::CorruptData)?,
+        revision: u64::try_from(revision).map_err(|_| KnowledgeStorageError::CorruptData)?,
+        created_at_ms: row.get(6)?,
+        updated_at_ms: row.get(7)?,
+    };
+    entry
+        .validate()
+        .map_err(|_| KnowledgeStorageError::CorruptData)?;
+    Ok(entry)
+}
+
+const fn kind_name(kind: KnowledgeKind) -> &'static str {
+    match kind {
+        KnowledgeKind::Prompt => "prompt",
+        KnowledgeKind::Context => "context",
+    }
+}
diff --git a/crates/storage/src/lib.rs b/crates/storage/src/lib.rs
index 97c88f4..63572a3 100644
--- a/crates/storage/src/lib.rs
+++ b/crates/storage/src/lib.rs
@@ -8,6 +8,7 @@
 mod agents;
 mod connection;
 mod error;
+pub mod knowledge;
 mod migrate;
 mod models;
 mod paths;
@@ -31,11 +32,12 @@ use crate::connection::{StorageLocation, maybe_backup_before_migrate};
 
 pub use connection::Storage;
 pub use error::StorageError;
+pub use knowledge::KnowledgeStorageError;
 pub use models::{SessionRuntimeUpdate, StoredAgent, StoredSession, StoredWorktree, WorktreeState};
 pub use recovery::{ReconciliationEvent, ReconciliationReason, RecoveryContext};
 
 /// The newest schema version understood by this crate.
-pub const LATEST_SCHEMA_VERSION: u32 = 3;
+pub const LATEST_SCHEMA_VERSION: u32 = 4;
 
 impl Storage {
     /// Opens and configures a file-backed `SQLite` database.
diff --git a/crates/storage/src/migrate.rs b/crates/storage/src/migrate.rs
index 1f6cbc3..ce4e2c1 100644
--- a/crates/storage/src/migrate.rs
+++ b/crates/storage/src/migrate.rs
@@ -33,6 +33,12 @@ const MIGRATIONS: &[Migration] = &[
         sql: include_str!("../migrations/0003_recovery_metadata.sql"),
         destructive: false,
     },
+    Migration {
+        version: 4,
+        name: "knowledge_documents",
+        sql: include_str!("../migrations/0004_knowledge_documents.sql"),
+        destructive: false,
+    },
 ];
 
 const REQUIRED_TABLES: &[(&str, &[&str])] = &[
@@ -91,6 +97,19 @@ const REQUIRED_TABLES: &[(&str, &[&str])] = &[
         ],
     ),
     ("settings", &["key", "value_json", "updated_at"]),
+    (
+        "knowledge_documents",
+        &[
+            "id",
+            "kind",
+            "project_id",
+            "title",
+            "body",
+            "revision",
+            "created_at_ms",
+            "updated_at_ms",
+        ],
+    ),
     ("schema_migrations", &["version", "name", "applied_at"]),
 ];
 
@@ -103,6 +122,8 @@ const REQUIRED_INDEXES: &[&str] = &[
     "sessions_by_agent",
     "sessions_by_daemon_status",
     "custom_agents_by_updated",
+    "knowledge_by_scope_id",
+    "knowledge_by_scope_kind_id",
 ];
 
 const REQUIRED_TRIGGERS: &[&str] = &[
diff --git a/crates/storage/tests/knowledge.rs b/crates/storage/tests/knowledge.rs
new file mode 100644
index 0000000..3a960e6
--- /dev/null
+++ b/crates/storage/tests/knowledge.rs
@@ -0,0 +1,509 @@
+mod common;
+
+use std::{
+    collections::BTreeSet,
+    sync::{Arc, Barrier},
+    thread,
+};
+
+use cli_master_core::{
+    ProjectId,
+    knowledge::{
+        KnowledgeBody, KnowledgeDeleteRequest, KnowledgeEntry, KnowledgeKind, KnowledgeListRequest,
+        KnowledgeSaveRequest, KnowledgeTitle, MAX_KNOWLEDGE_BODY_BYTES, MAX_KNOWLEDGE_REVISION,
+    },
+};
+use cli_master_storage::{
+    KnowledgeStorageError, LATEST_SCHEMA_VERSION, Storage,
+    knowledge::{MAX_KNOWLEDGE_PAGE_BYTES, MAX_KNOWLEDGE_PAGE_ENTRIES},
+};
+use rusqlite::{Connection, params};
+use tempfile::TempDir;
+
+const NOW: i64 = 1_788_600_000_000;
+
+fn create(
+    project_id: Option<ProjectId>,
+    kind: KnowledgeKind,
+    title: &str,
+    body: &str,
+) -> KnowledgeSaveRequest {
+    KnowledgeSaveRequest {
+        id: None,
+        expected_revision: None,
+        project_id,
+        kind,
+        title: KnowledgeTitle::try_new(title).unwrap(),
+        body: KnowledgeBody::try_new(body).unwrap(),
+    }
+}
+
+fn update(entry: &KnowledgeEntry, body: &str) -> KnowledgeSaveRequest {
+    KnowledgeSaveRequest {
+        id: Some(entry.id),
+        expected_revision: Some(entry.revision),
+        project_id: entry.project_id,
+        kind: entry.kind,
+        title: entry.title.clone(),
+        body: KnowledgeBody::try_new(body).unwrap(),
+    }
+}
+
+fn list(project_id: Option<ProjectId>) -> KnowledgeListRequest {
+    KnowledgeListRequest {
+        project_id,
+        ..KnowledgeListRequest::default()
+    }
+}
+
+#[test]
+fn entries_survive_reopen_with_scopes_kind_search_and_monotonic_timestamps() {
+    let directory = TempDir::new().unwrap();
+    let path = directory.path().join("knowledge.db");
+    let storage = Storage::open_migrated(&path).unwrap();
+    let project = common::project("First", directory.path().join("first"));
+    let other = common::project("Other", directory.path().join("other"));
+    storage.insert_project(&project).unwrap();
+    storage.insert_project(&other).unwrap();
+    let global = storage
+        .save_knowledge(
+            &create(None, KnowledgeKind::Prompt, "Review", "Check failures"),
+            NOW,
+        )
+        .unwrap();
+    let scoped = storage
+        .save_knowledge(
+            &create(
+                Some(project.id),
+                KnowledgeKind::Context,
+                "Architecture",
+                "Daemon owns PTYs",
+            ),
+            NOW,
+        )
+        .unwrap();
+    storage
+        .save_knowledge(
+            &create(Some(other.id), KnowledgeKind::Prompt, "Other", "Unrelated"),
+            NOW,
+        )
+        .unwrap();
+    assert_eq!(global.revision, 1);
+    let changed = storage
+        .save_knowledge(&update(&scoped, "Daemon owns processes"), NOW - 1)
+        .unwrap();
+    assert_eq!(changed.created_at_ms, NOW);
+    assert_eq!(changed.updated_at_ms, NOW);
+    assert_eq!(changed.revision, 2);
+    storage.close().unwrap();
+    drop(storage);
+
+    let reopened = Storage::open_migrated(&path).unwrap();
+    assert_eq!(
+        reopened.list_knowledge(&list(None)).unwrap().entries,
+        vec![global]
+    );
+    let scoped_page = reopened.list_knowledge(&list(Some(project.id))).unwrap();
+    assert_eq!(scoped_page.entries.len(), 2);
+    assert!(scoped_page.entries.contains(&changed));
+    let mut filtered = list(Some(project.id));
+    filtered.kind = Some(KnowledgeKind::Context);
+    assert_eq!(
+        reopened.list_knowledge(&filtered).unwrap().entries,
+        vec![changed.clone()]
+    );
+    filtered.query = Some("  PROCESSES  ".to_owned());
+    assert_eq!(
+        reopened.list_knowledge(&filtered).unwrap().entries,
+        vec![changed]
+    );
+}
+
+#[test]
+fn literal_search_treats_percent_underscore_and_sql_syntax_as_text() {
+    let directory = TempDir::new().unwrap();
+    let storage = Storage::open_migrated(directory.path().join("literal.db")).unwrap();
+    let exact = storage
+        .save_knowledge(
+            &create(
+                None,
+                KnowledgeKind::Prompt,
+                "Literal %_",
+                "SELECT ' OR 1=1 --",
+            ),
+            NOW,
+        )
+        .unwrap();
+    storage
+        .save_knowledge(
+            &create(None, KnowledgeKind::Prompt, "Other", "Different"),
+            NOW,
+        )
+        .unwrap();
+    for text in ["%_", "literal", "' OR 1=1 --"] {
+        let request = KnowledgeListRequest {
+            query: Some(text.to_owned()),
+            ..list(None)
+        };
+        assert_eq!(
+            storage.list_knowledge(&request).unwrap().entries,
+            vec![exact.clone()]
+        );
+    }
+    assert_eq!(
+        storage
+            .list_knowledge(&KnowledgeListRequest {
+                query: Some(String::new()),
+                ..list(None)
+            })
+            .unwrap()
+            .entries
+            .len(),
+        2
+    );
+}
+
+#[test]
+fn missing_projects_fail_and_explicit_scope_move_obeys_cascade() {
+    let directory = TempDir::new().unwrap();
+    let path = directory.path().join("scope.db");
+    let storage = Storage::open_migrated(&path).unwrap();
+    let project = common::project("Scope", directory.path().join("project"));
+    std::fs::create_dir(&project.path).unwrap();
+    std::fs::write(project.path.join("keep.txt"), "repository content").unwrap();
+    storage.insert_project(&project).unwrap();
+    let global = storage
+        .save_knowledge(
+            &create(None, KnowledgeKind::Prompt, "Global", "Preserved"),
+            NOW,
+        )
+        .unwrap();
+    let scoped = storage
+        .save_knowledge(
+            &create(
+                Some(project.id),
+                KnowledgeKind::Prompt,
+                "Scoped",
+                "Project data",
+            ),
+            NOW,
+        )
+        .unwrap();
+    let missing_project = ProjectId::new();
+    assert!(matches!(
+        storage.list_knowledge(&list(Some(missing_project))),
+        Err(KnowledgeStorageError::ProjectNotFound)
+    ));
+    assert!(matches!(
+        storage.save_knowledge(
+            &create(
+                Some(missing_project),
+                KnowledgeKind::Context,
+                "Missing",
+                "Should not save"
+            ),
+            NOW
+        ),
+        Err(KnowledgeStorageError::ProjectNotFound)
+    ));
+    let mut move_request = update(&global, "Attempted edit");
+    move_request.project_id = Some(missing_project);
+    assert!(matches!(
+        storage.save_knowledge(&move_request, NOW + 1),
+        Err(KnowledgeStorageError::ProjectNotFound)
+    ));
+    assert_eq!(
+        storage.list_knowledge(&list(None)).unwrap().entries,
+        vec![global]
+    );
+    let mut export = update(&scoped, "Exported to global");
+    export.project_id = None;
+    let exported = storage.save_knowledge(&export, NOW + 1).unwrap();
+    storage
+        .save_knowledge(
+            &create(
+                Some(project.id),
+                KnowledgeKind::Context,
+                "Disposable",
+                "Removed with metadata",
+            ),
+            NOW,
+        )
+        .unwrap();
+    storage.remove_project_metadata(project.id).unwrap();
+    let globals = storage.list_knowledge(&list(None)).unwrap().entries;
+    assert_eq!(globals.len(), 2);
+    assert!(globals.contains(&exported));
+    assert_eq!(
+        std::fs::read_to_string(project.path.join("keep.txt")).unwrap(),
+        "repository content"
+    );
+    let raw = Connection::open(path).unwrap();
+    let remaining: i64 = raw
+        .query_row(
+            "SELECT COUNT(*) FROM knowledge_documents WHERE project_id IS NOT NULL",
+            [],
+            |row| row.get(0),
+        )
+        .unwrap();
+    assert_eq!(remaining, 0);
+}
+
+#[test]
+fn independent_connections_cannot_overwrite_the_same_revision() {
+    let directory = TempDir::new().unwrap();
+    let path = directory.path().join("concurrent.db");
+    let original = Storage::open_migrated(&path).unwrap();
+    let entry = original
+        .save_knowledge(&create(None, KnowledgeKind::Prompt, "Race", "Initial"), NOW)
+        .unwrap();
+    let first = Storage::open_migrated(&path).unwrap();
+    let second = Storage::open_migrated(&path).unwrap();
+    let barrier = Arc::new(Barrier::new(3));
+    let mut handles = Vec::new();
+    for (storage, text) in [(first, "First writer"), (second, "Second writer")] {
+        let barrier = Arc::clone(&barrier);
+        let request = update(&entry, text);
+        handles.push(thread::spawn(move || {
+            barrier.wait();
+            storage.save_knowledge(&request, NOW + 1)
+        }));
+    }
+    barrier.wait();
+    let outcomes: Vec<_> = handles
+        .into_iter()
+        .map(|handle| handle.join().unwrap())
+        .collect();
+    assert_eq!(outcomes.iter().filter(|outcome| outcome.is_ok()).count(), 1);
+    assert_eq!(
+        outcomes
+            .iter()
+            .filter(|outcome| matches!(outcome, Err(KnowledgeStorageError::Conflict)))
+            .count(),
+        1
+    );
+    let winner = original
+        .list_knowledge(&list(None))
+        .unwrap()
+        .entries
+        .remove(0);
+    assert_eq!(winner.revision, 2);
+    let stale_delete = KnowledgeDeleteRequest {
+        id: entry.id,
+        expected_revision: entry.revision,
+    };
+    let conflict = original.delete_knowledge(&stale_delete).unwrap_err();
+    assert_eq!(conflict.to_api_error().code, "knowledge_conflict");
+    original
+        .delete_knowledge(&KnowledgeDeleteRequest {
+            id: winner.id,
+            expected_revision: winner.revision,
+        })
+        .unwrap();
+    let absent = original.delete_knowledge(&stale_delete).unwrap_err();
+    assert_eq!(absent.to_api_error().code, "knowledge_not_found");
+    assert!(matches!(
+        original.save_knowledge(&update(&winner, "Gone"), NOW),
+        Err(KnowledgeStorageError::NotFound)
+    ));
+}
+
+#[test]
+fn pagination_is_bounded_ordered_and_exclusive_without_duplicate_or_missing_rows() {
+    let directory = TempDir::new().unwrap();
+    let storage = Storage::open_migrated(directory.path().join("pages.db")).unwrap();
+    let mut expected = BTreeSet::new();
+    for index in 0..57 {
+        let entry = storage
+            .save_knowledge(
+                &create(
+                    None,
+                    KnowledgeKind::Prompt,
+                    &format!("Entry {index}"),
+                    "A small body",
+                ),
+                NOW,
+            )
+            .unwrap();
+        expected.insert(entry.id);
+    }
+    let first = storage.list_knowledge(&list(None)).unwrap();
+    assert_eq!(first.entries.len(), MAX_KNOWLEDGE_PAGE_ENTRIES);
+    assert_eq!(
+        first.next_cursor,
+        first.entries.last().map(|entry| entry.id)
+    );
+    let second = storage
+        .list_knowledge(&KnowledgeListRequest {
+            cursor: first.next_cursor,
+            ..list(None)
+        })
+        .unwrap();
+    assert_eq!(second.entries.len(), 7);
+    assert_eq!(second.next_cursor, None);
+    let seen: Vec<_> = first
+        .entries
+        .into_iter()
+        .chain(second.entries)
+        .map(|entry| entry.id)
+        .collect();
+    assert!(seen.windows(2).all(|pair| pair[0] < pair[1]));
+    assert_eq!(seen.into_iter().collect::<BTreeSet<_>>(), expected);
+}
+
+#[test]
+fn worst_case_json_escaping_fits_one_entry_and_pages_without_skipping() {
+    let directory = TempDir::new().unwrap();
+    let storage = Storage::open_migrated(directory.path().join("escaped.db")).unwrap();
+    let body = "\u{0001}".repeat(MAX_KNOWLEDGE_BODY_BYTES);
+    let mut expected = BTreeSet::new();
+    for index in 0..3 {
+        expected.insert(
+            storage
+                .save_knowledge(
+                    &create(
+                        None,
+                        KnowledgeKind::Context,
+                        &format!("Large {index}"),
+                        &body,
+                    ),
+                    NOW,
+                )
+                .unwrap()
+                .id,
+        );
+    }
+    let mut request = list(None);
+    let mut seen = BTreeSet::new();
+    loop {
+        let page = storage.list_knowledge(&request).unwrap();
+        assert_eq!(page.entries.len(), 1);
+        assert!(serde_json::to_vec(&page).unwrap().len() <= MAX_KNOWLEDGE_PAGE_BYTES);
+        assert_eq!(page.entries[0].body.as_str(), body);
+        assert!(seen.insert(page.entries[0].id));
+        request.cursor = page.next_cursor;
+        if request.cursor.is_none() {
+            break;
+        }
+    }
+    assert_eq!(seen, expected);
+}
+
+#[test]
+fn exhausted_revisions_reject_updates_but_allow_checked_deletion() {
+    let directory = TempDir::new().unwrap();
+    let path = directory.path().join("exhausted.db");
+    let storage = Storage::open_migrated(&path).unwrap();
+    let entry = storage
+        .save_knowledge(
+            &create(None, KnowledgeKind::Prompt, "Max revision", "Retained"),
+            NOW,
+        )
+        .unwrap();
+    let raw = Connection::open(path).unwrap();
+    raw.execute(
+        "UPDATE knowledge_documents SET revision = ?1 WHERE id = ?2",
+        params![
+            i64::try_from(MAX_KNOWLEDGE_REVISION).unwrap(),
+            entry.id.to_string()
+        ],
+    )
+    .unwrap();
+    let mut exhausted = entry;
+    exhausted.revision = MAX_KNOWLEDGE_REVISION;
+    assert!(matches!(
+        storage.save_knowledge(&update(&exhausted, "Never stored"), NOW + 1),
+        Err(KnowledgeStorageError::RevisionExhausted)
+    ));
+    assert_eq!(
+        storage.list_knowledge(&list(None)).unwrap().entries,
+        vec![exhausted.clone()]
+    );
+    storage
+        .delete_knowledge(&KnowledgeDeleteRequest {
+            id: exhausted.id,
+            expected_revision: exhausted.revision,
+        })
+        .unwrap();
+}
+
+#[test]
+fn programmatic_input_constraints_and_corrupt_rows_never_echo_content() {
+    let directory = TempDir::new().unwrap();
+    let path = directory.path().join("validation.db");
+    let storage = Storage::open_migrated(&path).unwrap();
+    let mut invalid = create(None, KnowledgeKind::Prompt, "Private title", "Private body");
+    invalid.expected_revision = Some(1);
+    assert!(storage.save_knowledge(&invalid, NOW).is_err());
+    invalid.expected_revision = None;
+    for timestamp in [-1, 9_007_199_254_740_992] {
+        assert!(matches!(
+            storage.save_knowledge(&invalid, timestamp),
+            Err(KnowledgeStorageError::InvalidTimestamp)
+        ));
+    }
+    let invalid_query = KnowledgeListRequest {
+        query: Some("private-query\0".into()),
+        ..list(None)
+    };
+    let error = storage.list_knowledge(&invalid_query).unwrap_err();
+    assert!(!format!("{error:?}").contains("private-query"));
+    let entry = storage.save_knowledge(&invalid, NOW).unwrap();
+    let raw = Connection::open(path).unwrap();
+    raw.execute_batch("PRAGMA ignore_check_constraints = ON")
+        .unwrap();
+    raw.execute(
+        "UPDATE knowledge_documents SET body = ?1 WHERE id = ?2",
+        params!["PRIVATE_CORRUPT_CONTENT\0", entry.id.to_string()],
+    )
+    .unwrap();
+    let error = storage.list_knowledge(&list(None)).unwrap_err();
+    assert!(matches!(error, KnowledgeStorageError::CorruptData));
+    assert!(
+        !format!("{error:?} {}", error.to_api_error().message).contains("PRIVATE_CORRUPT_CONTENT")
+    );
+}
+
+#[test]
+fn version_three_upgrade_preserves_metadata_and_checks_new_schema_objects() {
+    let directory = TempDir::new().unwrap();
+    let path = directory.path().join("v3.db");
+    let project = common::project("Existing", directory.path().join("existing"));
+    {
+        let raw = Connection::open(&path).unwrap();
+        raw.execute_batch(include_str!("../migrations/0001_initial.sql"))
+            .unwrap();
+        raw.execute_batch(include_str!("../migrations/0002_worktree_dirty_state.sql"))
+            .unwrap();
+        raw.execute_batch(include_str!("../migrations/0003_recovery_metadata.sql"))
+            .unwrap();
+        raw.execute_batch("CREATE TABLE schema_migrations (version INTEGER PRIMARY KEY, name TEXT NOT NULL, applied_at TEXT NOT NULL DEFAULT '2026-09-05');
+            INSERT INTO schema_migrations (version, name) VALUES (1, 'initial'), (2, 'worktree_dirty_state'), (3, 'recovery_metadata');").unwrap();
+        raw.execute(
+            "INSERT INTO projects (id,name,path,created_at,last_opened_at) VALUES (?1,?2,?3,?4,?4)",
+            params![
+                project.id.to_string(),
+                project.name,
+                project.path.to_str().unwrap(),
+                common::CREATED_AT_MS
+            ],
+        )
+        .unwrap();
+    }
+    let storage = Storage::open_migrated(&path).unwrap();
+    assert_eq!(storage.schema_version().unwrap(), LATEST_SCHEMA_VERSION);
+    assert_eq!(storage.get_project(project.id).unwrap(), Some(project));
+    storage.migrate().unwrap();
+    storage
+        .save_knowledge(
+            &create(None, KnowledgeKind::Prompt, "After upgrade", "New data"),
+            NOW,
+        )
+        .unwrap();
+    let raw = Connection::open(&path).unwrap();
+    let indexes: i64 = raw.query_row("SELECT COUNT(*) FROM sqlite_schema WHERE type='index' AND name IN ('knowledge_by_scope_id','knowledge_by_scope_kind_id')", [], |row| row.get(0)).unwrap();
+    assert_eq!(indexes, 2);
+    raw.execute_batch("DROP INDEX knowledge_by_scope_id")
+        .unwrap();
+    assert!(storage.migrate().is_err());
+}
diff --git a/docs/adr/0005-local-knowledge.md b/docs/adr/0005-local-knowledge.md
index abdea73..d6f2349 100644
--- a/docs/adr/0005-local-knowledge.md
+++ b/docs/adr/0005-local-knowledge.md
@@ -1,6 +1,7 @@
 # ADR 0005: Local prompts, reusable context, and organization
 
-Status: proposed; shared contract and migration registration await S2 agreement.
+Status: accepted for the first prompt/context increment after S2 agreement.
+Organization and filesystem details remain integration dependencies.
 
 ## Context
 
diff --git a/docs/codex/xirp-context-report.md b/docs/codex/xirp-context-report.md
index 2fe3b56..4651d7c 100644
--- a/docs/codex/xirp-context-report.md
+++ b/docs/codex/xirp-context-report.md
@@ -4,34 +4,88 @@ Branch: `feat/xirp-local-workflows`.
 Worktree: `/Users/eguimacs/cli-master-xirp`.
 Base: `0ac8dd7`, fetched from `origin/refactor/canvas-only-shell` on 2026-09-05.
 
-## Scope and evidence
+The full user request remains open. Source/acceptance inventory:
+[xirp-local-parity.md](../xirp-local-parity.md). Architecture:
+[ADR 0005](../adr/0005-local-knowledge.md).
 
-The source/acceptance inventory is [xirp-local-parity.md](../xirp-local-parity.md).
-The architecture proposal is [ADR 0005](../adr/0005-local-knowledge.md).
-The full user request remains open; documentation and isolated components are
-intermediate deliverables.
+## Coordination and ownership
 
-## Coordination
+S2 approved the first knowledge contract and additive shared registrations in
+[xirp-coordination-reply.md](xirp-coordination-reply.md), reserving migration
+`0004_knowledge_documents.sql`. S2 retains organization/workflow, runtime,
+worktrees, file service and conversation capabilities. S1 retains canvas and
+composer integration; the request is in [xirp-integration-request.md](xirp-integration-request.md).
 
-A concrete proposal was placed in `docs/codex/xirp-integration-request.md` in
-S1, S2 and S3 worktrees. S2 acknowledgment is pending for shared contracts,
-module registrations, migration allocation and dispatch. S1 acknowledgment is
-pending for canvas mounting and composer insertion. No shared code has been
-changed by S3 at this point.
+The active daemon dispatch is `server.rs`. Knowledge handlers reuse its
+existing storage connection and generic request path, with no session/process
+operation. The additive `methods.ts`/`domain.ts` mirrors preserve existing
+`client.ts`/`types.ts`/`schema.ts`. Merge S2's `worktree.list` mirror entries by
+name, rather than replacing whole files.
 
-Baseline drift reported to owners: active daemon dispatch is `server.rs`;
-`client.rs` is uncompiled. Frontend currently has `types.ts`/`schema.ts` rather
-than the mirrors named in AGENTS. Runtime registry/adapters need consolidation
-by S2; S3 will not introduce another registry or Tauri client.
+## Implemented first vertical increment
 
-## Work in progress
+- `knowledge.list`: nullable project scope, optional kind, literal title/body
+  query, exclusive UUIDv7 cursor; `{entries,nextCursor}`. Global query returns
+  globals; project query returns its entries plus globals. Unknown projects
+  fail. Pages cap at 50 rows and 512 KiB of serialized JSON.
+- `knowledge.save`: UUIDv7, prompt/context kind, title (256 UTF-8 bytes), body
+  (64 KiB), project scope, revision and epoch-ms timestamps. Create omits
+  id/expectedRevision; update requires both. Revision conflicts are atomic.
+- `knowledge.delete`: id plus expectedRevision. Stale requests preserve data.
+- `knowledge_documents` in existing SQLite, additive v3→v4 migration, schema
+  verification and scoped indexes. Project metadata removal cascades its
+  knowledge rows; it never deletes project files. Archive remains separate.
+- `knowledge_conflict`, `knowledge_not_found`, `project_not_found`,
+  `knowledge_revision_exhausted`, `knowledge_corrupt_data` are stable errors.
+  Text/queries are excluded from Debug and request error details.
+- IpcClient methods `listKnowledge`, `saveKnowledge`, `deleteKnowledge` use
+  validated TypeScript mirrors and a shared Rust/TypeScript JSON fixture.
 
-- Pure validated knowledge types and contract tests (new module only).
-- Isolated saved prompt/context editor/picker with typed callbacks and tests.
-- Persisted handlers and integration follow the agreed shared boundaries.
+`knowledge.updated` is deliberately not advertised: compiled baseline supports
+session-specific streams, and general metadata event transport remains an S2
+integration dependency. Clients refresh after mutations and can explicitly
+refresh; revision checks protect concurrent edits. Search uses SQLite ASCII
+case folding; Unicode text is preserved but non-ASCII case folding is not
+claimed. Pagination is per-request consistent, not a multi-request snapshot;
+refresh observes inserts/edits made during browsing.
 
-## Commits and checks
+## Verification executed on macOS
 
-Initial documentation commit: source review completed; `git diff --check`.
-Implementation tests and runtime/platform evidence will be recorded here as
-executed. No Linux/macOS runtime parity is claimed yet.
+Use `CARGO_INCREMENTAL=0 CARGO_PROFILE_DEV_DEBUG=0 CARGO_PROFILE_TEST_DEBUG=0`
+for the Rust commands below; debug information was reduced because the host
+had limited free disk space.
+
+- `cargo test -p cli-master-core -p cli-master-storage --locked`: existing
+  suites and 9 new core contract tests passed.
+- `cargo test -p cli-master-storage --test knowledge --locked`: 9 tests passed;
+  actual file-backed databases, competing connections, CAS races, reopen,
+  v3 migration, FK cleanup, scope moves, literal search, revision exhaustion,
+  corrupt content, 57-row pagination and worst-case JSON escaping.
+- `cargo test -p cli-master-core --test knowledge_catalog --locked`: passed;
+  JSON catalog matches Rust methods/events exactly.
+- `cargo test -p cli-master-daemon --locked`: 37 tests passed, including 2 new
+  real Unix-socket acceptance tests. Proves scoped CRUD, cross-client conflicts,
+  restart persistence, frame limits, safe errors and unchanged session state.
+- `cargo clippy -p cli-master-core -p cli-master-storage --all-targets --locked
+  -- -D warnings`, plus the equivalent daemon command: passed.
+- `cargo fmt --all -- --check`: passed.
+- IPC TypeScript tests and typecheck passed. Full frontend run with Node 25
+  needs `NODE_OPTIONS=--no-experimental-webstorage` to use jsdom storage;
+  CI uses Node 24. Isolated UI behavior tests are being finalized separately.
+
+Direct typed serde duplicate-field validation is not a promise that duplicate
+keys are rejected after the daemon's intermediate JSON Value decode.
+Linux CI, actual Tauri/canvas consumption and full parity remain unverified.
+
+## Commits / next integration
+
+- `569449f`: source inventory and integration proposal; pushed.
+- Backend first vertical increment follows this report in the current commit.
+- Isolated `KnowledgePanel` follows as its own UI increment. Props:
+  `{client,currentProject,onInsert,insertDisabledReason}`; insertion receives
+  `{sourceId,kind,title,body}` and must append to an editable composer draft.
+  Keep panel mounted if unsaved editor drafts must survive closing its surface.
+- Next: bounded rules/skills discovery; consume S2 pin/archive/workflow and
+  initial-objective contracts; mount with S1; verify additional agent features
+  only against trustworthy native sources. Portal/MCP remain explicit separate
+  dependencies; no connection is simulated.
diff --git a/docs/codex/xirp-coordination-reply.md b/docs/codex/xirp-coordination-reply.md
new file mode 100644
index 0000000..9d27ceb
--- /dev/null
+++ b/docs/codex/xirp-coordination-reply.md
@@ -0,0 +1,44 @@
+# S2 runtime coordination — 2026-09-05
+
+S2 is active in `/Users/eguimacs/cli-master-runtime`, branch
+`feat/maestri-runtime`, baseline `0ac8dd7`. This reply is an agreed boundary,
+not a claim that the proposed endpoints are implemented.
+
+- S3 owns `knowledge/` modules in core/storage/daemon and isolated UI modules.
+- Reserve migration **0004_knowledge_documents.sql** for S3. S2 worktree
+  integration needs no new migration. S2 future migrations begin at 0005 after
+  integrating 0004; no missing migration may be published in a runnable branch.
+- Approved first vertical contract: `knowledge.list/save/delete`, tagged
+  `kind: prompt|context`, UUIDv7, nullable project scope, title/body,
+  created/updated epoch-ms, positive integer revision. Updates and deletes
+  require expectedRevision; stale revisions return `knowledge_conflict`.
+  Create has no existing id/revision. Define bounded lengths in the Rust
+  validation types and keep list responses bounded (pagination if needed).
+- `knowledge.updated` must be delivered through the existing daemon event
+  transport before its event path is reported complete. Do not advertise an
+  unimplemented event. Draft insertion stays explicit and is owned by S1/S3.
+- S3 may make the small additive registration patch on its own branch:
+  core/storage/daemon lib.rs, migration registration, wire exports and
+  `knowledge.*` dispatch, protocol catalog and TypeScript mirrors. Publish
+  implementation and tests in the same coherent commit and report its hash;
+  S2 will review and integrate it. Preserve all runtime handlers and additions.
+- S2 currently adds `worktree.list` with `{ projectId?: UUID }` and response
+  `{ worktrees: Worktree[] }`. Existing `session.create` payload stays intact;
+  new_worktree creates metadata/Git only, followed by explicit session.start.
+- S2 retains process lifecycle, workspace/floor/canvas persistence, and
+  project/session organization/workflow contracts. S3 owns drafting and context
+  references; do not overload SessionStatus with workflow or attention.
+- Planned S2 file API targets registered project/session/worktree ids, uses
+  bounded reads and optimistic conflict checks with atomic writes. Its final
+  path policy and DTOs require an ADR. Until published, S3 can implement
+  discovery of explicitly known rules/skills with a narrow bounded safe reader;
+  do not create a second generic editor/file service.
+
+Current baseline no longer contains the AGENTS-referenced methods.ts/domain.ts
+mirrors: S2 will restore those as additive IPC contract artifacts while keeping
+the existing client/types/schema files and all React code intact. Merge contract
+entries by name, never replace either side's whole catalog.
+
+Integration evidence and published commits will be kept in
+`docs/codex/maestri-runtime-report.md` on the S2 branch. S2 will inspect S3's
+`docs/codex/xirp-context-report.md` and this request thread for follow-ups.
diff --git a/docs/codex/xirp-integration-request.md b/docs/codex/xirp-integration-request.md
index 0522dbf..63a2621 100644
--- a/docs/codex/xirp-integration-request.md
+++ b/docs/codex/xirp-integration-request.md
@@ -23,3 +23,24 @@ Will deliver isolated components with typed callbacks for saved prompts/context
 ## Responses
 
 Pending owner acknowledgment.
+
+### S3 acknowledgment and implementation details
+
+S2 acknowledgment received in xirp-coordination-reply.md. First implementation uses
+knowledge.list/save/delete; list accepts optional projectId/kind/query/cursor,
+returns {entries,nextCursor}; cursor is exclusive UUIDv7 ID ascending, literal
+title/body search. Pages cap at 50 rows and 512 KiB serialized entries. Title
+256 UTF-8 bytes, body 64 KiB. Prompt/context errors do not attach serde causes.
+Shared additive TypeScript mirrors restore methods.ts/domain.ts; merge S2
+worktree.list entries by name. IpcClient gains listKnowledge/saveKnowledge/
+deleteKnowledge; existing generic Tauri request path is reused.
+
+The compiled daemon currently has only session-specific event streams; generic
+metadata broadcasts are not wired. S3 will not advertise knowledge.updated
+until S2's general event transport is available. Initial UI refreshes after
+mutations and provides explicit refresh; conflict protection still covers
+multiple clients. Please advise the general event transport integration point.
+
+S1: initial components will expose KnowledgePanel({client,currentProject,
+onInsert,insertDisabledReason}); onInsert receives plain draft text and sourceId.
+Please mount as canvas contextual panel/palette. No hidden terminal send.
diff --git a/docs/xirp-local-parity.md b/docs/xirp-local-parity.md
index 4e56b21..87f9bff 100644
--- a/docs/xirp-local-parity.md
+++ b/docs/xirp-local-parity.md
@@ -8,18 +8,18 @@ added to this implementation's scope.
 
 | ID | Requirement and source | Owner / integration | Evidence / remaining work |
 | --- | --- | --- | --- |
-| X01 | Local project pin, rename, remove registration, non-Git folders, discover child repositories. [Projects](https://backstage.spotify.com/docs/xirp/projects) | S2 project base, S3 organization UI, S1 canvas | Baseline registers Git projects; pin/archive metadata, non-Git support and child discovery pending. Project archive is a user-requested extension. |
+| X01 | Local project pin, rename, remove registration, non-Git folders, discover child repositories. [Projects](https://backstage.spotify.com/docs/xirp/projects) | S2 project base, S3 organization UI, S1 canvas | Baseline real daemon tests register both Git projects and plain folders; pin/archive metadata and child discovery remain pending. Project archive is a user-requested extension. |
 | X02 | Initial objective delivered to agent, attachments, checkout/worktree and agent-specific options. [Sessions](https://backstage.spotify.com/docs/xirp/sessions) | S2 execution/contracts, S3 draft/context selection, S1 composer | Goal delivery requires verified runtime path, not metadata only. Attachments/options pending runtime contract. |
 | X03 | Resume/fork, agent switch preserving supported history, linked shell. [Sessions](https://backstage.spotify.com/docs/xirp/sessions), [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S2 adapters/runtime, S1 canvas | Current adapter capabilities do not expose verified conversation IDs, fork or usage. Await trusted native contracts and runtime integration. Local context reuse is a separate feature. |
 | X04 | Working/idle/needs-input attention separate from process lifecycle. [Sessions](https://backstage.spotify.com/docs/xirp/sessions) | S2 event source, S3 indicators, S1 canvas | PTY silence is not proof of approval/input need. Explicit hooks or native signals required. |
 | X05 | Local preferences, shortcuts, supported native settings, diagnostics. [Settings](https://backstage.spotify.com/docs/xirp/settings) | S2 settings/runtime, S3 rules/skills, S1 UI | Existing diagnostics/custom-agent creation are baseline only; do not expose unsupported options. Credentials excluded from editors. |
 | X06 | Global/project rules and skills, including symlinked skill directories. [Projects](https://backstage.spotify.com/docs/xirp/projects), [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S3 discovery, S2 file boundary | Need verified location inventory and safe bounded reads with origins/scopes; docs do not enumerate complete formats or precedence. Symlink policy and editing depend on file service. |
-| X07a | Saved global/project prompts, searchable picker and insertion. [Changelog v0.19.1](https://backstage.spotify.com/docs/xirp/changelog) | S3 knowledge, S2 shared registration, S1 canvas insertion | Isolated module implementation underway; persistence, socket, UI integration and cross-platform evidence pending. |
+| X07a | Saved global/project prompts, searchable picker and insertion. [Changelog v0.19.1](https://backstage.spotify.com/docs/xirp/changelog) | S3 knowledge, S2 shared registration, S1 canvas insertion | Persisted CRUD and paginated search verified through real SQLite and daemon socket; isolated UI underway; canvas and Linux evidence pending. See S3 report. |
 | X07b | Session archive and workflow: backlog/in_progress/in_review/blocked/done. [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S2 organization metadata, S3 controls, S1 filtering | Workflow must not mutate lifecycle. Session pin is a user-requested extension. |
 | X07c | Tokens/spend per session/day. [Changelog v0.18.0](https://backstage.spotify.com/docs/xirp/changelog) | S2 verified native data, S3 presentation | Source documents feature existence, not a collector/format/pricing algorithm. Currently unavailable, not zero. No proxy or PTY-based estimates. |
 | X07d | PR review, Doctor, cleanup. [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S2 runtime/Git, S1 UI | Existing Git status/diagnostics/removal-token safety are baseline; review and expanded cleanup require their real contracts. |
 | X08 | Agent-specific options, including Cursor. [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S2 adapter registry, S1 UI | No flags invented from agent display name; support requires installed-version tests and authoritative CLI sources. |
-| X09-local | Explicit reusable local context between sessions (user request). | S3 knowledge, S1 composer, S2 delivery | Local text records and explicit draft insertion planned. No transcript capture, autonomous summarization, or Portal connection implied. |
+| X09-local | Explicit reusable local context between sessions (user request). | S3 knowledge, S1 composer, S2 delivery | Local text records persist and survive daemon restart; explicit draft insertion component is underway. No transcript capture, autonomous summarization, or Portal connection implied. |
 | X09-Portal | Shared workspaces, members, catalog links, resources, decisions/wiki. [Workspaces](https://backstage.spotify.com/docs/xirp/workspaces) | Separate authenticated connector | Portal-dependent; no account/API verification supplied. Not implemented or simulated. |
 | X10 | Workspace context via MCP, manual transcript sharing, configured external integrations. [Workspaces](https://backstage.spotify.com/docs/xirp/workspaces) | Separate authenticated connector + S2 transport | Requires real account, scopes/API and explicit outbound preview. No silent publishing, account linking or telemetry. |
 
diff --git a/protocol/catalog.json b/protocol/catalog.json
index fff6729..814cee3 100644
--- a/protocol/catalog.json
+++ b/protocol/catalog.json
@@ -29,7 +29,10 @@
     "git.diff",
     "worktree.prepare_remove",
     "worktree.remove",
-    "diagnostics.get"
+    "diagnostics.get",
+    "knowledge.list",
+    "knowledge.save",
+    "knowledge.delete"
   ],
   "events": [
     "project.updated",
diff --git a/protocol/fixtures/knowledge-page.json b/protocol/fixtures/knowledge-page.json
new file mode 100644
index 0000000..19443bb
--- /dev/null
+++ b/protocol/fixtures/knowledge-page.json
@@ -0,0 +1,25 @@
+{
+  "entries": [
+    {
+      "id": "01990000-0000-7000-8000-000000000001",
+      "kind": "prompt",
+      "projectId": null,
+      "title": "Review the change",
+      "body": "Review correctness and failure paths.\n",
+      "revision": 1,
+      "createdAtMs": 1788600000000,
+      "updatedAtMs": 1788600000000
+    },
+    {
+      "id": "01990000-0000-7000-8000-000000000002",
+      "kind": "context",
+      "projectId": "01990000-0000-7000-8000-000000000010",
+      "title": "Project architecture",
+      "body": "The daemon owns session processes.\n",
+      "revision": 2,
+      "createdAtMs": 1788600000000,
+      "updatedAtMs": 1788600000001
+    }
+  ],
+  "nextCursor": null
+}

From 72b4d4dd086a08d71d269005b1457ac8bef2a089 Mon Sep 17 00:00:00 2001
From: guicybercode <euguigom@gmail.com>
Date: Sat, 5 Sep 2026 21:52:14 -0300
Subject: [PATCH 08/23] docs(runtime): record parity evidence and integration
 contracts

---
 docs/codex/maestri-runtime-report.md |  94 ++++++++++++++
 docs/maestri-runtime-parity.md       | 177 +++++++++++++++++++++++++++
 2 files changed, 271 insertions(+)
 create mode 100644 docs/codex/maestri-runtime-report.md
 create mode 100644 docs/maestri-runtime-parity.md

diff --git a/docs/codex/maestri-runtime-report.md b/docs/codex/maestri-runtime-report.md
new file mode 100644
index 0000000..5eec583
--- /dev/null
+++ b/docs/codex/maestri-runtime-report.md
@@ -0,0 +1,94 @@
+# Relatório de integração S2 — runtime Maestri
+
+Data: **2026-09-05**. Branch: **feat/maestri-runtime**.
+Worktree: `/Users/eguimacs/cli-master-runtime`.
+Baseline de criação: `0ac8dd7d49eefee16e5efbf389994f551bc584f5`, obtido de
+`origin/refactor/canvas-only-shell`. Integração final pertence à S1 nessa branch.
+
+O objetivo completo permanece na [matriz de runtime](../maestri-runtime-parity.md).
+Esta entrega resolve o primeiro caminho backend. Floors, landing, editor,
+canvas durável, presets, continuidade nativa, comunicação, rotinas e ambientes
+remotos permanecem em desenvolvimento. Integração desktop não foi presumida.
+
+## Commits disponíveis
+
+| Commit | Alteração | Evidência local |
+| --- | --- | --- |
+| `7693468` | Saga separa preparação de início; associação SQLite transacional; subdiretórios; compensação e cancelamento de tokens. | Suite session/storage executada; após ajustes finais, 29 testes de create/prepare/remove passaram. Clippy session/storage sem warnings. |
+| `3c25a85` | Daemon liga new_worktree, snapshot/listagem, preparo/remoção e recovery à saga compartilhando SessionManager e Storage. | 118 testes core/daemon passaram, incluindo 9 fluxos novos pelo socket real; Clippy dos quatro pacotes sem warnings. |
+
+Ambos usam a identidade Git configurada `guicybercode`, sem trailers
+`Co-authored-by`. Publicados em `origin/feat/maestri-runtime`.
+
+## Contratos prontos para integração
+
+| Método | Request → response | Comportamento observado |
+| --- | --- | --- |
+| `session.create` | `{ projectId, name, agentId, isolation: "current" | "new_worktree", relativeDirectory? } → Session` | Prepara metadata/Git sem PTY ou processo. Retorna unknown sem pid; subdiretório cadastrado e relativeDirectory preservados. |
+| `session.start` | `{ sessionId } → Session` | Início explícito por SessionManager no cwd persistido. Revalida raiz/identidade Git e invalida remoção preparada. |
+| `session.list` / `state.snapshot` | Contratos existentes | Sessões incluem branch/worktreeId/worktreePath; snapshot inclui worktrees duráveis. |
+| `worktree.list` | **Novo:** `{ projectId?: UUID } → { worktrees: Worktree[] }` | Todas as worktrees ou filtro por projeto; estados parciais permanecem visíveis. |
+| `worktree.prepare_remove` | `{ worktreeId } → ready + confirmationToken/expiresAtMs ou blocked + isDirty/blockers` | Inspeção real de Git e uso por sessões, inclusive cwd sem associação direta. |
+| `worktree.remove` | `{ worktreeId, confirmationToken } → {}` | Reinspeção e confirmação vinculada ao estado; dirty/ignored/uso impedem exclusão. |
+| `session.delete` | `{ sessionId } → {}` | Remove apenas metadados parados; preserva diretório e branch. Saída sem assinante também pode ser excluída. |
+
+Rust wire, `protocol/catalog.json`, `ipc/methods.ts` e `ipc/domain.ts`
+foram sincronizados. Os dois últimos são artefatos aditivos: o baseline havia
+removido esses caminhos citados em AGENTS. Nenhum componente React, estado de
+canvas, estilo ou bridge Tauri foi alterado.
+
+Erros relevantes: `worktree_confirmation_invalid`, `worktree_in_use`,
+`worktree_dirty`, `worktree_not_active`, `worktree_identity_changed`,
+`session_directory_unavailable`, `session_still_running`, `git_unavailable`.
+As respostas têm mensagens/ações; não transportar env ou argumentos em logs.
+
+**Refresh explícito:** este incremento não implementa emissão global de
+`worktree.updated`/`worktree.removed`. S1 deve reler snapshot/list após mutação
+ou reconexão. A existência dos nomes no catálogo não prova entrega de eventos.
+
+## Verificação executada e limites
+
+PR de integração: [#44](https://github.com/guicybercode/Jig/pull/44), em draft.
+CI e Packaging Linux/macOS iniciados; resultados ainda pendentes.
+
+Host local: macOS. Passaram:
+
+- `CARGO_INCREMENTAL=0 cargo test -p cli-master-core -p cli-master-daemon --locked`
+  — 118 testes, dos quais 9 novos em `worktree_ipc.rs`.
+- Testes session/storage e 29 testes finais de sagas, conforme primeiro commit.
+- `CARGO_INCREMENTAL=0 cargo clippy -p cli-master-core -p cli-master-storage -p cli-master-session -p cli-master-daemon --all-targets --locked -- -D warnings`.
+- `cargo fmt --all -- --check`, `git diff --check` e `bash scripts/check-versions.sh`.
+- Rustdoc dos quatro pacotes com `RUSTDOCFLAGS=-Dwarnings`.
+- Typecheck frontend e 8 testes dos contratos/client IPC existentes.
+
+Os casos socket exercitam start/stop/restart concorrentes, troca de raiz por
+symlink entre create/start, token após edição externa, sessão sem vínculo
+usando o checkout, saída espontânea e restart com PID canário de outro manager.
+A matriz CI Linux/macOS e o pacote desktop ainda exigem resultado externo;
+não foram chamados de aprovados. O editor/canvas S1 ainda precisa consumir e
+verificar estes contratos. Os IDs M14/M34/M35 continuam parciais no escopo total.
+
+## Acordo com XIRP/S3
+
+Resposta publicada em
+`/Users/eguimacs/cli-master-xirp/docs/codex/xirp-coordination-reply.md`:
+
+- S3 possui novos módulos knowledge e componentes isolados.
+- **0004_knowledge_documents.sql reservada para S3**; worktrees não criam migração.
+- Acordados `knowledge.list/save/delete`, kind prompt/context, UUIDv7,
+  escopo opcional de projeto, revisão inteira; update/delete exigem revisão,
+  conflito retorna `knowledge_conflict`. Ainda não são contratos publicados.
+- S3 pode publicar registro aditivo de lib.rs/migração/wire/mirrors/dispatch na
+  própria branch junto de implementação/testes; S2 revisa e integra o commit.
+- `knowledge.updated` só pode ser anunciado como funcional com emissão real.
+- S2 possui file service, workspace/floor/canvas e organização/workflow.
+  S3 possui composição de rascunhos/contexto; entrega usa SessionManager/adapters.
+
+## Próxima etapa
+
+Implementar serviço local `file.list/read/write` com alvos registrados,
+leitura limitada, caminhos Unix preservados, escrita atômica e revisão de
+conteúdo, documentando limites de concorrência externa. S3 reutiliza a leitura
+segura. Em seguida, workspace/floor e canvas durável com revisão e importação
+explícita do localStorage pela S1. A matriz mantém os incrementos posteriores;
+esta ordem não reduz o objetivo aos serviços de arquivos.
diff --git a/docs/maestri-runtime-parity.md b/docs/maestri-runtime-parity.md
new file mode 100644
index 0000000..472ea02
--- /dev/null
+++ b/docs/maestri-runtime-parity.md
@@ -0,0 +1,177 @@
+# Evidências e sequência de integração do runtime Maestri
+
+Auditoria inicial de S2 em **2026-09-05**, no baseline
+`0ac8dd7d49eefee16e5efbf389994f551bc584f5`, branch
+`feat/maestri-runtime`, worktree `/Users/eguimacs/cli-master-runtime`.
+Mudanças em andamento somente promovem um estado após registrar o commit e
+a execução que o comprova no [relatório de integração](codex/maestri-runtime-report.md).
+
+Este documento complementa a matriz central `docs/maestri-xirp-parity.md`,
+mantida por S1. Os IDs M01–M48 e X01–X10 continuam sendo os dela; as descrições
+completas, fontes por recurso e critérios visuais não são duplicados aqui.
+Na auditoria, a matriz e `docs/codex/parallel-goals.md` foram lidos na worktree
+principal, `/Users/eguimacs/cli-master`, onde ainda não estavam no baseline
+de S2. Publicar este recorte não substitui integrar esses documentos centrais.
+
+## Fontes e interpretação
+
+O [changelog oficial](https://www.themaestri.app/en/changelog), consultado em
+2026-09-05, chega a 0.45.3, de 2026-09-04. Ele amplia o escopo até controle
+remoto de rotinas/floors, sessões persistentes e retomada de conversas.
+As páginas de [arquivos](https://www.themaestri.app/en/docs/file-tree),
+[workspaces](https://www.themaestri.app/en/docs/workspaces),
+[floors](https://www.themaestri.app/en/docs/floors) e
+[notas](https://www.themaestri.app/en/docs/notes) também foram consultadas.
+As opções de implementação e os testes abaixo são propostas para Jig.
+Não se infere equivalência Linux a partir de links de download no site.
+
+### Como ler a evidência
+
+- **A:** implementação funcional não encontrada no baseline examinado.
+- **P:** infraestrutura parcial ou integração incompleta.
+- **V:** fluxo comprovado por teste executado e evidência identificada.
+- **L:** limite de plataforma ainda exige resultado explícito.
+- **S1:** interface, Tauri e integração visual; **S2:** runtime/contratos;
+  **S3:** knowledge/workflows locais. Uma dependência de S1/S3 permanece aberta.
+
+Nenhuma linha recebe V nesta auditoria estática. Teste existente sem execução
+é evidência de cobertura pretendida. Compilar um tipo, anunciar um método,
+passar teste direto da saga ou renderizar uma UI com IPC mockado não comprova
+o caminho desktop → socket → domínio → efeito real.
+
+| Evidência | Arquivos no baseline | Limite observado |
+| --- | --- | --- |
+| R1 | `crates/daemon/src/sessions.rs`, `server.rs` | PTY e `current` estão ligados ao daemon; `new_worktree` retorna `worktree_sessions_unavailable`; snapshot usa `worktrees: Vec::new()`. |
+| R2 | `crates/session/src/{saga,create,remove,recover,token}.rs`, `tests/{create_saga,remove_saga,recovery}.rs` | Saga cria e inicia em uma operação interna; persistência e remoção segura existem, mas os métodos públicos de worktree não têm dispatch. |
+| R3 | `crates/core/src/wire/{method,request,response,event_name}.rs`, `protocol/catalog.json` | Catálogo existente não contém files/workspace/floor/canvas/knowledge/routine/environment. Eventos anunciados precisam de auditoria de emissão. |
+| R4 | `crates/storage/migrations/0001_initial.sql` até `0003_recovery_metadata.sql`, `src/{migrate,settings,recovery}.rs` | SQLite guarda projetos/agentes/sessões/worktrees/settings; não há documento canvas ou modelos posteriores. |
+| R5 | `crates/daemon/src/projects.rs`, `crates/daemon/tests/daemon_ipc.rs` | Cadastro aceita pasta não Git e subdiretório; teste `project_registration_accepts_a_plain_folder` existe. Organização e importação de filhos não existem. |
+| R6 | `crates/daemon/src/git_inspection.rs`, `crates/daemon/tests/git_inspection.rs`, `crates/git/src` | Inspeção status/diff por alvo registrado; não implementa o conjunto de ações de escrita Git. |
+| R7 | `crates/agents/src/{builtins,registry}.rs`, `crates/daemon/src/sessions.rs` | Registry e seed próprio do daemon divergem; Gemini no adapter não implica preset executável no produto. |
+| R8 | `crates/session/src/{manager,replay,runtime}.rs`, `crates/storage/src/recovery.rs` | Handles e replay são memória do daemon; reinício reconcilia metadados, sem retomar conversa nativa/tmux. |
+| R9 | `apps/desktop/src/app/features/canvas/{canvas-state,useCanvasState}.ts` | Documento local contém notas/terminais/conexões; não existe serviço durável no daemon. Frontend é somente leitura nesta sessão. |
+| R10 | `crates/daemon/tests/{daemon_ipc,git_inspection,event_stream}.rs`, `crates/e2e/tests/acceptance.rs` | Existem casos reais de IPC e testes da saga; o caso de duas sessões isoladas usa saga diretamente. Não prova isolamento pela API pública. |
+| R11 | `docs/adr/0001-session-ownership.md` até `0004-git-worktree-safety.md`, `AGENTS.md` | Ownership, epoch-ms, revisão de contrato e token por estado são invariantes. Floors compartilhados/hook/arquivo precisam de decisões adicionais. |
+| R12 | `.github/workflows/ci.yml`, `docs/{PACKAGING,backup-and-recovery,KNOWN_ISSUES}.md` | Matriz Linux/macOS e procedimentos existem; auditoria não executou CI/pacote nem restauração visual. |
+
+## Evidência posterior ao baseline
+
+Em 2026-09-05, `7693468` e `3c25a85` na branch `feat/maestri-runtime`
+ligam preparação/start, snapshot/listagem e remoção segura ao socket real.
+Os 118 testes core/daemon passaram no macOS, incluindo 9 novos de worktree;
+sagas/storage, Clippy e contratos frontend também foram verificados conforme
+[relatório S2](codex/maestri-runtime-report.md). Isso comprova o incremento de
+runtime M14/M34/M35; **os IDs completos continuam P**, pois floors/landing e
+integração desktop não estão concluídos. Linux/CI/pacote seguem sem resultado.
+Nenhum recurso posterior ganha V com essa execução.
+
+## Recorte de runtime por ID central
+
+A coluna de fonte remete à capacidade de mesmo ID na matriz central. Linhas
+agrupadas mantêm todos os IDs para auditoria sem redefinir seu escopo.
+
+| IDs / fonte central | Estado no baseline / evidência | Próximo efeito de runtime comprovável | Dependência de integração |
+| --- | --- | --- | --- |
+| M01, M02, M03, M10, M46 — canvas | P: R9 | Persistir composição versionada, identidade e relações sem guardar PTY. | S1 implementa interação/visual; S2 oferece armazenamento sem determinar gestos. |
+| M04 — workspaces | P: R4/R5 | Diretório/identidade/ordenação por workspace após restart; herança de cwd explícita. | S1 rail/edição; decisão de identidade workspace versus project antes de migrar. |
+| M05 — instruções/importação | A: R3 | Importar pacote revisado sem sobrescrever arquivos externos; revisão de conteúdo em escrita. | S3 regras, S2 serviço de arquivo/importação, S1 preview. |
+| M06 — paleta/busca | P: R9 | Consultas de arquivos e documentos limitadas ao escopo autorizado. | S1 busca/atalhos; S3 índices de contexto. |
+| M07 — notas | P: R9, persistência A: R4 | Markdown real, leitura após restart, escrita atômica e conflito externo preservado. | S1 edita/preview; distinguir nota gerenciada de referência a arquivo externo. |
+| M08 — acesso a notas | A: R3 | Resolução autorizada de grafo com leitura limitada, atualização e revogação. | Conexão visual S1 não concede autorização sozinha. |
+| M09 — fichários | A: R3/R4 | Mover página entre agrupamentos sem duplicar conteúdo/identidade. | S1 páginas; depende de notas e grafo duráveis. |
+| M11, M16 — preferências/bloqueio | P: R4/R9 | Preferências por escopo e revisão; bloqueio impede escrita também pela API de agente. | S1 aparência/atalhos; settings genérico não prova painel funcional. |
+| M12 — partituras | A: R3/R4 | Exportação própria versionada e importação revisável, referências remapeadas, sem dados de execução. | S1 seleção/preview; não anunciar leitura de `.maestri` sem fixture real. |
+| M13 — mídia | A: R3 | Arquivos referenciados com ownership e leitura limitada; remover nó preserva fonte externa. | S1/Tauri preview/clipboard Linux e macOS. |
+| M14 — terminais/presets | P: R1/R7 | Usar definições reais do registry em create/start e editar argv sem divergência de seed. | S1 seletor; testar cada preset anunciado. |
+| M15 — roles | A: R3/R7 | Provisionamento por adaptador com revisão e origem, sem substituir arquivos inseguros/existentes. | S3 descoberta e conteúdo; S1 seleção. |
+| M17 — atenção | P lifecycle: R8 | Registrar sinais verificáveis de espera/atenção separados de status do processo. | S1 notificações/navegação; silêncio PTY não é evidência de aprovação. |
+| M18, M19 — entrada/composer | P PTY: R1/R8; demais A | Draft durável e entrega única de texto/anexos no ambiente correto. | S1 IME/seleção/teclas; S3 prompts inserem draft, não fazem envio implícito. |
+| M20 — conexões | P visual: R9; domínio A | Grafo durável com revisões e permissões independentes de estilo. | S1 geometria e navegação entre floors. |
+| M21 — comunicação | A: R3/R4 | Pedido/resposta entre duas sessões com correlação, prazo, cancelamento e autorização atual. | Requer cliente CLI local e alvo verificável; não proxyar tráfego dos vendors. |
+| M22 — Maestro | A: R3 | Recrutamento/dispensa autorizado reutiliza SessionManager e modelos de workspace/floor. | S1 gerência; acesso comum não implica privilégio gerencial. |
+| M23, M24 — rotinas | A: R3/R4 | Agenda/histórico duráveis; skip, execução única e restart não duplicam disparos. | Hooks pelo dono da execução; S1 UI/histórico; S3 workflow não é scheduler. |
+| M25 — persistência de processo | P: R8 | Distinguir cliente reconectado de daemon novo e attachment tmux verificado. | S1 mostrar capacidade real; persistência após crash exige novo ADR. |
+| M26 — conversa | P metadados: R8; resume A | Adapter persiste e valida identidade nativa; retoma a conversa escolhida. | Nunca reconstruir conversa a partir do PID ou de replay PTY. |
+| M27, M28 — ambientes | A: R3/R7 | Resolver execução, cwd, arquivo e provisionamento no mesmo host; reconexão não duplica agente. | S1 ambiente/override; SSH/Docker/custom usam argv e transporte definido em ADR. |
+| M29 — arquivo | A: R3 | Listar/criar/mover/remover sob raiz registrada, tratar nomes Unix e links sem escapar do escopo. | S1 árvore; S3 reutiliza segurança de I/O. |
+| M30 — editor | A: R3 | Read/write em disco com limite de tamanho e revisão esperada; mudança externa gera conflito. | S1 buffers/edição; proteger conteúdo não salvo. |
+| M31 — busca/tabs | A: R3/R4 | Busca cancelável com paginação estável; persistência de tabs/defaults. | S1 abre arquivo/linha; definir indexação e limites após file service. |
+| M32 — Git local | P: R6 | Stage/unstage/commit e descarte revisado no repositório derivado do alvo. | S1 diff real; descarte precisa prova de estado, não um booleano force. |
+| M33 — Git remoto/histórico | A: R6 | Git argv real com exclusão mútua, cancelamento e erros acionáveis. | S1 opções/history; credenciais continuam com Git do usuário. |
+| M34 — floors | P infraestrutura: R2 | Primeiro session.create/start isolado pelo socket; depois floor com várias sessões e cwd compartilhado correto. | S1 canvas por floor; worktree por sessão não equivale a floor. |
+| M35 — landing/remoção | P remoção: R2; landing A | Ligar preparo/token/remove e depois preview de landing vinculado a refs e estado atuais. | S1 confirmação; manter branch/diretório diante de conflito. |
+| M36 — hooks | A: R3/R4 | Comandos ordenados com contexto, prazo, cancelamento e histórico via SessionManager. | Novo ADR de jobs; setup/teardown não abrem executor paralelo. |
+| M37, M38, M39 — portais | A: R3 | Domínio de autorização e alvos de automação sobre bridge real, com revogação. | S1/Tauri webview e suporte Linux/macOS; adapter deve anunciar capacidades observadas. |
+| M40 — dispositivos | A/L: R3/R12 | Sessão de dispositivo e operações verificadas no SDK local. | Android nos dois hosts; iOS local exige macOS/Xcode. Não chamar indisponibilidade de paridade. |
+| M41, M42 — Wire | A: R3 | Transporte remoto autenticado reutiliza domínio; pareamento/revogação e feed recuperável. | Novo ADR e S1 cliente; socket local não prova protocolo Wire compatível. |
+| M43 — Ombro | A/L: R3 | Decisão explícita sobre inferência local sem transformar o coordenador em proxy de agente. | Alternativa Linux e viabilidade medidas; badge de status não equivale a resumo. |
+| M44, M45 — recuperação/plataforma | P: R4/R12 | Restaurar composição, notas e anexos reais com manifest/revisão; recuperar corrupção sem apagar dados. | S1 preview/restore, bridge de suspensão por plataforma. |
+| M47 — agentes adicionais | P: R7 | Capacidade por versão/adaptador, envio/provisionamento/resume testados individualmente. | S1 exibe somente presets detectados e comportamentos suportados. |
+| M48 — atualização | P build: R12 | Pacote atualizado preserva DB, ownership do daemon e identidade de conversa. | S1/Tauri/release e smoke Linux/macOS. |
+| X01 — projetos/organização | P: R5 | Preservar pastas não Git e descoberta explícita; pin/importação persistentes. | S3 organização/descoberta, S1 navegação. |
+| X02 — sessões gerais | P PTY: R1 | Objetivo/anexos/opções com destino verificável; sessão geral sem projeto fictício. | ADR de identidade/scope e S1 composer; S3 draft/contexto. |
+| X03 — continuidade/fork | P: R8 | Fork/resume nativo quando suportado; shell vinculado com lifecycle independente. | S2 adapters/floor; S1 escolha explícita. |
+| X04 — atividade/apresentação | P: R8/R9 | Atenção separada de processo/workflow, sem encerrar ao ocultar nó. | S1 grade/minimapa/busca. |
+| X05 — preferências/diagnóstico | P: R4/R7/R12 | Preferências revisadas e diagnóstico sanitizado do fluxo real. | S3 regras; S1 UI; arquivos de credenciais não entram no editor. |
+| X06 — regras/skills | A: R3 | Descoberta conhecida e leitura segura com origem/escopo; edição usa file service único. | S3 knowledge, S2 contratos compartilhados. |
+| X07 — workflow/arquivo/prompts | A/P: R1/R6 | Metadados de workflow separados do processo; prompts/contexto persistem com revisão. | S3 responsável; S2 cleanup e métricas nativas, nunca custo inferido de PTY. |
+| X08 — opções dos agentes | P: R7 | Registry consolidado e controles somente quando adapter comprova suporte. | S1 presets e opções. |
+| X09 — contexto | A: R3/R4 | Knowledge global/projeto com origem, revisão, referências e busca/exportação. | S3 serviço/componentes; S2 migração/IPC; S1 montagem no canvas. |
+| X10 — MCP/compartilhamento | A: R3 | Expor apenas contexto local autorizado; envio explícito fora da máquina em contrato próprio. | S3 ferramentas; S2 autorização/transporte; conector Portal continua opcional. |
+
+## Sequência de incrementos verticais
+
+1. **M14/M34/M35, base de X03:** separar preparação de criação e início na
+   saga; ligar `new_worktree`, snapshot/listagem e remoção no socket; executar
+   processo curto somente após `session.start`, incluindo subdiretórios,
+   concorrência, compensação, restart e token invalidado por edição externa.
+   S1 consome as respostas e comprova o fluxo no desktop.
+2. **M29/M30 e base de M07/X06:** serviço de arquivos local compartilhado,
+   inicialmente list/read/write em alvo registrado e revisão de conteúdo.
+   Editor S1 lê, modifica e salva arquivo real; um segundo escritor produz
+   conflito visível, sem sobrescrita. S3 reutiliza o leitor seguro para regras.
+3. **M04/M07/M20/M44 e base de X09:** workspace/documento canvas revisados,
+   nota Markdown em arquivo real e referências estáveis. S1 importa o documento
+   local existente uma única vez, confirma persistência e só depois muda a
+   fonte principal. Restart/reconnect recuperam nota, composição e vínculos.
+   S3 entrega knowledge em migração reservada, com refresh/eventos no mesmo IPC.
+4. **M14/M15/M17/M19/M21/M25/M26/M47/X02/X03/X08:** registry único,
+   capacidades por adapter, roles, draft/anexo e resume. Em seguida autorização
+   de grafo e cliente CLI: duas sessões reais trocam pedido/resposta; revogação,
+   timeout e restart têm resultado explícito. Não confundir resume de conversa
+   com reanexar processo tmux; ambos precisam de aceitação própria.
+5. **M32/M33/M34/M35/M36:** Git de escrita, floor compartilhado, landing e
+   hooks. Provar várias sessões no mesmo floor e terminais da ground floor
+   preservados; hook é um job sob SessionManager, com política documentada
+   para erro/timeout/teardown. Confirmar destruição com estado atualizado.
+6. **M09/M11/M12/M23/M24/M44/M45:** fichários, preferências, exportação própria,
+   rotinas duráveis e snapshots restauráveis. Testar duas gravações concorrentes,
+   interrupção durante importação/backup e scheduler reiniciado antes/depois
+   de registrar disparo. Histórico registra skipped/failed, não conclusão falsa.
+7. **M27/M28/M37–M42:** ambientes reais antes da automação remota: SSH/Docker/
+   custom, arquivo/anexo no ambiente alvo e persistência tmux. Depois bridge
+   de portais/dispositivos e transporte remoto autorizado, cada um em ADR e
+   incremento próprio com capacidades por plataforma.
+8. **M43/M45/M48 e aceitação transversal:** decisão sobre assistente local,
+   suspensão e atualização. Provar pacotes em Linux/macOS; reunir evidência
+   S1/S3 para os IDs ainda parciais. Prioridade posterior não remove requisito.
+
+Cada passo contém vários commits pequenos. Contrato só entra no catálogo
+junto de handler utilizável e teste pelo socket; a sequência não autoriza
+publicar stubs para reservar nomes.
+
+## Decisões necessárias antes de ampliar fronteiras
+
+| Tema do ADR futuro | Decisão que precisa ficar concreta | Alternativas e consequência |
+| --- | --- | --- |
+| Arquivos e revisão de documentos | Raiz/identidade autorizadas, encoding de nomes Unix, limits, revisões de conteúdo e escrita atômica. | Path relativo UTF-8 é menor, mas exclui nomes válidos; ID opaco/bytes preserva identidade. Não reutilizar `GitRelativePath` como path genérico. Definir symlinks e proteção contra troca de diretório durante a operação. |
+| Workspace, floor e canvas | Project continua raiz registrada; workspace/floor são identidades próprias, com revisão de documento e vínculo de várias sessões ao isolamento. | Documento único facilita evolução S1, mas pode conflitar inteiro; tabelas por nó reduzem conflito e aumentam migrações. Escolha deve preservar migração do canvas existente e não duplicar truth em localStorage. |
+| Notas e anexos | Ownership de arquivo gerenciado/externo, journal para SQLite+filesystem e recuperação. | SQLite de metadados + Markdown real preserva interoperabilidade, mas exige compensação/reconciliação; não esconder nota só em JSON de canvas. |
+| Jobs, hooks e rotinas | CommandSpec/SessionManager como execução única, modelo durável de run, idempotência, cancellation e teardown. | Reusar sessão como job simplifica ownership; job explícito separa histórico/TTY. Ambos exigem um único executor e distinção prompt/programa. |
+| Continuidade e ambientes | Resume por adapter versus attachment tmux, identidade de processo por ambiente e segredo/transporte. | Nova conversa não equivale a resume; PID antigo nunca prova ownership. Persistência opcional deve ter fallback explícito sem afirmar retomada. |
+| Grafo/CLI, portais e Wire | Principais, autorização/revogação por recurso, correlação e transporte remoto separado do IPC local. | Grafo visual pode referenciar relações funcionais, mas estilos não concedem acesso. Não anunciar compatibilidade Wire sem contrato externo testado. |
+| Inferência local e plataformas | Preservar coordenador local-first, alternativa Linux e política de capacidade por hardware. | Integrar inferência altera fronteira de produto; requer decisão registrada antes do código. |
+
+Os números de migração e ADR são alocados por S2 no momento de integrar,
+considerando commits S3. A matriz central continua responsável por paridade
+global; este recorte não conclui o goal de backend.

From a757f0598aabd7debd10e09a4a29c4da16a92114 Mon Sep 17 00:00:00 2001
From: guicybercode <euguigom@gmail.com>
Date: Sat, 5 Sep 2026 21:53:44 -0300
Subject: [PATCH 09/23] feat(knowledge): add reusable prompt and context
 library panel

---
 .../knowledge/KnowledgeLibrary.test.tsx       | 263 ++++++++++++++++
 .../features/knowledge/KnowledgeLibrary.tsx   | 215 ++++++++++++++
 .../app/features/knowledge/KnowledgePanel.tsx |  23 ++
 .../src/app/features/knowledge/index.ts       |  14 +
 .../features/knowledge/knowledge-library.css  | 188 ++++++++++++
 .../app/features/knowledge/knowledge-types.ts |  54 ++++
 .../features/knowledge/useKnowledgeLibrary.ts | 281 ++++++++++++++++++
 .../artifacts/xirp/knowledge-desktop.png      | Bin 0 -> 76626 bytes
 .../xirp/knowledge-narrow-editor.png          | Bin 0 -> 45707 bytes
 docs/codex/xirp-context-report.md             |  11 +-
 docs/xirp-local-parity.md                     |   4 +-
 11 files changed, 1048 insertions(+), 5 deletions(-)
 create mode 100644 apps/desktop/src/app/features/knowledge/KnowledgeLibrary.test.tsx
 create mode 100644 apps/desktop/src/app/features/knowledge/KnowledgeLibrary.tsx
 create mode 100644 apps/desktop/src/app/features/knowledge/KnowledgePanel.tsx
 create mode 100644 apps/desktop/src/app/features/knowledge/index.ts
 create mode 100644 apps/desktop/src/app/features/knowledge/knowledge-library.css
 create mode 100644 apps/desktop/src/app/features/knowledge/knowledge-types.ts
 create mode 100644 apps/desktop/src/app/features/knowledge/useKnowledgeLibrary.ts
 create mode 100644 docs/codex/artifacts/xirp/knowledge-desktop.png
 create mode 100644 docs/codex/artifacts/xirp/knowledge-narrow-editor.png

diff --git a/apps/desktop/src/app/features/knowledge/KnowledgeLibrary.test.tsx b/apps/desktop/src/app/features/knowledge/KnowledgeLibrary.test.tsx
new file mode 100644
index 0000000..b28eef9
--- /dev/null
+++ b/apps/desktop/src/app/features/knowledge/KnowledgeLibrary.test.tsx
@@ -0,0 +1,263 @@
+import { act, fireEvent, render, screen, waitFor, within } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { describe, expect, it, vi } from "vitest";
+
+import { IpcError } from "../../../ipc/client";
+import { createMockIpcClient } from "../../../test/mockIpc";
+import { KnowledgePanel } from "./KnowledgePanel";
+import type { KnowledgePage, KnowledgeRecord } from "./knowledge-types";
+
+const project = { id: "project-a", name: "Project A" };
+
+/** Content fixtures intentionally keep exact whitespace in the reusable body. */
+function entry(overrides: Partial<KnowledgeRecord> = {}): KnowledgeRecord {
+  return {
+    id: "entry-a", kind: "prompt", projectId: null, title: "Review changes",
+    body: "Review the diff.\nKeep the public API stable.\n", revision: 3,
+    createdAtMs: 100, updatedAtMs: 200, ...overrides,
+  };
+}
+
+/** Controllable responses exercise real user-visible async races. */
+function deferred<T>() {
+  let settle: (value: T) => void = () => { throw new Error("Promise not initialized"); };
+  const promise = new Promise<T>((resolve) => { settle = resolve; });
+  return { promise, resolve: settle };
+}
+
+describe("KnowledgePanel", () => {
+  it("saves project context and only inserts exact text after an explicit click", async () => {
+    const user = userEvent.setup();
+    const onInsert = vi.fn();
+    const saved = entry({ kind: "context", projectId: project.id, title: "Architecture", body: "Keep this context.\n\n" });
+    const client = createMockIpcClient({ handlers: { listKnowledge: async () => ({ entries: [], nextCursor: null }) } });
+    client.saveKnowledge.mockResolvedValue(saved);
+    render(<KnowledgePanel client={client} currentProject={project} onInsert={onInsert} />);
+    await waitFor(() => expect(client.listKnowledge).toHaveBeenCalledWith({ projectId: project.id }));
+
+    await user.selectOptions(screen.getByLabelText("Type"), "context");
+    await user.type(screen.getByLabelText("Title"), "  Architecture  ");
+    fireEvent.change(screen.getByLabelText("Content"), { target: { value: saved.body } });
+    await user.click(screen.getByRole("button", { name: "Save locally" }));
+    expect(client.saveKnowledge).toHaveBeenCalledWith({ kind: "context", projectId: project.id, title: "Architecture", body: saved.body });
+    expect(await screen.findByText("Saved locally.")).toBeVisible();
+    expect(onInsert).not.toHaveBeenCalled();
+    expect(client.writeTerminal).not.toHaveBeenCalled();
+
+    await user.click(screen.getByRole("button", { name: "Insert into draft" }));
+    expect(onInsert).toHaveBeenCalledWith({ sourceId: saved.id, kind: "context", title: saved.title, body: saved.body });
+    expect(screen.getByText("Inserted into the session draft.")).toBeVisible();
+    expect(client.writeTerminal).not.toHaveBeenCalled();
+  });
+
+  it("preserves item and new-project drafts when selecting items, refreshing, or changing project", async () => {
+    const user = userEvent.setup();
+    const first = entry();
+    const second = entry({ id: "entry-b", title: "Project context", kind: "context", projectId: project.id });
+    const client = createMockIpcClient({ handlers: { listKnowledge: async ({ projectId }) => ({ entries: projectId ? [first, second] : [first], nextCursor: null }) } });
+    const onInsert = vi.fn();
+    const view = render(<KnowledgePanel client={client} currentProject={project} onInsert={onInsert} />);
+    await user.click(await screen.findByRole("button", { name: /Review changes/ }));
+    fireEvent.change(screen.getByLabelText("Content"), { target: { value: "Unsaved review" } });
+    await user.click(screen.getByRole("button", { name: /Project context/ }));
+    await user.click(screen.getByRole("button", { name: /Review changes/ }));
+    expect(screen.getByLabelText("Content")).toHaveValue("Unsaved review");
+    await user.click(screen.getByRole("button", { name: "Refresh" }));
+    await waitFor(() => expect(client.listKnowledge).toHaveBeenCalledTimes(2));
+    expect(screen.getByLabelText("Content")).toHaveValue("Unsaved review");
+
+    await user.click(screen.getByRole("button", { name: "New item" }));
+    await user.type(screen.getByLabelText("Title"), "Project draft");
+    await user.selectOptions(screen.getByLabelText("Scope"), "");
+    view.rerender(<KnowledgePanel client={client} onInsert={onInsert} />);
+    await waitFor(() => expect(client.listKnowledge).toHaveBeenLastCalledWith({ projectId: null }));
+    await user.type(screen.getByLabelText("Title"), "Global draft");
+    view.rerender(<KnowledgePanel client={client} currentProject={project} onInsert={onInsert} />);
+    expect(screen.getByLabelText("Title")).toHaveValue("Project draft");
+    expect(screen.getByLabelText("Scope")).toHaveValue("");
+    await user.click(await screen.findByRole("button", { name: /Review changes/ }));
+    expect(screen.getByLabelText("Content")).toHaveValue("Unsaved review");
+    expect(client.saveKnowledge).not.toHaveBeenCalled();
+  });
+
+  it("retains conflict edits and saves a copy without overwriting the newer revision", async () => {
+    const user = userEvent.setup();
+    const original = entry();
+    const client = createMockIpcClient({ handlers: { listKnowledge: async () => ({ entries: [original], nextCursor: null }) } });
+    client.saveKnowledge.mockRejectedValueOnce(new IpcError({ code: "revision_conflict", message: "Revision changed" }));
+    client.saveKnowledge.mockResolvedValueOnce(entry({ id: "entry-copy", body: "My retained draft", revision: 1 }));
+    render(<KnowledgePanel client={client} onInsert={vi.fn()} />);
+    await user.click(await screen.findByRole("button", { name: /Review changes/ }));
+    fireEvent.change(screen.getByLabelText("Content"), { target: { value: "My retained draft" } });
+    await user.click(screen.getByRole("button", { name: "Save locally" }));
+    expect(await screen.findByRole("alert")).toHaveTextContent("Your edits are preserved");
+    expect(screen.getByLabelText("Content")).toHaveValue("My retained draft");
+    expect(client.saveKnowledge).toHaveBeenNthCalledWith(1, { id: original.id, expectedRevision: 3, kind: "prompt", projectId: null, title: original.title, body: "My retained draft" });
+    await user.click(screen.getByRole("button", { name: "Save as copy" }));
+    expect(client.saveKnowledge).toHaveBeenNthCalledWith(2, { kind: "prompt", projectId: null, title: original.title, body: "My retained draft" });
+    expect(await screen.findByText("Copy saved locally.")).toBeVisible();
+  });
+
+  it("requires confirmation before revision-bound deletion and keeps cancelled edits", async () => {
+    const user = userEvent.setup();
+    const original = entry();
+    const client = createMockIpcClient({ handlers: { listKnowledge: async () => ({ entries: [original], nextCursor: null }), deleteKnowledge: async () => undefined } });
+    render(<KnowledgePanel client={client} onInsert={vi.fn()} />);
+    await user.click(await screen.findByRole("button", { name: /Review changes/ }));
+    fireEvent.change(screen.getByLabelText("Content"), { target: { value: "Keep my edits" } });
+    await user.click(screen.getByRole("button", { name: "Delete item" }));
+    expect(client.deleteKnowledge).not.toHaveBeenCalled();
+    const dialog = screen.getByRole("dialog", { name: "Delete saved content" });
+    expect(within(dialog).getByRole("button", { name: "Keep item" })).toHaveFocus();
+    await user.click(within(dialog).getByRole("button", { name: "Keep item" }));
+    expect(screen.getByLabelText("Content")).toHaveValue("Keep my edits");
+    await user.click(screen.getByRole("button", { name: "Delete item" }));
+    await user.click(screen.getByRole("button", { name: "Confirm delete" }));
+    expect(client.deleteKnowledge).toHaveBeenCalledWith({ id: original.id, expectedRevision: original.revision });
+    await waitFor(() => expect(screen.queryByRole("dialog")).not.toBeInTheDocument());
+    expect(screen.getByLabelText("Title")).toHaveValue("");
+  });
+
+  it("loads additional pages and searches all saved title/body content", async () => {
+    const user = userEvent.setup();
+    const first = entry();
+    const second = entry({ id: "entry-b", title: "Deployment notes", kind: "context" });
+    const client = createMockIpcClient({ handlers: { listKnowledge: async ({ cursor, query }) => query ? { entries: [second], nextCursor: null } : cursor ? { entries: [second], nextCursor: null } : { entries: [first], nextCursor: first.id } } });
+    render(<KnowledgePanel client={client} currentProject={project} onInsert={vi.fn()} />);
+    await user.click(await screen.findByRole("button", { name: "Load more" }));
+    expect(client.listKnowledge).toHaveBeenLastCalledWith({ projectId: project.id, cursor: first.id });
+    expect(await screen.findByRole("button", { name: /Deployment notes/ })).toBeVisible();
+    expect(screen.getByRole("button", { name: /Review changes/ })).toBeVisible();
+    await user.type(screen.getByRole("searchbox"), "deployment");
+    await waitFor(() => expect(client.listKnowledge).toHaveBeenLastCalledWith({ projectId: project.id, query: "deployment" }));
+    expect(await screen.findByRole("button", { name: /Deployment notes/ })).toBeVisible();
+    expect(screen.queryByRole("button", { name: /Review changes/ })).not.toBeInTheDocument();
+  });
+
+  it("keeps the confirmed delete target when the host switches projects", async () => {
+    const user = userEvent.setup();
+    const original = entry({ projectId: project.id });
+    const client = createMockIpcClient({ handlers: {
+      listKnowledge: async ({ projectId }) => ({ entries: projectId ? [original] : [], nextCursor: null }),
+      deleteKnowledge: async () => undefined,
+    } });
+    const onInsert = vi.fn();
+    const view = render(<KnowledgePanel client={client} currentProject={project} onInsert={onInsert} />);
+    await user.click(await screen.findByRole("button", { name: "Review changes" }));
+    await user.click(screen.getByRole("button", { name: "Delete item" }));
+    view.rerender(<KnowledgePanel client={client} onInsert={onInsert} />);
+    await user.click(screen.getByRole("button", { name: "Confirm delete" }));
+    expect(client.deleteKnowledge).toHaveBeenCalledWith({ id: original.id, expectedRevision: original.revision });
+    await waitFor(() => expect(screen.queryByRole("dialog")).not.toBeInTheDocument());
+  });
+
+  it("does not replace a successful save with an older refresh response", async () => {
+    const user = userEvent.setup();
+    const oldResponse = deferred<KnowledgePage>();
+    const original = entry();
+    const updated = entry({ title: "Updated title", revision: 4 });
+    const client = createMockIpcClient();
+    client.listKnowledge.mockResolvedValueOnce({ entries: [original], nextCursor: null });
+    client.listKnowledge.mockReturnValueOnce(oldResponse.promise);
+    client.listKnowledge.mockResolvedValue({ entries: [updated], nextCursor: null });
+    client.saveKnowledge.mockResolvedValue(updated);
+    render(<KnowledgePanel client={client} onInsert={vi.fn()} />);
+    await user.click(await screen.findByRole("button", { name: "Review changes" }));
+    fireEvent.change(screen.getByLabelText("Title"), { target: { value: "Updated title" } });
+    await user.click(screen.getByRole("button", { name: "Refresh" }));
+    await waitFor(() => expect(client.listKnowledge).toHaveBeenCalledTimes(2));
+    await user.click(screen.getByRole("button", { name: "Save locally" }));
+    expect(await screen.findByRole("button", { name: "Updated title" })).toBeVisible();
+    await act(async () => oldResponse.resolve({ entries: [original], nextCursor: null }));
+    expect(screen.queryByRole("button", { name: "Review changes" })).not.toBeInTheDocument();
+    expect(screen.getByLabelText("Title")).toHaveValue("Updated title");
+  });
+
+  it("shows deletion failures inside the confirmation and retains the edited content", async () => {
+    const user = userEvent.setup();
+    const original = entry();
+    const client = createMockIpcClient({ handlers: { listKnowledge: async () => ({ entries: [original], nextCursor: null }) } });
+    client.deleteKnowledge.mockRejectedValue(new IpcError({ code: "revision_conflict", message: "This item has a newer revision." }));
+    render(<KnowledgePanel client={client} onInsert={vi.fn()} />);
+    await user.click(await screen.findByRole("button", { name: "Review changes" }));
+    fireEvent.change(screen.getByLabelText("Content"), { target: { value: "My draft survives" } });
+    await user.click(screen.getByRole("button", { name: "Delete item" }));
+    await user.click(screen.getByRole("button", { name: "Confirm delete" }));
+    const dialog = screen.getByRole("dialog", { name: "Delete saved content" });
+    expect(await within(dialog).findByRole("alert")).toHaveTextContent("This item has a newer revision.");
+    await user.click(within(dialog).getByRole("button", { name: "Keep item" }));
+    expect(screen.getByLabelText("Content")).toHaveValue("My draft survives");
+  });
+
+  it("ignores late search responses without replacing a newer result or editor draft", async () => {
+    const user = userEvent.setup();
+    const oldResponse = deferred<KnowledgePage>();
+    const current = entry({ id: "entry-current", title: "Current result" });
+    const client = createMockIpcClient({ handlers: { listKnowledge: async ({ query }) => query === "old" ? oldResponse.promise : { entries: query ? [current] : [], nextCursor: null } } });
+    render(<KnowledgePanel client={client} onInsert={vi.fn()} />);
+    await user.type(screen.getByLabelText("Title"), "Unfinished note");
+    await user.type(screen.getByRole("searchbox"), "old");
+    await waitFor(() => expect(client.listKnowledge).toHaveBeenCalledWith({ projectId: null, query: "old" }));
+    await user.clear(screen.getByRole("searchbox"));
+    await user.type(screen.getByRole("searchbox"), "new");
+    expect(await screen.findByRole("button", { name: /Current result/ })).toBeVisible();
+    await act(async () => oldResponse.resolve({ entries: [entry({ title: "Outdated result" })], nextCursor: null }));
+    expect(screen.queryByRole("button", { name: /Outdated result/ })).not.toBeInTheDocument();
+    expect(screen.getByLabelText("Title")).toHaveValue("Unfinished note");
+  });
+
+  it("validates UTF-8 limits, focuses invalid fields, and matches Rust whitespace rules", async () => {
+    const user = userEvent.setup();
+    const client = createMockIpcClient({ handlers: { listKnowledge: async () => ({ entries: [], nextCursor: null }) } });
+    client.saveKnowledge.mockResolvedValue(entry({ title: "\uFEFF", body: "\uFEFF" }));
+    render(<KnowledgePanel client={client} onInsert={vi.fn()} />);
+    await user.click(screen.getByRole("button", { name: "Save locally" }));
+    expect(screen.getByLabelText("Title")).toHaveFocus();
+    expect(screen.getByText("Enter a title.")).toBeVisible();
+    fireEvent.change(screen.getByLabelText("Title"), { target: { value: "é".repeat(129) } });
+    fireEvent.change(screen.getByLabelText("Content"), { target: { value: "Valid body" } });
+    await user.click(screen.getByRole("button", { name: "Save locally" }));
+    expect(screen.getByText("Use a title of at most 256 UTF-8 bytes.")).toBeVisible();
+    fireEvent.change(screen.getByLabelText("Title"), { target: { value: "Valid title" } });
+    fireEvent.change(screen.getByLabelText("Content"), { target: { value: "é".repeat(32_769) } });
+    await user.click(screen.getByRole("button", { name: "Save locally" }));
+    expect(screen.getByLabelText("Content")).toHaveFocus();
+    expect(screen.getByText(/Content must be at most 64 KiB/)).toBeVisible();
+    expect(client.saveKnowledge).not.toHaveBeenCalled();
+    fireEvent.change(screen.getByLabelText("Title"), { target: { value: "\uFEFF" } });
+    fireEvent.change(screen.getByLabelText("Content"), { target: { value: "\uFEFF" } });
+    await user.click(screen.getByRole("button", { name: "Save locally" }));
+    expect(client.saveKnowledge).toHaveBeenCalledWith({ kind: "prompt", projectId: null, title: "\uFEFF", body: "\uFEFF" });
+  });
+
+  it("blocks duplicate saves and explains unavailable insertion", async () => {
+    const user = userEvent.setup();
+    const pending = deferred<KnowledgeRecord>();
+    const client = createMockIpcClient({ handlers: { listKnowledge: async () => ({ entries: [], nextCursor: null }) } });
+    client.saveKnowledge.mockReturnValue(pending.promise);
+    render(<KnowledgePanel client={client} onInsert={vi.fn()} insertDisabledReason="Select a session to insert this content." />);
+    await user.type(screen.getByLabelText("Title"), "Review changes");
+    await user.type(screen.getByLabelText("Content"), "Content");
+    expect(screen.getByRole("button", { name: "Insert into draft" })).toBeDisabled();
+    expect(screen.getByText("Select a session to insert this content.")).toBeVisible();
+    await user.dblClick(screen.getByRole("button", { name: "Save locally" }));
+    expect(client.saveKnowledge).toHaveBeenCalledOnce();
+    expect(screen.getByRole("button", { name: "Saving changes…" })).toBeDisabled();
+    expect(screen.getByLabelText("Content")).toBeDisabled();
+    await act(async () => pending.resolve(entry()));
+    expect(await screen.findByText("Saved locally.")).toBeVisible();
+  });
+
+  it("offers a retry after list failure while retaining a new draft", async () => {
+    const user = userEvent.setup();
+    const client = createMockIpcClient({ handlers: { listKnowledge: async () => ({ entries: [], nextCursor: null }) } });
+    client.listKnowledge.mockRejectedValueOnce(new IpcError({ code: "storage_failed", message: "Could not load saved content." }));
+    client.listKnowledge.mockResolvedValue({ entries: [entry()], nextCursor: null });
+    render(<KnowledgePanel client={client} onInsert={vi.fn()} />);
+    expect(await screen.findByRole("alert")).toHaveTextContent("Could not load saved content.");
+    await user.type(screen.getByLabelText("Title"), "Keep this draft");
+    await user.click(screen.getByRole("button", { name: "Retry loading" }));
+    expect(await screen.findByRole("button", { name: /Review changes/ })).toBeVisible();
+    expect(screen.getByLabelText("Title")).toHaveValue("Keep this draft");
+  });
+});
diff --git a/apps/desktop/src/app/features/knowledge/KnowledgeLibrary.tsx b/apps/desktop/src/app/features/knowledge/KnowledgeLibrary.tsx
new file mode 100644
index 0000000..3e30ae7
--- /dev/null
+++ b/apps/desktop/src/app/features/knowledge/KnowledgeLibrary.tsx
@@ -0,0 +1,215 @@
+import { useId, useRef, useState, type FormEvent } from "react";
+
+import { Dialog } from "../../components/Dialog";
+import type { KnowledgeLibraryProps, KnowledgeRecord } from "./knowledge-types";
+import { hasDraftChanges, trimKnowledgeText, useKnowledgeLibrary } from "./useKnowledgeLibrary";
+import "./knowledge-library.css";
+
+/** Local content library. The host owns persistence and insertion into a session draft. */
+export function KnowledgeLibrary(props: KnowledgeLibraryProps) {
+  const library = useKnowledgeLibrary(props);
+  const { draft, busy } = library;
+  const id = useId();
+  const titleRef = useRef<HTMLInputElement>(null);
+  const bodyRef = useRef<HTMLTextAreaElement>(null);
+  const cancelDeleteRef = useRef<HTMLButtonElement>(null);
+  const [deleteTarget, setDeleteTarget] = useState<KnowledgeRecord | null>(null);
+  const [deleteFailed, setDeleteFailed] = useState(false);
+  const dirty = hasDraftChanges(draft);
+  const projectId = props.currentProject?.id ?? null;
+
+  function submit(event: FormEvent<HTMLFormElement>) {
+    event.preventDefault();
+    saveDraft();
+  }
+
+  function saveDraft(asCopy = false) {
+    const invalidField = library.validate();
+    if (invalidField === "title") titleRef.current?.focus();
+    else if (invalidField === "body") bodyRef.current?.focus();
+    else void library.save(asCopy);
+  }
+
+  async function confirmDelete() {
+    if (!deleteTarget) return;
+    setDeleteFailed(false);
+    if (await library.remove(deleteTarget)) {
+      setDeleteTarget(null);
+      titleRef.current?.focus();
+    } else {
+      setDeleteFailed(true);
+    }
+  }
+
+  return (
+    <section className="knowledge-library" aria-labelledby={`${id}-heading`}>
+      <header className="knowledge-library__header">
+        <div>
+          <h2 id={`${id}-heading`}>Prompts &amp; context</h2>
+          <p>Reusable content saved on this device.</p>
+        </div>
+        <button
+          type="button"
+          className="button button--secondary"
+          disabled={busy}
+          onClick={() => { library.selectNew(); titleRef.current?.focus(); }}
+        >
+          New item
+        </button>
+      </header>
+
+      <div className="knowledge-library__layout">
+        <div className="knowledge-library__browser">
+          <label className="knowledge-library__field" htmlFor={`${id}-search`}>
+            <span>Search prompts and context</span>
+            <input
+              id={`${id}-search`}
+              type="search"
+              value={library.query}
+              placeholder="Search titles and content"
+              onChange={(event) => library.setQuery(event.currentTarget.value)}
+            />
+          </label>
+          <div className="knowledge-library__list-heading">
+            <p>{props.currentProject ? `${props.currentProject.name} + global` : "Global library"}</p>
+            <button className="button button--quiet" type="button" disabled={library.loading || busy} onClick={library.reload}>
+              Refresh
+            </button>
+          </div>
+          {library.listError ? (
+            <div className="knowledge-library__error" role="alert">
+              <p>{library.listError}</p>
+              <button className="button button--secondary" type="button" onClick={library.reload}>Retry loading</button>
+            </div>
+          ) : null}
+          <p className="knowledge-library__list-status" role="status">
+            {library.loading ? "Loading saved content…" : `${library.records.length} ${library.records.length === 1 ? "item" : "items"} loaded${library.nextCursor ? "; more available" : ""}.`}
+          </p>
+          <ul className="knowledge-library__list" aria-label="Saved prompts and context" aria-busy={library.loading}>
+            {library.records.map((record) => {
+              const itemDraft = library.drafts[record.id];
+              return (
+                <li key={record.id}>
+                  <button
+                    className="knowledge-library__item"
+                    type="button"
+                    aria-pressed={library.selectedKey === record.id}
+                    aria-labelledby={`${id}-${record.id}-title`}
+                    aria-describedby={`${id}-${record.id}-meta`}
+                    disabled={busy}
+                    onClick={() => library.selectRecord(record)}
+                  >
+                    <strong id={`${id}-${record.id}-title`}>{record.title}</strong>
+                    <span id={`${id}-${record.id}-meta`} className="knowledge-library__meta">
+                      {record.kind === "prompt" ? "Prompt" : "Context"}
+                      {" · "}
+                      {record.projectId ? "Project" : "Global"}
+                      {itemDraft && hasDraftChanges(itemDraft) ? " · Unsaved" : ""}
+                    </span>
+                    <span className="knowledge-library__preview">{record.body.slice(0, 160)}</span>
+                  </button>
+                </li>
+              );
+            })}
+          </ul>
+          {!library.loading && !library.listError && !library.records.length ? (
+            <p className="knowledge-library__empty">
+              {trimKnowledgeText(library.query) ? "No saved content matches this search." : "No saved content yet. Create a prompt or context note to reuse across sessions."}
+            </p>
+          ) : null}
+          {library.nextCursor ? (
+            <button className="button button--secondary" type="button" disabled={library.loading || library.loadingMore || busy} onClick={() => void library.loadMore()}>
+              {library.loadingMore ? "Loading more…" : "Load more"}
+            </button>
+          ) : null}
+        </div>
+
+        <form className="knowledge-library__editor" aria-labelledby={`${id}-editor-heading`} noValidate onSubmit={submit}>
+          <div className="knowledge-library__editor-heading">
+            <h3 id={`${id}-editor-heading`}>{draft.original ? "Edit saved content" : "New saved content"}</h3>
+            {dirty ? <span className="knowledge-library__meta">Unsaved changes</span> : null}
+          </div>
+          {draft.error ? <p className="knowledge-library__error" role="alert">{draft.error}</p> : null}
+          <div className="knowledge-library__options">
+            <label className="knowledge-library__field" htmlFor={`${id}-kind`}>
+              <span>Type</span>
+              <select id={`${id}-kind`} value={draft.kind} disabled={busy} onChange={(event) => {
+                const kind = event.currentTarget.value;
+                if (kind === "prompt" || kind === "context") library.updateDraft({ kind });
+              }}>
+                <option value="prompt">Prompt</option>
+                <option value="context">Context</option>
+              </select>
+            </label>
+            <label className="knowledge-library__field" htmlFor={`${id}-scope`}>
+              <span>Scope</span>
+              <select id={`${id}-scope`} value={draft.projectId ?? ""} disabled={busy} onChange={(event) => library.updateDraft({ projectId: event.currentTarget.value || null })}>
+                <option value="">Global</option>
+                {props.currentProject ? <option value={props.currentProject.id}>Project: {props.currentProject.name}</option> : null}
+                {draft.projectId && draft.projectId !== projectId ? <option value={draft.projectId}>Previously selected project</option> : null}
+              </select>
+            </label>
+          </div>
+          <label className="knowledge-library__field" htmlFor={`${id}-title`}>
+            <span>Title</span>
+            <input
+              ref={titleRef}
+              id={`${id}-title`}
+              value={draft.title}
+              disabled={busy}
+              required
+              aria-invalid={Boolean(draft.titleError)}
+              aria-describedby={draft.titleError ? `${id}-title-error` : undefined}
+              onChange={(event) => library.updateDraft({ title: event.currentTarget.value, titleError: undefined })}
+            />
+          </label>
+          {draft.titleError ? <p id={`${id}-title-error`} className="knowledge-library__error">{draft.titleError}</p> : null}
+          <label className="knowledge-library__field knowledge-library__content" htmlFor={`${id}-body`}>
+            <span>Content</span>
+            <textarea
+              ref={bodyRef}
+              id={`${id}-body`}
+              value={draft.body}
+              disabled={busy}
+              required
+              rows={10}
+              aria-invalid={Boolean(draft.bodyError)}
+              aria-describedby={draft.bodyError ? `${id}-body-error` : `${id}-body-hint`}
+              onChange={(event) => library.updateDraft({ body: event.currentTarget.value, bodyError: undefined })}
+            />
+          </label>
+          {draft.bodyError ? <p id={`${id}-body-error`} className="knowledge-library__error">{draft.bodyError}</p> : null}
+          <p id={`${id}-body-hint`} className="knowledge-library__hint">Insert this text into a session draft when you are ready to use it.</p>
+          <div className="knowledge-library__actions">
+            <button className="button button--primary" type="submit" disabled={busy} aria-busy={busy}>{busy ? "Saving changes…" : "Save locally"}</button>
+            {draft.original ? <button className="button button--secondary" type="button" disabled={busy} onClick={() => saveDraft(true)}>Save as copy</button> : null}
+            <button className="button button--secondary" type="button" disabled={busy || !trimKnowledgeText(draft.body) || Boolean(props.insertDisabledReason)} aria-describedby={props.insertDisabledReason ? `${id}-insert-hint` : undefined} onClick={library.insert}>Insert into draft</button>
+          </div>
+          {props.insertDisabledReason ? <p id={`${id}-insert-hint`} className="knowledge-library__hint">{props.insertDisabledReason}</p> : null}
+          <p className="knowledge-library__notice" role="status">{draft.notice ?? ""}</p>
+          <div className="knowledge-library__secondary-actions">
+            <button className="button button--quiet" type="button" disabled={busy || !dirty} onClick={library.discardChanges}>Discard changes</button>
+            {draft.original ? <button className="button button--danger-secondary" type="button" disabled={busy} onClick={() => { setDeleteFailed(false); setDeleteTarget(draft.original); }}>Delete item</button> : null}
+          </div>
+        </form>
+      </div>
+
+      <Dialog
+        open={Boolean(deleteTarget)}
+        title="Delete saved content"
+        description={deleteTarget ? `Delete “${deleteTarget.title}” from your local library?` : undefined}
+        size="small"
+        closeDisabled={busy}
+        initialFocusRef={cancelDeleteRef}
+        onClose={() => setDeleteTarget(null)}
+        footer={<>
+          <button ref={cancelDeleteRef} className="button button--secondary" type="button" disabled={busy} onClick={() => setDeleteTarget(null)}>Keep item</button>
+          <button className="button button--danger" type="button" disabled={busy} onClick={() => void confirmDelete()}>{busy ? "Deleting…" : "Confirm delete"}</button>
+        </>}
+      >
+        <p>Existing session drafts keep any text already inserted. Unsaved edits to this library item will be discarded.</p>
+        {deleteFailed ? <p className="knowledge-library__error" role="alert">{deleteTarget ? library.drafts[deleteTarget.id]?.error : "Could not delete this item. Try again."}</p> : null}
+      </Dialog>
+    </section>
+  );
+}
diff --git a/apps/desktop/src/app/features/knowledge/KnowledgePanel.tsx b/apps/desktop/src/app/features/knowledge/KnowledgePanel.tsx
new file mode 100644
index 0000000..5af4de9
--- /dev/null
+++ b/apps/desktop/src/app/features/knowledge/KnowledgePanel.tsx
@@ -0,0 +1,23 @@
+import { useCallback } from "react";
+
+import type { IpcClient } from "../../../ipc/client";
+import { KnowledgeLibrary } from "./KnowledgeLibrary";
+import type {
+  KnowledgeDeleteInput,
+  KnowledgeLibraryProps,
+  KnowledgeListInput,
+  KnowledgeSaveInput,
+} from "./knowledge-types";
+
+/** Canvas integration boundary using only the project-owned IPC client. */
+export interface KnowledgePanelProps extends Omit<KnowledgeLibraryProps, "onList" | "onSave" | "onDelete"> {
+  readonly client: Pick<IpcClient, "listKnowledge" | "saveKnowledge" | "deleteKnowledge">;
+}
+
+/** Keeps callback identities stable and preserves the client's method receiver. */
+export function KnowledgePanel({ client, ...props }: KnowledgePanelProps) {
+  const onList = useCallback((input: KnowledgeListInput) => client.listKnowledge(input), [client]);
+  const onSave = useCallback((input: KnowledgeSaveInput) => client.saveKnowledge(input), [client]);
+  const onDelete = useCallback((input: KnowledgeDeleteInput) => client.deleteKnowledge(input), [client]);
+  return <KnowledgeLibrary {...props} onList={onList} onSave={onSave} onDelete={onDelete} />;
+}
diff --git a/apps/desktop/src/app/features/knowledge/index.ts b/apps/desktop/src/app/features/knowledge/index.ts
new file mode 100644
index 0000000..0fc888c
--- /dev/null
+++ b/apps/desktop/src/app/features/knowledge/index.ts
@@ -0,0 +1,14 @@
+export { KnowledgeLibrary } from "./KnowledgeLibrary";
+export { KnowledgePanel } from "./KnowledgePanel";
+export type { KnowledgePanelProps } from "./KnowledgePanel";
+export type {
+  KnowledgeDeleteInput,
+  KnowledgeInsertion,
+  KnowledgeKind,
+  KnowledgeLibraryProps,
+  KnowledgeListInput,
+  KnowledgePage,
+  KnowledgeProject,
+  KnowledgeRecord,
+  KnowledgeSaveInput,
+} from "./knowledge-types";
diff --git a/apps/desktop/src/app/features/knowledge/knowledge-library.css b/apps/desktop/src/app/features/knowledge/knowledge-library.css
new file mode 100644
index 0000000..3f80715
--- /dev/null
+++ b/apps/desktop/src/app/features/knowledge/knowledge-library.css
@@ -0,0 +1,188 @@
+.knowledge-library {
+  min-width: 0;
+  container-type: inline-size;
+  color: var(--color-text);
+  background: var(--color-surface);
+}
+
+.knowledge-library__header,
+.knowledge-library__list-heading,
+.knowledge-library__editor-heading,
+.knowledge-library__secondary-actions {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  flex-wrap: wrap;
+  gap: var(--space-2);
+}
+
+.knowledge-library__header {
+  padding: var(--space-4);
+  border-bottom: 1px solid var(--color-border);
+}
+
+.knowledge-library h2,
+.knowledge-library h3,
+.knowledge-library p {
+  margin: 0;
+}
+
+.knowledge-library h2 { font-size: 1rem; }
+.knowledge-library h3 { font-size: 0.875rem; }
+
+.knowledge-library__header p,
+.knowledge-library__hint,
+.knowledge-library__list-heading p,
+.knowledge-library__list-status,
+.knowledge-library__meta,
+.knowledge-library__preview,
+.knowledge-library__empty {
+  color: var(--color-text-muted);
+  font-size: 0.75rem;
+  overflow-wrap: anywhere;
+}
+
+.knowledge-library__header p { margin-top: var(--space-1); }
+
+.knowledge-library__layout {
+  display: grid;
+  grid-template-columns: minmax(12rem, 0.8fr) minmax(0, 1.4fr);
+  align-items: start;
+}
+
+.knowledge-library__browser,
+.knowledge-library__editor {
+  display: flex;
+  flex-direction: column;
+  gap: var(--space-3);
+  min-width: 0;
+  padding: var(--space-4);
+}
+
+.knowledge-library__browser { border-right: 1px solid var(--color-border); }
+
+.knowledge-library__field {
+  display: flex;
+  flex-direction: column;
+  gap: var(--space-1);
+  min-width: 0;
+  font-size: 0.8125rem;
+  font-weight: 500;
+}
+
+.knowledge-library__field :is(input, select, textarea) {
+  min-width: 0;
+  width: 100%;
+  min-height: var(--control-height);
+  padding: var(--space-2);
+  border: 1px solid var(--color-border-strong);
+  border-radius: var(--radius-small);
+  color: var(--color-text);
+  background: var(--color-surface);
+  font-weight: 400;
+}
+
+.knowledge-library__field :is(input, select, textarea):disabled {
+  color: var(--color-text-muted);
+  background: var(--color-inset);
+}
+
+.knowledge-library__field [aria-invalid="true"] { border-color: var(--color-danger); }
+
+.knowledge-library__content textarea {
+  min-height: 12rem;
+  font-family: var(--font-mono);
+  line-height: 1.5;
+  resize: vertical;
+}
+
+.knowledge-library__options {
+  display: grid;
+  grid-template-columns: 1fr 1fr;
+  gap: var(--space-3);
+}
+
+.knowledge-library__list {
+  display: flex;
+  flex-direction: column;
+  gap: var(--space-2);
+  max-height: 26rem;
+  margin: 0;
+  padding: var(--space-1);
+  overflow-y: auto;
+  list-style: none;
+  scroll-padding-block: var(--space-2);
+}
+
+.knowledge-library__item {
+  display: flex;
+  flex-direction: column;
+  gap: var(--space-1);
+  width: 100%;
+  min-width: 0;
+  min-height: 3rem;
+  padding: var(--space-3);
+  border: 1px solid var(--color-border);
+  border-radius: var(--radius);
+  background: var(--color-surface-raised);
+  text-align: left;
+  overflow-wrap: anywhere;
+  transition: background-color var(--duration-feedback) var(--ease-feedback);
+}
+
+.knowledge-library__item[aria-pressed="true"] {
+  border-color: var(--color-accent);
+  background: var(--color-accent-muted);
+}
+
+.knowledge-library__item:disabled { opacity: 0.72; }
+
+.knowledge-library__preview {
+  display: -webkit-box;
+  overflow: hidden;
+  -webkit-box-orient: vertical;
+  -webkit-line-clamp: 2;
+}
+
+.knowledge-library__actions {
+  display: flex;
+  flex-wrap: wrap;
+  gap: var(--space-2);
+}
+
+.knowledge-library__secondary-actions {
+  margin-top: auto;
+  padding-top: var(--space-2);
+  border-top: 1px solid var(--color-border);
+}
+
+.knowledge-library__error {
+  padding: var(--space-2);
+  border-left: 2px solid var(--color-danger);
+  color: var(--color-danger);
+  background: var(--color-danger-muted);
+  font-size: 0.8125rem;
+  overflow-wrap: anywhere;
+}
+
+.knowledge-library__error .button { margin-top: var(--space-2); }
+.knowledge-library__notice { min-height: 1.25rem; color: var(--color-success); font-size: 0.8125rem; }
+
+@media (hover: hover) {
+  .knowledge-library__item:not(:disabled):hover { background: var(--color-surface-hover); }
+}
+
+@container (max-width: 38rem) {
+  .knowledge-library__layout { grid-template-columns: minmax(0, 1fr); }
+  .knowledge-library__browser { border-right: 0; border-bottom: 1px solid var(--color-border); }
+  .knowledge-library__list { max-height: 14rem; }
+}
+
+@container (max-width: 22rem) {
+  .knowledge-library__options { grid-template-columns: minmax(0, 1fr); }
+  .knowledge-library__actions .button { width: 100%; white-space: normal; }
+}
+
+@media (prefers-reduced-motion: reduce) {
+  .knowledge-library__item { transition: none; }
+}
diff --git a/apps/desktop/src/app/features/knowledge/knowledge-types.ts b/apps/desktop/src/app/features/knowledge/knowledge-types.ts
new file mode 100644
index 0000000..02d468b
--- /dev/null
+++ b/apps/desktop/src/app/features/knowledge/knowledge-types.ts
@@ -0,0 +1,54 @@
+import type {
+  KnowledgeDeleteRequest,
+  KnowledgeEntry,
+  KnowledgeKind,
+  KnowledgeListRequest,
+  KnowledgeListResponse,
+  KnowledgeSaveRequest,
+} from "../../../ipc/domain";
+
+/** Feature names alias the authoritative domain mirror instead of duplicating it. */
+export type KnowledgeRecord = KnowledgeEntry;
+export type KnowledgeListInput = KnowledgeListRequest;
+export type KnowledgePage = KnowledgeListResponse;
+export type KnowledgeSaveInput = KnowledgeSaveRequest;
+export type KnowledgeDeleteInput = KnowledgeDeleteRequest;
+export type { KnowledgeKind } from "../../../ipc/domain";
+
+/** Plain text the host can append to a session draft after an explicit click. */
+export interface KnowledgeInsertion {
+  readonly sourceId: string | null;
+  readonly kind: KnowledgeKind;
+  readonly title: string;
+  readonly body: string;
+}
+
+/** Project identity for labeling and scoping the local library. */
+export interface KnowledgeProject {
+  readonly id: string;
+  readonly name: string;
+}
+
+/** Host-owned operations; the library never writes to a terminal itself. */
+export interface KnowledgeLibraryProps {
+  readonly currentProject?: KnowledgeProject | null;
+  readonly onList: (input: KnowledgeListInput) => Promise<KnowledgePage>;
+  readonly onSave: (input: KnowledgeSaveInput) => Promise<KnowledgeRecord>;
+  readonly onDelete: (input: KnowledgeDeleteInput) => Promise<void>;
+  readonly onInsert: (content: KnowledgeInsertion) => void;
+  /** Explain why insertion is unavailable, for example when no session is selected. */
+  readonly insertDisabledReason?: string;
+}
+
+/** In-memory editor state; it survives selection and scope changes while mounted. */
+export interface KnowledgeDraft {
+  readonly original: KnowledgeRecord | null;
+  readonly kind: KnowledgeKind;
+  readonly projectId: string | null;
+  readonly title: string;
+  readonly body: string;
+  readonly error?: string;
+  readonly notice?: string;
+  readonly titleError?: string;
+  readonly bodyError?: string;
+}
diff --git a/apps/desktop/src/app/features/knowledge/useKnowledgeLibrary.ts b/apps/desktop/src/app/features/knowledge/useKnowledgeLibrary.ts
new file mode 100644
index 0000000..9ca4ad9
--- /dev/null
+++ b/apps/desktop/src/app/features/knowledge/useKnowledgeLibrary.ts
@@ -0,0 +1,281 @@
+import { useEffect, useRef, useState } from "react";
+
+import { KNOWLEDGE_BODY_BYTES, KNOWLEDGE_TITLE_BYTES } from "../../../ipc/knowledge-schema";
+import { errorData } from "../../utils";
+import type {
+  KnowledgeDraft,
+  KnowledgeLibraryProps,
+  KnowledgeRecord,
+} from "./knowledge-types";
+
+interface LibraryListing {
+  readonly projectId: string | null;
+  readonly query: string;
+  readonly records: readonly KnowledgeRecord[];
+  readonly nextCursor: string | null;
+  readonly loading: boolean;
+  readonly error?: string;
+}
+
+/** Keeps editor drafts independent of asynchronous list responses and navigation. */
+export function useKnowledgeLibrary({
+  currentProject,
+  onList,
+  onSave,
+  onDelete,
+  onInsert,
+}: KnowledgeLibraryProps) {
+  const projectId = currentProject?.id ?? null;
+  const contextKey = projectId ?? "global";
+  const newKey = `new:${contextKey}`;
+  const [selections, setSelections] = useState<Record<string, string | undefined>>({});
+  const [drafts, setDrafts] = useState<Record<string, KnowledgeDraft | undefined>>({});
+  const [reload, setReload] = useState(0);
+  const [query, setQuery] = useState("");
+  const normalizedQuery = trimKnowledgeText(query);
+  const [busy, setBusy] = useState(false);
+  const [loadingMore, setLoadingMore] = useState(false);
+  const operationInFlight = useRef(false);
+  const moreInFlight = useRef(false);
+  const listingVersion = useRef(0);
+  const [listing, setListing] = useState<LibraryListing>({ projectId, query: "", records: [], nextCursor: null, loading: true });
+  const selectedKey = selections[contextKey] ?? newKey;
+  const draft = drafts[selectedKey] ?? emptyDraft(projectId);
+
+  useEffect(() => {
+    let cancelled = false;
+    const requestVersion = ++listingVersion.current;
+    moreInFlight.current = false;
+    setLoadingMore(false);
+    setListing((previous) => ({
+      projectId,
+      query: normalizedQuery,
+      records: previous.projectId === projectId && previous.query === normalizedQuery ? previous.records : [],
+      nextCursor: null,
+      loading: true,
+    }));
+    async function load() {
+      try {
+        const page = await onList({ projectId, ...(normalizedQuery ? { query: normalizedQuery } : {}) });
+        if (!cancelled && requestVersion === listingVersion.current) {
+          setListing({ projectId, query: normalizedQuery, records: page.entries, nextCursor: page.nextCursor, loading: false });
+        }
+      } catch (error) {
+        if (!cancelled && requestVersion === listingVersion.current) {
+          setListing({ projectId, query: normalizedQuery, records: [], nextCursor: null, loading: false, error: errorData(error).message });
+        }
+      }
+    }
+    const timer = window.setTimeout(() => void load(), normalizedQuery ? 200 : 0);
+    return () => { cancelled = true; window.clearTimeout(timer); };
+  }, [onList, projectId, normalizedQuery, reload]);
+
+  async function loadMore() {
+    if (!listing.nextCursor || moreInFlight.current) return;
+    const requestVersion = listingVersion.current;
+    moreInFlight.current = true;
+    setLoadingMore(true);
+    setListing((previous) => ({ ...previous, error: undefined }));
+    try {
+      const page = await onList({
+        projectId,
+        ...(normalizedQuery ? { query: normalizedQuery } : {}),
+        cursor: listing.nextCursor,
+      });
+      if (requestVersion === listingVersion.current) {
+        setListing((previous) => ({
+          ...previous,
+          records: [...previous.records, ...page.entries.filter((record) => !previous.records.some((existing) => existing.id === record.id))],
+          nextCursor: page.nextCursor,
+        }));
+      }
+    } catch (error) {
+      if (requestVersion === listingVersion.current) {
+        setListing((previous) => ({ ...previous, error: errorData(error).message }));
+      }
+    } finally {
+      if (requestVersion === listingVersion.current) {
+        moreInFlight.current = false;
+        setLoadingMore(false);
+      }
+    }
+  }
+
+  function updateDraft(patch: Partial<KnowledgeDraft>) {
+    setDrafts((previous) => ({
+      ...previous,
+      [selectedKey]: { ...draft, ...patch, notice: undefined },
+    }));
+  }
+
+  function selectRecord(record: KnowledgeRecord) {
+    setDrafts((previous) => {
+      const existing = previous[record.id];
+      return {
+        ...previous,
+        [record.id]: existing && (hasDraftChanges(existing) || existing.error) ? existing : recordDraft(record),
+      };
+    });
+    setSelections((previous) => ({ ...previous, [contextKey]: record.id }));
+  }
+
+  function selectNew() {
+    setSelections((previous) => ({ ...previous, [contextKey]: newKey }));
+  }
+
+  function discardChanges() {
+    setDrafts((previous) => ({
+      ...previous,
+      [selectedKey]: draft.original ? recordDraft(draft.original) : emptyDraft(projectId),
+    }));
+  }
+
+  function validate(): "title" | "body" | null {
+    const titleError = !trimKnowledgeText(draft.title)
+      ? "Enter a title."
+      : draft.title.includes("\0") ? "Remove null characters from the title."
+      : utf8Size(trimKnowledgeText(draft.title)) > KNOWLEDGE_TITLE_BYTES ? "Use a title of at most 256 UTF-8 bytes." : undefined;
+    const bodyError = !trimKnowledgeText(draft.body)
+      ? "Enter some content."
+      : draft.body.includes("\0") ? "Remove null characters from the content."
+      : utf8Size(draft.body) > KNOWLEDGE_BODY_BYTES ? "Content must be at most 64 KiB (65,536 UTF-8 bytes)." : undefined;
+    updateDraft({ titleError, bodyError });
+    return titleError ? "title" : bodyError ? "body" : null;
+  }
+
+  async function save(asCopy = false) {
+    if (operationInFlight.current || validate()) return;
+    operationInFlight.current = true;
+    setBusy(true);
+    updateDraft({ error: undefined });
+    try {
+      const saved = await onSave({
+        ...(draft.original && !asCopy
+          ? { id: draft.original.id, expectedRevision: draft.original.revision }
+          : {}),
+        kind: draft.kind,
+        projectId: draft.projectId,
+        title: trimKnowledgeText(draft.title),
+        body: draft.body,
+      });
+      listingVersion.current += 1;
+      setDrafts((previous) => {
+        const next = { ...previous };
+        if (!draft.original) delete next[selectedKey];
+        next[saved.id] = { ...recordDraft(saved), notice: asCopy ? "Copy saved locally." : "Saved locally." };
+        return next;
+      });
+      setSelections((previous) => ({ ...previous, [contextKey]: saved.id }));
+      setListing((previous) => previous.projectId === projectId ? {
+        ...previous,
+        records: [saved, ...previous.records.filter((record) => record.id !== saved.id)],
+      } : previous);
+      setReload((value) => value + 1);
+    } catch (error) {
+      const detail = errorData(error);
+      const conflict = detail.code.includes("conflict");
+      setDrafts((previous) => ({
+        ...previous,
+        [selectedKey]: {
+          ...(previous[selectedKey] ?? draft),
+          error: conflict
+            ? "This item changed in another window. Your edits are preserved. Save a copy to keep both versions."
+            : detail.message,
+        },
+      }));
+    } finally {
+      operationInFlight.current = false;
+      setBusy(false);
+    }
+  }
+
+  async function remove(original: KnowledgeRecord): Promise<boolean> {
+    if (operationInFlight.current) return false;
+    operationInFlight.current = true;
+    setBusy(true);
+    updateDraft({ error: undefined });
+    try {
+      await onDelete({ id: original.id, expectedRevision: original.revision });
+      listingVersion.current += 1;
+      setDrafts((previous) => {
+        const next = { ...previous };
+        delete next[original.id];
+        return next;
+      });
+      setSelections((previous) => Object.fromEntries(
+        Object.entries(previous).filter(([, id]) => id !== original.id),
+      ));
+      setListing((previous) => ({
+        ...previous,
+        records: previous.records.filter((record) => record.id !== original.id),
+      }));
+      setReload((value) => value + 1);
+      return true;
+    } catch (error) {
+      setDrafts((previous) => ({
+        ...previous,
+        [original.id]: { ...(previous[original.id] ?? recordDraft(original)), error: errorData(error).message },
+      }));
+      return false;
+    } finally {
+      operationInFlight.current = false;
+      setBusy(false);
+    }
+  }
+
+  function insert() {
+    if (!trimKnowledgeText(draft.body)) return;
+    try {
+      onInsert({
+        sourceId: draft.original?.id ?? null,
+        kind: draft.kind,
+        title: trimKnowledgeText(draft.title),
+        body: draft.body,
+      });
+      setDrafts((previous) => ({
+        ...previous,
+        [selectedKey]: { ...draft, notice: "Inserted into the session draft.", error: undefined },
+      }));
+    } catch (error) {
+      updateDraft({ error: errorData(error).message });
+    }
+  }
+
+  return {
+    records: listing.projectId === projectId && listing.query === normalizedQuery ? listing.records : [],
+    loading: listing.projectId !== projectId || listing.query !== normalizedQuery || listing.loading,
+    listError: listing.projectId === projectId && listing.query === normalizedQuery ? listing.error : undefined,
+    reload: () => setReload((value) => value + 1),
+    query, setQuery, loadMore, loadingMore, nextCursor: listing.projectId === projectId && listing.query === normalizedQuery ? listing.nextCursor : null,
+    selectedKey, draft, drafts, busy, updateDraft, selectRecord, selectNew,
+    discardChanges, validate, save, remove, insert,
+  };
+}
+
+/** Counts encoded bytes, matching the Rust validation limits for non-ASCII text. */
+function utf8Size(value: string): number {
+  return new TextEncoder().encode(value).byteLength;
+}
+
+/** Matches Rust str::trim instead of JavaScript's different Unicode whitespace set. */
+export function trimKnowledgeText(value: string): string {
+  return value.replace(/^\p{White_Space}+|\p{White_Space}+$/gu, "");
+}
+
+/** Creates a separate unsaved draft for each project and the global library. */
+function emptyDraft(projectId: string | null): KnowledgeDraft {
+  return { original: null, kind: "prompt", projectId, title: "", body: "" };
+}
+
+/** Takes a revision snapshot only when explicitly opening an unedited item. */
+function recordDraft(record: KnowledgeRecord): KnowledgeDraft {
+  return { original: record, kind: record.kind, projectId: record.projectId, title: record.title, body: record.body };
+}
+
+/** Computes unsaved state without duplicating it in React state. */
+export function hasDraftChanges(draft: KnowledgeDraft): boolean {
+  const original = draft.original;
+  return original
+    ? draft.title !== original.title || draft.body !== original.body || draft.kind !== original.kind || draft.projectId !== original.projectId
+    : Boolean(draft.title || draft.body);
+}
diff --git a/docs/codex/artifacts/xirp/knowledge-desktop.png b/docs/codex/artifacts/xirp/knowledge-desktop.png
new file mode 100644
index 0000000000000000000000000000000000000000..c1827631c262a3a95ba12ecf018ec5213f51dc41
GIT binary patch
literal 76626
zcmdSBRZt#nmjxPu0KtO>ch>}W3lQ90g1fs1cMa|?!QCOj-CcvbyPqfDH~-Atsi~Se
z7pHGhX}aF-eq`^p*IK)SWu!#l-($Uh_39P;S5YCkSFa!>UcGv24gCh3X>vENef0|I
z)mI^Y1?SYmWk?NF6MU#s!q|A03TS>=^DmIEe|L2qA9FPyOjS#b9)shTz~P&2zC8K8
z?Wd!N<7N?<85g(qle06!3=hNYr1_-fotH-=BSk&kYzU%%jxSkMNXUN=N~Cw}LVu53
z8O+UpPDKmoL<#<L>b*Zd!oL@x{{Q15*;4{?T3T)nG8T4rNG}r;lQ(}Kf7~mss>-&_
z{pT%pW=>viE(rzQ7X;h&^$*$Edhao)5_!Em6%`e`Jqd$@z+oGoo}L~P6O$N=iHiDD
zoljj}UQ<R!jFC~+hbSaG93wV1EIbTz@t>jU7py_SLJxQWcY+QPRh1FyTO;V8G&UcC
z4*dI56mLmQls~>ihDsx$M!$K-Zep@0JI>g*2K~?I#=`6A<wWA^MNK24Mu5MLk5~5e
z1PrbH^UGU&F{6~mn7Am^6gZG@wlVT@Q`1xb&fNfV)9}}?ls+A@znY6l$qP0I6Ql|L
zPHHwz)?(O5b*42cL*G|%ad|npA?$x=*+XQPg?cmcE7fhJ_lJLn1l||tpM@Yt0cZR7
zS%XBg82SkRIpyC$@XzB1p}zmWUX)D}l`SqI0S60<@y|`3u@n36^p|df10!+bxM>s$
zWu|{B1|Z-WTUydRP9orOq{hc96)O#AlaaY3GqTWGcJ+-PAI~y0x3xVl%~$VF*?jOM
zvO3w3PUo4PoGw)^FFS?r=<KA|Z1V};9!}mK&Cvd5C<gF+Q%fMBpfb2z_RluRA8w9k
zCMVIJW##jwq`!Vut<#s)@=a~D+tF^con9Im>d9ZK+#r7k|Iu+{VLGFcJ)vAfwZ^$9
zE^mwV9lO<PYYLMK71{oD>EJ&D(?-F;vHiPKL`!S5v*QJ2wi@#zmYRA(nL?#cL_{4Q
zob9KviHU_8o#o!bLcu_U3@(TJr-vJ}*;0H?!`Rak`@zn)FJ<b@KUFGq6WLr3Z=axU
z(hjDO{|*o;22rYSU}SPqy!m`pQe|}XDLxWdU_l7#%LAqC8#vzlQt#rZ6iZYp-;m+p
znr^6^UAEYrtaxw<@#v4o<U!iM55wi$ALYg1@mjOno`TU_e&ckqve;^LVlm43^XJdH
z>0*byr6P^Ss`IM?>5NZ$+xUIZ^Rd(qy(J$RD=R-64PT$1(^(iWTOJyhAjBz`Xm}hy
zx-_fR9v+&~X;snC(3B_*C%3v?(I^hQfxp!o(a5!tu~>P8q*gBHhs!T7k0hm0YuQXn
zP*ziO-J4MIg+eG)Dm8V)j!RFE@QRBgU2T_BmLDxkE<ag>PhnYZw4)~?YSC!4U2b-8
zu(e0Z5R;P9s&-rsPpQ{xIi*ydSy)+VlRimbe*=Yp^#K!gs$BZy#`75p0WT~h#L=eg
zv&jSmt>kcYPVY*ahkDg!z16Z>t%*$gN~ZVQ)6=?won!6?E-tPLLS}OdDELDwW8>T1
z@r|NMuiom7-tbb@P8Me7TB{dtuqQ0k>cynQR%(qR=VHp1T~X<^%(p@e{ss_PmZ(mC
zzm45*^p8da@t++T<mBX<UjD3knRZrp5|FD;7b^;ec_VP-M=$bgWMySB+D;|bTdii1
zFf(uc_6=-(xQ>jB6k+Gsf<nY?vp!pouu!L^74P3i{CK~Z!rBIcM?IHi&LsYa4<B%F
zd;)KdS5GFbe#H%9Ai+VrdzWpiE3jU7#0f$Y#9o56<?1z;^EYh`4IEv>O77o;gliy%
zQx;jddn`Ka`X$FvD~d^qx7uvv2lgJNE!Kw+{%C1yb(2nF@i=S<hR#61XIHBg+uENl
zHfXHm=jZ2ky+VM4larMlpPFj%eCioasYj<*o2%gWsByeZv?&-({le_Q&20|-{P^_b
zl|k3&dAL=qe6rH2-EK2ESukp?MVQH9eTqcXI+Dim?j3}%uqRS3<A*u{33R=Jt0Pth
zLc-Vmc@<+7N1Tqj%I2$0jROAXkm2Fw8V=gGv)LYQjyi~$@WR3Yw8^Z3pWxw97VnOq
z+!!1F2BHB3TPzSPU$_khRB$=$!}udWz}x!M;U9WCE1aB!Oqfn-pkuQ+<~@ipia{as
zts|F`qDa2Ce`C8=owb~>=k}J-^gb-<{Hob;?{W8cE1@sc`dVjTB-qFgyT6xfi<RHU
z2$^2~AeYvU({6Y9Y|YocSZ_(AUIpz!$m{h|x>(1~&d$@Y6C7B0I_q<n$il)R(22B0
zpgZ4c#<}iYBu`drIsIWxep}LbxhXF`9z8o~i&}}<WWxFCC))G#Yfi_*Cc7QWfMoG_
zIuQcd7U#2r;{>Z^>yz<TY~2)E^}2ORKh|48<4T7?VRN$NK!MG2r2Rg_m)o@sf4c&D
zZ7$_nQ?&lFW@ng}<Ap|x-6;OV3L3@tv>6;OAMz_Fk=EdF#_+F}%e91`j7D4P%$EZS
z@+H#$rn6josWhHy-7TtE2^?N25fP)QK4f(kD<oz6tqFhPK*WC%(0u3EzSkyIEnLO)
zOY{kW2eNN!JOA~c@-O0sL-(DHmQOqMTA5wbwbAbW?A0$6^7;1BME=OXz$(Eaefw}D
zFE1}BkgvVU;~eDou8Kp~AhzCWmPMOqS{NQXgmfbC4ylQt-#0KTOQ(u7B`FyJi;YjY
zp3nE)6}GtY{?QZHpz!|Q-rA~2B>rd;Cw@^R2;U>AjJS3Ng#iRV!IrG7tXvnQrImy*
zoV8l|HA5)<BkLSY)tS{!1n%Y46|y`$HjDnoeXU?19C~i$$LHE&#o~ZcTCxfvvx84n
zw$Ul-cKU|zG3dg2{;VxG-&C2iCzBl4boj#(A~o$FmlaSq!gh3uM4r(Ll)Qd=(9s>5
zvk7WAJUT*3g!v~uyL1gse^RS<Ok*S5J3z$sAqhUD<hJj3fDM|Ych?F*=?=yCk->L*
z@!XoBl3kQVsHN`zOPFSS?DjG)@$v2=EC11TczF1eMEltlTGd3hOSRc-8S!$Z%b?OD
zVbITmbssh;#xVEV=$sw`L$k@I>BRAzrkmYbrxVZRH%*k3{mug&>sB}2Qqs~QcrYkm
zLOq+@uyt9wFxP7^5Bpi<IW(6B2Os=vH1spA2&6Evv0-D(?&PY?8_f$OQ+PJ4wlXlL
z>!r(S)$54}156m7zWjZuSY?o$k~wz}`D08eG>UW~8CQvN{9br|INV2vGcqy7O8EJ$
zYono|ZMsAmBA-(*P>8bNqN38&5e_CpCxO7gX4_>AGMVMdd4v7l`QB$EW+vwCk!L|A
zD45igdP|)*$OyXC4hKq3yK^qf_tF?1akOSn^+$4YpBO36kC)x<hGGcdJx@{VF1IDk
z4GT*&mgM|61n|)4l@wCvs?7o;A|gs~I3-gXT&Fd|tiL@(Xev@EqyGaP&Vv$)pWr7j
zXqVOglq(HmeI!bSdyj>UL8F3%0?-7qI0A0Ggo;|coV+~BIYMJJwem9K+Rl#C{-ue8
zifa6aj1MUMU{kJl4knZz&Q%Wb5@gyHL<}a-9Zxj=c&yH#@CfN$d1%E@Z+5(*n*XtF
zX!vo)Qoao5ncMMENKFlk?D~jTW?>=UW)eM-&PtD1^jO$K{qedza&(Yfnsl~qel8ZJ
zO~~9u#=64Um+i39XF>t-gGe9Q8a)-q{-Zx^WZtS|NO))pqZtcXPb9AI<y0^Vxz$Pw
zX*<rI;XUj>YmQx)Z07*}#bUSXt2~RvitEeo&fMHwu(@O7;<`^N-68e#HlE+UL!(xr
zAs`@NW>%D!&(U0DS(hJiNR>+Gc-rY`mrCWTwLGHQbO)RG?bEXo?Q&Eeat;lKk<neA
ziHYe<UAf2J`4*4I1FOXZgw1SRv9iG^(Zyt;&fB~DR@dtW`@4ZBC`2q)6Rig8EKVm<
zCo<#NeCB5dizy_=xSNX|%ThJv5}CD;Ww-wRe#K%Xo5H6pY^Nz3+vJy>j>1BUohJAu
zhohx>=@VpP&lCom^C^>dVuen!RCYH6@f7mmbXv_OE;hEgnL5|e^ySKM^*YNG9=+{K
z;=uErQSF%ptZ`XUW8+y%?$lHqjHg<@f8pG_&+OXe4#n}41(J-ctX`*ovTi3?y+$(B
z%gaJf!4mn&<}%?|QNbX@rW79!`<xm{8Y+FYKb<47Hz6h_CYl9CvCeAN@v;y($mjZS
zx!&;T{_^rNn%MJTywxlKlJ5Rs6vUsNUUKu*O1sV;Nqk;Uq0{fDucGI68THCF+v&6$
z-Ca`R1`~)fE{>lbQtG*CYHBJZrh4T$I5@Cp%D)&#r^be9{0IpV0}*bvL@heS56zZY
zv)P_bCX-K8RFsd8Kny8SGKHhjxl$L}Dk6g|xS#@Yc}a~xXsOA9lPZX}mBaYYtCHE-
zo1>;HY{<PUb7Bz$dW{Ba4fjX8#*=>v8DxWeR1_3a3iOxnNYvu6YvdteVM6p=oj1>R
zR_C!M57+p{bD7T*q@hS_LL$8cygwS%nqnWzyZrq93-a<pl!pzVVBH^%)6&bzyuH1n
zU~O#9paVltDO0zyeSCZ+Lr`Vq<UX83UktQ46Ni9`;HxBBxz<Dc*58W6fWht9CwN1|
zt5Qu&Y@pfcBrH7KKpPER{4&qa>PJ-6SiWW;`f$qC(WLrqux;bfxz=q9m8qPJ49(D{
zI}{sy8%Ia~EACqwVjO-~x9@Q6z9#zmiFSU(bYn|HGzrKE1pKiE;D0|0gZq_**nE~s
zA@#>{TZGwE>HgLty9a)LeoZVUEA^{<^Wi$3ot?5(dOMbDDOrp8!JcuKoGZ}I!jT`H
zZcmZDJ<;E>zi<f(3d&E$^thayp@63!X9a-m_s?lFzY|)o=SMfE6I3fCe~58_`tkao
z-g7+}!`VK&5C<S~+U<A6_M<@l#UJ;3@wD2(GURr5XDH;H_J_LalV#d3-db8KK9@$T
z2dwtoUTZ}8C(G@Td$^oVIvfN9NR#J{SP(1}s%^RkGBPru@iEO`aoKI*NWX%jgYIJh
z95&ClKT(n?byJQdlbN!5G+tn>)gIz%?lZGF?^f`+{QkG{dTzeI-qQqtVI1|wRQo?%
zKu&LWPtQPtcH=&e>kylGv0U{_Vq8?zT(NZf*cbyfb#X;Sg?c@g%-TZj0YGT&)@L8`
zPgcRxRc#Fn7)ncH$bj0fNIsMArOiV|E=%AJ0HUJ8Lj6X41?cy1O`aP)#k1uPS4Sx5
z=qp~ozDbWZ6MJIk|NP0}GEmdd;OuQ1{x2Qy<YZ!IMyqyfBx8Mg^4YLI0iVO3O}ov#
zGXSngp>n-2x|5iQ2+4bMu)x&J?BUOEK?T0T$(pYl%@f+Q4KIIm`1SOt#RrE5XD6o2
zml}}ChK3~6nXCc`$OlP7<E}0*4Tm3F)o1Ch_M3#hd>PJQZPsjN!R53Um6W`?x<aFv
zz2*FevAE1oYHJy`>I|TJG?PvGlxN_d?sQB-N;+M-Dx-9Me`WTlzPMs}+`>ytOpMRt
z8uop2B5yFr<<!W?Dq(QipkANh)?JyE*`eRcA*jA?Vk&m2m4KF8GE+nEU;5+4!Nc{Y
z#b%?Y<?iL>_gM%URm+)&+kV$L9JASMo%EgF$TsaF;1BdIEwyq2j<%?kTU%P2jqb-g
z!Y0})^zS2_8?nIBLw=g2q^2ItU=`7pmR6E0*U}_WQ7Tsr^<uS}-&ZL(zB-5r9T<|3
zl#~cDU#=S-X^SWLdN_BoR7*`t+PzYy<On+pW|x7X!Q~?Uq4oe&3-h!|ZN&dY$O!!Q
zfixO@ewnpZtF^~wbf25C;M7QA(r(dL4ZOBE;?<4{_(euXx3VI2j+BLvKNw#-vStLM
zsGtyl@G&+yexbnX1;j?2c!||eISGl_OqIvC0wpxG|1b^r(#hOTzq`(I{7*<|Xf(97
zPnsWzTue=WKH9cz#2B>cE^7a0k3UNNLlnu@g@wU^s|C3(a1$gx{tuyWviYb$n3eVW
zH{r+k8|&*@t)9eD3c9-Muo(#*H`kj*%C4@i0RklyEG$xeuqQk8F+b#OwRssBC@3gY
z{$_yej3E9IauhOYd`_MH+pm+S^{z)fk@#MH%5lfbUd|6A%W(eQ{J%va(vUn`LKDij
zYo!qp@wq);R-|uLD|Vbt*a_Sb&lj65JGZB5!kiM?o%eobczut;Sadw>Keg*)cRSrZ
z%ORKkci#s)H!i${V{<Q!jS=t=uI-MaEIJ+IaaCkws?cdQ>B^6&iHm=hw&QlbZBU>L
zUGENsd129BT6z8C3d5Ud)_MO=uzu12SZhK?*~z*>yTv~5c5LwBu3z4WnAg2fp;F)=
zemE{RHUf`RHCJ?PfBNU2d9zt7BIU6P{^f>-+qCAJHrFR%5s?B5YF2UaP>`$S3r3eO
z8`9$AE!9iKE)2sN=?%Y1Nv$-vG~Zlc7#fmt)>-8g6jQff4;BCLV&US_1=yi{^%k8<
zp~7QP>5HU<%<a(N!)4Nij?S8rQr<$nS@<=t*V%d94z478IOolALS2>lOc&bk#f~q7
z**SXgblMx6-?ZD)?Ziy?+nxgPcwJ1*&6iq=iv1f^<>V$>AVaaIoY-yF;r3ZAr(UVs
z{P`0t5}A>$IGXNqb+jxv^TB+%a-)FjWJO*{&arGmrnjFzYSTSElYxq3p(@rTLF#CF
zYHFKah0B-^|E$-wauqHd?#OJq&lWo}gUe&E6UCxTd6xYm6x6*{PA^#nqb&}wyHgHD
z^0i{5sAa140KKM&CzR`|r>5bUF1{RXUw*8^AVtLE;&5D#1$<wqVR)r!Y{_avo+o!g
z3~9(}>&+|45a}R#EBP`>>U#IPXGg6iuhY}1q>D<%%Hiau=k~8jj(@^a@UnE)RM^tP
zLqfDFU2!`M^?#ff{p4Vu=^;Dhw7%{CVU(<v9F8@G!piT?zk1vDnf3G0TpKe2p7&pv
z+V+uNd9dSP)+z*pIt1{EeYnlnwZ<zDt%{c-qv_2-9div0U0p(zh5`Zt8ZDbXg?1Qp
zS=794+f0`W(iz;5F-|8>NEcx^Jo>j4-n&n{UTef7wj0|=194OmDO_!tm1lKF&0Di6
zTl@MG6B9F*bLNJIAueWfN+KBe(Za?mbJw_TSj{YnOgdrt`P<iNZV)CoSAW)s?d+;S
z^3IWt6ovB_ghCvfnZO#WFQ~32#>3;W#aTWM-VmNGKWH&H7-?u=>z@$l6cFqHC{;GA
zCEOVj7fZg({9`V$tNj7ZDkcQgsE3wR5}V_#mGALV>&sfFNXg}4BWxN+T^ff;YE{+1
zU1&n(e)bnhq@<u~Q6joQIaSM?z@0QGL_9?7PnlL3c*nC<w~Qrk10%@D$ineIw`is)
z0dB;Dyw#nKifaGaS46adP>IX^5<<@Uyjp)w%lYA$TWKLPeGt6RWNtzkAzr7{uQ0c3
zTp@-4+)&Yzq=bY=TQH(dC){%brSrEo#AiMOWr~9>Z;|y^THUnWulGKeXOn%YfLiBY
zr~m{T;RifcL!m&&(wk%6pzdt=16B)K`Fy5pm9zCP_2!GD0P&39eA71$;)yw3^)2nG
zgY6;^S@9MWsWV>;#zA;@rHTEu?2|xDuE3pb9?cMA*Ghxz6Hc3kcZJA8iX`8*{_dY=
z3VzR5DEF?eY*P}F;t&w;f|<qD;{>8|^77`ZzR0iETcK<=ZL^otv5}y9L)`B|8%81S
zP3M@2iT$j<2|eE$jH9&hhs-8EK6=9W_)dXNp@Lv0JEznlaH#(RgQ7o!HzTG>&a?LM
z=Y$)^O7lymL8#%vf*Q+K333R?Q`BX7mdhL}ZGuN?-u(Q#vBf{Ln?g)^g4?aEK4AGO
zz_3_f_UX8~HWe}$PFeMdeoG1p?K){vDAG8qw5NW2d>qFlChnxEKReqf2*;WcoH8=k
z_mhxniaJAhjfl_FGoyok_|+WwoKTm&iWTzx?l%)sG1QAQ7gApFfFno@BN218VXW!O
zFG02X%<>?Z%gaZr3hWoT%}SwB$0leabTo>g4eBB0Jk99^Npx)+tav+TIlSL(xw%L%
zAOB$l5Pgg`!UR9`_i?pNcj0FiAwfZI5+)jEQpjL3NlAFW=%A$!JW!*cXu6~=DHV5f
z;l_A&8~aQn-y=q#RYr!`Ds5qLgw4v0gL^n`B@82ce6r$3;5dmg_I9`pF(lLYq)kvh
zf0Rl!8{+;TK92^e6>ROztwH6!DEHf2<c)h>N&C%i7`TgrgS|k1|3UPai+!-Xklyy;
zCCAeciW1{*j5?`^@cCQ^iepeTpTcNf<aXu4m43PWfP%tl^_%Eytv6B@TD*(YxUe`B
zW#4pP)GYIbRzDBKEWpQ(YBvZ;*MH9;)(yv+8~VIM=e*JwcnigjE-2U^`Aozz2SQax
zR<HE<UU}j&OF)4C;4zB!*c^qt*~W(-9~=M$f!Hm&H#xIs?6o41)<ypXdYuPAcLDvF
z)EFY|l{SlF5OuQCrhh6~t}lo_+cMWk)&*9wB9U!XyzR~`v(EB4d3qd(-Mg=s6qOL5
zpx~iV5IuKOFJEnee~<8+kr;jbdoXk)!<~ET-+iE5tWenj=<c(uNW6CUo3Gx4fxgf?
zSJ<mcmcx*`QN)NlZ=1Gv^~;wl8l`Zd9GGj@yF>QSDgMl47r8SVkdn>^xyi{@v3aXx
zJB^k(@4D<9@7H2)58XdK`VUf4Qlj)kcG!-M1ID^p__@sjKPUV0@=BjIZp7B%Q^31-
zeJp)=*&-1#UBCEv&+X*i=)7}XxxaVKvh|i1p1^^bfHt1ah0!}LKTJyX@snWHj(4xl
zbNOK?sR^*jQj-UUBUTJydiqTO!d`hnaVWz!C|rFmG0IB@V?CcccKYS%4>JzykoPhp
z@p(fg@p+{CjE#*8DT)cokcjCH`QE;LOPDZWr#M*Ws`v=`?%i4(htrzwhA{l*LO%B0
zn*5K7QRFh{`9r=!xuW&^aCI?M`iNaA#pBsFB&@aWkl^s?nTZd%t2@8Pzh#yyx2VYG
zw*Q4z_hk%lA#Kl~&_=}NKu5=;dxQcS0#SCS(qO>%mkrEKeSHwtBW~lUXR%lc%}h)x
zJv-w$q!2KDy)JL}29?Xz8<{_|un3d=?$2^GRol<$l@?2=>(T%TSim$7#3VGTIUIIZ
zB5rPYZyE159J>%X^3Rt^%DBA?>*wRkB1TQ3(H+OLmYFG`TIGkz3RN0uB|840s8T`F
z&bPZZ-S4+NJXTAWEB0=Rew2u*mZ&w4chAFA4(CxHcZVczj%M&SOA4lwvytR}<JW^T
zS5b>=a^4F8$VYVcaNen+EL7f6**e6|fI<ip1q&-6H7?G8@~y{HO$}3*sOi2bq`f`T
zk@HfUFNJ7H@Mcf9xU!-`tSoJ_h0xj-_3VI}I`M}V`+4rprZF|@V!0i94FL%>Yz(K3
zco7h>{WYR2tVX8a`1*i+I@T!f)<Qul9xwXvkd`kVSEW*Isi$c~&UCxvFJ46k;tD`M
zr&I)qjr*R<jS+$YwFHO1)zs>Y(ed$lPe!|2T^*Sz<w!U<dLHgzx%~b9hInKsUB|Be
z{Cv_E;!Y_LVR)hM?;{YdZ&7x6gZZV<HLz#YTP<^Pd~x3`9L(BjRTw8#RekV*Ivc!U
zHZLZWWOP}8(<d4Gh-O5oTsKsQ+Z>s}7MGYfmHkDYnVA{tL9KYkl25|Nv)%bD1v>5d
zsQKD6=rOY_Yo*zU_3p~Bk>jKOyZg)Ih*}VmFmcbMa2K`*3)D(f#(To|UuyN)C)k>r
znmk+`26dVN?m1eqBOqWX)Ol)3Td4msveqMsn441ZW!E~VI(<t6M1Ykh3uPIZzRcGi
z`u_2GL*-h{HV1X&O%HjcG_>NX-`Ho%R#Ukg$m)uHBpWkF_b7$<)$5MBu<Yi9jmQH*
ztddS=k*D?Y6cKr-kVv91KLm@sKqA9GHs(hTclH}XjLmx1KvREMG$CU~hkF``FG1{|
z53d2-A`VEc|5o|)r&wun9pFgBd`Ku0T%ba(sFll{w+~$of54gT0ocT%b6%q=3Prfy
ztt&fMEs}uCd80d8ke^p;K8`w!M8aCx5cd9GfwC=GPGSi0ZhFuw%8M^3F3<l|Q|D4s
zaKma<Dp*>SFP^NEHeFUyQ&Y1|#xYv)9ZaI;{ZWEO*|F6H8JS^&m{^nsTSBZLf(V(W
zSiIqH4JtY9RAikvbGncER$ZJZkL?yPFvh~$$w>w)J-NC1G&F%OvafA413c2J;TBVT
zV-@tb<*FA0=N@BGxl-umf7mv^<((bX#r}*VZfu=i7yXx{P;WVPQJl)n%vAX=DgDWb
zQa`G5aQZJY{J#sVWsd3t|KS4uzm;wOTL2Exea8;i?tdBa%Z%Ja{s=Jgd_pAtvWRWu
zAUha{5Kg{r(Fp(N4gc?Y@qgd=|ExU!zx@&g?4_!P#v@P#M$$N6o}b*-0_PjeZdN=V
z{9h_&%eAFbc!*h8lnCUYsg=sKYMf1g;0FrS*<)_N0>vaJQ$2n<2CUDvX5&5`7=tGx
zhQ2$9r|+)tSXYP3PC#<H!fKF8;@~DF{c`(yX}Ns4!AAa;lvcfM{dA4E0}&k+wZ(08
z#m^67&F$jalgF|nH!%^DFtW{6SniwM&M>`&1@VjWOulYBGpqShjqC8j=H_N>?9}(~
zzcT+2FoI(Bdg&e>8-(chFNJ}K_&F}DR?olc(<&;g&G)jb+-~Mt45-n4RAfQrd~evI
zar9$v(nyIy+jB3b9gwVEi<8xEkt<RW2!J6)dlshy;(6Mi?HPevr}uF0g`!v-FGT@*
z%J@u7$(3TeMWs|iAVp2>rK3Or#GTIt5qbiOisv(~f5z4Tlb#q)V`8c%Cu1CR@T_sF
zoHUWA?%CPg8<RH}C1o{R2fyM6O6qK@PKgMJ7?yIa_PW|qGS7wurSdkX(UDIEVtO3h
z+#dZCTj3fh9J8e_4`Hg9C1^(T^)KJeerzlLT&OcyTsv-k&>aS(=+RPbvq$g9aB{s+
zKX~olFx-<ryBhUcoh}y`eR6_@>~141$&Lt;DS$BY<QCKeir7q!a>iRI#A%x%<@T(D
z0mb62!P(N)Zzq53&o?P!Q`u~)1bgYG&E~H5ClQk<Di?xe_0XSdjUT(dPMe!K9IZ_9
z5`5d-tyKIuZEZFUa)h0N^XVVL1(&mlEp%G-#c4+@R!?1X4V(c^r=#a}|Iu;1-ZOK1
zdwX~H$C|y*W6odGV1CHNWTmMP&qQ$lS!noJr{;Oo=c{w@4i3l1A$ZI4`S~pre39&6
zoBEAb;>fuoo8u#dqvrHJGpEDx{qDG4<>~zAa?dBIg_#<&$+Avx^_Ek21a5OhXvNF8
zA!<6in<Zd=6ZwYGs7X0#si;g38(?a24{EH<S{)W0&(MA==`G<-I#X5>g;^V=M~n81
zkL&EmeqCSP{EE^gfTPCNca}a@=g|wsvwzlVx(PReF?GY^0sge*C^$y7dgt<ZlDAXW
zYUO-)u83M{D4<Modnk=wTpNeirph7Zdfnt|HoLnInv{%eebZv1<cq$3u1bMhq?YsT
z^%1AUM(HcWGqUfW-vkrSpW7%n?ag#nN@>z?(b686?Npq$qtlwqH<jLMdH=?(#0l4~
zb%mFLN_Ap;DAQ=9ia(iaggxl)kEo|_fn6&~VYPyZ`5isj4v+62JZrU*31r{|2Hd-~
zw~ojw_feP`97j&`*w9pej?T`0kk2`=c_q-PM-)Us3%IzqkTfs03GQ@@$Nvpvs{#BG
z5CNLe_52LJG7$KSFfcG%7Um&n)By$Y<tmLvCvCwfz4VE^C-J>Ud+nn_S&^gS_6V+y
zCv_GF+q&H$2zXqm%Wq;I?(Ry}YV#Gv>-Q$}|EzuY_SL?<rBPw9I-DC11X`3oHE@y8
z$~By7!*2gor#A~3*IPaTVWGwCW@X-PXJ_a+NASVXczUJvq5GWE>6q){{8?{1?5ARJ
zgLX5I>!GvJ4hQyZdH2Nq75?RM+Gep3At7P&&0(=>PLDS1ix8)JovD1DZJvXfQkFEY
z(@I8RR8(S+Bb{oM`P>-cZViY|JP!Nzu{ns!EzUM>Zq41H=*Fg|mMc|P1JlJREM==T
zHp}7}2~`Zjv8ky(zcPWsk;Yk9Ydj9OhF_<k!KoWrWl;K(%FD{cWWSc(O(7vJj?JY%
z*L-ubGnzKp<S=M3sHE=+GX@7iLN_r?samCflisSUt6Nb6BI&{IZi#ktzUm~|?&mZf
zJEc16mD~Ggb}P&N7*d&ts3D;Ltn##;9S(h*Jp1rXcPvT=x=@Kuo8=oHZ;O^l1m5K2
z<k3<ku_NX6uO7*ix4u42j(e#t!bC}z?I^J15~(dttIttUGB_c=0dSIHVzJXVE->W`
zS>@#!^j<s?yT%8*2M7K1D1qALD;}#YE|ZP&P=E(cHFMrU&Ncd7IIb6sW@BsHb=Gcp
z<O*k6SX6`tgv3E14L=S*nfGGL3J4HIJYHbX=|aDK%LL>#tyWiV_s!kn<5`&<;3&!w
zjs(^lV$ndoI?KiAt^BoR^Wg;toh%&|maSvJxswHN5L`TKd}kmgAgBQT7FNp@94>pz
znV|EaAZRAN>HS)0JvsSFl2Y8y2oFNE?a6KF`fq^?EesBRdg`2*0h`H~!ZEt2sHicC
zazy|N@ebY!tI(J9Ppj^2(0DLRu(vlqrqZw7fRK<+h6<qcgM2Ia*201oa8SF8r?$1y
z=yZvZblsJDz2i62fMy@hzUzY70Hi|Ts~q*&5ojuz0`1k6UFjTZa}(A5ZHN9{vY5}q
z$;{ji_i#L=p{SH$G3ngRK+so;y8d#^>--%v(==|tS*1m#GE!D{y=fqhI@HvMX@$@8
zZGXJ(m(T%L;ZGe+-`aqCt2CK8oy*1b{BqCnXdzQWQqtr1V<Qz6Ribctt1$fH^V9t|
zEPlu)TukYsl~QUvUAlVoVaByx8EnlAx-?FmrmuRln$0%@N{qIf)?E%hOy7Pr(9EbT
z42TH|E|2|s^*UW8!V_)*h}ZtWgrGmCd3Rov&gH2P<@g#rc9rqjgpqWHs;XLc*UU_v
zUf^{iG$L#YgUS1Q(<~jGm6cH^^F_H*HAQ~gJI}dCUJOGOf-1R*;XP_ggn-fUa6tkL
z3=CGM5qxJtDg}xYmmNB-OyFk-YSx|TI@?7<qg6xo1<Z|Gwsw#uetH$1e9zbz(i%L6
zOS7Y8HHCq9yKp$xw-um+=}7BFVZTP}=vJgo&?C>`CFRZGBY|Rve+-^<bgX5uPzjvF
z9*5M8^nJLAr!uH?8`aw6`aH_!wUP=#JkV0M>U9J^Y23P=Jiirs#+1QiwuP`|6O9AQ
zI&<k4AAZhT#h(g2*lz@q@wnaeh79;#Jj=qdvJvvJn^~G%<Ui~O8NKe2w0>hbUo+m(
zfuo8_;>BXQ<X4S14oURB1!gFPlaqx7y)k)c_~DlE{d7%jEh6rcmA-xu6XlBBm|Bax
z#X`*&dHIcBZQRb%f?<AZVYLS{vn4vzBPvr}`a2P&&b@pCtZZzUUzHEz-!wr+eW#Lb
z>53o5hBUE+O44F-J0t2(iV%e(zs(Ve>|&KmWO4Yk5Ii*&mgJ?;;tWhW2#J-p)B8Yx
zELNiF+>PV|M2-dKrh7JUPd(OW-3snFzdZZy&R}9;T^`O8lQ5xj-%6&`Lr;XJLG<6S
z`dnUJ?hK_kZH2fgD4^Ox`;e%f?fD>uHHM(jYkw8C1ICN4z}<$y8O5<Vl~f9n($v_*
z#4N_XA<>7G59sLVyGB8iyP-kI5d^plWeR(fvzfBSYE`*xo^VaBP3sW4Z|7~t$i=0l
zf0TAqDNx$HA$--O`ug>2(T%=(9ln=me*WLfZkGcY^xC*P9C{*=G#U*R?*8!DtVg`o
zeXFb5k9gvy3kCkz7)<vy4*sw?<bf(%!`RyW0kKuLH9e!n@qx>vi#SZ!%fvR=p&0Z5
zfx3;2N%O!>q2DZkb3?1qfb=}<Ue2PQacXtK^VB7dbhe=5cvf__(ZghM4D6ATLcVWg
zBN(#1Z?#kFVx)q;isv$le?{Djx1^2w&>s~!teO{sb{63K=Mkhr;7%)69__AkW$yoE
zVQ#IE!QpU!wCE(dlTD)L`Z=tLZUj@Qfv}b3Fh7u~&t&RV<2*11!c1V3^u<5k_RH4@
znd^v~sC_tj6^_Ls)I%nSozDGZ$V|SBMv7FT#$@@uSK?^{?bihrb@k9378PcnRC4L`
zKEtkWepRReybM~WE2GlaX`~<FhW}`XJqMBJCu+N1-Uie36)9Hd6SOj5zUaaLy=45R
zhd_jgiRo~&NPaklb#ivH6O&3H?XPDB$|n{f;QFir7#+^963SH^);jWV7wZ#~l7R~)
zT$JGAlX!fr`!puwcV|KoXJ@vU4<FwIA3_BBWkL}<9#{GSBDzY&Gx)>nXYZ=O*WTU^
z2OO}C+dC&lx^hAqJi568{_lggs@js%)9HkDP*6~~PnPaHdP<5WjY>3I<ybglNcwt8
zv}%|7$C34#(5RIMbu_y}fJMg9Ut7ro>yXat<&`RS#l?7U2g@-m*Y`kOE?-eN(vE~6
zb%NvlPAJ46RV){1)xlW0a7n(OrM7uu9}P)jl-sqqb9FbxV`50OhdK+rZ;=WjfBp<{
zrd6VgqmXsK897?4J87`FAd{oGwX-v0v>L&8yFN|<ASaa!`dt)u^t6a!=g0^`KTdzG
zX+75|p1-x|BNc99qPwe?b(wsDOqLID1+KHYPfhW7cxcZ|wOje;MwmnJlkwkoW6sm8
zW4>l#Kf0g@FpnR)7zkP|``x0usF8XAj6@he-0%g5;x9gcnywAG{Rgo(!V^Hw1(FZA
zPgeH03|x1Q-LUHF{S?ISK1EmY#XxL@CeR3S5f4j|WX_hxYr|&^2Eb!iYvd<w>e^TH
zzG&>?BYpRtc0A&=SZw>8aKu0Ny;5g0b|jtK>F^dtByb_=V5;=M7I+eW6iA79-d5;t
z?FR)}2QJk5YpCDO>ejq}+drsO(lJ&t7e^_V+XqZrW6=T{j84xP#3GSjO8ld@fn9jt
z>x7(Cv|4&Mr;D6~;2`dz+~*sx_#|_ljDm`8wb{#S`5qqJ$<C(DbsAT1aV|Bkc&4G&
zG(62*xmXEU8hrdiiHM2mwVK@Thg2~VQs1!G;J;|KIKyo88XD$1!+^Sgf`*2Rgk-aR
zjkw!vvrNOGmrk?J-e!@dlw2w`hGH4%?jvM2j;a_6o2X@w)0+mDLE;@~a<WN&G-Twg
zvN9f>$2oC~5rAqWqgHrdkuQ&=#aOjjtkxNHpXUMXJU%0@lBvGYWsqfPQO30tE8v^8
zA>nf`#n8!Q!MfG$X%;SLoya4>wn@2G+@^~N4c~vb0O?cDEjr0u{cp6xv~DhLp^e5}
zk8C0cxIA)Y8th*i6Y4RAf?-GxJ{hz*8?oQfe(`~R(KQz}pTn;<v^QQY3%TrArU%Y;
zl)v-+@iY5}-I8+cX2Z)l8;1kd54mrnfQtpanpK`m8i0P=#cSO4_4V<*#LsT%JcrHp
z$IeeZ@H<UcjN1!&;ycBvSA=7CD(#-bg|d1Ftk!5Gz9mw?p*NsuNAkAS9~Q%OtOAfi
zra#ESyUV+c#%jLm<?=iyazmv#PraD^&R9SCV_TG`9!jU#Eb`?GaU7%9F-~QL_>NSy
z(P-)HudC})Yzy^zyw8>`7Lsn}^a0_$VR)3hZo^o0;n>aBN31emzPRj05wfqIqp4Tg
z-hHAOuKj8!#Hliv0sA~41C_G3gU?`e%w--C9Zks6EAxK5FO~gb#%ivxynMC5iT-Sn
zXP)0P|I39Tz;1so&bM-dH!5F5BJp-qdLbDT(=<zqT3vxDK{EYQsaJd3oF1{r<IGs?
z9w>KvBR<CI2z&2VcZx(1BvDEgQ&3yYw^Ra;H_O%lx66Hv<RStZRjf#q?+@<5!D%Wb
z3a`8KIDnwP{rOg?G3MhGX0t)ArmA**wD_>h*)KU!!AH|I)+ggkN26NTVw)GzchN`x
z-WMxK%kgl@-{eeJ%6Kv#P2h&d1FFV&{18A=kw{#tvCQWx(oigBQ)f`MPMgiRy14}g
z__sQ*{b;lRu3NL|67Qay<4MHe9I$nuprD)%=Uy9S{K$FR^Tze&Sh-YfS}+hX$F^8W
zyMa)I5*8Lh6O#ms(bm2^o!fMNT7b-Pr);?o`Xly7i-js?CZ@|j&#mlUJEgk*?~O<M
zWc4_lj)QJk|AJ6#ita8Un2>H>g06uHfm^D+A@|$UO8x#1>!TWd1Q|#uD8)B-&2&VU
ziM2H~`r0x52-(Dnig8OX=baM<gVKPK1nzal{-~`yvX9Bp1t)tUv$Kubt@_5_zMBUh
zigSLNQ<>i;t_H@glA@yMt?UXDXxp|qfu!ACV+#w5vxVwIf*-_M(`1N?g*iDtF2X*o
zJ1|#y8^MWE!-&mW2q1ip>2O}V*r#4W*&a!0H@Q%{`;dA#nl5@A5<znSssnr;_uQ;3
z9*h0hkDp(DCE1=tK#h<c*rHhzxbV7#buv>>?B0B=K3-`qC@yw89-^GLwGLThT5Ym`
zs-h?iK<#~OtVZT^;q~It-?bJJg5CqR8g8p+AKR?~A{L~b4_10IHHH1%7e)r50<JEr
z&rg_GzihFl%31AtPMRhTmVnFn$X5g94I1268tuxTMv<1lt{%6VnwXe4uGh1Ae#-ax
zbel!@)~XL+q6^n0zu?(&&E7`&2J5vlO%5G*{-|dahIn6Ni@rbJ&OzMYrw%$GFS@@&
z$j$@NA^L3wua(q=p=5L&F00N2aB(wq$y9vf&n?Aj77K_HQx`urJ6{q%C&kxZt%ui4
zNlcFKT1+Dt4lY$`eD8)vj8JX(40x~cQ6I#CY%)m5?hb;T1Y%fQKYT&-&AwwVzTCMs
zy1qLi2$uc*eQlg=q#s;Kg7&e*F4+YIf&P67dZ~GQuhY077gZ3}v*Cy-gKEbFaQ8eG
zZNCRm6A=kG_M(1-AV)@y?&%R0(E65lPAk&l$FgZc_%R;9MBdlFsa}CzZc!IKv#cZ}
zxdEl6r+Ng6=cm5~Ih)lURc-DgZ~6cFl%jQI`UnD7`|q|Alf>E>=^q(@7VEIj_Ai(D
zKIDJb+B8DW$jEqu&vkz8iU)KWq;dM5zOk`|Ci^WhG=Q4_`bDyF82h66{OtaW$=ZFM
zRH9A6{`m2|&}AqLEbPs>XT(K~!{Bz99SE)zMvueHFq_s$Yiv_>dVYeJW*v>epHX)x
zN0k102Pj0~Y)M*L($y0vX_3au;s57+i-sf-4Oc2VPPR7wh`gs+#NS9A^uK$7|3w4W
z7u8G+Q3(n6i|t_$X0x-i{qQ@14-rJ7#`2Tn<7ZGd4s98Yq~6`0<(y8sI6DIdL+T%2
z=6wO<j|+ox?e>*AixglfOio^SxH-Ya!NFoOCUCa`XI55L>gwv)ry8x-eDd-Pf<KTl
z;DT%j<dfj3sVQG5L>7w$1>n_-dWQ|{^+4I^7`?jOlP4u5t+ZH`4JaK%xm*4cOAfrI
zZ1bNJQc_Z2g)Te)aIg06Y+-9_f0maQACv>d<r^SV>O@@_0OCbJLB3dtRzgHrnC>qu
zzdQdDf{N_P0r4TIwoA(`6rHxK1L#oF(xU*Rcz(e=J$Q&O{jsVk<l+O}Tl@85XiG~P
zpOX6XYpF{?KfeG3EUrtyo(c;KgT@ZvyH%+)FN%)N;uDH>g0pQS;O55lmdq0H?+U!X
zzu)Ky7Zek5-#?tM1~!ymLV03wW5^;@#H6HKUBM`kc-#UfO9KNx9S&yhE_QBiZbWkZ
z#&*Hr0=z3?Fm!vm)(I%#DH}UGd1Ymc1TSDxcDp$SelO5b&;_LZHd3IS2-WTMMHBZ;
z!(lRfTW#|Ix2US9P^mNjn6BAmZvvXBfB>?kp5Ex<bIDPU&1(5=IzK<(I33KvquNS~
zi!TfCQ4(<dn&@H~%HYMXCT8?$q*5*mGpWpQ0@HsmTi)B%HMh8^N1Jq`1xQTLF5%(s
zUeOCksqOW3AC}DRq|Zhbe?2)}!@YC^wzMj?0i`Gyx9i=o+}zwEA|eW%)xaAnOmeZ=
z|Kt1j?^OnaL`2=y9~~3;Vlmh_xwtK%W2SbG2s;Dt+1-B$ag_ar4&3ckZFck!66%T*
z-+@J^!NkOzYBZ|{9y`foHZ2080Zz|vUavW}cGFJgDmNzb#Df&a_-Dt*kvX?0T<*>d
z+C87{Z%!g%AQ&jzA8#3bvR89Y4a0*3qPAC`9v=Z#kulcO^Yv^=NKhV4=MIF&j!#Vu
zyA{#EK$imsOTdsQ70E%G2_=%OekdulUh9xdVL6&CK*S?@#mDfy2M(VH2N4PZCvlCa
zi6$lR%tRvd984y11>vix3`jFBk9#JcKuY<1Hg<N4#X5LejNCiwE)tK2>!X>{MbP!t
zee%Y|&FybSEk(M@S}0a7|8&w?s$T!IurLgVy$aMfKx6wN_0E51Buy}OqF9;UoM$~%
zv)M5??sGZm#f-&j8!lxUqh1dIlK?|Nl*AHRP;JzLz!u1Jep*RR7_#XEiIfC+S(IN1
zb!qtAolnPf^qqkTq1&{5G?CfzQAi>TlX<)ROQ_LEvSv=aM~WjZ&^+jsesT5y(1P8_
z;!viJA7|4BD-;`!LGMmOON+er?XNlvm`Ag{>%C-uy<X`WK*gF~C8u#Xd0g&Rs@xtX
zDYrkrwJ=*)%U$&Plc~~Ra8QTWdXK~ATo@tVdJnIuT&6~={tW!>peIS8TIuMwV89&|
z1hi1@7^v|-x{iipvkG&(>Gz(mHqvf(l%#35+d&w(%H5wWj~s$~AFaMSo)b8SFOUye
z8Lq+(*pP56W&ueF0%hNk`pQa1ygIYlk>9`hOMIo+<>+?1av*dBot+!pKPxCIBHIue
z{_-n9BGv8k?>203WFOonEaWSL5$_R*lK-h*U-n3|J4cwxhaKh2&k&FdHubuEkUNqs
zDzy?^(FY-8AEs2nH@!<sIPg9B27S={fL`!H65@9r=<0%~jKB4GN0Ja#@afa14!VwN
zu$%;ot2D#|N(EnC++Q6S4kzn`i!Kw~3SA4QBD>(}FIMD%ji-B2wWKMu+P6}M9<hJG
zO5)8#6c5msVyPPBq^PImd=t0!v-@B?op68y0BtLy89DBEA#s1JJvN(1pSuf7m!<UQ
z2MO<>s<m~wo%1bfHV;rc1?tcPf3v}$SQ%M^?KEiaf}tC6U@6m9uhQ>7=62IDhb7lM
zX?r@0uJk-gHk3?}NaA?9OsXz?Jlp66J2Z{k$#dk8m!rliP&S~|?FKeR9MLj7g#ku(
zvIqX)bbPGf<P`!35+%#^OB<ZW)=#<JOJZE_E?8RvgMnC(+0^ST)8-mQ0<~JSU{3~t
zdLTRk^|}-M8<m8N;p5rpT#K2FF%$$XLL<WF&C|+88;UYkAaYmV@)Ba!zr+O#8|r$s
zf3)0;VUh<h5g{9YE+H?moHS^gi-?R&(2OCE4`pRXBJbLTJwwc9n-8m^jrmQE<QPlS
zgLL9gzygOHp#nJDqO!7xFMyO|8m#SuML_5|1ThQ+U-w3-M1|4rLO<tFXcbp?FPYhl
zK-TwpCOoAcDTCGYmeSYMMAh_hjxn)NEpOn;jFnEaNh9Ch<gyHOF3`Lac)Gt9<~83A
z+iTelrx53Ea+;i&=xF#gwkrIG>33oWD4YJ|3ckz#m(0vY=)e;Z3H0+50(~)O{49Vw
zyzMHH$!gh2YwnG}#TXTFmwT-J#)Ga{Y#0uxk#sJPCg5idM8Gf7YE=WzE2Fd2z)0tS
z?d--&ue~BnKm^%Mumj7W;Wxww^f^cqTR=dz=<&e3e=p$oy@kKta#^1+WcQc%ThUsl
zqXo1$dd;TTyRrdHK7m<YfSwL7fz>}t{(1T2<M&$qc`oZH0ce}YTN@$Hb7i}%TBFf)
zTo!XoB6KG6fmllRk~iw!K~mQ;o@#!g?`)vsi5>Tlh}M0fDp9ZkY;7(okAOH55YTw9
zRpjj341+=zv_>?}+fn-Eg57Rs?Hgz^^{KYQooDdg+DXJW%1BC@2mOqdHa5WO8;VZ9
zT;mc-05eE><A@0Np2}302uW562zueXa6@Sv9){!Dq&dA2p!}T#h88Ntd!}6fsGeF`
zL5W*Yx>LIUA;r4(i2PxRJCF+)YwE3DUQ495TQjn-%;Z^m%s08Owi!eT=Kf;KyoH43
zl>&m^Mh`q=0WuQOchOhenEap86|O-umTns)TGTJ(T;&P^PH$*(4h}4n44Q=CS9?QA
zpLdsXGVDRF<#xM<ZuI^2iai_7Uj<_(v5{+Vo7>|awYbw2S(#ujgHY{P1=GEe?)lF4
za0+`tOw?e9F7o2HQD<joeW@0L#NW_Mdy@soJKyv`8AbYxgoNdIyu|LuYW(in7p&C7
zHrS+oD_kEO8c<dast^c}<xX|c-))*WA$#P!yE-5zBU^4eask{H`f&2Vz|$rI3y!m>
zl&Oj7x{%<0&&IaHBlnG~53ewr(ENO*9!3>);;%XW2S*F_TI;4y|LqGfz1yEQ<LWAi
zYkw&yANzx{159nu%3|>p$e5TU%}cK`Mo4*A#Xqx=2wmTia(^TxPs<TJ0^uQuJja=5
z9pIXfQ2r5&%*j;{BS3N@EM+vCDT$+2o+;PXezg2rZ8!`R<j4+_$$ZeeTL2h-3iG)N
z!Vce6uNRM_g<9yhRT_qq`I6D^l7ONGkki@o!S;51a~(9Z*^K-3;XE))Z^0rLf^<np
zZg;sWdv^}9DkE(dwlP2_7kE7GLGgW~K1WoVO_vgs3WE00f_ea-Xw;fce+fm`p+>q@
zRaG@8n*=x&gbG~;6@oW-XDmy`m_2ibARO!Ug#G%(mz!d%0)q0vbTP*DEA*hap6+hI
zmVfQrI3~ImPEN+UI+(^~cQqFitNQUHr{oc|rExkQ3xIT2we|e^b?woSjLK}c3+T*<
z;ZfCCS|=R@eR*+f0YpM1c2^6vK;q^0d?exF!Fx&P^lA$z-TV~dN;jfh-h|I<^Xa@Z
z@V|H^X$sIb&9G4WZH*|bR<p(a4n$u%x{-BT1|OEEn<PvpHX!3yZjd9bWL8*eCfEU+
zQ==`~1(D=bO=Aka$nPLjV0if-NB%j}An@3dMc}8|;p!Vkx&LY~4>*Kckzmw~CB*Q4
zb{awUA!wC>w;Ef=IJkf?8+v>&-jhozzZ$J_siN+!(%?B~pA(*Ee#PFY^zCk*R;-Q>
ztqAUOHhkmX{M88?{lNKNzp;6Dm73Ma>>aRtY+Z5lZ!cUOv_4$6TR%%M?#=cH&6cn3
zP8VngULSd8@F>#kE!A>T0l(xK$Vr$Tm~5HaH<p@^d%t--*Ehuz=(@YRQ&N(Kleonl
zr{R$ekkHY203J!T_p$eb{oViQVs~{(GRsn~+U$8yXHob~U!TolVDlY3iE^5zLpzJn
zNDEMT|KxVwu>nDVqKl$4_(wr9i%E;=m72RmLla9fw^_g~Wrg8U6X<aa3=Gsu$`J`S
zU(B!N6Oy~lr1_`y=ut|_a!=HNZgj~5BX_j`qYXmyx;)6bi`kG)A!eY;cKiOPoB+%D
z6qWgx5o9SxScUixw&a~N9ya0Um}_J8g%(yXO9x*A1kS_~9W567Ft(Kk+YP5ffLkN=
zxk?Wk>IG=KdMbouWJ-s{$g++|zsyzI-<e2zdA$G+WWSestyeqGtsvPyogYCI&|b2#
zvbXjlr!Z{xeSbVXNLSh7URrin%jus%8Ht2?)|@8vJ`$95vUn27TvtQ$c9yis3Dn9g
z7u888d32(IXqanATQTwZ`Ehv$@zVVwY@a?JBUAlYwoU|<7N5||>%UH^bC568m1hI4
z9Uag8!I1PxKF0@n)&Ov_PJ$M+%lq#Qn5<@)>~ywpPQ3Yrc*B#5D4!vS?nnQt^F`=?
z`{9oWzv!&2Th4(u$WI+4J4I{K9MXEax<D`7+`8hT;nE<;=ISUiwa{#`&3mu<?5q&)
zJb~;HTF$nIitUR7gM*^AGKy=u2qSa}+vyTgt$2GjHqT+bTiBRnQXD_b{>Xoc#z5kY
zg1#dQ+9m8Jx7NRkT!x>!PEc|gc$2i-$gW*sYu}i$TDwCFT^{`YPc6OH+iCrYLml(>
zn^EZQ!JnnyAN?+%jpQx&FLH_Rg<ZJ!Q1JlC8RUd~wVnvNt|+QEh1v-iVP7VN3qbX)
z$EHe<ZKbD~&%~o*XO{&b&5?aVbVHujp%--l<0{2Q;4FcJ{H?;bvtMWxVMmrO5Wxk!
z6GkI1_}TyK*E0UwvlLPVm=0}fAcufY7?>4-h5_#&Pjn!=(}SJ?d?W&D7(~Rs?ejQ>
zjZQDmZBI~sOa1Z&MEBEwJ8te>2bD_>7fN?Be|O$rV$0OJh68GmjJyDvcLiunz`jj{
z^hEBm)MlZ)XfpOE3!BB#bgu9$C^|<^Pfzw4;6q$a$1R49iyeAUL6dAsrBk7dmj{4#
zIX){dE4#N+dax(oOP|i`_P84j5MSwP1^?|C9=EGIa8P;g;@6r?qLX~y5<j)Rh%fDk
zygc73{w)YvK|N`tn!pzcT$h^8u9ur3VKHF9ihb$(dPCn$5GeXOub`j+)T$Kd=E!y8
zxBf}Ve?NiYAJ}Ul0jdwP?UH#QxtA*Bxyr~OsXfnTlLBIjjjd54k&T^>4$mQ-`@(d!
z@&bG(;Se|V6!i_sroZV_l~d8|pUr;x^-tJLrtZ&=ko8Iy=4K1<_>B7-y%eZ``1=MN
z3%$~*)@ACvTwuB0lOHbCx*b3Aaysl`eZcyENPDZWtk*8wcbXuGfG8*(Qc8$OOE(Be
zH%OO&fOJWBx0E!}EsfG4CEe039WS}ZJHPd<xc0u*$@XL(Ou;w)&ok=2f8%-V`<s}n
zzml84lnoNG@7H{qc&o@@iCOuY<yvhwCoPTN_XH)0j{Sy}HH*ch%h8w0eHnVyT0(04
zZY$yd%7B0Xb{#XW(QhWJFAcXG_U==jja<l6&on)PM@5)IgdNPOd4YG-4>vnFp6D?s
zRKKJG{RC)&x0aS1uC`3z3lU<3TUVvrblKz5d0}y}BbXqJ6WoL{DR0_DlDTd2REM&;
zosVRdlo~(HUjX$YTRN4@!i10S&j!mT?iI)NX(<J?5TJ<ToA1PKsx%*}m2L5*4kKZC
z`4Y?j>K??x7iz;xAcae=`_!WH>guJ3A4vJ_?TRQaUIJyMP%SIa<z73U?|owL@2H68
zpMriS#>RwP*2e1#!lI#sQ?=%GDsGD_QVMVE!CLh#D&o4v?vfL&KZT3r$rFc<*IE}1
z?mOQddvHD0#tvkXKV8e!*WpK`^DC>UO1z_6z}4AQP*CvJzAF%cj>kBXs}mIQ2l5W>
zS{H-fjhF@bkvwIy*@AEEu3M)8Pn%>!mG2KhdQn<#|Hv<JWMrhyelxI7HE2Z&8};b#
zh&)&WY^1)tVR`eWxw8|?_AUngdmWw7fc5y&DjY-TH~o<2`{T!x#CM1Z8RTS*t67`{
z_h84yKq<4t#l<CzVjK0&mEKTZyxf^>e4$j3%N`QF4pl?zI<H}0_z2{}j=O(;wjY@t
zKn~>b8N0==aH^yftct%42`~vbZ{q-Egv)m8<H}ae<neJQdcZfbXCaV3?H#T&|IfGo
zYYB^%v@PhPP}3hfvd+DOgQ-e0wtd#g$;m|4f_$~CveW3sloa-eq@;b2P%)c$Q^anr
z8K0k>>Eh!o>@w@(ejp+ze7g$JAB{4VxnI8&lK8YS@*U2P3;7PsXf&#KtLPI0AJYe>
z#Ewr)HrmRA+j3s?6|L#RM}&0J%6Tf-UN>zulloJe!Wk}jd(SsUHpztpNt>}rVqen-
zJhYme{-vPQ`|H;s46OMl<q2PY^!JLAy!0)~S1OLsgzj5DLR7leofiCufh%}TUpEOZ
zP1XH6Z-0wF+8ixVuX9@Pwp#9)(l3f)Ow9`rkNEt9Z%^lghK7Q|r@e(X>zcrSu4U{y
zL*QhDhBBxP3z41~Jff9z=s2eLL3`XB5zwckv%dU=_tDM7A)~&)q2=xv^YO1dk<4ei
zjw&|-<7kKhk<wax`tl`diBQ18Ld6Ar&aIm_+cF0#Oqk!zUrflyF(eVNSPOwK@=m(;
zNI&oTRTff>d-<`i&o-7(+h_N#YI0jpoKm5hu&5|?+(D5>!`*od!wa*$NQs!|xHRwn
z@qt%zxaXLVlthPhIW*7#4@wU(Tim6M@<B9X|94urQMg|79GxT;<Y8NrS>-N7!8UPp
zvbt^EiePAXg0E6(SlF{_Nk?j1e*NR849ECP9T5@XyC<nw#rgR`3Z^P5r}Gr`99)+h
zZu|ea{`}Yc5?@--wI?KNZcK2oH#+R;PDH+${##XQMlsgj3s;%@;o9Cp6K<dnjN!$k
zBn!1#7+M;H0<N%O7TvN|wkr=(37~{*AFh`x=1q*2*?$<R)f}P<IX~HqN}HTy$+wuU
zHc*}_)$$TiQi>J4i}|pJh|qMd#(AtNyFop_s!*+}72(s2-Gnh!V}=(C!bwX}Q5280
zxD#d>_`0*=<7xOyPf@&8RMk+0t`(ouK(l4sInbqTv|-mVX6(d!!UhjuBWkC!t<F06
z`T47ExQS>nGO2G2b#))&;pG$-CeNz|>#z27oOcW`(#IJMDJOl3AmI@b5dzc>xnDUc
z1A~?nz57aCOlx~Pxn<OR?``zxrj?L2?Tr_GR4(suS!65nUnADVgbt(pPnvP}rBziq
zz(6k6v`v9^sZ2(S(0!Z!E#Zg=6(&k$8egH5@gxZs5^5?M$&V#?y4U^{w118*V6a{r
zQ=FQG&LVmGn}raRS7*C>8M<>G%32y4)A?hTjejSK^TnH@b92}JgumNkWMySwEBE&C
zBjK@j8Hy!x81%8+Jxn<1n>p9j)BCsozY~&>bj|f?X?(^R6D0n+>3XK473QOv5s{I<
zN6grOOf*+%<Ba&Ciu-_osmdzjE;y>9VxB#t3MJyrGB;!Mo3s=7TkpPuhy7HwRKRgQ
z2lYN0kM&k-=bW!gTe-G!lp8IzbaKtMqw?{<cxSHqSZJH|#naf3#46X|z^Z(c{DJ~<
z7q1^bNc*`?@L6)>mSgtdtqRR~CM3y7r*iBZ>>ssSQBa2xusAM^Lp0H-|0LX*5tY;5
zZRGKH*7>u0TPkyZmc82*CNU3gqmqQFsX}!63`3Y(1^=zH`{39UE^i-X8Z;X<?<R{%
zh>i9ATqW1GFNM#hpsb7>8vDD6gU8?cX!7Xit#eaTQ?%cSr4?pV-96`yDY0L(vP|@i
zPn%Z_OkPNqwzjmCFRiAkK$B;#?s|Zk(bAmWd`#phU$Kx*EaPibPG389YutC*vFw;B
zFtxx31gG$odHWVEP6yztwCaQHW)zf^z)xzdoqyMm!{)DNIKz96JcNSZgN@WQ41N!O
z6igC9KNg#V1)PU=+p{MZJ~9CdZ6CU0E_a#GlGPAsDpceRpp*t<$@Wy`=&4Jbdcod8
zR(?AYLBvuTJ?qCtL*sBVd&}+W2HXQ%(`khP;@BQny>BIBJL4Er6HLVG&&DjBKwpB(
zpzxA`=W1YHk3Gfe8EK{eBLfGaRxmfof~MS$QLCPi+4RYSK7d77y;<y}m2c0BQD^4m
zy@pS|!S%cdtTWGE<|`EWpTV%|9Fv$|2i$zi=H0Aj3xOj6`EDn(mWwOqa6~4f%Pq#T
z4OXV=k?c0tJBHTJ()DzK79|yU(Nu0Bm-!JKFJxh+BNYwHA56$t|Emj_r<JC7DE3w&
z@(#!Mo#~;0fp}I&0dUaRZ%rlw#V%K`ztQW7P%5jV3;21N8H>SVTFqLZUGyPAd{LC5
z+3|F34}?PR(qxMNLUHPZ*kFmpA;ELMTqy*5mGj9O)lyqZ1Ij>o(km;C4Bw-E&FZB2
zIxLXcP1$dmY)!uZ?akzWShX`v5qo})@{H=4bmE)7uF~V|!l|}m^CWI}Z2rlDIcnv+
zcWx(*w{Fq~miVIz4LgCD?3e0yxAL(57eZBbm8MBe4o`LNFF=DeNw&}-Ko^5xxQz@S
zhX4<k*zIf!k*D}vHIDXjezAjPlZ}#!($09U)>syYP#85&)_wJ_E3~4(<kL3qI(5Jx
zKrw+2sJOuLyB=)amNShMAl}Dz#r(A-CM4oU^Nx>NW-P|wn+w8v4IO$06nNgoC=G1)
zLxN;DI9zIlBWr3*ZV)B^3CH?G35G^6a=(22dTq8c>a@VL(dEgnzEoabph36;Jd0c3
z@8$M;%af(`ayi_U_#%kv>|~5DX`t<aXh^-Dvfp9i41IX(mg{!^oE=~4QI~x2x;*t)
zA@!+WRcbNuO(-0*vy20$ud)hXhU}eM;pAjzW}`)F&v*KLMsv<~s(eoTeW!l!NEkO)
zJuY+sY(9!SRvW>5*Vg{E;3~hoxU{MswJInqDk6UPaO3<~bErLpPEy?3UTc=|&6^!k
zJ^4!OtQqGAk6yFl%15L#5KYB|-#uWnaB6LBC8uH=7-Li|yZs>k{Dg$8^y%Zrh0p$M
z$qCTut2g9b<N>Kc*TOLHEmc{Zf3A=A-9D}@3<?TC5C2Awr8lpBjX1VOg|5|gUW(`J
zK3Nh2Igu+cIcA(jEbG+n>P-Q=uG$82Zp~h2OyW=i?uFq5n+19PpJYIE6QS{Za@Rvj
zP3=o)sPuVN;XsqnM^6SloH3E7Zeu%O3O?m>sQxFL*DW{?NP8+pF(WdGM7)liub(|K
z`+0awRJUh2L{;>-I}Rr`BuwT9eq|=!qDM-j7Jwz#pADZLh@w{ssH<~n;HNyr$M4qV
zRY1jvdBg)I<1WH2rrRbe1<23O^!L#3y(*R33d-~c{12H??)~=K_%(45FD5PiQ|Ge_
z#r~TFqmFe7>DzZDR@6$Z3r}CdsPY-zBb@EYs%iH>yJazEAC1Z8hrr?MdMVRXodc#r
zcc#|Q2RErbcY8{z7`B%$-<*8EPnJ$M|E75&I`PY!b^peo>C{h9`G<P@)^gUWT56pK
z&T(L8;w1uLWN}GFy^})UvdVleD?i`NP)!cVj!KPYCp<#5Ab{m(vs&3g=q`PhHNQwR
zt9IV;07E&e#W0_n>~gmng-RK%QF7wZ@%9MO^%(+Tgh(dTkNt-%Ry?BFVQurAwWYs^
zVjJfvHry23UV9F%CZvaZi=wK@Ao2yzU{0OER9~9cx!$de^mM}uCYi79HKX*26b5*B
zBqxUnY@ru`(+cqVHdAL8?K4W=O3y(jnq;=IWQ7{J+!NtI$ZMw$7b5iP0L74!k}_In
zG|NzRfdE|3M;MmBC4Ig)@M=)`NA*2U@SdJ75K*xmA&cpZ`V{1+(MOH3IW|*ibp6M}
z6$1lfpr)fjs-{d}_A#vns@`v~I)0d%lxloK#)K^?;=OpVuV`%i<mNqZLZg1owdrrJ
z04tLOuWq)`r;18JftHscU;Jqx*Hg-_pu`0S+8x(h4frGZ_q2N^z8z=NPi?Yuz-YAI
z^<=hr`t6l!z8o(2^gdbH34E|w4|Fa~r&^%20ZJYmyy23<<Jtb}5wkfvb2UmzY6?E)
z*DrsRLrl0Za+4F=W3e;$CtV#67;<&CXOydc`9PV_7TiPZkHUy}eR8Ya=TbNr)83lo
zyW|-SNSVCrrzGERiO8VNQz}&G&+3a@&c`@B`od=ZK}QG5;p}hUXfO7$a^?jEA|<##
zz5Y*A<<+a#tsh_YW!%poo|yliO_94CsiZ~^afwUc56XRN4)5R-$S&&1A;1K8aS*Rn
zZGmk95Gt1IX?{7cOy8N{9u+FW*tDE0RhO3>n*LSc|2kQ&`W^o#!W`*TA3a%h$$Zi8
zeV&<##*Tk4+U`ZUryiX@qDFCk=9qnT<rn!?p(0mYCWoOp?(3d#dCi!rW*lcHBU!7!
zKZ{#Sq;8g?*(#;!Ap|4WW?j}o+PR}SV>up3TcBPngmto}p=?DM7<aV^hgNP!1Pi3(
z8HQ}!q(y681?P9Y^UlwFWlOA(`&)C)=b_x7{p0V{Om`@~&+i<I2F}(DXS^lT6-EtD
z4TG$}WvfgwAxo7xgE@~D-J3&Y(ZasL%Z%u&S%T(VT5kjohjue5(s#sYsYC|dl#p_y
zjRQp^M;`{ByWv2QQ*{4P_+e1>t%QW!wTqddEaX0Frg`zK5yiCU`+|82zG&J%TMne>
zVZvY6P&ilJHa-0-D^zdA)L3W5mJA~+mbd95<Y}gM>bve;O7b&dV5#U=6Yk}M9|rmv
z2JFU7NTdm*wZ5#7)vhSZ_nh=%oCg*<gZ3zY4w*bXBIcn9`ts<}BXq8B?l7iCGC%c5
zExM*vqlM%XZazm8+vkhjn=AMn`aqWefU&!~sLx)TO&TV9cfI-|r`&T|9#%HTLDuH0
zBHYP^u*~RsZ2GUlh4+qE(ly%VtE?O;ViJ7ZqQb0i85#cuJZxGT03?w?Iwg#ThZK3j
zi@^WCx30tnJLk64_h^nsAz%*Lr_o_WGy`E4=TStu1s*bnYD4GoQAk<YD^HKZ!%zGk
z?`?i(F1ZT>M9QB=66}FugESyV1w5Em5`_gGqcQ-3(iwGOa`U;>;a|kp8R+Hz@6cfb
zFsWQzU7r71URhazK^hpb7t(#)4IQ4pd}$1g7bt07v9coH&l(9dl>BKZgxHIuz8Eo_
zIGw>iPRql<!_BQJE^ach|F|vaF^FnCazOBDzcVpaXomMMPUo5(`Jbl=U%ogwP5<x)
zg697aDrAab^Pdq2p_;Vj-UYjyT$+pHgdp^6&xCi4j{N;!3A~i&lMs}@g;`ly+2$8N
zTdJoForRZ!U@C;6I#6D;zPn|>$R05P7ioKF;=8F*Y4q=->fg<gSlqQ$T`G9JnCa;m
zH*ei!VzTYdoTm_pdu}jTY-uSaC57MwkBg+Fq<W1@f;-<2?|>*<TU&_3R7iJzfAd>p
zV~)n$AS*4+!ub8W*>;hu9A(G>xVd+NiCLP{qkS?m1T#c1LW#JLZpA^FR^(5d9R6OV
zyxN}0(Z0GsFzo@v!-km|DMNB2M}7#}jG*Tb6o-<1Z)e^MMFMV8<j?YY#O1@+odqoe
zz;mpDz+pcvG$G+z!ngJ2CR`sM9~gvQu(~XPvjPoDkV70MWJ6Lylha;8N*n~7EYCNt
z?Um(~l(d@Mq{PH>^@#9LsN-_i)@B==kWk7)9NPa~H%Lkz=>#XmuaO!KR&Ji5)w<;e
zjiku0nY0b}Sm5O_qLV}mOQE3!`XnSZA$Irlp!!(Z|MBDN*RSvAQG$YkoR7{zb}K;-
zp)J<5mqY;Mg=f$Q6*}xK3;xI_DIbLm@~A;xPlz=TfUbDV{<il{Wnb}}|28<e-_PT4
zcsdxB6Yn1qQs;ok+ts^$_YMh%oxrIY39ks!cpVq>eR~{-fZzo(kHn@WoYmZpqMx!m
z-kNQz(7*T0#_)=%$uvd+_!yljw&p6@N&X>04Pca)Boak_(#XOIBwuoJ@&s(A@1Hl!
z<);)eT#@s-gkxIwY1b#oD2`-nOl0+p0nF`fB2%4Y&M~km>g!X1D2xlB*Mfms0~<=p
zEZ}s`9@j_lx?ee;kVMm(Ll^B5aI1bkqT?eK=7aV3a35n~Rh#u+4V09CSI6$}xU{x5
zV-FSg!9I`cii?U$b&TS-<83vw-29B)`3&lg(A2=d&?-8E(7VRQVnyB@Zu^Jym@<F~
za<WY}DEIRd-QsmP4cXxWxm)PA`sSKg)$)~>Urt|ASV(~R=&<6y+Az6yAX^hq6wdNB
zXR$iFbZ%N&(vKn+UV70gDB$VgarL>8yRxzZ@Gs^%7P#2hHF{$_-VBQ(n4<5jj;Do(
zTkBDUyQiX)p|%h+9$zWs3Ma*9ap??ECnh6H%l(YnQ4_kjl`zyDT~+V2EfTxUk6Pi{
zk<wm-K_&Gh18h^StHf4a$W&msbbDBQF*-&O%RX(O<)F_CCCm@w>A-gx%#(gNRFdjV
zCT2hnlP!1HO9$(_0NH3G1R!8rw1*KOHjW6i@<ou<bYLKV-yCV=M7_Durc&?0au0cj
zkB}5pY!clPV#72qUQkTHwNL};erMEc3kB_q-w)y+(Q1s=23J+Z+9v!SH7Ec!7CP>0
z2BiWT0X!rGFN`GP_s~#;gUMilRc!C>v72n83&%50P^V$Xf*L@yh!&(TdLoy;zwXCs
z0Dy=0`k!HtIGI4L1>j2pf~Ptj>z+#;oLCxJ*_rGd<7TF&P`_ROZO|6bC6APjc^=#G
z%C@3Xy~@~^PpsfA@?B)UN20CL=0Nd!{5%F)obPzpjv_E?;2rCke2Dt|lAKAF4zHN}
z)?)($Ma9QfYKp>&7nMJxiKd9)yhAwye3?WRD`7jDgGetyfsl~<yuG=3d4+{U#JHhi
z>%VHyfx!mBPgqzOl5Et-B$?{L)i0nt=IJFSgbw5@gEP849YCoFIovkwjt%&Oa*zDq
zqacRO)QM=iL<u7m|6MKXr7_B=RS<9CaT6wBXpTB+WyofTkf<mLucP64A2+DwJ2g-u
zWb}nH*+Y_K-o7npY@9v7<N05pk3Sm#`fyOvmf2bC2-EGwOr^emc!Xp!RfJu<Iy(9U
z)mvUT5;2K~bg{$Xg<CIG!>WlG3yb~JM|U_?gn59=1mIp<YrCnLiK?1f!CXmJXp~n<
z%3nxfv>Tm($gLXs0vmXvY!(x<WsdTh+R$cr+@u_pphz2}XvS8{&P7&L^Qo;tMK%gV
z2o&;}*+oixqA2Kl)vltds@C7gCO;y&E6YYljVrhM#y}kp_|rYNt8_>XOG<VDk97QZ
zq7n#WESs#Owsrz$P+>n)$J>|ncYG&LO3v|rDpSFSJ_+u@!a_;qA_abRb#>A$nkdfy
z_5$v5q{9{J<rhkB^h)>ec4_8+`c4UErY0uf#^y9TzR=>XRa1@4)9!ctnQqYi+j9MI
zZ4?po0@%={4Ca*|_g-awhO3Ip{zIHWCD>qDEflVcDSHN=X=={!G}NXI)V^H@h8bW;
z<uwHxkTi)uSdTclI6y4wwqKE8ia6lnoTSL)*8vbexAUioQX9sq7cBIJ20?%r%%hZi
zBs%=s@~19{z|~mHZ9jdAzAesfzjGz1Zwu|)E<tav!5jaP*Y*^lQbOo8NW)oMz9b~k
zDpY4RO1kwgpkH?n6ScIg0?REE4iQrXc_3(sTrsKHuxg)yZ^IB*h!!<<N%Cce!<1K(
zvZTmbWZJv%Sy6sXDJdQ{pV*wtOaRC;3Od8>i+!2@pT6epJuM&A&`<D?T$VNdJ@}si
z$6omy|7ml;8)0_OLk9DjBuYW=TOfB%@OpZiJ^`H)LteQbtKqAfFRJJVaJN~*WRb!i
z3FE)a|I>m_qH}Z4nuR?5S95cVV+>FNFE{_R1Zh(~Mutn|pa1^|ei|UkM&kkOt(X_$
zAl`mofB#O{gbhfUyi+#;L-3uOn>mhAwe}4S4Ju9|t7QY=1;g<G-bVTCS!Z1R?w;et
z={>u?sqZ^W-}fNSgQ^E<(+cZArdF0pMQSsRdU5<-ei%<)w^kVzy4||l*4nyca*v6r
z6oC1XQc{oIiU7fz%HtSY<I+FtIzNvczk70m8Rm~=y^RRMgQ5LQgHf@IPB~B%D>gr0
z4yDQCO?^2|{Qlu_PifsgK0lmFS0ZFC;yC)dunk6z{V6<->&*!NU4L+LFPj_#KA>2$
z;T2qx&5VZonfIg;U-!9Q3i^eqsKi6JR-v&3&d%eWINj^%YCAC5P#&x>Ry&`hz-;w@
zBqmNEF$cY;+u5PK(^6|dl=-AxE{y7|562-@js6vX)Dc@a)oK(`%O87dA`Fj*r*N_Y
z2VK@2$ml@rl(h!`QuOI*{fDW>jMFW|0iIfQCGeU%4i!(#THFZ8nvMb8J88e=0$v*G
zRi{&MGm)2OcWh6As3J~rllSB9(I#8#`grwtT2n}_T%kw~!_435nnWENDyfvftbidH
zO$ssRDHTsNh!%s3$!ON@LmxOjVi~l&>9DG3Z0^84g<n+#>KGyCrJlvb#hkavfB!6b
z@_O?@#*6&E?2)PP+9p|Uwe6-|Ti`O2>(r1<Up)d0IJ~a=)o{a7h=lT|X%?!9+55*>
zI?sx~m7p^>h)Iej1nx8L6|1hojhUO&GK9&m92b&m4k8ZuEMQt_4?-D-<K{NW_}%^e
z_QQ}wHYCx$n46Y%9Yj!LMVfO>_9thR`7j2AP=gx{>Lwpw-|jpePBJFhq}h4{^&ms3
zVy(u3))CvzfjI%emL)v@kCfm^#bL8_{1wk(2E=l_{?tO%a*<-5%U9YO_LuEapc7v*
z|MJ?3`_r0O>^W@uz_=kd-|VxDZof6Xyt?Clwe^j{@7Ngt=shihkc6BSAtyh}6M*LQ
z4SV8KkG4;(qoXrZYbQ*${}PCz0AfrpvhZNa5GA96fs~c?r~7F4!3V?rJc+}mO88)9
zzlT3~e%;Zixw_P;wl=;L%>Fj3{V!g;n3|YyoQ<6(`}4QK8RUXiO?E^>DbN}yGEYsT
z?CPTR4-J1OaKU`>U58pGxvyp!V`B`YzeQD5cB_3vkkT_Rspw0mycwyH&-udgp_Kj>
z%AxkfSo1Fg?rqE7FRVX>U~&WP0)`+@xD23^?7h47<EP-|8K#1)tZmWaGhT{U9H?2I
zUV``U-v=|X@_*(TXGIR^CNR}_AzNP^6l4Q@%{Iw6B|2?gUAfynK;IL2R$_VWR{9|F
ziNASwY^B9?>k){OfO0DIPr1>FG-A2l1@Vf5qsC28c~9s4`*(}&ktTkV#}Lxh;wnW5
zJxlbvE7l>G7m~;kK<qzN^V|hQrDzf>GmGm%JKJh(VnRZ9wp6b~qvHWpk7==1L!MT{
zmo1$viO0+ed>6iaYakF^z{f5mD_vZBryhQr0~^&6asdU!1D$qW!`^|hvA9$KM{7ky
zkW5zXd@U>-s#hK2zlE~Y(}4*U<5|jSjet<J5!8Qc$$HIG=LqefSW+S~F&z9XN%f<R
z2@1hwu)t=6|GQMzk(s$1X-wx;tao676%pXPgCo%uH&*psy}_^$47X8UUf)c*Akc!R
z-*j9_Syr~IWEaZoRyC+1;zb@Q6vXQz@}57J9h5EOv?{%Bva;dh`}%<sCXZk`36F`S
zlxzgkq4VjUUNq!*7n3r{JYMd|x{T+rdfRbrK!>T5R<T>Rb$4!K#1^{@w8l`{J$v>Q
zRBo?zem}CcJ-WI)LsmU=n8=Fw%*hJ{!{PJ~89CNlF0L^Mkl&vOPuICOiT2OJ#2*PA
z$4SL%vY5FGj(O%^TCfC!oJx4KXe#{6mq3+eup@=v;&+6(=g7z~)Akz8J%TOM5sfMr
z;T5xy+v{<jxb#|)Nl6chh(fA6y9RIg;Nq@`p*cFu{yc<R2!xa|BS_&^xsg_UwF{zq
zu|sBQh-H6c)D~XI7=(e_>se+{Pa9NgY!A#+3}s8V;|92!jTO{?+>>Ll%xZ9H>$crw
zBQ45*m*&#-kn+`S2jn{oO&}ysFE)DregI6!2zQ2(@A*)k+!DHD4i;o7DM3?%vx+XT
zL*V5DB@=#yq9pEhjN?7{y<lS70?LiNT;%5Px1sUM2$j(A6?mY5yWdffk<oHY#6?tw
zW(|b@%;IA0slj_U9vhNy>Z78eKYs4Lmam-ZrlzKb>ReFR)42g41G|lixw%GX5XW*D
z^^rV%CHbnerQZFdQF83>y?_8t&PfPKSW&{{yu7^6bd>1S$zL$BF$?PZ97=<~(}&Sy
zxMV(;N$>lIne6oRK=vFxKf8ag*R1~o$erku%7f>$r7#^7*M%Jcswg4E{X@V$;(nNI
z{pu04+Y3<a?oH?B|0wzBT?#ufNx;g!|5_5t+PuI(7t#m<u#OP&SPw4;tzyq-W@UZL
z&+p+)1k1u!INTm9Poe$&dxV~JNdROM9ye?95|qWx-#feiBteG*qI@10_7XWNrKO?4
zHMA}}b~^SPUedp0?G1{4rOYyb=f6fR5#ayU0rC7|KO`3=>}|&byesp4{Q1wID%-`-
zr=@U2WR?}A_MoD;z4N}MDx!`267MucMcol%mzY$e%J4IuQZfMV(!qTFP*tJfD?1f6
zo*1?R+<Va&z!-J3F+!5;55XMs3XRv5hlR4{{SE_s5JPB3n-LF52&|4h`BeG8P}WUl
zKzzT9W9sapIUEnT`JfW?XDn;%<35C3w8)Hn8Q&`@ctNXPj?n;ISH=7-zsdh1B>(kE
zjX5lO1V>VkBe=m3<(HSnZ|&d>F<mIy>_4Qi|AVx(0};SLU*Gr%J}$Cf^566enP_$Y
znyjse8?%95x~APWbuOInO6lgm|D!;z4b9SJu2#G5rweolE?@k)g-(L(Q7aWG$dbBI
zLkh%9M6?Y>;tsEa!`eV;$?iwwZy7TLWGLYSp88#EDlBNJL6cvwdGIH(J3K4cms9_X
zhYUd(`R9KFX4ThCGS2^o<}U#Ym;F`xZkXD4x5dC1Gw5B|I6UX(Zm_)m2|^!aV)gHj
zx^ctIwLx0b$-&wEj1ogiD&%(-%<zq8D@^prcA&9^gm6=kd%F*ZCOd<t3#9Ft+1ar(
z^4;CffnNY^WmIc;gsdArq{%dSK+OB$eI9cFM@Dx(CVxyMn2;i0&%#0p2->?}uMqpo
zK_MZwAM^a0xxN>_c)^TM4RI-bS~vWl@C&OI{eKih%0;zs1>(56!~Nv_#&o1iSZ~Z1
za^hx2Mj%HCqSygBiUkuzMoi5A$vkT0kM@RAvyA(XosPDy<`?~7tAxc&)gt5;?(|8F
z$VUL%_3?vn_ZOKKXD6En9R+iBw%eY5c#N93Js|ZRbN>;}$$)`!AKz}inKJqr6&3hm
z8>H%_A$YWM=6?1=4L>GfAI?%Q26uxI8{=;(&Dvwrxim9tYc%2_)jDG4zf<m5Ly#cH
z$M*aENNG5i^>@dk*BZ^W3Yv92O9f<&i|JxEy~D=vI`cxygw4w0Jd~&U2aT@h56n6=
zqH^A1-oM{n-<4c<xHa%i9ayU4C9wX5;@k4l^jG+@?ElX8m{Q+ch;a}b{4>XF)NkZa
zWxX5-ZOZsJRu^9sd-ito&X2&*dEXXBxhs9@;|0P51*qa=h`UH)J$4re4rh!_OuDmS
zWXY-XyMnE;@j>PGZ2cY)uT}RE0o%y%FfjO`k+$f#`e5S}fpDCyNsNzINEh1c>=cU@
z6%sLID-H}qiv<Ay?CdFiX3L-{><TUgrtRhB5EDqI5ba>fz2O5kF^-SB;ee76@a&Rz
z!?U494cvuiBU*(SL}HkW3%Ujep-<UpNlAC1n1+PrDVt8@6QwTaBm7zaA)A$}fLz))
zbkmcyzcNI_?qVXgeZpi`l5JMDI3PWRfDAlw%b9)H#v{=g7$B|#k18xr7$^zmZDO~d
z^@R0E>hXzWw#OGWGS@e}TAELBLf|k9Mc=v0F}DGI$++Tb%ZXYdcL!rjWt{7xxsrPU
zp(8Ki`jeQ<kMaz}0O(SMvkW@6wkD8-M_f7MU61B(Ch2%g^r{!CJ-*n4B2o2$5LbJ9
zJ6Q1er5M*wJo6+|d-;SFms?9)s6&ZN$BHn>{ajHV+^ZSLv}(~4#RPpDpNz~7u%7$t
z>&x;3RF?mwQGh}VieJ?R>viuvJ=;%c)pgqa?|SFvNP0?3Y0ch$-TCuAEO-6)@{5Ex
zUya_-<T?PIqd%f~uU01HYqY}~E@TY*1qhg(T77NvSNc*C7&8B}^dn)Hi(}4oWW%;>
zok5ec%4~{?gX8JM<2M==4gp)=jI?G^#gYikR(o<b$nJ93XYxxoG~MCg_@&<9#8S{R
zb?%rZaA&VXW{0>lo%GwnHvKnkC<lI-+gN`Z7@_|h0HgYozcbgoSzm4c+Y8uOenE!!
zh0QF`JtX)(c1be3<Jn057=U^E%T^9nBTu_)-@?;z>uq(VaqRL*L|;mjM!r(fhY6rr
zgI5Rb_lwabv)QKW61NsAsP+~@X6|Ba`BljH`V5y;x?W$s^OM#Dr=mikX$-XELPCQ7
zg~_MC1?yM-d=mz({G{pr@LWrCvw3%n@Xi}r4po;tu?X@7Z*U@b-U)%VbrBi4vMtAx
zl?0JyBX4#du`uzEX}g(l{0jO4>V2)*S+SD%_(xXe!|!J=d>~xz@4M*$E;as{&6GZy
zI1V*1a`k1hvRoy+GL0nsa`Ugvi<Xw2kr9ZCM~<$5Zmx4Mp?r0B2UdgaQpY+tOoN>k
z`1;`^0GB8Ma5&iBMLQ<Pmwur?Wp>K+@tFW+)8Cmo_s!UjY$<hC3k^Nhyl7;+`8Uip
zDnj$nJYRWpw6X`%(E`=FG%Za$dPwnyA{#B|FbD@^w6!s9TZ_Mu`gyq%4Ce=t8g=w>
zM?^&QzM8S*Ty=y#F33$>9~;1I{JEK#SsbnA*##o#=g*&FBnA^zV6>vfl=xW>x}8=*
zbQ_zl=b7Iv-DrC^AU8lXx+dx{fC5_WyS1R4@WtP7A0J1%DXrSz$5*ab3&Jig^}fFC
zpzS=_nt`X2u}KqxTB8Hmgm(&eZ6G266hvsh)v+rqPrgln$78z0qB6VzWRd_HoIJJz
zc}xiGtKl?n&yrLIiXrpAy@~W+@I8_gs#lIzIBtU52R4M6Z%yV32N?ndgoN{hK2(+|
zJg#>8!wI#v$=6A21T4u(gjlu!M&t{35$>QoNVksv?sSv~L@Xy@&7!YYYANO^O*Xp5
z?IJcg6A*}V+wIx>TygAHdIy#7Mf$d|SnKp;d@l-~H65L_gr>$O$P?9xzXSge^6#+d
zh{{S^J9TpaRR6P6wVF&O=%<{gu-Dqf47fD#WJVU-D1B)MYi!#9nOEz>7d>)|)Y9Dc
zSDtiWQGe#>d&T;2ol!_4OET`*c_&OD(b@nh>LO2n3t7g_EyrN+)9dPP*J42R0F~q4
zp*o|FV!Ns6xL{$b($ZY*!s!TNfp(SYXh8(*xI0bLP?|X;ToDeZkX9&^Q$5?s8P7Hy
zDey{quswxKXY8`RuSicHLOfH)YC?yw{Q~$MxVnTbZtIA^tc7{5^nG(R<V5vON0Z&Z
zt!JlI#Tf2QsPC>40w-m*-xZbu#YRWJv}zvT7`Zy${#w4u@MjLRrezO5GzJECH#lQr
zVc)CqdNct1fr0|M(%3y5DwI1YVT5~$h32;Zc3Nq0{+E_dJnFG_M@F7k??_a$y{B7!
zN{SXtgM8}GV;#o|Gy#p~3l+-Y&KMUJ)m^413up*5nzz#8BV$9o*2i#%kB_Ug>IwWM
zEeZ+_ehsy|TM6tg7$1*MEg?V4dSmrLW3i}iw-R#Rv)B{lCD7*kUtmDbh+Bc@ou(^)
zM6Ba7Y!g{6dnW>Nz7y;R&`rKd`XMMUf6M(Q5C%S9gZo-%UI%nhMvl&y@Jr6_K<lhc
z0al}BTICtoJSD(hZU+>g>2Tf*a13QLIzT_!o6N=w+mSlCU{&NI)mwoxh0Z!0YH1)l
zmLd->tXUCdQjEII(EzqwI;=rue*IUbhvQDRnid*$)?){wz|cTu6R@j`Z0DxeO{8T0
z>b`;&H#CZ-5kbggZu!o?>D|_3L&x~|+R3^+#{K)z(b4#?b9wc5e<&Ag1@-eduZ$F5
z^G$uRGoQ2_|KEJFU^dGKpDe367a_NuM);NV@DlCNOOG!vlq4)-h#x;@v77du47G)3
z62N<%9~|^u+srq*q5#NV8ODfaW5vk05zU26cFT4_?+NDY&N)Peds8DUgrOC)MEhN5
z=}ttHd}KBTlVbhu;dSI1KSW0u$<A~QU=vRI9c@4w;Q=ApL49h&_585CoZ0BD<;ZUg
z9GEm79Gt+mqlwQqF0a%omO2OZCVHp7$)n({a)KUCqu!X`XMY)aM7oJ)9X|WhpzmDH
za&eCK?bAYP0U>Xt4?zJfIbfZf)Z3hZWg7&mKjckKH=?LQMOSi+2h*XeRS#{bt}bkT
z^#93F3&~kc*5vxG8eR578-|rHErV8i%M!;1I<c04&WL<^x>=CTK-H3$Z0;awij_gs
zyQo5KFT}neXv16%YGMB&*dypK_fod{BiRMaM-p{r<9HbN{$*$p4uVsG$(dmlTF2=c
z$XRo=517+|pUJ?<sb<G@6q3jaL`RwASKssl9-iOC%*@FNViM=$`$wX&`p4m?t|nyN
z+2n^wj5WknL*6G2UqMa#zr{tGQ9ro!zqN=4yPfXJIyjsb%{ap+*E(GBETt@85!SdE
z{A?D63m;Nfn70)`XXZiBbGb~^s|JU?hmp)c7c$JwM!!~j1SIf>5BH~bBMz=L;#=ye
zgaZMH?|gO$`!*tx&utA-y-I@)NNc5HHSEVkBhWIfo0N9Hs`=Qui|lLtloxBJQ?Gr(
zFDb?47Z8<wxIU8)3_K3HJXnMU8x|8!Rz0D23j1h)*+BK|*>GuS5U9HqK7HEJ;<k<-
ztCY<E4kp;W*EbaHk++4lC@mEg==85{kSWFDHjnM+ZoIcS%H$Jj3Z@PXF`K?TW4J<3
zRi4{V!6G6eA}03uAyUsSr3JYoXt-AP>9Vr2=CyBgEVPVQvs3bmgKCcLfZQrGuRA{|
z05s1(Pz+?FJUw;ibF#@LB_!J2C)L!-A_q!#4=WBK6(}np0URIULqo%}<zlp@dhkr7
zQ^YLG-$8qXWi5p}>tFGj#YY238gLw_FaBIO;ZRAsF~QxT89wU|7$F=CTiba*t0uR6
ziL5|1wHo{r4D=v&hf@_5hude0u#MNEmmsdPN&o=^9j0f~C5@7?He}5luE!TY+!`9I
zFOuT^l_VTuLY;GjWqE&NZVD*$oSbLl0XBYNNn7KMF}p1Q>r~CIFtG4UiXX3*Qnw$i
z%9kw{VS&{5`_2XHhe=ikz8wLdNA%dpM@A_6saMhtpQva@nq5fY)QRrdf`L7mCZK5K
zgcU0-i;G~JCyZYmcUF}%KSs0{9lZ^FBrPGKR%M;6XI=-l{rbjwmF1@0*_MxTv5S->
zu4ph+b-t9jdAX;Jt|#p$4K=C(P?lnk7ictqFU@Yo*W8XJf6S_^zlIz3)uQ7QjO3|m
zx~P;1l~xtb@Q4T-pjsDc)vY_OYJv163yl?H<NA8`o$-&#O=91>XP^-Jl9-qd9-1Ba
z$3;3?)49#nSm0DDvi`d)d5z>}UA`*`H20x{5-;X2Q|-E{<#h%i#|qGg2rhZC>m2%%
z#XO&c7C9Rk6BCFE=;+9)SnY=W`Kg4_3bpD=v&~0JGkihz3o~UQjppV2G03I}SaeHZ
ze@Ple$Gh<yWj5&F5o=CCTlpX;<R0pM2Ce#B7jZ`dGYIDUlprpvu{m-3-baKL(BO2r
za@ISg>-hftM>*Z!YuH{}rW1dsZAe*Jc|d!)A7fUi#!A5A0(l;q0L8!Ya1F1Wbaj*L
zABU^vj&np0OwW>eoJ*Z5C3GFz&{$UtDM8W={ple&c_OnhfsG8c5eX-!J2x+G$?}Vf
zcQq=(GiD1(!{HGIouum5SDsjzuC0_Xg;&h}L~Bmpn;k;%#(fX%ryK;<=;)aJ<^Hf|
zVJ-ye85tyRT$0jsup_X6OS5o@Kv%Z=I~&G(V)lJ$^Nr)#bXKTWX=z$xqt>NUpG>M#
zz%qa?SwH;o{F7&$wGY5`r;{t!Mi+$d{S7ansH!SMlYF@w9{kAI1iFaexO`WflTG5g
zXJ`I8_@nmx3Z%HErY^OYe8wtBvtU7)hliV(vC3e&Fcf-N6{wMQ^xtyDss9<2Tv$zI
zVS9D)Iu3Ge-85)W-CvHS*jauthm+GsS`gV3PzXZ<RJT?W=JJRB`dW=nizHYyycred
zsgVNk#Q1l#n%veb6Mp)11B3$PN1yh}xCFq#rcZ~fj+Br<AEX&FNNz}ic)0792G&I*
zpMfZZSMbr}#~H=NFO~#`SFtGJLnq^D{M@%XHJoi!5YU-dP^svfy8e<@?sRZ5C-i}x
z=TeoW;ps_l;`dq+cl4<Hhqj=s;bo&!8!c&KVdtD|ZiYRzV^ADG!uCQp$1f~JUz!m4
zuVY`zJz2Wo^FhP!Xm4}oJ%Ms$e}?NCG$ZN4K`Vys9iS{4AA9}!^~WZ=a$}|_7sNBh
zC`dtnGm7=-=LUa}@r?w@G1<w2+qRPVIljMpeQJ}->Du~NkA~&V=(3lv7B{0pk=DQ<
z%Z$xpK23#~h{)z-wgrBM{9y4MHU*Zq!}5)T{BP^VX5e?5Z8$+ax|4qWPZBz)@Bd2~
zf>-(9S#F*R|3xf2497jda8dWkwC?&xgqNQT={u9LY@e!Fa91qg85O8BUQ{KYgLe#T
z{L}Wd5?z66#$;LxwWp_`#s>S+8?MojI-@aA{A$!%OTlbjOvZ91ucmZxE<HnyB_GAl
zyHC4BAzb6PQdv<@hKg2weAgy2v)5|X=>76~c!d6ITH0T$^S@g)LBlM=-LbSp5Amt6
zXgP)0L2S>$Og~X(z^q4cwMGxGd*kJ!P!A3lhe~U+K6aF7UD!C^wm^cVYhXg=LLZj*
zfK^!rZSL{S#9xTmEuef!OG*xP4f2qY@n7yVF??Z&nYSOZ0XkS*QW8Yq#Ca#ygxBAG
z@n)xdz6<V0UOarH%w@Xx%Nm!{!gzJNrv1Fx|CrMvji5ywoa4yk=$csj1mS~BHUp2%
z0=LSq?$?BUTr%+gczfM^V*in$v6<P%=B5E2bfLINXpBNXKFe2<?|F%b--7CQ#r5)u
zZ)Ow3+rwhH?BJO1C+Hp^nqcglm>}~j@%DG~gl3;s7KlQwIZt;Nl*NVbTf1@KCp=_F
z-tR)u&i@}x$p3e{@Bj9f+*__vBVuEZ4<`;lOgGOJ06M0{bLmr^*~WvQfPfy0EQgIF
zGi})8h92Z_(fWdxmP5wIpypo9>hkshkv5|v%(4Krj=k2j;S<&mxv_WZGTh)m7D4A7
z11JlwymaP&djX{h2|YWrbxpd<rWZ(R`awCbW4}u>Xa#Im`z$9bC~0WKPNjEmc-#>Y
z7QQ!kS8B4#)o)iG64wjp8F&f+wP+FYoh8XKuFt{=n8U!F3q)a^on;>D7`!^|!U5mv
z%ex%fmZM2`n)=UdRz7sitrXTlKhlPmvDphfuBg3@5_Jx)=h@3MdMi%$XIt>Dn=x&U
zFS34o{c+!?EavX*yBc-#WJ?bOeC|aV5p%hzHDXbo;@HC`7nB8@XU;3xeyg*WqOX1t
z<Ku%UBRhOxV7NkojInImdwQx$PsUX3%kC{9;Wk1}7rC$QnBb<8P@htX%OA*-s)Jkz
zmc*ma{W&)8hkeZVc=;etg^X7a=8@>%cg7L0yl{SXves2J_JyL{LpXte3ULAI?21uS
zPm0N0DYF(GVl3C}B!z}nzRIQHZc+JF{NnO5ee4MU<(JEvc=0Zd+I*;~bA}7Yc6SH$
zZg_Y&64`a#(5kLExDF1!AazOnzB5aIVOF{;|6#Izd2Yn2e}4<h$J_VqwQIJExE)Ff
z&4EW=dU|9yR@0}6eLAlsZfIw+|FJQ?kL?Nx@tpqJR~~t)(5KwixhWPNt|*~PZX!VM
z*YP?BWe0q+3_N|8lT!0|?+sM*)Z>n83WAry(ma0Jq{i+0j6c>BdGNE3kmu7sPCR~L
z`cvyC2beF}UZ{>u$O>v|lAiemlW?s}MER8)^?tH%V$~gfGEeYnYrw7LjHMYfJT^8I
zdkt#9d1Xa_xIm?-rXJU|KVdnCth{AXdGggNyK4^cmU_;Q*S9aX_Oda|U~#AO;RX>N
zURd*ynerkFY+$bvJ+X*?!fo1$7q??IC8#Or+EzvhwF0ATdNtoQF-H<nY?cIfy}M{<
z<u8=y4@#gOH&VVXzH@+bxRcn^4%HhpN{POH*DN=*<-L|s^~B?0R4$r*={%bbX&r?b
zoTMuKi7#twGL9)jMhp%Pvy$Rc$xR<sV~=FZoOj6PzV9$$6B3qv+(QfAdw&+&k^DmW
z+Fe*wNNA}RV+yX+ReF`PvyfsHhn4BJgmOGO?Hc0s&@EhssOV^K9~haj7+vYUovu0O
zqtmW)lXP(KW)BhS?&()1_4W~cFWae2#A8jqy~7a#ID_=wGL|B>I_!H1u%IbO)9*gG
zrWdv})a3;!XlR1=EFp*Xn`9~BBYOdx%-*=||2n{9EFDpC06eLOV8>N_o$*AVEhdR8
zzR+};Ih!0GIxaoz@RRVJV73%+ae1T0vlzyU$Dp?NXI`%qAJ=(zcaL}FqSAQ%`Gl?k
z=vM8P#%YIDEA$^<2?wkupVu7|MsG8{=ILoOG=B0*(m}H%{KW05%ty~Q-e5Gz$M~PS
z0e8-Ppzjd_L9(|H0i(gPW?*xZ_RDAGnF9&3E#F@2^t9r`3~o-M$~<_5detieL!vY|
z0<P?XVhbZ4d|^7kL{OsKz6}_)3K4qe4o+L;0*w&n6X>Z!UEV$L`2kT~XBk$4?bdK*
zjrxnXhwE%#t%g=w+|J$OAX6+5E#_g_CUi?>k~|)bcFYnue#5=<X=l(33Mv+}5sS6S
zrQgdvx(HZ^uyS4VF3IiUR2(!E`sME}-}5Sz7qYmt(o9H{N6n=0GkydMxvj>A4yOIa
z^aw90>FRP4mwlRAWgf^zcx;X}R*b;^J6mTDW(6LAxh<rDn)&XZm}j@G$o(kwG)SCn
zo4vanNLp@RwZ6GKTNFp9`FBa9*a@Q!;8tX-bcxU+ZjsNHo@+2-JXV1P4$K-@F-WHK
z#;B#fGAtRmG10@MH%g-7u$(ti+74ZB^qN^_0Nrm6ma}<s*7E^_B+|Wm?1Wwmzk(3`
zllgB#bo(N8_r7UFnHR3wcN6!^vk+JWp^KoORtrKY0TqeVm&%et6E^d+;Nj@&oKaX)
zJey<b9zAAPP!3T0c}a`e`jH|*>Ma};QCQc-8tCJo89x2vhHrDt!3s6C<U<3qG4m&{
zKCmC(3mxf_&rVBbXYt;`6r;OsE<%PIstC&w*Yz0u%3BH*2`+5chA9Op%HMo0=XzIO
zZnVQQYzgZqJiPq$eN<WRT0VlM9MPI(PZ0BhLn{`r)#B#A1H7G<v6E!*n#B7DUzA+`
z*%QIoB$M?r`Q*R%6ZT$`?X0Fg#KR=!rZup5E;i><UJxcgLE**rTkEQ4tdVK3bZ1s_
zb_{lf%ICf#o4|+VuTG!Li?hCQ=#Kw01X~0i{vm<E9{a*~eqh6JxNW?(Ly!BJW2mCi
z8kM6Zc=y<3d2|c>MOQZ>+3BBia<UxB-v_ZS^`@zIliO6Ga1@!>nXk96fr^5usl=zZ
z_o=XmwrAX{Er>*4!))XdxE$g*nPXpg58QM#C-XEoHvPg<4QrT7q0-%^OU+Xl%yygM
z%qlD>8G%e0(nhJbZ?DY7=5TxQ0R)39PCN__XUF~FI<wUW4~|)wf2BC${N;5CwhJX@
z$}|X~0>>W?BRhxHhK7qva|zky^cOb%Hxxln=Brk@Q<aMe*z$5f7nfDI%oy^aLHm@n
zL_DHBork9wD#C8-(tV6N=j-_>YArCCY))p)fIio1e(&BrNOU(Q8gL@j;+GLY9~f`s
zXy5KzK*wX8n3@WJWn(;L&^x7tA8Y(XeDB7m=G*JJABQ_~gW?#1Y(ojTO?7oWnem4F
zBkVp*{jOJ)|75J+BV<$rUpM<i7zwxMqn|*(8MsqX@{-s7Z~es|&(zeps2mx<t(Tci
z0sZ}WC+5&VnNHh!?MI^z`btlV0E$`XR}W{q?P}OAJd*!+qEMlexOVva8w>Z~Glzv!
z?E89QPr3LBgYIFVqhDN%Jj(o{-Qz00IKGFYClWGU=j@l7>h3FTXQ=x3=@Y=~R5{H~
zPY{2%xc~GG4MI}cpRCHNXi=e~YrQYI4s!d17he}c-)DcE7Z4y;%za1feDr<JcY*T9
z?W^t>`k;N+bIh%&rt2`(CX(qUYBDmb>C=ERRUVhq&l$_3^kI%Rh9q3ps3;<R`9GM-
zEw=Lz2ZqowQy=9je%E->*iiR(x{*citOB_dWL1l<-?9J0M6Ed-XW*e)z}h%nxux!r
zCe0VNC$muA(6`!x?lq24(`9T(Z_(HGFVK|I!$%x1S6I?1sHr=Ka%6&ux#h&eg+A+b
zNPQSC`MDm|0kvjolLOgkt1Rc`i7KqRpRTpS@RJ{T9%D267MhuGZCJi*nnjf7gc9<+
z%lxQQdU29a4z2<F4|BC^#dlWww5Lm~qDT>+P&-PUmIgdF*(}uJ6QQkT0@@0JV-)?`
z@V_gg3(W}Tu_7&N^Wj`TTj)B(woH_|Zm!JbNcFyP317aEG~@AwXbX3k5ujb}25PY(
zu-rok3Rvtff$*4c1SV?~7|VM2!$RmjHh!fWw~oOZ3@|VWO+3+P(yn)-wG}n0;*f<n
zF@&xSpht#fS!>NkTAt|^D5y*J3=Hs9dDCse(67OH#}B}@b5O4Z1bjJhyJ47p-9&hk
z<QHOpRas7{`J8ltCi>9;{kuvDVJM~Xs}#Mw1j^MN?qY0mQKY|Qrk90Xusf?9M|l7?
z_T`h7f&M7>DjnV(My<v&2CpZXk66o9qkx1{_4N5^y^CV?JF-@4R)ZdpGGCKYv$7Jq
zI(d7>6=`s}9_t>N#sDOV#}|~{eoRUqScu7`jVG&ls)~dH(yK=DVajgWq__PA>PCQh
zxmw|DnNC(2uLK@P)2V8RsuO6we#8SZSChrN3l<<Q&+%=~S$^YueDU`ZWu~@5l;Cz(
zkAC1OPN}Z`Qit`Z($3sD1>x_pF-2wNe&k_3*mwH7u=W0fzJK*F=mk<+9avfJc*t$|
zg~{d)q-jbfT94km1c#XFqFgaQy|Z5=rNpmfZb`c7Dp%3UJVj``TFfCk@`wA!?Q4wE
ziu%r>Zhs3POTUTPW<uD{?!-)(`{WKVM~jszyFrEJ<>du)Cx16)&epuV=O6>(bq_7I
z$wUJ=gTI^IikAjellPKp<wb556>$amDyMDu93NwMnw@#rR0^Eo(@2lY^NgYC3}?2-
zkC*+zh?g~Lsv44$HR)|^4n_;rwQQSWZI<ay-U8`hqI~u4@s4uKD62Lwqk4xc^dF!H
z1P341+n``Ss6EP}qwCYIrg7ewMjUwgUHKN=(JHgj6Crr=1l7^oUh_4k7tz9P|D6_a
z{IuhnO-)fq4L3NC!N?k7{q;EtX&=J%tOCFd>EaIethIzetkc{3t0Y&g(zLeDU1G7W
z(pZa6v_l@hJcdR~qux)b&-rcw<!uhG@0RpR1y6`|8<4100=#`z&_Uv6s(yoA%sT1P
zMAXd8Lq=L!Jb=WcqkA>|HC?F?Kbgx`h;-@Q6tSfR4-X@@_5HOuOlQm8uQ$qC@n&10
zqXUAA2vm^tUoIGuXBcQ^zfGNO0Fzm1E|nC15c*GC+pTfpdG6RhleuJe1u9JyF<GUh
z*wN**K?mdt49c;H&%<LwW?Pe}^n1J2AvFsNi%guPOAdB_ehdx&{x#i4hxvyNbC~db
zVQz7H-j}qOJ?-xgPX1m-7qlS!|45Oh*Z-l<Y`P~$^W>j{dYfXU-VJ}scMIpomo1_)
zt>G}L6~FkMW<Yx&C@TH_;vUf^+Hy}fBU#TGG`2C&(0)3McZ3bn&ph9mv?-Cu!mO?3
z<Y<aoNLEc67#x)lm+G^a-{1Wf930MWZv1}tc;=iimNBRo1n1<<6lDcoT8)FNrVcp_
zT6BvgLy9MfFlZ#=d5-ADh?Lx!MNsfyr&>4t)%jXnoR&5Seb!}(WgkX<<yW*E-}r72
z?WK8m@OW}ssR;@K;}?tYq1{F6I=~lPlw4sO>p5YNu$`Fl_s=Tj@A)aLZn}DEIzNC;
zi~RM)b5h&}w?!qs_g(2!KJ;|Iw3?3Fs5z<1G(N!6R3FjqGsSk1RI1(i)zSJrNT5IF
zirFajtreplN^T4^a_c_+q=QGNF`Q*XO+?gX<$s0Kmob%!GB#Cdj+07Sql-f{1Qc4b
zZLj%V*bZ9DKGvnv^@LhUc?@=B4k?BLteCxO&`aplyN|}HE531g-s<}5*3`y`PqD5E
zg4XXd#i;1nb~T;ymji*4uC;GLLrO|YFpDpi<H%uh4t5N}0oCFqlk)?oQg$xydaSyf
z5p$cm5r5N{r>;9!t{3yuqR;Oa`=372B@S++5aY|YZlt3x_7wCaU@c&jhQ2kfr2Y;y
zuvR*=o5bA0$gU}*Ws+VC2U~)@Vec-D*2AQh6#h3`^Yb1KI{<UJ{ZC|;s%lmax}}S2
ze-eiuD%tbrXy-r1N0t8D3ozPmz2{&G?(9vr56v69qapu@2wqyw;TLL7X<d<p^0mI#
z4I|vq)V)n9Hiy8w;Bbd57bMku_$XaPNtpKuovRYmh>5WQdqMt}kH3t%hm@B}o#(1I
zRpur?70+brJ{_jm2e%vse@6u{N&w`z#f&I*M0mJnZyV*K7K_OiCoHkTB#}t3gvCxm
zPLM+0se3nfTW@;}?Q2K9`6{vVIsV!eh}-1&MC(e;ToI-YFDl9^91t5AuO7qZs#y2u
zJ!c@;d}8Btv7`#E&G3if(h@L99V0*Alq-u`ZeC712%+QUNxi+^rXXhZUO-j+>5T{#
zG7iM`n7;dk%Xu|8(QZz-NK;7M3-gcW23u%f>h(2+J}7!&Ij;G;epPjK$#5+zKk1k!
zOQ6j;T%TADx_s`4>ZcH`xcfAWNmx8TJ>B4jy4@?w=Cqa$c$?dhjV(0z1S$Waz-l0O
z`PkmtZX$_t5Uws8+2|QhjF|dLRCh9WxLcqoxF4ZWAAe7G5F#S^KEKlH=yn}6RCTcu
z9ZR38rRS*gIhESVn&e;c4yb2Y-?_Mh;z#<talx%2B`Auo=~*yVhMylV5Zfae)wU)X
z!~_;RpEwZnT72;Belm<qV7laUwCZ>HJA{7;8ls^8RONs{<;^=+cCk7IL^Ivc02Rk+
z2ieo{;9^IHsM~zvUUzroEk^nwS5#(_@QK3LD1(E8YbZgNhFjiluIKM>=E!JF=MYq$
zBQCekZ&_x}Ib*+wt9nj9$KSdeaxunR<|Tp_d9jVN^uk+%PXV-KAbr;4f7rJUwf7Bk
z+!k37==x%8p!5EdK0TJYgL=IZqTkGSeQiQ+PQN|Ph{lDcY13uxGN&e4cP>__QSGp|
zfGB^W(enS0_SR8Ru5a8gii(JUihy(@B?w5DfV6;=G^2EPrwW2dcQd4P$IwW}Al)@|
z!${Wv@6G=0-+Rtk>wVv|&N};_z1Vve%*^vV_kG>h_5FUn^`{Y;T^)&hJ48D(uabDk
zcwL{!B((*cEFZTPK&oW%+t)DzF#%Fr$ZhKg$X3I3S|@uC@R{RSHEBC(#eGPg5?;bQ
z_DoD0oTfOy=rYL5D>&``gX^3580q5$+}dA8aP?5=>&>0b<UMlD(looZnexqTnY))j
ze-A8~RMM=mhcSo{&EA7A!0%6~cOg$QjyY`8Wi{QP_EDt1f<}Ok^ta}-D9+l3b-mb-
z78BA=sc_pULtpJT>T&fG{poE|;dVu86~=(ubC0_B0h{_I4scgmE4Qz7hRnos^RS(t
z1;)90wT_q!gh2(F$3+pR!2QO=B)dV<Gmxa~g>@K7$W|Nl75hK}B=~AcH}}ves-Ry5
zp2bgE`drf0e}~t59zU>u&R$mLvM2PKGs+W&A)X4z4<CM12A{nm94gXI1thC8L#JkE
zcx&GqIG2`2G_aNBxgzeW&eVD|qbh*Vps!Dse<Dw}QOgMBgq+^rS1BpE-Y056YHP&n
zIT6lKth=3hGh&S-oAfkbVg|}Q40-Z%LHrF1i<sqmMyx})`Ye0M-gIm8$J^ZVf)Sp<
z?a8L&bF8?IXP(_uB)(VvJJ=V_XQfh1g;_^9a+<6kQ)_E)Nn1~kTdKBU9b$&w&PXA@
z(tHqO1HLEuOLmvSUq}nE)eaZutf+G&a#^`wx6<vOzWJMxNx?Xucz1SIi&W6{g&ht*
zGauVv@ke<tuPY!i)_<ZEt`~T;lDE>@zg0a}`Zkz&v``cMX+J!!gh~Cn6-H+JL%;iG
z8h``^;pN(9{exGnO75$@YFRm!1#-nMpycWWkb2<BeEZl3xINB$d5RI9H`hY$8953m
z&bGO)Zd9#21aQM<HqzG`_=87iI7{6QKkgHn-MxF)p~lVS{rf&(j_3*@y6P$<I=i%3
zgicTM$FV|sKA%rI_kG8E&B#ZDR~uN*(e_K%$;AigFz1s&+<>8#ZfAG*hcl+GFz7qZ
zQid!$(rgbFe7=h;!%d^2JOGD|@`5u22>H5D(Fy{HvwD?zjFLfTAd;!NdThK1@nbGD
zYbk%s0v=l>=|hYmBWo`!*06GN)lFXGvl%IN?-S^Af-!u1@DDn}0De9F{YySqkM_j?
zSC;ivpc%NQNti4;$-pAppu#yFyo>@ZQ4M15M|aHq4d~?(z$*S!Pl|=e!@fetk7i|c
z=gF!qnhB<v@(y+KL9M2@bI9gox=^g`!3uDdPWQ$kryEU%ma>5$68{H-2av5&IHizP
zTOxD|jJaqPlSy|!7S89goL9eZ!r9dd#D7u@GNikwdZ^lhr^cjSo*hjE>4*EiYx$#{
zO83*GL4>iK;>9tf(oiA?$0|Ce;)PnT^&*F~Ca_lzBs9N(0@|}`Rdi?q--O*{ofT|7
z1>-vw5n)vQe4$P)hn#w0+Yepf839V!<W+A5<r>?z2dox6mhy7);&s0qx|$o=MBGu8
zp0zg!=IRfkG}zcqes>@dS<k>cqt0N$yOIKm<y@5?v^yZWCZD^#Qv=2^csXwXVAp?e
z=}@1<22tyCBDfR#{8Fp>fN(DT5162Wit1DMZ{Ziz5-&hQ*}!Tur^YOB2|0fm7^iGl
ztKn9)YkqcqKW+8=a1~^Ax%<7j0<mS%YHCIRys$w)85VthoB?^FkM8&`mQ^?OTE8S!
zXb|aWG4%_m<~CL{w`+Zn)@6wnnf{z6e<U&e`-~3tZLfg+aYLKt#M#zfv?mWwD#Bc&
zN}s5+8Kj?n31+RcFpvxrv+1dOPeiLtN=Ej?W|_)eLLZ0I#1{ic1B|eK#uS7<nrvX7
zxzsU&4U@(On|HHJO$ku5@jLf1?CVb-aNoYwwH;-O9G`;NSB<Mpjk;yZ9UrZxGjYv9
zMiWSNTqQIzQ7=#+>!SZNTly88Hpj<ag|DWH_Pez}4~L}J>#%=<=ri^ouadY4de>s_
z{4g23AGd3Dbeuv;)}Jgi0jwW8)uw+35yg;ZDruXsDub?K;YN=TA|d7OOrW0<@>(0q
zwNpv%0CgBV&iiU$l(J$MoQ~eVx4d$90t7Ekm13PKP<c<-Og`-SeZb9KWj-FRcD<CE
zz;);XNRW24kI6V*Xtsd#SYCk%b{-x;XJGTD!hn+sdrrpNEz?1s^puR}XKVLEes$UL
zTJLPg06tX$=K!hA(yw3oe0uGvjTcL8_vJdJXV2^)H7)#lS3Obm!9<)2Dsp(xcf2a?
z>bs|ADj2wAAG@->L2IR`Xm>#r-9b+w7Q+x8YfZ?io4>me%yYOmS7*#?!~rGKuC~^0
z{v7q9G!SEcN5q(4x?}`?fY!hF79R?joTI}=%%IH);*di1zrlclXms>VG6V#_NX6d*
z&6h8#rnn@-gGmzOUTG7wSmm*K)jd@*2F6IlMN)4w@y(Yf%<vK)fxrJ~I0R4}H1o%=
zxlfk2;0r?Ps8$O-!qBGcLO!2A$-;Ne@6j32jWxeSR3zW`eg6U<{wIzF?-|~h!<BBI
z4bV9Se{R;%(}23+m7*(Uq;9Ialxp~qLS|u8J=SFqo%@nzU|jCdl(E^o7HF_c>@xSg
z<hXTRO%H)*JfQp94rRJnK>P9~ph9iPY&=4sZASa~odJ|gLH>2aP_9lfK!!4pnDjMx
z?t4m0Kjfe#x(My=N%MiaVNP<Ur++SIQ}E;p{$-%^8#oT*u7-)lbnd-G7|HE(Q|o=B
z^JTbeGp$Lki)b<lKYECb{R(wXU;^<Qcv@H{9T9vS;SC_X5(^RV)dlPkAl_ZPBZ<8N
zkBICo`4zkP=trNuFr}R;&DO`8HR#7nJq+8_8g8@s9G8LdBCSX7YESSfKK~ak+_!>a
za0}6BVr_kzMH3Avj5=(sK=Jn36Wn`N+Yr*H7-V~|2hFf)R=vLgbMmXE_t~mhS%ML4
zlC4<mnbq|IvSJwbyQN;g%T;f7NmJjZNwF%5TlxVJ|0>5MCnDQ7mxd12`Us#uSm1y9
z7VnmVu}b%oHDU0_5a&Ili*Hj2sHG9Fg9rzfCRDNTduQevD+DQ<C-ROOaTavyJdoFc
zQ7;WLGLzmogH;y^X5KDT>aX2bK7IYc5cW9aG3b~uKDi=(e(*)mTgP5y{7(|Mrw7i@
zjpjhnejh@6;yQ#uVZ@JXi{6>ZzH`(zpbPVU7o^OQPXT&4o=^WTtPaqMix4~SMWCho
z=-Apy+uAbFi?y|ii?wnHCjED?c~nzV!_$OZk@K?w1}0)Mva1ery?NoKpN4pdp&1u%
zc6PhkyoA-%9=fT$EB^AiYu)^-L=^g65pUH>$Q00nQFr{NTt~DcL>78f*z7JqiDEK8
zz`nn+KXQpnVU!y<fB0QaeR=8GH}O^ls1O_Eo7w3$Oy6Mnd&3V!>B%~;)8zA@37c7A
zkNG93FzD(Bx0z6(JTtQcJjk6_?*usGph7;3uNgjce+PXG)*ff%M8xh1Qh9g6aqMbs
zo5$u>0+#^+&aF$HeXNJ>higUhd=~E~9PE12e^pnXl(u-$siY^!K3UPZ)dywAezf-S
zem)hSQh!47Vk3;=FbOnX%1IwO9UVIb5i&EOUfb>4ndbOji5!k#@FDf6m84Bg!L|)B
zMgZw$pX+=&f29o*e63Wbe|{_YJOJ$cW*=k#CO|!}85_5XU?j|g5oVS397mkUXQCG`
z96_KS(41l-Zc`b6FJrDu++(r+(W6KFwtrvK2ZsbtS6R?_;x}Ac%{Nr36~xxn{d8-)
zIz=KpW=||f>SAt%n`aBJi?^3pQ15QKWdk=5-$nZ;f`0rEbY40F7pSw-ALyqDBd&iR
z0_#1fNdp3;v^3&tt4s^ii?0vHk^qeY_^BxZzXK?OlP>A$uE?{e=jrZavc(}=pJM?i
zL!AMFqZzc3yYUm>DzRo<Du7W~_`17n1mMR3_g+6%79TDGr~|+))zg!ANWenI<vDnq
z1Ut;jpB^jkcorEI<+8*7_h4-M8Qsrndy9PSw70V6TaY02P%<vnaV^cB-Z2s|z?-m|
zG*+*0PvD4^3QgTXzydTd(&Y>$-02g%oA_zp00(rI#{>=#2lOa@AhaBs<>KdmFp@BH
z-f`u8JS`8PiXf<$Nv+iE1LWYT(?#EXmI`~io(7oUUVBG}dcLVIK}O2tWOWe;CrSVf
z6&Asz*>m{QhzM?@q9h&%wU4p1v_t-fgvFj`FTPWjf_|ia4ksfc5heqeJOZj<rOgbJ
z&$VX)iRa9rp6k0Ti?+Jlu#o9eH;fF?2Ga7mq}mojwtB41NUr?cd;szSu(*G<Scyq7
zrX%^a{{E7CxG#7e_Nb@RN^&NetmFj0NA_X06UW3vLmE%8AK~Pwmg%%zur67A)pY@&
z2W;%By8h5fr>hIc0ekhdOy{+o4)DkrcqEI_{kIoDRkdp|IWrb+qhV{i0hl0n@A`&>
zgiKdjYSq|+(6uZh=7}-8e6PJ(BXo2jKhL$bU*EDOUU=@b6OFceU+xi7U)Rqzdf0$i
zlCrY0Z;_F)vE%!h0p%WZ_j_!VF~O}54ue2D;OiNlnNb*g0MwUp)#a$Cq6(lejkm+2
z4<-pxKMCSm@4p%8=-`VJ4J|1_maj55sfXh|Bjy17e1uSUOGMb*_UfwF$xdwvj{TGC
z&jY+;cB-S4AR7u4CllUs;SQJ8>!APW^R8hZ)e!`Q@W$s3>>}3Lkf9gAZMJV;RpO`E
zR3vZ`3nDj<ezXAi)O5KO?uF;)#l_1LiX!z1vvwQbH(XpN6oO3B)Zx)N10bENjP!iw
z(^0?6F5hICSHagSclY^53SwebX@PO|S({3mW$scRMF_$L7@0GkTq$8=9}m&^S6U7k
z-n1BO6au)V_QX`)`%PsUf9$syJYZBVOeJa=4C>TXt3suz?m=5*6OBIA11Zi*O_t4(
z0+NeUp}Oi4-FoBnZ=Hab8VJz|ME#{=VQG+F6ieXYrloyB1}Rg2C5EgmblPN@VO)8b
zKAlp3TJN;?WpZI`o9E%!J(*#8VRm+<!Y_emey(0#LX}T;+dC6uSt34Dfo6lV#gJil
zS`$_JXK*lydLw+$cJ13m!c`b>c5g&K9W=sr6CB6_sL(Gd_3Abwjzg<TUjwLLpa$Zy
zRxzUW{!^|VXPa2;P6q&)wD^F?b_n49@tO@%JDzV;q11-K%v?Z8{mkC$cbedDk%uM3
zIPpMeMJnPX8SY=0K=^~p-F4n-Nvi|`wPu4fxt;eCeg}*-VW0hS2();PA1398hmRjM
zSNwMJ@SuuKfBE{V4hRKl+g!|8A&no)zWwnlYo3aJ<*>1VDa!9oMnLeCoPga@8c{xO
z1emFm(w8j)&PX;ZHS@l1s!quVfB^LHM(xg>uR`v}MBJ9$MM)FZbGA^PbzJu0eubFc
z7{JT5u+pU$cLP2KrQ(7DX4DHH6a@jF(eLz|x#7y$<nzrmo;E-V-MUw#Jt2`sfjPA4
ze{A7LLCNxF2X&6sI-t9${>J}@w>$_4Q#QRF-j`RXSjo%(0k}EGtwDM^y0NZxr>XMn
zS8|%5heS!WynOiR98Z;1r~3s>)%0{CP};sI1L=ytzuZFXfRC>|dklz5bHmF(oAhp0
zj$UNRw|~e!efSZ|J&_%N@gm;VIv6B2k9I@J7@f|Z&GMc(nvJ>ms1XWjU0--9*KN$e
z$h-=NLewPg)1<7zwLN4!3P4N1(z4gkZA^Y8fI(L`g(WVwHbpEH1k~&)cil+}d;JRx
zQ*xlq`q6h1zy7nv_04qwxfs=47JwSk2_DA2A@}mSrwb&K0DHAv%lq^Dm-tfGvW&^H
z?iebp2qRx??8lW(l~?F@J5oR(j=VK-a4uRwoBhEmoX7A3#Ykkw{slGK!-tQ1?Ssk%
zKYh@93wt}pgkM$l#$xg#Hcq6DPW;?mc+4x`4<nP^AVi(xg(trD_R`Lm7noA2WKx%o
zR6_N-5%E6;8Hpmuou?PRHgX2b(D<qX^)2vL%f?uuP}etJFEIkNOs)P9tNDtHh3jEq
zW495LlI@g^b=!Sz#%%R@li)im=ays-)X{hpAX`}tFvRh|3EXrdT?O<vEv5u;$T?VO
zY2Td{1D5Xgbe3C8el-yEyZ&8B*Qfz!5@2e6o<kwxJ)9@UV^?R8Q~YO+w(ZdC0^4-9
z^1KuwxuSpmuLi&j1dNowC!?+d*o^Vt^kaGTKy`Kgcpg~AlDEfg=6+pe!{a(4Sx$cg
zv@`%uPzy1Py8)^DAwiM;vhbX6`@e&Di6%Or<uVX2&Bi9?ng_;$!r88MBOtf{LM{aG
zK**})hmnXVh2tQOwna*fi>5W$#zVOuLblibXzO2+k*0tX5d*W-5{^}8XYZp5?M*<<
zHy%jfF`7O~bjF#qVav|RrzC4i;Baz3CU%xjs$V?Y6tOMU2%SBks94uW=;MN!t)8<<
z9EdIpBNZa}bE`ryocx=dbmbJ%LTvY`8z*b0P#1Ow`?u0py7#FZ*aC~UCQ22c32K86
z0o@hI)C`9j!N;v|6j&Adk6(X%^g<X9j!VuTe7rYb0ZX^Qd*d{*C&VyYZzB@A1;U37
zdK}jJ3B&M6X-#Lc7*+Ne12IuOC!WsCe-3tjzXMVfPKw;AmNZ&|pf$CMqVE@?qN02}
z^ze$dkwb-3@<sv{9Y6JZL6MNns_lu(qusEH%4&lY(A)<+bDDp)0UT)h*YuswflHA#
zIcYQ&rfF=kl*sh#Z2YI>fo4v}iW6l&)N?%Z(=wR0U!_G|n6>_<6x4Zk4k*CDjR|CH
zsuB{bZCznzeBNFVZh@scNBY2ii$%c1u!7@$1H=JN_N9jh2YC>fLaY-Qnlv<4kXH|=
z2;A>seZ=|t?1+nGhnYPtM!kGjqK!JM9)7y(k)_j+1$zW?86#J}gQQ7Ayu9HrobU%U
z@813XFgW=zUE!tN;p`g?6>;6<-#ODA@I9a(m8ATN^Rs0gopRaV#Ob#*$uCBQ4O5Hk
zEc*4*w`5b*re=Y8FHi;A3o6gvsv}3<#n!j}(joG>`LbHT{d{n!SPf2~6ze&YDtO%F
zdCVUR{$cXCZ-)lBU_p51=VMQ3sBq0beWFZ)-?pYo-1l3%Iy>nd+^#*(yF$s;%Jjbj
zYKkMPR2WgS6I^mp!0mYJ7^F&oGsA4DsMnFeB`&GsK1#EpXW<F<<BR8*T^(JG-p5+W
zfSrV{SH(1D4rHwDm4-dZ4)Pg5kx-&t&qPW2>1e~Q%3_A*&Ud<_ow=^!k44K;VQFnV
z?mIPrS3Es6_ADz7a&gf#*X+XcE!^#pfOjG<YL5JE2K|=7bAoxm8W`oXKgtaZ#5|~6
zl7-pK1^2sLhNc+(`7MiqL;URli*CclMF>e0y&~uUh#UNU9%{OS0%o|=?U8!fm|l>x
zfKQw5T$iLBB;oVwH#fLFOTfr{Z!gXWJ|Og;i97}05^TIcYw69q-!vXuD|sUz%nj!e
z&enY9ZKfhXb(z4F8@>Y4ro#yZX8;Ha*gZ`E=s)QG<r|hopmf-{wAO$<FyH|J7xMB~
zju}_N4&#@n-rEyJ<Kx5E1}Dityc6<5_%Xnkl#EY|2)LX)kM)5sJNLi3`Pn&J>)^6{
z;Uv=|<688cv{{LOoIF&0r8^z{nD|YrJ-|2Ufe7shN$h=9;8O%%*>V$P6R`Rj9V423
z!mh7SZVtA&?^A@)J@6}n6v4K>2%s*m+DSYn&VVFgmzDlRz~Owj19(&b)kpkOVP+<$
z;orBkjksi!0db!WM$O{iay1wPVfEN&Po<FkphC{oL&m51+rB2I0GpklJIZySI0XRk
z1l^A`NE^C~*}<#2Q<mtMmCD-#m!(Pzx`I;{><)>ITk5xu5GEmKRvUm-5A>nHLd5uF
zD6E}wotbE3J3WZS;|Gtx(S7#G8>$0ejc)_plastcjdvHHMnH5DEst>U+=rD;0Q+Yu
znt7(e<E5wRE1d@F^%Ab22}Umf6lM%hDu4)gsdxNLZ0~Ges(3;n(h-zos7a{#>o;YO
zhOqzNj%R-NOqCOcW8KViD5q@dTpey^cTBy!WK=*M{Y)h6K%Y|nEHbQ|?wu52_+D`a
zy~LoG&5qVh(4q0v!Xs`YQ2nTnwzro@*KVzc4U-bHApfTTy#OfYf3QADeyC~VN`Ub`
zmdl~`ErZ73B-`)icbGB_M|&wyjri5#-<@^b`4gpI;ebMavLj$=X-IjQh}S89x+5@}
zqdo!Xsf&NLOHC!53&gK6gw&_R&o^%pOaGSMy`OKw3N(*}lw`g>`%4l%k#w^qx_C_#
zkD-LjA5~Grec@ET+%{A0%bkBfOreoFh2{r3I+;(tFVuDlyp;YkGXD!w(B)lDw|_9d
z{=0)jLV$ZW0GCdDIfm)uEbQjXi<Pu4Zrisa?Tx?|dTB8f89w;o=wrn!Ixl>7HjzTe
z{rzKmz`101AH5lomF6=yzj{U4vLW!GJK!<#kGI5|9F8O4QF`@&Z^<15gKaG7V2mgz
zgq{($yfv7R1l}khx&!pipFv@#hlk8oMszDrpJ9y~^#TKvoabbgjKP!&_`4lz3%GZZ
z)~yr;W7=f@^u3?cdeimp@Rxk4NjsfR?bdu&pvCt`kv8Pqxi^eN-{$|Oi%a?A5TW*p
zRz4npM|!&4Xr?sXmrne31ci!<@-p7DQfgqU<bw&8gw!%w1)u42nSQw0sb!m8E~|{8
zBfwg<>`i>m_>A~s)1TWEXr>-Z5mrA}Dt>X_X>)e7H>TiVV99swbaSNLupBVrQQA47
zczU<0fjifC2nYzImoSG79t25fY0G@*Ek%JjaNAVG>es}%*d;tcb}Epw69%9G!1ena
ztHR<vjtK_f-BQS$fYxS_R^!@YrWEg&?B<py_)m!fU36I}h(PDYn^v#*Bqp4xMLXS9
zeBA|!0@~EX$Vl_gAD<a)EU80^=l%kV1jAvrk!GFu2n`U1({YUfVf8-A{Oyn?VUWk`
zs*?vyY2JS`cu0}CnNR^L39oOybaCHj8&(5f$Y^h4iN`N(l<cI3gdERb1;Dl9I<?*M
zE3t{1w0u#KG1(o!lEcpAAMk=(*mfiSm%p*|Zl5Ta_>k}jMbgbAy6<+r5{za+3=Vd!
zb3FnbL#Xf}frbA0!vcN%iZhvH(80ia_N<g*wq&mSHK#;ity@o*VnaKs6HL1zl6s5p
zXmY=R@^qJeMp9)*B|U(PSKsrJCbP0q1!QX_X8}q$Iz2qGR)=!5P-(Zd1FVO0?cRSI
z928ml?A0kX>TLI!s;66LA74?Oi$CllyDQZGDgNYdLtNX|BYc(@WO%;5^5K&D-q%o8
z%UeZ#gXdl&v^fs8GWF$m+RG`OAGt3EWyAtF9L|?tDiXgj7j&9-1cDb}<6cA~Xo4<;
ze|jt(H1Z-#%AWqr1A-I4Zf}?2XjT9sj}2M}1}FkIfD#6A(%>rsLU;w~#v^p-82{{S
z%2fQI$VPfh?cO=6D5<MoZrq>0y4(=`NhN!tO`HMPHMt;c6GOjX74|%!Ot+|c&haTy
z4&c#tLAEMb@}Yum)U|eS^<6j1!Xm3<7HD}n3!MU`5mQs!dZ{wAoLp@$)W4B@)`v2v
zo<)T1&j12a-q_Nzw1<s}>EvYf{AFXf%}#s-knt)wZE>58F9G<QSm?oY{H1+JMB@hE
z+Z(;`tWDb2{Jy8Tq)c!&ooa+(Z(L;I=cE7j0$@G1wL2hF6oe?1gY-30l5S$JIg7ae
z+|4Q6R$5aN)fR~Ks7Bur5SC|1c;ApQpaT7zf!z-spt203?rmD@{9X5KHyE?Da6%4k
zryf10$)E^GNG|c)zh+ID*%Po`0bRQdj%w?v$2QllDh2CHHRikYjwt}2Fqo}kja*lm
z9zH0cV`i^|WVkBD@#8S${m;?M>n6R8!zz>5?7qS56t49WOoJQeK<>J=OC0hx4_KYQ
z)_SN_a}B>^C{RB>eNIYUj8y??vTt-7k&KsQJ6Y-|cxd(rA2p+)z8xzMRM)&dEgabL
zA%1@Cz`6AU(~o5)!T0~>k$KD>TewY4^rJ|*mihqSVU0~}py^$pzP>#0GXbC`i&lAt
zN&xppBAhMj-*Hoy;y>f2@Zf4{uf-KpnEtV(QO|_yfs<+6ZpycE3tIqJ0ov?DKL4Kb
zmV?p~L2E>ckjqnN?<tOKaj}Z)kIJ$CZW%Hj@8ul#CUK}j{OhzTeubRu2qn)I1HHc6
z$TEl{!5z9}H2O^M1LOB=uQFGK)VR_OJE|3^J}(c*t^%IHg+aT@X4`Zzqu#Vb+8$pa
zchqAq7PvBjVyb(9zrSW&+0n^~+i|CQ!$hrEIp|>4q;%lFvluT1zF@1jH{S7**NZz-
z4hIAJk2OvjpSx|DZ)wJwd@}uXws4(eL%h(q)Ch%sZCX*51V`PP0fdcciJUh9Df%}<
zS^>3gG9XOgUhTz<{C!+hRSDMsar1^GAXF;;yx2n1*s5X%9mtUWFO`DX@Fdsz5XF(q
zQ*lY}voBwChU0mfKoL@I!X92yT+9mbx%uh~pz0tp2`>wAGgawUfU4M<+BxY9Czc40
zJ$6W_=FW*RuCicKE&SWMPB%>dZDl%N9Xi3_hGp+u9L2ZA$-@IVnz-8lClhk^M78&T
zd`b|WR2m-Az};C_$fc)mH$8DGa5IfR%)34Sd7cCDo>wLUVI}7QypeGw8nuo+)a)ue
zN3f@M_UPKZOiZ<?Yyk1Z5q;9+=+=Uu<Rubu?yF(X6hh7toy<sMVI6|pFvE#>(taGn
z4v-$*^eoGx27(aQuNAlQKuNrN$D-Y2kMff-QG`B+gVM}rX@&7#c=<c(r(OcUKT`q_
zqEFi%P@ku<#x)mz*2ecadmrQVGjqU1cWp#N3k<vrxjdYa3`wkNy$zvJLY=#Y4l%GY
zR`u#Pu{1Y!p(YsE8zHRpog5_NH;!=1qv;MzS{}ogq3l#475f~yBVUY@Z8`|Gnc*>0
z^%xVpoV7<L@63@+OVz$8F|~Maw8wx0;^eR9vORnUGbDF|!PB*y$#6<x3N-6E;>&=V
z`Bh@AKC|J31yw2$e~pdcbjdIJ=B<y`@^gti{eN}8H8s}#)DDU1h46jp#`f8;g72*`
z&v1S_625Z=FK+n+fsgCCx0yy*o*GYm0_=-Y6Zg}dZz*g(VfUu2<KoW0M3ngBPW0eO
zn!w(kbLn$-1OhV!0J>C~(g!No%r@wjrhRs<zl%jN2*coiKY1^v84`v8y3At*+kRFO
zvvhlJb|w=>UUoCRPkgPM{Fau}yU*r8ia71gQrXIMX)*8O($0d;Iu_w1s^EBI9$)AT
zOxv8cM(;><#}w>wSr!;TvuJbLyX34d7b%|D{vBL=>@ZdhOA<gTYEDRX&d-BEt(?<#
z-HNADg0J{4@IX=5lo#oFA+FJRx%1WIvdDl%zx?yEq~ATJ-d^DE1<~OpPTwD`0?9rg
zm;8zjYMKXFM-V{(TxIihtL!c(EYXxE-?Dna$=u_3C$x=`g+-8oSNgGEd2}1Ot%F4w
zAfvh<5k<O<OzXx!e6KuCc6MiSPJu%MxM8=(i{x;Q%aoIcx;>ZT5vbFL80Mp;5^;oZ
zM(q<UC7!wp(4DBU-GAnM*BRLcd_RONt4`Soe0=<t^W|0ES9MIiOzXm3Xg`+BXJ#mP
zZA%+MLV!@QzYw_n#tNz2Xj)(UWdFpslLow(vC+XN4vdHb_E4NEyWC3aRew$3&ZYHK
zR|pNoB4DlaJb#ptGUsu!szZc)Ve0wqD82>9#ibdjP;Z*qHRgZmsE$gpu_60h==&&v
zc%}rPLyWDh{ly#Yvt@Z7a;-K^#niI%LCHK$cab0{v-)A4+{{)akJUS2V5O3FpsMi0
zJ8WsYK^)vM8;}T!)29N)x+WUni;@*8@RngMQH~1WS$*t~PAe{@^D%YxS$SbH86Bgj
z{ngR2HVj$E<r3q=R9`!Y$sK*U<<`I3_qANrUo51-vd}fcaqWQAyWpL70wTNRz`ptI
z@vN5sH4hfhXbRcyjN+eaZ<?9e?eEXkp?0O@IFLU{F9!Ks(wio^r`V(1#HjF@R86;I
zLkv0<G%DXkE-`<2yWY;;b6*0mR1<j3wjwg6BD6M#8cE6t4jiVY#`0CV%49fsg0J=J
z-8G$u6aXiZ@Vcr-vS=D8WKWPYDRZ&~AM*q)Hx|IuS$~q3k=?GJg0lnC%xI(11k|qm
ztjC}Wr&VRSxx4yGWMbhf`nb((rT!|Dp)t1&s&y{;@#7=iEv_GdfkluK)>uaAwq-Tu
z*w5W=a~IeeWd8^Pda1g5KI7JKoAWx1TV~a-(gc7i1f)A+E(^pv+eQYn^j#a!`_}=c
zi%Vb4J^-~|{#`^D>viXwe^6&62g8bE9dmZ<w6Am7X1d%;dsuG)n5=D5p^qLv7PF=e
zkXXDg_6G#no0*&a%F4=U;k(DjSMsJ}?N6e+>#X%mG0njMAVmP0ph_|)2+_uSDeqjk
ztX%#s5E%OC<#jqJO|DVjfeMeCgG2VcG%3HMwEyoj5|WWh8N7RZfIQfmixDa9g7jK-
zQUOxlCWljUYGyx^CAiC0`w&1iJ|=%-do;OkZhmg}7#M%Z@uptgfx3g)Ser!%W);d@
z8oepTTSz9Ws7Ofv%myg(A7Wx}&gLzbri%kzkh6)D-fd<zm|94@|M|`<xOJZr`WZfZ
zyPgX+fXyhS(LmMlXp%j%{Zudc%rt%FBdhs27uTDvFcKPYjLmwEmuZS1Klu-yxG7dj
z4I`=G<##9pJvTw4<k<V=Z4oIA*BbvidV9vZS6H7(--x-JU^yz{^A@}QKYgzM=B!-=
zjlFgbdU`}H@d%Febo>RNhw(}E310WJmH`#?36o)s-Ti0pfHY!i?hp0p>&f6(y|dY!
zvGla<gseKeJOyX09%!{HK0ZE22M(O}RMk&D>*;l|m20!PR|4}B!Yf;!{Mu({?!J!N
z=}p(ZxQlP)H^1+bb94N2I$PWmLMd1iyU7kSHoE+C$rbe^^;lS<_nwAJ^0T2tY{`5&
z8!0DK8&h#91aS}^OCC+9)QHooS%)(O52DBObQeaiRtbki+Rp0eGD8bh*X_$I8XFqS
zYY*$3>8Yq%=I5`crQWkyDZvV9&&~<qaj%Nqj2Ic{;G60<ZVg)bdpVg3_6~=Uk&z7z
zf)>qDOd@2;9Ty9kVdB-6kyjepGpaqw96OSdo$7HdU$pX9OG<lJ2(xpftZe!`a?&Cl
zwl%di8DXInBR;2+znLf<wtteCFRzVwP+0W{_F~i6U`~`Ei)Qv5Q@q1h|ClxII@KAR
zIT78#M4z9ZuY%mT&y6%FbQN8RE-$kc>%xk~15Qk6`dPJ`P=}0B%p&GSMymyfLBCt(
z^*q#uoshxfRRKS@Ja5_*mBS*H;RDU6X&5r*=0!n7#E{eGdnXYxC+dXut{l-6?mX+2
zstFx6yJdf}xA=afXlT|fpl-;`-FT%fZfRxN*^E*K(aZS9!}AJn=Y7G=If54!rgCkN
zoSee%w3CZgGxm@V4Q*Bf2L}i0iAp~}q+NOZy3zdO`%Rd+*#_f_c2GDv8XDSLwcD4W
zp{aiVU;k*`4K1k8OyK2z9(Us;fd=zk8hwLzP4EN_Ef-5nK`k}}bvPi&gl3KF_B7%^
zB@g_jQDUkbrnp6M&g#97XtU%Tu)RVa{rJ0RXdf*6lJk=<PPwb9WzU>q?=F0lL!G;*
zU|@7L3E`umebJ&>*;qWhaBXW{I%8|<nf6HI<&wW+>(Dchf;#F@xbFSHew1*Qar>JH
zXLaR85Ipo*R<p@9j!vFuQ`Gi2whjrrd|LM|Ch9G6RS<fQz=tDyYM;M4SrUd)x&4f@
zO8@82`oH_XDn*5bJHdT@-@b{3NM@qd0K>v#5Q+(|f|XU#?K|hEUfGC?kJeFE*0(UQ
z+A`EPG|U1oTS@u;t+h2dd8Yv-IN{EE`-XI1Fbz^+cD-e{b+#`pef@F~jR%UF)zs49
z6%b&O%|i(?f%oYo+MUP5%&cwBi-S}B=!^EBp%%S-eoaly+uu+GK2mRYACNkK0N?J)
zIy+6&?Umd560V{qDw>{`7kGE!<deBElSs@zFSlF%n*W9vdtwm{hHF4WvuFDdyx8x5
zeX;*{U%>zAM(Oy_vb(iWW`OWMZ37XdF(hoP!rlvMpGTTdTD8R=OEj5to)8gb&+3R=
zp^`{prKP1ONzuS8?19Q-H|R2ZLwp~6Viyjv{xK3Sgs*5z(dphy$?OX-W4kzp5dm$Z
zn)R3H=uw2pb(v>}>@Lg=bO{(43EAiwCdT|jl2)E)3_#Vbi#2^vj9ssonDVdaJ35H@
zuG+KSiQ%B3{Z0uDE4Y&CvAixQX*PTQf>;0S_4zmgVRPF5gp-qVwYj&w-F56IUHK==
zK3woley4=U_8-S3B%CiwL2<~u)sao;5TE6u+>M(O1Hjll*ngS2H(6V+`gN^82{P0K
z0>>}+C`Qr^CO}Aw*Ws=U7a^WxaD&N8E~rsNYzG=~8~!ex?d({Z5ncW@n3e+byOo)V
zc~^iee^M@JbNy`~M`3%a9^o+1T;qZiHp88&_F5{4GNfYS*ZMeF?gUs%ImpJFblAKb
zgt34!CA!lEacSE#Y=n-19aW)G?>skE5rG@xrRsi-3Su)cG&B!$IvCBv#Di>)XNEam
z!#11MCl+UCNv9l;!sw}9d*81xa8xTx5T%=WCaK8Ts`dD?<?Azt&}t=j2B|n4i{=>N
zZrHR`fdJWVywBgom*C}Y3+Vyk;$iB-?qD3Br8@Tm`rlpv4`P$&Qz_|2Sr-%sOCZzA
z=W_1U$VOYdT4aB;!u}BmLpz;69h}QVvb}nx)+^F@vaHzLJ2Kj6f>5V#V$IB-V*&w)
zBRx=DQo#n5IP$PykEOp6nc%iXv*v6t^Gd;g{#@{;^^8U;jN5W!dvA|^a~0faK39Ad
zdX4V45wx{U+1V1?AB)7opy9RUU=eN1L{2ps<QP(!nB-W`)sYK(uD~`qU$L-2-4FJ+
zaGnymDKsg#AMP$?=qoDXhWvV`wX?g+>O$H4wh07<My~?Ig61{w3ChdM8&!eWloUaH
zf^s9@guJ}Q6kSWp!m_f6im0fBguuQzxQjlU_UhVd??JX45xCmmb^?SvkJGEL+1V{k
zEv=Z?XaJ*JhL>EQ4h0}}Yit)2Odx$dJ)3j&>Z+=vJP2=ST-@n!(7?9yS(1%U_~(f4
zWCAV}SVCpCEr?Wd@+2M`uiayr;WF+bZ78qXQji&h;Q0z%)5K)Gd&uaha^_bKB+_PN
zSlNP?3?1DU+!vn?W1ld#N{g;#@0S34lq%`fIboNa<@RKHV|v8U-kb+*f+g-0EmuKJ
zjqB8m6opS@OiYo`enmvYGp9;z`OB?sk?S+&*OX~s7t@CMcjNJ!oKTRH??FBJjX+Kk
z$Z0q|IMAuH>@Wxusj|BwCL}bueRyHmOnehl^Np8AVzXH?%h^GMeF;Jq8{sYc`-I?d
zOow}QeMxa}3^!Bpx!&{$6pA#@%AkG~8j7PLe7RCGRq@M<-RNK?EZYe3s`$|DXfXiT
z7Z3hSK=kb7aa~Ti3SzCMD*MOA)Ov}5{&{0GZ@C`X#E9$W;WiL|Ef?3H;shHu{TauS
z*zCEf-$U~3D*(j8KFueajR?mDh=s+)$gaK8V8~lOp3qC+KCWoKxoCrrIE+(NfFuMb
z7djcs?X}}bNuYmXri%mTewpQx=0D-@_RmeA*9V8Ew-7ZqMJ;m&q2RquTF@wOjhHPr
zZD|0^QIXS~5ebR7dL>oWH*4t_O+W~?*?fiC9uTRto|9EhFiic~SY`UO!DQkD*aBV<
zU*8OTd)`I6C=I(wJ?tWcDta#;2Ldw*^T$}Bz<@B)*pd<jPorUyk}E!o&dNL$*%;-2
zzFxfBuNNe`<86R$a8IEwf&0l0)&1nC90eIhnuA%sJWj{GQKe}*K0nK;+&S7@P0l=t
zLP#?^{aR}TjZ_vLv%uv~3}T@R>ul#~n2m)-v4riQe@LKm0w#{NcSjNG>dFdC7t%$&
zkPhn^-@bh_oSK-BYFb-gjZ4|=896u(6Ir)p4l^&;J|})^_wlY?j4n0_zlH~x!jSUX
z{@t1CZf$M-`@?oq8Q7Vk4~9$!)0#*n{5O7*jR>U_?y#8QJ~CfJB0dmEKBhR?e+e}c
zaRQv0;R2JeBC45R-up&cT6NERqkV9Zx%GRIFSC286jE3PxEPP$yRNEb?}&S`udZvK
z^f~VgveO$6fyKmP<d;)@wN(HPk?KH)#2v6`@A`#1q^!nZpn)XLUD)(}nfo1y9G#uU
zG0YFNun1pW|IJh++t~&1Ofv(Eg3(a0W~|x(!q|-_Ltgo>vND;N@6)f}oT-b@`KxJ)
zk~q=ct*!Uy78@X++a4=;nJ(s{4j}W>_jg0E9|b)M%34xk$^2|-=y=Y6kFK`L!qi{j
zKLU>A#gnz+u8acX1P)pBhYRsiw8C6A<fCccUUN-qM4dhgy9YUQl{v;17KF2c46k2*
zh(#nH)xFCDhZS-`S5u(%AITYr7xFOv^!5uValXtvpjzj*7_SWU93wDfB1q)60@R$%
zWfediqi5L(9_1e%9;Wx<9&2m6ios+XNP>MBPdLAHOb~)MoP(vkWaKHZz|nm*G&ZKE
zrw65fYEXU~MRrfmAGPAx<WV38MUr!sLz;yTc0trkd4&TgpPeRvgLEB$F^xnod3^4o
zt_<IJdJ!iF{S<aPh;9!%Iy&0eIDDo+%=HK?V@kbDVsUIoVfh`KXO}U$ziDC!row!E
z+vdG4nT3n1Z4h^4c&{#xueRWM2jKpi1zz#unzmo7iu#$qf4d;uR64l<U7d*ufOKW`
z^P^qBLGfY%{S-dfczjY1*1oxFD-0?OG_-|kvF_TBDmmU}7B02Gv*>ksiLCFMo3rZb
zpDStHj|E0kRWo4AeDHYVWf%?_$I2yzcjD{)V^Q==B;YBn<f#k@A7)hw@Ch(3_Tq|M
zjZ*WTA!`q#`6G#cl$3<MU#0L^%5%1wv6>=QPAWnXb4O=AB_X-ovWO!0GAvYf5f8x8
ztFxTSfy(nyI8Xtda+t_XISdAY8GqkP)ULMlTIw;$dQk~BZ#=wZJs}U-WnGt$v#o6#
z`lgf4@D_BV8d~YcB>eC4+3&1=1rWBAp{`U%=Q__R<v$G#4Zyp?w0!>C7Z>9`*9@4f
z(c<lPjU^|Ot!@LFf-y>%`9Me2>RG6*v-8$`W5K)fz>=o<Vyl@ki{3r*{qdv{5!)ND
z0pXjB_S%=^K9zRM^o08QMyqS0f1ZPdc~+rj|991+uphjxf5T6ps!Carf8hfn4={KT
zrJt8)-44AxiBZUHHsTnc;mw2`Xf$s`Qqtwj5n@16a^7JeHz$<^iw_Ut25<o$U|PuW
zH163~Wfx@gWp!iY90)k6_P6v{+k9zW5m;M$F2^RsMh5ii%VSq%{Xie>ExgJ}VzGVW
zby$?F^riVmQN&YwpRchO99;Cx%@b)!d3a!ebgS(#)Nim%?sk#)@(~u6Pm-`oFHNMa
z@Wo%DY{5?r{C3}Vq&g2h-}l7_6bn*5GiyQ}91^_xw!E|qfIR!t1$dP_ad?p=U4ln%
zot;l6ZZ5gm*kI}dd$POllP+pibDj65uQpAf0V#ZkqfudUtr6&6T)Pg8Jn~TX?XijZ
zn)vX);FkzE@1%k6Yr$DRJS8PBS5C)M`O_DueN`(BwU<{zj74l*oVtdFp-Ij<aZ*+m
z5Uao3O~GW+sf+$>VUg+4q3}v(k(!--Xlkmq*au#om9>(On;(;!%8D^IpPlxAh$!Jg
ziiS^<iCgXB1ArmM#;$E`<&R2$k*6Pw3B6!0DGM+dnX^OR5X&no+c&zis+}YxCB>zr
zsFmmm-RF@|J^F5eN-y4C1DJ6Si{S!LAh{$KoZ-_qGYAQdau+NvoAdmX;A_O)Od(ZA
zr6(28NIb}kVsLT^!IYBT&*v`Kl;;&g&h@;1|9&gc_MH=ZXI8SZOQhB8+;MPzcJ}vq
z0fK)%{o8J^n4+aI-JUkl(DKFpfBdMQyO5~c+sy##K2=(<0a>o_-R@;I=t@1c^voZN
zfC|G8;E5HS6)sP#9^mePOo$ITLVlKrv0{1fUBF4odVpsoj#b;p%uGqA(9Y3uV<N`{
zPVgrNNKUD|Z@!{mdt=9F1%-sj$u&QpZAbu1CfcmBUvdHL^YVB_#864&!ME&eBWvq<
zWX1KPsp<;#0c)q}9?(Kf;x<#w30KLHpRTk%Ubu3Ji;k8yGVbha1|5jG*)3hWf?x7?
zSE0&;giA{_G@1XLiE36K@~PWQq&6ywoafS#YQ~!P%w_rqqy!EMS31q~1C)g68@eLx
z2e`zOidx{V0pcZnv(MgVrlwz-p`)H4TCDkeZylT>q2A|>7VDv2?k<Y*^4it<YDec9
z5a>lFlKiukmC#{Wvli?YmH)w6p&yhXpk@v5fpX;>&{yr`1FyrUFU`%(HmZ)5e#u0f
zCOqcPOAXfdz_a#vV?qiBi&)P9L!j4dEgmrktwVreZ-_fr@3c9Zp5h!ZT;qbcZf(ur
z1}`Qbz1b*Rwivf&U}CynsW6MuBeAjU+rBNkVUH(Pbg~O~c2KChE<CWG1TH)iAPKCu
zH6k+|2zESoBFYAYk2Tt-9A;ehA|x@<(z_JT&dwUR_vtVngR@#(rwP=1cDi>f(9Xd9
zXoI>VRudThA3SI{zqqHU7{=#72(;*6jPEd(=oCpeUNrN3R<OIX^Vb2rEE$Nc>mfI!
z;^f>u3shMqCj!C^^{d8LEWQ2x5#I-wUjl1BYGpZ0kmDr1h)RGKCB0lWxa@JdM{)W$
z-URB7vNRlRy28-DhjEOY(f%n?qUagu2M(^cjShzxR^8sxs;VK6`wAQTDu7~~uRbs}
zH1v7lOB1LmN2`HQKO!+Wq{^ua$EvM$KsE>*qrawq4b00ci%?Rw&;M1U@sm#ZIq_i0
z>G#PR)VFUBjvJG>%miJomp0<DK%{t4xy-7sv9U3^u>E@&rwI*>VhT>2#=$zoK~4@|
zL<C~xF|el#Zm_<-zWnW?*l5#>lg-tg6<TJOy-6U4d!5a)lDshiiz_GqRq05L6gfEW
zFqi$AY@Zw)>>eFey?rpP8Rs3FW&8UTA{~BmB{F>$r=@!-z^BVv!7IQ=|1!rku1f9s
zXDg#u*^&9$Ac>fs&gW=Tbr*Jie!gk8xwmJHesSu3lgWrX>jI1D|H>3a-3JJmT2+sW
zBkMUhIKX;J7m`YDEgtZ=@-+{b;fffki`!Ju4s<u;7g$!+N17|UsjIj<x(pY8(w6+^
z{ZN3%jn+(*iEl`0{pyMh@r{LwigC%(5LOHz-@BX~<&`1IpX_W)n_HWDk;1zhpVn75
z*%w#W^98{G{|@xQG5DKTC1{xrZCl`s^MK1DLtArr-t}#s-k(OR=`5u#oZTcYE7e*h
zbKz%yvwCUabgO4Sh;P3M3QwKgt>fJ}gT<xQygak=<dmoi+x_y^gNyfIs{s<qpr2WN
znN!sU>Yu(qum#G>%OkaZveeYo8JnypW3tsdiOR}u1t;7d0isltPj*Gl&T81JtH%Xg
zkl;$<g9|A;H#R%-1?>hnG^7<}<>YuQXWbVDKbu)T-)OeFWaZNg<ncjqxk#NG2`Z<`
zD#*kT{IkAgyP{ujIc-e}bG^DsLi)ryQk`dsUvf{wjq98@<HO^RHcdthYd?!audm!E
zN}~W8l|`!or7x!6EG*O&S_>KibkE4&(9yL8;6xvE17%e9-0ZC9<e(_x>aPWu8t(4y
zGTCJ4R3v)L$dk)Uqg)RNAN>3p5a0o`K8-om<d#VlT$Pg#l;n=MW-#jMvH_|}q}SQh
zC9>hOe(Qf8@nBJB=U*ADcKb41go@?_<WD!Zmvt|Xv)dyg6So!?KCCV!Py2)xR3@h{
zuI6j$c{kN2X#Vk0t?Z?rD3-MeBgGc-UOH+s*c<UKz@=>6`)@CRQGNB--C=5wIT5cq
zHQ=;^pN5a`wMgufyIpq<h}QFoNBMU_du5Hu`+E<YtYR4R4Oxc(*5Qx^omqRwl;-IP
zx)Bd)!CVYec|dQ=@7CFdHNVXIo~nY`nUT*X<ApPm)$#>Dr9y&_X1V2w3usAqy>CmL
zh1ewniQL|aoR*{#Matsa|AHgYEvmM5Gi!W%r_|s*wFmz~%YAfPOQL<rfAat3$G_^k
zB^6mK(EwPwO5EPr0jY~lPaBt&l?{dR>S}4_FF1D;fWI>PUe&&MxL?;}ycofP1#)jC
zR}IhSU=RWK9alTMp@pwkF$GmzhEgEL3+y?0Y0mcc_J9REJP7+56O;XI=2?k38k#NV
zQ~P4&3D%SqC<}`JDh#-FDj(t~+XhWePQE9-X}I0sqG?uie7=8|XdX!PV%=(hh(iO&
zYX(L~-x0U<`+=U$s<Nb{?V+&?HibUePu-$|2=QWBA!LL;O7mOAXOn7TV#679@a!@@
zp}0$_Fh>`csLs*RN+afv640>Y<2;dzy{8<_Ae2wgb>l}~-sX@&`qw)kWcfH%z(&bj
z%f0Kw3Mi-;lAaS1vgy?wIBL`sg*cU@&Ve-~w)1vF!Zoi0&xU;9FOP|Sz(>ioC&+2*
zx14=W9dLMR<2o=$^Iraa6YAnpy;H=-(z3zkMwD-3GGH%i>^c=zBYrtfEFXB(GTe&#
zJ2Z&q)7*l7$;Zdn8wgSq76&5?{2%y(?JU+O<`kNg1p74fjEK&{Vq1yEzgOufG;$9R
zUS5rx3g0aG*eE74cu330>sEUnpT}c?R!W;c&e4%=obrr10yUW966UncEx^wYc1>-M
zLK-P?pny(}gCYveq9SPg6XQ2-G{e7|Pi44upXh2PXclSR$EDzxcF!hr03=9*^sbja
zC_Qt~-|;mM@aid7%Tf5Qsik?eJt8NtQ};60gP$ubNu$yDs->-qg{AM}bhpvsv}qmc
zl_Bf%hB#!8^SVuO1W6(^JT)bASy*K?BBuAseV}*^XQPRwfaG)I?Y;0N>5GMZadT#u
z!qM)CMXTHZ7$X1zy}A}S^R2V#a65K?QP=ZUh~=@G|LEqG5P7{nF-sqUZj=bHL5^FF
z@zq|3<5or5_nU9}w_8O25U^?%M?*Y0EKX*B|Ng=Qfi7%rvYYHto3Su4341T80`&-e
zBR3TvozqG3`7;qc_v_8ZOI&)o?CwV(ZXKjYCG%d_)=S|)n)LsCpX4<In;1WV`@!bR
zu8^k7;+TR7xK6WuT%?Nf+8+o<nh$aU;x#o4@(R9nNJ>hMbB~v;&ZIsPz;k2O%J|L#
zd|}<mdKXXJQGQ`z0~UCY$h;F!tHc~&f_2IP)FL-12St#1RoF{Mq%BrGGdbyfHlGA;
z=>|IoX{XGr`o#G;(D@n;9Y9vBot<-eZilEFZW#9`MnOJMj%=^2j7G1F2I8gSnvXk<
zB_5amN=9bTF{gT>o@%PBZA5P5dvF`2Rr~F@Zd?zs3Ezy?It&T8?2d)jCfkT39vr;u
zzIMW8+6G)laFS5eUlhueWYMb=OT}vZ_tFLzWyP(hy6u!nbxOBJ?5S;nao*K{>&IV)
zO1lc+!8VNA>i^HxJPx&W`uA#vJ6!d&7dOG;qB&NC?A<uE8KGQYzgwCZRDZ;FAbc9A
zlEYjAjgBsiW;zJ12mOiLEi`4N@uVEqNa6me^0`LepFi3#oF?0J%hbf^<a|cfz47d*
zLdMI8o&sm#-MzKxEIS$ti-OLOyTm*PaW322V-B&;X^pVmj?VU@fVn7AoX2zlxc;>B
zUYUl?<QaHqYm;ooz+k`;r4&<78#QYT;J%L@0~B_&)j)D!xb!k|;scX3N2a`7{qxaE
zyZ3$f6KVu_C*^RBqTE?oUuoZ)($I!ewSr<vPE<6aySLZ56h?6~Tyb*Z9D_?$VcUZS
z3J+yP*OSezd=k33G4siyqnvk{n`4;;U<JE$wpvM_Jg~zPg8NUD%dMY)*fnJ`CRV0M
z%^FozaD#OUx|WQpnY)U4IBxH(eN;>xymNJ_D(JFjZEgQh8w3^LFiFG!5e)nx&(X2l
zer-<nU*$iTAB9p9yLMOdO1-^2YI(78gd6MPn6lL_RN6T8;1vb6=yhyzjWjxQx2yI7
z{lc>O1T-XMOau$8JX4pe>lytNe8leMo(~e(YO@3rRKpK~RHmN)<p7P&T`^EN9u&Jt
z`ZwGui6H*2OdjwoDpKUaG2i)q!bMI_HvHTBlB!pdAY!Fca@xp%W_ehd4jggQN`LqF
zf1F`((9A<u-OQ<qar(U2To)akytK38>L$|JIX*s~$7puv8XFWt_=L#q)y=0*7GBnN
zx3sWQrY(wiROC%+D}9b&xyNGzVxBLLVIosg(~i5-c`5<miymr*l+ekk_tuV{p6pG)
za%dSE!6TxDT`w=IP%Ic}Up`FzR6(I7Lol%CTWvyZw6)=q_dxFAAt7tbRKqCUEsJZe
zYs~M2M$ZUKL4lDmZ`vqfaKiQjE-p`?3I6`?u`!9fHKVkD7PV2eon2Ps_<T!KMq`Eu
zm*8@hV11%M+GY7Dj%Cc#;ypENu#4e6vA2G}rl^>}hC{+Hjm+f0@9#dlQM}i4q{P^4
zHj`Y7mF2uRlICq}yk?@(94je>A%OV;PtUvfV9jikYc4_kAS@z1qM?G-CN~Z#2p<{}
zt$l`p5g@m@Ic>x^XK1o6ooeUo43Zv{%H_cs{a)&v$EkpkbXESe0P724V$cAx1rcRW
zO=xaXVci{5GSspinaYQ5hCArst_#4SNVvX)QZ(LF&npe<{uv$3>a_+<5L5M7l>))Y
zgal2T82z{SRx_26J^*9_NQsDN<yLQ-g~y8WuB0{2#f&9>=cb*eJ>xU1gQi3oSgFO*
zX5$!t_yd27WEgvGU0i&uuWyk3jt0Iy(6w<=U1u^o_`7rg%D`MwOx$1W|55=7S7!Tn
ziT4dFn0tJE-P9$fXkKE)3yLaGjx&jDt!*X7q<C#PP8m@xJ~gRQ|L~jupXh~jK4Vhq
z-jvG+kE!Z{f`XM0&c&zYEH-rm@qG2bJG~|j7-`aFMi$*C<%N+^70BN$XgB`7G55~S
zWqU+D(&5!)^+H0kV5|`m9K6zaeuaU1e#sLp<7rn$e}QsC_}ukp&C{}+tWh)WyL0W0
zb8>=@ys!X7eo=q1XL27ts3b(k#l~)s{pUeWvS>`672K6h74e}GzRrNb;^v#^Xz8zx
zPw)1STU!?&Z+n=zP%q;-P<?b+-4$?=>y3<o?M~9A6dss5VPHT0i)f&G=dUZvtRj5F
z&w8CPk2iYz;1<cP<B)J$1B{|cceSp^DcR_*mD50ts%6#>+7KBTMnZi93*LHS{<Kr0
zytsLFF3|b?BTBb!9DeXW+I#P)DAO)ql-3qn1?d)0$&#f=0s@j%B<C!-Ns@DttfJ85
z43d>xM9HBDDuPgiBIh7Tj#9)To=wm9&AKyp&ROToUF)n_cMbmtC9sP3ectEU`?r5V
ze#>yG33qlIf~t~ABRzjMp(Euw0}f^?{_HD%8!A6JH3|4BBd;bB4-C<r(6`Sk%FAs>
zs;k@;0kkVK-ArlzGq_6*Vj3>$Zs*Trk$zjE3>K$?2U*H_=(tLo#E9@qmrH7c^YXsE
z^lNN7-qubcnHV1jnCkMlySO;0sw3sxBoio)1|!A%KY#t2U7vQyw>wtnJ@ZN;s55u!
z%rCz44>?@Cyvq`oA<8}=wX^rbWf&p<vv9##lyGFx8KepLmyueS717jg*^{>+Xm1QU
z7cbGX`Jb$404Snk(G_qYXKJ||ToJ8G99h?lMk`YA9r=u(XI~a0YB<_k(Ogh%B;cUk
z|AS|p){mzuKR@4lL}{-xHgfaoYPyoUyF1a3;ogy@z98DTk7ma9{MeEYE@y`M-tJx*
z+fBY+XJR|00A-+1Lxn~&sKAQC+28?qy5+YDb)ny@WhE@H7~1EKsXfg8geSgW{Z{(v
z(a{Sw0VzX6!`40CdhE_l)$MKVC|sF{bbVszd`I&0=bD=m2E0kFXus7;S)A5ewHDQq
zS7wC4zl@6~6v*R0RjQLKb(NO&s7m%=i<F~MD|w2(%|xNtdX>|tPIr}<dc3B%p=V^~
z<e~NaeFrXO*5n}(QZHge3+Gf^!C%;|0i^Tm`aJcit5WHqF{Fd^wRP-UqjfBE>to+&
zs0){~4#-QLmoFYX*qva>Y!)6No=O_kw$ZNE+lzUkD{Gh=3t-R6s|ztQ#)kF}WTj_v
zYB<{$P~42@O}nn8%~F<sT%>xu<h9x~#K%OX>N46Ze78Qlo`Y|zn*XXaD@q_BTFvTa
zMr!JKv5iHejhtNFoXWCj{<Lvv_lkzcHF%6d6H6v<mRD3}GYW8Rl}Xd86{vPfunnae
z5Sc!cz$uMXu>jcivYvh(FL6rLy7uW`h;U_*Gso_}U1k?o*B2Y{x7F1L;;_PbLsbv7
zTQ}U@p$!<hLPt=mATWDxp~geqp7*9LV)NK1+`gp(;Er1N{}{ddLVLM2JU%Wp=G{B}
z91u4h=xbEIUSknvS^C=Xv2xcHy4UaGk#aplDThbG*rERN^+gTX2(q^7I=@Vwz+-TW
zloVi#kdTlnf!U4mI*G&{>RdnE)OC#5%A%G#F&0YGEx*GmyOe~B%D?*+<X2FVkQ@NO
z)_E}?ojE_8_-PyvkRqVD`Kxp!H5Vr*g~&($g|;_evo&pon|DtJ&_uVqPO`HC8WR(j
zh^FT8k-p0FWP9Bn;sSP)-~glwYw!>Q9gryCgNa5j+B!P8d3jyNLaIV<anT<4`ffFz
z){Bt(iam$KdO&}WCJW#Y1BKiX6sjFqu-bxdU)asIbWqjr@n?uS1}>#n9%HJWk~28h
zIv7YO83@!pww{R%3j?Od>u3)mO}N&N+Uq!h=Hb1+j6E(A<SQCzw8?{+cp!~9*`4JY
zuZ=+Iwn+!b7uhy>ZT2B<P(ztG@>nX;)$wDgF)_@)E6$T=ie$5(&$rh5^6z@I%+pxb
z`fy5tpgWZ0l9JNW>B3uEOD<cYS&ZqL(>s7pQ1V?HEpzc$)8fG2UCTlR0hJV0S66K{
zrKUCAXknzJWZ2v!3Lcxc*ma$u9jvO_%l|{-^psLg)VQUM<M;*@f|b>7qP`WT5S0c9
z1mehazv1U!6=Gu3SzAq=(>*2FzP)tGxBqAXCBF?8E;&PSK(o2o|3YZJt4)y(8%4F7
zj*^!7g+qiM3#o?*w-$pU1LZXBetz=1DVE4#<Tf|I0w<BNu?6)jnZ<u%0d1l@xzDn6
z%3T-0W-cu)Er@V+q<2JGikXYc<FNPh_~WS8dJwy_popla%d3W9F$w7ia*8|dTf;hM
zn!6lFK1HR<r+prgA0bPTo&97rg%+P^nd{XsoYx+hP0;>C^O4+)xy7MF1Fdb(+*u#P
z)YMd^jr&@^)oB|CY>hJmExz0R@jRr%T3XP*Ca}zfq?In~si~nc&8M8o-&isfQQq_S
zn**ETVTk*_X&v`(npws9ujZ*OEtoc=hS59^<=Yle-f77mfBbM+uiEkgWSE?-WnMax
zk(I3~L#`-C+#x6LAoN>Ut%BH6Lddn>wz?Z0<LKqOg`M?wz{fw_7_U%9$|4ms`6#;I
zzdEg)f#6|`QLXKA)GwtCC#mcX;|<02Z6^&4P~*F;_s(_;FhA4P1<hI|x&(~z0Bzvg
zj4l&Jc?_X~;NWE?wbbsxaJ6@0;@@)6O~7<5X9pT2_SolEb-z=xBrUZrWq6&90kZj!
z11W{-nD!0Q{gt3`uZ@kfr^jW9qr}IuF{tov-R6P#;sZ-C;I$j6-V00emmQT+l1&ou
z?|6CEXym_VE-&Bdc^&QkOhbd}U%NG)2M;DIJenUsq4m)!_S2cKHypQOIQNBuDz!)6
z8}W&Z-d#9vV|#o15l-qzYGGEAQ|Peyl4GDVDYR94JSY8cy1e!N9Kw}}qA{1tmoHEI
z_`Ze%HnlD^4$B^wnu-u5KcA~OnC5j}SamCN+V1E4F;lPk6R<2AszKY?m<2MM-0WP%
z7b}7tbU;R~`uOq1T6pk57zMY(=NQ1c+1#5l9XL6alts7mpRyyV_^%P>moJ&K4U>|R
zDp8$JPB8>=8I?(;Gi=DuegE8&wMD)?$r}kV7n(}`b8nVFo5{$=1~=P749H2H9Ubv8
zUyuW{Db=>Ia|%KGcGiYQ%<m1;H`N^P2pwXtAY!O^c*@PR#!=b_9|8ylKW@N|W3H8)
z?kAhuJbo+5oq*4V-eID1-ThJXG>cMNNr~zMyZ)!oyVRJX9ytrKKVe?h+@GoNzAd1A
z8}9k){(Je{9#2nC=%N6G!HAu{tArXq<_dwgw*^by(Ox4bGo#fAA))1HxnxvaWFRrM
zs~EEsKXO#IJ4jwmiItOcbpjRiCP|5UT-G47_8Eg!R?;AtLz@LbHz?%7{G@=Y+*$PY
zZNZR#!rq<Oc(CXA@FBV^xC}x=)co9{TtAJE7w8N~(a_lUEpf?QwLJXzIW(~-?$Tg>
zw1k@g(zRSI0!ZxWgbK=kY5in7kjZl<tnXm?%3zp8=Fej<=R}y<*f6vv>~H912>D9s
z(s=#px}-$?&xV#x36(sk28{^Ag0Nuzx^&3>ayFwG{AzxF*^UnFbsxzYGx1zz=0NPw
zpayUcL_u7yCM6qK^Z2p@d6IhGmr6Z8hiL_#JdHMegEiT3C8=i!D}asEOw{1kZ8`!_
zoNPN$Hqp_iIvtScS-d}>&v)IPhLMjT=@*;k#;s}9PVEvMNOK2p&WspHDMNPmDu#$>
zQXY8sye2Cgp60c#t(570I{i{yC;eJ>eP(gxvK=XBkJ9*+VDA12I5|7$;t#l7^f#Wk
zdG`+eOFQPbyE1q*4Iw7`y9YM+R?Iufhn9LIWo=P$(X+FgxdsEcjI2&l{U=W#Wvf-m
zS`3JT<rT3mtu;ie-fRmUd2?7V@>>9I4aSvIqeToSEbYt<c9ltsqW+!=?hFZtTQ+yM
zx7+qVRJo=5tH4A9)7O!aJoHPAKPDTjY;D&^X3oqkYzC@qSY-A4YrbZi3HokabKZn8
z0G1Ffs3j6vj>%uXle4~>tghA-9U#Y1LT@bRr0i{TEoWVcu%lDENKQr}rfpX~u^_v5
zRmdnUL{$EB-alH|&H4EkLhSk|_Ft4ycd7aLI675thMVc63tyBFH>BI^ywqf0EOt04
zjW~+4B~@LV>_A<#8F5Ij`Ln|XBVss}%<(!!p89)JpNH@E&;ie9yWz^R#JoI(+8`oo
z4NtztaC!z_b<|zS$c9OMVLjC9jcgBMHKum1+7tX{(g&5-)p#%ZIW-+2*TeSRne&t7
z)0&#V^?RJ0er|J++VmXyHtn;zdZ_}<c&`|97W1g=`DEduh56;Xyk{W}3%xPcR8&-)
zr!HA$Nzt9_Gtg=0s5urC_zc_A#d`5pT)<Z+8Tuc{sC^A-#7Jo9kn87MxB8QoJJ<b}
zqh19N>_tAL#2qw9-UOej^#&19=7tmfg(1dlS+S0uo?+&at}b>0Z((G3R}$)xwZ0h9
zs>So?e*AkjQ(~O@l^U0R#zu<M6C`6>N6!6?)xy)7>91Bw1xm$4S03QSv1A6`g+BT{
z1uWczXn{S8Gr_zQ6PlD<MG71AOhcmJ>9j9F!Nk|$;r(>g7C8A4b?q}V2hWx}<P&+a
zPY;6!)c%OM(ilGXY}rXLiv5l4#LB{kxrv%x?GTCpsAE5WR;UHU=yq<C<W<^0*4tyP
zDEdbi{hciIckNj)1A#HWTFc5uUNY4Sp9W}y%Rky27$)uN>FEsl)LtvGFS&xd0&_n!
z7AOE>I9pw4AwOZXt;JVX%x9$$R_QdGxw*MRX%SUbnrhBE?_);4)Al+}?5D+qGKRn<
zxer;ip4S+|rg)uS0L%ppF$42hboOMW@eeK8yHIngg~c%bSY1Wn<ocu4{3M5=5@Pyp
zr9FMKTp}VSKCSWm`)nYQ@3qhn#)^kRaXF!)$2V4s<Jx<z3LjZ8V3=6)tUFoxJPeUn
z#(>H;I~=uPZgro<V&+u<fGnl8@r3e#>)tdnF9b)>rFj1aM+o2*6s&{s=clxnay=ZT
zW@dx;KAlg{`ju6c^~G6kQi{q^n3`|`jt%US34{Q7;aw)`tCs;o@trFR@;+GI?>=Y-
z>_Mi#*D#&4>dKT<U%h!~lK&Y889w;kI7Ny)lPKNY{9rJl1uU=ApRugf=85iuBPFa?
za_V+&mm1W3SV!Rg?gxcD*6;f+X2iVCZdb?c8*%78$Uyxm+m=J<a=k*jP3%Q$i{^cP
z9<SYK0`T^)bj2Y$$l!cbn@jqCG^VfRSG{*<39KKc!DRSE)Wg`s1g)+t;=DBl9W4$h
z7wSym?c{Z+Ixwm29vG;Ajg*Tk()ajA>O=BdgGEkImF@o+>9tte^d-1K%^6B`<_EKO
zrl>G#mzfi6%C9nysKs30Ya}t!v}?;2)A|Z&@)#%fY*1dozh~~xhWru7b;gp@>~5#G
zwqbGJ)VS1bRA~~Qqv1U{sc$pjnd5HO`}|Z;`-q_q32pWG*&sVFo6V0lj&RB=?K`!`
z1GkK3jsQUby~^C?CW7VfYHJ@lPhK*&;85jjgg@0ww7?jvG_uCIqFq50nr}Gjo#oxG
zN|yqk2A#6TU!q^7Rjvq#z`~=&bNyf^GE}_BZjPLKjzf9!dWExTYfx4}K5p3yGk0FY
zaj*9@Tg%wkn20YG&3M<Uw0*?hT%%+^MI#CkV)hO(p+$2`XSR`8{MZLe5aUQlNEF6a
ztaHXK9zbDj>HKshW%G9f$t5@0o3RojXKtF?^n(VqOqrQn`ag)>3<NSn%*XX&4WW;y
z9nfzry^oVzSy5G1y^Rp8d8a^CsIa*v6hD|kw97v%HoH6(@V2SjO?x24vE;=r#Z9HL
z>Z1}#r1=+BbZI_vO{*UI&1Sm*`>bi>J|bRC`;pv(zr2E$5kjT%-Zrns3t#-P%6U<l
zp8Y1cI#T1n^*mo7=uMQs%)9sS>h}ct`TPt?gKH0KZ{1`*Kfh%MFV;%_XZYU#)Cmxh
zouq(NUn)x#Xy_q)6gZ>?{7&oeDE0WHBrC{f1{%7`GnIS)prHe6y}Y8TyQ5nhzTMe*
zXFg92`nh~Q&=BzR55t^bWrZB5?i?H(QxGEMhaiKl_(Bk%ifPs1z7Lf)rn~dU5!Lra
zwqeT)y+<r$?1rQLXyBKuzD5<Uu<R57y`rnDDDJf@NC9GH`G&f>2787RC~m-CdhJcB
zb;o+h)eD}B<2Sl__y<pg?1CVUho|{p;LG^yu&!YP^1u3@8B_kpGtH0>7bC;(Hx70O
zl-Ujm;x9-&-+P#^E+rcIss1GX`;T`dV3=J7>;XPJ5H}+X^<yun{*%!N7OIjCWEiLf
zGzEnPnewvl!K-Zr7t9wULoA!ZFYq>9`K<bvcUO2}<E&wudc$zt*myRak^rGX8nC{u
zAZai+7klaQ2`OH!u8z)_d_uA1@)|=kLO(SPZmqq8T1)gB7fyuNph1hBZP8k#9X!){
z(xQ?EuqNLJ&8GtAyMrqX8tN-Rg-ij?bp!WEfq7^>GnHfxT@b49mzOkH`AqK`POLI4
z0S}7*Yxh#(3ZCPHjGU5^f<i(6i*1u9Po88tSAYxZ8yaz7eHToseqrcYoS#RGNQ@@^
z%*>qAElEvHbq2NBmoM}=o6asS3>Zn){P`!glK_jLH<p;s?_8>t0@SAW$AM18!KUzg
zeQlmA06ZJioPK#b3IoTgPB=Fv{C}#%lSKs55Q{pg)y1HXkxY##^YinN%nfi(X??L7
z$(TxAH-ylL@^c#2(SU~&SAa?iUu;ZF^VxpTo3Bq{E?Y!QH?c-q39Z8g!1kCarRL4k
z)bNHmYwd08W+^i9K!NjKypl_BckN?RCsRT3w^IG>Ynv?V`#>TP4UaTCI4sDO)Mn_~
zo0yvJv=#m+E@Cg7kmHXgil6A>RTdq-*K1T)*JGlWiuxxO@J;{cfz88@{zed2pTllx
z7i*#OIoyM+bl*l}+w{c_G0}I#oyNW4l#qHe^M!|kf(SfEq6jJ?Hz%ikAe%#Bt}%!M
zjx2{!9WyZOKh0ozdsPak{JYM)XXng;ljQ8;HguNZ0(eD6#Zrk*4IRg+T5MZ5At7PU
zn+yY#eM@j`-r338)&(VT=M)2LQSB}kyX)xOa56IpEgHDod2XA`ZHgY(yREo#B80@7
z{{#yu2vZA>5StOnPXbjzE(aZUu}nGO$SbnYL%d%WiRen_b@)~yD%IAu*VvfN>vEPp
z(_}!oGI~Umve1o%Z3vNK>7iNF=d-)A1iX1RcJ|a0T;k&5^X4;t-rYmll?p1S?U)5<
zTSY0!$;o`16xR}3TU!Cjxu}xCss!32(a9+Uu_^e?jk{5vgA8&9i10dN07TC($I}|r
zS#KD*EICY6t0%(*L&ntFdVC%DRUA5;5`WzJ4i#svD2lxKyw2}OE-)CN`wkBybkoZ{
zKMRVDjRn%|H0O#h&G~5<Z3^ximCoaSgBM@NIMamMtD8^wc?C*syIh=In7T9sZ+qTK
zVAo4}2PilOEV;-1j!!Y;ktHD90rX^i3XP3J8Uf+O@J5ZrmLIEnrR^U@akoR~A1!dj
z`~{D%V5RFLFLQHq%@&)L^)VSwB~#NM4UG-#91z0Ag#k!O+MLQv5Map8(&n{Eq=c+&
z@aDs!r~wQb?or|b&~H+2Tu<C7z~N#(#9HX3BLjjW+pSjji%ncMuDA7m`o3gj@gRST
zgX<lF>xs@qjMLGUKYGU-?Ad4V_n1`WO?^%z$zQd~YwM%iqtXE4qDQ51?_eUR$E^-d
zP9vMWUep4TuW?{K)8KY7o&r)Url;rXiN|pKNSz3ufsn_b-|_Z5GEJy5mX>WQF{%Lz
zBX}N<voF0Qd8>5~g@qn!Oh@j2Q!&i&^0$5|tZS`XUmPBv$$8><>5(GVc?W<{Ugxj9
ziAFw)T}i(s*~kHvR?p7P4rl~t06~;ae3boruHR(<;-ue^ui7720(#dEsEh0Fv-~cP
z8Si7FU;>PYU=Q%>He^e+x?V~aCVa-;aDusg&eUk_`t$p+KT!5IZ>^DhlcyhVa?#eI
zed^aV{X?rJ1GbNYE%C!iUS*N(QHB(L2T@8-r2?v(cgzgg45k`Aj3Vs~+=vb6L{DSX
z#1`Upyq(q1*&{5!3J~}EeU$4_g-4s#_mB>!#hiQP%3B!E`vX9kz;5uz&Q@eu#|7um
zkQ^jBiRq%Zyq+-c#?!{HV3Yo;*lOB4I!w$EezDvRyBrS}IKN=p!YMoc^7QsT<My^6
zTUlD_98~XFIQ3xeAUqsg8K~zdPwtvxn${R$YQ&hn&CWKvdO2&8f`27kJG+G}Lo@av
zBLi-b<j2wO>IZL57|~G(y?9iSt7wkL<lJz0!izmYS4<XaAB2c@nvIXQ=^n2%k>n{!
zr;4)hTIql~i9tvEmI>F_Ar~jlrQ(r>#>QJ*da64%NMnf^7y}?kY&>b$4vcd5cwUZo
z<}0NOad<w8DD<FWECvyhWepmGfdZs)Zih*t#s)KOEI}Z8w%p=%tTl_h&dj7~*w`dS
z<ZAS$yeCjm&umf*_cJZwbN3R5eo@@gC-REtouR8B(2298bGRmxg-R)G_^oOLFu=S{
zl5C>qUPc=?wHY6YoqnxNO!t?%WZk}>7VoX8rmKddryaACwL(rO_LeUc&NJ-}Q<m<p
z4XgnLy{G$h<h!Lmq0J%k7e_rPVLp*n{$|fvA(a$dZP_QXu25Uq{-Dg~ODvazTl3+`
zK)>^<>oed6VRLI6ctv0Q*&HHoDKa^=Fl8yrjP0pJCLw|E2voWS4}bHq(XUT)v-?Zz
zqH*eDsP9S<#d=jy9<^)-PY-H`Hl$PHQqxi=_1E0i`gMez8a#GoJOy;8r)b4oKPsTz
zh>Nu|#4ZxgP;MKp+;orSWO>SB70o2*B58!(^~+zSRz)iNB56_|Iu&56o$33P0nl0r
zF8bY{dv+#I{ho_QhjaOt!qNsa2M3ldq)kXD5CG_>Vv*ThbvxIug@lHf(WLsV#Js75
ze(0WZkiGoEl-3B-)Kb~&uf+)*$(<88{^4N;X~Nhd%>w<Vt=C^E$t47%HtX6SzKbJz
z|G^y(W}xVFBVKj#_h?~a!k>{L5z%;euhKotU%~Bg^O$?My58qHf0L5dXaFD|6Sdn$
z|B8vv6QWY45wAV7Kn~HkSfSG`5FV|suUB$Q^=KOkYWrC47Hs0I!6$iFIz4XnNb9lT
zk_7&qhvUb@k>Kguvn{4HQM~akuvu#=DCh)r#wZ~B^J*Hp*a0G5om*#jlHDID(EPcL
zRRpMasN8%9&6I`UGUzb9e0&gp6dAS(2!7<yT!opJ(Gz&o<1J>!#}WBDBp_i!YOdNp
z>&&3QtD$mu0*hdD{F%*dGe0DU6CuT@!{;wKTYf)f1CI6xZY)!N-(uPF@0{rP*16<^
z<KaGE>UIt$kfR>cpz3Lp(o4>N?>)Kd?mTaqf1+33rIo<T!&5~Y?d<9p^){A8xdz4#
zNa~~l>r(#cD=xe)o){E1FMGat^YxcY!oqqRH9$<|xmwatH(v%J!x^HKtm-H7<mB-)
zVcKXlX%&U8w@4#DQwNKQMwEiDaJvr#z{@IqG});fd?3qw5KhBqv3W`MsoJl1cr4$C
zDa7A`!7Q7*?15*|-ByCz7Aza(sedk56r0p7x*%V@Nd@W9<++oFMiH2i{PovgafB+{
z(FGxSdiB~G`tG6CtA_I9%I;RjM$c59E!?|lYeupHOzS&IRYu#$zQTH!%A+OO(h>(U
zv;ET3Hy_lxLsc#Xle%PA(vwSk$yVb(WbHX8Y;tsR!YzgA%5fJsY^C4C1QJrHNYs$T
z#-yfkX=CO+;|P)Z!JG0jw?I52ma$*uer4rj!_<4cT2r7LzV9(hz#Z0>0qKC?2F(#}
zggnC+`=KT=F|ByRfFTee5VPr&<MrO78;oFFS0+`bqe>?4Y2KB6sAe5?Fc^@`r&%J2
zW61(tOBi8zc0-n;7!Q}L>&XaHbP9ivjFPuY|5F!UUgTZY_-VMlGo-ZKKJDOU2Bqg2
zZe$W$cz2!YDzLH_5Yjd?CE+Ki7u=8C%bj)-fK#_tZ8_3llDO;qu}1!UiA0fStQaep
zGoC7+6OA0dyAXYN_-hBhnt$x43eyo9R(s1(4ljc#8>Cz3t!9Ocm8CVxJHNj#u3n)g
zkhmOh;vW;dX;)hMBEoGoWiwRe33!5@CzwQ+DhB|ECsOQGp8^=GygX;;Kg`HFp;Rib
zC|6fg%egfC{*?z2fwQw~6iLyj{;FU+E#HIt?DyE?MwzSb25Tl`Bd<e!fIw2Ab(&8X
zZ5GepJizmKAXb8p=T>bpG!ArdraylrAn4F2udHOe`$>7aa@cRzh(@>EHfK{yD?tkY
zoiU*U=7i;#xYSHvZB)s(Vta8l?$K)BJcVcG_BHmWxqxoS{U|3Z6n3*d|KxiBW=;CX
zG(H=|21#I@(cn=M=g%*TxCtj_d{(>X#x$xFecEj%W(Qa{Y_b9AB5u04gPG~*<d?gO
znGp)7IcUZyM;Dh)G<w)CLE(7~lu_zRvnEe6yTU^GC_FrB@QGGCt?N0+jxR1g_TWI+
zXFfm9!>ka3ZdMKQU|I9<#LG@b$+b?O5@egI-9~T@gY?RNc}-o>C~mwV!By5x#_$f{
zsDo{Jt8I^08I6t2{jbO<vFsiO*QcAN9pxU=v$G>&CbJvY+Db%^D^VUEE}dOygm7wR
z>ea}6A06$^gl?u&d;y2&?@4OT_N<8se;ccoP?EdUl@PUo-Dn0Fc6j>x;{>)6{eIu8
z9YVjnI)e;~ShD#%i3rNurRNdz@x;ZVb3>=`jCca1&`{=AJXfT|Kq)-5S_RbsgA^ej
zFK_ITL~~PPuJ37@F-}upJQQ1aK`Qfz5Kj`>E0g|)t_1p!Q`XDyl<EdtPf&)>p}j$*
z9<C34ywX=3+8}v49h5<F4?jJf=7(39AQUTS;Y}9V4INz4Mvd+*`KUn6>FhZYBke)p
z1B+W=6lG+*Hj`Lr8vJ(w3ide&P&Qi~&GNpzLDYnBUF%=TGqRw%E^2RMs*d9{)cu=g
zHOW!opJasos^R^u!YMK$Y3JaQXQz?68jtf=6;`?0y5ZQ;E#IHPPk*yvV<Xo~s@AeX
zHcTX=vJ*-5ybe~kah2z?SF_c>?ep{V^Vn++BXRnir2|zv4Y<%BT+Bc!g^HBoyT{M(
z#z|D2<r$^Q8oQnwWQtxxi&fd$Fw2FkU^)zPU$5~;FTjZbK{uLr&ZO0%`d}WbwDc^m
zX{G5mj;?N$#|9RvPHcsW)6#>E=fsho-?u!kGx5KuMG3GKp4>Tck>cRD9~U~>M7eqx
z;&LVoZp1|$ewL1nFK-xk?ET~yKN6>%r~!(q?Vtt?-5Psjqu$HS&;r}9o3Vc!n;xY5
z-t01apUvxqDa3xLa48=to)`rRp@)F>l}{UA?+Od6t0w*n(c=o9{YMZ7!kihg#Vwx&
zI~tK*hl0|UokgKd>4MYVrnLHIh_=kgS?`b?)0UaMR6&V68EtaE{50Q)UqgYjDNx7<
zNf28q)2>{&gSzEv4K0_%-5A~&9(lJ6yukvTKF}M&g4diaX4#q&3Zg`!{8suK55kHj
z^F63sgKEmz{<*jjG4(;O?DKmP4dadQwCIF{7PoNMXS_^J+=NR{=-FAdr>HU6#5WBJ
z8o1scFfslzk)NuT6(V6H{#zcNNBPgcWRxSlLh3KjlG-2LM=nZTZ=Y>6_K|9iR(h^Q
z7<dEFTVO?E4@k$e0zyF_eImS<!iML5zEJI0b4pC<=vG=zBTWg|3Wa7ee#axdKpYU?
zVVsjMkE8AS<z?a1{||bp|81>RZ`OT5rp+3i6*}P%wE@!Q`%ccT%Y8#TNT*!R9=@W4
z_;}ylXUi)C7HVqhWP=eEvFc!5u3P<Eby-=7an;GmN&fP?(b|XPW>*BlM6MgAr#Ff1
zL1Hf%p2v-U58K2zDuwx$-xHL49Il|B8u0vF%b+K^;~>VI4OF4+aZ|wBf4sq%mo38{
z79u9TS~5GdKqdPSavp%Rw7#%nY-*bIJ+Nb&^#S!iu>dqWBs^4EL2hNViAa#ZnhdlD
zf8(Kmsr+<sYVKj29SjWXf4k+6+*C!*%6wUwF1~&>Psyy-te4{Gh)U3_sNO9*kl|{c
z><=l%R7ypuXKiCu>7iehu6#-hxB#nig4R`3gvn6{ng>yF4B3HM-wPhtQ{B0B%Wx{I
z%*hGpM~)RQJnQ8}rGIf;`ko9sSiwCGgU1_#_qAA&$U(=FWI_X?+dR;(s<+f7nN`;9
zU#+e9kKwg{FDR&q!hdOFYH3OSeQC5bQFEXTzfE91Eh})VY1Vl}WkJY^*4zJd8#D8l
zs8J{Y)nJ7Lrr2j-*qf7+bFCzHcURuYX<NWw29p-*wfQztDOChHc?Wmp3J_-o(nY=3
zDu=)n%<pWWhP)Z0hL=wb7)?ofS%B}rOp}9{gVv|G$k)%$Z;6}}?;K5|_ZCIWUfOm3
zxgb=w*4u-0z)+Sg6*8-1&MxDN|NIUv!^}4*cuwk;z>lC?(^0ewh-W8krMJk)SOwbZ
z^79><k7sSo%;McmO&MHVT+~ShD5|H*O!I70GBQdB4V+Z_s_lg7vofulJ95Ipl$n(U
zNoZzgXG=6@T<}&wMfkFC2{+op&+)paX>ay}Sj!i~7eik=K73~5x|g5jG3{%_egEC@
z!TOYNP2=fsHW=D0VvOE@SAyi1YSX2XxVQrU{ye|aBO}EWiaU2yTB>iVnoUsN{!{?c
zziLod0wd)H#luI)rX{?=S2oUg-&b`A_*muSl?|F@6L`Tam)AH3*|{L@zarxL{@W-)
zm&oJ}C`K*LnAU0|Xjb-n8)r#o&|o5btP>)BGek)gml+)%j<MmIsB%zGO-rk0W!zsP
z=cDT5>4j7S76|TOQ;<=Z`p9$^DVRtsVD@rtih=!vVo@?9QPgaG%xJnXcki3H1^IU)
zA65ppmc{GhirR8=t_N0s+LG>mEA{N-wwO6nY2rKBx89w)ebt{!LI2~^x^2+Aw)CWu
zKYZ^G4i@thLEj>r;KSK@P>gY_3L+jjPy2HKx0&%iNQ2h7k$a_>cXn3(7RUVu58~)Q
zwX0@<&)as}T4}n7=W2>WGpJ48K`sXL8WcQcj`5c{K>yIT#S3Y`4I+){en%Z27T7?;
z;=9|&QXUV|NQk2~^4=puifc?;kCiV#b|+!vUzVf22MdXY>%&!{4?qRwC*+9+L3em~
zn2^Wj?qaq8;5HB%6L_Q9=J4YO@GbzlruFjL4nWLcmAA3sF)i%8yWHP;9k`7knv$M5
zcv%{WxvidePe9vPweM>%*kw;^)_eTyH74&sNlz~<ji}HF`OVFzHZQfcwh0Of6H(kf
zk~IbSV^@+tmAKOrsa(@<Hx9y^zJ2=ieGoYSCNgV({n5hsm)yfT??IUj>E`EM@9JDe
zHnok&jhr5OD)}GIE`6i%t_1gTaG<GwmSsgVXbY*_5fKp*_{6LIbpz|oXVdj=DMf-S
z-5y5=TLLDBy;Op8MdHe-B35RWgCY-?`=n|31$d7~SV?c8XCr7tpW9e?pEqW)jVD5o
zh1E{N@g`;CpR<_>9C{-A%M5fA)!+b$5M-?bQxXR0h~@E|iut55|M=67UBI|1F+ia_
zwzLc|zvN$rlBw1!Njd_2iuh0WgcDJL$s-3nLN^hgCB}=BA7H&5)U<%zx#g>tn!YKH
z^Hm@5B0naU^K)G8)6|Ok^G9!?_dfEzj{QmZQZ=wC&X0n!TRTPD!neH^!Q6yJ*b4h&
z<oTxkQuC3L`{rpsFHNKf<Hik96wdds`fG7MtC6*{Go?T8P*-Qmr@;q53o&v1{q4le
zM&pemKg!B_E+4N>*;$n_3()tMIVdyO6qYycEhA35L>!;hu_`DkrU(%0*7yZv-^L{;
zCnFpxYaB+DXp(s?HjBj1e3m~Dh@E_IeDn3|Z9_y#aJBu^>h8+@V5ag0Z_Kods_Mpg
z71U}k=8zW7&MqweSf>GIMMGcT7zHynTFKlVhsINT$c_^~w=HMP2bH@Y5bD(UTl|jo
zHFk+-e2@D>x!4Wr6&8=;YsM?Bb|@X1IMmOHr~OC9$B&SC8R5ZocOOeeR5=YS=B2;z
z>5?D@53aeK#7-e*%}buHM`1~Ib#)-#eQKhH?fhXB4A5?_;#zyVOUz$pY2c(mE$;V(
zc@C|pt*b_FT5HmZkd_Vt2Z5kKnharwrb>DK6dv<}#>P|ct){75w>5E#bGLol?9?9?
z>bdC;oz!?NnwxxKJ#hQa(&wDW-5KjJa#;kv5!GmObEI+rr-6{HcU}+m@$RN3&hg5X
zn=K?&w370&it#Oyso_-ot};?mi(Ji0i7yA63?@F|`Fm>6t2^%86`ae<@NGK(^ce--
z84o|6gTGSq33d&Ucem{67tPRw&o}wb0oo4P?<!&!9RBh)G{+!)4op1!j#h57(l`D*
zsc?6%p7A+ubbU0ZUsGZ(?gidp%M&%qM4|-mZ)jZXoCb%p0y!E^<ox-wD2Mi%n`D_{
zY017P8a*q#$KwZaw=R>AFvwq@03>8TJ7~RK&~yBQcjDoU1?Ye8?#0GcQFc?l(5tcZ
zo1MtuC8mnm1Gcv-xmazzNrdl+QrnGvi?-%y-#HER>YkP&g)lMYy;iEFSEnJo74*!F
zM!NbwRwIUqbe9RcyXCK6CqAH6txk$o-QSKaIf#haQy;eNMJ>(qQKkkFm9Gto+5ONu
zwoh}xJe`-6WD@`<gR}dd=p~zx;>1sP_sBg{{LvP%z&30P_kMcTajmY-6LkIhO(r>U
zD)=|<`~>R}`zZ?g_>5vYIuNPwcp5aA$?EEkW5oToR#wI!hXyPoiwrBO!Bd7T=r`-(
z_1zAYoCb=!bY_@oUq~DWy_~#~690XbY$>{(EmelCf_`qKNIN^u-$;>{n;VLi35b@(
zVt2r>K7#tXuiM<OvPR`f*1F>k0~Rv;u^~Y|Y-BN3Mn0U^KY#9~rP}$qPc581x&1ka
zRz4`FfaGR5aC$6%zJG=0=+86{1)B>%EKPraI#orC!c%QN`aU~T5jU~uefO>atfh~S
z&x;pdC5WeKNe300;^%@j3=knK0DL8yWg6HISFWrM*)Tn;F5s@yd6&|BGPlFi!xPi2
zcz){o3~<23bi;J%$hYpRqn{zQfs<2=es2980c})rdQnDn66;<PSeyw9qe9YTRN_QV
z06p$3uSp!4XH{pTool_FzH@LezzM!vT9wiF;xmlyx*@>U2Wh6qx+SBnS7WVnoPN1h
z0$`Bu6qXNeHyz`?5I5@{;e_^AR>T&Yq-K1a@-Zq``H7gD%w}@3f-7R(B`-5D;1J|l
zpTFK_%75s(#?DGFz^-2%<BsfjA;zb43l>N={oOxup3V%7CY+hma-zc<e9Ed6Y77Ez
z#C$ZHUD5;M<JG((=_H-2F1M|;f4<nI0}r|`5F*gV@D&OZ2S1bSV7>W?XP@e$6}iuB
zkWpNU47N*qAQz1~`|vH2OQ+s;rGH@yEU$=X{3*$(Pq$fOBWVPaQxfwU#otL~IYIJO
zU)HzbC_56Pq~C9r`}Tf%#S9j@42ja;#CViY5=kg&X=!b-r(i=dj}c33k4{a^v|}B%
zoL`fsMSl?Uv|MLUQvnl?i3ta#e#7_@GN*l8->oAau0(TL^+*vBty|fXj7DsW17`~v
zhu0z>PLxZIaZn{curIQ6n9Q~Xl{Ey0`yTBk+>jTPx%P(v$~8e<#r_W#Y3YsEp`jIo
zxnC&>2#&vjX-Qv9PHDqY{hRO-1K~*D<<C3Zx6RT7{V}oFztqlD1v*&N+WPF*46XjM
z?)cpIcwfa`f2kbfvbdn>>-kOpo^WPjV&1-<gK{ahZ4_`9s;eR~O1{26l`~)ksWBGt
zRBPjPgKjq7i~064`9w}Dy$1^zzL)10?U26c0r$buH+`9zCVA_JSj^y%<de5$X~h!(
z2la&1clPHB$q6E5`f~fu#YRdp>Wy6jv<;)!jYsNQTALST<<H(e!%=Xrh_Zgr-*z02
z@18W+>5)w2swLA`xW_RpLtB(0Fi^ta5I<3An@&q&GyT5lAQU5mH}E{&U07hSa;;yD
zm8~x9&Rnl=^Q&m%)p|vAH?ZAneOe3b4NwoP`fGhr?%1tQX8}v5CiCE^<|V)?=-Kzh
zv#F^m!=Kx3u}i!%CF~CWZfhco?PM)jq+1>SEZ6&UgsT}jHQY@JQ`}t|$pQlTM2?KJ
zH4L>-C1iLk@nQ^{#Gir_BV?L_ZwzI*-7%aA2?=p0hb<mtdbkIccXRMNw0RyUes^8|
z`G=L2N^_G4DXoVpN=e^m>~*!Or8lQZPa=mUL#*qI?&PY8YCCao+o|qx(IeMzr&DTv
z_wG7iP&z30#zOf<5b4PszuD$;+Z-(8_pVLQ)3B*=^<WFV*TI^|VCgL9?3rcLYRz9=
z4YeD@I*&Vm>3-qFhq#y3Z*Be8ie(?e&l6dr2d&WID}pa4$VXsqFjQeTfj%ENSPQ4H
zAG`O->XA{9y@7KJ=9Urq{sUf3LLwp#j-36>Mq8=EdmN|z)0YjE#h=^S#MZlKsTn3j
z(}#`3{$R{`#%DJ<pXfm8uf37F-oJUugu5bEs{GNuPv1Gt4#f}cYPP8F1Sbj0H~i8@
z+o=ZRRtibV$w~Nna}jZfiJ7tS;-c<(jz#GUPF9;?d6Avt!>KL_>FcpE@hOsM3dsMw
zbB_M1n8GiQe`t3UHd<S&MBTYKjJtx9l#~>#t3$bO8P+*#wla%)??)xKe9Q1#Tv!<^
zFdvhStasZ$@czkqoO+dbhT<mApS@9A{)b4c>a}ZF@PGovX7=LFghQe@5lq~CFw4hA
zUY@T_{_L%`qx7st_&=1}-JD|M<J*f>7LTpN643gcEZ2VH<>9?_>7=o-(f@2=1Z?8u
z5K)=0zE*@BVVZo8n{oTzf{7Pxj^U+ol9lnQ(9}hBjEIG?abKQ?!-6|KQ(R(ObNQcr
zCf)?c%;A)>p#V67hN{p8lHn8D9n-?Y;#|&M%g=<FYKL8-OHu9{Vjd+oJY1R@iseOd
z^?s-LR}04(<fykGiJ9OAm4201aisEPAoqpDL&z2oLT4^wpcn!~Oxuc9-PxQfvnwBn
zgP3&!GV=;WkN9?}K5axoyR5x6`7OhOnrP2=ZD`T|eDi$88&|eHTiU?70h_4Y_|?>X
zs~=m<T|&-9Smqce1%ownYEeTKzgbjfU#g$`YcQQy*`<ZH^SPz{EzymX)f<VlzG5d;
zHHrq1{&bc#GVmiNp+w|daZE$ZvvqYegC>JB^q*KjuJGR4l<hEAL}R_Q@6p@1c%FTl
zsMV-%S;Tzj-crU-=EyLTdSNkd2i+*+Q@{elwauX!a6wG-AvWK8^Ay};AqB_Q1UFS;
zm~t4R@Qf))A??Wgz<vthz+?FxkM$QKN`8%Fx_jcyfiu24ZqG)Oz@bs}crp|gk+1D!
zR(vG(=V%$oFJg``Ka|BdJf$WqO-xQET`)4mxym!YFi3|dU|SCpjfxtEL_H$CR$6Zl
zm+1M=Tqd@ID6bacX`9LX=(4iyqND*)QPB*~ecU#QA#5_+4$UX}Wnd2@MRT1f-bGeM
z;Se-1RZM@3nYDj^Tn_ScE_wOu3+`$&6MFP>tC}|HKC5H2{zvBEs-Gt8@qmZNYb&jW
zor8Va_q;`5#;fN2d&kKv;<cFuzf&<^uQV}geh562qjp;v7p(Pk>7b(&uwxaTLpgv9
zPyu%mTH16bb+c!}p-I*J)FQ)EuFVCUlKU}dr$<^f6LbLta-Z$Swa<^uuyK%vtXVT&
zb+H;S{}%8o8E)dATCHsQ07Y|+#p4r6#h&J~H#yN&RoS<5+%tl>D?i@9&ogMYH2B<{
zfs#_uy?Qe}d}AZ@yza(_Ooto_MJu~A(%@*-pC>xGN=nj!)9MRPt%qlOZ!~WF!@@|e
z7+{Z_>|FG&29LtRepr}-u<(TLCgW*86PtV|!aF}IDT&qm8tX@mDTJs2`r-5QCS#}g
zCc!foKKZwklOhrl0U>%yOA8BCwo{w4Wv0`9Hfm7o#>dC=zqD#Ro+bdh@uTBX@rg>S
z;z1>%%e7`>XjKm)^^y$GDM4)m3SvY+Y=)86F9Xx+AD*j;a2L5YRcV{IoV>n-1Kp;|
z1e2%6fo#!}0{2@92~{g<9NvCY->7PR-$+08@)}ehe0zaA=*G`4+1T9Gj9Z8r-(ut{
z-Dk5YFW;@!mVGGaITNSrxI8p<&>hTtV_!8kZ-{kPUpivJb;2gY@l8OZFHt0#(ePYL
zyPo9bbi|NKZ1g?NGAdgC?P#aS*01`ov@JJCdK8&Gy9{S~HF1TH`D*LI5aWaAo~k-h
zK9SK3QROluO5iBW0PL-}6FB4jPB@n4ts1R}s^}Kp()u6vOiUEYp{lBevLZz$KN`0v
zQ48M#XMxx7;HzMJByF}v0}G#nQSAXnP7Vj%8?6c+p1>dfYyO!(At_z~kCQ8aY<ywy
z04_Sqg}g4LmteX4Y$^+Qd^$suQd9!3!>YsTE`9HL3`kJHI?7#3McCayNb5iaph%?*
zF#zSj`$@o_3VsFvNKkfMvribU4K+-sx%N`{!t|{G>$Q0m7S<JQ`mFiW6ZIj{@p4H=
zja?iVWU6D3B;=grl`g7%#k$q`_S9gX6fDb{*YX9qG-=86g{LQ2wgaZ|r2lV36aQ@o
zYnixWbES*2s&(=uYG$Pf_cURdFWhcUfQ<ru5J+dTs`N~JnvXZYQ%9Ca`leEMMkLJs
z6A4-OsQ!VOUNF~8LF9^u_*eY$Z}QpCnH+Rf%hb>XneIPlH}by+H2$ye(EmUFw*XA*
zfKFP=dj<cH_1qK4arq%e#DL8A{bwnwUX~A%Q&T4a0RNIne?=e>85~^qwhnMG;ILl8
zJ5R`XN5$)~(#n@o&X7fR(lU<u=Ic0fbP)N#!%g+V7tMe|QP%5-iA0^m+uK`Ro#YAt
zTE?n|eulb7Owt4d3=Du_pV3`i>fI?tRoYB>p;7!qzN9A%Yx=vbM07k4?fl-!_55*y
z1q&J|IT$BK$HrqE?XPZpPf1EflYGE?#B{N)NDjNQ7*i2ukIbIw3sr{Wyvr`Z+FFj`
zc@3^Iul3MhzUZg_b_EYnSL+q)eV%@;V0OCZxV1`;^rsUaUazKxhONmHqNQ80d5`}7
zwhpn|ibQ$%JP&!EUi-&|3xvlXRE_^L*Ka+U%b$iiJ3BEaK~h=BlPDi3J_6PATH+|V
zV9ZFuqCE7xySDbQ@%YC4ZPI&q?+tTWlh^a_Y&4&Io!7M|JL;>vF0aitA}j0ndEc8h
z^29X#wcaZ^Xbl>Bdw(otVr&wjLZPCje*HSR9#v<h7p4&Q*7=95D>o0%4eR0E5F6N$
zq$D%II8%e0R~_$B4mMW3dWyGXPR~XAcB0b8>**IAAKS#YsZh^Nt%BRU=c87&+8<H_
zdmtKfIcq(IPphQ8_fvcSm;4iPy{jT0GJIAhKNOFAJiBIp?V>{|v^NkYzlRUW-qF#j
zkUh3CRfqyU9DD&(buzq99CO2Y-lu;AF#cq;o$xgtOP))e9FCpQA}l>~QNRVWI@t)I
z_Q1T4e*R8!vU}2AqkCO;?KA!dWmR<ZlMi5>)@rHMN6Y+JS()9~05obCCe@%bH3Wgr
z^Nk~XA_|$YY`A{yeZ7Z=FT$mM%&$*YyUByNd+a_!=m-*Z)C|hXs;=I!UfeX)x+JHl
z7$47NfWFVm3yN&ETF<CguRiyrq4;ugdXyp{R^3jwChl^Y5H&Mj(wvE6MedRR2;?*d
z2B!ZN8j0z|c(}V-59G#IRmJbqb(jjfZ}xO|@9qAy94QI^@Zp2&`qyCfC9bcxZjp{o
zOmv_@t!$oAt5@?_iB5op1!Vc5p%<zs@bZesj`yt$80(A)8cwG#=01l83asw#9)mbj
z#Ptx$rkG%)tS?vTVs{FpY^RCgO{!?6Z*m%pcfLL_2#9PD74(~0+$E3_gou`N@pPQ0
z)|bT%$uYs64Lv^ZjVmOSDToO)y6<{|xwOGYhw1F?oyZA(Y~r4>!l@FC&^FG)X|1{v
zHy4n6psrhVwQfnZ^s#TFG~x8l;ICG}294ZS2WK?bpUa%}O*I$6p-U|HpjF9EH#Md4
zQ~Q_9g&>D)T48eBk`IH+&Zj)ueG2|ZkBglYVKoTcBuu5ERv+lEnvui5cdtG1?SS!Y
z^iofi{ZP4j-VL3kq??zsx%v6+x0(XL0v1STJlx#iDrTXjRsHoP)ctJu_@GgD@$e9Z
zC~%+;l{+gL8iJdb&q?d2NB)$QDa*?{;P3D*B}u@Z^mj5c4ubxTu4sl2d0%>DcCE+g
zAF>JCfE*<xC|leQOm&5X(nG~)b<S$an1s`=M*g<z0IpYSlMNzBY1Rd9*?p>8?rmTC
z>F<6Lr=#QE{d(0Z5wF_jVET1t=KJT0av^-i7GKzeKH42C$v))J!#_Uei@W1~a@et|
zM2lyii@!ko1m#-3F4Xan_W9GERJM-16*f#RjgY(J7nG)!(sb2UyKu(XA+GwxR#nXF
zFTR*&)u@=~l*>zf&50tb)1}g<D10MN@tmBx+jG}B&EJha!-*cfd@w3tLv=XMfG;KG
zb-=|o&%~U!E*eKo_Tzl{^4pcf8x1G!tI@qu7}4i24LRCQOr8|EQYFO%(<>HA%EIjV
z`I8eLb@hP|kiUvtZhfC!IoQ!>wH)<$ylwg29d-5Co-`pDvi7MK1LsgFb@on%EehsH
zIlA_-G48qby2?sd+6?@D6HBu}ls2)>;{*xi)Cb($n|+O;AY}v=ig~B@%KrQbZii;m
z9#m(Y<*`{3CTitzI+es#_G3@bJcfqp;BizRXLzfFLf}T6zntgL0&u#4ETl8`@kD|;
zrYbv`@p=-hgf7NF+2Q`UI9I^Tz>t5u!r2*A2$gKv*|}A}-Eej(W|=W;c<0E8kP8v?
zQidzeEbl;!OC}*<F~V@^!!{JY^j@rdo!9H>sK>w#Nle$&s%DXo@dCaCNh~Z&O~Sag
z9_4kf-76h5=@Q3+RaWGC2PS#LpT{rtksV~2o0+flH7{)|H<#~k?^E^H1fF(E<nC90
z-cpKtE1!q?T0A|7%@W8K%I@eC-WyUD<SwfYzf3xK0}6tYJW!;$sH-C}GIB^u+u<TB
zE%$vOJe!Sys-7nR`p&K}1sfY1J4<d}K0DGEIPDRny73Y^gm)|uA0KNcyRvZlOh?CB
z`xXfK)G&S1Ly!97a^lV7?PbttF80cbiXlH6qmnsQXl!uS#>SjMy>XV6Q(~_3GS+g|
zs@n_RUuBv5hL1Qn*x7{chTnt(&}9MqhivRn#o^)n^JZpdXl+*Rw1=L$tj*1-YU#<l
z=}njL1XPu}t^lj<<6~nlDKLG(Zl3A|hDRsFU{Q+CC8e})uvi62$X~l&LrAOM7qbT|
z3^Djzd<bcL&b;pqcFok+D>M9g%kOKW5fV(-K$&tGZ$wefx`5PBe@*k02#lRW?!$n!
zL$*UY;_c>SqXlRYitTI}H7vD(gpe9zZEDA{vH-)<&)q3k@Z-$WCFK)VM5C&5G<9`#
zt*nr*vPr|4xdbqSJ(bvNG3DT{TJFN>AHvQhZglgn*ep{w(V6D+M}~fnfkOZm0vF-P
z?#xe+>As%sataFA-Q9azp6CTboy693AYKoaZW(y`UNx=Hb5Nm~#rqB+-NDJ)`!h&`
z3Mn-Nm=o?(jS4S!Cl=~WHF^F>-6?~p<-z0plbOP}ME#Ol+D1x4r}J9QT4uQ4Lv{H(
z7MOHl$L}ib)oC|5bgQnFl)o0K^lQnTOw|YbTHxZVlc*=nd3)A&Hk|j)GTaQmK_k?_
zXXdS{YAm_O0R9k`mX>bPt}Y(&Pr5;II5#(Uus)`JvL)V^wXiZvLrLkukJVRm#zs)1
z%=s9ytj{qcmf6^BRz&@Y4quMc^t7Sc&{&1XOv#kDfbFP$X5GnRCTT=baS;r*<LUF_
zl3P5f74h({amhY?tWoXRSsi63Tp;XwK{n~CP`#Z{Dk^+hI;E^6LpbJ!8^++{+cye*
zD;azD(bIdsZs!B7f1TUc(M<WIcmdb7F+O3$;(C}MmTz^dHHBa%qx|4~rJh&96b-ZA
z)Nt5<g>^;7HMJ0Kw~xwW{?8ENF|`E~;w20SK|IG|#>{)>+CQFodwcR<+f6i)i6;Yl
z>rwE}ISNmyDs)?awr{)%YD1SDEImCvq&EP2biB&S&cVR}i0m61o~ye_ycYDYUl*LB
z1b~{)!&{M=g~^Bvwwk=xJKdw@k+#1vF5@WZJpb<LT}qomfMhAP{C^DI;z*XiHvZ8n
zv=Q79QYHk`h@WdPn`eqOddb`ZJ+=LGgU%DRnAEqGoo7%!aL!r`Bot%)a<Z}{P}Li7
zo$zY=7**TF8QA25-ZLvQiwyky;9a@VJws)rrsBFAfP`JvMIiD0h!KC;`N(;uVGI5|
zOU~17J+H-YGfWwWqF&7|->UoVNqT#sg!&ql#v-P?!n1bFwwd?(RkZ5&0pg65iWldh
z4mZZDa_dij2=TP{^k@t+af-3t|D+7_eKN}1TMH{6^c~bPq6bxRfxqg4PW>ijK@n?J
zL<pN>K^DjHU_&xhS$^%P!qR&$vRk*3hfNeav{hC6AW(plvuB|uY1-1v@}Xt#`S~^h
z^0)W|EzyBhrDlAA<zPI=CEbk~zxEH^=sgwPB35+Q12@-v<Fwa<57fPdFHfC6mzP7F
zO)J^$@0=41St7QI$4`v{hU|_A1yRjPDec~N=`_|TjTopqCmF|&e_bw!akPF`aV<;t
z#4v6(M5owAl7r;0_;_<Q=W>k{h;e}pi7C=;bFvJ3jhWf&$fz^+(#w>VPov8r9bdbU
z$@1iEWNkJT8Rtg0nR5qil)pZ&-va2)q`qj*h&9H<sFy<uXID2AN^UM-ELQV7?71oy
zYK=}{-g6EvmG<KQu_wzvNk4(t@V?I|D1?QEgpf|EVM&)8$pBI3Sql`?S;{2SkieG?
zl=)k61vxQ`3k$5ZIan-~ql<$SFaN8r%uFcd6H<*IbGaLv0bXo(=kZ>0f^oy^FLSWz
zuL{<@Aw&`SJvNR8Xyg)J{9v=c8TPDYw)sp}H18Vu@8k*djRb4rFKRAHa{t>~Z1cV^
z4&+7i3rl2VWNfu{@cwdudh@OQFONAqjd<vnb`Iu3*Q(8=rPvOGsxl&vKTXFtb{VXl
z-0lJgWKq#o*42Oc1J6(z<j%FZB+z&KANp_pqahBtcK)ss?2lp3y^yrMm*TNY=%~mP
zLWnQ{OL%V11eE7^kHXEy*<&pv-8AkvD=3CtzkVHbW_WmfF;*3<bW0I`nwrMHi_5%t
zDL+~v#T;9dA8}10;?=8H;Z^3&*90%zLG!ho%NeQUlSJ4Gvc5zyuyb_F%gaNuRNZBe
znBl3sRfy@#Mau=}ysgWWS|t?xg6{wFNhMh1Hq0CiG&G)$!*_l1PgMvuHvvCdhFG&C
zMCThFRo1_GRgLq(U0rAnggR*b|9%(ent_3VFhK%u1MAZ`-7E1yf4gp<^C23HFFu0>
z@HedRUqYV<@8`dQO!B|q#(&=hSOfp1q`UvUCjalPNt`%b?ep`pD@>{I3I0Xtcp0zr
YkKY}CC(4(ASMX#dm7bP7`SbPv01C1g*8l(j

literal 0
HcmV?d00001

diff --git a/docs/codex/artifacts/xirp/knowledge-narrow-editor.png b/docs/codex/artifacts/xirp/knowledge-narrow-editor.png
new file mode 100644
index 0000000000000000000000000000000000000000..e53078ff2b037f848e6bd006300d2a84999f0b0a
GIT binary patch
literal 45707
zcmcG$WmsHolq?Df?yf--+}$B~aCZqB2<|Qk8azRQLvW{YcXtUi?(U7#_}$;goqL}-
zbI#0<^OFrtZ+YKUwQ5!E2vucSbQBU47#J9IxldB+Ffg#5FfeaJklp}Cz(RX`Ffdp!
za#G@&UKuBu@P>HHgoEJ@AMjNr)bWI1kl&*ApPijmT8Uj9)~?sKwhF0MzlFzx6aSEO
zhVa_CI{geWH-)FzW^KEAhITIsd7iDLW<I97POJ*N&;I?pClUUa8poVA!Pq1Y5uV}d
zSjw+A#+}}-uN^w=E$&7}nZ&UX(UByger{#jELMuyBZ*|mAVYKvjKisp_E2f}J;KYo
zhRo(>0dtu+O-)VaP1?_$0c5;pZVt+4FaE7NJ3B<VCr~1i7q)N<t-KLMJ<8EUKA+n&
zE1jb5grZ3zhx04nM)Uo%L6t1_cUXjkomP;SD?-*93N9{A^X;wNJTWfIk(l&GC#0Ng
zQI5{v{*Ra@oz2b7H0vMO*eJqZY4#KX0z@S>Rd<ND2!l4S_a9<-=jJkn-1}q|6ryB}
zv*hLF#{%);;qMg)CrreRvsn946z*#+Bj3}|SPuW)CC_ZBvjaQKop@77z6R2DI&E&9
zW9N~jwe(;J`kXZVc^U!Rwm+g(c{-iVHZKn-rT4EZ3wfSS*BgL}CbRAiz@9yQ3}3%~
zr6=aMCTitnr$?f&n#c;bJb5!Z7@Muz{>A?4cg0{#HgsoLBhh!QRm^|jU6|EKSZ+^d
z>)l%W6$D)L+O|%>AxwJ2f<nk_=(2ax>~TisjHd%KemtjYdhMb*xQ9k0BqVg+H#n}h
zrwjTQDsb_+1?*Rf^t<!Fe^18J=w>VAu@Yi6nT<LET5sa98G{y1j3c7GYkBQ5ZNL)g
zTbnk$egE(+?qq2TBV1%ZD*0)x&?vm)8Sx$pMS+NjiUv%qtm`-0$C06viV9M0h!}_l
zc2n1R%wN6yP&0Q%f`^B1_ql_t)nXdbg+V?(-`rvNDOHXeD5Z;{S|zPAGBMfSM}kk6
zJYC#uc)bpO=&XT=bDvbj9VizU7q{sYF9M#IR@z!}a$tAfZYD`0-fCAG-v8ZYBC;zj
zWkf%kzq`2U?MHd-)R`o|qwo@szP@%dGR*kge!13c3yO?9D*n|QwG2;91{Jb8dum&0
zE7gj*yh2sYEzmkNK&+{`P}9=FAB~8J&|Rx`#q7Z?_IT~?ZG^lLhODTnYtEKxGEh@X
z7#l0A=;+AF!3Kw~{~%}>85-+yQCGiAC{jsE#CuQuo{(AJ#za+5OY78Dyt~~ObMCp>
z^e{ejb92*tKv_{m#c{Ewe=v@M&tWM(HC5p2me(|f<4PTV5j-kp8+rT1g^>5wC$0B+
z%Z-qU3?4)>+l4>h*9|(w<|;=gCVJG03JT02{Jtj*5fO6Gl%H5^drlS>76i<Oevh$q
zV^}F45(*VZhldGH{Ga+5rj!sLX=_|u;>bn9xL5Al;LBJzIZ-NDjBb5xY)E`JD1w4>
zcuur!Uky70U#V=Fn0y~;Jt00@s3Lw&oxgr<LPm8mg#vTDx#n%arCB1LrVHn4e4x+M
z^Yi9EE<eIoTV@G+hcW$~YZzFZp~Ik9*`Lnw*VMeeM@_D>nap~IwmO`q*#|m)Kl`X{
zqVY#cR@N6hvW`i%(s&!E#iY$FIXr{Y=M#oTa=r1A8FM`UTvhlhXERA*|7@j2yFea)
zWx?P7`5hS<0dq=})&Mx#6S8zRTUT<ReShz5rA#Ikc*~6-%w4Q>JVzHxX58w*qkRv(
zj1D!YQ#M<eOcSs_O-qu+I0b3f9|0@$>he-5JqT~D-Ji^5s>%615t&Y<p(NE7Ez#dH
z9oF>@`_b-aU#cd0202BkYbP@^GfEDuSPi;ZqYkftm4)f%=Jl5EQ)Ay={Q2w+J8kzH
z$d(&;tyL*%kfyQgv>P2V2QeY*EzZ)~x34;sW0IfHTKsp;U&ORQDI&H$c6KYFQEhA&
zNq0<7nH>I08H-$)C(G>~<E5Z6oiKVjO)P`GQ=v8dl`(K=W|8$;8?hph7eP}hVtB}g
z^78C7>@HDDmZw8a`U1E#wDscVn6I~|r@g&hEk5n{Z7<o)$zmo0u~Hg${H{i0>}pK<
zXOr~V5{<`j13i6x8*6Km?%6*64?B68nPk7qbohGL%g314es$aoeui@1LG>fPT=3B!
zyv1u!)gTjDs_n*L77l!QGohobtZbr6*|KwV)N?)=R#Jj|8>DgF8yi8cY@^ROa(ZH;
zr=MmH`>W8h6J$X~0S_NaFrL18)7H2b=Z=gV!H%CAn6>6$)Uu(#P#5L-(k2;P&E>v?
z7PhYwb`h6+H!ip!6cU<wv{vic8-`B8XR|Zi-ColnDw&AO_+!N4QudF@n<S&Is<F|1
zDmKsuzex)L?<4Ll{v~~VbduSbsaXqo1Yx$#IC%Kaoosk`rO14_QxbANlkR23a)Lt{
ztMuQZb8>U{yvacF3MB&PDlsrI)uP(D2_Vk&S9xDL@$T&Ibeu{%<)V;<ZZ!4111>h}
zk28$FY;U>1+p_%iZ{1U%rTSAvB}J)6?E~%ru{uW#LSO5&w4|fihT4XPfy)(v+CP@_
zmFs>NTQpA~qgD?J;U>aZe91&a;QVJxzeaVI%TenV>&<8@X@SSaK5%oRP0OyF;^N?F
zmm9tn3tXBV9*oVD%53-b*u3lyjrwN&)nll*m|pVDMugw}CA_lK&|n<RI<Lt4;CnqM
z)d0tJ56E1-yDgueR0;wWz7&&`?OH1Yei9q?4&u8BN-BV#ka6dl`5BkvxZcqV4d2Hn
zc|blgF*iq#3)@_jTF<SZP;lb^{Y0_dHTO|yX=zC%OBB~jQ6*b6ysz%->d~aT?KuZE
zHI8Ww1+Q+xD~;J3hi*q#XNOJpfG48T%F3`uIJ9><g!=*hj~lb&>76jsG;pP#EJsjx
zwJhh#^@{Wk(_zil^X0PFM6j-<Q*djAe^m7-tEs7dU2fo+^Km<<vOHebD4KL}oZp+y
zqjSm|h$W72F%mJN{kiyXx9)yCE8ucXq#<ttuL*JptLC=rD;|g;S#Lhpi?3iF8|RqC
zhRNb^o%q@PHudlJ=Jd-+v+Jl%<pUl;R#sL60B(J%AfskV{i})0*7q{8-vvS#sG8_l
z()eUelUXx4l0^OYPB2cFH{DD>cwQgC`1VDLnf3NihoO;13~`gT;HcEwfNj9#5m$?i
z>y%KX6#roED)NNNEQ}Y?zzdhVEdOpQ3I%Eo7%DCu9V_dtYvS4s0;7%|)Xm9sp)$wp
zHS<B0kgQlD(R>;7<?|{e%}RTnD5??UU7m+10cE1e6R`#CreufpTf#R$>0jv^D@#p1
z47&+jIFC8y$dfe_wz9A=`AaxMEaKxv$`fD2Ia8#>%gfv0eZ?#D#vxwuP_NEJbT38J
zA4L|%Z0rD=W)aSKEMIPWy84*U;bjH1M=}d)^a0DGyWgOb@@@VoXJ&a_YbhC8Us6sL
z<`5Ny#W6QAsdDP}<8|V)JJ^`clcD?=EWksA^pj}Jfa3{U)cirSF8J!6f!XfkD@8Vz
z^+=0*8TMdIbY#oxM)w%8#v%hR%%;pWVZh7-dO9Z;mp-?rrToAWPnl_+w}@Yz-|o@3
zI|#=;d_;Hbi(xAX!hGfG<Cn1vvgiA&G2$7rcPGTT8I&5`S?pbP4$8_71@h8;dhB$$
zWn~5jRwpR}bF;HpF-wV9D=nKGhlhtrx3ZQ$zCB$l>unU76xkK)q74r-NN2|^=q@ma
zK74DY;!kpdN&O4sh<e2E;0L20oKaFz!chRns;;PLw>$C>x->R4q^O`E{VtM9{@b;%
zsp@oqQ%O(Jke0M@W)MZ&)4Qhe9(5D>$<9O~n5&8p;K)QG)tz_fxkCj>M5-CF^yjAX
zn0@dsAZr1$0qL+9WQOp7IVCK(#-AftaNR8VoN(e!s3mCPSSu2YlK-c}yZk!F>Mop*
za899AJS?Y@=W)35*i!eohD)4;tVS0Br$xEB8Ck#A^5uGOPxYg|_~OLvKZnPV&gp1q
z?3&?%WK|}zTJuXw<CBv?d3mc#72fSFViWO$=kfhgBEByxe|s_*IIyvQAxFr$+h~x$
zN%$}XGP-W>tzvfPa1|-3YH5uR4XxBde(sBa2*!=%!9(qj#ys}+@&%j)OZle356=&7
zZ1nWs>}z}>RKbi|XlMaXUbadGwom5rlKgCXce3il5^2BE`5aj_2=WUHkB^Sn#T5J`
zay^F0<3ydH3qQsE-QBz%)m2s5c`FGBvsG84lW#B1L_phgD(k-INW8I0G?3K0u0I>c
zd=NOq@OJ_MjMSW^`daT(h)DSyqhg}&F8q_TlO2s$xkW`c4=xg{CO>1KKU;iNGg4D?
zhP+5}a=J`~)?Ht-1fJHFS+?2_8gDA~-LW$ZQws>xHyA1D>hjY8w4Nb18(ey}=F9$`
z>*{<OmzbECU02GN^xfsf2spjmqRUOt=V>-?P-S;#C%Ut!M{=_ow+P}T`bj~dmlm`R
zHEwddx!O;mn>6Njx4VR7U(qt+$jLFhx_q*+Nffk|{gqgIjPon1yxdMQ#{xABK}(-|
zyWM8)v3|04pDhfXoZn-%>JKK>T{}5f8y=mvXh*=8FJHKdRC*}=o<i<^2UX{Vmz9;o
z5DEU#<DyF;eZ(NIZ)ivpvIW?cOn6*Y5O-6(UBKZ;eMZKL?YslH#J(sehpG)(Lw;);
zXMvfWfuW=$01}2lzOVvrK3Ln^DJ;0)G=G40_+M;+hc<%|F;4>LuV7~pLmmD6vW2~Q
z-KM@(=Y<6#y+E%Qqgvcgmg;PfudL>-<*w(rC2Sb17<*|m897njO6JuYM2#ffV4-}S
zZ%6_`8t+^*=jK5=^U9J&tKA)HA2$%gk`*<?Wwd3))zplYS!sDi#n>kMhp~B;m*-e|
z-&5Dt)G8@O+b+)W`#iZ>>v~1)O@#7duYHx5A7O$}|5XY=!U))>Kr-TYI-sYX4Z73f
z^K|Dd&IRS?YZ^N0ndH~G*ya?KMU5ztovhy@vI{3&*shjJCow)eJhVt6-f@A9$yyjd
zlx$2)I+u6qxP73aj8&MMYd0!x@B8~p>eNLuGjn(MPGS<D7QyOj=aU-B^o*7?!RXK)
zgZ{pNhzO$=KlDcqCMG5hs_ChzKlbUrqkdN&Ew{Epb^3bI1OhMQpMBg>kUzV)j65S^
zs_BA<y7DB2k{}>ltetY^%0^}^yr)(txdeNZTfELP=W#>#MU*sQq9A(0M6RT6r%)E$
zhYQ?C49aiCQd8k3gjTXfWGqsW3lb?rOH2A<)=^@}m3c<U-DxEWgZTRQ2g9yh8VQe>
z<j<1gQhVd1yv5<gF~#=%GJ&aE*y{!%sbnYV0E2jMh*XA%f+`fXNp}smLxa5=bV<l&
z2d-Hhp4rE)>F3O?rBlfs-87)r{{0*19jLGpva<sr-I5o?D&W~!6D5-z`6Nc9&^FAS
zcB&7otmLpuZEbA}P5e?KVdBrLNdK+{V3PeQDT)1hD3OjQaW0XoPSw$<t^L~=lOm4}
z=)n6kmadZ9_?VV-4c1y;u@F)H7XuFt-UiSkB9Qd_&2<c>Mmo%ST16uxOQU>fcOK<M
zb3_X9PYAO+=vy4#yh={lW%7n3@bU54&a@Py$Yi7~WefU?K3pZwIgBG>8~|+!arD|#
zP>?eDsR?C<s4MpF$jAtp$O@n1s#>eI5=(`APdfW6$wj++_tNC&-xW~FuwNXUoNmsC
z;}9<12%~BnqX2PHUhzPptZUtsW?#q6_@t<Sbe4w(nV_EtBgaB$P6=^Qar1L?tayJI
znwc(=;!JM&xR@05<m8?}k0|z+5QbR;MdAC0drXq4^yi^Kwl4uWL#*;uayjLzuP-r3
zQvH%XYo@BkY)V7lJF>E@(Ng$M)oZNb^|8oPe?Xtk5&J@U@9&WA=EOFhlWh4&dCJ*z
zqq=GjcCb;TKcjubk^IDEVXlA*9#`C-NR#&w*A)I_nGe4Usa=Ir>!wViLJBhYWQi2C
zL7+|?MA;Oo8AgfZK=r>qTteB&9TO4rcuDj7o={3khK7cQODckap8ovi3S<KMMcMQx
zW04bhbf4P;NKpj@1YG>8+Du-?<{ka6E?t%zZF`@XJw+&H>*~KQ{2`Z21RCUP(#EqC
z9X=MVc#kcyPXZdmR&=sYy*;r;kEiL}<pzVXR3AdZ!UnDxwuytF*!Xm;fPm0ywch<R
zE*oHF4|k^(#Y4VM0vrAtH>95N@d?MXmEZ!6a0wM7S=m5Q-xn7PO>RY^@4K(}u45%!
z`)az)H38XKM(F6?sbkyQxD!TAcn=J@Eva&oXPF#bZ-Rq9w_R&%YWh773@(k-C>{Tn
zjmwNw`Q&E(cM8~%b^r!?KAcFue*36|eglBn(R^8O&nnPmH<WopUV5K`{B-sUmB>y}
z$wC9W9@86ztA!L4uE<w~m>B8H4LU8C5-%<<FIBSJyOa@c_jg12T~6x!6A<q2;SYjK
zBQMM5MYVquoG#bTfx+G14V!(o3+_nui1l=m3!!u?0Wvas5gJxbzh}YVR`**I4UEVv
znrWNd@x9%B(2IHRlfcZhgrVP4^Hs7~Xs8Yk=h4A*W$7=f=y5SV2Y1`WlcoA)LBS<^
zgGP(H-RC7hVOmbr)2p{x@;E(FGgN+;QS9Sx>$?`1k`}Mu8IY+=es+NGJ7H;QxekR^
z>Nc>8Qsqo3FU|z)trU1d-e`g~^;_#rR9X*UBgtc-R|u@1n_srTr1<y+ycPPQe%EeK
z3)rC#Kv7_Oh;e-O)q!Lg0VQ+Mu|lo4rAa?hxP`*w&y%`y7EHkN04T{Isw82cps=tO
z`3wgKCoWqU=;lxBhPSKyj&DUaADU=yDFkf{dP%mWKC2{;Z=gG@x6l6x$dv9JFE!UW
z-buYe6N6DZ5J5zHJw*aw$_8AQ%H?WfXZY0JJIL`u7en#9vlx{^WQ?=!N?2)OwXc}X
zS?N2kyw7Hc9QVTl3gYnEzVf&p$`NVxZ1%brL`Zi^Hrw8cB@>%zP#V?aqAe>eB^Pog
zVa;g?^MMOo_JoB5OG<DwRKFu43K7@ZAthnYeIph!mMUQR)PxOcTgOA;UA<@n<>WM5
zY_70oF0Hqn>aFPERA^h&0@}&R{bDVoDm3)IZE?ow==Mw~BPlb61DBMPf{;|q|H!LV
zpNGw;dEz_)njz?Fx^v!Lj7%JqPjF|yCAE6tH`S>!8L=%J8WQ3o;@9IB_#WPm+Yj6N
zvs+QIEAR-$#uN`+;v6!8W%dn{JM<P$<lV(S`aZ!Whr?KvX)xkPv#EB8=kJPm&oM=X
z8(+G3-%#MD<9WJm38_|=@H4(`XXmI4OBXo9VOJ-5ng60QI@i-CsEE0u@Vs`9Iv*Di
zVcEgiv|n6W+Qct(ba+(b?f-apii|6%r`IeVEV#MZhFUOm_m2H3xo%;uN=-+n%+y?~
zcL3+E48V9w$);-a3J_#@f^4<gRzt%a@lmF!wdT>?%{sTF<hwC3sm}BHW}Z{BQxdq;
z($?HQ^b=x(|Enlcn%P%V3{sR}Mk=b|$}cfhRZh|G?Cn`@i5;f-xPj*xG&{>}&r-pV
zFkth1#iB!mKop{<r`MDhOD0m@RQo|+NwM}oMLZxN>dOQpBcl=tUtcNGi}%}c?;;&=
z$=8I*&mCQ&BctP?O}&Mx>gps@pk!z=n8)=iAf^$2wqE9S2!c#Zb-}bw&CW7A6tOc2
zdfLTt*%`0eZ8c4^i$n@^^@P8FX>0c<oNCcR^%wbbJlAt`e1|s`^z!3=K*8(ZZZ3Jk
zz#X6FSL@>a{i`z~cBpA~=WbxA9u`6eH_|s)pdDd?7K1>8tWao2us}jaM$eZ5^GNSW
zSOO>iS{j!&3(fV*ufwCmy>}x+Lqik8m70gkz6eeno65Sy*+(`<0s^lGIA2DtJ30$d
zS#jEupiOX03ReKq%gAVfw829oBX4^0D~yImMxK0aL)WKNi#*1E{P=N`{!*D=vUzfH
zV7;#EMQE?z$nSbf9oyfx(BxjW_p^$6GTxepWBhV`@cfl4B3K%k8!x=8qYV~yM1F+b
znBB$4?bz*UM-PpTi1Ku)jvzrg@rKh2wWY<``QqeK?DHEnuOb;4gelo>Xt}y{Hp3n#
z*1xRC-=W$Cj^j4S1wn+@vSWP4J$bn6-(8fXU)mMxOSLXS-LIY4Tv#gmcXnP$3x48<
ziMhK&50F>d#}$>-)z!5t^(OJIvVudToDo>yJ}GNscsiztJq>7Jr<(+XG&Fdqn^Cu-
zZPT!@kOk!y72%RS!*7|{Tf+8xU+<(kaGung^{zQ(ViDOu)@TnT&wrU0ZJ?oadXZ{R
zZhZI0?)AAJ@tx0lt3Wu;cF7!}EtyfKTKnb8`dW2_B(7+J6JlT6$6U4E2k71XRWhLe
zuV1vyH`E(A^XP#>I)73VZN7<IVHgm`V_^|7GK!(wt%9?RY(|R|Rxq0|NMcOtrKUE?
zH@TlFVxL|kxQlr|6#x8e98{(-HXZT0HNt~0z?EKL=?*8Z`#Lv2`TEq))MJZYswt<W
z;JZJGiVlb1Z_<8{v0@1K!@bUXesH^pZQ+O0FNgqEr>)l^JKvel+J1zz&%?|<TRC%}
zU%#%N=AcqCy2lF84E-XMO2$s>R(f2FO8${$hPS)B8y@hWxmv!^c(B#szrAN<Sn~t1
z_m=hACwNrHaYOSX=gEnU8GwlTsyjgaqAk=5W=xvl;#}mqKh*Hj)U2y^uBU#yy;m5^
zc~8d<MMo=5NzpVX?Y>7wjl-(&TR+COV2yi?MRco~TH5kJA%xtLsbqK%5teC#Wbr!x
ztvZdDlsw0zd!DUbUAEnw56=+hwzHg(hL6ADLJ4)c=y^}w_bwBPk!Z`<z+ygI6FNG;
zvJBu7y9vVeF-sc(&GW-Gzw^<`@C^KUrR}A0z=vSpKdu_#T7h;SE%Kf75bTt6Z*n05
z(9Jd9n}Zfeml{9WPev;`L@9%SCS)@~01+3S<}nNtoo>R>jz)hQ=xPSu9Pyl>GN-4f
zh6JDxDm^p7XxJIYWr+sfM|!Rr=;O6eQ2V%FLl4X59X51@g_o#A)&J%0EZKG6=?P?@
zyWK2Y%&@CCRX*IF#m?vsiCLDY>ro^nvwY4gEDRGw8vipjI0%tE9~6K4fLCf~YhLSf
zis05YR!8zB3XsTMik@cHh>QG(A+{Td&4NN{=LNFYFw&TGEG$Z6-jaz{Lw^EPneZ(O
zDvg9OC<GXM+@u4xD^}7Vi@pbkwK`!4NlJ>*{lGnAt2ERwUN==`#2UiuQ<W0WC{X29
zH2lNQl}i;I-?sk;t0{U)xrBGqG3ko!vwW0zth4S)6o<1!qI6A3)IaQEE4_ayzAY1l
z@BB@UCs#(N7qLfye}YVp`<&xbnZbPQ0JyZr4lj@qSnkR~Eqe43HUIDdWoJa9cbC|l
znvKf#%wp$0@2)p{tEk?l=F(r1vensg$kM%_C8HdAhj#~V3D9!j^x`EsHS#Nn7hIQk
zFJ_-629yOpuGwDXwGZJ^>(lE~cP!#`z{K6{A?K)tAUhK7=LV9#Nri5f(7O~#XWhoX
zQ+5uAA>0GnOi$tV4gx$2i!T_Yf3q3FaL&>g_6`EhXoA!y0(*W_<)`-Le~8|c2t`UY
zwHQh6XK640MmpLtjdvwmz@v<MVH+E32N2D$;y(5#IaZmGZ#77T*{?L}UTzuxNog4k
z-109;Awzq>8pA4}d;k9Zj(M@Q_d!urU7cGPrF<9geR9gmBJK}8D~lSTsIMzkJe-XB
zT3R$>oqtMynch{B0eb~6mFBq7o2vn`aBQ+ZwE37v15733R6gN7Q|bNkd%>x-y@TcM
zIj4YIuiuC9m~A%qEfoGX@wvst|1WepbOdDF39e~YkPEPZIs%1U@slFXtEwf{-x;o~
z&TEIWqrOihhlde;_YfaNA0NR9WefoLLJF?VFKSO)Z`m@$YMYq#R$Dw)+V3bu&E9bG
z^1fWm5ONhN1JYCp7a=eQ6~e!=##j4sK2*H15m%s*8XfI>*Pbt7nO{hUQ}k349S3Oz
zwm^P<p`L!q%^{eq_hrvsMUQw9vzux<yOX>4bE|(V?+Gr94rtx)_9-c{#$}YC(u_n?
zUEOBy@Aa+yWJ(JEErYR|Vssg}uEP0w;FL8}gw?QRr7gAgw{`(FmqY~Yv*M>u?*z=)
zA8n)Bo}Rd@*gE|8K}ALL-R<?>?p%e%ZhCft^mh&R6QA44i;Jgfnwb*SnieIR6RV;m
zSn~7pC8*(5d@CQ!p8-0FkB={nE03Sr9d&x&{)l<w<}SR{$l{hFO&-dgbw?rU{lH8|
z*J%3Oa=N;_v7nH$j=I|FawFs5um)k8pGXyeUuQ`3dD>x!odx#~Pj_$_HgtNP5Q|!T
zi;eX#nF<G>*8Onj;_g<Yq~z;Dz6!{pN9=E0?2F&lY;zM7S}G$0=<Sx-`^>YH8j82&
zpwFFaP2T&5SINK}ft06sImh1sFSjrz2K*Kz3k($PXG$$|P@n`TH&T8Q^^r;fQKLJ1
zduturi)B{x&9#L<ue#cP2NSB7ni`iadb~63u#&R*{d@O!aVmPhm&>HM$z?$F!6f_p
zx|vr5>}2rI%!IrgsxuulvX$jFpHtVtD_A??Vl)lSQaX;d%Ya}iZVM-|ZpUg?<Ce$^
zUe~1$NQ0a2>9AoLIE@I>F-8XG9Y^}A+kM>Hz3%m;EM~<fhs9ikA{tcB>%aMLWzcYN
zG;bWwQ{&1<d^vxkrZz3GxOnwN#ogIM*lUOX9qeX%6nW^mKGJ#u-DDUB3A@MaIc9g<
znyLA}YXKD5qT3=?x;;<ERqr@_Y?t&W(?pSRwznT|`=fLY&Nse4LwrP$Fz$;hE9Z*E
zMKZ858m|aJE%kPVWo05}2QcnDJa+1zAe0>AhMDJ<dIoyJeq*iVQlu7<!)&4CTgE~0
z7v|xQ5BHMO3u*tamZewsCPbx)ZVR_m%WEWcgr1&$BMa~k;OV5;quZ{yFS@KCIB!>!
zgLGOwD!M4wdS@Kh9~vFNZ)hHTd|1+6#ZG^Ivs;@&@!O~Pp%A$K{k^-*yhZjR8^#GX
zIyLo7i8-P+gOr8{zO0%0-%y2lRXwk|&VcPG1Ddo7t(k$LA<AnFFXzLWkB=S|i(`tw
z{xqSGBG`Lv&Wv=-!IGv;#2Me{&vIR$EG;cXC!Ot$m3U3P`*=+sGT(7=(JL1m3h+fC
zHz%>Hqqgw4f7UB)SX+?r8O_P$d3Bz)1Ix9WJ9_B>pL>;+E2#wk))p=Xg~-=0HbG@?
z5Q2hobI~9rpZX;*Il9?oyf7HidI<>hoY6U@cawu?q98g33a9{(lu8H2n%ee|_B8N+
z&&B`OwTPl3aFybe)Mewf`z$CV#79FTedjwt*B!^eGYej@dNSX}fwN^gCcH=(AB!&k
zRz+DH5)@=;->Od|SF7LHu)52{=j3TA7Fp<nQ+s-V9ZY2t9-EQE`IT7;WsLwWph@CH
zzZg@Bi;e9ww-LcvWRoKN;a4ZJKs1(&^__q2jeJvqdZN#k3!xG{O<H%<rlrgME9TKA
zcYi+(5(&d4eaPJ#y1LZk#stvtHr<skhhKM3Cu%bHA{n@395r=wtj_+l!Sgi-{^|>-
z+2Ly0@_m#}<$9aZ%p5{|%$1%+u%g<1ffLDOM(aDAOYCF{x5b0j_YC}}{aRR*qB;7Z
zMHwY%cGG~hA&yu?u}q!D&;DonmW|C-yrw_byZHF1A^w7bf<u$_de!JWO}x~j2!<9e
zefE0x`s=yZXK)#xpifg7rD1+Px9xz1WlqsHdjWMCE2_>11V4R!l5~Q&<jNALVT?5G
zN)Ijj3OfuXfi+`xwm=HD96dNUHOd-+?Pc$^u~S`LqdbH>2DsdpX$ms?9~}&0+v2d<
z*`pBnKNuLdN;VfbZco9oaoIh6t&p3lgz%=XLf5cdmcXzgMN-&f3oYY#iv(|+4L%UX
zcr*GC*Exk>C;HQ;-EjOqI?b~4M6Nhw<;dLl_`)!Ru#qdmHM2GTFQ%q1UB?_|1RF2G
zgJ_693VkF%So~v~Rs(qO!EKHZ2bHW#W9e^}3QVqJ;wI;kvL;uu(y~!<$)P5&Hid-+
zBEA<RD=XzqtoVy>wv?U-Va{`rkua+rZLyT-wJZ?W!o-fUI=%YOKSvW@a*S!x%gO(e
zrCOmNwH@_+!VS8;qY#XA%-6hcH<|4l=&#jIN=ho2?;YfS7r=bWy5(@PIW)xiJ`7z-
zkuIL1Qe8t!dIyOGwJ{iC3Hjd3Po-)jb#WEt_>+OL6E7N5Ny(ia>CB)F=J$}Ljs^T?
z7GA0xYQQx><`=o1er97*+&D+3pvVf;TG}k=iUeHR4cCB2809^9>^I5qba2<)y}bJ3
z*L9c}7zG6cs#Iovv*ea!Ijyd=c_U_W7pq_Qmb3Q=`P2z{Y+Xl};QG2lBE6;(ifo;7
z_#8AT8Zc!3Shp}oV?Fhsf1`k#cC%TM8UtxYDl~!D+HcmLWwD~mbwIoZ)M=`vLukfm
zVvOIrPIt@rIJ{as&Q$4->krhBK<+k2=l2RHky^*>u5iw7HY2`Vio;jFi@FB?p+uf;
z?ZDL9E=G!35D~wBFG-lZ=G4Jz)GYdChdtvSnD=Dz`v+WxOdklN)qw-;h`9g6CGGOn
zDkv*Y42-zU%$>G9YKR9wvQ|~;mo^$fS|2*`a(P>C$v>78&XpZ}(0Bf)9&jgU>*_+s
z4YF>PNTj7?B=_E(kje(W_&x8Dg{(2^zJ$A^-orXnS$ly#MUH*ZY`~Mh=@X=-SvQ34
z2fjLL&>Ioh!J*ZHnFu7!u#}ihTVSR`3{;tr#B)X)RV5e-p=icUMv|Z?p*rd~39tDo
zSrp4t2JZkiJ0>W?)%_FuVe~oen{)8S2t(pgfoibXr2=wW+ZKI|L{1i-ycJE8z7*k$
zNaFqG=N!W=J9V*SsZve678?cM2s{CkNX29t+SNcgeR_3x6q-b{$jOZY=G!yIfCa+l
z<M=?Ho;=Oy-}sFYFn&C_i}{guRYOneTQr4DD4{;;D`4st)n9*#XbQ*-&qA|eD4Wdt
z&c(O5m~g~kOQP$7)6)-pC6HpFpxxvLp8wh8?$apOqKk`5P&6Ez_>;n=7v`e;=wo1k
zv}IyaVvVZ{Q4r-wP{v6Hg{a2E=ud*A>GJ$vzkUs4!Ko1db{x6MV1~cBoFqp_E;TL@
za>Kx!@HMut&!S1;=*TA8jZ(V#l2K>Qs$-<DpQfvLIFATjJP{|FBsz0p0S=g1`TL8=
z*!-*%C>%*DIGDwfx|b0DuBN74^1)x_d`6M?zc+OJpN%LjOE|xacLV3yC&r+VRNYWx
zf)rGYm6$XAksSB`#`pafXIG=>y^+*-2TYjHRs+B78Z<(hni`rso)O+FWpp}Wi=ZJR
zn<524>2Mk>TRb55XPKQ&5qWvN9U`qLTE15Up3ApnlHq7Jdq?p<e_|0*P*4y~RxUNZ
zel#{-`}6%R9zH(tu=DBCjgY6v@mz(ugTsVVZwx75rs*|kZca^2<rI@PGz8S!eRp^F
zR*%CmtUizgqcCmbZx%E(v;|AotD`NZyQ9TC4OvW}`Muo+Onh9NoNDxXN%!y>qP`O|
zS6Qhghbm=b`)t{-x{p@qq@?P^TRPPEj9g9|FtUh`5~1^sE5cp}PP)2HzO4;OOvk7r
zab#lOF9ZA^>g<=loKKmirs~n3tQLuh0&{z{rqH*Dn3;m^w8GRYv$J)8&7j@)M#>Z*
z!=D2kgL`l8UF*Evuc#yu+^-ML_hKdi|DR@=w*BL}ff^knqtDI(M-ro!pr2Eqy31vD
zpo7=-L3MPworY|9Dp%oGYwN1hyi6t?(C*$|EICh2ljK#vv(NllJIL7E*1EX0rD-fp
zAXBS1F)^|Jcuvg!77b?+=;e`d2ekOOB=0l4uK;`2-ehL&>jo7C#peUa`KDyG%}y}~
z+vg66&~=@1VV{$}Go$5dzugh=Hl1?E6=tzk*_Tey_T{>-F%ovMGDmYIGfmEUosIT7
zfL(5;mGEWt=K9J1o>3F&9$GCqI5AVGEWV8<?iA<NXW8*W(EuZ9`4F8tncdlSIjm8H
z`A(R*7&Y#&H+%yc;w2!U2Pi$j_Q5+kI4UkHL+0~7Te;t5(l)h!4S4=LGegL#|0eG3
zE-9cS3Yr+u(G_j{{7KAZ)#<luRQqL|?X#H)L*E5iwQL-PIbk6!EigR+9<Z?UWg@UL
zfHnv1@B)`svPjkH^?NWWpFJ|l!#B}9=gvlm6eg;zY%GcI<1HCr6n%Pn^JDv@`ARJ-
zGgHK8%&U%;jt=m4cpY9QnfA&K^!1r&NlAV15V2ZwoK~9#hyedBumtlA4Gav#)nHLc
zj!1xsA)1&dkNp7iJBg^h@t|PILdA6F*YAWQT%24}Jw}thw)4*s9rurj%=&G3_=$K)
zb@g7PBcr36Z43-rPBU>o$$|b5Ft(`WeX+l#*kYsa?iw&T``bL@Ke>!~w#wl0$z<bn
zy-`+A4|z1uaaGt1%D!382K9V-d48Bk5xtrE?r*?r&(6Ukj*J#AHdij_{X{PxhCv)1
zPp6W_NI%qQ1I8Hz1_YbW{$r2Jl|}|b=x-+33r&Ph7G6BVF-}eWp-`yF>E?Uc3(x*b
zOTJ1Y0ryK?GqYT4%$)bCC~hYkFYWV{h9PBd@@Pfgzdg-cOyjX<%M$Z_Ixyw`R+Tl8
zCB(LXMMF4|E#SF__dAD-AKz9R1fVgwsB#v!=_y4SaR&`N_F|_erZ#XLLSkZplUeOS
z1e6y0lUdE)&y0d`agC4_`=wdui!FFvUJl-FZ&wc&Go-C#N__H!V1HZ@5fP8YzklO5
z+vi!40$V*!gF0<&Y)+RNRy)k;G)Ojry0LVdyoQHoib#3v7IK1x5CleyjEv6K1FQT8
zS>YHavUbr=X6rPc+#TmJC^%j=KZ<xiXliKGmgH?WoC*)_9MvCJg%Q1c8~jZ1S<H*x
zY1bse?Pvj;#(J?*n}uIC^x^!BY_jX?+8BNyJ|5mgw$S)*pewo<P0xX6uCrU*>giYL
z2ylca?cv$ZMnTo3h>(+ukc&vVxd}B0OTYc?C{m%{E~EN`0B+z<OnrS;7ApbZpbL5F
zwYNZ$koXij5>3q2qH2gxiSmM?NCZp?3lqD}RMoUZ+>frKlG(5~7HT~yPGZkiTY98}
z!p&@K)XTmoZ9Yul(W6EaHVK@kw|JbQy$wfypo}-Oum}nL&60L}e5_Mu6QaiwZRHIm
zcd1$T)eWgnN=O(zzbQ}^SS~lg<yB8eN@XafT##~Gc4XP#t3kCJ{0J=IGR=~V<mAsi
z1i<~LD(D=kt*PrnyL)~#zBvXn(bIc%@lp5v%*uj|!D0mr;+!C3|Lw3FtT%n1=bxK_
z7P`!V#X!Q$DWTJ2H@>{Qyt=x&OKM9%$$@1uLnQowQ?#XVSAfK$-b+3Nxg5T8+#E`k
z0~81o_Oh}vbM=#}{YjN<k#JFoq{!&eg}HLr+TEl(+cBr@?Z4~EbbWN?x-UY@%%tP^
z%(JChQ4FwO{mSH(wD4u`IJog(9lc`dk-c8CL?Uq-K4NvEm8hmBG3nT9KNMnnc+~HW
zrA4F+-J=p>=OH5@{fLP|MMGnBFi<QM4!Cq%x=ww5yt_G=GFI(yKVC1I%&-TKpof<4
zt1nMrOe9A}qDYxOhsC(KT>9Rf5;~v=g^o~e1nK1$Dy8T4RhQ)D<aGba8#GZoJU%>K
z4W#7dy&WsTZE0yaJ6$?i^)%VaXJDOB25cTKouq_4Zr1BB*N3&~ypAuIyRLvNFrMB>
z!eavrh_((6zJ1vYr1C4%D#7XDJ4kBvHIQKjymm5vK397cfGHW5E*dhOx11(67egda
zxDE#;_;)S9bw3vAckh1ByP3V1<Ni96ucolxkw1Q<2-*)+<w)AhH<%*@`Q}qUJc_bo
z&B&c}euG&PA?_HSWk_I8_S>(dlYtIl_eL&zTpy^V)ZF+!5{Mgay1@CHrkm(0rwWo)
zPdXU2MiYzRG(Hq45Om`#R=eI+EH?t40Jb*dWA1Kz7gyV15_qJjlg0YCJ&lg9-?eOC
zx=P(`=NFddx=Igc3L88f5hpR!;`YYV1$f-?PD!_v%5*9|4k7!5q!!XDkvKwK$$H}q
zAdBs|2ov?T^HetAvUK~!w(sbq5wPLkW`gK(;NU63F-ZkI#;m21*^@jj{_Zx|>%Vrm
zML-D>lah**Go#6JCaZ#pf}k`*`2_{+mf{wg(e+928iidt5(`@Ak9Ze6o3IhT%{>t2
z5dGfqPK>;%{-mrt{kOC)F(o=$@mlKhXOOBuq03a-23=4;td2scO3o!PAMA5r)cR{7
zk4Cy~xew9n@VkGr$Ow+Zi4rn`qoQP|Zz@%@EM)#^1K0p0)Dv??rnnaWCyulKf?oZ1
z4}Vg(1m-(iTU#jjj0{XV&o8uGL6nRz@tUcC<C4|5rd-t&@a)FE6YK&AuiDT2k?VuC
z3Q1qjuvfEtK#VjL4n!Drx!mc)mI{@KXWLa%Rh`<&1FWq~Ouej3ObqVF)3)m`j(cN+
zQ>u+~r%!7g{?8BS1ZOKZCoA>78v9>r_s0|_hfI#!eD}p{t`}%Aln^n<9}cF?0c*rp
zi6i4@8URyu%I1K*w-^VwDFN&&`)Zq>lu3q-UG2QRCx=V-#2a`9$cqH5hS4a1A?Uqq
z9AFw*>hz4u3w{Pd5E2p+0EN#-`0CefvOke&k|iZ0ZF;{~VL&D#h-4hXZ@+{Gu)d|%
z#&qGYJwRyW^6HAh%ex>ye<Fipyl>Xxd_x>?&{lc=>pwvY;<i&=Us!<7RV)J_a&dEG
zQ2q3ZZN{Xa;L-iJhnkKKU}KDc$C^OD!KU{&9Sx1Fj0^{y_$PFA5}VVN;qASOWx$od
zV`o=hQ4Y6@{R>-0CQSE7baaTL7T|+7-?jnDPJj~xLlP@Qlez$80a+=Tx!PyrbzEC&
zc9q?{bPseuLPNQ{xms?!aRf~KNThu3Zi;epz@GB-@oDJ{{0I_#t~BcG#)6~b`BXBJ
zl0pR7yVy7whVvwSH!mxV1Tl&Do2)<`0K&|d>qp>lam^@^&Swj_Hi*A}ByWEJJkPeP
zBQd~gwD~EgpkO)@G*nDv%Y<4O4Sl#_%9jFS4a@5W3jjgLMknVy>3(i)5flW*zW}O+
z@`_6#grcBayOIXczXc2)Wh7c(M&5j_vm_VuUaIw6{~1TY@#{ki!6uPf1gyS((kC+{
z36x(0rg{Z6FI}+Dq<l7g2tImP@M|x3+7<Fi|FmBC>PH;da8!CDQ|8o!!T+^i=2z7S
z;8$!9*xrV`in5AkQ6c3jPS1er>+4H&8e_x41m6pMDB=8>!nMz;$;WlNRG-(8MJ|aY
zm5M`37;eBXqu0oq`GKB0UXxgt<0p|0Asw&)F}lVL)}>WsWCk8@NRctP<wQ+kl0pRr
z0beK$kBu%O92{r7WPAgf8OIJiHr%{Pq8#s;oU7vhWc%()S_1c}rnUw=s|i>YV`9pX
zjja{1LasGLH4Dv)Dxn6eW6T0HG<<xXJpfNez%=7W5Yn&nIs}3RJUl#rjVR#vr751S
zzP{aR&EXPQA+GJreznH=CaoUe=4Sk~Y;2J0)LP*ApoxFt@Vz^Wi;2Ny?H&XoQS9oH
z0<I!J4||f%?d;~}^#Ew=6KNuZR<%0W0cWS)Y%Ttex2r&~iFBFoblGvEVtIWn!yh^{
z4G`_|%sYcT+E}1viTM$o!R>7m9H!Lbc6_lZ$<7FD<@Hv_S5!ha9@}Y@S0EJgay$>>
z;NUog+Iv725ov%kp^=RxH>lr>3wVn#&^J&+quVu@R5q8v?;QCHW90L<ygz>^KYZxx
z>Vg@)xImVTBg+<X9hiO}4%8{&gUc=T%d5+L1F>Z2dcX#h%&e=scHL)lJDLR?W%BZ?
zzSl=<?aRT4S@kw^Pp;1hnnT0G-jBBx$@9HH%HwpY`gCC20Knq;`FSzVy$^HbqD_H+
z`;h-RtqOzsQhhKzGjrSPH*t2;b4*mIwVByUuC%L+AU%b1YDh>Q5QgjdDJL)A;&Ve{
z)&;oE&2?^oM$xnv0pO8`E;mPC{C)0vYRaNqi(<)v9<bbK8H0k9*Lvf?BrdeUei@kG
z@VdHpyR>@P>y+#E^TwyAH*Pd~laP=+JosqPsw}lzK>*MNFsWKzPft!<{5us=37pQ!
zFG)lMG!hic!<j}gd6NoKz`r8u22)0K_@}K{@r}fXbF-aY{3CE#>(gBUP_RxISy)&+
zsQCHeHch)}zkDeKl0jdRnY11VI+BtTG}P2glXJ+<qZcgwD1H)o5XbmE5shF;3BY<h
z1K}7T2ZrX~E&FLK=dCZ(@iCXW<h?4fRA7;E>dHt(L5d(dw!fc0JVjn^u9Bi+N<8c&
zlaP=Bz*{%lKX8@m*O#J+CsLrHqhnAkt(U0;dV33eLL*iANzOQdsd93f4zvtwfgAnj
zr)jlTlRS=l`aSlhv*qhm*Z~?gHb)JoLb}N)xp_cP>$KGqcqk&Ozu$-7QiyteT>21J
z@`+IcJY?PbP|u`O>995Bc5wbHfmW$YQxmz7hrRd>;n-q*s_oTpaH&>0|98SOK(r(i
zwOeQdf=Ypy>sTS&!3u;j=<ogizYs57!mC$pbJ`}rl~O|s41JB-@eY>&KO~pslG~(E
zBl}_qGBfW16U-M36kv-2PSD1uK3!Balu8@TR0dSW4Ohj2cp_6ka*#&lsFuc&#Ck>W
z(U0fg19kX-QU0;`Q6`yk^Y8#BJ3!IcK=|Kz|D@wPpTRTWn3yPlac$s4b4K&XxBwV!
zXK(-Xyv_ww7P*ffO=3vqqIUo+o-H%jH$NysG>#j}r9xuu8tQ?f+!N_{8XEy0x)h-O
znU=N(z-=AxztzL<d2mb!IC(j0M}rQG6RwK<UO=6D0=}vE&(ypBE8<VQ4lu=33=Dh?
z2?-(Lv5St00V)<F0giU6&e|F-tug>GGgGQ@QBe?Z?O<+b=kRDks5BNnqTJpyd=w#D
znMUhvlvNysXp`r8*BX#0@$y;w=X5^;w*)}ZAW4Zd?yvd9#XsVJS&pdl6VekcbKvuX
z`*WDm8JVB}w|gqTx6RXCc^72uK8{4BAwqHnK)8?b3q8+>7#PI7TR>?XH)ya~oqGm#
zHX?gC-(Myf`#%Wq3&v%$GjK9SQUQ(3d%2|VR<mPZ%k4szviWlVC#amZwzj=cE8yie
z1wWvZVv-9Af8BxtE`I;}OUu8BU+JSGB8Wv@>HsrkCE2o&kDG3l(?$I;pK4Y{#?$3)
z8DNC3FsyD<ff!q#_eE&X%cj@vPe7ImuCi8zfE6Ya{VpLreH07s!uFRFoW<%A&$8!9
zi`T{9toFxQO)a1RaXX&b0VymX^BVJxW31iCV0N+1`I!ka52P*ud+-+vi*o(uclbxM
zCC^X&3U&*X_N24JlasHmrz8Mq$RhfRbvEi$8Xben1{YoTN%<Ur44JHEiiqzQg+^Xj
zScvVvFn(z0CtXWmE?uaY^&=4b*Dru0-}^3m0Que=$#B1yr^S_(j0z2awP-s8iTVL~
z0E7tB(eW~!PLF57Ry%7Gm<ZEk7G`GUEWwyiK;O$RDgsicEDJ^lMJfP2y@>jiKhifa
zVASk`-w@XDTO05p<?t9AV+IFHn#>*?9?Hnb)PUK+F_x&Pt{S)r3DZT`HGuLe?yaeb
zC%+*0+01MMz4}eah*lYiX*al^Sb1?tOdHrDpD^SGEbHnRsnlDor{jT1{dIISkeunj
zM6>&w&!OF1Z`bTQY5ZAC49*frt?-!7+3D#m7RJUR5rK>vML9SwCX7_zEcF}gx_RN_
zzFx#zvj1>cY4X1KYk7bQ!fyNx*p)jxA)?fxIv}IFgISubRu^ozi_xF?EN^GtIvdje
zFgW&r{zxtS{`LV-5Z{iX2BafeSxs%^uv^$HEKvFdOK4~$jHmOK1D@0QGZCOxzYoJa
zUM}KWPK=1C{w|)xYrov<bvTvt3^Y}0Kae<1GMldmO(IbudCecVbrk{Wwvzz4v->wZ
z<IluIG;D@zUtwKVK)FiMWYiR+p@9!AUx(whUvs%10UztISy@?a=f%gX=R6=IBdgMg
z`va8WQ@?jGOB5@`w9Aj!;yxH9rE%(IY%n1K85tQ+uaMQS14h?@VRpMeF7RVXK6SC8
zI~UhKh2p3DL9^6<ZC#e`VN6I%yM2g>>wJA|f)HCE1<^ABQ&D?+`y+4#(CJP952qCE
z!`@i)KPG8FjVT5d0dz{O5STD+62z*_RVdIQqr`mBLeNJ0FaYk404&pQov!9QrxSkt
z0wTdOL2s4fCoLo`O(y_S?IZ_OLRi@E{}e-(U|lo;dAM#KBFp#~-@pH(au)R=@X<iu
z#nm-iB=F^6dOJVgLfq8P@2N#>K5FqOsgduobU0qMbOcU3F~lX0)A#nQ*3(J9*=GER
z$2QY2&3?W57+^T`D$2^De$e6+^z}~6HvdOf4NiHjRLURms-nV$02_L4w;u$Yq%17n
zAU_m9^pu?xrKKG>d8|d=>Kt2Ze-sfGJUD)RH3dckO+fR7MlAdTAVc9SZzaD>oTQfb
z!CW1I`5d5JLQG|<^^K0}=oB0+)&4Ub&j@QR{<2=+0VRVIvdkr4H$jglI0GEAXYa8E
z<d`)6mU^33`$vp0$`Pvn#JXg4pXrn{%mg_pNB&(4$Pae;!wD#&;^Gt}yw;S42U{nz
z1qxQ1@l8!oK&NPMIQ6)@jj1-5oy@#T2Z1PBkEXW=IXTD1k97!Hp6pLsZU9p{r{8W(
zLxa>Vu*^>unjd#ZbpT4hr{8F!RbQ&6tLya&8*I|EK|yei{W~CvV4V2y&pR(gz{KF~
z?XA_>x#a`wx@u=<-Qsc(CKyZ8_i0D&f6c3IZf@w5GQPn-(keaNoCdpC(G}fa?NyQX
zNYzv~++reGFI2%wV(p^v%gbVr5wTm-Cl;uzztBhgi00<y74<v#R)tBUH}aju+}iqE
z=V!ByDvH$=eF<^J=$PzIFDgS8ets$Fsw2Rjy1TniYP@e=lXXB2w-@I01nfHCA_xpz
z{Iajxz^uBs_&;BR_4aLW@Z+6!nLhqQkNiL6$r<xYei(2+ffouiH1Je@?(7Z-0nIij
z*#evh)zx*=h8;UEHxHh|6gD*_rE2t-np)2;KwZYi$J5!JFE_g1QmnN49uH{M4P!|)
z!+UP^hTrOxsKc+}en4pH{e-*w{z1t8D6t~YzSVUew|4&i{+`cqP0;IL=-bP4$nnB5
z-^Im6`)gO!<}#1fWR~sPSdtO^_U`N<*8(p!_0~bPc_k|=5V00$ZuV(usi~=PT!RV+
zUc^)VxI|0b9m;tQ$0YyB8(}&!s>r*=%%t-q`q~%@yhs85{(gj!v6Ic<FA%TZ6x51|
z<}Lr+>UUoXi0lkZWr}Is-P6<Gjdr)Tp0;*J!M1Y})>z43A!`_+Tvm#t95&G{E&8j1
z?(cx8U=aO2Fvp1bC2#TfuX;)iB`4#+(nzjmdbw`B$65w)!4g~tX5yP5>R`D%Ga$UB
zp~FUP<O}$#GT6NDUs0KYMu0IuT3Q;KxTbZ0Svfocybe$4SR(xHi2&`vDCRL91II@t
zr3zJKyzmcUlucn-zd!u9LKxEVDnti>-&#cn7p|L($dbtRUl`ZI(h~Hs(+c2b@!!66
zk?@og4^zn{0UhSV;FJo0yuYL+u?)Zc3cbL;<fsd1Zvj5E<Elu>!!r(akk<Bwe!~B>
zoNr{2f$}CJDcN4Ptevr+;&figsto<74vOap(Eiuu^?w@}`7d%L|9Ti`eHj=SoT>FL
z6BColNQf)$%`+=2C(cbJQ7c4Tu2b6D{6JYE|Mc6)|5^I^+5euD!qvrvfLZ@<r(?FD
zyUq4?FrqQArU4jNi~SE#i23Q}uHipap*B_)L-y>7g!E+K{UP^XDp|{cM5Wr<PYVxc
zfTt*lMn*=~)Nr2Eq?IyikEe;;#nlG}++P-$7qLQ{PVVsYWa3!r?pr-y=<NWWzp;_?
zPY3f41OXRg_9G%j>C>mF>1n-o7kE(&VqvGbG2$M4GxKekSaNd<i@HDvIWUF0z@-D6
z`|JQIpinR6WM=oUnJbNeH#av|7!7Qr-29%bBQJjhgjN+5l@Kt=^D8R+0W}klUar-Q
zt!jdUL@C)<YP3ji&DGUiEG+Q;<rm7Dd&lz<@B;&2MxDy1jkSLe^H8Q#g!WH)ett#4
z&H3~;G_Zr9vLw$Oh{VNaw$9AVJU_qnxjFPaeL(-`k0qD1WPn`kSc)33VlYTW<(pQ<
z#@uEGZmcFU?5Bo0WI>|!rziT2F8=_o=!YkS<@ki;WIDFbA%WpPqJhO8^hShH9LrJ;
zKymwF26eM<zqM(Af6Nf32=jkhJpVtL<Sbk4lm=;QJ+G+D*49=7<Uodw?*1?R1|^5p
zgi*1>m!*1JS$`3cFv=gCG`y@BjZV=u4n~4<s@A|Wr~=-b0IXYpj=cMp-q;b96&)RY
zcg%<L&N|*N7MT&%H5LGG1)JF_3?w9r58)r|iT@w=-ZHAna9tNxKsuBTX^`%2Y3c56
zk?scR29=hQmhLWTq>=9Km~_W^Tx+j=VvP0eea83q{FH$(dFOoJ=f1D(Htts<gD>l#
zj<a5j+fM%P8KM690nWW9gar^bskexz5Rg%`<n8#+bOnZ@vb86Ib<)MJ3`Zr#MC<B4
z;^)tg`Q4@#7VSRw@(mOM0*`yu7KgWBU&oH$+1bg-{qf^7*r$a()y#()5CTJEaJhW{
ztY&o)aJt@@9Az4aFF(G^xM^tU@Bgqp^DQmS`{qQ6WlJ%oqJp^}M#We@jen|ClF9G+
zg)jn)^Vq5pHxF=wJ3CrV7b~;_s4c!AH@CrUSGA}YA;2nk-bB0Rq#g*vDo+HND>NX!
zm;2L}OHFFOxgdY?*vNeVN(x!5ELBZS6L4GZ?0i_fMFOV;Ofbi%*)$<9d?XN05}8Dw
z%3-k#Xm4EbS;&1XwW9}7HS%(Vk2m_z^xuI2yx#WUc)DpR^MK2DYa+)YlgrL~cEDd)
zIGxum@b?Q0!@a64>osryEB0j-4%XmR+jm*qz;>Qt70=c($AepXh|zAj%4Kxfr_)Qw
zdviA;0RZc_IZ7CPBYI5+4esF##9Y2))`+gRr*Q?~mc+7l1YD`}=v*yN8o4`5FlqrH
zZ;g!BkXJ5}S)5z}q+2@Q@C=><WYM)~!~rHI#$0xb_5f`s6OgpAIRXTBtNSUCr-$|T
z8<9(ZO{?B=h6u6ebx;sBF>PEz!sWod%Tkj|MT<}02;d-(m#PnbJqdsSgQZHRdaz3d
z!d{l^w)U#Gd0u*^^VWjT!o<WMhfK-e)jOjaW%_J>Pia;fjB0--(|B#(As$SY`P`4x
z&seWC`7BJF3(~>42|&OBtKtr^wA|}cNGmBR_XFdM<wQQce#-@j+dvlbkW@F{z9usN
z3rr2-rKI368Sr@9uXI4)>$iE<TAojfgklh4r6(mt1|wh;^wael@cWq$=A!_66TioP
z&2FVA$>P#NM<NUJ&-F{aNyL|we`aRrE(VJ7Wc<nv%8xfB(KsI(Z6V8#fa(MI22`PX
z%2M++AWD3|z$TZjtEZQip8lQH``W1Yq7a;|QOGD%QN(VS_zJpB&d1J=y(rVzf0Yt~
zi1pBPKkPCE!N;mpRmy2QYA=>ZNM1%Ju<vVJTp%@l_8_cU(PW{`&cQ(_Fv4}>PueN|
zq}tw|3PmBz&dM4en#yz9kq7$>_JobI$#U8pEG+EQ@Q}HDrt8t&C0Q})Hz*YCs*hP^
zWsJN|hASEGq6u({0=XF{3vwjk=)Ih8LZ#4OpFCZqH`m*)Xf@jctRWQ^<*nvNoiM^6
zCLW$VbGe1{9eFD&OBNVXgj`-m=r|bjo=`Mm5EfPK{F_W%yk~KdKMd;aOF}{$)v)Mj
zlN}Z2FTio<<L#}crj`Ywg`Py;jim9w*{yFDsvJsMLxsLd<>uiL@H>UFMPio~)$2M~
z>)MQu2d^x=4XxhuazDTf0NMo#nc;hN-@bhV+*<v>)G&!owmb$rDk=**yO`OP2~bLi
z9q{`;z!*Cp-XJ{OKindDhMfaz?C&xG&kNkA{euJY&r@}B2O<lM26fKE#8#>G)@GJQ
zEQasfMFwR4(u3+Lz0m}ucSsYf%dK$tSH!q%o|wHtuqTPb1V^8yXjL1nl13_wRn^qM
zI|ffI?T%IQf`GsZmpqu$!NE1)JeWX`9u)=U5=a{?%*?t>(T}85O(&m|a<YrnibGy`
z@Z82vs@5@+3y3Pd#28Jk4+-u(NhinE13IN_8*l>nK0RoiJlTZ-VM`hKr#&IA?JUj+
z^!*!Jr_1@v<yKGDhh0cn`a;S&3kSzslNrW*i`R@(Zwb$hX1hLkocr=@kuXC41|bvs
zF@(+Qw<+%0bssAMdztd^8Gbt?>FJ4~4ak|{-r^y5j-(^5)acZF^u6h4xuT*iZ)puh
zCX6ACHWQ0Cq7Mp{)YQ`I>=3@#0gTAWkl6j|#sLz7$<3QD0Mlq}IN2vrcRb%d0(Y)8
zK$v;f?g%(-dKv$)vDR5X4o>yt^=|~+0rZ;W8%mac!L;449~e~6Z<0E;xw8ouo&xYX
zpLD9+*BYHDBQ`|7gZmX(4MY#vJ3GH;msZdB?p_Uxki2a;dmUd{UA@q<#Y8`v&L$(S
zHdWiGV{)J0FolNC{JAu6x1=y!igH*QtXsjHb~ANyVAk=x+8$;hz2I{{dCzTt?B@#0
zZaev<bo+2K-rx&U6VGQM$GtPG!^-Dh!d;;#PHPK%CcROJC@41jhx5xhaTPXs`9<1Y
zy}h+sG8ReZfbwxNAEiHTsC#b3DhkC;)6>z^(!PSsNV*?^X9|!SXPG@iBo;W^eA^Bm
z;@wGx_4wSr3s?~4H!boxACBknEh>bNQ25JgYa^;)i%Ilo>S)D(io+_N9!X^jyrp^l
zqoW43vodcU@tj`h4GfSjXngq4zpqAT=<uEcu~7)VymR4OLITzvX@4Nxb=Q><3eCxC
zx0jr>w8T*J7bK~NnVaxRY!KBp^^;WvJAP&-nfV<SrZg4Hs=-J#$uD~CFcw`?vo?Eb
zX38HF(iamSE!6-slRY-^O(?(BODE_9m<)Xpl~agKtgVLtE>-<sE9@dEGMUHzS0q#5
zsk-@_$TwOOD=R?J0DdMw1_}zwYO=x{%m!-t`b)gTqCx^Eo?_T2!uBsEuzNN7`^N4r
z_y1BX3Nn8!hmaY&AGHn-C8%HzC-rP$kDC613+|ymwmJ?OiQOH|P26k5V7z`6{C_uE
z{C6GMUl9|4na>kIge?Ir>EH=n1oA+{UWuI1R{M74FL_-J{QkYQvje`TRJW}}H1tY#
zZ?46x*rE25UX!yq$RC+YB!NHuzzSjFb~u{^F!%OI%H>66()HjDP_kuknk0g4TE!C>
z%Df(XLvLxGhU;L2!z4RttKA?^Bk8>0<D>z29AROj{dg%L4ruc|hb?aNeQa`=NW3CS
zPt*M_m(EGf$e6+4Y_)W}SvV0GitOa<s8?a{AS;VJaF6yD_-CEh)+tNm<mAMEgOLEt
zq&us-{Jx#JAdN`bM&`8`9+^}T50uouuz&=q(SDG_x4*kfqT2wB8UWHd$L6#Zv_Bc^
zM%dsgduF5M_3ZxncWtMR4GWuXGr=jz@NlwNY4JdsevOF3m~3ZleYiR44DfoOsgETV
zN)d4LoncJBK3qmHu<q_>`J2kOnE02h18AU_ghXc>GdnxI;}PI{C6I{`C-RkYLS&NY
z&#uvKPDqpWrojFIGyp&YHwHKvh0%NJ%E~%*C8g=9@j@F5I4vHpWABaLXkM57kDttW
zy{?A7eEIVE^Y#Dy70KU|4OK&Z5Ha*#u~G5fRf7=1`|%b}mj{%)6aUAb23nbV%*@Om
z6clil9;T1@z{+8}H;w<?<N^u*Hl~m%-M|0_??{TBWFVEJXP^hp=!IepG+|QyblA&-
z%i}2(4Gk_@)(D2EhzRqWB8oO)O^L&R;>hZjmIr`N;xwv1fHyUs0X^nPK9h6n=@AZC
z^KLI_kcH#&1`{)d{9a}tsW&#(0?|(9%0fN(f`02Z8aa6v0MEPGUyU9_$11qHb2AMb
zOrHTJ`TBTibYP&#^QcL(fDs_H|N1*C2H35(n~ZN+WhwrSS1SC#?YC6xq%-`zPP6u;
z{uTs?5pjR~fK<=P!cy7ncBBX()rm=f8JwM;>C`$XNJ)v$nt>=Zz^eV!X&+ywlz~IT
z*DM8MFk1jiE9HN<L8*f>tN<QYkji%xosz6EFfyX9qC#iH_Y=)P>V$=qR2Zn-fQO!{
zjxy|-6>A54|LaJGD%}h;6=OuT>G5$RX=E_`*uRXX`#)9|uvst#R?G9tqDG7$L=DJG
zGXa4rwMxyTX=!wPNi?PxkJ=~0vY`*~zkkZgFVApTY}BoM$jvNx4db@D{YX!Z@f@?L
zK(tfFRvK59?H#_YGl&hob4G2=PNceGY*=`r)!$PTDPbUC_a#{XwTbb!a|2ileUB8+
zE6e>vIt2YEyrk_^=JvM;KZm|MIefwOk!xfiM@hHd!}}Ppin!R~fYaBWA)oN>D8l!V
z#cJvHW-r|(#bB^p9dAWpE|rPO&}gTjD4IS&MP)+2{q*$Oj~It|^zTIja00-30cX=!
zn}0X`HKcV$+`0i1vaHx@&Or$xF^kpAA%yz$`R!Je>c%5!&5BDyHC8h*!1)4JEHi0q
z-M6-DxMoXD&W=@TkgZ&gb)y0QW~pLWbt7NW_B)<@v~ixBgXQ<oenvg-jdk_X0J$E3
z#9YPPHdLJI(Z0QvX+28pCj7v1Lw7qxi*Xk07KB3Y9`{L6E7=MB0$t^t5SRDwNw5!P
zJ!1ZZ8kDiN&zl(g;p7x{s&IkD4NxIqaWmP-fYoj}CCdCh`k=jA-~N9?b));L3^0Lt
zO%y=y+exoMT-59-#!z|Qj~|9$7N(&QZ~1BrRJ}US^C5m912WsnZ!6{25<Tvle7ayD
zwCO+$ct`<lDeE&nWTxD1scG2$@2wyYrGolZIUzhUvc9smt9{;u0GUwGapegbJXwa?
zS8u{qu8#!_xmQ6XCm1}j7!goVmRii{&aD6+VgMNE?rw^4H856bX{7*B6^*jl(_@O1
zf<k?<O1oV1RcG+wjD=3Ie5}3?m{*VtsJn>2SU0X3sH;z-EnHutecV}I>lsW^8XuRP
zJ3Za#W6*gvfBH*eD5UX%*Ebfr+FpNTI6$g=#FEbA(m6lBzeNYB+~@_8RM`x6|645(
zpp_qFXGY5aSQlVxyuXGFexM_lL<Y|Pzlx5pR?m+qjRziR24JQ&0$bg*x_ZD_I$vEQ
zH{b1TYdV`9;MVP2j~4aY^;_M1?ZAe@VLvvuqd*Mgrou1%W}l|4W&rGZd0$0|tR(o=
zH5L%c9UW~T8+2m94Kn-f=g(b-4XSxQ-bPNhK%8G~PS}Z?K+^h3N3X>hEHikAtR?Fs
zdd(X#o_9l9Yl*Q$e8<aeCV=g~1INkRw*lWc{7U$|bHAva6<S?qFk?g<F60er`~{&M
z)+s{puumXh{|>1ASQM;ta4g`ta(RJ?Dd_i<Z2@UR!Jlh(+jYJl(UYK8$(MgVfY|6Y
zU4FD)alVVvV#b?we7gr;{3|c5TF+?1IIEfR=33jC$woZ-B;vN{`UW-(Z0s1e!?DRc
z!0P>0$!8H-?~P6^)oBz~tWf-jby4hU(+pIPZD+p2iSN}nO}E+@9zGbO67fb=1GV%i
z;NYq(k{J}FrT?D1fjQNYR!DE#D$*k{o<JsoQcmA`>d|7Jm#0KX1EKfh-Oe2f_n&E-
zCA;O8p2UvT{iy<ju3prJ?p}pt7=LqVSM$}HGR;QMj_jVy&d!Phu-2^A4r-KutAL4}
z_|(>-6{&tnz`3o*Po;oB3-ik7*NndxZP^!36#UT)Hnd=7ArRvlRZN&*aGqIgF1#U=
z#9()@oTY>z`SxsQG!u^||82J!85x;Azu(&7Wc*tC;$l{pq-vq^)}P>W9WJ{T`_uJ}
zJ_W_&RYSkMKW5YPaPX0ng?g!a$ADE_3%m!AUr%o@!aTp%G5^pF&`zGWcp=eVEd+>D
zv$L|cxIGiMK_536AJ>DqB16EZ%In&8SXZy&vtKj;hp`4F1%*hKd^-1ZzFhHC@k~`P
zv8d?U<K^M<W82Qro(k0ltF(-aNdy%?KNK0O*LD=JK^p4_zb56Ur|03hy^ldBX%3JB
zny<yi4G2fE##<go<ecC)GG8s;k&`=(eaXWA{#_E4xWVnZuDUwzMq>4B(QkDs+v9wD
zSl4c`fl~XW3EIk=5e5~{yQ{tE>izBMDwV#NLp<}rB>H;+UfR2pEa-!0U9a=$bTEY>
zaw6Q~1~iLTo0rX$>1D8(d`Bi9k&O(G21jRu^V%YC2bhm!3>GD12dtOiO=R+W+V6F0
znVD_jvF%hO^km{8-|w+mh#CO7yNR*&!`5KZ=j)f9ShmYeW}kWoL&E9KH^Xz7G6b}m
z+`+*(Xun}ZXS!nw2MhanIa8-Z9<tKrQQGRo7vk3r;v%;)^!SpV+b+(w=mMr0_1X?M
z4uJIetAzs5I;*<!U7l8<bfjwWP;%vl-uGJTiL$PEnz*~`jYbN1wN3%c$%>9tF1r))
z>0+I0iWSN-_1aI5cbE42c)qG=MUb^|e;Y9ny7*VEoC%5Uma9_g3IS;NXof(2Rn-|9
z{AZqtpGsXb<py0azX(G(g2!UsbBp=ktuAaWrJ9)~+!*@n1!r-%4pHmrErFF$n8cog
z&3mC^c2-kTW9N5V!C&c1lvUW9$l}PzoSeYCyjPfO{xhQ6k{5^LOJHWQprW$AT<t*H
z$MG=d7Z5NpHr^Rck9Gx&@z{?WiPs4rzN18`3l^Gy2;<>h2Q4!0;%&N~&MHC2tci4N
zOA9{)d2j&e`6?}v*Cc-!vR@u8EOd6hHNdNR8c49})ZyWs-}qDr7@%`$H8t@E#@;BR
z!h!-m`}cloYEuA|$;wqP{r(Y~)Y}d+lb`<%s`9myIY=vXC^a`TUmt-p3V1bBp(JV@
zQ`U(MU}Y@i?1lzz-LjvHc}`SvDA7Ai`s=7K1rXhz^~X>d2^yA5b?Q440?)(0-Cq+s
z@2<u$cFb8%<k$W%S2k95Rp+$jY}f?qn&Q&Z;SVgzgh^U0?xe>x4VjPyw-+lYy-s3c
zxm8sI1jGh)B6-pY&dzP=2FvNU{o|y8aC$B7zY7a<+S(e@&?{n{U7Ry~+M_S_=g8UU
zssZqA&q{(gQ@#SU5k20+bas%H?O`)%v@-Ootwtb`JK^G?!NU>YWn!X&(=$1EzfEiT
zDZ&meCrPiOvQqzg2bTKB4Q_<JkNTjrjJsH_O*H;@q5b5~fbdo?RK}|#O#~F#+B^wz
zcUe`vov}vow%z&8V;ZT-+fxJtFt&qiz`0ls8>=*a7wLvhv?HdMpNfjcd|dG?h87kU
z#yg1EY)=%Tkx?A(JK798E3mrL@VpDYxU|;`H<-^tT3J-LFA4aXwJTz6m)lT${1Li}
zHi6crqDVd+cpDNN9i3o~pg%~cNW!fplByB5uP~i%E#DkZU+#_{$ym!m1Rpmyw>+<Q
z{dK;xr?M%RvI4+rb%;^>hJas9j5=Q~UAfWGEQsn|6fxbMS-sT)YzD3DHz0eEOJkPz
z9{dRB*2z<CfkkUK`=cXAG8RPB@w%M-+I(|7)Swh*hd3XqqnOo6miNQa%m>%_e0#)P
zdZ;fp>k#UJNla5KyhD#`!>i%t0HrSR)ZwS8bsOBf-&gnCrtaoQ5cHwnx2ODi2?KY+
z#Dc%jIt6Y+6V~35yfa(LWhwCtu}c?rhM}FPFoM>=vB)nOpZ?S90gr&-AKrJOo2y88
z<ky0trzh7MBuDxQnhk^NMTig^xBKb~dh3-+5ahrJa?d-@zylnn;~k3y?0k*gXj$Qe
z#Yi%T#Y~LNYoz2~$+*FV0g<j?9D;wru};uap=-O+=(ID9;=bNsZC{F5A81vmxKYPp
zbE;M~n6-lQ8AwgiwAj|<g#1p8|7=<|B)>AI2#ybIKpxsIRCxyxvWH)TrWS|-ka^56
z39}oFWe_r3HFZ);3ft&7^(mPYDDT7Us&hj7N*COW*4SF$S2d`SY-2TT|KyI3=y|<{
z{xp}(V~%1qT@!3W-$vv9Nl>sY8Op>LrVLv4L&vF+8p60>1Nu7Gspk#6InMDHke2&8
zN^|y{x=#+hqhG`pP{<mu4}^J;@z&m;#v$%IZS7AHhXjFVm%YYfr4tST7Z&lN$HOK<
z)9Fr=&})ugLW^kLK9AjEWNX4dyzm|%sBTE7MuqE&ieDsgj~{{~!F)4214QI{Pr-?#
zWRdzE7=2T(HjpSi8a+}{T5esu`9P#P#w4bbIp(cvH$(;}G&Hn2ZW!R}$|@6vo~zmc
z0=}2?(Y?_gv~ih9nW=!K3ia9U3JjT`X!E*3&yohr=}F@;yc`ao@=--!d_qzvQl^w!
zbjPL1_kN&7+nN8<X?!1({^g{--d5rV&Z*xJQqA@5F68+cR|mw<GVcQr7*Qt{$csem
zcL2Tbb#>U&S@EXDYZ9pYeu(KcUHyuZ#egfA@+&b5CAJlAum>2MEx_|~bE)4^lfSrT
z(Hzuka_O6dW>jb4a1b`6mQNL&$kRf)Fzx=yA|?LVB91#d1tuozwdr?^oT#>hIzZ>M
z5Wk5jOA$@PR>rg9h4bRM(yW;CXx<BK9R=e;d_q>!&baus2b`~mq_8~94NsnH%`lED
z85xIJBtsBTS(dt5kR|e0txfP3#>U<oPCW{U|EEVFGT<}iwk^;mMVlSI8Kk^zjiQ#p
zW)MrO^%$JyR(E!PXs8@g@V8lM^EudDwBGz#2^?MK5NdE+{vuu7bUvESNzjp58(1Gj
zK6WB_(hV)X0E7aw1wQ9bJ6nCij`BnXo%iG*+P3c`P>_(f#%`%juNvDntZ^0OB#OqO
z@*};{u=I)@IoX5RN;Va%2e8@VpHh@XmPJfF8i{udM}1st-(KTknb??}c72+XI5~@z
zI9yLJ|4$6fu*cNQ3?CP_fAG0wBJ>_)smEi-N)MGoIfkU>W(PpEaGr9oh|ZN85Np2Y
z)*K&$Wn3iF`9&y5MFr<iy1nvJ1By%kCoFj>$pad>h>lF;t=p<>QLz<f1P1wCq<b7m
z+H>sP^WD&|n80eSvtm>?LEW6-G#Wq>odca%qA5Il@As1zm<oo9_W!6fP}I*f>1=s%
zUJfMl%xr9Cz6=$PEad8EcMW*hcmfRaxrWCqW-kd!znFt8`qUX8OpkXxVg2nwY!#l;
zYQ%0T<0Ad*<?Wt+sGi!&p28QCWA8oX5CW)4b6Nk$6q@G%_4fZKA^Z=}EAd%+d4-jf
zhURv+aw8ztSox?bEPoO!GvFHN;;dtU(C)*R0nB&6bTuEP)ft`+)7{-muU{qGVD3=p
zswJkfAED6Eyd7Jc8I;ld3IYwCME{unS2|EAYlMi{rr+i*{^dy-mriDoYndq-{d{Mh
z13dUJ8S!|GZ-Cl6ve<9sTpqX!f@Ic>H+<!My#rQJ0kGZ|n^}RUsi&)RINut|fb9O<
zw(?mR1)tM$qO5hb=MA6haR#%cG$5KbdKDgQI<m2CL6}1WFaqK7o6gR=91y-uUubfB
zox94wSZ}rB3(e=U7ZUs?rx)Cv?3QP$!WKZN?C<AuheAF1n@r^hJ4v~o8>H$--R=J2
z^Yg3Q1VK^GhED;(;DEFq(78hX(E@bXP+SauCG;vuVf`OMNOH0E)KUPh)Fl~XJJB>%
zN}w?cd|iU$K(+^36=0B%&IxA9V~Dw2Pru~>yj+Qhm^fAqIM#e`b}NG$Z#!R|*FW`m
zA;8N1Rnb!xP#Cm1w*ki|o5ir1N-$2+g3EK;Qi1#ldX(K#)#>40+`;sdki&Hr^nD_|
zHg(#^fV_UyW^wRNb%A7ZB_Up3-gB>Qb_@&?XT#IZS0HxKdSC&}9a+Fg3I@be@U*n9
z1s(!m5=z`Zl?k}%`A|MUGV)0$r#Eb^tERTr#o3wHdA0R;2Vm7egoDu=JvA|Lv{;x^
zT3Sl7Qyg8J(AGxu(@X=SOs+%`*X3|`9N3d^^Bf(kfGsI`-Km-OY}HIgNqN&OMNLuh
zHG6hhSy_>~SlN%imp4UO0~u5{{A5bA!5FlL1J-!Xt<u$(&uu<l)pI8ufC0(M04x~G
zpJG-JYz&YoM%5e2cd*&y?wjrTrAJAS5!7P%2t<BnlIm)wSw|EU6ya?cE2{&Ia`!s4
zeBV`j2Hl#Qz3QE;%+4UE@<i-4)#hdIt_UmM8n@V|hudKS;)lraaNynpC?k!8r&>N3
z2FAIH_xE=x0&?vpc!@oD4E(;d3UF{>Jz+M##lQRA8$yL>Z9C)R<u;nh6)I=^?!9`V
zg(4>ACL5*bm*`r>qNR0e4@7-^i_Oh5@o$L5KYu#!4S6M?A>+}*Q*rTv73<w#mLT|>
zP{7|rD8T#cxWQ+Kk&Gs+sH(iBNN=G`nQ|B`Yd^+jX3&lmq#WCf-(zE9E;hRf@$fVv
z2t9ssXw<`dGIav<W-F24ol%5t;=1w?w&ZV>lYn{GT4m*L;(@{^-^MzDRmAIhpGFsz
z%Lyo6ne^L$CGgW1{RGST$<z8<Cm<(SDhVbq514hQ3c&Fz(XX|D2vQ|&3jpo=LP3(f
z`81hu1#CxBzI+)VvC}wRSW|QB8WzjwH~L~av_tbpL_?wtWv+<1cmI@Zt&+AJK4|_D
z64r+N$GiGI3$q1G0oJJ?uN#9(t|MTTV}W}aOdF%$1!k7V5u7vwuwOryX;r^_`<^pa
zNcaQWpNwl9&JU)h6tJl$UZt}lFrI!l0WTFsy&{ts&s&^|YZ~=r#I^F~8L)tQHyT&4
z#;d*zS@;2d;GPck!{^mj-F2iMmHEZ8yzCO?qr@*s<t<DGjo%W#M=&#szE)Ov<)^Kz
zp)fPv;a{i;m{J}tE}X1`Z!O8uBoy+mG*aeWUFkGbYj!?kGdx6t#}u@gFUh~x0_EzN
z0c;)r&6}+J{QR68^0w{Z$fV9L@`}~t<!P||2;Tw(|Loi&77D!3_{X*K+_0#KvolZ4
z-INzBx?reU>}&~%Mp40b7x30BRHl?|Vlf*S)L2%?;O`MxYN}07PfN~RPpEg3c9aH-
zZZaYw<A^qgm9}Ow+p|<IZ{!rv+TnA$0?pb_or5}+g2z>jPDilTojC%76fy$ptz_dY
zMe=h7Fm)3Ode=~J2>CuVfY^Q6a31Fy`1=d>6q4^mHL_p68rjc7mM<T;qF34>E>G)}
z`Ri3~E575Be$RX#${7O3n=L02yWp-D=BN8dNByoI;0l@NVA!)8_atI)i7+s#O?GTU
z2%w;rfsg45vXb=G7C=@K+<tOe<3D_T9wNhjnEHrSf}d1vvk)Wb<0)#4+a|ESYdD(7
z^yuSJja|CWWxco@nDqFWMuo%zxT%HjqmNS0SY3P-f;j+M&)Gx8?Y&8TAHM-`BX=Ke
z2Xrn+PRs2Hi&5W-z;Xl7SJIJHD05JE41{gyn8X4gKg*{N7A5t9n44R(A3HKKl7Q73
zW}ivx4iufx>V)OELdFm*egL=$7)mxbPgwWTczs~gF|C1q+RXn_L)UZ63h+pThnU4d
z(fMo^qYRo2HvovVS>pSZXlk&axGC=!0J3sH)y2o<Dy*x8^5^&NU#&fS^_K(0BOP-8
z9y)-DV4!Do*dNkzLVe3m;c0IF^miQT&Z0pqkWD|{^N3}Ljfjw_zWSKgxG>#bhma8x
zio;{P`Ek<C)us*DicbZe_eOxFn_Z|pH(ZRC0%((Pk3dBWXxa!bD*~eT-x!hx{9aYg
zr`bI+i2{E55zZ?@n}E`xQb^Z+y8p&j5CdpqfE>j#prIjw01@*fP&Q#dW!%xKw@_W6
z;0jqTO({l7Wv@QHwy27PuEHYD1Sm(NFf`myngAD9Qj!^{3_91Td#VN2lMFXIo>{J2
zn+`HzpWV(N2a{N0frpdvocrtcMhajPtGAv%IlG+zX{~}MXU4<qaB%lBNsN6xK7+Z?
z(Z9ltlOko&5E%lIQHa=AuSySgufQ|`gD@5M?HgEHB0mo9C(tow2w9m~YAu3m%X98~
z?se~aS%jsK$^V_%SNHgupAYB<KumGRR^*Q9*6J0JF;b*V8sf$q!LZ$w6b>)_1NG7}
zy~f<EEdOQ^^k=#*DI#8PF~H(8>T$Qboc988t)TBi(3+4_v-@udH;)35hml$r>}AjO
z0~PNC5WhQ1sHt807?PY5OGvB1isFl?NU5ket0j%3vvaV644m+BTVw0DCr<(@uHe=!
z^{6%vGsY(X!hU{m8Tx+z?h&j;MM7FLeE@b6vpDm_&C_Gh<gmZDhx&Gm7-uCisa(<V
zWNb|Wg#bwJ`Ms_dL0Fg&$$P_*nvcsZfWZRr1mnmEa3@<Jy`e1CUph>0_fs_d5*+->
z3${qD6eIw*$|NzdJutIbW1z*NT0fFa1RB3qFIKMw9sxiaV7!Zxk&^1^Km<a{M0$PI
za(z9JFXQ~9Aw3a0Y!!qG^u-W?%``k9z<VM;2FO(pY1w1!)HO8f<0L~ZR$^-!x(mfK
zQhxpT0mM=cCXy!EhC{nb0T3uyq@W)Fq5-Jp?b((LDDQG$GP-fAnw*Re>K2<d1Ng&i
z7p7<-F9znt%XDF`v6Rz|Ui-D;MDkpA#+<yo;9_PL7A5B?u=2MUv=^!r)YYlyr7foU
z#mTC~GqD)V*Vzm+&TLY(iAv>3f0xC}$}ggI|DHCyilFd1?j!IG2K-V1Ts&)a8zJyJ
zQ8s@z`izvM7m{9Ob**o0t6NITXoj_Aw@2^JIrudPnBRa2;+u+!<loek!>`j18FOf@
ztZW=uo1A8C7DyOn28;4CuVOI$2qG!8Ujd~2P=vBnT583Kl+2jdr<a~wR5Z-aTO{Db
zjlt7g->bdQ)*M#K?8YO$*mtxcCi&|>@S7F8BaNcmoUTE#>>ocWu3|a->=xQQhqZB8
z<ERwGK8Mp}D7(N)2ZhUX%Ft7^Y1e)l^24Q3!&?lqF0s*X^<B!Bvs!ap6tVl~x;|vn
zwJzY7b<!PF^{wh-|Bp>6W|nzT5y7g#Wb{r0LYrk|-b2(`d~1)a4^-AEP+xOXdcJ0S
zeOZ984A&*Ig~#ho0%@fK$9(VGowT`Xv4hBEXrt$@*7+I-0X~X%@)_U1K9!nOj3zPa
zpz^^Nn5_pn457uS;&dsGnY)Vx+1skPa9pAv$G>vbl_KM?enJrv5}IX=>d%Upw!kRp
zBs08Wv#kgWD#9r<D6l;m+sYhMi#i$_8u|%&LwtxivKn-1!XYkef@4AT5UAARF=*hl
zJ<{%Qgs8%ww;yFQjKB6~jXBBQ!_bk9m-qWE8hPvZ3aA?aHokpIAv|}GU6S6Mfy^Y4
zjHV#Sgl1qM81TJ85Yc99bMj(3y*c<@sZ0jUL{HD{Qy?5rkTs~J^EzQyTDWsjhYB2C
zp1dhDEI~K@ZQ`G~zOg~qTS*IpikKdX7fT)9DqvUPa&gk&a?gnD8}fWl;?4-5tR9;f
zM6ms9Jve9ol`*@oQfj{1vRN9i*(#a>Q33$rU>4&2^8=0eb(UD*2?@yoxNn}q)2q1o
zIDGCdQb^hz9ezCrOjX#e_>X1^u|52t*TrSI?4gjy$^!?v?5bY#^?Q}8!==$SbU1bw
z=g%7MCu46upmkl(zs5DbY3!S|M@Yj@?&bDcUtm(Rux|x|TNB?G1*rZWEC#!NFZa@a
zhhW7e$FqOB&@?ln6hi@un;5^7Xcm*DCL2E7ULg5|!BBu=&S^OwMY)O@NyNr3kSD^3
zAN|hZGqGK2^`y!5!*7MG6c)RIz;5NX-U{Mxg__T?o^I{YTxSFLu!+gWl#DXlbMrD#
zEf*j+1}7;Q%DB|Dfv$VsM|;{X+x6=4>PUxb$NV=94Ul1*I6a~e@WMFG<yoPLih}4D
zOynM5kHngRLiHYqmjWl_TI(NiB?Pw_pd5p-YIb_yHvg9{z<H0|yL(r^)f4{t=`{u~
zh*XDn5xDS#w+!)Ux0peVx{|`^LnGuwce_bDJWLo&3O}vrhQzNGDA+77){6Eq;;!jm
z3-sJ1+bbJ#)Yw~@SnHx}uRXPTwY7iAhL?yXVzGPb1SsE+cWvK){UVV7%5(az!&y-G
z!{=TTiqyNkB1~}uDNU`MNN;xCz;z%pA4x{VdavPd159Dk(h)_pML>>&x#C{P3w>aI
zRf2c!r_<oL^~njzslgH4ua=|z;W{rx+;F2iZy6nYel__AciKaTcxr1mtv=F1F?(p4
zj<o(!HuY4*mHzrwNt@r-Tem@}%aDcnroQpX@WSU7J&-(ssiQb&;8OweO3a539{`IY
za&Z)zAd||Cg-RcTbUpxDyb!4zgRy|7G5iUMn7)LThsWcTr6lthxyiqazBoSW8Frwb
z26YibjNC$q-S(OCySLcjpqO!l72G&XN6;Xef4#xG9Kv_8Kqlyvnm8qo*XE;i#-2|}
zoJS>}5upFk%CZYi?1j#Krro$v`ie;WRhTp-9(U^>5*GAOpmV21wf_n-)e-!r2mYKX
zWYwc#d;<dVpWM#-yZ(O2q-OsO4UekDCZ?#N;@A<NTZ(~<vNCJxpKxGkQPEf1o~zyg
zK)ES5$$y{&2$}zZ4n*C88VY3Hs+#Op|D>C8C4IGgu-Z1e*;sJ@0Ie`Ub^;T=5mZ@K
z<GrDmSa|FELDzZ_VDG>PFbeGI{2q7KvtdevysoZxE2j{f1>moFZ1g2>-alG!1MfCu
zI%npO*<dgi4dafL;uzed-|av%AQLa~+0Emuv6H%L?b`j*o1D8kK?@<EA-}VG6#aN)
zT=HBs$n=E{a>GA)@@an=h|g~QCtvR#I0`F*K``i^ko^hBu+eF#Jzmba)>BZ}mVC?Y
z{u2nXchTk>M@NfK_Ed0rnf*FCZ-QVr3s1_Hyk-Z0;|ef*jyA{UkX?4C>9?HY*6Qlm
z`-gMQqory(7Bky^kF9cJ?uAtg=wd14d9=_fWX#MbzuJJ~OWW7iZZw0Z*6#Twr;C0x
zK4&P}F=TQ)NAb*`%&9HlFzxWyuOIDC^PHc$PZqe!Yu)VnFf+UU0~OHss&X0Z1yf!b
zh9~wmNbmtL+{N{?A5rh(;$r2-J59~xl?GoIfX4yxu+P@;U<fpp`{e*1`^7{dM&Epm
zWv%C>_9+|z5m6gZ4go%{&HKspdgKTewnY^lNaS{Ztp_7HJJ-zRcK-F7A20z~HJ{(J
z9$$UBfDbJ>xe3UPLSBJELPc%#IKL{>ThO3?CM<{?&Q_j3tb<Y7{!rehTKh>2K)Y;g
zY&r}0V1i_sHQsQqL<g=S7ne&Bh#ei{4jqz&_VbgEPQ7g~Y$}J7S;XjCQGeh})i*Mx
zSf*5^udn#j)Ksu+u{mWx%^;XbL7f4g+x|x@E3d5qjt-)}7`)&mptm_N`S^2H4_+K-
zJ->sxisUb0U%pgUvZSUegItB9&&cFm@373zvEGB&AOXnk>gy|-!=+}o%Yzv{r|l9F
z6BUTQKv8N+V-q)*<)7}zOq=4GIU9uRp|AQ0Mv@Is#Pt1xbYUJgIu1MrS|q%3goHsd
z-j5Hfsr3JeIruVqoFpaV0%<etN;UITO)XaLNN`&PQ<rI64+Rxvq$S)pE~nlak9LNS
zlie>-32PK&x57T?3yuMMKEKx!)HCQGTv}Q{s0yC`skE^W5PeDK`(2o`nIWoKLhdab
z8eXrq4$LVXr~^p?A9*^YA!1IO?=M(*bj{2>cyy5veIK9*;StgrK-RJi14Bp>6?cuN
z3!AH&rOGrKKKF}f5P#vTQvpw!U?zj(cMz4P`y>>HSlwu;eZmHZm{cu-cXmq7FCCJk
zdJ`8tTrVr$V^$xWQtgBT38n%vY%`TN7%({TGd%esm`Ufg+})e@!4y-4Dhmf|ImGV}
z%rPE`g?yo!&o3{%Ha0fa*N5UWKwE(8I`||4@JUte^4V7l1d-Cv{O;@^q5fVSH?cQi
zF)IgJ<8pN?u&YhLN%aMH_M^2$w`sk2{fymgkl%V71iiaG_hF7zrC`|o6cBgV$jnLR
z3`&ldXRl!7B8G0Y->y3~#1QkD&t$afJl_#yCHi=|$FTx|o7k6x;Wxv_&LE14`Sp`#
z>!<BQ9w5$@m6pb5bvLA|Pn6vgP6OllE&TCnGEij#5eBtp@Wyvuv$K*pClh0nyXyl!
z%XJvcGVMn1<%bpB)OvOf7UAv!Q8+iad%JQNKxqPT9VZ7zsZHwi;XSN$>QW-fz+1~v
z;2(?_yw#@2lcUyIBmzo~%ZrOy)iohWTU&i+XZ8RdN(D~D+t1y&s)e1$I7BKS5Qrrl
zHp?HsN{RGk-mtBVDl;|2ZjMB7$Ledml)QRa{HnOEP&63mf1g9D-p3Z<P)doL(=!%(
zx5AuasJ>0OjotB1NJ{FWXstRMT~LAPc!MQr_O!ucz!KSRvS0wvC*t^9|9_vC@n56E
z|BaHG|Mx@w+kHO&?^6A{OJ({u5`Yo#MCKGIbHGq$<lk+*(w6>}{ja-><tuu)5g;qF
zMaTruyA*XpNN9;V(aBL9QVdF2@4h?U5X7a$wgdAbu#5hc$w`uicd$y}_2LWquEp}X
zB0ov{)(%XvDs>vPSI|FzG#DVr`>V#22$M#}{-^%9H(-ToxuMvmXy`%Pw{ZaXJm#eT
z(e$D8e>3%&1=!Pv)EYCli3o;Fmuuiqdf8H~m!}t^pIhBdjj#9**Sao#XxL7_8WZaJ
zt=_7WB)?p~k|yBA^1nte<j9JOJ~p|{x7OngAhJH{)g&84{%?}+-0kUN1UiMj4xUB!
z&au4wzlDQ+?+t*~Fh*h6U`)l&S?B1R_216ze+aoh7{2prX&#x<uq+oczkFoNE^ZBx
zB##ckruA&+Cj&VO89#$sxU#e~^z$=(zDLAf7Skmu8V_J2%(9YDK@Ny_*6Z{X9_~Q$
zRDhMKS#sr(bH3ZOT6_}C+PkfV#FyNYw*nUnQ#0JB%skY*RLrz|G_Alq1#)$i<7zpT
zt2mVpw^R%LZ_6{Z(Mf)<JaN`2_6h;37$S;*(fj|ZDe>O~R6UQkv;!SDNOZ=bMMk~@
zVR0P~v}682BbcuXn6gz6Pj02fzxh2qJsLy*>@F+I2<$>^LgKR4he=E<$fTqcC9F<<
zI&X<Hf5p=PcA~3`Tx<~HzKj#rpGP-CMn;aL(cmRS#u{<^rt|0_l`&XS3<UCjrkNmg
zkn{Asn>yeEF`p@Za-bcqa-%>-^LDQqCp3mgL3(=&?N>_ot*LYu9fWICzr_^T<X_sP
zfVwTvFCsn&S!_+p_{wPB#gY>;r>Vm#v>tjCUm;V+VJ#7j+Zn$X(*W$ACRb53pFXwo
zUTfO-OM>VPDoHQ;4cT>XR<T=Q+vS!<SuK#*QC3{s75{C)jX#xl9uy&2uQYOj44>6C
zlZ@-uO;a<_HBre40zdo8d_bclf;+LPnPpaXr`Kl!H+NO9latD{mX>e_j(Ed`sG*@p
zxY%3^Q-Jxjx?kRj+B17+hoI~uxYpP{ZqLqg>!t(0F!uHoaJ?6n<-0y?rhrTp3v+X=
z^B%LAj7PxnXeZEOHLj2?_>;PxoQ$hjjD&h4*Va{m(w-*Y^SbgC9cuUm7UX`g2w>0U
zff@p!$^o~{)%`Ctjq)WR*v9R{dh^Cow-jIgLl$9APaiS2^WkKQ)9$ygUjeKha$*Uv
z27brG&G8K?P+}M(kR5QMolL~d16Z*xB?53%`pP}Mgn;l*&#n3Bpl*r_br1?sgU_E6
znN-#p*5EcOBN4*F#x^`SYS85Ea&FG}QMg71Oqq1*<tpmx^Oa6aZ|U?13CCri)HnS_
zB{TVb%7BoGZER>NMZg>6d7{4M{nMm22(ku6`Wzp+_W+{+nx@u_fQCOqz>kIZZZM}$
zK`-s?=~tVp<-kxyvh#iO-SZ+2KYRj>i9ba!gBLf2Y$yjaT`^TvRe-DEb=bH5xLW{7
z8qi@M(VQq&F8Xp;)7RJEUl@!2zV))*_gsF7*EM^Gl#<eABGCr;_-0EJOEot>t|Tv+
zIIQ4!?VFmJ)*a2-d@_zwp_;EZkOkeF`62i!*dHPp0HC`5IB)SVtK{Q#&F!}4XpYS^
zcQ?LK018_5Dy@}J2#W9ZV{zLKP7miI9ZV#ma5-<LkD41iXKj=OKXohCV-NGX?JE|W
zqg>aOg7Oun#i#C56B0TT2~?Z$&IE>z7eoS%)ODWVtuCmr*XJuNZ0L+wwEKEQ@}Ux-
z4M2j9J(6i-t?Tk!E$qYdFD#%V=jUggvif=jQ`N~qjdIf0xW9T_5bisPD!-(r-h(KJ
zMvqGmCv(GDK!ngYk^js{Na)F4*=GNw>9<qnqcu0zDF=eerNza~#_gQ$FZKaP8lIM>
zyH?9(w*tBiyVsl{^Lz8rI@D4hKJa^AQ1HTb!H9TlY^ReI3x_Ym`DilRO~?P<0Pa0`
z>GiE31zB0+o0s_Gj7CACcqS(6Ai7bzpl<0lG6~6NPyx95ALrfv1hD{#t;fk@cU34F
zWshahY&eljeOY=I5@@1`dMnuA+sexw$DMh;GxR0t`FT-XjlApg=lAqt;*vR`yIfuM
zpJ@;FDzR4CYi%YzO<&M}{s~Y78qxTV_gj&r#4M>2sE@V2?qsc6z4R*69Lo&wlc*Al
zJzXe_jFdzxPEEm{t3Qjx^pG8qk7+>D)J{$XH9lS0@UJ_)`f$buO2v0#j#3~q5gBD=
z!U+S6@^TK)ruD&XKVb4<%J>)AH?iE|xypY2Bq68E`I$@o{FwM>vJznkn~e?Q@J(-|
zz1jF9_ME(|wXUzeJ{t~IGEu`tS0}lBa3M9F+rj)^_wQ<Odmc_z({a+2$#kj~>f&uk
zis}(2ra#~R>g0<EA08d-V_E;>TwzyIT8c$<6-$kFH&!gE;S4>~njg}el$<OQ8kkCD
z4MSj69KPWJdEvD~4C<{I-g5K*05RwHH?0g++ODps6fe4zb!4o1YosbrVQeDyzNP9o
z0bd`EMc?jdCX%?lx6ewQ)k0BKTN}t?8#&V0UYKQLWfvnKYaoji7xs69!rJsGcugDi
zd;(;SN)2Y9N%QCK=*@ur){m_pXe|dj<fFeHwxL9m-8low<OA<q=E|EJtfVe@F<<N<
zgV5eoIM+?$*P7+>N5sAy;>w%XuY!+Omth%J18B<ZwlHbF|DGOGe6IUZ_I0>j<N9FX
z0K}41>>quab3I%I4~l3$gr{_#zUH^2Fu-AH#MNOo9FLC7+#$la67+_oX$8nbYI=5<
zSdg%vM|`_)WWy9bUm{WM_6{##V^7U#*d&y(?eFu<@dUeJV&oKDKj&9Oq0?nO6zuly
zvF&6F`E{Jg$VzvjsJlB|yOw5o?iLh=Bf#=_zhB%m`gD8N^QsKSt4_SQgAg7G$)MUc
zN1akmL&JiTo-AJmHxZX~Oe>_k6qJJ5!!RepOxc%XTdQdqC@3;MT!srJuKzlYLM}Ee
z20gqP0!=Namw|=wOOTm@oq7zqh9-7)&B)q+Ua0+o2+*cXk0k!;6}c!hH=liw_-LT7
znZRi)!x?U6)B=T0Rzq8YO77h?YlE;{DnBU)$K{`dgV30_p?P}6`3#GC$WO%9T8pYy
zzs(KBuXRlMc;~f2Pti!4VB?tdqDcGMQgrU7X|jya?l<>Y!o6Jzs^=A`J~NFEH!(zf
z;YbdLyKfq%$Pqs`XP;<O&j2N_Q6kW=q1!$WtR#WD4k?vt84I-2DMN*h;{DyVn9uM5
zG-JX0Q^T_ZLWjy<f4xJuPN1mq_#G>b44O<yNr_KOjhO6hmTzu^6%kYTJL503@2HrA
zA0C!FiaMcGhCIF`d>tP7?cW+WA}VZn&z#5Kn|Y8rN!IEldt>W*JV%U!6KmB|ratW5
zw!AQ_xzr2^_IlIS2`IykQJf`3J-ya1gCuP&6!#2OgwW8??ieq<;ovUkevxttxvo1y
zh?ZWH3HWS#7rN>##vr2<<>pybfUq7El*p(kTFitX9w>tsN%Z`$8m@zVM;+JxsC65Y
z;<@b4{{B7S^QirT558WS)Ah3&FyGTx;U5yFnX)6bi%RO~%$D33B}Ks8U$*QdAWg6^
zLCP$~t8dn0gV%~lz15Tm;L=;3SF>1z6cGy`chNfQ6H7^(+UT#|kge214Cy+?Od@#D
zDndx!LZCe=NxQ4X(AGlxZk&ALv~y<?{a;#InY7w=nJ>DqxZYnM^_&pS@9vHwCDA7t
znHH&Y;Llrs-VK58G`iY6-@%0$4I0!-OC{p-#b5SXn6}MZvU4~>CS+Ybc_RjKB$3eL
z^ZI2AN>^M#$@=SKVg8%(oPxg{kqcAwWisn;mdC@40#OMCeJ^e-VQ65lAc4Os?B&FQ
z!I$!j@*}(&va*D;Twj0tW!(e#;5Qa~i*wNCJhBzjrP?KW?ONDb#Ny(d^bFd=1ApFj
zK&VDDOoj{>J44aMSR8V*^=LN@!v18ZAn8`DU^A#Ft2(>51h7X=zwx7gL3*27e?0VP
z^BW?AZ8#I)DBDf(jxr}xv#y3c6kSUv;$BZgs*F+z&`==6ILaOiiba-X=j9gj3t*j!
z-GT*UlVqWcdz8=&SD`qooiq*4m}58Jtext6L1LC(=B`YbH?mHM^{`@tG7T&1^TPeA
zT2gzVbv|G9?u@vC+=7hg?U%#}LT72{a8gSNzv`7ROiE#5^Gb|=nx!H5#aN}qqDPC$
zZT3-NsPJa3l3B=wH8PiCMw#?!zHV?l3nBZmGdO$a<!~qN?H=S{=T1E&{+=r@{;lqD
zwy0iA><vm}3yj$fvrsem-AYP~<Egm5#;Ta}Uz1OxdV372#ED`)W_=8Ie?wCW%C`2{
zPO*I5>4y~3hsbDt*HXObodHt3^K+!vt4uZ07yMy%jTC*FMQu`S7c~^Z@t8xkZjk9$
zN+;j?auGs6XRS1933DK=*@oCd!N2LWrMbQ}gIb2$-ri>UBk6nr91QKuFsGRXi^W5r
zB6MQHFKvI13cch}M*se%YLxf+P7fnU_0-_^{rv$(Nn^duQofo@h-34cXAg=Lx^jx!
zj#cNwd8gIMlyf`p$D-8l6?o`?Z=7p>KB+yZ2RIXSpddHTJQc;eqh+sO9c?TNXNm2u
z@Ko_$xBD(xFjn=DWj^nVZoScaVEUha9_ri!Yed^j4$xZ|@{ob**3&o;B!x4KA6g4K
zru!5!gkKT2y8+zNx#sy)@vM|Dqr!N710!PSNaD4!Jl^&|oau!Iw@`9ONE3;WroKLK
zz<U*`PS@8kw>uo5!rmq;brHD>2)dqK)cnQ(_+D%}H=DElbCFs!qi#!QlMJX6N5_b3
z^A0am&T|woCfirV8j#j%*9SqCHLG7@q3<pelafM#G4ss&A}mXD*=@CA$ESR|Y$RY{
zOt9ks1+X07RNVItVYD`Yk=hl)qX?oqKz;Jgh=EA3N3{j0(Od9a?N8HE2|mv?H8<a;
zp>E*j!dm74(S!mN-d2xBz7?PgkC%^!mX40=ld4cuW-u~zn?6XIvn~OhLd~wnnu>}i
z32T&RKMmSrnEWsd+TAYqr?8(;+`;9v^M07GwNz`YY6C@Fp;t%C@xRh(SgjU8{@m{8
zrl#+D3_2f{K^{&v0d~?tG|3a+hnwTOt_MR!m}E97so!Afu$F!^D|ok39amUX1V0oC
ztdr@2URi2`+rGXK-iCUtY8Bs%db>HlaZF_5ZOJh6=)wN}px>aj&$AAScZgRDMi^5h
z!rFcO!O&j+ikP3(;bC{*JRcBlGD+p;?zhvll)ef}$oFLA8w&)HuluBA<bX~@0kAY2
zSV>A!8j^fGw>oW+U`7{_S~i3+GxHmyNxv76<C6U*qP4L)OhZRAoXMxsc!5TV(d~yw
zgD4TP4HuXM)efg*R00z3X;OuM|M>$|hM3L#)AjsHZw-5uS{Q17vW)Vszr;R(gTRVz
z)C<kg$;0F5wVnAn5yIzyppXzyxSRdB!(>nyoUOG{fkbCD$ma&h0&^1Q6#<^w1;Iv;
z+wgJa7#}QrwlTSQUDQWkW-K!^cd9}4k`CQ(hEMR-N(?&eI<2mOEiGv|q8LNGS%S?)
z!jDZLz~N}FHS*&|C&ILDWzMJpHj`e*NnBB5y%mFQHHhOp@xf-&0fOn@=6W#TcPq}8
zyN&93U74K04}4q!Z6;YpU;8Lq4r(rd-_Uk`x`Ji1eIk_P3F(7g8UNpF966@2wit;l
zG=-a=jkqNmfa17$^V_4k0B5GbKA;v#uxI%GmsT7|h<~;~%_6Jr%`%s&LP2mHewS_z
zFVa-l-*_e_Y5ldFr87)T^&zy`?ciz&4vqNwcrKcTXf3n2|BR;0{HuzH_;xVe+U8e7
z0}7UIzvzf_q?jfbD?Z-Y=Q|B<3>eakh#b~`nj!zdJ>n<)|A#jJrqy8(;50fJWbXtn
z-oX4#xe*uEkZewIno<(Qx}?0NuLMbS=o?)2rnc5^0Tu(dx=rY`EwUac=?dp24N`DY
zuDKlh^uOT-tl~#ioiHr?jf2vGjR6^;FxM19o&$g5?qqF6$o~HOgKNq7e;rHr;Y`Cr
zOpA=J_>)=IL{qT#Fh1*9+9LlD&d@Yuy(9ij2=sljEMDxZyiaNj*rO9aHBw1wsZ9q}
zVK!@POJ>SmBTtr$Ra~p=m<9*4nMLS_*0DM|R_-vem<dzf_tKibGa{&?{b;r4;;i7Y
zmwq>&L`qBc_kS0m667k)9Cx))GA;4K$|h(1D7N9Xff9ZF=VhU+`1_?1PA*cGr@PXY
z+}zDR1*86M(3o8I=lr9_&dpOVn(d@uokG10UA*evT<vjV4lS5}5!H(mrxzRXkR0*x
zv1R<M?2oL|Rp5%F@fdw$n`{<89na7ApGO>B$!RmnwI>Yp<0|0l?R5KxxG^qR--#9$
zDLMF1qq}?WCJV0+t<-&5fhAsh!79cRs+v#sW&Ke?SfgM&W;iUBIu*CT^S*nfA<&US
zhafW8N!jN?kp4k{iDlfehpdM-Auh93k+Up+X((llF47fgrpE21W*O*FHQ#{EoVJVR
z@mc=3`+`LzXY24|qqmX1<5}O-LHqWO&hu%r#3L_t=*wUf42Vat&4bKb?)RgWgUAEX
zufygrue!)5Y-YYc!jpn9T`4qp(=bQW9y3~~H61rr1H8wWWB4)FhqXJ0+wbfvZhKFV
zOis%fbi7xuc+{|l-$gTTV+auEwqMS;x<t%7DHa#DMz!cJPNfdy_wKt`h1$(0o;^_R
zTXDFIK_&%_7mmr?LSM-FdU}qfi5oaMWzj?*>jwuzSxz|F#a*l_-AohyjC*2yU#;Zx
zQ}e4&|1G+T>EN!^lo51RvWKPR_h^FNG@emROy+-FK9Mh(#BCk~A@xP#E`;^lA<&)+
z)(;zbsc;gtdlypL@~DWOP1fSLNH+v-TOoTF;bC}I&FsSuxZmHr4l7l(<+qdtcSj{j
zaY@h`Lve}jI#EdZzp#KW36xD-YDniLVbmXx6OmY1o!Y#WYT1)!{)hyAj4p-F>k^{x
zFD%5K3nlZ<(QvsTnU%JGF%B1oDjM(i0bINg=sQCRn$ssyS8F=;@fpaZaND<h;dcEy
zq9dqxBOiR%P^x>(yFS(VK145^*cy(ge)>f0vx_TT)k%KB^>L&#DAmocflpPv+@z1O
z3sZS=q6_(rh{$bWp>#-yHP7K2ET?LAA-}GU$H+s`afZ;44tSBiAFSNj&TVv(@os-#
z!HHZ^G|`piV`5GH6RmmvJfl3GKk?bOZ)ORYcp!X1O>GumBJdt*-vpUTz#~R(lY?XZ
z_DV$Jr0+1S{}XxWws(y1&mPmWhH@UBFCk=ZaG5gAjgfODG!7bes>jn>5>hPV6OkIe
z&tLVM)f1XshmcW3k)$PHmyepUW<uA)n!T5tw@vBAtp7)CXB|~_yRK^~=@3OJrI8Yt
zAT1yWBHhiD4y8mCX{19!QUpW<r8@;C-6<&2B{BgOknY$Iu5a)0owLR{dyTcn{!bXg
zKVUNF?|q-=zOQShg^U7I<8|2W&eE@!Uo2|B6~ZdJ)jLvDOfS)k4A}T2r>gUCa=?A%
zai_v^wW3{k0#1D>dP5d3(?ZT?!K?q%E}a+!0@+L3bW48I;|gjnYR=_~$2!L(oxg;5
z?$&A~p5oHa?U4Spn)O3!Y~$G%UAftf)A%WfQ``IXi4vFOC$|l4Fq$u^u4>3i0TVfp
zoscoZEWdzDp`z<c5I2#!3w?OHosobThp43ZosUK;$g52T*{Y$`>gv(av3;tFJo1)q
z1q#K91h2Zg7%s=YjX7}kQscYXi0$$-Z$wQzh)rzSIDuQh@;~bkw=0#}Frp0vXAMG*
z%5P@2Ub3)CKs~-d-ZEkA%@E4&Mi<@@b#rOrq8Hvoc?1Io!F#@dOVJxYi5X?sd5ks3
z_rtJrh!|v<CB56pC`kT^u*|$){@yQA@UKr{c@4|*lw>~WuB)<K$Nj@Q%LSNE);nP4
zH?dG!wttsH0Ca>SBfCg<aUSEi|LUbDPtVwR)Ztupk*j~f03U5#!F8;E1fYJIwtty8
z@_*ph{zXbXvrqCpGK!edkHVA9i0+!FKbWQ70W702%(wMpjqn);^_;`>0k=CJA0O--
z?mbGA2lR6`SFZ>l;ka|uTSRZC7ty@>cL1qz<{(4xm+-{H-?uR;Fo2u_0Rh3;X7N2A
zIv%FVfWJa*>{v<a2=N~t{=Tu-LlzLn0E+<f(;)kaXVPZF1<1|4Z^uwqhuLqD!7(m8
zPH=OS+}b)ubRnAv8VLZ->Rws2_p$#mIp~jkx-;n(rGh+543}t*z*#PBel0qqV4?>1
zJWdG(tLp1vpIH+w=IdF#kT7qn2=oY6fk5&8!M5$YI+WY@FF+4EAF(`TP<05@_dOdn
zm@XTkEMD6>3wg+8A<VDK$jV+B=RhEwpkSUokT08uLwF@a!Vub_@!rR{f)D3}0c--s
zu(4+R*vvEtU`Gl$juA|q8FUD+rW@pfcj<&Xhedq8F-ja993W&w0<<zwpR-Nx2rE+-
zLMG>cl6o8(w>v9S>Z`juE0Bu(Ig(f9jwV1NuZHiyojNj-1cGirL$uuMe!Mxn0)yf-
z_Kc2j0G$3<9^*gUTCFx;EL2XeBKXZHCg!oc7YZ+Gp3c!U(5DY0k@;3D<8`=VZzLT_
zxN=@bG4yyFbECAO&=0?*-%~!k?n5C`SciA$FY_E<MW?3jW`0U3`0%0PQIjVW3*=+7
zP_FCb=(ib?lI}-)&4G$Qow*yVTcrP@ZdA|k&LDVbdn?`0KP!Oa2bLzPbXsYr*Bjku
zl9v+@@Zg$b&=nNqC)_|9LHxAVpyFueAdMN?QA`&ZH+EJgbP6UPPK-5q0tssfi-(73
zHuBoF0oLCmMOmuJKTRB?4oI)LzL9Wt*?5odhh$@C7vHD}4ulqPIgx+or{DIADpz6u
z4z9Hgb-k+92wPo(r$mEGfVu5U70B>usNb`B@L(U^b0x?z3XETldJQVjR4K50(Y~Yn
zj+IO<-*0+l^yF1g(A`hh#8Z&T#&s@JAiUUm1Qkk<f>2Zc1o+Gk@Q#&-GIT>p3QghW
zwommXOWM}YPr|6d$@zEvaYlQ%*G4B{cc~frC&-0OJWB;O_Z(Cpg~t}W@4Q=>RbA~?
zU?5P0Z14pQN8wEAHcyaa_3cV{jbN%dO6=zEv$zVmxu76#4YgS$M}Egm)5+0dRa1x=
z$#~)QLARTBIT=qh=mF1B1+S2`WHX-GmD!@#iIjKDit{rwt!zx_*Jg9I^D>)!ULjoU
zt*k%_5Qgr5<H`X;)>KeG9Sjd<VBLvR?KJ0jWpc#i?F8_I$!SC|F;*);z&}cNb#;k7
zTahw4zxvs5W@O@InsM}fU9Ff5#sZNY6_H6C&~IjcA4rZIpu9tUejguWPVW;ipKtWL
z&6NqfvZDJE9tZQ$X()ww4wwVEZ7g9B#U_p>hQ?+#Dw5|5@C&rfK>caQ9N1G(CmNk<
zdS-q{5`HPXA)_SEKfTRxc6O!$zc&??{?|^to|n?2mIE?dV?#slUF^kz*xtUpp~>xg
z|19CPnNUz>-IuRf>(bc~bw=bXE*Tsi?(gq!PE=J@B_$#P*GZMhMLq0(6=fmEeL}PO
zrYgexe6EOyh^mwAD#(GOQjU@;e#Kp)c(yXhJ<7}}M&n~jD=R14f+UaQ(JQBv82rrg
z0^WUw`VFPw;ap_-vSr1}yf{Ja@2DZeYTKJ}0VUWuSBmBob#tW^bHXHflWf@IC<c2U
zL315g1wc9{DK2h#`RK-s#$x}~S4Db(fuR@M5i-?*cJQXyuv7%4L$S^JXNZC^w%Xbm
z+5Z|=W~00Lh(13#G&YM7yXUSr_L-4_AqG}%x_Jii-wurqca~-H-=98j5_jKjQW`+H
zow{0!XyqU$1Ro_qDb3WzhK-F*)b(Y4xZUoxI>ZZL3~hBJ#Wx$4^ifl4QSrMReT1Td
zogEZdh|!=De=YcQ11ekYyDO(lgRww$u-!&ll4(ICnhL0v(ByUB{V4){`AS-Tn*mKO
z*C+JPa%h=i6B3%^aH7=_!#bBgj9awjR%|ZxnuPdZG_#q0GgTuF34G+Hpg^DypiG2-
z?ct^Q#j@yV#%ByXJRR+t1o16>Ia>0XN@b;de1JU*>_&VdPF7qyqgmT59#wyVL(-#j
zfj&({ReAQcB!G{Yta>JN=ZNs{aNc=Dyd&9N-wbAhLb#O1Q3_~l-(BVo<Iy!$n8`10
z#mj(~`e^;rHVth4u%nX@=G1rMtRVz|&u_ic>sN%6j>bdNw|;r=#Dtwpm453E$DMnL
z(oIYl-2GdRUl3sCKoDT^?+W>tqq=ZN#sWbHP5`e=;!N}ZJm3Ev5?RAB4s3hiIeXid
z<uFLuFZ*Sqx*r8r=-_}F&q^i5VpYSxBUJz&!q(Ok7_#_E(UFsrLm;C25+D(6IeW%k
z1Yik9c}5xbZ8fU#?1PP1hL>0h;JiclZ~(0dM}k|T<*{i4XTpawbq(%eJ2L{i35Qaj
z()ho)#kc<grsJPQBfy071JRVi#0fy;^BGE|PO3@fjQ{T@)Ia!W@+bF$*zmtyxB#1&
zULNaj=`6r(u@?URrr{I}c776ZtIuemah-fR(F`AVyfXW~T6f2(#2n_JXF}Eg@$oiw
zyFDy#-#rE^{8zeTR<B>i6M~Lo-A9)O2jB7_YsfENG~7^z!pPy_Mm$V%00h9>wwv-&
z@Sf$#uf0QDqdFIHu*IwGL*-HDs9x)+5-{Uu8j&LoOf0PRXY1*K{r#vXTW#Ba{!ceC
zyn}yEeh^zd1tHW^+bM_rFl}(jEa#qm`D?IetfDQAp+zm?#uh1FB3L5eBMGpE-hi;I
zd^B_7Z!<q$@e9h;dSxzCK@rKHj6a5KVE6|uOFmL_eFoC1WZ?&4iN}$YBBIRm-vP~|
zcla}2NMX8xH07qH0b$iJ_;n_0e?MPhNaI5lClrjQqlMqSdeoOFLW717tNoY4W5~P$
zQyDn@bAvf~ie(8ccf$#Yh@`J>?ToI+>QVC9?Sby0b?dL62EwKxgGY7t9zB=)lB;V{
zB%F7S0twlC05JlUSHr4@6_#Jl-?&jAvbg}jf1iDFe$%<Q-tcf)LZ7mdlGhC;gHT^k
z7hz||kAOr$PaRS$D^qz;<IT7W8y%lbnpZ4qbL}C#2FLqliN`y?Ms!tmb>-x&hq5mK
z=oo-Kd@e_=OG`^XG_!^aG;ve47~XaD^dv*80*YGDK@8<S-rjX-%KZePMz;f^1oasS
zFF1XvqzFIV>ns7dNN=(j4K5$J7KR?67j$4;$whQcc%Z52zS1ZB2mT9*-Beh(JHNlw
zjsUKN&eaV#fWmf5WWykcXXEALn=JpPT1h?3%F61X*D%~UkX`xas>313by{aFMz{@2
zNBave*BaHiZ-alk{2@B?gLaPAVc-%t#%RU|-_?n6q=-H}PhRQNBD&n)k|FL_`-&TR
zP1NFLTHx&L%Ygya@9mLP2v0VNg~dg}33}jCi&dQ#04dlKET0%y2MAAJkFBM3G^ehn
zrY6l$(JtsumkkEKlJBIv6o#`zILA?A7Mz-3&3{*vXYB_7YJR<V6-+`mR%cxVr;k%_
zFZb=`GdYq@1hshN6oEu%Rxz&>6V!r~*e^^uGDu)=?%0?*^n2edx_><Pp=W^JZQpT(
za>AEdaOVCfm!1iN@1_My&^Ixiyi>hj-@g;a`xYWR<;_AK6XqyY<N7-{Ic`D*eqnLf
zWwB5^Pv;aP7>Aok2U+h*a!t7_X&>HY`2^=&q7p?)i+QcDfSLz~yk+faz&F+2GP)Kf
z#uv8E(2nCBAh|YbYxS_k`+Me{;7DHDt&}}WHKWW)=haD^fX9dtEV-8E7@=lRh$M-M
z!V#|EewpA>3vRx2;8n3_6xD9pgrkHs|2Yd_VmcD{p3}0h$nlByw{K}~CM!}_QQ5ET
zkQ|0$<-))>7*wKeFUfo?g|H9oe`_#EmnQcKq20()sNWj@*m;wWpAQlnz;qQrc%1%7
zz1Tpm@%k|-=0%XFL8O(;S%@-rbFt6&f^T9QU7qgw^Elh9UwnXBRVnb0h<2c%vu~op
z*4%N%;?x%lKA9{P@G%>QhliaPj(2vZ#Fm{_lC+@~l1KqD5o-W8u&O4p8Nt)*!OHko
zQPCR0%iQhE>Q2WPvDa0ezX<NiAf^#yl0h0(_<V5&&+q^B5N*k9$W)^4AhX0^1f?JE
zqGt9jc6OK+;FM^uCo{QnaURB2(PAsZ#2K4TQ$qs~w{7JK2?;?2y-~Nt0N^T_zvJkB
zGV|?vyTO0mh@D;&U^3FDlVd3epKdsw&n<4{z2&ol`&o@VlwDqoiy85m^q-z|e@j&{
zcI}~BjW5E;ABXv5j$b}Eyw%uE?$1}`x-gZruT6R@5h(6<kitdnH;Wn070&aQZfK*b
zfnHpEYUKCT@`M1;M$if?oUy(iN-7j`D75Xb@Q_Tyj^zYyo?2=)k)i+dLF~WJwg1Pn
z>7VZV|NGyDU!aK^w2oVOn#Q~RqRGG;hkp%x-3>$=|035MMgjASi&<IL7QmjGU*K!y
zkx`eD(wEg&*49>0iDW;u@Cqdsa}hk~E-0T>3)+jU34CpOsKe@2!=XE9ea1{>m299#
zAmpXgr4$tv)zy6&ycyu0_geooKEAxDr~w*jLyzF;`1ILvGOZ~WhkC(^X#LI5%Yh}D
zRACX~s>0~Bflj^{CUNnra~krRvCIo2Evasxj~R_o62U#wuekS;#Ux742F#W(O$ZT)
zJx+?Ig&%WLQCmxkQu;9)XP$+XB?6tY)Kf(?anm})jMolL?X^wv=Xe34X?C`k6io6a
zgYyZeA$kV)*z^%*ja^ObX3V&KVDxLc@wdO#zaQ5Ad>f1`JerSz)S|Ix^6l41QF9(l
zA*!G3KXg$cX+c2Q3xMFHgrqQKI(@zir!n4uo9hBRk}KwvhdjR&?eMEM^lJo<mMt^G
z**d%HXKY>9PRx6KLN`o%AngZ#+;5ONYA;7dzS<6D*C!=WOLTYjumj1PHzn3sZ4I#%
z3u1!Ml66u}pOXz17M21qIS?@jShTfI{X%H1saJ>9*PENyj>THEoowBj>+UPU*>6XR
zUD9P3lU)1$P1DM&_QBWOrXw<aDj4^Iy)URpSfZimOPQlqfjLd4w5G!?R^q4IuvA8)
z7ra9wh)GD+QHx)@3#!4>^ORo`Ogrfolpm{;p11_hdDic;9Zklgw!+VIF7TI1Iu2QT
zg}y+!PoxF%YhuPnYim6juL?wRclNXd5hPIq|HIEO-7oqb#$_d?@QR9ZsJCu22*1}+
zo&aM7X;YKEK`lE6hxZBjW_yPai-@eY^4IatpTkZgv0e2fB)p^5)nDuDyNlKk(+tCq
zrsvbA-A#{O_FIhC#S9hm$O#5n35xF5nm#nc>>z5t=doKEMnJ%G-(615M@L7e&|bH!
zGqSCt;}F)UEUg)lAk&_p7WC7GV8-$EeoISPNoBsNc|;7H4Rog+&CFaEYP>D$+9Rkr
z*f~HNe!CBVzk7Qq2=oc@^HVJUnyP&s^;V)uzbwy^=E60WBKqG$Ll|g${LuP(#}Z9t
zVq#lPPEE~JHyr2RZG?`OfF=g!Vyz;FH(~3jr(@|lU)5%E@GpngmhYxEF#a50X|10s
z|25nkxZyof|EcQtV&;cm0y)OE3)ncs5z-UskC#H7AJDZ_Je(M&lr;L%PQHCSY}d}w
z@HLsKXzIaUhuQi{qwVH0;(d|_=lA{<x~QbEn2;VJ^K0U^E@nd5_sYGrTt&>Cq`Xrd
zT51?@RXcOChYb0|*83)Au{zLk@da|Exx*zln6~4hJ}NPopgOxdTdy;liHKbn6Sz?~
z`%9Oo4F(Tp*;RJm48C>_97d3~OLDk+9HIzajpHSMYJAavD65<)>}C%e>1`D^p>S+r
zVdd^7Znftgka;wN+s(@dFt5&@E-5nzDpOPIH1T>Lx9gT)hs8JKM+c-KB*m#aEO&Lt
zTG!Ij>aMKpNO4Kbt5=)eE3qjte$pWTc&5eva9N9qabw$-E@;>F35idGR6@dK!1n?&
zs;zC^{TeO#M*D~=Qo8`~99aX8D4nRNP}gbJcc;CICXa3%wnvngS6q|yI@sU5631kR
z?e)aT!C<0r7|2_2y`hxm%Jh_E`(c0X<h<R~Rn#uq`>ciXl69ULRANn<8hSKXwa&*d
z$5g#;wfQy9n22h}r~XLAf$~b;hhH#li4BGLe|$daSn)hgx^ON2O<aE3J1fL{9)ekG
z{U};4rt7*EhuJUpSp-+R6kB7sg17qQmE0xVyirwAeIHHvHXcj#45O_r_%u|jQ_P!h
z7$_?X+z`<I$SZWk<+en<tcaT%9>GZo`mKbQ-vzBI6??8<KW%(ML))?o)mx}fDZQ11
z4mKADR8869(8+yk!^wgb)>Xt&A^92~O1)y+^$N9e$lG1sr8f4$B*uO)KN=R~V9uhH
zc`4!&AD$09IT9O9dG-Cl*sRb{`S_axNMy=r#pu=LIP7}0(wh&}=ybH>ISyVGO^1X<
z4uAPVOd1vN;rsG($oB#VtH%qIvXxd^LyP&#b|W>)7hZq<`sJ9?Z#9^TQmd=CH^%q2
z*;*oHORiZ6-Mfc&0S!M)qxTMf%*%=&25C=C726G$IX5mK_1~Ju5pxi71RJ9m^3qJi
z-SJeMi0dwp1}inr7X2JFs4}gKl2iF5nB9_ePtq<}Rz>-1wzBgK+9x-eN_S;ILFrKM
zL-q%K>!v4M%=-;dD9^m<&tt_=8~pq;$NSIR^#ZJjIq%l6zv5_FsLwU%yZ2E|R<_#I
zzs7OqJY3-}`hS6O5Cjd*@{uAU@f;6IpO){LV3cX|)YU<Oh(URoL+?&LG7D5;3GiSv
zb-rqUV<%&07soV4BW7J!b2C}q?tv+{USQ${PD3)8`-l5Ddo)y3IGQZ%?60SodTFJ+
zw6!U`E$`o>3F}(Bl}2RO<1YTlPfNT0hpxtB@{{R$kJE`UHnzqg8t|w)?9HL`44<t+
z{0c^GjVLoirZ6V)a3S+-Q-`G3#FSSFmk*c5-b7-lX}o+B(U8;huKDN7weBqX>x(K`
z7=AHB1FC`4T=HUV44Gay1q#cUG=f%0UXhdSwQXArc$X{2;~$WPGvwxFXlB!1AmCI~
z4F5*Tz_50Ow|%x4t~T$z-oBN#VHFX<p^@;|xy8>(Ge`??Zg~EpNXe%NEihFsianPa
zhoAoDklT#V{BsIES5Yz&olY6wsjaoai{U<y2<+8HHaNYo_M{*k4=4zb$lx>Lrwt@O
zWz<~!T^<`;+vs4HqoLp6?_oF;z&^ineE#A|VZSm}x-jnp*Jaw1BCVeD?S7~l_pdHD
zRu)va3u|;%sDHd=OnNhJIB&3ndzs}yRwuE~sCRYdWUFOqnKK!qEH4fgg(-<R@+v1-
zbk1Fw16001>l4!<t>Nz<a5OdM`qUWj`s3kAw;@VOfS~}>=A4uiI|-uaex8X$`L$Z}
z*DNh8W`ks8?$&uNk}jgroQ{K{5Q;GoMtS~-upvBvP{kAvqV0qXtCp+ry^Xgwgd`52
zJKY-6);>;PIQh}-5Ms}%yL4<EY~B+&rWBOIJjQh@3JQKs0U0~n9>GZ?j?+8tdz31g
zmR{nmq48{ach%o}?ooQ5{0v40UyDdNXxsc&MP=hTawEy?Gqw6e`AgN1XOk<pc!k(y
zUGMlW^y5W(j(SnTsDH{~=K5+EVO*XLT3JB`S)06kTF<<K_Z*R)T|lwBOkqc7MB7$j
zjKL;UNyMs_D&Z5F#xwV(SdF(9`?~Z;Oh4+i7@((^8{qm6eEytrY^oUBPK>~Ga+Djr
zdk5J!R?SZP8e$H292_QVGPHAIqJ5=8LVomoelMS4RMb)L?O0Oe{`BW9pZ#1loJ5+$
zE#IF|>Bg@vxd|UxNd&(7#iA7}N7Dx_S^S8?%#4EASJ%0#UI4Di>X&4o?Cr#qWYJsR
zN8!i%WOHIiZ|bYvk1tCkQPWHe7q?4|eJu~{cmg5B)B&wRquR==cS4>sMEKynu$dSe
zhjILL1FqqHkJUK8<;js3BlM}cc4>}6wxxavnQK9beO+Ophpx-ZhYdTo>A8Zo2AypJ
z9uspqe=odR@9Mr^5ZS`DO*(Pmc?b_{s5Hr2Z$YQR!xql7U)0~N(l0dZG5Ikr7Aomu
zUAdz#kDn0oh#`Pgh=+8Y`kQos3B{?t1~aeQEH1^vVzMz25rU14QkK0j9CvtR8OJcc
zS08)}f*GJxnY?Los`cEaW_?G-d~&K%R>t5Hn3;EhQiqKF5|-RdbJ2XMWh@DgBflkv
zRg$x&#-*p_Z9`p=s%k^I%uMb<gap_PwQ#9Aoq6D0|H!tj@|5S}<Um17u=R&=<}*e6
zU{s4d%R5Yoj`tg%Y;XvD3bTsS;$+MyPl_UZ^yG3ZluN|bwYZ`)!Uleq4XEPr=H%tD
zWM$Hyw=mz18p9S;(!@ij6NHlc{rE<w;2%?{GRPUQieP!Lcp87o&em3G?C>s&<---%
zyO2L`Z*Q}-vU+G^V?tg3GWH%B8nfo%2WnxRko)}D>Z$)!BLib>cgv(Qjw_W~H7g9r
zFj3@+Q_bP`qi&o}p-o}@v)$Cv)<SqRlf^J`a+Y<5o^Aw2*BTBLco3-*4OXpEZM>b1
zyF{){rTuj|1r-;kRchlcF1#qbIVMuQ+>(N({$4*dms(FWUjLRW>CbJTRl@7R=PDXF
z=kHG#2kkz2D&_9(Zl%L|c!_Vl=Xq^zdVV@gHrCR!ubn%Gfs&Vz(z>q8?My_$2q*K=
zLH<Eq$JhZptbaJrs>8h5g>LlBoG9p7g6&FW2_FlFpTz&ay8+?fZoP41za?O2g!9{z
z9xvU<zl4j^&}FVM?g9b9hMU_~+&L*NNJlHitkwj?z3yh?=v<ti2N_tLk89EHOX+wR
z+QQ81%)55dq}Lu|)g8j82>@Lx;-_Cng~_S?*k)SWrOmY38lLBC#i2D%b91|m8!orD
zwrWr&(swgaR-@K?E@kJ&Svr*Q_1{R(%w=Ti!43|{{O|#;KQWV_5%YHn8%#<_jf{S=
z{zAPsj@>fB_%7uWQ5FHFS916NNCN{d`ODk(vaxfp#T8^QKficZ#v;4jaLn@G4P^h<
tFTH4=bLY;To*tsk2f{zjpS_M)=cZn-{XlN<-GuL)lb2PIDU>$x`wxQR{7V1;

literal 0
HcmV?d00001

diff --git a/docs/codex/xirp-context-report.md b/docs/codex/xirp-context-report.md
index 4651d7c..9a3bca7 100644
--- a/docs/codex/xirp-context-report.md
+++ b/docs/codex/xirp-context-report.md
@@ -71,7 +71,12 @@ had limited free disk space.
 - `cargo fmt --all -- --check`: passed.
 - IPC TypeScript tests and typecheck passed. Full frontend run with Node 25
   needs `NODE_OPTIONS=--no-experimental-webstorage` to use jsdom storage;
-  CI uses Node 24. Isolated UI behavior tests are being finalized separately.
+  CI uses Node 24. Full frontend check passed: 121 tests, TypeScript and Vite build.
+- KnowledgePanel: 12 behavior tests, targeted ESLint and Chromium inspection at
+  1100px/375px passed. Native labels/focus and no horizontal overflow checked.
+  [Desktop capture](artifacts/xirp/knowledge-desktop.png) and
+  [narrow editor](artifacts/xirp/knowledge-narrow-editor.png) use an isolated
+  mock-client preview, not a claim of integrated Tauri behavior.
 
 Direct typed serde duplicate-field validation is not a promise that duplicate
 keys are rejected after the daemon's intermediate JSON Value decode.
@@ -80,8 +85,8 @@ Linux CI, actual Tauri/canvas consumption and full parity remain unverified.
 ## Commits / next integration
 
 - `569449f`: source inventory and integration proposal; pushed.
-- Backend first vertical increment follows this report in the current commit.
-- Isolated `KnowledgePanel` follows as its own UI increment. Props:
+- `2f3b7c8`: persisted knowledge contract/SQLite/daemon/typed IPC; pushed.
+- Isolated `KnowledgePanel` is implemented as the next UI commit. Props:
   `{client,currentProject,onInsert,insertDisabledReason}`; insertion receives
   `{sourceId,kind,title,body}` and must append to an editable composer draft.
   Keep panel mounted if unsaved editor drafts must survive closing its surface.
diff --git a/docs/xirp-local-parity.md b/docs/xirp-local-parity.md
index 87f9bff..d51a5d0 100644
--- a/docs/xirp-local-parity.md
+++ b/docs/xirp-local-parity.md
@@ -14,12 +14,12 @@ added to this implementation's scope.
 | X04 | Working/idle/needs-input attention separate from process lifecycle. [Sessions](https://backstage.spotify.com/docs/xirp/sessions) | S2 event source, S3 indicators, S1 canvas | PTY silence is not proof of approval/input need. Explicit hooks or native signals required. |
 | X05 | Local preferences, shortcuts, supported native settings, diagnostics. [Settings](https://backstage.spotify.com/docs/xirp/settings) | S2 settings/runtime, S3 rules/skills, S1 UI | Existing diagnostics/custom-agent creation are baseline only; do not expose unsupported options. Credentials excluded from editors. |
 | X06 | Global/project rules and skills, including symlinked skill directories. [Projects](https://backstage.spotify.com/docs/xirp/projects), [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S3 discovery, S2 file boundary | Need verified location inventory and safe bounded reads with origins/scopes; docs do not enumerate complete formats or precedence. Symlink policy and editing depend on file service. |
-| X07a | Saved global/project prompts, searchable picker and insertion. [Changelog v0.19.1](https://backstage.spotify.com/docs/xirp/changelog) | S3 knowledge, S2 shared registration, S1 canvas insertion | Persisted CRUD and paginated search verified through real SQLite and daemon socket; isolated UI underway; canvas and Linux evidence pending. See S3 report. |
+| X07a | Saved global/project prompts, searchable picker and insertion. [Changelog v0.19.1](https://backstage.spotify.com/docs/xirp/changelog) | S3 knowledge, S2 shared registration, S1 canvas insertion | Persisted CRUD and paginated search verified through real SQLite and daemon socket; isolated panel CRUD/draft tests and responsive Chromium preview passed; canvas and Linux evidence pending. See S3 report. |
 | X07b | Session archive and workflow: backlog/in_progress/in_review/blocked/done. [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S2 organization metadata, S3 controls, S1 filtering | Workflow must not mutate lifecycle. Session pin is a user-requested extension. |
 | X07c | Tokens/spend per session/day. [Changelog v0.18.0](https://backstage.spotify.com/docs/xirp/changelog) | S2 verified native data, S3 presentation | Source documents feature existence, not a collector/format/pricing algorithm. Currently unavailable, not zero. No proxy or PTY-based estimates. |
 | X07d | PR review, Doctor, cleanup. [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S2 runtime/Git, S1 UI | Existing Git status/diagnostics/removal-token safety are baseline; review and expanded cleanup require their real contracts. |
 | X08 | Agent-specific options, including Cursor. [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S2 adapter registry, S1 UI | No flags invented from agent display name; support requires installed-version tests and authoritative CLI sources. |
-| X09-local | Explicit reusable local context between sessions (user request). | S3 knowledge, S1 composer, S2 delivery | Local text records persist and survive daemon restart; explicit draft insertion component is underway. No transcript capture, autonomous summarization, or Portal connection implied. |
+| X09-local | Explicit reusable local context between sessions (user request). | S3 knowledge, S1 composer, S2 delivery | Local text records persist and survive daemon restart; isolated draft insertion component and tests passed; canvas consumption remains pending. No transcript capture, autonomous summarization, or Portal connection implied. |
 | X09-Portal | Shared workspaces, members, catalog links, resources, decisions/wiki. [Workspaces](https://backstage.spotify.com/docs/xirp/workspaces) | Separate authenticated connector | Portal-dependent; no account/API verification supplied. Not implemented or simulated. |
 | X10 | Workspace context via MCP, manual transcript sharing, configured external integrations. [Workspaces](https://backstage.spotify.com/docs/xirp/workspaces) | Separate authenticated connector + S2 transport | Requires real account, scopes/API and explicit outbound preview. No silent publishing, account linking or telemetry. |
 

From 910ed7dec140fc56e0e6896e46c05cfaa7a942db Mon Sep 17 00:00:00 2001
From: guicybercode <euguigom@gmail.com>
Date: Sat, 5 Sep 2026 21:36:15 -0300
Subject: [PATCH 10/23] docs(xirp): record local scope and integration
 contracts

---
 docs/adr/0005-local-knowledge.md       | 74 ++++++++++++++++++++++++++
 docs/codex/xirp-context-report.md      | 37 +++++++++++++
 docs/codex/xirp-integration-request.md | 25 +++++++++
 docs/xirp-local-parity.md              | 36 +++++++++++++
 4 files changed, 172 insertions(+)
 create mode 100644 docs/adr/0005-local-knowledge.md
 create mode 100644 docs/codex/xirp-context-report.md
 create mode 100644 docs/codex/xirp-integration-request.md
 create mode 100644 docs/xirp-local-parity.md

diff --git a/docs/adr/0005-local-knowledge.md b/docs/adr/0005-local-knowledge.md
new file mode 100644
index 0000000..abdea73
--- /dev/null
+++ b/docs/adr/0005-local-knowledge.md
@@ -0,0 +1,74 @@
+# ADR 0005: Local prompts, reusable context, and organization
+
+Status: proposed; shared contract and migration registration await S2 agreement.
+
+## Context
+
+CLI Master needs global/project prompts, reusable local context, and work
+organization without assuming ownership of coding agents. The XIRP reference
+separates optional Portal workspaces from local project/terminal operations.
+The canvas remains the primary UI. Linux and macOS remain first-class.
+
+## Decision
+
+`knowledge` modules hold explicit user-authored saved prompts and context
+records. Core types are pure. Storage uses the existing SQLite database;
+daemon handlers expose the agreed versioned wire contract. No additional
+Tauri client, file service, process executor, or database is introduced.
+
+A record has a UUIDv7 identity, a `prompt` or `context` kind, a nullable project
+ID (null means global), title/body, monotonically increasing integer revision,
+and epoch-millisecond timestamps. Project queries include project and global
+records; global queries include only global records. Project deletion must
+have a documented foreign-key policy, while archive preserves all records.
+
+Creation omits ID and expected revision. Updates/deletes supply both identity
+and the last observed revision. A concurrent edit fails with a stable conflict
+error and preserves the editor draft. Save-as-copy is explicit. Input and list
+response sizes are bounded to fit the daemon's transport limits. Content must
+not appear in Debug, error details, or logs.
+
+Selecting a saved prompt or context inserts editable text in the composer.
+Only a separate explicit runtime action delivers it to an agent. Saving text
+never writes terminal input. Reusing context is not restoring a vendor
+conversation and does not persist a terminal transcript. The initial objective
+must eventually be delivered through SessionManager/verified adapter options;
+a stored text field alone is not completion of that requirement.
+
+Project/session pin/archive and session workflow are organization metadata.
+They neither replace process status nor signal a process. Workflow states are
+`backlog`, `in_progress`, `in_review`, `blocked`, and `done`; archive is a
+separate flag. The runtime owner coordinates their shared types/storage.
+
+Rule/skill discovery inventories explicitly supported locations with origin,
+format, scope, and precedence explanations. It reuses the runtime owner's
+file-access boundary; discovered content is data and is never executed.
+Credential paths are excluded. Symlinks, external changes, size/count limits,
+encoding, and edit conflicts must have explicit behavior and real filesystem
+tests. Reference support for symlinked skill directories is a parity item,
+not permission to traverse arbitrary links or read unrelated home files.
+
+Agent-specific resume/fork/options require verified adapter capabilities.
+Attention needs explicit trustworthy events. Token/cost usage needs native
+records with provenance; unknown data is unavailable, never inferred from
+terminal byte counts, silence, or process duration.
+
+## Integration and dependencies
+
+S2 owns shared Rust wire registration, catalog mirrors, migrations, daemon
+composition/dispatch, runtime/adapters, and the generic file service. S3 sends
+small contracts before editing those boundaries. S1 owns mounting the isolated
+components in the canvas/palette and composer draft insertion. Working
+components and green unit tests do not prove their integrated application flow.
+
+Portal authentication, shared workspaces, MCP exposure and transcript sharing
+remain separate capabilities requiring real contracts/account verification.
+Local context is a CLI Master extension and is not branded as Portal support.
+
+## Verification
+
+Contract tests reject malformed inputs. Persistence tests use real SQLite
+files, reopen, competing connections, project scope, and FK behavior. Socket
+roundtrips prove handlers and effects. Frontend tests use typed callbacks/the
+project IPC client. Canvas integration, Linux/macOS CI and runtime evidence
+are tracked separately from isolated component tests.
diff --git a/docs/codex/xirp-context-report.md b/docs/codex/xirp-context-report.md
new file mode 100644
index 0000000..2fe3b56
--- /dev/null
+++ b/docs/codex/xirp-context-report.md
@@ -0,0 +1,37 @@
+# XIRP local workflows report
+
+Branch: `feat/xirp-local-workflows`.
+Worktree: `/Users/eguimacs/cli-master-xirp`.
+Base: `0ac8dd7`, fetched from `origin/refactor/canvas-only-shell` on 2026-09-05.
+
+## Scope and evidence
+
+The source/acceptance inventory is [xirp-local-parity.md](../xirp-local-parity.md).
+The architecture proposal is [ADR 0005](../adr/0005-local-knowledge.md).
+The full user request remains open; documentation and isolated components are
+intermediate deliverables.
+
+## Coordination
+
+A concrete proposal was placed in `docs/codex/xirp-integration-request.md` in
+S1, S2 and S3 worktrees. S2 acknowledgment is pending for shared contracts,
+module registrations, migration allocation and dispatch. S1 acknowledgment is
+pending for canvas mounting and composer insertion. No shared code has been
+changed by S3 at this point.
+
+Baseline drift reported to owners: active daemon dispatch is `server.rs`;
+`client.rs` is uncompiled. Frontend currently has `types.ts`/`schema.ts` rather
+than the mirrors named in AGENTS. Runtime registry/adapters need consolidation
+by S2; S3 will not introduce another registry or Tauri client.
+
+## Work in progress
+
+- Pure validated knowledge types and contract tests (new module only).
+- Isolated saved prompt/context editor/picker with typed callbacks and tests.
+- Persisted handlers and integration follow the agreed shared boundaries.
+
+## Commits and checks
+
+Initial documentation commit: source review completed; `git diff --check`.
+Implementation tests and runtime/platform evidence will be recorded here as
+executed. No Linux/macOS runtime parity is claimed yet.
diff --git a/docs/codex/xirp-integration-request.md b/docs/codex/xirp-integration-request.md
new file mode 100644
index 0000000..0522dbf
--- /dev/null
+++ b/docs/codex/xirp-integration-request.md
@@ -0,0 +1,25 @@
+# XIRP S3 integration request — 2026-09-05
+
+S3 is active in `/Users/eguimacs/cli-master-xirp`, branch `feat/xirp-local-workflows`, based on latest `origin/refactor/canvas-only-shell` (`0ac8dd7`). The user explicitly requested coordination before shared changes. This file is a coordination message, not part of your commit unless useful.
+
+## S2 runtime / shared-contract owner
+
+Please reply in `/Users/eguimacs/cli-master-xirp/docs/codex/xirp-coordination-reply.md` or append below in this copy. I will inspect both main and runtime copies.
+
+Proposed S3 ownership: new `knowledge/` modules under core/storage/daemon; isolated React components under `app/features/knowledge/`; domain tests and XIRP report. No parallel process executor, file service, database, or Tauri client.
+
+First vertical increment: global/project saved prompts (UUIDv7, title/body/projectId nullable, created/updated epoch-ms, integer revision) and reusable local context documents (same scope/revision plus kind). Explicit insert creates composer draft, never hidden send. Suggest `knowledge.list`, `knowledge.save`, `knowledge.delete` with tagged kind `prompt|context`; optimistic revision on update/delete; `knowledge.updated` event for refresh. Stable existing `invalid_input`/not_found + agreed conflict error. Storage tables in current SQLite with project FK; no runtime side effects.
+
+Next: `knowledge.discover`/`knowledge.read` for explicitly known rule/skill paths, bounded UTF-8/no credentials/no symlink traversal; edit via your file service once available (no duplicate generic file service). Please advise your file contract/reusable safe reader.
+
+Organization metadata: propose separate project/session organization records for pinned/archived, session workflow (backlog/in_progress/in_review/blocked/done) separate from process status, initial objective + explicit local context references. Do you own these fields as planned? Please reserve/implement contracts or delegate an agreed narrow patch. Initial objective execution must use SessionManager/adapters; S3 can own drafting/context composition.
+
+Please confirm migration allocation, shared lib.rs registration, wire/mirrors/dispatch ownership. Can you delegate a small additive S3 patch to these files after review of this proposal, or supply a commit? No shared files have been changed by S3.
+
+## S1 canvas owner
+
+Will deliver isolated components with typed callbacks for saved prompts/context library, rules/skills inspector, and organization controls. Please identify preferred integration surface (canvas contextual panel/toolbar/palette) and coordinate real mounting/composer insertion. Your AppShell/canvas/global styles remain yours. S3 will publish commits and integration API in `docs/codex/xirp-context-report.md`; main canvas remains Maestri.
+
+## Responses
+
+Pending owner acknowledgment.
diff --git a/docs/xirp-local-parity.md b/docs/xirp-local-parity.md
new file mode 100644
index 0000000..4e56b21
--- /dev/null
+++ b/docs/xirp-local-parity.md
@@ -0,0 +1,36 @@
+# XIRP local parity
+
+Sources checked 2026-09-05 against XIRP changelog through v0.25.0 (2026-09-03).
+Baseline: `0ac8dd7`, `origin/refactor/canvas-only-shell`.
+This matrix covers the user's local XIRP request. It complements the main
+session's `docs/maestri-xirp-parity.md`; Portal product features are not silently
+added to this implementation's scope.
+
+| ID | Requirement and source | Owner / integration | Evidence / remaining work |
+| --- | --- | --- | --- |
+| X01 | Local project pin, rename, remove registration, non-Git folders, discover child repositories. [Projects](https://backstage.spotify.com/docs/xirp/projects) | S2 project base, S3 organization UI, S1 canvas | Baseline registers Git projects; pin/archive metadata, non-Git support and child discovery pending. Project archive is a user-requested extension. |
+| X02 | Initial objective delivered to agent, attachments, checkout/worktree and agent-specific options. [Sessions](https://backstage.spotify.com/docs/xirp/sessions) | S2 execution/contracts, S3 draft/context selection, S1 composer | Goal delivery requires verified runtime path, not metadata only. Attachments/options pending runtime contract. |
+| X03 | Resume/fork, agent switch preserving supported history, linked shell. [Sessions](https://backstage.spotify.com/docs/xirp/sessions), [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S2 adapters/runtime, S1 canvas | Current adapter capabilities do not expose verified conversation IDs, fork or usage. Await trusted native contracts and runtime integration. Local context reuse is a separate feature. |
+| X04 | Working/idle/needs-input attention separate from process lifecycle. [Sessions](https://backstage.spotify.com/docs/xirp/sessions) | S2 event source, S3 indicators, S1 canvas | PTY silence is not proof of approval/input need. Explicit hooks or native signals required. |
+| X05 | Local preferences, shortcuts, supported native settings, diagnostics. [Settings](https://backstage.spotify.com/docs/xirp/settings) | S2 settings/runtime, S3 rules/skills, S1 UI | Existing diagnostics/custom-agent creation are baseline only; do not expose unsupported options. Credentials excluded from editors. |
+| X06 | Global/project rules and skills, including symlinked skill directories. [Projects](https://backstage.spotify.com/docs/xirp/projects), [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S3 discovery, S2 file boundary | Need verified location inventory and safe bounded reads with origins/scopes; docs do not enumerate complete formats or precedence. Symlink policy and editing depend on file service. |
+| X07a | Saved global/project prompts, searchable picker and insertion. [Changelog v0.19.1](https://backstage.spotify.com/docs/xirp/changelog) | S3 knowledge, S2 shared registration, S1 canvas insertion | Isolated module implementation underway; persistence, socket, UI integration and cross-platform evidence pending. |
+| X07b | Session archive and workflow: backlog/in_progress/in_review/blocked/done. [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S2 organization metadata, S3 controls, S1 filtering | Workflow must not mutate lifecycle. Session pin is a user-requested extension. |
+| X07c | Tokens/spend per session/day. [Changelog v0.18.0](https://backstage.spotify.com/docs/xirp/changelog) | S2 verified native data, S3 presentation | Source documents feature existence, not a collector/format/pricing algorithm. Currently unavailable, not zero. No proxy or PTY-based estimates. |
+| X07d | PR review, Doctor, cleanup. [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S2 runtime/Git, S1 UI | Existing Git status/diagnostics/removal-token safety are baseline; review and expanded cleanup require their real contracts. |
+| X08 | Agent-specific options, including Cursor. [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S2 adapter registry, S1 UI | No flags invented from agent display name; support requires installed-version tests and authoritative CLI sources. |
+| X09-local | Explicit reusable local context between sessions (user request). | S3 knowledge, S1 composer, S2 delivery | Local text records and explicit draft insertion planned. No transcript capture, autonomous summarization, or Portal connection implied. |
+| X09-Portal | Shared workspaces, members, catalog links, resources, decisions/wiki. [Workspaces](https://backstage.spotify.com/docs/xirp/workspaces) | Separate authenticated connector | Portal-dependent; no account/API verification supplied. Not implemented or simulated. |
+| X10 | Workspace context via MCP, manual transcript sharing, configured external integrations. [Workspaces](https://backstage.spotify.com/docs/xirp/workspaces) | Separate authenticated connector + S2 transport | Requires real account, scopes/API and explicit outbound preview. No silent publishing, account linking or telemetry. |
+
+The [XIRP overview](https://backstage.spotify.com/docs/xirp) confirms local
+projects, terminals, files, rules, skills and worktrees can operate without
+Portal. XIRP's macOS platform statement does not replace CLI Master's Linux
+requirement. A macOS test does not count as Linux verification.
+
+## Completion evidence required
+
+Each implemented row must link its commit, relevant automated tests, persistent
+or filesystem effect, real socket behavior and canvas consumption. Portable
+source code alone does not demonstrate execution on both supported platforms.
+Unknown capabilities remain open dependencies rather than claimed parity.

From bbf4b1ec1896e719ae4a8ec63b9ef4afb623e180 Mon Sep 17 00:00:00 2001
From: guicybercode <euguigom@gmail.com>
Date: Sat, 5 Sep 2026 21:57:30 -0300
Subject: [PATCH 11/23] docs(knowledge): verify rule sources and propose safe
 discovery

---
 docs/codex/xirp-context-report.md     |  6 ++--
 docs/codex/xirp-discovery-contract.md | 41 +++++++++++++++++++++++++++
 docs/codex/xirp-rule-sources.md       | 34 ++++++++++++++++++++++
 3 files changed, 79 insertions(+), 2 deletions(-)
 create mode 100644 docs/codex/xirp-discovery-contract.md
 create mode 100644 docs/codex/xirp-rule-sources.md

diff --git a/docs/codex/xirp-context-report.md b/docs/codex/xirp-context-report.md
index 9a3bca7..03cf72e 100644
--- a/docs/codex/xirp-context-report.md
+++ b/docs/codex/xirp-context-report.md
@@ -80,13 +80,15 @@ had limited free disk space.
 
 Direct typed serde duplicate-field validation is not a promise that duplicate
 keys are rejected after the daemon's intermediate JSON Value decode.
-Linux CI, actual Tauri/canvas consumption and full parity remain unverified.
+Draft [PR 45](https://github.com/guicybercode/Jig/pull/45) targets the canvas
+branch to run Linux/macOS CI. Actual Tauri/canvas consumption and full parity
+remain unverified; CI state must be checked rather than inferred from push.
 
 ## Commits / next integration
 
 - `569449f`: source inventory and integration proposal; pushed.
 - `2f3b7c8`: persisted knowledge contract/SQLite/daemon/typed IPC; pushed.
-- Isolated `KnowledgePanel` is implemented as the next UI commit. Props:
+- `a757f05`: isolated `KnowledgePanel`, 12 behavior tests and visual evidence; pushed. Props:
   `{client,currentProject,onInsert,insertDisabledReason}`; insertion receives
   `{sourceId,kind,title,body}` and must append to an editable composer draft.
   Keep panel mounted if unsaved editor drafts must survive closing its surface.
diff --git a/docs/codex/xirp-discovery-contract.md b/docs/codex/xirp-discovery-contract.md
new file mode 100644
index 0000000..7916630
--- /dev/null
+++ b/docs/codex/xirp-discovery-contract.md
@@ -0,0 +1,41 @@
+# S3 second contract proposal: rule/skill discovery
+
+For S2 review after first knowledge commit `2f3b7c8` and UI commit `a757f05`.
+Approved narrow filesystem reader remains inside `daemon::knowledge`; no
+migration or generic editor is introduced. Source inventory is
+[xirp-rule-sources.md](xirp-rule-sources.md).
+
+Proposed methods:
+
+- `knowledge.discover {projectId?: UUID}` inventories known global locations
+  and optionally one registered project, returning `{scanId,entries,truncated,
+  issues}`. `scanId` and per-entry IDs are ephemeral UUIDv7 capabilities owned
+  by the daemon. Entries show rule/skill, provider, origin/scope, source path,
+  name, precedence explanation and availability; being discovered does not
+  mean the native CLI loaded the item.
+- `knowledge.read {scanId,entryId}` returns the source descriptor and bounded
+  UTF-8 content. Client paths are never passed to file opening. Expired scans,
+  changed files, nonregular/symlinked leaves and unavailable content return
+  specific safe errors; refresh obtains a new scan.
+
+Inventory limits: bounded scan cache with expiry, 512 candidates, 10,000
+visited filesystem entries, depth 16. Read limit: 64 KiB; JSON envelope remains
+under 1 MiB even for worst-case escaping. Truncation/issues must remain visible.
+No content enters logs, Debug, error details, SQLite or telemetry.
+
+Symlink support is intentional at known skill-directory boundaries. Capture
+the target and open it component by component using directory descriptors;
+subsequent SKILL.md reads are pinned to that directory, using NOFOLLOW and
+NONBLOCK before verifying regular-file identity. Merely canonicalizing and
+then reopening a string path is insufficient. Rule/SKILL leaf symlinks are
+reported as unavailable rather than followed into arbitrary credentials.
+
+No native credential/config files, support scripts, imports, or transcript
+files are read. Editing waits for S2's common file contract. Root will publish
+wire/catalog/mirror registration together with functioning handlers/tests;
+awaiting S2 agreement on these two method names and response shape first.
+
+S1: proposed second isolated `KnowledgeSourceInspector` receives project and
+client callbacks, with refresh/list/preview. Keep it inside the canvas surface.
+The current library also needs a host-controlled editable composer draft;
+S1's existing terminal-card draft is configuration, not prompt text.
diff --git a/docs/codex/xirp-rule-sources.md b/docs/codex/xirp-rule-sources.md
new file mode 100644
index 0000000..ac8c074
--- /dev/null
+++ b/docs/codex/xirp-rule-sources.md
@@ -0,0 +1,34 @@
+# Local rule and skill discovery sources
+
+Verified 2026-09-05. This inventory describes discovery candidates, not a claim
+that a running agent loaded or executed every listed file. Native configuration,
+trust, scope and version may change effective behavior. The app does not parse
+credential-bearing settings to infer enabled plugins or custom discovery paths.
+
+| Format | Verified paths and precedence | Source |
+| --- | --- | --- |
+| Codex instructions | `CODEX_HOME` (default `~/.codex`): first nonempty `AGENTS.override.md`, then `AGENTS.md`. At each directory from repository root to cwd, same order before configured fallback names; more specific directories follow root instructions. Default aggregate bound 32 KiB. | [AGENTS.md](https://learn.chatgpt.com/docs/agent-configuration/agents-md) |
+| Codex skills | `.agents/skills` from cwd up to repo root, `~/.agents/skills`, `/etc/codex/skills`, plus bundled system skills. Duplicate names remain separate candidates. Symlinked skill directories are supported. | [Build skills](https://learn.chatgpt.com/docs/build-skills) |
+| Claude instructions/rules | User `~/.claude/CLAUDE.md`, project `CLAUDE.md` or `.claude/CLAUDE.md`, personal `CLAUDE.local.md`. User `~/.claude/rules/*.md` and project `.claude/rules/**/*.md`; user rules precede project rules. Parent instructions load at launch, descendants can load on demand. Imports exist, but discovery must not follow arbitrary imported files. | [Memory](https://code.claude.com/docs/en/memory) |
+| Claude skills | `~/.claude/skills/<name>/SKILL.md` and `.claude/skills/<name>/SKILL.md`, including parent/nested project scopes. Personal overrides project name collisions; plugin names are namespaced. Skill directories may be symlinks; aliases to the same target are deduplicated by the CLI. | [Skills](https://code.claude.com/docs/en/skills) |
+| Cursor rules | Project `.cursor/rules/**/*.mdc`, with path/manual/relevance conditions. Plain `.md` files are ignored there. `AGENTS.md` is supported. Global user rules are application settings rather than standalone rule files; no invented home-file location. | [Rules](https://cursor.com/docs/rules) |
+| Cursor skills | Project `.agents/skills`, `.cursor/skills` and user `~/.agents/skills`, `~/.cursor/skills`. Skill roots can contain nested groups and project subdirectories; nested candidates have directory scope. | [Skills](https://cursor.com/docs/skills) |
+
+## Local reader decisions to verify
+
+The inspector will show provider/format, global/project origin, relative scope,
+source path and a precedence explanation. A candidate is not automatically
+marked active: editor settings, custom fallback names, plugins, conditional
+frontmatter and selected session cwd can affect native loading.
+
+No credential/config JSON, arbitrary Markdown imports, support scripts or
+transcripts enter the inventory. The reader only opens an allowlisted rule or
+`SKILL.md`, requires regular UTF-8 files and applies byte/count/depth limits.
+Symlinked skill directories need an explicit verified target policy and race
+protection. Rule edits will use S2's common file service once its contract is
+published, rather than adding a second generic editor.
+
+Directory discovery and content read are local operations. They never invoke a
+CLI, execute scripts, install skills, change native configuration or contact
+Portal. Missing, changed, unreadable, oversized and unsafe candidates must be
+reported as such rather than silently fabricated as empty files.

From 1a74bbb2baddb1ca5decd473b849fe812f08d0c1 Mon Sep 17 00:00:00 2001
From: guicybercode <euguigom@gmail.com>
Date: Sat, 5 Sep 2026 21:50:20 -0300
Subject: [PATCH 12/23] feat(knowledge): persist scoped prompts and context
 over IPC

---
 apps/desktop/src/ipc/client.test.ts           |  31 +
 apps/desktop/src/ipc/client.ts                |  17 +
 apps/desktop/src/ipc/domain.ts                |  45 ++
 apps/desktop/src/ipc/knowledge-schema.test.ts |  39 ++
 apps/desktop/src/ipc/knowledge-schema.ts      |  64 +++
 apps/desktop/src/ipc/methods.ts               |   5 +-
 apps/desktop/src/test/mockIpc.ts              |   6 +
 crates/core/src/knowledge/mod.rs              | 530 ++++++++++++++++++
 crates/core/src/lib.rs                        |   1 +
 crates/core/src/wire/method.rs                |  10 +
 crates/core/src/wire/mod.rs                   |   6 +
 crates/core/tests/knowledge_catalog.rs        |  19 +
 crates/core/tests/knowledge_contract.rs       | 271 +++++++++
 crates/daemon/src/knowledge/mod.rs            |  68 +++
 crates/daemon/src/lib.rs                      |   1 +
 crates/daemon/src/server.rs                   |  14 +
 crates/daemon/tests/knowledge_ipc.rs          | 248 ++++++++
 .../migrations/0004_knowledge_documents.sql   |  29 +
 crates/storage/src/durability_tests.rs        |   1 +
 crates/storage/src/knowledge/mod.rs           | 402 +++++++++++++
 crates/storage/src/lib.rs                     |   4 +-
 crates/storage/src/migrate.rs                 |  21 +
 crates/storage/tests/knowledge.rs             | 509 +++++++++++++++++
 docs/adr/0005-local-knowledge.md              |   3 +-
 docs/codex/xirp-context-report.md             | 100 +++-
 docs/codex/xirp-coordination-reply.md         |  44 ++
 docs/codex/xirp-integration-request.md        |  21 +
 docs/xirp-local-parity.md                     |   6 +-
 protocol/catalog.json                         |   5 +-
 protocol/fixtures/knowledge-page.json         |  25 +
 30 files changed, 2515 insertions(+), 30 deletions(-)
 create mode 100644 apps/desktop/src/ipc/knowledge-schema.test.ts
 create mode 100644 apps/desktop/src/ipc/knowledge-schema.ts
 create mode 100644 crates/core/src/knowledge/mod.rs
 create mode 100644 crates/core/tests/knowledge_catalog.rs
 create mode 100644 crates/core/tests/knowledge_contract.rs
 create mode 100644 crates/daemon/src/knowledge/mod.rs
 create mode 100644 crates/daemon/tests/knowledge_ipc.rs
 create mode 100644 crates/storage/migrations/0004_knowledge_documents.sql
 create mode 100644 crates/storage/src/knowledge/mod.rs
 create mode 100644 crates/storage/tests/knowledge.rs
 create mode 100644 docs/codex/xirp-coordination-reply.md
 create mode 100644 protocol/fixtures/knowledge-page.json

diff --git a/apps/desktop/src/ipc/client.test.ts b/apps/desktop/src/ipc/client.test.ts
index f487293..be45fab 100644
--- a/apps/desktop/src/ipc/client.test.ts
+++ b/apps/desktop/src/ipc/client.test.ts
@@ -379,3 +379,34 @@ function requestFromArgs(value: unknown): RequestEnvelope<unknown> {
   }
   return value.request as RequestEnvelope<unknown>;
 }
+
+// Knowledge uses the same versioned request transport as all domain methods.
+describe("knowledge IPC transport", () => {
+  it("keeps revisions and scope and surfaces conflicts without issuing session writes", async () => {
+    const entry = {
+      id: "0198f000-0000-7000-8000-000000000010", kind: "prompt", projectId: null,
+      title: "Review", body: "Review the selected changes", revision: 1,
+      createdAtMs: 100, updatedAtMs: 100,
+    };
+    transport.invoke.mockReset();
+    installWireResponder({
+      "knowledge.list": { entries: [entry], nextCursor: null },
+      "knowledge.save": entry,
+      "knowledge.delete": {},
+    });
+    const client = createTauriIpcClient();
+    expect(await client.listKnowledge({ projectId: null, query: "review" })).toEqual({ entries: [entry], nextCursor: null });
+    const input = { kind: "prompt" as const, projectId: null, title: entry.title, body: entry.body };
+    expect(await client.saveKnowledge(input)).toEqual(entry);
+    await client.deleteKnowledge({ id: entry.id, expectedRevision: 1 });
+    expect(capturedRequests().map((request) => request.method)).toEqual(["knowledge.list", "knowledge.save", "knowledge.delete"]);
+    expect(capturedRequests()[1].payload).toEqual(input);
+    expect(capturedRequests()[2].payload).toEqual({ id: entry.id, expectedRevision: 1 });
+
+    transport.invoke.mockImplementation(async (_command, { request }) => ({
+      kind: "response", version: 1, requestId: request.requestId, status: "error",
+      error: { code: "knowledge_conflict", message: "This entry changed. Reload or save a copy." },
+    }));
+    await expect(client.saveKnowledge({ ...input, id: entry.id, expectedRevision: 1 })).rejects.toMatchObject({ code: "knowledge_conflict" });
+  });
+});
diff --git a/apps/desktop/src/ipc/client.ts b/apps/desktop/src/ipc/client.ts
index e30335d..62b2cdb 100644
--- a/apps/desktop/src/ipc/client.ts
+++ b/apps/desktop/src/ipc/client.ts
@@ -1,3 +1,5 @@
+import { decodeKnowledgeEntry, decodeKnowledgePage } from "./knowledge-schema";
+import type { KnowledgeEntry, KnowledgeListRequest, KnowledgeListResponse, KnowledgeSaveRequest, KnowledgeDeleteRequest } from "./domain";
 import { invoke } from "@tauri-apps/api/core";
 import { listen } from "@tauri-apps/api/event";
 import { openPath } from "@tauri-apps/plugin-opener";
@@ -60,6 +62,9 @@ export interface TerminalResizeInput {
 /** The sole frontend interface to daemon and native desktop capabilities. */
 export interface IpcClient {
   readonly platform: AppPlatform;
+  listKnowledge(input: KnowledgeListRequest): Promise<KnowledgeListResponse>;
+  saveKnowledge(input: KnowledgeSaveRequest): Promise<KnowledgeEntry>;
+  deleteKnowledge(input: KnowledgeDeleteRequest): Promise<void>;
   initialize(): Promise<BootstrapResult>;
   subscribe(
     handler: IpcEventHandler,
@@ -136,6 +141,18 @@ export function toIpcError(error: unknown): IpcError {
 class TauriIpcClient implements IpcClient {
   readonly platform = detectPlatform();
 
+  async listKnowledge(input: KnowledgeListRequest): Promise<KnowledgeListResponse> {
+    return decodeKnowledgePage(await this.request("knowledge.list", input));
+  }
+
+  async saveKnowledge(input: KnowledgeSaveRequest): Promise<KnowledgeEntry> {
+    return decodeKnowledgeEntry(await this.request("knowledge.save", input));
+  }
+
+  async deleteKnowledge(input: KnowledgeDeleteRequest): Promise<void> {
+    await this.request("knowledge.delete", input);
+  }
+
   async initialize(): Promise<BootstrapResult> {
     const hello = decodeHello(await this.request("system.hello", {}));
     if (hello.protocolVersion !== 1) {
diff --git a/apps/desktop/src/ipc/domain.ts b/apps/desktop/src/ipc/domain.ts
index 7cb4aa6..d53c607 100644
--- a/apps/desktop/src/ipc/domain.ts
+++ b/apps/desktop/src/ipc/domain.ts
@@ -10,3 +10,48 @@ export interface WorktreeListRequest {
 export interface WorktreeListResponse {
   readonly worktrees: readonly Worktree[];
 }
+
+/** User-authored local text; no Portal connection or transcript capture. */
+export type KnowledgeKind = "prompt" | "context";
+
+/** Mirrors the validated Rust knowledge entry. */
+export interface KnowledgeEntry {
+  readonly id: string;
+  readonly kind: KnowledgeKind;
+  readonly projectId: string | null;
+  readonly title: string;
+  readonly body: string;
+  readonly revision: number;
+  readonly createdAtMs: number;
+  readonly updatedAtMs: number;
+}
+
+/** Null/omitted project selects globals; a project includes its global entries. */
+export interface KnowledgeListRequest {
+  readonly projectId?: string | null;
+  readonly kind?: KnowledgeKind;
+  readonly cursor?: string;
+  readonly query?: string;
+}
+
+/** Bodies are included in bounded, cursor-based result pages. */
+export interface KnowledgeListResponse {
+  readonly entries: readonly KnowledgeEntry[];
+  readonly nextCursor: string | null;
+}
+
+/** A create omits id/revision; an update requires both. */
+export interface KnowledgeSaveRequest {
+  readonly id?: string;
+  readonly expectedRevision?: number;
+  readonly kind: KnowledgeKind;
+  readonly projectId: string | null;
+  readonly title: string;
+  readonly body: string;
+}
+
+/** A stale delete leaves the existing text intact. */
+export interface KnowledgeDeleteRequest {
+  readonly id: string;
+  readonly expectedRevision: number;
+}
diff --git a/apps/desktop/src/ipc/knowledge-schema.test.ts b/apps/desktop/src/ipc/knowledge-schema.test.ts
new file mode 100644
index 0000000..3004c9f
--- /dev/null
+++ b/apps/desktop/src/ipc/knowledge-schema.test.ts
@@ -0,0 +1,39 @@
+import { describe, expect, it } from "vitest";
+import catalog from "../../../../protocol/catalog.json";
+import fixture from "../../../../protocol/fixtures/knowledge-page.json";
+import { IPC_METHODS } from "./methods";
+import { decodeKnowledgeEntry, decodeKnowledgePage } from "./knowledge-schema";
+
+describe("knowledge Rust/TypeScript contract", () => {
+  it("decodes the same fixture as the Rust contract, including explicit nulls", () => {
+    expect(decodeKnowledgePage(fixture)).toEqual(fixture);
+    expect(fixture.nextCursor).toBeNull();
+    expect(fixture.entries[0].projectId).toBeNull();
+  });
+
+  it("mirrors every public method", () => {
+    expect(IPC_METHODS).toEqual(catalog.methods);
+  });
+
+  it("rejects unknown variants without echoing text", () => {
+    expect(() => decodeKnowledgeEntry({ ...fixture.entries[0], kind: "private content" })).toThrow("Invalid knowledge kind");
+  });
+
+  it("rejects unsafe revisions, text bounds and timestamps", () => {
+    for (const change of [
+      { revision: 0 }, { revision: Number.MAX_SAFE_INTEGER + 1 },
+      { updatedAtMs: -1 }, { body: "\0" }, { title: "é".repeat(129) },
+      { body: "a".repeat(65_537) },
+    ]) expect(() => decodeKnowledgeEntry({ ...fixture.entries[0], ...change })).toThrow();
+  });
+
+  it("shares Rust Unicode whitespace validation", () => {
+    expect(decodeKnowledgeEntry({ ...fixture.entries[0], body: "\uFEFF" }).body).toBe("\uFEFF");
+    expect(() => decodeKnowledgeEntry({ ...fixture.entries[0], body: "\u0085" })).toThrow();
+  });
+
+  it("rejects a cursor that cannot advance and repeated rows", () => {
+    expect(() => decodeKnowledgePage({ entries: [], nextCursor: fixture.entries[0].id })).toThrow();
+    expect(() => decodeKnowledgePage({ entries: [fixture.entries[0], fixture.entries[0]], nextCursor: null })).toThrow();
+  });
+});
diff --git a/apps/desktop/src/ipc/knowledge-schema.ts b/apps/desktop/src/ipc/knowledge-schema.ts
new file mode 100644
index 0000000..5b3d890
--- /dev/null
+++ b/apps/desktop/src/ipc/knowledge-schema.ts
@@ -0,0 +1,64 @@
+import { IpcContractError, requireArray, requireRecord, requireString } from "./schema";
+import type { KnowledgeEntry, KnowledgeListResponse } from "./domain";
+
+/** Keep constants aligned with core::knowledge validation. */
+export const KNOWLEDGE_TITLE_BYTES = 256;
+export const KNOWLEDGE_BODY_BYTES = 65_536;
+
+function uuid(value: unknown, version7 = false): string {
+  const text = requireString(value, "knowledge identifier");
+  const pattern = version7
+    ? /^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i
+    : /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+  if (!pattern.test(text)) throw new IpcContractError("Invalid knowledge identifier");
+  return text;
+}
+
+function integer(value: unknown, minimum: number): number {
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < minimum) {
+    throw new IpcContractError("Invalid knowledge revision or timestamp");
+  }
+  return value;
+}
+
+function content(value: unknown, maximum: number): string {
+  const text = requireString(value, "knowledge text");
+  if (!/[^\p{White_Space}]/u.test(text) || text.includes("\0") || new TextEncoder().encode(text).length > maximum) {
+    throw new IpcContractError("Invalid knowledge text length or encoding");
+  }
+  return text;
+}
+
+/** Validate content without including its text in contract failures. */
+export function decodeKnowledgeEntry(value: unknown): KnowledgeEntry {
+  const row = requireRecord(value, "knowledge entry");
+  if (row.kind !== "prompt" && row.kind !== "context") {
+    throw new IpcContractError("Invalid knowledge kind");
+  }
+  const createdAtMs = integer(row.createdAtMs, 0);
+  const updatedAtMs = integer(row.updatedAtMs, createdAtMs);
+  return {
+    id: uuid(row.id, true),
+    kind: row.kind,
+    projectId: row.projectId === null ? null : uuid(row.projectId),
+    title: content(row.title, KNOWLEDGE_TITLE_BYTES),
+    body: content(row.body, KNOWLEDGE_BODY_BYTES),
+    revision: integer(row.revision, 1),
+    createdAtMs,
+    updatedAtMs,
+  };
+}
+
+/** Enforce page shape, stable ordering and a usable continuation cursor. */
+export function decodeKnowledgePage(value: unknown): KnowledgeListResponse {
+  const page = requireRecord(value, "knowledge page");
+  const entries = requireArray(page.entries, "knowledge entries").map(decodeKnowledgeEntry);
+  if (entries.length > 50 || entries.some((entry, index) => index > 0 && entry.id <= entries[index - 1].id)) {
+    throw new IpcContractError("Invalid knowledge page ordering or size");
+  }
+  const nextCursor = page.nextCursor === null ? null : uuid(page.nextCursor, true);
+  if (nextCursor !== null && nextCursor !== entries[entries.length - 1]?.id) {
+    throw new IpcContractError("Invalid knowledge page cursor");
+  }
+  return { entries, nextCursor };
+}
diff --git a/apps/desktop/src/ipc/methods.ts b/apps/desktop/src/ipc/methods.ts
index 7b00a06..530b06e 100644
--- a/apps/desktop/src/ipc/methods.ts
+++ b/apps/desktop/src/ipc/methods.ts
@@ -28,7 +28,10 @@ export const IPC_METHODS = [
   "worktree.list",
   "worktree.prepare_remove",
   "worktree.remove",
-  "diagnostics.get"
+  "diagnostics.get",
+  "knowledge.list",
+  "knowledge.save",
+  "knowledge.delete"
 ] as const;
 
 export type IpcMethod = (typeof IPC_METHODS)[number];
diff --git a/apps/desktop/src/test/mockIpc.ts b/apps/desktop/src/test/mockIpc.ts
index 0b13c8d..c5bdb6a 100644
--- a/apps/desktop/src/test/mockIpc.ts
+++ b/apps/desktop/src/test/mockIpc.ts
@@ -24,6 +24,9 @@ export interface MockIpcClientOptions {
 
 /** An injected IPC fake whose unconfigured application calls fail loudly. */
 export interface MockIpcClient extends IpcClient {
+  readonly listKnowledge: Mock<IpcClient["listKnowledge"]>;
+  readonly saveKnowledge: Mock<IpcClient["saveKnowledge"]>;
+  readonly deleteKnowledge: Mock<IpcClient["deleteKnowledge"]>;
   readonly initialize: Mock<IpcClient["initialize"]>;
   readonly subscribe: Mock<IpcClient["subscribe"]>;
   readonly subscribeTerminal: Mock<IpcClient["subscribeTerminal"]>;
@@ -146,6 +149,9 @@ export function createMockIpcClient(
     getDiagnostics: vi.fn<IpcClient["getDiagnostics"]>(
       handlers.getDiagnostics ?? (() => rejectUnhandled("getDiagnostics")),
     ),
+    listKnowledge: vi.fn<IpcClient["listKnowledge"]>(handlers.listKnowledge ?? (() => rejectUnhandled("listKnowledge"))),
+    saveKnowledge: vi.fn<IpcClient["saveKnowledge"]>(handlers.saveKnowledge ?? (() => rejectUnhandled("saveKnowledge"))),
+    deleteKnowledge: vi.fn<IpcClient["deleteKnowledge"]>(handlers.deleteKnowledge ?? (() => rejectUnhandled("deleteKnowledge"))),
     openPath: vi.fn<IpcClient["openPath"]>(
       handlers.openPath ?? (() => rejectUnhandled("openPath")),
     ),
diff --git a/crates/core/src/knowledge/mod.rs b/crates/core/src/knowledge/mod.rs
new file mode 100644
index 0000000..e093754
--- /dev/null
+++ b/crates/core/src/knowledge/mod.rs
@@ -0,0 +1,530 @@
+//! Pure contracts for saved local prompts and reusable context.
+//!
+//! Text crosses the local IPC boundary intentionally, but is excluded from
+//! diagnostic formatting. This module performs no filesystem or process I/O.
+
+use std::{error::Error, fmt, str::FromStr};
+
+use serde::{Deserialize, Deserializer, Serialize, de};
+use uuid::{Uuid, Variant};
+
+use crate::ProjectId;
+
+/// Maximum saved title length in UTF-8 bytes.
+pub const MAX_KNOWLEDGE_TITLE_BYTES: usize = 256;
+/// Maximum saved prompt or context length in UTF-8 bytes.
+pub const MAX_KNOWLEDGE_BODY_BYTES: usize = 64 * 1_024;
+/// Highest revision that JavaScript can represent without rounding.
+pub const MAX_KNOWLEDGE_REVISION: u64 = 9_007_199_254_740_991;
+
+/// Safe validation failure containing only static labels and explanations.
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct KnowledgeValidationError {
+    field: &'static str,
+    message: &'static str,
+}
+
+impl KnowledgeValidationError {
+    const fn new(field: &'static str, message: &'static str) -> Self {
+        Self { field, message }
+    }
+
+    /// Returns the invalid field's stable label.
+    #[must_use]
+    pub const fn field(&self) -> &'static str {
+        self.field
+    }
+
+    /// Returns an explanation that never includes submitted content.
+    #[must_use]
+    pub const fn message(&self) -> &'static str {
+        self.message
+    }
+}
+
+impl fmt::Display for KnowledgeValidationError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(formatter, "{} {}", self.field, self.message)
+    }
+}
+
+impl Error for KnowledgeValidationError {}
+
+/// UUID version 7 identifier for one saved prompt or context entry.
+#[derive(Clone, Copy, Debug, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(transparent)]
+pub struct KnowledgeId(Uuid);
+
+impl KnowledgeId {
+    /// Generates a time-ordered UUID version 7 identifier.
+    #[must_use]
+    pub fn new() -> Self {
+        Self(Uuid::now_v7())
+    }
+
+    /// Validates an existing UUID without changing it.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error unless the UUID uses version 7 and the RFC variant.
+    pub fn try_from_uuid(value: Uuid) -> Result<Self, KnowledgeValidationError> {
+        if value.get_version_num() != 7 || value.get_variant() != Variant::RFC4122 {
+            return Err(KnowledgeValidationError::new(
+                "id",
+                "must be a UUID version 7",
+            ));
+        }
+        Ok(Self(value))
+    }
+
+    /// Returns the underlying UUID.
+    #[must_use]
+    pub const fn as_uuid(&self) -> &Uuid {
+        &self.0
+    }
+
+    /// Consumes the identifier and returns the underlying UUID.
+    #[must_use]
+    pub const fn into_uuid(self) -> Uuid {
+        self.0
+    }
+}
+
+impl Default for KnowledgeId {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl fmt::Display for KnowledgeId {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        self.0.fmt(formatter)
+    }
+}
+
+impl FromStr for KnowledgeId {
+    type Err = KnowledgeValidationError;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        let uuid = Uuid::parse_str(value)
+            .map_err(|_| KnowledgeValidationError::new("id", "must be a UUID version 7"))?;
+        Self::try_from_uuid(uuid)
+    }
+}
+
+impl<'de> Deserialize<'de> for KnowledgeId {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        let value = String::deserialize(deserializer)
+            .map_err(|_| de::Error::custom("id must be a UUID version 7 string"))?;
+        value.parse().map_err(de::Error::custom)
+    }
+}
+
+/// The local purpose of a saved knowledge entry.
+#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum KnowledgeKind {
+    /// Reusable instructions selected explicitly by a user.
+    Prompt,
+    /// Reusable local background information selected explicitly by a user.
+    Context,
+}
+
+macro_rules! knowledge_text {
+    ($name:ident, $description:literal, $field:literal, $maximum:ident) => {
+        #[doc = $description]
+        #[derive(Clone, Eq, PartialEq, Serialize)]
+        #[serde(transparent)]
+        pub struct $name(String);
+
+        impl $name {
+            /// Validates text while preserving its exact whitespace and content.
+            ///
+            /// # Errors
+            ///
+            /// Returns an error for blank text, a NUL byte, or an exceeded byte limit.
+            pub fn try_new(value: impl Into<String>) -> Result<Self, KnowledgeValidationError> {
+                let value = value.into();
+                validate_text($field, &value, $maximum)?;
+                Ok(Self(value))
+            }
+
+            /// Returns validated text for explicit use or local persistence.
+            #[must_use]
+            pub fn as_str(&self) -> &str {
+                &self.0
+            }
+
+            /// Consumes the value and returns its text.
+            #[must_use]
+            pub fn into_inner(self) -> String {
+                self.0
+            }
+        }
+
+        impl fmt::Debug for $name {
+            fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+                formatter
+                    .debug_struct(stringify!($name))
+                    .field("bytes", &self.0.len())
+                    .finish_non_exhaustive()
+            }
+        }
+
+        impl<'de> Deserialize<'de> for $name {
+            fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+            where
+                D: Deserializer<'de>,
+            {
+                let value = String::deserialize(deserializer)
+                    .map_err(|_| de::Error::custom(concat!($field, " must be text")))?;
+                Self::try_new(value).map_err(de::Error::custom)
+            }
+        }
+    };
+}
+
+knowledge_text!(
+    KnowledgeTitle,
+    "Non-blank saved title bounded to 256 UTF-8 bytes; diagnostic output is redacted.",
+    "title",
+    MAX_KNOWLEDGE_TITLE_BYTES
+);
+knowledge_text!(
+    KnowledgeBody,
+    "Non-blank prompt or context bounded to 64 KiB; diagnostic output is redacted.",
+    "body",
+    MAX_KNOWLEDGE_BODY_BYTES
+);
+
+/// One persisted local prompt or context entry.
+#[derive(Clone, Debug, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct KnowledgeEntry {
+    /// Stable identifier generated by the local owner.
+    pub id: KnowledgeId,
+    /// Prompt or context classification.
+    pub kind: KnowledgeKind,
+    /// Owning project, or no project for a globally reusable entry.
+    pub project_id: Option<ProjectId>,
+    /// User-facing title, excluded from diagnostic formatting.
+    pub title: KnowledgeTitle,
+    /// Explicitly saved user content, excluded from diagnostic formatting.
+    pub body: KnowledgeBody,
+    /// Positive revision used for optimistic concurrency.
+    pub revision: u64,
+    /// Creation time as Unix epoch milliseconds.
+    pub created_at_ms: i64,
+    /// Most recent edit time as Unix epoch milliseconds.
+    pub updated_at_ms: i64,
+}
+
+impl KnowledgeEntry {
+    /// Checks invariants for a programmatically assembled entry.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error for invalid revisions or timestamps outside the ordered,
+    /// non-negative JavaScript-safe epoch millisecond range.
+    pub const fn validate(&self) -> Result<(), KnowledgeValidationError> {
+        match validate_revision("revision", self.revision) {
+            Ok(()) => (),
+            Err(error) => return Err(error),
+        }
+        if self.created_at_ms < 0
+            || self.updated_at_ms < self.created_at_ms
+            || self.updated_at_ms > 9_007_199_254_740_991
+        {
+            return Err(KnowledgeValidationError::new(
+                "timestamps",
+                "must satisfy 0 <= createdAtMs <= updatedAtMs <= 9007199254740991",
+            ));
+        }
+        Ok(())
+    }
+}
+
+impl<'de> Deserialize<'de> for KnowledgeEntry {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        #[derive(Deserialize)]
+        #[serde(deny_unknown_fields, rename_all = "camelCase")]
+        struct Fields {
+            id: KnowledgeId,
+            kind: KnowledgeKind,
+            project_id: Option<ProjectId>,
+            title: KnowledgeTitle,
+            body: KnowledgeBody,
+            revision: u64,
+            created_at_ms: i64,
+            updated_at_ms: i64,
+        }
+
+        let fields = Fields::deserialize(deserializer)
+            .map_err(|_| de::Error::custom("invalid saved knowledge entry"))?;
+        let entry = Self {
+            id: fields.id,
+            kind: fields.kind,
+            project_id: fields.project_id,
+            title: fields.title,
+            body: fields.body,
+            revision: fields.revision,
+            created_at_ms: fields.created_at_ms,
+            updated_at_ms: fields.updated_at_ms,
+        };
+        entry.validate().map_err(de::Error::custom)?;
+        Ok(entry)
+    }
+}
+
+/// Selects global entries, optionally including entries owned by one project.
+#[derive(Clone, Default, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct KnowledgeListRequest {
+    /// When absent, list global entries only; when present, include this project.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub project_id: Option<ProjectId>,
+    /// Optional prompt/context filter applied to both scopes.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub kind: Option<KnowledgeKind>,
+    /// Exclusive cursor in ascending identifier order.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cursor: Option<KnowledgeId>,
+    /// Literal case-insensitive title/body search, bounded to 256 UTF-8 bytes.
+    ///
+    /// Empty text means no search filter. The daemon trims surrounding whitespace.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub query: Option<String>,
+}
+
+impl KnowledgeListRequest {
+    /// Checks search limits for programmatic callers.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error for an oversized or NUL-containing search query.
+    pub fn validate(&self) -> Result<(), KnowledgeValidationError> {
+        if let Some(query) = &self.query {
+            if query.len() > MAX_KNOWLEDGE_TITLE_BYTES {
+                return Err(KnowledgeValidationError::new(
+                    "query",
+                    "exceeds its UTF-8 byte limit",
+                ));
+            }
+            if query.contains('\0') {
+                return Err(KnowledgeValidationError::new(
+                    "query",
+                    "must not contain a NUL byte",
+                ));
+            }
+        }
+        Ok(())
+    }
+}
+
+impl fmt::Debug for KnowledgeListRequest {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("KnowledgeListRequest")
+            .field("project_id", &self.project_id)
+            .field("kind", &self.kind)
+            .field("cursor", &self.cursor)
+            .field("query_bytes", &self.query.as_ref().map(String::len))
+            .finish()
+    }
+}
+
+impl<'de> Deserialize<'de> for KnowledgeListRequest {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        #[derive(Deserialize)]
+        #[serde(deny_unknown_fields, rename_all = "camelCase")]
+        struct Fields {
+            project_id: Option<ProjectId>,
+            kind: Option<KnowledgeKind>,
+            cursor: Option<KnowledgeId>,
+            query: Option<String>,
+        }
+
+        let fields = Fields::deserialize(deserializer)
+            .map_err(|_| de::Error::custom("invalid knowledge list request"))?;
+        let mut request = Self {
+            project_id: fields.project_id,
+            kind: fields.kind,
+            cursor: fields.cursor,
+            query: fields.query,
+        };
+        request.validate().map_err(de::Error::custom)?;
+        request.query = request.query.map(|query| query.trim().to_owned());
+        Ok(request)
+    }
+}
+
+/// Bounded page of local knowledge in ascending identifier order.
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(deny_unknown_fields, rename_all = "camelCase")]
+pub struct KnowledgeListResponse {
+    /// Entries selected and packed within the daemon's row and byte limits.
+    pub entries: Vec<KnowledgeEntry>,
+    /// Exclusive cursor for the next page, or null when the result is exhausted.
+    pub next_cursor: Option<KnowledgeId>,
+}
+
+/// Creates a local entry or replaces its text with an optimistic revision check.
+#[derive(Clone, Debug, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct KnowledgeSaveRequest {
+    /// Absent for creation; identifies the existing entry for an update.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub id: Option<KnowledgeId>,
+    /// Absent for creation; must equal the persisted revision for an update.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub expected_revision: Option<u64>,
+    /// Owning project, or global scope when absent.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub project_id: Option<ProjectId>,
+    /// Explicit prompt/context classification.
+    pub kind: KnowledgeKind,
+    /// Validated saved title.
+    pub title: KnowledgeTitle,
+    /// Validated saved content.
+    pub body: KnowledgeBody,
+}
+
+impl KnowledgeSaveRequest {
+    /// Checks mutation shape and revision bounds for programmatic callers.
+    ///
+    /// Persistence must check the expected revision atomically with the write.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error for a partial id/revision pair or an invalid revision.
+    pub const fn validate(&self) -> Result<(), KnowledgeValidationError> {
+        match (self.id, self.expected_revision) {
+            (None, None) => Ok(()),
+            (Some(_), Some(revision)) => validate_revision("expectedRevision", revision),
+            _ => Err(KnowledgeValidationError::new(
+                "id and expectedRevision",
+                "must either both be absent for creation or both be present for an update",
+            )),
+        }
+    }
+}
+
+impl<'de> Deserialize<'de> for KnowledgeSaveRequest {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        #[derive(Deserialize)]
+        #[serde(deny_unknown_fields, rename_all = "camelCase")]
+        struct Fields {
+            id: Option<KnowledgeId>,
+            expected_revision: Option<u64>,
+            project_id: Option<ProjectId>,
+            kind: KnowledgeKind,
+            title: KnowledgeTitle,
+            body: KnowledgeBody,
+        }
+
+        let fields = Fields::deserialize(deserializer)
+            .map_err(|_| de::Error::custom("invalid knowledge save request"))?;
+        let request = Self {
+            id: fields.id,
+            expected_revision: fields.expected_revision,
+            project_id: fields.project_id,
+            kind: fields.kind,
+            title: fields.title,
+            body: fields.body,
+        };
+        request.validate().map_err(de::Error::custom)?;
+        Ok(request)
+    }
+}
+
+/// Removes one local entry only if its revision still matches the user's copy.
+#[derive(Clone, Copy, Debug, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct KnowledgeDeleteRequest {
+    /// Stable identifier of the entry to remove.
+    pub id: KnowledgeId,
+    /// Revision observed when removal was requested.
+    pub expected_revision: u64,
+}
+
+impl KnowledgeDeleteRequest {
+    /// Checks revision bounds for programmatic callers.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error for a zero or JavaScript-unsafe revision.
+    pub const fn validate(&self) -> Result<(), KnowledgeValidationError> {
+        validate_revision("expectedRevision", self.expected_revision)
+    }
+}
+
+impl<'de> Deserialize<'de> for KnowledgeDeleteRequest {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        #[derive(Deserialize)]
+        #[serde(deny_unknown_fields, rename_all = "camelCase")]
+        struct Fields {
+            id: KnowledgeId,
+            expected_revision: u64,
+        }
+
+        let fields = Fields::deserialize(deserializer)
+            .map_err(|_| de::Error::custom("invalid knowledge delete request"))?;
+        let request = Self {
+            id: fields.id,
+            expected_revision: fields.expected_revision,
+        };
+        request.validate().map_err(de::Error::custom)?;
+        Ok(request)
+    }
+}
+
+fn validate_text(
+    field: &'static str,
+    value: &str,
+    maximum_bytes: usize,
+) -> Result<(), KnowledgeValidationError> {
+    if value.len() > maximum_bytes {
+        return Err(KnowledgeValidationError::new(
+            field,
+            "exceeds its UTF-8 byte limit",
+        ));
+    }
+    if value.trim().is_empty() {
+        return Err(KnowledgeValidationError::new(field, "must not be blank"));
+    }
+    if value.contains('\0') {
+        return Err(KnowledgeValidationError::new(
+            field,
+            "must not contain a NUL byte",
+        ));
+    }
+    Ok(())
+}
+
+const fn validate_revision(
+    field: &'static str,
+    revision: u64,
+) -> Result<(), KnowledgeValidationError> {
+    if revision == 0 || revision > MAX_KNOWLEDGE_REVISION {
+        return Err(KnowledgeValidationError::new(
+            field,
+            "must be an integer between 1 and 9007199254740991",
+        ));
+    }
+    Ok(())
+}
diff --git a/crates/core/src/lib.rs b/crates/core/src/lib.rs
index 2fcd66d..2cb3f64 100644
--- a/crates/core/src/lib.rs
+++ b/crates/core/src/lib.rs
@@ -9,6 +9,7 @@ mod catalog;
 mod command;
 mod error;
 mod ids;
+pub mod knowledge;
 mod model;
 mod protocol;
 mod redact;
diff --git a/crates/core/src/wire/method.rs b/crates/core/src/wire/method.rs
index 96bffd5..b067015 100644
--- a/crates/core/src/wire/method.rs
+++ b/crates/core/src/wire/method.rs
@@ -65,6 +65,13 @@ pub const WORKTREE_REMOVE: &str = "worktree.remove";
 /// Read a sanitized local diagnostic snapshot.
 pub const DIAGNOSTICS_GET: &str = "diagnostics.get";
 
+/// List scoped saved prompts/context in bounded pages.
+pub const KNOWLEDGE_LIST: &str = "knowledge.list";
+/// Create or revision-check an explicit saved prompt/context.
+pub const KNOWLEDGE_SAVE: &str = "knowledge.save";
+/// Delete a saved prompt/context after checking its revision.
+pub const KNOWLEDGE_DELETE: &str = "knowledge.delete";
+
 /// Every method implemented by the Beta v1 contract.
 pub const ALL: &[&str] = &[
     SYSTEM_HELLO,
@@ -96,6 +103,9 @@ pub const ALL: &[&str] = &[
     WORKTREE_PREPARE_REMOVE,
     WORKTREE_REMOVE,
     DIAGNOSTICS_GET,
+    KNOWLEDGE_LIST,
+    KNOWLEDGE_SAVE,
+    KNOWLEDGE_DELETE,
 ];
 
 /// Returns whether a dotted method belongs to the Beta v1 contract.
diff --git a/crates/core/src/wire/mod.rs b/crates/core/src/wire/mod.rs
index 71737a2..a5e6657 100644
--- a/crates/core/src/wire/mod.rs
+++ b/crates/core/src/wire/mod.rs
@@ -13,6 +13,12 @@ mod request;
 mod response;
 mod value;
 
+pub use crate::knowledge::{
+    KnowledgeBody, KnowledgeDeleteRequest, KnowledgeEntry, KnowledgeId, KnowledgeKind,
+    KnowledgeListRequest, KnowledgeListResponse, KnowledgeSaveRequest, KnowledgeTitle,
+    KnowledgeValidationError, MAX_KNOWLEDGE_BODY_BYTES, MAX_KNOWLEDGE_REVISION,
+    MAX_KNOWLEDGE_TITLE_BYTES,
+};
 pub use event::{
     AgentChangedEvent, AgentRemovedEvent, DaemonShuttingDownEvent, GitStatusChangedEvent,
     ProjectChangedEvent, ProjectRemovedEvent, SessionChangedEvent, SessionDeletedEvent,
diff --git a/crates/core/tests/knowledge_catalog.rs b/crates/core/tests/knowledge_catalog.rs
new file mode 100644
index 0000000..b28cd66
--- /dev/null
+++ b/crates/core/tests/knowledge_catalog.rs
@@ -0,0 +1,19 @@
+use cli_master_core::wire::{event_name, method};
+use serde_json::{Value, json};
+
+#[test]
+fn knowledge_operations_share_the_authoritative_catalog() {
+    let catalog: Value =
+        serde_json::from_str(include_str!("../../../protocol/catalog.json")).unwrap();
+    assert_eq!(catalog["methods"], json!(method::ALL));
+    assert_eq!(catalog["events"], json!(event_name::ALL));
+    for name in [
+        method::KNOWLEDGE_LIST,
+        method::KNOWLEDGE_SAVE,
+        method::KNOWLEDGE_DELETE,
+    ] {
+        assert!(method::is_supported(name));
+    }
+    // The metadata event is deliberately not advertised until its transport exists.
+    assert!(!event_name::is_supported("knowledge.updated"));
+}
diff --git a/crates/core/tests/knowledge_contract.rs b/crates/core/tests/knowledge_contract.rs
new file mode 100644
index 0000000..5920876
--- /dev/null
+++ b/crates/core/tests/knowledge_contract.rs
@@ -0,0 +1,271 @@
+use cli_master_core::{
+    ProjectId,
+    knowledge::{
+        KnowledgeBody, KnowledgeDeleteRequest, KnowledgeEntry, KnowledgeId, KnowledgeKind,
+        KnowledgeListRequest, KnowledgeListResponse, KnowledgeSaveRequest, KnowledgeTitle,
+        MAX_KNOWLEDGE_BODY_BYTES, MAX_KNOWLEDGE_REVISION, MAX_KNOWLEDGE_TITLE_BYTES,
+    },
+};
+use serde_json::{Value, json};
+use uuid::Uuid;
+
+fn create_payload() -> Value {
+    json!({"kind": "prompt", "title": "Review", "body": "  Review this change.\n"})
+}
+
+fn entry() -> KnowledgeEntry {
+    KnowledgeEntry {
+        id: KnowledgeId::new(),
+        kind: KnowledgeKind::Context,
+        project_id: Some(ProjectId::new()),
+        title: KnowledgeTitle::try_new("Architecture").unwrap(),
+        body: KnowledgeBody::try_new("Keep the process owner in the daemon.\n").unwrap(),
+        revision: 2,
+        created_at_ms: 1_778_000_000_000,
+        updated_at_ms: 1_778_000_000_001,
+    }
+}
+
+#[test]
+fn shared_page_fixture_matches_the_typed_contract_exactly() {
+    let fixture: Value = serde_json::from_str(include_str!(
+        "../../../protocol/fixtures/knowledge-page.json"
+    ))
+    .unwrap();
+    let page: KnowledgeListResponse = serde_json::from_value(fixture.clone()).unwrap();
+    assert!(page.entries[0].id < page.entries[1].id);
+    assert_eq!(page.entries[0].project_id, None);
+    assert!(page.entries[1].project_id.is_some());
+    assert_eq!(page.next_cursor, None);
+    assert_eq!(serde_json::to_value(page).unwrap(), fixture);
+}
+
+#[test]
+fn entry_timestamps_reject_negative_reversed_and_unsafe_values() {
+    for (created, updated) in [(-1, 0), (2, 1), (0, 9_007_199_254_740_992)] {
+        let mut invalid = entry();
+        invalid.created_at_ms = created;
+        invalid.updated_at_ms = updated;
+        assert!(invalid.validate().is_err());
+        assert!(serde_json::from_value::<KnowledgeEntry>(json!(invalid)).is_err());
+    }
+}
+
+#[test]
+fn identifiers_validate_version_and_variant_without_echoing_input() {
+    let id = KnowledgeId::new();
+    assert_eq!(id.as_uuid().get_version_num(), 7);
+    assert_eq!(id.to_string().parse::<KnowledgeId>().unwrap(), id);
+    assert_eq!(KnowledgeId::try_from_uuid(id.into_uuid()).unwrap(), id);
+    assert_eq!(
+        serde_json::from_value::<KnowledgeId>(json!(id)).unwrap(),
+        id
+    );
+    assert_eq!(KnowledgeId::default().as_uuid().get_version_num(), 7);
+
+    for invalid in [
+        "secret prompt text",
+        "00000000-0000-0000-0000-000000000000",
+        "550e8400-e29b-41d4-a716-446655440000",
+        "01900000-0000-7000-0000-000000000000",
+    ] {
+        let error = invalid.parse::<KnowledgeId>().unwrap_err();
+        assert_eq!(error.field(), "id");
+        assert!(!error.message().contains(invalid));
+        assert!(!error.to_string().contains(invalid));
+        assert!(serde_json::from_value::<KnowledgeId>(json!(invalid)).is_err());
+    }
+    assert!(KnowledgeId::try_from_uuid(Uuid::nil()).is_err());
+    assert!(serde_json::from_value::<KnowledgeId>(json!(5)).is_err());
+}
+
+#[test]
+fn text_validation_counts_utf8_bytes_preserves_whitespace_and_redacts_debug() {
+    let title = "á".repeat(MAX_KNOWLEDGE_TITLE_BYTES / 2);
+    assert_eq!(
+        KnowledgeTitle::try_new(title.clone()).unwrap().into_inner(),
+        title
+    );
+    assert!(KnowledgeTitle::try_new(format!("{title}a")).is_err());
+    let body = "á".repeat(MAX_KNOWLEDGE_BODY_BYTES / 2);
+    assert_eq!(
+        KnowledgeBody::try_new(body.clone()).unwrap().into_inner(),
+        body
+    );
+    assert!(KnowledgeBody::try_new(format!("{body}a")).is_err());
+
+    for invalid in ["", " \t\n", "private\0body"] {
+        assert!(KnowledgeTitle::try_new(invalid).is_err());
+        assert!(KnowledgeBody::try_new(invalid).is_err());
+    }
+    let text = "  private-content\n";
+    let title = KnowledgeTitle::try_new(text).unwrap();
+    let body = KnowledgeBody::try_new(text).unwrap();
+    assert_eq!(title.as_str(), text);
+    assert_eq!(body.as_str(), text);
+    assert!(!format!("{title:?} {body:?}").contains("private-content"));
+}
+
+#[test]
+fn create_and_update_require_matching_id_revision_presence() {
+    let created: KnowledgeSaveRequest = serde_json::from_value(create_payload()).unwrap();
+    assert_eq!(created.id, None);
+    assert_eq!(created.expected_revision, None);
+    assert_eq!(created.body.as_str(), "  Review this change.\n");
+    assert_eq!(serde_json::to_value(&created).unwrap(), create_payload());
+
+    let mut updated = create_payload();
+    updated["id"] = json!(KnowledgeId::new());
+    assert!(serde_json::from_value::<KnowledgeSaveRequest>(updated.clone()).is_err());
+    updated["expectedRevision"] = json!(1);
+    let request: KnowledgeSaveRequest = serde_json::from_value(updated.clone()).unwrap();
+    assert_eq!(request.expected_revision, Some(1));
+    assert_eq!(serde_json::to_value(&request).unwrap(), updated);
+    updated.as_object_mut().unwrap().remove("id");
+    assert!(serde_json::from_value::<KnowledgeSaveRequest>(updated).is_err());
+
+    let mut invalid_programmatic = created;
+    invalid_programmatic.expected_revision = Some(1);
+    assert!(invalid_programmatic.validate().is_err());
+}
+
+#[test]
+fn every_mutation_rejects_zero_fractional_and_unsafe_revisions() {
+    for revision in [
+        json!(0),
+        json!(-1),
+        json!(1.5),
+        json!(MAX_KNOWLEDGE_REVISION + 1),
+        json!("1"),
+    ] {
+        let mut update = create_payload();
+        update["id"] = json!(KnowledgeId::new());
+        update["expectedRevision"] = revision.clone();
+        assert!(serde_json::from_value::<KnowledgeSaveRequest>(update).is_err());
+        assert!(
+            serde_json::from_value::<KnowledgeDeleteRequest>(json!({
+                "id": KnowledgeId::new(), "expectedRevision": revision,
+            }))
+            .is_err()
+        );
+        let mut invalid_entry = serde_json::to_value(entry()).unwrap();
+        invalid_entry["revision"] = revision;
+        assert!(serde_json::from_value::<KnowledgeEntry>(invalid_entry).is_err());
+    }
+
+    for revision in [1, MAX_KNOWLEDGE_REVISION] {
+        let deletion = KnowledgeDeleteRequest {
+            id: KnowledgeId::new(),
+            expected_revision: revision,
+        };
+        let round_trip: KnowledgeDeleteRequest = serde_json::from_value(json!(deletion)).unwrap();
+        assert_eq!(round_trip, deletion);
+        let mut valid_entry = entry();
+        valid_entry.revision = revision;
+        assert!(serde_json::from_value::<KnowledgeEntry>(json!(valid_entry)).is_ok());
+    }
+}
+
+#[test]
+fn wire_contract_uses_camel_case_epoch_milliseconds_and_optional_scope() {
+    let entry = entry();
+    let encoded = serde_json::to_value(&entry).unwrap();
+    assert_eq!(encoded["createdAtMs"], 1_778_000_000_000_i64);
+    assert_eq!(encoded["updatedAtMs"], 1_778_000_000_001_i64);
+    assert_eq!(encoded["projectId"], json!(entry.project_id));
+    assert_eq!(encoded["kind"], "context");
+    assert_eq!(
+        serde_json::from_value::<KnowledgeEntry>(encoded).unwrap(),
+        entry
+    );
+
+    let mut global = entry;
+    global.project_id = None;
+    assert_eq!(
+        serde_json::to_value(global).unwrap()["projectId"],
+        Value::Null
+    );
+    assert_eq!(
+        serde_json::to_value(KnowledgeListRequest::default()).unwrap(),
+        json!({})
+    );
+}
+
+#[test]
+fn list_contract_validates_pagination_search_and_response() {
+    let id = KnowledgeId::new();
+    let project_id = ProjectId::new();
+    let request: KnowledgeListRequest = serde_json::from_value(json!({
+        "projectId": project_id, "kind": "prompt", "cursor": id, "query": "  secret_%query  ",
+    }))
+    .unwrap();
+    assert_eq!(request.project_id, Some(project_id));
+    assert_eq!(request.kind, Some(KnowledgeKind::Prompt));
+    assert_eq!(request.cursor, Some(id));
+    assert_eq!(request.query.as_deref(), Some("secret_%query"));
+    assert!(!format!("{request:?}").contains("secret_%query"));
+    assert!(serde_json::from_value::<KnowledgeListRequest>(json!({"query": "   "})).is_ok());
+    assert!(
+        serde_json::from_value::<KnowledgeListRequest>(json!({"query": "a".repeat(256)})).is_ok()
+    );
+    for invalid in ["a".repeat(257), "secret\0query".into()] {
+        assert!(serde_json::from_value::<KnowledgeListRequest>(json!({"query": invalid})).is_err());
+    }
+
+    let response = KnowledgeListResponse {
+        entries: vec![entry()],
+        next_cursor: Some(id),
+    };
+    let encoded = serde_json::to_value(&response).unwrap();
+    assert_eq!(encoded["nextCursor"], json!(id));
+    assert_eq!(
+        serde_json::from_value::<KnowledgeListResponse>(encoded).unwrap(),
+        response
+    );
+    assert_eq!(
+        serde_json::to_value(KnowledgeListResponse {
+            entries: vec![],
+            next_cursor: None
+        })
+        .unwrap(),
+        json!({"entries": [], "nextCursor": null}),
+    );
+}
+
+#[test]
+fn schemas_reject_unknown_duplicate_and_unsafe_fields_without_text_leaks() {
+    let mut save = create_payload();
+    save["private_unknown_content"] = json!(true);
+    let error = serde_json::from_value::<KnowledgeSaveRequest>(save).unwrap_err();
+    assert!(!error.to_string().contains("private_unknown_content"));
+    assert!(
+        serde_json::from_str::<KnowledgeSaveRequest>(
+            r#"{"kind":"prompt","title":"One","title":"Two","body":"Text"}"#,
+        )
+        .is_err()
+    );
+    assert!(serde_json::from_value::<KnowledgeListRequest>(json!({"limit": 99})).is_err());
+    assert!(
+        serde_json::from_value::<KnowledgeDeleteRequest>(json!({
+            "id": KnowledgeId::new(), "expectedRevision": 1, "force": true,
+        }))
+        .is_err()
+    );
+    let mut saved = serde_json::to_value(entry()).unwrap();
+    saved["extra"] = json!(true);
+    assert!(serde_json::from_value::<KnowledgeEntry>(saved).is_err());
+
+    for field in ["title", "body"] {
+        let mut invalid = create_payload();
+        invalid[field] = json!("private-content\0");
+        let error = serde_json::from_value::<KnowledgeSaveRequest>(invalid).unwrap_err();
+        assert!(!error.to_string().contains("private-content"));
+    }
+    let request: KnowledgeSaveRequest = serde_json::from_value(json!({
+        "kind": "prompt", "title": "private-title", "body": "private-body",
+    }))
+    .unwrap();
+    let debug = format!("{request:?}");
+    assert!(!debug.contains("private-title"));
+    assert!(!debug.contains("private-body"));
+}
diff --git a/crates/daemon/src/knowledge/mod.rs b/crates/daemon/src/knowledge/mod.rs
new file mode 100644
index 0000000..cce9d75
--- /dev/null
+++ b/crates/daemon/src/knowledge/mod.rs
@@ -0,0 +1,68 @@
+//! Local user-authored knowledge; no session or process side effects.
+
+use cli_master_core::ApiError;
+use cli_master_core::wire::{
+    EmptyResponse, KnowledgeDeleteRequest, KnowledgeListRequest, KnowledgeSaveRequest,
+};
+use cli_master_storage::Storage;
+use serde::de::DeserializeOwned;
+use serde_json::Value;
+use std::time::{SystemTime, UNIX_EPOCH};
+
+/// Handle only the registered knowledge methods through the existing database.
+pub(crate) fn dispatch(method: &str, payload: Value, storage: &Storage) -> Result<Value, ApiError> {
+    use cli_master_core::wire::method;
+    match method {
+        method::KNOWLEDGE_LIST => {
+            let request: KnowledgeListRequest = decode(payload)?;
+            encode(
+                storage
+                    .list_knowledge(&request)
+                    .map_err(|error| error.to_api_error())?,
+            )
+        }
+        method::KNOWLEDGE_SAVE => {
+            let request: KnowledgeSaveRequest = decode(payload)?;
+            let now = SystemTime::now()
+                .duration_since(UNIX_EPOCH)
+                .ok()
+                .and_then(|elapsed| i64::try_from(elapsed.as_millis()).ok())
+                .ok_or_else(|| {
+                    ApiError::new("clock_unavailable", "The local clock is unavailable.")
+                })?;
+            encode(
+                storage
+                    .save_knowledge(&request, now)
+                    .map_err(|error| error.to_api_error())?,
+            )
+        }
+        method::KNOWLEDGE_DELETE => {
+            let request: KnowledgeDeleteRequest = decode(payload)?;
+            storage
+                .delete_knowledge(&request)
+                .map_err(|error| error.to_api_error())?;
+            encode(EmptyResponse::default())
+        }
+        _ => Err(ApiError::new(
+            "unsupported_method",
+            "Unknown knowledge operation.",
+        )),
+    }
+}
+
+fn decode<T: DeserializeOwned>(payload: Value) -> Result<T, ApiError> {
+    // Serde errors can quote a user value (e.g. an invalid enum variant). Never
+    // attach them to errors for a text-bearing knowledge request.
+    serde_json::from_value(payload).map_err(|_| {
+        ApiError::new(
+            "invalid_payload",
+            "The saved prompt or context request is invalid.",
+        )
+        .with_action("Check the title, text, scope and revision, then retry.")
+    })
+}
+
+fn encode(value: impl serde::Serialize) -> Result<Value, ApiError> {
+    serde_json::to_value(value)
+        .map_err(|_| ApiError::new("internal_error", "The local response could not be encoded."))
+}
diff --git a/crates/daemon/src/lib.rs b/crates/daemon/src/lib.rs
index 7575f9f..685d628 100644
--- a/crates/daemon/src/lib.rs
+++ b/crates/daemon/src/lib.rs
@@ -14,6 +14,7 @@ mod diagnostics;
 mod error;
 mod events;
 mod git_inspection;
+mod knowledge;
 mod lock;
 mod paths;
 mod preflight;
diff --git a/crates/daemon/src/server.rs b/crates/daemon/src/server.rs
index 855d60a..49aefc5 100644
--- a/crates/daemon/src/server.rs
+++ b/crates/daemon/src/server.rs
@@ -557,6 +557,20 @@ async fn dispatch(
     }
 
     let result = match request.method.as_str() {
+        method::KNOWLEDGE_LIST | method::KNOWLEDGE_SAVE | method::KNOWLEDGE_DELETE => {
+            let state = Arc::clone(state);
+            match tokio::task::spawn_blocking(move || {
+                crate::knowledge::dispatch(&request.method, request.payload, &state.git_storage)
+            })
+            .await
+            {
+                Ok(result) => result,
+                Err(_) => Err(ApiError::new(
+                    "knowledge_operation_failed",
+                    "The local knowledge operation could not complete.",
+                )),
+            }
+        }
         method::SYSTEM_HELLO => encode_response(&state.hello),
         method::STATE_SNAPSHOT => state.projects.snapshot().and_then(|projects| {
             let agents = state.sessions.agents()?;
diff --git a/crates/daemon/tests/knowledge_ipc.rs b/crates/daemon/tests/knowledge_ipc.rs
new file mode 100644
index 0000000..1417ade
--- /dev/null
+++ b/crates/daemon/tests/knowledge_ipc.rs
@@ -0,0 +1,248 @@
+//! Real socket/SQLite acceptance for local prompts and context.
+use std::{path::Path, process::Command, time::Duration};
+
+use cli_master_core::{RequestEnvelope, ResponseEnvelope, ResponsePayload};
+use cli_master_daemon::{Daemon, DaemonConfig, MAX_FRAME_LENGTH};
+use futures_util::{SinkExt, StreamExt};
+use serde_json::{Value, json};
+use tempfile::TempDir;
+use tokio::net::UnixStream;
+use tokio_util::{
+    codec::{Framed, LengthDelimitedCodec},
+    sync::CancellationToken,
+};
+
+type Client = Framed<UnixStream, LengthDelimitedCodec>;
+
+struct Running {
+    config: DaemonConfig,
+    cancellation: CancellationToken,
+    task: tokio::task::JoinHandle<Result<(), cli_master_daemon::DaemonError>>,
+}
+
+impl Running {
+    fn start(root: &Path) -> Self {
+        let config = DaemonConfig::from_paths(root.join("data"), root.join("run"));
+        let daemon = Daemon::bind(config.clone()).unwrap();
+        let cancellation = CancellationToken::new();
+        let token = cancellation.clone();
+        let task = tokio::spawn(async move { daemon.run(token).await });
+        Self {
+            config,
+            cancellation,
+            task,
+        }
+    }
+
+    async fn connect(&self) -> Client {
+        LengthDelimitedCodec::builder()
+            .max_frame_length(MAX_FRAME_LENGTH)
+            .new_framed(
+                UnixStream::connect(self.config.socket_path())
+                    .await
+                    .unwrap(),
+            )
+    }
+
+    async fn stop(self) {
+        self.cancellation.cancel();
+        tokio::time::timeout(Duration::from_secs(5), self.task)
+            .await
+            .unwrap()
+            .unwrap()
+            .unwrap();
+    }
+}
+
+async fn exchange(client: &mut Client, method: &str, payload: Value) -> ResponseEnvelope<Value> {
+    let request = RequestEnvelope::v1(method, payload);
+    client
+        .send(serde_json::to_vec(&request).unwrap().into())
+        .await
+        .unwrap();
+    let bytes = tokio::time::timeout(Duration::from_secs(5), client.next())
+        .await
+        .unwrap()
+        .unwrap()
+        .unwrap();
+    assert!(bytes.len() <= MAX_FRAME_LENGTH);
+    let response: ResponseEnvelope<Value> = serde_json::from_slice(&bytes).unwrap();
+    assert_eq!(response.request_id, request.request_id);
+    response
+}
+
+async fn success(client: &mut Client, method: &str, payload: Value) -> Value {
+    match exchange(client, method, payload).await.payload {
+        ResponsePayload::Success { data } => data,
+        ResponsePayload::Error { error } => panic!("{method}: {}", error.code),
+    }
+}
+
+fn error_code(response: ResponseEnvelope<Value>) -> String {
+    match response.payload {
+        ResponsePayload::Error { error } => error.code,
+        ResponsePayload::Success { .. } => panic!("expected request failure"),
+    }
+}
+
+async fn project(client: &mut Client, root: &Path, name: &str) -> Value {
+    let path = root.join(name);
+    std::fs::create_dir(&path).unwrap();
+    assert!(
+        Command::new("git")
+            .args(["init", "--initial-branch=main"])
+            .current_dir(&path)
+            .output()
+            .unwrap()
+            .status
+            .success()
+    );
+    success(client, "project.add", json!({"path":path, "name":name})).await["id"].clone()
+}
+
+#[tokio::test]
+async fn knowledge_scopes_conflicts_restart_and_no_session_effects() {
+    let root = TempDir::new().unwrap();
+    let daemon = Running::start(root.path());
+    let mut client = daemon.connect().await;
+    let mut second = daemon.connect().await;
+    let first_project = project(&mut client, root.path(), "first").await;
+    let other_project = project(&mut client, root.path(), "other").await;
+    let before = success(&mut client, "state.snapshot", json!({})).await;
+    let global = success(&mut client, "knowledge.save", json!({
+        "kind":"prompt", "projectId":null, "title":"Review % literal", "body":"Review this change without sending anything."
+    })).await;
+    assert!(global["projectId"].is_null());
+    let local = success(&mut client, "knowledge.save", json!({
+        "kind":"context", "projectId":first_project, "title":"Decision", "body":"Keep the original process owner."
+    })).await;
+    let page = success(
+        &mut second,
+        "knowledge.list",
+        json!({"projectId":first_project}),
+    )
+    .await;
+    assert_eq!(page["entries"].as_array().unwrap().len(), 2);
+    assert!(page["nextCursor"].is_null());
+    let other = success(
+        &mut second,
+        "knowledge.list",
+        json!({"projectId":other_project}),
+    )
+    .await;
+    assert_eq!(other["entries"], json!([global]));
+    let literal = success(&mut second, "knowledge.list", json!({"query":"%"})).await;
+    assert_eq!(literal["entries"], json!([global]));
+    let updated = success(
+        &mut client,
+        "knowledge.save",
+        json!({
+            "id":global["id"], "expectedRevision":1, "kind":"prompt", "projectId":null,
+            "title":"Reviewed", "body":"Updated prompt"
+        }),
+    )
+    .await;
+    assert_eq!(updated["revision"], 2);
+    assert_eq!(updated["createdAtMs"], global["createdAtMs"]);
+    for method in ["knowledge.save", "knowledge.delete"] {
+        let payload = if method == "knowledge.save" {
+            json!({
+                "id":global["id"], "expectedRevision":1, "kind":"prompt", "projectId":null,
+                "title":"stale", "body":"must not replace updated text"
+            })
+        } else {
+            json!({"id":global["id"], "expectedRevision":1})
+        };
+        assert_eq!(
+            error_code(exchange(&mut second, method, payload).await),
+            "knowledge_conflict"
+        );
+    }
+    let after = success(&mut client, "state.snapshot", json!({})).await;
+    assert_eq!(after["sessions"], before["sessions"]);
+    assert_eq!(after["worktrees"], before["worktrees"]);
+    drop(client);
+    drop(second);
+    daemon.stop().await;
+
+    let daemon = Running::start(root.path());
+    let mut client = daemon.connect().await;
+    let page = success(
+        &mut client,
+        "knowledge.list",
+        json!({"projectId":first_project}),
+    )
+    .await;
+    assert!(page["entries"].as_array().unwrap().contains(&updated));
+    assert!(page["entries"].as_array().unwrap().contains(&local));
+    success(
+        &mut client,
+        "knowledge.delete",
+        json!({"id":updated["id"],"expectedRevision":2}),
+    )
+    .await;
+    success(
+        &mut client,
+        "project.remove",
+        json!({"projectId":first_project}),
+    )
+    .await;
+    assert!(root.path().join("first/.git").is_dir());
+    let empty = success(&mut client, "knowledge.list", json!({})).await;
+    assert_eq!(empty, json!({"entries":[],"nextCursor":null}));
+    daemon.stop().await;
+}
+
+#[tokio::test]
+async fn knowledge_worst_case_escaped_pages_and_safe_invalid_payloads() {
+    let root = TempDir::new().unwrap();
+    let daemon = Running::start(root.path());
+    let mut client = daemon.connect().await;
+    let body = "\u{1}".repeat(65_536);
+    let mut ids = Vec::new();
+    for index in 0..3 {
+        let entry = success(
+            &mut client,
+            "knowledge.save",
+            json!({
+                "kind":"prompt", "title":format!("Large {index}"), "body":body, "projectId":null
+            }),
+        )
+        .await;
+        ids.push(entry["id"].clone());
+    }
+    let mut seen = Vec::new();
+    let mut cursor = Value::Null;
+    for _ in 0..4 {
+        let page = success(&mut client, "knowledge.list", json!({"cursor":cursor})).await;
+        for entry in page["entries"].as_array().unwrap() {
+            assert_eq!(entry["body"], body);
+            seen.push(entry["id"].clone());
+        }
+        cursor = page["nextCursor"].clone();
+        if cursor.is_null() {
+            break;
+        }
+    }
+    assert!(cursor.is_null());
+    assert_eq!(seen, ids);
+    for payload in [
+        json!({"kind":"private-submitted-content", "title":"text", "body":"private-submitted-content"}),
+        json!({"kind":"prompt", "title":"text", "body":"private-submitted-content", "expectedRevision":0}),
+        json!({"kind":"prompt", "title":"text", "body":"x".repeat(65_537)}),
+        json!({"kind":"prompt", "title":"text", "body":"\0"}),
+    ] {
+        let response = exchange(&mut client, "knowledge.save", payload).await;
+        assert!(
+            !serde_json::to_string(&response)
+                .unwrap()
+                .contains("private-submitted-content")
+        );
+        assert_eq!(error_code(response), "invalid_payload");
+    }
+    assert_eq!(
+        success(&mut client, "state.snapshot", json!({})).await["sessions"],
+        json!([])
+    );
+    daemon.stop().await;
+}
diff --git a/crates/storage/migrations/0004_knowledge_documents.sql b/crates/storage/migrations/0004_knowledge_documents.sql
new file mode 100644
index 0000000..e663cb5
--- /dev/null
+++ b/crates/storage/migrations/0004_knowledge_documents.sql
@@ -0,0 +1,29 @@
+-- Explicitly saved local content. Project removal deletes scoped metadata only.
+CREATE TABLE knowledge_documents (
+    id              TEXT PRIMARY KEY NOT NULL,
+    kind            TEXT NOT NULL CHECK (kind IN ('prompt', 'context')),
+    project_id      TEXT REFERENCES projects(id) ON DELETE CASCADE,
+    title           TEXT NOT NULL CHECK (
+                        length(CAST(title AS BLOB)) BETWEEN 1 AND 256
+                        AND instr(title, char(0)) = 0
+                    ),
+    body            TEXT NOT NULL CHECK (
+                        length(CAST(body AS BLOB)) BETWEEN 1 AND 65536
+                        AND instr(body, char(0)) = 0
+                    ),
+    revision        INTEGER NOT NULL CHECK (
+                        typeof(revision) = 'integer'
+                        AND revision BETWEEN 1 AND 9007199254740991
+                    ),
+    created_at_ms   INTEGER NOT NULL CHECK (
+                        typeof(created_at_ms) = 'integer'
+                        AND created_at_ms BETWEEN 0 AND 9007199254740991
+                    ),
+    updated_at_ms   INTEGER NOT NULL CHECK (
+                        typeof(updated_at_ms) = 'integer'
+                        AND updated_at_ms BETWEEN created_at_ms AND 9007199254740991
+                    )
+);
+
+CREATE INDEX knowledge_by_scope_id ON knowledge_documents(project_id, id);
+CREATE INDEX knowledge_by_scope_kind_id ON knowledge_documents(project_id, kind, id);
diff --git a/crates/storage/src/durability_tests.rs b/crates/storage/src/durability_tests.rs
index 004168a..f29fc29 100644
--- a/crates/storage/src/durability_tests.rs
+++ b/crates/storage/src/durability_tests.rs
@@ -35,6 +35,7 @@ fn configured_file_database_uses_full_wal_and_verified_schema() {
             (1, "initial"),
             (2, "worktree_dirty_state"),
             (3, "recovery_metadata"),
+            (4, "knowledge_documents"),
         ]
     );
 
diff --git a/crates/storage/src/knowledge/mod.rs b/crates/storage/src/knowledge/mod.rs
new file mode 100644
index 0000000..917514f
--- /dev/null
+++ b/crates/storage/src/knowledge/mod.rs
@@ -0,0 +1,402 @@
+//! Durable, explicitly saved local prompts and context with optimistic writes.
+
+use std::{error::Error, fmt};
+
+use cli_master_core::{
+    ApiError, ProjectId,
+    knowledge::{
+        KnowledgeBody, KnowledgeDeleteRequest, KnowledgeEntry, KnowledgeId, KnowledgeKind,
+        KnowledgeListRequest, KnowledgeListResponse, KnowledgeSaveRequest, KnowledgeTitle,
+        KnowledgeValidationError, MAX_KNOWLEDGE_REVISION,
+    },
+};
+use rusqlite::{Connection, OptionalExtension, Row, TransactionBehavior, params};
+
+use crate::{Storage, StorageError};
+
+/// Maximum rows returned in one knowledge page.
+pub const MAX_KNOWLEDGE_PAGE_ENTRIES: usize = 50;
+/// Maximum serialized page size, leaving space for the socket response envelope.
+pub const MAX_KNOWLEDGE_PAGE_BYTES: usize = 512 * 1_024;
+
+const ENTRY_COLUMNS: &str =
+    "id, kind, project_id, title, body, revision, created_at_ms, updated_at_ms";
+// Reserve more than the fixed JSON wrapper plus a UUID next-page cursor.
+const PAGE_OVERHEAD_BYTES: usize = 128;
+
+/// Safe knowledge repository failure. Diagnostic formatting never includes text.
+pub enum KnowledgeStorageError {
+    /// Caller supplied a malformed request.
+    InvalidInput(KnowledgeValidationError),
+    /// The supplied clock value cannot be represented safely on the wire.
+    InvalidTimestamp,
+    /// The requested saved entry no longer exists.
+    NotFound,
+    /// The selected project does not exist.
+    ProjectNotFound,
+    /// Another writer changed the entry after the caller loaded it.
+    Conflict,
+    /// The entry exhausted the revision range and cannot be incremented.
+    RevisionExhausted,
+    /// Persisted content violates the typed contract.
+    CorruptData,
+    /// The underlying metadata store could not complete the operation.
+    Storage(StorageError),
+}
+
+impl KnowledgeStorageError {
+    /// Projects a failure into a stable error without SQL or saved content.
+    #[must_use]
+    pub fn to_api_error(&self) -> ApiError {
+        let (code, action) = match self {
+            Self::InvalidInput(_) | Self::InvalidTimestamp => {
+                ("invalid_request", "Correct the request and retry")
+            }
+            Self::NotFound => ("knowledge_not_found", "Reload the saved library"),
+            Self::ProjectNotFound => ("project_not_found", "Select an existing project"),
+            Self::Conflict => (
+                "knowledge_conflict",
+                "Reload the entry before saving or deleting",
+            ),
+            Self::RevisionExhausted => (
+                "knowledge_revision_exhausted",
+                "Save the content as a new entry",
+            ),
+            Self::CorruptData => (
+                "knowledge_corrupt_data",
+                "Restore a known-good database backup",
+            ),
+            Self::Storage(error) => return error.to_api_error(),
+        };
+        ApiError::new(code, self.to_string()).with_action(action)
+    }
+}
+
+impl fmt::Display for KnowledgeStorageError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::InvalidInput(error) => error.fmt(formatter),
+            Self::InvalidTimestamp => {
+                formatter.write_str("Knowledge timestamp is outside the supported range")
+            }
+            Self::NotFound => formatter.write_str("The saved entry no longer exists"),
+            Self::ProjectNotFound => formatter.write_str("The selected project no longer exists"),
+            Self::Conflict => {
+                formatter.write_str("The saved entry has changed since it was loaded")
+            }
+            Self::RevisionExhausted => {
+                formatter.write_str("The saved entry cannot advance its revision")
+            }
+            Self::CorruptData => {
+                formatter.write_str("Stored knowledge does not match the supported contract")
+            }
+            Self::Storage(error) => fmt::Display::fmt(error, formatter),
+        }
+    }
+}
+
+impl fmt::Debug for KnowledgeStorageError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        fmt::Display::fmt(self, formatter)
+    }
+}
+
+// Deliberately avoid exposing underlying SQLite errors through a source chain.
+impl Error for KnowledgeStorageError {}
+
+impl From<StorageError> for KnowledgeStorageError {
+    fn from(value: StorageError) -> Self {
+        Self::Storage(value)
+    }
+}
+
+impl From<rusqlite::Error> for KnowledgeStorageError {
+    fn from(value: rusqlite::Error) -> Self {
+        Self::Storage(StorageError::Database(value))
+    }
+}
+
+impl From<KnowledgeValidationError> for KnowledgeStorageError {
+    fn from(value: KnowledgeValidationError) -> Self {
+        Self::InvalidInput(value)
+    }
+}
+
+impl Storage {
+    /// Lists globals or globals plus one existing project's entries in ID order.
+    ///
+    /// The page is bounded by row count and actual JSON size. Literal search
+    /// uses `SQLite`'s built-in case folding, which is case-insensitive for ASCII.
+    /// Project validation and the page read share one database snapshot.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error for invalid input, a missing project, corrupt rows, or database failure.
+    pub fn list_knowledge(
+        &self,
+        request: &KnowledgeListRequest,
+    ) -> Result<KnowledgeListResponse, KnowledgeStorageError> {
+        request.validate()?;
+        self.with_connection_mut("list knowledge", |connection| {
+            Ok(list_knowledge(connection, request))
+        })?
+    }
+
+    /// Creates an entry or atomically replaces the caller's expected revision.
+    ///
+    /// An update may explicitly change kind or scope. Saved text is never
+    /// executed or sent to an agent by this operation. Clock rollback does not
+    /// decrease the entry's update timestamp.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error for invalid input, a missing row/project, a stale or
+    /// exhausted revision, or database failure. Failed writes roll back fully.
+    pub fn save_knowledge(
+        &self,
+        request: &KnowledgeSaveRequest,
+        now: i64,
+    ) -> Result<KnowledgeEntry, KnowledgeStorageError> {
+        request.validate()?;
+        if !(0..=9_007_199_254_740_991).contains(&now) {
+            return Err(KnowledgeStorageError::InvalidTimestamp);
+        }
+        self.with_connection_mut("save knowledge", |connection| {
+            Ok(save_knowledge(connection, request, now))
+        })?
+    }
+
+    /// Atomically deletes only the entry revision observed by the caller.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error for invalid input, a missing entry, a stale revision, or database failure.
+    pub fn delete_knowledge(
+        &self,
+        request: &KnowledgeDeleteRequest,
+    ) -> Result<(), KnowledgeStorageError> {
+        request.validate()?;
+        self.with_connection_mut("delete knowledge", |connection| {
+            Ok(delete_knowledge(connection, request))
+        })?
+    }
+}
+
+fn list_knowledge(
+    connection: &mut Connection,
+    request: &KnowledgeListRequest,
+) -> Result<KnowledgeListResponse, KnowledgeStorageError> {
+    let transaction = connection.transaction()?;
+    require_project(&transaction, request.project_id)?;
+    let sql = format!(
+        "SELECT {ENTRY_COLUMNS} FROM knowledge_documents
+         WHERE (project_id IS NULL OR project_id = ?1)
+           AND (?2 IS NULL OR kind = ?2)
+           AND (?3 IS NULL OR id > ?3)
+           AND (?4 = '' OR instr(lower(title), lower(?4)) > 0
+                        OR instr(lower(body), lower(?4)) > 0)
+         ORDER BY id ASC LIMIT 51"
+    );
+    let mut statement = transaction.prepare(&sql)?;
+    let mut rows = statement.query(params![
+        request.project_id.map(|id| id.to_string()),
+        request.kind.map(kind_name),
+        request.cursor.map(|id| id.to_string()),
+        request.query.as_deref().unwrap_or("").trim(),
+    ])?;
+    let mut page = KnowledgeListResponse {
+        entries: Vec::new(),
+        next_cursor: None,
+    };
+    let mut page_bytes = PAGE_OVERHEAD_BYTES;
+    while let Some(row) = rows.next()? {
+        if page.entries.len() == MAX_KNOWLEDGE_PAGE_ENTRIES {
+            page.next_cursor = page.entries.last().map(|entry| entry.id);
+            break;
+        }
+        let entry = decode_entry(row)?;
+        let serialized =
+            serde_json::to_vec(&entry).map_err(|_| KnowledgeStorageError::CorruptData)?;
+        if page_bytes + serialized.len() + 1 > MAX_KNOWLEDGE_PAGE_BYTES {
+            let Some(last) = page.entries.last() else {
+                return Err(KnowledgeStorageError::CorruptData);
+            };
+            page.next_cursor = Some(last.id);
+            break;
+        }
+        page_bytes += serialized.len() + 1;
+        page.entries.push(entry);
+    }
+    drop(rows);
+    drop(statement);
+    transaction.commit()?;
+    Ok(page)
+}
+
+fn save_knowledge(
+    connection: &mut Connection,
+    request: &KnowledgeSaveRequest,
+    now: i64,
+) -> Result<KnowledgeEntry, KnowledgeStorageError> {
+    let transaction = connection.transaction_with_behavior(TransactionBehavior::Immediate)?;
+    require_project(&transaction, request.project_id)?;
+    let (id, revision, created_at_ms, updated_at_ms) = match (request.id, request.expected_revision)
+    {
+        (Some(id), Some(expected_revision)) => {
+            let current = load_entry(&transaction, id)?.ok_or(KnowledgeStorageError::NotFound)?;
+            if current.revision != expected_revision {
+                return Err(KnowledgeStorageError::Conflict);
+            }
+            if current.revision == MAX_KNOWLEDGE_REVISION {
+                return Err(KnowledgeStorageError::RevisionExhausted);
+            }
+            (
+                id,
+                current.revision + 1,
+                current.created_at_ms,
+                now.max(current.updated_at_ms),
+            )
+        }
+        (None, None) => (KnowledgeId::new(), 1, now, now),
+        _ => return Err(KnowledgeStorageError::CorruptData),
+    };
+    let entry = KnowledgeEntry {
+        id,
+        kind: request.kind,
+        project_id: request.project_id,
+        title: request.title.clone(),
+        body: request.body.clone(),
+        revision,
+        created_at_ms,
+        updated_at_ms,
+    };
+    entry.validate()?;
+    let revision_sql =
+        i64::try_from(entry.revision).map_err(|_| KnowledgeStorageError::RevisionExhausted)?;
+    let changed = if let Some(expected_revision) = request.expected_revision {
+        let expected_sql = i64::try_from(expected_revision)
+            .map_err(|_| KnowledgeStorageError::RevisionExhausted)?;
+        transaction.execute(
+            "UPDATE knowledge_documents SET kind = ?2, project_id = ?3, title = ?4,
+             body = ?5, revision = ?6, updated_at_ms = ?7 WHERE id = ?1 AND revision = ?8",
+            params![
+                id.to_string(),
+                kind_name(entry.kind),
+                entry.project_id.map(|id| id.to_string()),
+                entry.title.as_str(),
+                entry.body.as_str(),
+                revision_sql,
+                updated_at_ms,
+                expected_sql
+            ],
+        )?
+    } else {
+        transaction.execute(
+            "INSERT INTO knowledge_documents
+             (id, kind, project_id, title, body, revision, created_at_ms, updated_at_ms)
+             VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8)",
+            params![
+                id.to_string(),
+                kind_name(entry.kind),
+                entry.project_id.map(|id| id.to_string()),
+                entry.title.as_str(),
+                entry.body.as_str(),
+                revision_sql,
+                created_at_ms,
+                updated_at_ms
+            ],
+        )?
+    };
+    if changed != 1 {
+        return Err(KnowledgeStorageError::Conflict);
+    }
+    transaction.commit()?;
+    Ok(entry)
+}
+
+fn delete_knowledge(
+    connection: &mut Connection,
+    request: &KnowledgeDeleteRequest,
+) -> Result<(), KnowledgeStorageError> {
+    let transaction = connection.transaction_with_behavior(TransactionBehavior::Immediate)?;
+    let current = load_entry(&transaction, request.id)?.ok_or(KnowledgeStorageError::NotFound)?;
+    if current.revision != request.expected_revision {
+        return Err(KnowledgeStorageError::Conflict);
+    }
+    let revision = i64::try_from(request.expected_revision)
+        .map_err(|_| KnowledgeStorageError::RevisionExhausted)?;
+    let changed = transaction.execute(
+        "DELETE FROM knowledge_documents WHERE id = ?1 AND revision = ?2",
+        params![request.id.to_string(), revision],
+    )?;
+    if changed != 1 {
+        return Err(KnowledgeStorageError::Conflict);
+    }
+    transaction.commit()?;
+    Ok(())
+}
+
+fn require_project(
+    connection: &Connection,
+    project: Option<ProjectId>,
+) -> Result<(), KnowledgeStorageError> {
+    if let Some(id) = project {
+        let exists: bool = connection.query_row(
+            "SELECT EXISTS(SELECT 1 FROM projects WHERE id = ?1)",
+            [id.to_string()],
+            |row| row.get(0),
+        )?;
+        if !exists {
+            return Err(KnowledgeStorageError::ProjectNotFound);
+        }
+    }
+    Ok(())
+}
+
+fn load_entry(
+    connection: &Connection,
+    id: KnowledgeId,
+) -> Result<Option<KnowledgeEntry>, KnowledgeStorageError> {
+    let sql = format!("SELECT {ENTRY_COLUMNS} FROM knowledge_documents WHERE id = ?1");
+    connection
+        .query_row(&sql, [id.to_string()], |row| Ok(decode_entry(row)))
+        .optional()?
+        .transpose()
+}
+
+fn decode_entry(row: &Row<'_>) -> Result<KnowledgeEntry, KnowledgeStorageError> {
+    let id: String = row.get(0)?;
+    let kind: String = row.get(1)?;
+    let project: Option<String> = row.get(2)?;
+    let revision: i64 = row.get(5)?;
+    let entry = KnowledgeEntry {
+        id: id.parse().map_err(|_| KnowledgeStorageError::CorruptData)?,
+        kind: match kind.as_str() {
+            "prompt" => KnowledgeKind::Prompt,
+            "context" => KnowledgeKind::Context,
+            _ => return Err(KnowledgeStorageError::CorruptData),
+        },
+        project_id: project
+            .map(|id| id.parse())
+            .transpose()
+            .map_err(|_| KnowledgeStorageError::CorruptData)?,
+        title: KnowledgeTitle::try_new(row.get::<_, String>(3)?)
+            .map_err(|_| KnowledgeStorageError::CorruptData)?,
+        body: KnowledgeBody::try_new(row.get::<_, String>(4)?)
+            .map_err(|_| KnowledgeStorageError::CorruptData)?,
+        revision: u64::try_from(revision).map_err(|_| KnowledgeStorageError::CorruptData)?,
+        created_at_ms: row.get(6)?,
+        updated_at_ms: row.get(7)?,
+    };
+    entry
+        .validate()
+        .map_err(|_| KnowledgeStorageError::CorruptData)?;
+    Ok(entry)
+}
+
+const fn kind_name(kind: KnowledgeKind) -> &'static str {
+    match kind {
+        KnowledgeKind::Prompt => "prompt",
+        KnowledgeKind::Context => "context",
+    }
+}
diff --git a/crates/storage/src/lib.rs b/crates/storage/src/lib.rs
index 97c88f4..63572a3 100644
--- a/crates/storage/src/lib.rs
+++ b/crates/storage/src/lib.rs
@@ -8,6 +8,7 @@
 mod agents;
 mod connection;
 mod error;
+pub mod knowledge;
 mod migrate;
 mod models;
 mod paths;
@@ -31,11 +32,12 @@ use crate::connection::{StorageLocation, maybe_backup_before_migrate};
 
 pub use connection::Storage;
 pub use error::StorageError;
+pub use knowledge::KnowledgeStorageError;
 pub use models::{SessionRuntimeUpdate, StoredAgent, StoredSession, StoredWorktree, WorktreeState};
 pub use recovery::{ReconciliationEvent, ReconciliationReason, RecoveryContext};
 
 /// The newest schema version understood by this crate.
-pub const LATEST_SCHEMA_VERSION: u32 = 3;
+pub const LATEST_SCHEMA_VERSION: u32 = 4;
 
 impl Storage {
     /// Opens and configures a file-backed `SQLite` database.
diff --git a/crates/storage/src/migrate.rs b/crates/storage/src/migrate.rs
index 1f6cbc3..ce4e2c1 100644
--- a/crates/storage/src/migrate.rs
+++ b/crates/storage/src/migrate.rs
@@ -33,6 +33,12 @@ const MIGRATIONS: &[Migration] = &[
         sql: include_str!("../migrations/0003_recovery_metadata.sql"),
         destructive: false,
     },
+    Migration {
+        version: 4,
+        name: "knowledge_documents",
+        sql: include_str!("../migrations/0004_knowledge_documents.sql"),
+        destructive: false,
+    },
 ];
 
 const REQUIRED_TABLES: &[(&str, &[&str])] = &[
@@ -91,6 +97,19 @@ const REQUIRED_TABLES: &[(&str, &[&str])] = &[
         ],
     ),
     ("settings", &["key", "value_json", "updated_at"]),
+    (
+        "knowledge_documents",
+        &[
+            "id",
+            "kind",
+            "project_id",
+            "title",
+            "body",
+            "revision",
+            "created_at_ms",
+            "updated_at_ms",
+        ],
+    ),
     ("schema_migrations", &["version", "name", "applied_at"]),
 ];
 
@@ -103,6 +122,8 @@ const REQUIRED_INDEXES: &[&str] = &[
     "sessions_by_agent",
     "sessions_by_daemon_status",
     "custom_agents_by_updated",
+    "knowledge_by_scope_id",
+    "knowledge_by_scope_kind_id",
 ];
 
 const REQUIRED_TRIGGERS: &[&str] = &[
diff --git a/crates/storage/tests/knowledge.rs b/crates/storage/tests/knowledge.rs
new file mode 100644
index 0000000..3a960e6
--- /dev/null
+++ b/crates/storage/tests/knowledge.rs
@@ -0,0 +1,509 @@
+mod common;
+
+use std::{
+    collections::BTreeSet,
+    sync::{Arc, Barrier},
+    thread,
+};
+
+use cli_master_core::{
+    ProjectId,
+    knowledge::{
+        KnowledgeBody, KnowledgeDeleteRequest, KnowledgeEntry, KnowledgeKind, KnowledgeListRequest,
+        KnowledgeSaveRequest, KnowledgeTitle, MAX_KNOWLEDGE_BODY_BYTES, MAX_KNOWLEDGE_REVISION,
+    },
+};
+use cli_master_storage::{
+    KnowledgeStorageError, LATEST_SCHEMA_VERSION, Storage,
+    knowledge::{MAX_KNOWLEDGE_PAGE_BYTES, MAX_KNOWLEDGE_PAGE_ENTRIES},
+};
+use rusqlite::{Connection, params};
+use tempfile::TempDir;
+
+const NOW: i64 = 1_788_600_000_000;
+
+fn create(
+    project_id: Option<ProjectId>,
+    kind: KnowledgeKind,
+    title: &str,
+    body: &str,
+) -> KnowledgeSaveRequest {
+    KnowledgeSaveRequest {
+        id: None,
+        expected_revision: None,
+        project_id,
+        kind,
+        title: KnowledgeTitle::try_new(title).unwrap(),
+        body: KnowledgeBody::try_new(body).unwrap(),
+    }
+}
+
+fn update(entry: &KnowledgeEntry, body: &str) -> KnowledgeSaveRequest {
+    KnowledgeSaveRequest {
+        id: Some(entry.id),
+        expected_revision: Some(entry.revision),
+        project_id: entry.project_id,
+        kind: entry.kind,
+        title: entry.title.clone(),
+        body: KnowledgeBody::try_new(body).unwrap(),
+    }
+}
+
+fn list(project_id: Option<ProjectId>) -> KnowledgeListRequest {
+    KnowledgeListRequest {
+        project_id,
+        ..KnowledgeListRequest::default()
+    }
+}
+
+#[test]
+fn entries_survive_reopen_with_scopes_kind_search_and_monotonic_timestamps() {
+    let directory = TempDir::new().unwrap();
+    let path = directory.path().join("knowledge.db");
+    let storage = Storage::open_migrated(&path).unwrap();
+    let project = common::project("First", directory.path().join("first"));
+    let other = common::project("Other", directory.path().join("other"));
+    storage.insert_project(&project).unwrap();
+    storage.insert_project(&other).unwrap();
+    let global = storage
+        .save_knowledge(
+            &create(None, KnowledgeKind::Prompt, "Review", "Check failures"),
+            NOW,
+        )
+        .unwrap();
+    let scoped = storage
+        .save_knowledge(
+            &create(
+                Some(project.id),
+                KnowledgeKind::Context,
+                "Architecture",
+                "Daemon owns PTYs",
+            ),
+            NOW,
+        )
+        .unwrap();
+    storage
+        .save_knowledge(
+            &create(Some(other.id), KnowledgeKind::Prompt, "Other", "Unrelated"),
+            NOW,
+        )
+        .unwrap();
+    assert_eq!(global.revision, 1);
+    let changed = storage
+        .save_knowledge(&update(&scoped, "Daemon owns processes"), NOW - 1)
+        .unwrap();
+    assert_eq!(changed.created_at_ms, NOW);
+    assert_eq!(changed.updated_at_ms, NOW);
+    assert_eq!(changed.revision, 2);
+    storage.close().unwrap();
+    drop(storage);
+
+    let reopened = Storage::open_migrated(&path).unwrap();
+    assert_eq!(
+        reopened.list_knowledge(&list(None)).unwrap().entries,
+        vec![global]
+    );
+    let scoped_page = reopened.list_knowledge(&list(Some(project.id))).unwrap();
+    assert_eq!(scoped_page.entries.len(), 2);
+    assert!(scoped_page.entries.contains(&changed));
+    let mut filtered = list(Some(project.id));
+    filtered.kind = Some(KnowledgeKind::Context);
+    assert_eq!(
+        reopened.list_knowledge(&filtered).unwrap().entries,
+        vec![changed.clone()]
+    );
+    filtered.query = Some("  PROCESSES  ".to_owned());
+    assert_eq!(
+        reopened.list_knowledge(&filtered).unwrap().entries,
+        vec![changed]
+    );
+}
+
+#[test]
+fn literal_search_treats_percent_underscore_and_sql_syntax_as_text() {
+    let directory = TempDir::new().unwrap();
+    let storage = Storage::open_migrated(directory.path().join("literal.db")).unwrap();
+    let exact = storage
+        .save_knowledge(
+            &create(
+                None,
+                KnowledgeKind::Prompt,
+                "Literal %_",
+                "SELECT ' OR 1=1 --",
+            ),
+            NOW,
+        )
+        .unwrap();
+    storage
+        .save_knowledge(
+            &create(None, KnowledgeKind::Prompt, "Other", "Different"),
+            NOW,
+        )
+        .unwrap();
+    for text in ["%_", "literal", "' OR 1=1 --"] {
+        let request = KnowledgeListRequest {
+            query: Some(text.to_owned()),
+            ..list(None)
+        };
+        assert_eq!(
+            storage.list_knowledge(&request).unwrap().entries,
+            vec![exact.clone()]
+        );
+    }
+    assert_eq!(
+        storage
+            .list_knowledge(&KnowledgeListRequest {
+                query: Some(String::new()),
+                ..list(None)
+            })
+            .unwrap()
+            .entries
+            .len(),
+        2
+    );
+}
+
+#[test]
+fn missing_projects_fail_and_explicit_scope_move_obeys_cascade() {
+    let directory = TempDir::new().unwrap();
+    let path = directory.path().join("scope.db");
+    let storage = Storage::open_migrated(&path).unwrap();
+    let project = common::project("Scope", directory.path().join("project"));
+    std::fs::create_dir(&project.path).unwrap();
+    std::fs::write(project.path.join("keep.txt"), "repository content").unwrap();
+    storage.insert_project(&project).unwrap();
+    let global = storage
+        .save_knowledge(
+            &create(None, KnowledgeKind::Prompt, "Global", "Preserved"),
+            NOW,
+        )
+        .unwrap();
+    let scoped = storage
+        .save_knowledge(
+            &create(
+                Some(project.id),
+                KnowledgeKind::Prompt,
+                "Scoped",
+                "Project data",
+            ),
+            NOW,
+        )
+        .unwrap();
+    let missing_project = ProjectId::new();
+    assert!(matches!(
+        storage.list_knowledge(&list(Some(missing_project))),
+        Err(KnowledgeStorageError::ProjectNotFound)
+    ));
+    assert!(matches!(
+        storage.save_knowledge(
+            &create(
+                Some(missing_project),
+                KnowledgeKind::Context,
+                "Missing",
+                "Should not save"
+            ),
+            NOW
+        ),
+        Err(KnowledgeStorageError::ProjectNotFound)
+    ));
+    let mut move_request = update(&global, "Attempted edit");
+    move_request.project_id = Some(missing_project);
+    assert!(matches!(
+        storage.save_knowledge(&move_request, NOW + 1),
+        Err(KnowledgeStorageError::ProjectNotFound)
+    ));
+    assert_eq!(
+        storage.list_knowledge(&list(None)).unwrap().entries,
+        vec![global]
+    );
+    let mut export = update(&scoped, "Exported to global");
+    export.project_id = None;
+    let exported = storage.save_knowledge(&export, NOW + 1).unwrap();
+    storage
+        .save_knowledge(
+            &create(
+                Some(project.id),
+                KnowledgeKind::Context,
+                "Disposable",
+                "Removed with metadata",
+            ),
+            NOW,
+        )
+        .unwrap();
+    storage.remove_project_metadata(project.id).unwrap();
+    let globals = storage.list_knowledge(&list(None)).unwrap().entries;
+    assert_eq!(globals.len(), 2);
+    assert!(globals.contains(&exported));
+    assert_eq!(
+        std::fs::read_to_string(project.path.join("keep.txt")).unwrap(),
+        "repository content"
+    );
+    let raw = Connection::open(path).unwrap();
+    let remaining: i64 = raw
+        .query_row(
+            "SELECT COUNT(*) FROM knowledge_documents WHERE project_id IS NOT NULL",
+            [],
+            |row| row.get(0),
+        )
+        .unwrap();
+    assert_eq!(remaining, 0);
+}
+
+#[test]
+fn independent_connections_cannot_overwrite_the_same_revision() {
+    let directory = TempDir::new().unwrap();
+    let path = directory.path().join("concurrent.db");
+    let original = Storage::open_migrated(&path).unwrap();
+    let entry = original
+        .save_knowledge(&create(None, KnowledgeKind::Prompt, "Race", "Initial"), NOW)
+        .unwrap();
+    let first = Storage::open_migrated(&path).unwrap();
+    let second = Storage::open_migrated(&path).unwrap();
+    let barrier = Arc::new(Barrier::new(3));
+    let mut handles = Vec::new();
+    for (storage, text) in [(first, "First writer"), (second, "Second writer")] {
+        let barrier = Arc::clone(&barrier);
+        let request = update(&entry, text);
+        handles.push(thread::spawn(move || {
+            barrier.wait();
+            storage.save_knowledge(&request, NOW + 1)
+        }));
+    }
+    barrier.wait();
+    let outcomes: Vec<_> = handles
+        .into_iter()
+        .map(|handle| handle.join().unwrap())
+        .collect();
+    assert_eq!(outcomes.iter().filter(|outcome| outcome.is_ok()).count(), 1);
+    assert_eq!(
+        outcomes
+            .iter()
+            .filter(|outcome| matches!(outcome, Err(KnowledgeStorageError::Conflict)))
+            .count(),
+        1
+    );
+    let winner = original
+        .list_knowledge(&list(None))
+        .unwrap()
+        .entries
+        .remove(0);
+    assert_eq!(winner.revision, 2);
+    let stale_delete = KnowledgeDeleteRequest {
+        id: entry.id,
+        expected_revision: entry.revision,
+    };
+    let conflict = original.delete_knowledge(&stale_delete).unwrap_err();
+    assert_eq!(conflict.to_api_error().code, "knowledge_conflict");
+    original
+        .delete_knowledge(&KnowledgeDeleteRequest {
+            id: winner.id,
+            expected_revision: winner.revision,
+        })
+        .unwrap();
+    let absent = original.delete_knowledge(&stale_delete).unwrap_err();
+    assert_eq!(absent.to_api_error().code, "knowledge_not_found");
+    assert!(matches!(
+        original.save_knowledge(&update(&winner, "Gone"), NOW),
+        Err(KnowledgeStorageError::NotFound)
+    ));
+}
+
+#[test]
+fn pagination_is_bounded_ordered_and_exclusive_without_duplicate_or_missing_rows() {
+    let directory = TempDir::new().unwrap();
+    let storage = Storage::open_migrated(directory.path().join("pages.db")).unwrap();
+    let mut expected = BTreeSet::new();
+    for index in 0..57 {
+        let entry = storage
+            .save_knowledge(
+                &create(
+                    None,
+                    KnowledgeKind::Prompt,
+                    &format!("Entry {index}"),
+                    "A small body",
+                ),
+                NOW,
+            )
+            .unwrap();
+        expected.insert(entry.id);
+    }
+    let first = storage.list_knowledge(&list(None)).unwrap();
+    assert_eq!(first.entries.len(), MAX_KNOWLEDGE_PAGE_ENTRIES);
+    assert_eq!(
+        first.next_cursor,
+        first.entries.last().map(|entry| entry.id)
+    );
+    let second = storage
+        .list_knowledge(&KnowledgeListRequest {
+            cursor: first.next_cursor,
+            ..list(None)
+        })
+        .unwrap();
+    assert_eq!(second.entries.len(), 7);
+    assert_eq!(second.next_cursor, None);
+    let seen: Vec<_> = first
+        .entries
+        .into_iter()
+        .chain(second.entries)
+        .map(|entry| entry.id)
+        .collect();
+    assert!(seen.windows(2).all(|pair| pair[0] < pair[1]));
+    assert_eq!(seen.into_iter().collect::<BTreeSet<_>>(), expected);
+}
+
+#[test]
+fn worst_case_json_escaping_fits_one_entry_and_pages_without_skipping() {
+    let directory = TempDir::new().unwrap();
+    let storage = Storage::open_migrated(directory.path().join("escaped.db")).unwrap();
+    let body = "\u{0001}".repeat(MAX_KNOWLEDGE_BODY_BYTES);
+    let mut expected = BTreeSet::new();
+    for index in 0..3 {
+        expected.insert(
+            storage
+                .save_knowledge(
+                    &create(
+                        None,
+                        KnowledgeKind::Context,
+                        &format!("Large {index}"),
+                        &body,
+                    ),
+                    NOW,
+                )
+                .unwrap()
+                .id,
+        );
+    }
+    let mut request = list(None);
+    let mut seen = BTreeSet::new();
+    loop {
+        let page = storage.list_knowledge(&request).unwrap();
+        assert_eq!(page.entries.len(), 1);
+        assert!(serde_json::to_vec(&page).unwrap().len() <= MAX_KNOWLEDGE_PAGE_BYTES);
+        assert_eq!(page.entries[0].body.as_str(), body);
+        assert!(seen.insert(page.entries[0].id));
+        request.cursor = page.next_cursor;
+        if request.cursor.is_none() {
+            break;
+        }
+    }
+    assert_eq!(seen, expected);
+}
+
+#[test]
+fn exhausted_revisions_reject_updates_but_allow_checked_deletion() {
+    let directory = TempDir::new().unwrap();
+    let path = directory.path().join("exhausted.db");
+    let storage = Storage::open_migrated(&path).unwrap();
+    let entry = storage
+        .save_knowledge(
+            &create(None, KnowledgeKind::Prompt, "Max revision", "Retained"),
+            NOW,
+        )
+        .unwrap();
+    let raw = Connection::open(path).unwrap();
+    raw.execute(
+        "UPDATE knowledge_documents SET revision = ?1 WHERE id = ?2",
+        params![
+            i64::try_from(MAX_KNOWLEDGE_REVISION).unwrap(),
+            entry.id.to_string()
+        ],
+    )
+    .unwrap();
+    let mut exhausted = entry;
+    exhausted.revision = MAX_KNOWLEDGE_REVISION;
+    assert!(matches!(
+        storage.save_knowledge(&update(&exhausted, "Never stored"), NOW + 1),
+        Err(KnowledgeStorageError::RevisionExhausted)
+    ));
+    assert_eq!(
+        storage.list_knowledge(&list(None)).unwrap().entries,
+        vec![exhausted.clone()]
+    );
+    storage
+        .delete_knowledge(&KnowledgeDeleteRequest {
+            id: exhausted.id,
+            expected_revision: exhausted.revision,
+        })
+        .unwrap();
+}
+
+#[test]
+fn programmatic_input_constraints_and_corrupt_rows_never_echo_content() {
+    let directory = TempDir::new().unwrap();
+    let path = directory.path().join("validation.db");
+    let storage = Storage::open_migrated(&path).unwrap();
+    let mut invalid = create(None, KnowledgeKind::Prompt, "Private title", "Private body");
+    invalid.expected_revision = Some(1);
+    assert!(storage.save_knowledge(&invalid, NOW).is_err());
+    invalid.expected_revision = None;
+    for timestamp in [-1, 9_007_199_254_740_992] {
+        assert!(matches!(
+            storage.save_knowledge(&invalid, timestamp),
+            Err(KnowledgeStorageError::InvalidTimestamp)
+        ));
+    }
+    let invalid_query = KnowledgeListRequest {
+        query: Some("private-query\0".into()),
+        ..list(None)
+    };
+    let error = storage.list_knowledge(&invalid_query).unwrap_err();
+    assert!(!format!("{error:?}").contains("private-query"));
+    let entry = storage.save_knowledge(&invalid, NOW).unwrap();
+    let raw = Connection::open(path).unwrap();
+    raw.execute_batch("PRAGMA ignore_check_constraints = ON")
+        .unwrap();
+    raw.execute(
+        "UPDATE knowledge_documents SET body = ?1 WHERE id = ?2",
+        params!["PRIVATE_CORRUPT_CONTENT\0", entry.id.to_string()],
+    )
+    .unwrap();
+    let error = storage.list_knowledge(&list(None)).unwrap_err();
+    assert!(matches!(error, KnowledgeStorageError::CorruptData));
+    assert!(
+        !format!("{error:?} {}", error.to_api_error().message).contains("PRIVATE_CORRUPT_CONTENT")
+    );
+}
+
+#[test]
+fn version_three_upgrade_preserves_metadata_and_checks_new_schema_objects() {
+    let directory = TempDir::new().unwrap();
+    let path = directory.path().join("v3.db");
+    let project = common::project("Existing", directory.path().join("existing"));
+    {
+        let raw = Connection::open(&path).unwrap();
+        raw.execute_batch(include_str!("../migrations/0001_initial.sql"))
+            .unwrap();
+        raw.execute_batch(include_str!("../migrations/0002_worktree_dirty_state.sql"))
+            .unwrap();
+        raw.execute_batch(include_str!("../migrations/0003_recovery_metadata.sql"))
+            .unwrap();
+        raw.execute_batch("CREATE TABLE schema_migrations (version INTEGER PRIMARY KEY, name TEXT NOT NULL, applied_at TEXT NOT NULL DEFAULT '2026-09-05');
+            INSERT INTO schema_migrations (version, name) VALUES (1, 'initial'), (2, 'worktree_dirty_state'), (3, 'recovery_metadata');").unwrap();
+        raw.execute(
+            "INSERT INTO projects (id,name,path,created_at,last_opened_at) VALUES (?1,?2,?3,?4,?4)",
+            params![
+                project.id.to_string(),
+                project.name,
+                project.path.to_str().unwrap(),
+                common::CREATED_AT_MS
+            ],
+        )
+        .unwrap();
+    }
+    let storage = Storage::open_migrated(&path).unwrap();
+    assert_eq!(storage.schema_version().unwrap(), LATEST_SCHEMA_VERSION);
+    assert_eq!(storage.get_project(project.id).unwrap(), Some(project));
+    storage.migrate().unwrap();
+    storage
+        .save_knowledge(
+            &create(None, KnowledgeKind::Prompt, "After upgrade", "New data"),
+            NOW,
+        )
+        .unwrap();
+    let raw = Connection::open(&path).unwrap();
+    let indexes: i64 = raw.query_row("SELECT COUNT(*) FROM sqlite_schema WHERE type='index' AND name IN ('knowledge_by_scope_id','knowledge_by_scope_kind_id')", [], |row| row.get(0)).unwrap();
+    assert_eq!(indexes, 2);
+    raw.execute_batch("DROP INDEX knowledge_by_scope_id")
+        .unwrap();
+    assert!(storage.migrate().is_err());
+}
diff --git a/docs/adr/0005-local-knowledge.md b/docs/adr/0005-local-knowledge.md
index abdea73..d6f2349 100644
--- a/docs/adr/0005-local-knowledge.md
+++ b/docs/adr/0005-local-knowledge.md
@@ -1,6 +1,7 @@
 # ADR 0005: Local prompts, reusable context, and organization
 
-Status: proposed; shared contract and migration registration await S2 agreement.
+Status: accepted for the first prompt/context increment after S2 agreement.
+Organization and filesystem details remain integration dependencies.
 
 ## Context
 
diff --git a/docs/codex/xirp-context-report.md b/docs/codex/xirp-context-report.md
index 2fe3b56..4651d7c 100644
--- a/docs/codex/xirp-context-report.md
+++ b/docs/codex/xirp-context-report.md
@@ -4,34 +4,88 @@ Branch: `feat/xirp-local-workflows`.
 Worktree: `/Users/eguimacs/cli-master-xirp`.
 Base: `0ac8dd7`, fetched from `origin/refactor/canvas-only-shell` on 2026-09-05.
 
-## Scope and evidence
+The full user request remains open. Source/acceptance inventory:
+[xirp-local-parity.md](../xirp-local-parity.md). Architecture:
+[ADR 0005](../adr/0005-local-knowledge.md).
 
-The source/acceptance inventory is [xirp-local-parity.md](../xirp-local-parity.md).
-The architecture proposal is [ADR 0005](../adr/0005-local-knowledge.md).
-The full user request remains open; documentation and isolated components are
-intermediate deliverables.
+## Coordination and ownership
 
-## Coordination
+S2 approved the first knowledge contract and additive shared registrations in
+[xirp-coordination-reply.md](xirp-coordination-reply.md), reserving migration
+`0004_knowledge_documents.sql`. S2 retains organization/workflow, runtime,
+worktrees, file service and conversation capabilities. S1 retains canvas and
+composer integration; the request is in [xirp-integration-request.md](xirp-integration-request.md).
 
-A concrete proposal was placed in `docs/codex/xirp-integration-request.md` in
-S1, S2 and S3 worktrees. S2 acknowledgment is pending for shared contracts,
-module registrations, migration allocation and dispatch. S1 acknowledgment is
-pending for canvas mounting and composer insertion. No shared code has been
-changed by S3 at this point.
+The active daemon dispatch is `server.rs`. Knowledge handlers reuse its
+existing storage connection and generic request path, with no session/process
+operation. The additive `methods.ts`/`domain.ts` mirrors preserve existing
+`client.ts`/`types.ts`/`schema.ts`. Merge S2's `worktree.list` mirror entries by
+name, rather than replacing whole files.
 
-Baseline drift reported to owners: active daemon dispatch is `server.rs`;
-`client.rs` is uncompiled. Frontend currently has `types.ts`/`schema.ts` rather
-than the mirrors named in AGENTS. Runtime registry/adapters need consolidation
-by S2; S3 will not introduce another registry or Tauri client.
+## Implemented first vertical increment
 
-## Work in progress
+- `knowledge.list`: nullable project scope, optional kind, literal title/body
+  query, exclusive UUIDv7 cursor; `{entries,nextCursor}`. Global query returns
+  globals; project query returns its entries plus globals. Unknown projects
+  fail. Pages cap at 50 rows and 512 KiB of serialized JSON.
+- `knowledge.save`: UUIDv7, prompt/context kind, title (256 UTF-8 bytes), body
+  (64 KiB), project scope, revision and epoch-ms timestamps. Create omits
+  id/expectedRevision; update requires both. Revision conflicts are atomic.
+- `knowledge.delete`: id plus expectedRevision. Stale requests preserve data.
+- `knowledge_documents` in existing SQLite, additive v3→v4 migration, schema
+  verification and scoped indexes. Project metadata removal cascades its
+  knowledge rows; it never deletes project files. Archive remains separate.
+- `knowledge_conflict`, `knowledge_not_found`, `project_not_found`,
+  `knowledge_revision_exhausted`, `knowledge_corrupt_data` are stable errors.
+  Text/queries are excluded from Debug and request error details.
+- IpcClient methods `listKnowledge`, `saveKnowledge`, `deleteKnowledge` use
+  validated TypeScript mirrors and a shared Rust/TypeScript JSON fixture.
 
-- Pure validated knowledge types and contract tests (new module only).
-- Isolated saved prompt/context editor/picker with typed callbacks and tests.
-- Persisted handlers and integration follow the agreed shared boundaries.
+`knowledge.updated` is deliberately not advertised: compiled baseline supports
+session-specific streams, and general metadata event transport remains an S2
+integration dependency. Clients refresh after mutations and can explicitly
+refresh; revision checks protect concurrent edits. Search uses SQLite ASCII
+case folding; Unicode text is preserved but non-ASCII case folding is not
+claimed. Pagination is per-request consistent, not a multi-request snapshot;
+refresh observes inserts/edits made during browsing.
 
-## Commits and checks
+## Verification executed on macOS
 
-Initial documentation commit: source review completed; `git diff --check`.
-Implementation tests and runtime/platform evidence will be recorded here as
-executed. No Linux/macOS runtime parity is claimed yet.
+Use `CARGO_INCREMENTAL=0 CARGO_PROFILE_DEV_DEBUG=0 CARGO_PROFILE_TEST_DEBUG=0`
+for the Rust commands below; debug information was reduced because the host
+had limited free disk space.
+
+- `cargo test -p cli-master-core -p cli-master-storage --locked`: existing
+  suites and 9 new core contract tests passed.
+- `cargo test -p cli-master-storage --test knowledge --locked`: 9 tests passed;
+  actual file-backed databases, competing connections, CAS races, reopen,
+  v3 migration, FK cleanup, scope moves, literal search, revision exhaustion,
+  corrupt content, 57-row pagination and worst-case JSON escaping.
+- `cargo test -p cli-master-core --test knowledge_catalog --locked`: passed;
+  JSON catalog matches Rust methods/events exactly.
+- `cargo test -p cli-master-daemon --locked`: 37 tests passed, including 2 new
+  real Unix-socket acceptance tests. Proves scoped CRUD, cross-client conflicts,
+  restart persistence, frame limits, safe errors and unchanged session state.
+- `cargo clippy -p cli-master-core -p cli-master-storage --all-targets --locked
+  -- -D warnings`, plus the equivalent daemon command: passed.
+- `cargo fmt --all -- --check`: passed.
+- IPC TypeScript tests and typecheck passed. Full frontend run with Node 25
+  needs `NODE_OPTIONS=--no-experimental-webstorage` to use jsdom storage;
+  CI uses Node 24. Isolated UI behavior tests are being finalized separately.
+
+Direct typed serde duplicate-field validation is not a promise that duplicate
+keys are rejected after the daemon's intermediate JSON Value decode.
+Linux CI, actual Tauri/canvas consumption and full parity remain unverified.
+
+## Commits / next integration
+
+- `569449f`: source inventory and integration proposal; pushed.
+- Backend first vertical increment follows this report in the current commit.
+- Isolated `KnowledgePanel` follows as its own UI increment. Props:
+  `{client,currentProject,onInsert,insertDisabledReason}`; insertion receives
+  `{sourceId,kind,title,body}` and must append to an editable composer draft.
+  Keep panel mounted if unsaved editor drafts must survive closing its surface.
+- Next: bounded rules/skills discovery; consume S2 pin/archive/workflow and
+  initial-objective contracts; mount with S1; verify additional agent features
+  only against trustworthy native sources. Portal/MCP remain explicit separate
+  dependencies; no connection is simulated.
diff --git a/docs/codex/xirp-coordination-reply.md b/docs/codex/xirp-coordination-reply.md
new file mode 100644
index 0000000..9d27ceb
--- /dev/null
+++ b/docs/codex/xirp-coordination-reply.md
@@ -0,0 +1,44 @@
+# S2 runtime coordination — 2026-09-05
+
+S2 is active in `/Users/eguimacs/cli-master-runtime`, branch
+`feat/maestri-runtime`, baseline `0ac8dd7`. This reply is an agreed boundary,
+not a claim that the proposed endpoints are implemented.
+
+- S3 owns `knowledge/` modules in core/storage/daemon and isolated UI modules.
+- Reserve migration **0004_knowledge_documents.sql** for S3. S2 worktree
+  integration needs no new migration. S2 future migrations begin at 0005 after
+  integrating 0004; no missing migration may be published in a runnable branch.
+- Approved first vertical contract: `knowledge.list/save/delete`, tagged
+  `kind: prompt|context`, UUIDv7, nullable project scope, title/body,
+  created/updated epoch-ms, positive integer revision. Updates and deletes
+  require expectedRevision; stale revisions return `knowledge_conflict`.
+  Create has no existing id/revision. Define bounded lengths in the Rust
+  validation types and keep list responses bounded (pagination if needed).
+- `knowledge.updated` must be delivered through the existing daemon event
+  transport before its event path is reported complete. Do not advertise an
+  unimplemented event. Draft insertion stays explicit and is owned by S1/S3.
+- S3 may make the small additive registration patch on its own branch:
+  core/storage/daemon lib.rs, migration registration, wire exports and
+  `knowledge.*` dispatch, protocol catalog and TypeScript mirrors. Publish
+  implementation and tests in the same coherent commit and report its hash;
+  S2 will review and integrate it. Preserve all runtime handlers and additions.
+- S2 currently adds `worktree.list` with `{ projectId?: UUID }` and response
+  `{ worktrees: Worktree[] }`. Existing `session.create` payload stays intact;
+  new_worktree creates metadata/Git only, followed by explicit session.start.
+- S2 retains process lifecycle, workspace/floor/canvas persistence, and
+  project/session organization/workflow contracts. S3 owns drafting and context
+  references; do not overload SessionStatus with workflow or attention.
+- Planned S2 file API targets registered project/session/worktree ids, uses
+  bounded reads and optimistic conflict checks with atomic writes. Its final
+  path policy and DTOs require an ADR. Until published, S3 can implement
+  discovery of explicitly known rules/skills with a narrow bounded safe reader;
+  do not create a second generic editor/file service.
+
+Current baseline no longer contains the AGENTS-referenced methods.ts/domain.ts
+mirrors: S2 will restore those as additive IPC contract artifacts while keeping
+the existing client/types/schema files and all React code intact. Merge contract
+entries by name, never replace either side's whole catalog.
+
+Integration evidence and published commits will be kept in
+`docs/codex/maestri-runtime-report.md` on the S2 branch. S2 will inspect S3's
+`docs/codex/xirp-context-report.md` and this request thread for follow-ups.
diff --git a/docs/codex/xirp-integration-request.md b/docs/codex/xirp-integration-request.md
index 0522dbf..63a2621 100644
--- a/docs/codex/xirp-integration-request.md
+++ b/docs/codex/xirp-integration-request.md
@@ -23,3 +23,24 @@ Will deliver isolated components with typed callbacks for saved prompts/context
 ## Responses
 
 Pending owner acknowledgment.
+
+### S3 acknowledgment and implementation details
+
+S2 acknowledgment received in xirp-coordination-reply.md. First implementation uses
+knowledge.list/save/delete; list accepts optional projectId/kind/query/cursor,
+returns {entries,nextCursor}; cursor is exclusive UUIDv7 ID ascending, literal
+title/body search. Pages cap at 50 rows and 512 KiB serialized entries. Title
+256 UTF-8 bytes, body 64 KiB. Prompt/context errors do not attach serde causes.
+Shared additive TypeScript mirrors restore methods.ts/domain.ts; merge S2
+worktree.list entries by name. IpcClient gains listKnowledge/saveKnowledge/
+deleteKnowledge; existing generic Tauri request path is reused.
+
+The compiled daemon currently has only session-specific event streams; generic
+metadata broadcasts are not wired. S3 will not advertise knowledge.updated
+until S2's general event transport is available. Initial UI refreshes after
+mutations and provides explicit refresh; conflict protection still covers
+multiple clients. Please advise the general event transport integration point.
+
+S1: initial components will expose KnowledgePanel({client,currentProject,
+onInsert,insertDisabledReason}); onInsert receives plain draft text and sourceId.
+Please mount as canvas contextual panel/palette. No hidden terminal send.
diff --git a/docs/xirp-local-parity.md b/docs/xirp-local-parity.md
index 4e56b21..87f9bff 100644
--- a/docs/xirp-local-parity.md
+++ b/docs/xirp-local-parity.md
@@ -8,18 +8,18 @@ added to this implementation's scope.
 
 | ID | Requirement and source | Owner / integration | Evidence / remaining work |
 | --- | --- | --- | --- |
-| X01 | Local project pin, rename, remove registration, non-Git folders, discover child repositories. [Projects](https://backstage.spotify.com/docs/xirp/projects) | S2 project base, S3 organization UI, S1 canvas | Baseline registers Git projects; pin/archive metadata, non-Git support and child discovery pending. Project archive is a user-requested extension. |
+| X01 | Local project pin, rename, remove registration, non-Git folders, discover child repositories. [Projects](https://backstage.spotify.com/docs/xirp/projects) | S2 project base, S3 organization UI, S1 canvas | Baseline real daemon tests register both Git projects and plain folders; pin/archive metadata and child discovery remain pending. Project archive is a user-requested extension. |
 | X02 | Initial objective delivered to agent, attachments, checkout/worktree and agent-specific options. [Sessions](https://backstage.spotify.com/docs/xirp/sessions) | S2 execution/contracts, S3 draft/context selection, S1 composer | Goal delivery requires verified runtime path, not metadata only. Attachments/options pending runtime contract. |
 | X03 | Resume/fork, agent switch preserving supported history, linked shell. [Sessions](https://backstage.spotify.com/docs/xirp/sessions), [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S2 adapters/runtime, S1 canvas | Current adapter capabilities do not expose verified conversation IDs, fork or usage. Await trusted native contracts and runtime integration. Local context reuse is a separate feature. |
 | X04 | Working/idle/needs-input attention separate from process lifecycle. [Sessions](https://backstage.spotify.com/docs/xirp/sessions) | S2 event source, S3 indicators, S1 canvas | PTY silence is not proof of approval/input need. Explicit hooks or native signals required. |
 | X05 | Local preferences, shortcuts, supported native settings, diagnostics. [Settings](https://backstage.spotify.com/docs/xirp/settings) | S2 settings/runtime, S3 rules/skills, S1 UI | Existing diagnostics/custom-agent creation are baseline only; do not expose unsupported options. Credentials excluded from editors. |
 | X06 | Global/project rules and skills, including symlinked skill directories. [Projects](https://backstage.spotify.com/docs/xirp/projects), [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S3 discovery, S2 file boundary | Need verified location inventory and safe bounded reads with origins/scopes; docs do not enumerate complete formats or precedence. Symlink policy and editing depend on file service. |
-| X07a | Saved global/project prompts, searchable picker and insertion. [Changelog v0.19.1](https://backstage.spotify.com/docs/xirp/changelog) | S3 knowledge, S2 shared registration, S1 canvas insertion | Isolated module implementation underway; persistence, socket, UI integration and cross-platform evidence pending. |
+| X07a | Saved global/project prompts, searchable picker and insertion. [Changelog v0.19.1](https://backstage.spotify.com/docs/xirp/changelog) | S3 knowledge, S2 shared registration, S1 canvas insertion | Persisted CRUD and paginated search verified through real SQLite and daemon socket; isolated UI underway; canvas and Linux evidence pending. See S3 report. |
 | X07b | Session archive and workflow: backlog/in_progress/in_review/blocked/done. [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S2 organization metadata, S3 controls, S1 filtering | Workflow must not mutate lifecycle. Session pin is a user-requested extension. |
 | X07c | Tokens/spend per session/day. [Changelog v0.18.0](https://backstage.spotify.com/docs/xirp/changelog) | S2 verified native data, S3 presentation | Source documents feature existence, not a collector/format/pricing algorithm. Currently unavailable, not zero. No proxy or PTY-based estimates. |
 | X07d | PR review, Doctor, cleanup. [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S2 runtime/Git, S1 UI | Existing Git status/diagnostics/removal-token safety are baseline; review and expanded cleanup require their real contracts. |
 | X08 | Agent-specific options, including Cursor. [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S2 adapter registry, S1 UI | No flags invented from agent display name; support requires installed-version tests and authoritative CLI sources. |
-| X09-local | Explicit reusable local context between sessions (user request). | S3 knowledge, S1 composer, S2 delivery | Local text records and explicit draft insertion planned. No transcript capture, autonomous summarization, or Portal connection implied. |
+| X09-local | Explicit reusable local context between sessions (user request). | S3 knowledge, S1 composer, S2 delivery | Local text records persist and survive daemon restart; explicit draft insertion component is underway. No transcript capture, autonomous summarization, or Portal connection implied. |
 | X09-Portal | Shared workspaces, members, catalog links, resources, decisions/wiki. [Workspaces](https://backstage.spotify.com/docs/xirp/workspaces) | Separate authenticated connector | Portal-dependent; no account/API verification supplied. Not implemented or simulated. |
 | X10 | Workspace context via MCP, manual transcript sharing, configured external integrations. [Workspaces](https://backstage.spotify.com/docs/xirp/workspaces) | Separate authenticated connector + S2 transport | Requires real account, scopes/API and explicit outbound preview. No silent publishing, account linking or telemetry. |
 
diff --git a/protocol/catalog.json b/protocol/catalog.json
index 0efc949..2a775f8 100644
--- a/protocol/catalog.json
+++ b/protocol/catalog.json
@@ -30,7 +30,10 @@
     "worktree.list",
     "worktree.prepare_remove",
     "worktree.remove",
-    "diagnostics.get"
+    "diagnostics.get",
+    "knowledge.list",
+    "knowledge.save",
+    "knowledge.delete"
   ],
   "events": [
     "project.updated",
diff --git a/protocol/fixtures/knowledge-page.json b/protocol/fixtures/knowledge-page.json
new file mode 100644
index 0000000..19443bb
--- /dev/null
+++ b/protocol/fixtures/knowledge-page.json
@@ -0,0 +1,25 @@
+{
+  "entries": [
+    {
+      "id": "01990000-0000-7000-8000-000000000001",
+      "kind": "prompt",
+      "projectId": null,
+      "title": "Review the change",
+      "body": "Review correctness and failure paths.\n",
+      "revision": 1,
+      "createdAtMs": 1788600000000,
+      "updatedAtMs": 1788600000000
+    },
+    {
+      "id": "01990000-0000-7000-8000-000000000002",
+      "kind": "context",
+      "projectId": "01990000-0000-7000-8000-000000000010",
+      "title": "Project architecture",
+      "body": "The daemon owns session processes.\n",
+      "revision": 2,
+      "createdAtMs": 1788600000000,
+      "updatedAtMs": 1788600000001
+    }
+  ],
+  "nextCursor": null
+}

From b271825c448b90535fc990f44a88e6b467a4ce52 Mon Sep 17 00:00:00 2001
From: guicybercode <euguigom@gmail.com>
Date: Sat, 5 Sep 2026 22:01:05 -0300
Subject: [PATCH 13/23] docs(architecture): define local file editor contracts
 and safe saves

---
 docs/adr/0006-local-files-and-editor.md | 296 ++++++++++++++++++++++++
 1 file changed, 296 insertions(+)
 create mode 100644 docs/adr/0006-local-files-and-editor.md

diff --git a/docs/adr/0006-local-files-and-editor.md b/docs/adr/0006-local-files-and-editor.md
new file mode 100644
index 0000000..681c710
--- /dev/null
+++ b/docs/adr/0006-local-files-and-editor.md
@@ -0,0 +1,296 @@
+# ADR 0006: Local files and editor I/O
+
+## Status
+
+Accepted for the requested local runtime increment, 2026-09-05.
+
+This decision covers the first functional slice of M29/M30 and the shared
+reader needed by M07/X06. It extends the Beta domain-operation inventory with
+local file editing. It does not change IPC envelope version 1, session
+ownership, worktree deletion, or Linux/macOS support. In particular, the
+relative file identifiers below are a scoped extension of ADR 0002; arbitrary
+absolute filesystem paths remain invalid domain-operation inputs.
+
+## Context
+
+The daemon currently exposes registered project, session and worktree IDs,
+but no file-listing or editor-save operation. S1 needs a real file tree and
+editor on the canvas. S3 needs a reusable safe reader for explicitly selected
+rule/skill files; a second filesystem service would create conflicting access
+and overwrite policies.
+
+The user requested files/editor after worktree integration, including real
+disk effects and restart behavior. A generic Tauri filesystem command, shell
+command, or Rust type without a daemon handler would not fulfill that request.
+Linux filenames are byte sequences and need not be UTF-8. A check using
+`canonicalize` followed by an unrelated pathname `open` can follow a replaced
+symlink. Atomic replacement prevents partial files, but portable Unix rename
+does not provide compare-and-swap against an external editor's last write.
+
+## Decision
+
+### Ownership and initial scope
+
+Implement `file.list`, `file.read` and `file.write` in the daemon, backed by a
+single internal `LocalFileService`. Core owns pure validated values and DTOs;
+it performs no filesystem, hashing of open files, clock, or process I/O.
+Storage resolves existing metadata IDs and remains the only SQLite owner.
+No new table or migration is required for these three operations.
+
+Add each method to Rust wire, JSON catalog and TypeScript mirrors only with
+its functional handler. The desktop continues to use `daemon_invoke`; there
+is no `file_read` or other domain-specific Tauri command. Operations run in
+bounded blocking tasks rather than on the asynchronous socket reader.
+
+`file.write` replaces an existing regular text file. It never creates a
+missing file or parent directory, renames a user file, or deletes one. Those
+remain required future file-management increments, tentatively under
+`file.create`, `file.rename`, and `file.prepare_delete`/`file.delete`; they
+are not advertised or implemented as stubs now. Creation will require
+exclusive creation, rename a no-clobber/state policy, and deletion a reviewed
+state-bound target. This sequencing does not remove M29's remaining scope.
+
+### Target and byte-exact path contracts
+
+Every request carries one registered target:
+
+```text
+FileTarget = { kind: "project", projectId: UUIDv7 }
+           | { kind: "session", sessionId: UUIDv7 }
+           | { kind: "worktree", worktreeId: UUIDv7 }
+FilePath   = canonical padded base64 of repository-independent Unix path bytes
+FileRevision = "v1:" + 64 lowercase hexadecimal SHA-256 characters
+```
+
+`FileTarget` has the same tagged representation as the existing Git target,
+but file semantics belong to this service. A project resolves to its
+registered selected directory, a session to its persisted cwd, and a worktree
+to its managed root. The service must not expand a project subdirectory to
+the repository root. Worktree-backed targets require an active association;
+creating/orphaned/removal-pending targets are not writable. Reads may explain
+recovery state, but must not substitute another directory silently.
+
+Roots are derived from daemon metadata and validated on every operation;
+clients do not echo a root path back as authority. Root opens must reject a
+persisted canonical root that now resolves elsewhere. Managed worktree
+identity checks reuse the runtime worktree validation before granting access.
+
+`pathBase64` is limited to 4096 decoded bytes. Empty bytes represent the root
+only for `file.list`. Nonempty paths are relative `/`-separated components;
+reject leading/trailing `/`, empty components, NUL, `.` and `..`. Names with
+spaces, Unicode, non-UTF-8 bytes, leading `-`, literal backslashes or colons
+remain valid Unix names. There is no Windows-path normalization, Unicode
+normalization, case folding or Git pathspec interpretation. The existing
+`GitRelativePath` is deliberately not reused.
+
+Responses return `pathBase64` as the exact identifier and `displayName` for
+presentation. Escape control/undecodable bytes in display text; never rebuild
+an operation path from that text. Raw names never become HTML or command
+arguments. Non-UTF-8 names are listable and can identify an editable UTF-8
+file on either supported platform.
+
+### Public operations
+
+All payloads use camelCase, reject unknown fields and keep existing versioned
+response envelopes. Optional fields are omitted when absent.
+
+| Method | Request | Successful response |
+| --- | --- | --- |
+| `file.list` | `{ target, pathBase64, limit?, afterNameBase64? }` | `{ entries: FileEntry[], nextAfterNameBase64?, observedAtMs }` |
+| `file.read` | `{ target, pathBase64 }` | `{ pathBase64, text, revision, sizeBytes, modifiedAtMs?, observedAtMs }` |
+| `file.write` | `{ target, pathBase64, text, expectedRevision }` | `{ pathBase64, revision, sizeBytes, modifiedAtMs?, writtenAtMs }` |
+
+`FileEntry` is `{ pathBase64, displayName, kind, sizeBytes?, modifiedAtMs? }`.
+Kind is `file | directory | symlink | other`; it describes observed type, not
+an access grant. Symlinks are visible but not traversed or edited. `other`
+includes devices, sockets and FIFOs and cannot be opened through this API.
+
+List one directory, not a recursive tree. Default page size is 100, maximum
+200. Order by raw name bytes; `afterNameBase64` is a validated single filename
+and is an exclusive lexicographic cursor. Bound enumeration to 10,000 entries
+and the encoded response to 512 KiB, returning a continuation cursor before
+exceeding the response budget. A directory exceeding the enumeration limit
+returns `file_listing_too_large`, never a success implying an empty tree.
+Pages are observations, not a transaction snapshot: concurrent changes before
+the cursor may require refresh. Search and persistent indexing are separate
+increments.
+
+Read/write text is limited to **128 KiB of UTF-8 bytes**, including any BOM.
+This bound allows worst-case JSON escaping inside the existing 1 MiB frame
+with room for the envelope. Preserve bytes represented by the text exactly,
+including CRLF, final newline and BOM; do not normalize automatically.
+The service reads at most the limit plus one byte and rejects oversized
+files, invalid UTF-8 or NUL-containing content. Binary/media previews need a
+separate bounded byte/asset operation; this text slice does not claim them.
+`file.list` can still show those files. The UI keeps its unsaved buffer after
+every error.
+
+All timestamp fields are Unix epoch milliseconds. File modification time is
+optional if it cannot be represented; absence is not zero. Revision checks
+use higher-resolution metadata internally and never depend on epoch-ms alone.
+
+### Descriptor-relative filesystem access
+
+Use safe APIs from the existing direct daemon dependency `rustix 1.1.4` with
+feature `fs`. Its local source provides `openat`, `statat`, `fstat`, `renameat`,
+`unlinkat`, directory iteration and `fsync`. No new project `unsafe` block,
+shell command, external file utility or platform-specific path syntax is
+needed. `renameat` is the portable directory-relative replacement operation.
+[rustix reference](https://docs.rs/rustix/1.1.4/rustix/fs/fn.renameat.html)
+
+Open the validated root as a directory descriptor, then walk each path
+component relative to its already-open parent with
+`RDONLY | DIRECTORY | NOFOLLOW | CLOEXEC`. Open a leaf with
+`RDONLY | NOFOLLOW | NONBLOCK | CLOEXEC`, then `fstat` that descriptor and
+require a regular file before reading. `NONBLOCK` prevents a FIFO substituted
+at the leaf from hanging the daemon. Use no-follow stat for listing entries;
+never open an `other` entry as if it were ordinary text.
+
+Keep the parent descriptor through validation, temporary-file creation and
+rename. Reopening an absolute concatenated pathname after validation is not
+an acceptable fallback. Revalidate root/parent device+inode identity before
+publication; if metadata registration or directory identity changed, abort
+with `file_target_changed` and discard only the service-owned temporary file.
+For managed worktrees, hold a short operation lease against worktree removal
+for the final write transaction. File reads need no process lifecycle lock.
+File I/O must not delay stop of an unrelated session behind enumeration.
+
+Descriptor-relative traversal prevents symlink substitution from redirecting
+access. It does not promise that a directory descriptor's inode remains at
+the same pathname if another same-user process renames that directory. The
+service acts on the opened object and detects observed namespace changes;
+it is not a security sandbox against another process with the same Unix UID.
+
+### Revision checks and atomic save
+
+Compute revision in the daemon over file bytes plus identity and change
+metadata: device, inode, size, high-resolution mtime/ctime, link count and
+permission mode. Encode fields canonically with a version prefix and hash
+with SHA-256; the resulting `FileRevision` remains opaque to clients. Make
+`sha2 0.10.9`, already resolved in the workspace lockfile, a direct daemon
+dependency if used. The revision is content/identity-based, not a database
+counter or process-local token, so unchanged files can be checked after a
+daemon restart. It is not an authorization credential.
+
+For read, compare descriptor metadata before and after the bounded read;
+return `file_conflict` if a concurrent change was observed. For write:
+
+1. Acquire a service mutation lock keyed by parent device/inode and raw leaf
+   name. It must serialize overlapping requests even when target IDs differ.
+2. Open/inspect the current leaf by descriptor, reject nonregular files and
+   multiple hard links, read its bounded bytes, and require the caller's
+   `expectedRevision` to match the observed revision.
+3. Create a unique sibling temporary file with `CREATE | EXCL | NOFOLLOW`,
+   initially mode 0600. Write the complete new text, apply the supported
+   permission metadata, flush and `fsync` the temporary descriptor.
+4. Reopen/reinspect the current leaf through the same parent, verify identity
+   and revision again and revalidate the target/parent. On conflict leave the
+   original untouched and remove only that operation's temporary file.
+5. Atomically `renameat` the temporary sibling onto the existing name, then
+   `fsync` the parent directory. Return a revision for the published inode.
+
+Ownership/group and ordinary permission bits must be preserved when saving;
+if this cannot be done without elevated access, reject the write. The first
+slice is not a full metadata-preserving file copier: ACLs, extended attributes,
+resource forks and platform flags need explicit preservation or a documented
+unsupported result before accepting such a save. They must not be silently
+advertised as preserved. Hard-linked files return `file_metadata_unsupported`
+because replace would otherwise break the link relationship.
+
+The lock guarantees revision ordering among daemon writers. External editors
+do not honor it. The final comparison followed by POSIX `renameat` leaves a
+small external-write race: it is **optimistic conflict detection**, not a
+filesystem compare-and-swap or a guarantee of zero lost updates against an
+uncooperative writer. This limitation must remain in editor/save documentation
+and tests must not claim to prove its absence. A later stronger design may
+add recoverable versions or platform primitives under another ADR.
+
+Failure before rename does not alter the destination. Failure after rename
+is materially different: return `file_durability_uncertain` with
+`writeApplied: true` and the observed revision when possible, instructing the
+client to re-read before retrying. Do not pretend rollback occurred or send a
+second implicit write. A daemon crash can leave a uniquely named temporary
+file; startup must not sweep unknown files from project directories.
+
+### Errors, synchronization and S3 reuse
+
+Use existing `ApiError` envelopes. Stable service error codes are
+`file_target_not_found`, `file_target_changed`, `file_not_found`,
+`file_not_directory`, `file_not_regular`, `file_symlink_not_allowed`,
+`file_permission_denied`, `file_too_large`, `file_not_text`,
+`file_listing_too_large`, `file_conflict`, `file_metadata_unsupported`,
+`file_durability_uncertain` and `file_io_error`. Invalid encoded path, text
+limit or revision shape is `invalid_input` at the wire boundary. Conflict
+details can carry `currentRevision`, never full old/new text or env values.
+Map OS errors without logging file content, secrets or raw program commands.
+
+This first slice uses explicit response/re-read synchronization. Do not add a
+`file.changed` catalog entry while the public socket only supports terminal
+subscriptions and no implemented file event feed. S1 refreshes the saved file
+and affected directory after mutation, re-reads on explicit refresh/refocus,
+and re-reads after daemon reconnect. A later watcher/feed must provide a real
+subscription contract, bounded events, gap/reconnect semantics and the same
+epoch-ms timestamps. Polling/refresh is not described as live external edits.
+
+Expose descriptor-safe bounded read/resolution as internal service methods
+for S3. The knowledge layer supplies an explicit allowlist and provenance for
+rule/skill discovery; it does not gain arbitrary root access from a path string.
+Global skill roots will require registered internal read-only capabilities
+separate from project editor-write targets. Credential discovery/exposure is
+not part of this increment. S3 must not add a second unsafe reader, database,
+shell runner or Tauri client.
+
+### Acceptance
+
+Use real temporary directories, SQLite and the production daemon socket:
+
+- List and edit a file under each registered target, including a project
+  subdirectory and a session with `relativeDirectory`; observe disk bytes.
+- Preserve a non-UTF-8 filename, spaces, leading `-` and literal backslash;
+  use only the returned identifier for follow-up requests.
+- Reject absolute/traversal/NUL paths, symlink components and symlink leaves;
+  swapped FIFO/device leaves do not block the request or get read as text.
+- Refuse a target/root replaced between requests or during observed traversal;
+  file operations and worktree removal cannot race through the final save.
+- Two daemon clients reading one revision cannot both commit different writes;
+  changing bytes or inode externally before validation produces conflict.
+- Reject binary/oversized files and unsupported metadata without changing the
+  destination. Preserve line endings, mode and complete Unicode text.
+- Inject failures before rename and after rename/fsync; verify original bytes
+  or the explicit applied-but-uncertain outcome respectively.
+- Reconnect/restart, read the saved text/revision again, and cover pagination
+  and encoded frame bounds. S3's reader uses the same safe implementation.
+- Execute on Linux and macOS; compile/test wire mirrors. S1 separately proves
+  open → edit → save → conflict/reload on the real desktop. Types, mocked UI,
+  or this ADR alone do not mark M29/M30 complete.
+
+## Consequences
+
+The first editor slice has a small public surface and a single access policy
+for S1/S3. Exact filename identity survives Unix/JSON boundaries. Existing
+documents remain ordinary files, with no second copy silently made canonical
+in SQLite. Directory and file limits are explicit and can be extended with
+streaming/indexing later.
+
+Base64 identifiers and optimistic revisions add client code; symlinked and
+unsupported-metadata files initially remain read-only/unavailable for save.
+Atomic replacement changes inode identity. External-writer races and richer
+metadata preservation remain explicit engineering limits. No file operation
+spawns a process, changes session status, writes custom-agent env values to
+logs, changes Git author configuration, or creates coauthor trailers.
+
+## Alternatives considered
+
+- Absolute string paths or generic Tauri fs access: rejected because clients
+  could bypass registered target identity and introduce a second I/O owner.
+- UTF-8-only paths or Git pathspec reuse: rejected because valid Unix filenames
+  would become unaddressable or acquire unrelated Git argument restrictions.
+- Canonicalize then normal open: rejected as the sole safety mechanism;
+  descriptor-relative no-follow traversal is available on both supported OSes.
+- Truncate/write in place: rejected because interruption can destroy the
+  original and partial bytes are visible to agents/editors.
+- Unconditional last-writer-wins: rejected because ordinary stale editors
+  would overwrite external work silently. Optimistic revision detects observed
+  conflicts while accurately describing the remaining portable rename race.
+- Announce all future methods/events immediately: rejected because advertised
+  names without usable handlers or event delivery are not functionality.

From b7b0b4e15fc6e72be9027b084c2da5054b100b31 Mon Sep 17 00:00:00 2001
From: guicybercode <euguigom@gmail.com>
Date: Sat, 5 Sep 2026 22:04:03 -0300
Subject: [PATCH 14/23] fix(knowledge): preserve source revision when inserting
 drafts

---
 .../knowledge/KnowledgeLibrary.test.tsx       | 41 ++++++++++++++++++-
 .../app/features/knowledge/knowledge-types.ts |  9 ++++
 .../features/knowledge/useKnowledgeLibrary.ts |  1 +
 3 files changed, 50 insertions(+), 1 deletion(-)

diff --git a/apps/desktop/src/app/features/knowledge/KnowledgeLibrary.test.tsx b/apps/desktop/src/app/features/knowledge/KnowledgeLibrary.test.tsx
index b28eef9..d2d209f 100644
--- a/apps/desktop/src/app/features/knowledge/KnowledgeLibrary.test.tsx
+++ b/apps/desktop/src/app/features/knowledge/KnowledgeLibrary.test.tsx
@@ -45,11 +45,50 @@ describe("KnowledgePanel", () => {
     expect(client.writeTerminal).not.toHaveBeenCalled();
 
     await user.click(screen.getByRole("button", { name: "Insert into draft" }));
-    expect(onInsert).toHaveBeenCalledWith({ sourceId: saved.id, kind: "context", title: saved.title, body: saved.body });
+    expect(onInsert).toHaveBeenCalledWith({ sourceId: saved.id, sourceRevision: saved.revision, kind: "context", title: saved.title, body: saved.body });
     expect(screen.getByText("Inserted into the session draft.")).toBeVisible();
     expect(client.writeTerminal).not.toHaveBeenCalled();
   });
 
+  it("inserts unsaved edits with the revision they were based on, even after a newer list response", async () => {
+    const user = userEvent.setup();
+    const original = entry();
+    const onInsert = vi.fn();
+    const client = createMockIpcClient();
+    client.listKnowledge.mockResolvedValueOnce({ entries: [original], nextCursor: null });
+    client.listKnowledge.mockResolvedValue({ entries: [entry({ revision: 4, body: "Changed elsewhere" })], nextCursor: null });
+    render(<KnowledgePanel client={client} onInsert={onInsert} />);
+    await user.click(await screen.findByRole("button", { name: original.title }));
+    fireEvent.change(screen.getByLabelText("Title"), { target: { value: "Edited review" } });
+    fireEvent.change(screen.getByLabelText("Content"), { target: { value: "Unsaved content\n" } });
+    await user.click(screen.getByRole("button", { name: "Refresh" }));
+    await waitFor(() => expect(client.listKnowledge).toHaveBeenCalledTimes(2));
+    await user.click(screen.getByRole("button", { name: "Insert into draft" }));
+    expect(onInsert).toHaveBeenCalledWith({
+      sourceId: original.id, sourceRevision: 3, kind: "prompt",
+      title: "Edited review", body: "Unsaved content\n",
+    });
+    expect(client.saveKnowledge).not.toHaveBeenCalled();
+    expect(client.writeTerminal).not.toHaveBeenCalled();
+    expect(client.startSession).not.toHaveBeenCalled();
+  });
+
+  it("inserts a never-saved draft with neither a source ID nor a source revision", async () => {
+    const user = userEvent.setup();
+    const onInsert = vi.fn();
+    const client = createMockIpcClient({ handlers: { listKnowledge: async () => ({ entries: [], nextCursor: null }) } });
+    render(<KnowledgePanel client={client} onInsert={onInsert} />);
+    await user.type(screen.getByLabelText("Title"), "New draft");
+    await user.type(screen.getByLabelText("Content"), "New text");
+    await user.click(screen.getByRole("button", { name: "Insert into draft" }));
+    expect(onInsert).toHaveBeenCalledWith({
+      sourceId: null, sourceRevision: null, kind: "prompt", title: "New draft", body: "New text",
+    });
+    expect(client.saveKnowledge).not.toHaveBeenCalled();
+    expect(client.writeTerminal).not.toHaveBeenCalled();
+    expect(client.startSession).not.toHaveBeenCalled();
+  });
+
   it("preserves item and new-project drafts when selecting items, refreshing, or changing project", async () => {
     const user = userEvent.setup();
     const first = entry();
diff --git a/apps/desktop/src/app/features/knowledge/knowledge-types.ts b/apps/desktop/src/app/features/knowledge/knowledge-types.ts
index 02d468b..c66aa0a 100644
--- a/apps/desktop/src/app/features/knowledge/knowledge-types.ts
+++ b/apps/desktop/src/app/features/knowledge/knowledge-types.ts
@@ -17,9 +17,18 @@ export type { KnowledgeKind } from "../../../ipc/domain";
 
 /** Plain text the host can append to a session draft after an explicit click. */
 export interface KnowledgeInsertion {
+  /** Saved item used as the editor's base, or null for a never-saved draft. */
   readonly sourceId: string | null;
+  /**
+   * Revision used as the editor's base; null exactly when sourceId is null.
+   * This is provenance, not a claim that the inserted draft matches that revision:
+   * title and body include the user's unsaved edits.
+   */
+  readonly sourceRevision: number | null;
   readonly kind: KnowledgeKind;
+  /** Current draft title, which can differ from the source revision. */
   readonly title: string;
+  /** Exact current draft body, which can differ from the source revision. */
   readonly body: string;
 }
 
diff --git a/apps/desktop/src/app/features/knowledge/useKnowledgeLibrary.ts b/apps/desktop/src/app/features/knowledge/useKnowledgeLibrary.ts
index 9ca4ad9..96e6ac0 100644
--- a/apps/desktop/src/app/features/knowledge/useKnowledgeLibrary.ts
+++ b/apps/desktop/src/app/features/knowledge/useKnowledgeLibrary.ts
@@ -228,6 +228,7 @@ export function useKnowledgeLibrary({
     try {
       onInsert({
         sourceId: draft.original?.id ?? null,
+        sourceRevision: draft.original?.revision ?? null,
         kind: draft.kind,
         title: trimKnowledgeText(draft.title),
         body: draft.body,

From 4a367d003501e5b6d0d7870ea3f5236a7d8c59ec Mon Sep 17 00:00:00 2001
From: guicybercode <euguigom@gmail.com>
Date: Sat, 5 Sep 2026 22:21:19 -0300
Subject: [PATCH 15/23] feat(knowledge): discover and safely read local rules
 and skills

---
 apps/desktop/src/ipc/client.test.ts           |  40 +
 apps/desktop/src/ipc/client.ts                |  17 +-
 apps/desktop/src/ipc/discovery-schema.test.ts |  42 ++
 apps/desktop/src/ipc/discovery-schema.ts      |  96 +++
 apps/desktop/src/ipc/domain.ts                |  52 ++
 apps/desktop/src/ipc/methods.ts               |   4 +-
 apps/desktop/src/test/mockIpc.ts              |   4 +
 crates/core/src/knowledge/discovery.rs        | 231 ++++++
 crates/core/src/knowledge/mod.rs              |   2 +
 crates/core/src/wire/method.rs                |   6 +
 crates/core/src/wire/mod.rs                   |   6 +
 crates/core/tests/knowledge_catalog.rs        |   2 +
 .../tests/knowledge_discovery_contract.rs     |  42 ++
 crates/daemon/src/knowledge/discovery/mod.rs  | 707 ++++++++++++++++++
 crates/daemon/src/knowledge/discovery/safe.rs | 655 ++++++++++++++++
 .../daemon/src/knowledge/discovery/tests.rs   | 468 ++++++++++++
 crates/daemon/src/knowledge/mod.rs            |  65 +-
 crates/daemon/src/knowledge/socket_tests.rs   | 309 ++++++++
 crates/daemon/src/server.rs                   |  39 +-
 protocol/catalog.json                         |   4 +-
 protocol/fixtures/knowledge-discovery.json    |  36 +
 21 files changed, 2812 insertions(+), 15 deletions(-)
 create mode 100644 apps/desktop/src/ipc/discovery-schema.test.ts
 create mode 100644 apps/desktop/src/ipc/discovery-schema.ts
 create mode 100644 crates/core/src/knowledge/discovery.rs
 create mode 100644 crates/core/tests/knowledge_discovery_contract.rs
 create mode 100644 crates/daemon/src/knowledge/discovery/mod.rs
 create mode 100644 crates/daemon/src/knowledge/discovery/safe.rs
 create mode 100644 crates/daemon/src/knowledge/discovery/tests.rs
 create mode 100644 crates/daemon/src/knowledge/socket_tests.rs
 create mode 100644 protocol/fixtures/knowledge-discovery.json

diff --git a/apps/desktop/src/ipc/client.test.ts b/apps/desktop/src/ipc/client.test.ts
index be45fab..055bfcb 100644
--- a/apps/desktop/src/ipc/client.test.ts
+++ b/apps/desktop/src/ipc/client.test.ts
@@ -11,6 +11,7 @@ vi.mock("@tauri-apps/api/event", () => ({ listen: transport.listen }));
 vi.mock("@tauri-apps/plugin-opener", () => ({ openPath: transport.openPath }));
 
 import { createTauriIpcClient } from "./client";
+import discoveryFixture from "../../../../protocol/fixtures/knowledge-discovery.json";
 import type { RequestEnvelope } from "./types";
 
 const PROJECT = {
@@ -410,3 +411,42 @@ describe("knowledge IPC transport", () => {
     await expect(client.saveKnowledge({ ...input, id: entry.id, expectedRevision: 1 })).rejects.toMatchObject({ code: "knowledge_conflict" });
   });
 });
+
+describe("discovery IPC transport", () => {
+  beforeEach(() => {
+    transport.invoke.mockReset();
+    transport.openPath.mockReset();
+  });
+
+  it("sends opaque scan/source capabilities through the generic daemon bridge", async () => {
+    installWireResponder({ "knowledge.discover": discoveryFixture.scan, "knowledge.read": discoveryFixture.read });
+    const client = createTauriIpcClient();
+    expect(await client.discoverKnowledge({ projectId: PROJECT.id })).toEqual(discoveryFixture.scan);
+    const selection = { scanId: discoveryFixture.scan.scanId, entryId: discoveryFixture.read.entry.entryId };
+    expect(await client.readKnowledge(selection)).toEqual(discoveryFixture.read);
+    expect(capturedRequests().map((request) => ({ method: request.method, payload: request.payload }))).toEqual([
+      { method: "knowledge.discover", payload: { projectId: PROJECT.id } },
+      { method: "knowledge.read", payload: selection },
+    ]);
+    expect(transport.openPath).not.toHaveBeenCalled();
+  });
+
+  it("rejects content returned for a different source capability", async () => {
+    installWireResponder({ "knowledge.read": discoveryFixture.read });
+    await expect(createTauriIpcClient().readKnowledge({
+      scanId: discoveryFixture.scan.scanId,
+      entryId: "0198b6e0-0002-7000-8000-000000000002",
+    })).rejects.toThrow("Discovery read returned another source capability");
+  });
+
+  it("preserves scan expiry errors for explicit rescan recovery", async () => {
+    transport.invoke.mockImplementation(async (_command, { request }) => ({
+      kind: "response", version: 1, requestId: request.requestId, status: "error",
+      error: { code: "knowledge_scan_expired", message: "Rescan sources before reading this item." },
+    }));
+    await expect(createTauriIpcClient().readKnowledge({
+      scanId: discoveryFixture.scan.scanId, entryId: discoveryFixture.read.entry.entryId,
+    })).rejects.toMatchObject({ code: "knowledge_scan_expired" });
+    expect(capturedRequests()).toHaveLength(1);
+  });
+});
diff --git a/apps/desktop/src/ipc/client.ts b/apps/desktop/src/ipc/client.ts
index 62b2cdb..f604bf6 100644
--- a/apps/desktop/src/ipc/client.ts
+++ b/apps/desktop/src/ipc/client.ts
@@ -1,5 +1,6 @@
 import { decodeKnowledgeEntry, decodeKnowledgePage } from "./knowledge-schema";
-import type { KnowledgeEntry, KnowledgeListRequest, KnowledgeListResponse, KnowledgeSaveRequest, KnowledgeDeleteRequest } from "./domain";
+import { decodeKnowledgeDiscoverResponse, decodeKnowledgeReadResponse } from "./discovery-schema";
+import type { KnowledgeEntry, KnowledgeListRequest, KnowledgeListResponse, KnowledgeSaveRequest, KnowledgeDeleteRequest, KnowledgeDiscoverRequest, KnowledgeDiscoverResponse, KnowledgeReadRequest, KnowledgeReadResponse } from "./domain";
 import { invoke } from "@tauri-apps/api/core";
 import { listen } from "@tauri-apps/api/event";
 import { openPath } from "@tauri-apps/plugin-opener";
@@ -65,6 +66,8 @@ export interface IpcClient {
   listKnowledge(input: KnowledgeListRequest): Promise<KnowledgeListResponse>;
   saveKnowledge(input: KnowledgeSaveRequest): Promise<KnowledgeEntry>;
   deleteKnowledge(input: KnowledgeDeleteRequest): Promise<void>;
+  discoverKnowledge(input: KnowledgeDiscoverRequest): Promise<KnowledgeDiscoverResponse>;
+  readKnowledge(input: KnowledgeReadRequest): Promise<KnowledgeReadResponse>;
   initialize(): Promise<BootstrapResult>;
   subscribe(
     handler: IpcEventHandler,
@@ -153,6 +156,18 @@ class TauriIpcClient implements IpcClient {
     await this.request("knowledge.delete", input);
   }
 
+  async discoverKnowledge(input: KnowledgeDiscoverRequest): Promise<KnowledgeDiscoverResponse> {
+    return decodeKnowledgeDiscoverResponse(await this.request("knowledge.discover", input));
+  }
+
+  async readKnowledge(input: KnowledgeReadRequest): Promise<KnowledgeReadResponse> {
+    const response = decodeKnowledgeReadResponse(await this.request("knowledge.read", input));
+    if (response.entry.entryId !== input.entryId) {
+      throw new IpcContractError("Discovery read returned another source capability");
+    }
+    return response;
+  }
+
   async initialize(): Promise<BootstrapResult> {
     const hello = decodeHello(await this.request("system.hello", {}));
     if (hello.protocolVersion !== 1) {
diff --git a/apps/desktop/src/ipc/discovery-schema.test.ts b/apps/desktop/src/ipc/discovery-schema.test.ts
new file mode 100644
index 0000000..192b723
--- /dev/null
+++ b/apps/desktop/src/ipc/discovery-schema.test.ts
@@ -0,0 +1,42 @@
+import { describe, expect, it } from "vitest";
+
+import fixture from "../../../../protocol/fixtures/knowledge-discovery.json";
+import { decodeKnowledgeDiscoverResponse, decodeKnowledgeReadResponse, decodeKnowledgeSourceEntry } from "./discovery-schema";
+
+describe("discovery Rust/TypeScript contract", () => {
+  it("decodes the shared scan and read fixture without changing provenance or content", () => {
+    expect(decodeKnowledgeDiscoverResponse(fixture.scan)).toEqual(fixture.scan);
+    expect(decodeKnowledgeReadResponse(fixture.read)).toEqual(fixture.read);
+  });
+
+  it("rejects unknown variants and malformed capabilities without echoing source values", () => {
+    for (const field of ["kind", "provider", "scope", "availability", "entryId"]) {
+      expect(() => decodeKnowledgeSourceEntry({ ...fixture.read.entry, [field]: "private document text" }))
+        .toThrow(/^Invalid discovery /);
+    }
+    expect(() => decodeKnowledgeSourceEntry({ ...fixture.read.entry, viaSymlink: "true" })).toThrow();
+    expect(() => decodeKnowledgeDiscoverResponse({ ...fixture.scan, scanId: "not-a-capability" })).toThrow("Invalid discovery capability");
+  });
+
+  it("rejects repeated entries and inventories beyond source or issue bounds", () => {
+    expect(() => decodeKnowledgeDiscoverResponse({ ...fixture.scan, entries: [fixture.read.entry, fixture.read.entry] })).toThrow("Duplicate discovery source capability");
+    expect(() => decodeKnowledgeDiscoverResponse({ ...fixture.scan, entries: Array.from({ length: 513 }, () => fixture.read.entry) })).toThrow("Discovery source limit exceeded");
+    expect(() => decodeKnowledgeDiscoverResponse({ ...fixture.scan, issues: Array.from({ length: 33 }, () => ({ code: "partial", sourcePath: null, message: "Partial" })) })).toThrow("Discovery issue limit exceeded");
+  });
+
+  it("preserves truncation and explicit nullable issue paths", () => {
+    const scan = { ...fixture.scan, truncated: true, issues: [{ code: "unsupported_scope", sourcePath: null, message: "Nested scopes are not included." }] };
+    expect(decodeKnowledgeDiscoverResponse(scan)).toEqual(scan);
+    expect(() => decodeKnowledgeDiscoverResponse({ ...scan, issues: [{ code: "partial", message: "Missing path field" }] })).toThrow();
+    expect(() => decodeKnowledgeDiscoverResponse({ ...scan, truncated: "yes" })).toThrow();
+  });
+
+  it("keeps empty and markup-like source text literal while enforcing UTF-8 byte and NUL limits", () => {
+    for (const content of ["", "<script>alert('text only')</script>", "é".repeat(32_768)]) {
+      expect(decodeKnowledgeReadResponse({ ...fixture.read, content }).content).toBe(content);
+    }
+    expect(() => decodeKnowledgeReadResponse({ ...fixture.read, content: "é".repeat(32_769) })).toThrow("Discovery content limit exceeded");
+    expect(() => decodeKnowledgeReadResponse({ ...fixture.read, content: "private text\0" })).toThrow("Invalid discovery source text");
+    expect(() => decodeKnowledgeReadResponse({ ...fixture.read, entry: { ...fixture.read.entry, availability: "symlink" } })).toThrow("Unavailable discovery source returned content");
+  });
+});
diff --git a/apps/desktop/src/ipc/discovery-schema.ts b/apps/desktop/src/ipc/discovery-schema.ts
new file mode 100644
index 0000000..151e6f6
--- /dev/null
+++ b/apps/desktop/src/ipc/discovery-schema.ts
@@ -0,0 +1,96 @@
+import type {
+  KnowledgeDiscoverResponse,
+  KnowledgeDiscoveryIssue,
+  KnowledgeReadResponse,
+  KnowledgeSourceEntry,
+} from "./domain";
+import { KNOWLEDGE_BODY_BYTES } from "./knowledge-schema";
+import { IpcContractError, requireArray, requireBoolean, requireRecord, requireString } from "./schema";
+
+/** A discovery capability must be a UUIDv7, without echoing an invalid value. */
+function capability(value: unknown): string {
+  const identifier = requireString(value, "discovery capability");
+  if (!/^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(identifier)) {
+    throw new IpcContractError("Invalid discovery capability");
+  }
+  return identifier;
+}
+
+/** Reads display-only metadata and rejects unsupported native-provider variants. */
+export function decodeKnowledgeSourceEntry(value: unknown): KnowledgeSourceEntry {
+  const entry = requireRecord(value, "discovery source");
+  if (entry.kind !== "rule" && entry.kind !== "skill") {
+    throw new IpcContractError("Invalid discovery source kind");
+  }
+  if (entry.provider !== "codex" && entry.provider !== "claude" && entry.provider !== "cursor") {
+    throw new IpcContractError("Invalid discovery provider");
+  }
+  if (entry.scope !== "global" && entry.scope !== "project" && entry.scope !== "admin") {
+    throw new IpcContractError("Invalid discovery scope");
+  }
+  if (
+    entry.availability !== "available" && entry.availability !== "too_large" &&
+    entry.availability !== "symlink" && entry.availability !== "non_regular" &&
+    entry.availability !== "unreadable"
+  ) {
+    throw new IpcContractError("Invalid discovery availability");
+  }
+  return {
+    entryId: capability(entry.entryId),
+    kind: entry.kind,
+    provider: entry.provider,
+    scope: entry.scope,
+    sourcePath: requireString(entry.sourcePath, "discovery source path"),
+    name: requireString(entry.name, "discovery source name"),
+    scopeDirectory: requireString(entry.scopeDirectory, "discovery scope directory"),
+    precedenceHint: requireString(entry.precedenceHint, "discovery precedence hint"),
+    viaSymlink: requireBoolean(entry.viaSymlink, "discovery symlink flag"),
+    availability: entry.availability,
+  };
+}
+
+/** Keeps partial-result explanations distinct from successfully read sources. */
+function decodeIssue(value: unknown): KnowledgeDiscoveryIssue {
+  const issue = requireRecord(value, "discovery issue");
+  return {
+    code: requireString(issue.code, "discovery issue code"),
+    sourcePath: issue.sourcePath === null ? null : requireString(issue.sourcePath, "discovery issue path"),
+    message: requireString(issue.message, "discovery issue message"),
+  };
+}
+
+/** Enforces the bounded, uniquely selectable source inventory. */
+export function decodeKnowledgeDiscoverResponse(value: unknown): KnowledgeDiscoverResponse {
+  const response = requireRecord(value, "discovery response");
+  const entries = requireArray(response.entries, "discovery sources");
+  const issues = requireArray(response.issues, "discovery issues");
+  if (entries.length > 512) throw new IpcContractError("Discovery source limit exceeded");
+  if (issues.length > 32) throw new IpcContractError("Discovery issue limit exceeded");
+  const sources = entries.map(decodeKnowledgeSourceEntry);
+  if (new Set(sources.map((entry) => entry.entryId)).size !== sources.length) {
+    throw new IpcContractError("Duplicate discovery source capability");
+  }
+  return {
+    scanId: capability(response.scanId),
+    entries: sources,
+    truncated: requireBoolean(response.truncated, "discovery truncation flag"),
+    issues: issues.map(decodeIssue),
+  };
+}
+
+/** Raw source text is allowed to be empty; it is never parsed as HTML or a command. */
+export function decodeKnowledgeReadResponse(value: unknown): KnowledgeReadResponse {
+  const response = requireRecord(value, "discovery read response");
+  const entry = decodeKnowledgeSourceEntry(response.entry);
+  const content = requireString(response.content, "discovery source content");
+  if (content.includes("\0")) {
+    throw new IpcContractError("Invalid discovery source text");
+  }
+  if (entry.availability !== "available") {
+    throw new IpcContractError("Unavailable discovery source returned content");
+  }
+  if (new TextEncoder().encode(content).byteLength > KNOWLEDGE_BODY_BYTES) {
+    throw new IpcContractError("Discovery content limit exceeded");
+  }
+  return { entry, content };
+}
diff --git a/apps/desktop/src/ipc/domain.ts b/apps/desktop/src/ipc/domain.ts
index 4dcfdaf..80325da 100644
--- a/apps/desktop/src/ipc/domain.ts
+++ b/apps/desktop/src/ipc/domain.ts
@@ -45,3 +45,55 @@ export interface KnowledgeDeleteRequest {
   readonly id: string;
   readonly expectedRevision: number;
 }
+
+/** Mirrors core::knowledge::discovery; discovery never establishes native activation. */
+export type KnowledgeSourceKind = "rule" | "skill";
+export type KnowledgeProvider = "codex" | "claude" | "cursor";
+export type KnowledgeSourceScope = "global" | "project" | "admin";
+export type KnowledgeSourceAvailability = "available" | "too_large" | "symlink" | "non_regular" | "unreadable";
+
+/** Known global sources plus optional registered-project sources. */
+export interface KnowledgeDiscoverRequest {
+  readonly projectId?: string | null;
+}
+
+/** Read selectors are daemon-owned capabilities, never paths supplied by a client. */
+export interface KnowledgeReadRequest {
+  readonly scanId: string;
+  readonly entryId: string;
+}
+
+/** Source location and policy metadata observed by one bounded inventory. */
+export interface KnowledgeSourceEntry {
+  readonly entryId: string;
+  readonly kind: KnowledgeSourceKind;
+  readonly provider: KnowledgeProvider;
+  readonly scope: KnowledgeSourceScope;
+  readonly sourcePath: string;
+  readonly name: string;
+  readonly scopeDirectory: string;
+  readonly precedenceHint: string;
+  readonly viaSymlink: boolean;
+  readonly availability: KnowledgeSourceAvailability;
+}
+
+/** A partial discovery result or unsupported case with a safe explanation. */
+export interface KnowledgeDiscoveryIssue {
+  readonly code: string;
+  readonly sourcePath: string | null;
+  readonly message: string;
+}
+
+/** Metadata-only inventory; its scan capability expires in the daemon. */
+export interface KnowledgeDiscoverResponse {
+  readonly scanId: string;
+  readonly entries: readonly KnowledgeSourceEntry[];
+  readonly truncated: boolean;
+  readonly issues: readonly KnowledgeDiscoveryIssue[];
+}
+
+/** Explicitly requested, revalidated source with raw bounded UTF-8 content. */
+export interface KnowledgeReadResponse {
+  readonly entry: KnowledgeSourceEntry;
+  readonly content: string;
+}
diff --git a/apps/desktop/src/ipc/methods.ts b/apps/desktop/src/ipc/methods.ts
index cb3a528..e7ca201 100644
--- a/apps/desktop/src/ipc/methods.ts
+++ b/apps/desktop/src/ipc/methods.ts
@@ -30,7 +30,9 @@ export const IPC_METHODS = [
   "diagnostics.get",
   "knowledge.list",
   "knowledge.save",
-  "knowledge.delete"
+  "knowledge.delete",
+  "knowledge.discover",
+  "knowledge.read"
 ] as const;
 
 export type IpcMethod = (typeof IPC_METHODS)[number];
diff --git a/apps/desktop/src/test/mockIpc.ts b/apps/desktop/src/test/mockIpc.ts
index c5bdb6a..a6e6c73 100644
--- a/apps/desktop/src/test/mockIpc.ts
+++ b/apps/desktop/src/test/mockIpc.ts
@@ -27,6 +27,8 @@ export interface MockIpcClient extends IpcClient {
   readonly listKnowledge: Mock<IpcClient["listKnowledge"]>;
   readonly saveKnowledge: Mock<IpcClient["saveKnowledge"]>;
   readonly deleteKnowledge: Mock<IpcClient["deleteKnowledge"]>;
+  readonly discoverKnowledge: Mock<IpcClient["discoverKnowledge"]>;
+  readonly readKnowledge: Mock<IpcClient["readKnowledge"]>;
   readonly initialize: Mock<IpcClient["initialize"]>;
   readonly subscribe: Mock<IpcClient["subscribe"]>;
   readonly subscribeTerminal: Mock<IpcClient["subscribeTerminal"]>;
@@ -152,6 +154,8 @@ export function createMockIpcClient(
     listKnowledge: vi.fn<IpcClient["listKnowledge"]>(handlers.listKnowledge ?? (() => rejectUnhandled("listKnowledge"))),
     saveKnowledge: vi.fn<IpcClient["saveKnowledge"]>(handlers.saveKnowledge ?? (() => rejectUnhandled("saveKnowledge"))),
     deleteKnowledge: vi.fn<IpcClient["deleteKnowledge"]>(handlers.deleteKnowledge ?? (() => rejectUnhandled("deleteKnowledge"))),
+    discoverKnowledge: vi.fn<IpcClient["discoverKnowledge"]>(handlers.discoverKnowledge ?? (() => rejectUnhandled("discoverKnowledge"))),
+    readKnowledge: vi.fn<IpcClient["readKnowledge"]>(handlers.readKnowledge ?? (() => rejectUnhandled("readKnowledge"))),
     openPath: vi.fn<IpcClient["openPath"]>(
       handlers.openPath ?? (() => rejectUnhandled("openPath")),
     ),
diff --git a/crates/core/src/knowledge/discovery.rs b/crates/core/src/knowledge/discovery.rs
new file mode 100644
index 0000000..fda7d7d
--- /dev/null
+++ b/crates/core/src/knowledge/discovery.rs
@@ -0,0 +1,231 @@
+//! Read-only discovery capabilities for known local rule and skill documents.
+
+use std::fmt;
+
+use serde::{Deserialize, Deserializer, Serialize, de};
+
+use super::KnowledgeId;
+use crate::ProjectId;
+
+macro_rules! capability_id {
+    ($name:ident, $description:literal) => {
+        #[doc = $description]
+        #[derive(
+            Clone, Copy, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize,
+        )]
+        #[serde(transparent)]
+        pub struct $name(KnowledgeId);
+
+        impl $name {
+            /// Generates an ephemeral UUID version 7 capability identifier.
+            #[must_use]
+            pub fn new() -> Self {
+                Self(KnowledgeId::new())
+            }
+        }
+
+        impl Default for $name {
+            fn default() -> Self {
+                Self::new()
+            }
+        }
+    };
+}
+
+capability_id!(
+    KnowledgeScanId,
+    "Opaque identifier for one expiring daemon-owned source inventory."
+);
+capability_id!(
+    KnowledgeSourceId,
+    "Opaque identifier for a source within exactly one inventory."
+);
+
+/// Inventories known global sources and optionally one registered project root.
+#[derive(Clone, Copy, Debug, Default, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(deny_unknown_fields, rename_all = "camelCase")]
+pub struct KnowledgeDiscoverRequest {
+    /// Project whose root sources should accompany global sources.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub project_id: Option<ProjectId>,
+}
+
+/// Requests a source by its scan capability; client-supplied paths are forbidden.
+#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(deny_unknown_fields, rename_all = "camelCase")]
+pub struct KnowledgeReadRequest {
+    /// Unexpired scan that owns the entry capability.
+    pub scan_id: KnowledgeScanId,
+    /// Source selected from that scan.
+    pub entry_id: KnowledgeSourceId,
+}
+
+/// Category of a discovered local document.
+#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum KnowledgeSourceKind {
+    /// A rule or instruction document.
+    Rule,
+    /// A skill's SKILL.md document; supporting files are not read.
+    Skill,
+}
+
+/// Native tool associated with a documented source location.
+#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum KnowledgeProvider {
+    /// `OpenAI` Codex.
+    Codex,
+    /// Anthropic Claude Code.
+    Claude,
+    /// Cursor.
+    Cursor,
+}
+
+/// Scope implied by the source location, not proof of native activation.
+#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum KnowledgeSourceScope {
+    /// User-owned global source.
+    Global,
+    /// Source in the selected registered project's root configuration.
+    Project,
+    /// Machine-managed Codex skills directory.
+    Admin,
+}
+
+/// Metadata availability observed during discovery; reads revalidate it.
+#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum KnowledgeSourceAvailability {
+    /// A regular, bounded file was found; UTF-8 is checked only when read.
+    Available,
+    /// File exceeds the 64 KiB content limit.
+    TooLarge,
+    /// Leaf symlink is intentionally not followed.
+    Symlink,
+    /// Candidate is a directory, FIFO, socket, or device rather than a regular file.
+    NonRegular,
+    /// Candidate could not be opened safely with current permissions.
+    Unreadable,
+}
+
+/// Provenance and metadata for a discovered rule or skill.
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(deny_unknown_fields, rename_all = "camelCase")]
+pub struct KnowledgeSourceEntry {
+    /// Opaque selector usable only with the scan that returned it.
+    pub entry_id: KnowledgeSourceId,
+    /// Rule or skill classification.
+    pub kind: KnowledgeSourceKind,
+    /// Native provider associated with this location.
+    pub provider: KnowledgeProvider,
+    /// Global, project, or administrator scope.
+    pub scope: KnowledgeSourceScope,
+    /// Daemon-observed display path; never accepted as a read selector.
+    pub source_path: String,
+    /// Filesystem name, not parsed or executed frontmatter.
+    pub name: String,
+    /// Relative project scope ("." here), or empty for global/admin sources.
+    pub scope_directory: String,
+    /// Static documented precedence caveat; never an effective/active assertion.
+    pub precedence_hint: String,
+    /// Whether an intentional skill-directory symlink was traversed.
+    pub via_symlink: bool,
+    /// Availability observed during the inventory.
+    pub availability: KnowledgeSourceAvailability,
+}
+
+/// Safe, bounded explanation of an incomplete or unsupported discovery case.
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(deny_unknown_fields, rename_all = "camelCase")]
+pub struct KnowledgeDiscoveryIssue {
+    /// Stable machine-readable issue code.
+    pub code: String,
+    /// Display-only source location when available.
+    pub source_path: Option<String>,
+    /// Static explanation without document content or underlying OS errors.
+    pub message: String,
+}
+
+/// Bounded metadata inventory; document contents require an explicit read.
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(deny_unknown_fields, rename_all = "camelCase")]
+pub struct KnowledgeDiscoverResponse {
+    /// Expiring capability for this inventory.
+    pub scan_id: KnowledgeScanId,
+    /// Source metadata in stable source-spec/path order.
+    pub entries: Vec<KnowledgeSourceEntry>,
+    /// True if a scan or response limit prevented a complete inventory.
+    pub truncated: bool,
+    /// Partial results and unsupported-policy explanations.
+    pub issues: Vec<KnowledgeDiscoveryIssue>,
+}
+
+/// A source revalidated against its inventory metadata and explicitly read.
+#[derive(Clone, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(deny_unknown_fields, rename_all = "camelCase")]
+pub struct KnowledgeReadResponse {
+    /// Original source provenance and capability.
+    pub entry: KnowledgeSourceEntry,
+    /// Raw bounded UTF-8 document content, excluded from diagnostics.
+    #[serde(deserialize_with = "deserialize_content")]
+    pub content: String,
+}
+
+fn deserialize_content<'de, D: Deserializer<'de>>(deserializer: D) -> Result<String, D::Error> {
+    let content = String::deserialize(deserializer)
+        .map_err(|_| de::Error::custom("source content must be UTF-8 text"))?;
+    if content.len() > super::MAX_KNOWLEDGE_BODY_BYTES || content.contains('\0') {
+        return Err(de::Error::custom(
+            "source content must be NUL-free text of at most 64 KiB",
+        ));
+    }
+    Ok(content)
+}
+
+impl fmt::Debug for KnowledgeReadResponse {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("KnowledgeReadResponse")
+            .field("entry", &self.entry)
+            .field("content_bytes", &self.content.len())
+            .finish()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+
+    #[test]
+    fn read_content_rejects_oversized_or_nul_text_without_echoing_content() {
+        for content in ["x".repeat(65_537), "PRIVATE_CONTENT\0".into()] {
+            let value = json!({
+                "entry": {
+                    "entryId": KnowledgeSourceId::new(), "kind": "rule", "provider": "codex",
+                    "scope": "project", "sourcePath": "/project/AGENTS.md", "name": "AGENTS.md",
+                    "scopeDirectory": ".", "precedenceHint": "Inventory only", "viaSymlink": false,
+                    "availability": "available",
+                },
+                "content": content,
+            });
+            let error = serde_json::from_value::<KnowledgeReadResponse>(value).unwrap_err();
+            assert!(!error.to_string().contains("PRIVATE_CONTENT"));
+        }
+    }
+
+    #[test]
+    fn discovery_requests_accept_only_opaque_capabilities_and_project_selection() {
+        assert!(
+            serde_json::from_value::<KnowledgeDiscoverRequest>(json!({"path":"/private"})).is_err()
+        );
+        assert!(serde_json::from_value::<KnowledgeReadRequest>(json!({
+            "scanId": KnowledgeScanId::new(), "entryId": KnowledgeSourceId::new(), "path": "/private",
+        })).is_err());
+        assert!(serde_json::from_value::<KnowledgeReadRequest>(json!({
+            "scanId": "00000000-0000-0000-0000-000000000000", "entryId": KnowledgeSourceId::new(),
+        })).is_err());
+    }
+}
diff --git a/crates/core/src/knowledge/mod.rs b/crates/core/src/knowledge/mod.rs
index e093754..a78d61c 100644
--- a/crates/core/src/knowledge/mod.rs
+++ b/crates/core/src/knowledge/mod.rs
@@ -3,6 +3,8 @@
 //! Text crosses the local IPC boundary intentionally, but is excluded from
 //! diagnostic formatting. This module performs no filesystem or process I/O.
 
+pub mod discovery;
+
 use std::{error::Error, fmt, str::FromStr};
 
 use serde::{Deserialize, Deserializer, Serialize, de};
diff --git a/crates/core/src/wire/method.rs b/crates/core/src/wire/method.rs
index dcc4a0b..d213d90 100644
--- a/crates/core/src/wire/method.rs
+++ b/crates/core/src/wire/method.rs
@@ -69,6 +69,10 @@ pub const KNOWLEDGE_LIST: &str = "knowledge.list";
 pub const KNOWLEDGE_SAVE: &str = "knowledge.save";
 /// Delete a saved prompt/context after checking its revision.
 pub const KNOWLEDGE_DELETE: &str = "knowledge.delete";
+/// Inventory known local rule and skill locations without reading content.
+pub const KNOWLEDGE_DISCOVER: &str = "knowledge.discover";
+/// Read a bounded source selected by an expiring discovery capability.
+pub const KNOWLEDGE_READ: &str = "knowledge.read";
 
 /// Every method implemented by the Beta v1 contract.
 pub const ALL: &[&str] = &[
@@ -103,6 +107,8 @@ pub const ALL: &[&str] = &[
     KNOWLEDGE_LIST,
     KNOWLEDGE_SAVE,
     KNOWLEDGE_DELETE,
+    KNOWLEDGE_DISCOVER,
+    KNOWLEDGE_READ,
 ];
 
 /// Returns whether a dotted method belongs to the Beta v1 contract.
diff --git a/crates/core/src/wire/mod.rs b/crates/core/src/wire/mod.rs
index b69af5a..f6d1225 100644
--- a/crates/core/src/wire/mod.rs
+++ b/crates/core/src/wire/mod.rs
@@ -13,6 +13,12 @@ mod request;
 mod response;
 mod value;
 
+pub use crate::knowledge::discovery::{
+    KnowledgeDiscoverRequest, KnowledgeDiscoverResponse, KnowledgeDiscoveryIssue,
+    KnowledgeProvider, KnowledgeReadRequest, KnowledgeReadResponse, KnowledgeScanId,
+    KnowledgeSourceAvailability, KnowledgeSourceEntry, KnowledgeSourceId, KnowledgeSourceKind,
+    KnowledgeSourceScope,
+};
 pub use crate::knowledge::{
     KnowledgeBody, KnowledgeDeleteRequest, KnowledgeEntry, KnowledgeId, KnowledgeKind,
     KnowledgeListRequest, KnowledgeListResponse, KnowledgeSaveRequest, KnowledgeTitle,
diff --git a/crates/core/tests/knowledge_catalog.rs b/crates/core/tests/knowledge_catalog.rs
index b28cd66..b0b5926 100644
--- a/crates/core/tests/knowledge_catalog.rs
+++ b/crates/core/tests/knowledge_catalog.rs
@@ -11,6 +11,8 @@ fn knowledge_operations_share_the_authoritative_catalog() {
         method::KNOWLEDGE_LIST,
         method::KNOWLEDGE_SAVE,
         method::KNOWLEDGE_DELETE,
+        method::KNOWLEDGE_DISCOVER,
+        method::KNOWLEDGE_READ,
     ] {
         assert!(method::is_supported(name));
     }
diff --git a/crates/core/tests/knowledge_discovery_contract.rs b/crates/core/tests/knowledge_discovery_contract.rs
new file mode 100644
index 0000000..fa6217d
--- /dev/null
+++ b/crates/core/tests/knowledge_discovery_contract.rs
@@ -0,0 +1,42 @@
+use cli_master_core::wire::{
+    KnowledgeDiscoverRequest, KnowledgeDiscoverResponse, KnowledgeReadRequest,
+    KnowledgeReadResponse,
+};
+use serde_json::{Value, json};
+
+#[test]
+fn discovery_fixture_preserves_provenance_and_explicit_content() {
+    let fixture: Value = serde_json::from_str(include_str!(
+        "../../../protocol/fixtures/knowledge-discovery.json"
+    ))
+    .unwrap();
+    let scan: KnowledgeDiscoverResponse = serde_json::from_value(fixture["scan"].clone()).unwrap();
+    let read: KnowledgeReadResponse = serde_json::from_value(fixture["read"].clone()).unwrap();
+    assert_eq!(read.entry, scan.entries[0]);
+    assert_eq!(serde_json::to_value(&scan).unwrap(), fixture["scan"]);
+    assert_eq!(serde_json::to_value(&read).unwrap(), fixture["read"]);
+    assert!(!format!("{read:?}").contains("Review the current change."));
+}
+
+#[test]
+fn requests_accept_only_registered_scopes_and_opaque_v7_selectors() {
+    assert!(serde_json::from_value::<KnowledgeDiscoverRequest>(json!({})).is_ok());
+    assert!(serde_json::from_value::<KnowledgeDiscoverRequest>(json!({"projectId":null})).is_ok());
+    assert!(
+        serde_json::from_value::<KnowledgeDiscoverRequest>(json!({"path":"/private"})).is_err()
+    );
+    let scan = "0198b6e0-0000-7000-8000-000000000001";
+    let entry = "0198b6e0-0001-7000-8000-000000000001";
+    assert!(
+        serde_json::from_value::<KnowledgeReadRequest>(json!({"scanId":scan,"entryId":entry}))
+            .is_ok()
+    );
+    for value in [
+        json!({"scanId":scan,"entryId":entry,"path":"/private"}),
+        json!({"scanId":scan,"entryId":"../SKILL.md"}),
+        json!({"scanId":"0198b6e0-0000-4000-8000-000000000001","entryId":entry}),
+        json!({"entryId":entry}),
+    ] {
+        assert!(serde_json::from_value::<KnowledgeReadRequest>(value).is_err());
+    }
+}
diff --git a/crates/daemon/src/knowledge/discovery/mod.rs b/crates/daemon/src/knowledge/discovery/mod.rs
new file mode 100644
index 0000000..ccffd61
--- /dev/null
+++ b/crates/daemon/src/knowledge/discovery/mod.rs
@@ -0,0 +1,707 @@
+//! Bounded inventory and read capabilities for explicitly known rule/skill paths.
+
+mod safe;
+
+#[cfg(test)]
+mod tests;
+
+use std::{
+    collections::{BTreeMap, VecDeque},
+    ffi::OsStr,
+    path::{Path, PathBuf},
+    time::{Duration, Instant},
+};
+
+use cli_master_core::{
+    ApiError, Project, ProjectId,
+    knowledge::discovery::{
+        KnowledgeDiscoverResponse, KnowledgeDiscoveryIssue, KnowledgeProvider,
+        KnowledgeReadRequest, KnowledgeReadResponse, KnowledgeScanId, KnowledgeSourceAvailability,
+        KnowledgeSourceEntry, KnowledgeSourceId, KnowledgeSourceKind, KnowledgeSourceScope,
+    },
+};
+
+use safe::{Directory, DirectoryIdentity, FileFingerprint, SafeError};
+
+const MAX_ENTRIES: usize = 512;
+const MAX_VISITED: usize = 10_000;
+const MAX_DEPTH: usize = 16;
+const MAX_SCANS: usize = 4;
+const SCAN_TTL: Duration = Duration::from_secs(300);
+const MAX_ENTRY_JSON_BYTES: usize = 448 * 1_024;
+const MAX_ISSUE_JSON_BYTES: usize = 32 * 1_024;
+const MAX_ISSUES: usize = 32;
+
+/// Daemon-selected roots; IPC callers cannot override any of these paths.
+#[derive(Clone, Debug)]
+pub(crate) struct DiscoveryRoots {
+    pub(crate) home: Option<PathBuf>,
+    pub(crate) codex_home: Option<PathBuf>,
+    pub(crate) admin_skills: PathBuf,
+}
+
+impl DiscoveryRoots {
+    /// Captures the owner's global roots once without reading configuration files.
+    pub(crate) fn from_environment() -> Self {
+        let absolute = |key: &str| {
+            std::env::var_os(key)
+                .map(PathBuf::from)
+                .filter(|path| path.is_absolute())
+        };
+        Self {
+            home: absolute("HOME"),
+            codex_home: absolute("CODEX_HOME"),
+            admin_skills: PathBuf::from("/etc/codex/skills"),
+        }
+    }
+}
+
+/// Expiring read-only capabilities, synchronized by the existing daemon owner.
+pub(crate) struct DiscoveryService {
+    roots: DiscoveryRoots,
+    scans: VecDeque<StoredScan>,
+}
+
+struct StoredScan {
+    id: KnowledgeScanId,
+    project_id: Option<ProjectId>,
+    created: Instant,
+    entries: BTreeMap<KnowledgeSourceId, StoredSource>,
+}
+
+struct StoredSource {
+    entry: KnowledgeSourceEntry,
+    parent_path: PathBuf,
+    parent_identity: DirectoryIdentity,
+    leaf: std::ffi::OsString,
+    fingerprint: Option<FileFingerprint>,
+}
+
+impl DiscoveryService {
+    pub(crate) fn new(roots: DiscoveryRoots) -> Self {
+        Self {
+            roots,
+            scans: VecDeque::new(),
+        }
+    }
+
+    /// Inventories known globals and project-root locations, without reading text.
+    pub(crate) fn discover(
+        &mut self,
+        project: Option<&Project>,
+    ) -> Result<KnowledgeDiscoverResponse, ApiError> {
+        if project.is_some_and(|project| !project.path.is_absolute()) {
+            return Err(ApiError::new(
+                "invalid_project_path",
+                "The registered project must have an absolute path.",
+            ));
+        }
+        let scan_id = KnowledgeScanId::new();
+        let mut scanner = Scanner::new(scan_id);
+        scanner.issue("activation_not_evaluated", None,
+            "Discovery reports known source locations, not whether a native CLI loaded them. Imports, config overrides, frontmatter activation and plugins are not evaluated.");
+        if project.is_some() {
+            scanner.issue("project_root_scope", None,
+                "This inventory covers the registered project root. Rules or skills from a session's other working-directory ancestors are not evaluated.");
+        }
+        for spec in source_specs(&self.roots, project) {
+            if scanner.full() || scanner.remaining_nodes == 0 {
+                break;
+            }
+            scanner.scan_source(&spec);
+        }
+        let now = Instant::now();
+        self.scans
+            .retain(|scan| now.duration_since(scan.created) < SCAN_TTL);
+        while self.scans.len() >= MAX_SCANS {
+            self.scans.pop_front();
+        }
+        self.scans.push_back(StoredScan {
+            id: scan_id,
+            project_id: project.map(|project| project.id),
+            created: now,
+            entries: scanner.saved,
+        });
+        Ok(scanner.response)
+    }
+
+    /// Lets the dispatcher revalidate registered project ownership before reading.
+    pub(crate) fn scan_project_id(
+        &self,
+        scan_id: KnowledgeScanId,
+    ) -> Result<Option<ProjectId>, ApiError> {
+        Ok(self.scan(scan_id)?.project_id)
+    }
+
+    /// Reopens only a cached descriptor path and revalidates its root and file identity.
+    /// Retargeting a skill-directory alias does not change this scan's captured
+    /// target. A new discovery is required to capture the replacement target.
+    pub(crate) fn read(
+        &self,
+        request: &KnowledgeReadRequest,
+    ) -> Result<KnowledgeReadResponse, ApiError> {
+        let scan = self.scan(request.scan_id)?;
+        let source = scan.entries.get(&request.entry_id).ok_or_else(|| {
+            ApiError::new(
+                "knowledge_entry_not_found",
+                "The source does not belong to this scan.",
+            )
+        })?;
+        let fingerprint = source
+            .fingerprint
+            .as_ref()
+            .ok_or_else(|| unavailable(source.entry.availability))?;
+        let (directory, _) =
+            Directory::open_absolute(&source.parent_path, false).map_err(read_error)?;
+        if directory.identity != source.parent_identity {
+            return Err(read_error(SafeError::Changed));
+        }
+        let content = directory
+            .read_candidate(&source.leaf, fingerprint)
+            .map_err(read_error)?;
+        Ok(KnowledgeReadResponse {
+            entry: source.entry.clone(),
+            content,
+        })
+    }
+
+    fn scan(&self, id: KnowledgeScanId) -> Result<&StoredScan, ApiError> {
+        self.scans
+            .iter()
+            .find(|scan| scan.id == id && scan.created.elapsed() < SCAN_TTL)
+            .ok_or_else(|| {
+                ApiError::new(
+                    "knowledge_scan_expired",
+                    "This source inventory expired. Refresh discovery and select the source again.",
+                )
+            })
+    }
+}
+
+fn unavailable(availability: KnowledgeSourceAvailability) -> ApiError {
+    let (code, message) = match availability {
+        KnowledgeSourceAvailability::TooLarge => (
+            "knowledge_source_too_large",
+            "The source exceeds the 64 KiB read limit.",
+        ),
+        KnowledgeSourceAvailability::Symlink => (
+            "knowledge_source_symlink",
+            "Rule and SKILL.md leaf symlinks are not followed.",
+        ),
+        KnowledgeSourceAvailability::NonRegular => (
+            "knowledge_source_non_regular",
+            "The source is not a regular file.",
+        ),
+        KnowledgeSourceAvailability::Unreadable | KnowledgeSourceAvailability::Available => (
+            "knowledge_source_unavailable",
+            "The source could not be opened safely.",
+        ),
+    };
+    ApiError::new(code, message)
+}
+
+fn read_error(error: SafeError) -> ApiError {
+    match error {
+        SafeError::Missing | SafeError::Changed | SafeError::Symlink | SafeError::NonRegular => {
+            ApiError::new(
+                "knowledge_source_changed",
+                "The source changed since discovery. Refresh before reading it.",
+            )
+        }
+        SafeError::TooLarge => unavailable(KnowledgeSourceAvailability::TooLarge),
+        SafeError::InvalidText => ApiError::new(
+            "knowledge_source_invalid_text",
+            "The source is not NUL-free UTF-8 text.",
+        ),
+        SafeError::Unreadable | SafeError::Limit => {
+            unavailable(KnowledgeSourceAvailability::Unreadable)
+        }
+    }
+}
+
+#[derive(Clone, Copy)]
+enum Shape {
+    Exact(&'static str),
+    Rules(&'static str),
+    Skills { recursive: bool },
+}
+
+struct SourceSpec {
+    base: PathBuf,
+    directory: &'static str,
+    provider: KnowledgeProvider,
+    scope: KnowledgeSourceScope,
+    shape: Shape,
+}
+
+impl SourceSpec {
+    fn kind(&self) -> KnowledgeSourceKind {
+        match self.shape {
+            Shape::Skills { .. } => KnowledgeSourceKind::Skill,
+            _ => KnowledgeSourceKind::Rule,
+        }
+    }
+
+    fn precedence(&self) -> &'static str {
+        match (self.provider, self.shape) {
+            (KnowledgeProvider::Codex, Shape::Skills { .. }) => {
+                "Codex keeps same-named skills from different scopes distinct; discovery does not select one."
+            }
+            (KnowledgeProvider::Codex, _) => {
+                "Codex prefers AGENTS.override.md over AGENTS.md within a directory; working-directory ancestry and load limits remain native CLI policy."
+            }
+            (KnowledgeProvider::Claude, Shape::Skills { .. }) => {
+                "Claude personal skills take precedence over same-named project skills; filesystem names here are not parsed skill identifiers."
+            }
+            (KnowledgeProvider::Claude, _) => {
+                "Claude combines applicable memory and rules; imports, rule path conditions and managed policy are not evaluated here."
+            }
+            (KnowledgeProvider::Cursor, Shape::Exact(_)) => {
+                "Cursor recognizes AGENTS.md instructions; working-directory scope and rule activation remain native CLI policy."
+            }
+            (KnowledgeProvider::Cursor, _) => {
+                "Cursor activation, frontmatter and duplicate precedence remain native CLI policy; this is an inventory only."
+            }
+        }
+    }
+}
+
+fn source_specs(roots: &DiscoveryRoots, project: Option<&Project>) -> Vec<SourceSpec> {
+    use KnowledgeProvider::{Claude, Codex, Cursor};
+    use KnowledgeSourceScope::{Admin, Global, Project as ProjectScope};
+    let mut specs = Vec::new();
+    let codex_home = roots
+        .codex_home
+        .clone()
+        .or_else(|| roots.home.as_ref().map(|home| home.join(".codex")));
+    if let Some(base) = codex_home {
+        for leaf in ["AGENTS.override.md", "AGENTS.md"] {
+            specs.push(SourceSpec {
+                base: base.clone(),
+                directory: "",
+                provider: Codex,
+                scope: Global,
+                shape: Shape::Exact(leaf),
+            });
+        }
+    }
+    if let Some(home) = &roots.home {
+        specs.push(SourceSpec {
+            base: home.clone(),
+            directory: ".claude",
+            provider: Claude,
+            scope: Global,
+            shape: Shape::Exact("CLAUDE.md"),
+        });
+        specs.push(SourceSpec {
+            base: home.clone(),
+            directory: ".claude/rules",
+            provider: Claude,
+            scope: Global,
+            shape: Shape::Rules("md"),
+        });
+        add_skills(&mut specs, home, Global);
+    }
+    specs.push(SourceSpec {
+        base: roots.admin_skills.clone(),
+        directory: "",
+        provider: Codex,
+        scope: Admin,
+        shape: Shape::Skills { recursive: false },
+    });
+    if let Some(project) = project {
+        for leaf in ["AGENTS.override.md", "AGENTS.md"] {
+            specs.push(SourceSpec {
+                base: project.path.clone(),
+                directory: "",
+                provider: Codex,
+                scope: ProjectScope,
+                shape: Shape::Exact(leaf),
+            });
+        }
+        for (directory, leaf) in [
+            ("", "CLAUDE.md"),
+            (".claude", "CLAUDE.md"),
+            ("", "CLAUDE.local.md"),
+        ] {
+            specs.push(SourceSpec {
+                base: project.path.clone(),
+                directory,
+                provider: Claude,
+                scope: ProjectScope,
+                shape: Shape::Exact(leaf),
+            });
+        }
+        specs.push(SourceSpec {
+            base: project.path.clone(),
+            directory: ".claude/rules",
+            provider: Claude,
+            scope: ProjectScope,
+            shape: Shape::Rules("md"),
+        });
+        specs.push(SourceSpec {
+            base: project.path.clone(),
+            directory: ".cursor/rules",
+            provider: Cursor,
+            scope: ProjectScope,
+            shape: Shape::Rules("mdc"),
+        });
+        specs.push(SourceSpec {
+            base: project.path.clone(),
+            directory: "",
+            provider: Cursor,
+            scope: ProjectScope,
+            shape: Shape::Exact("AGENTS.md"),
+        });
+        add_skills(&mut specs, &project.path, ProjectScope);
+    }
+    specs.sort_by_key(|spec| match spec.scope {
+        ProjectScope => 0,
+        Global => 1,
+        Admin => 2,
+    });
+    specs
+}
+
+fn add_skills(specs: &mut Vec<SourceSpec>, base: &Path, scope: KnowledgeSourceScope) {
+    for (provider, directory, recursive) in [
+        (KnowledgeProvider::Codex, ".agents/skills", false),
+        (KnowledgeProvider::Claude, ".claude/skills", false),
+        (KnowledgeProvider::Cursor, ".cursor/skills", true),
+        (KnowledgeProvider::Cursor, ".agents/skills", true),
+    ] {
+        specs.push(SourceSpec {
+            base: base.to_path_buf(),
+            directory,
+            provider,
+            scope,
+            shape: Shape::Skills { recursive },
+        });
+    }
+}
+
+struct Scanner {
+    response: KnowledgeDiscoverResponse,
+    saved: BTreeMap<KnowledgeSourceId, StoredSource>,
+    remaining_nodes: usize,
+    entry_bytes: usize,
+    issue_bytes: usize,
+}
+
+impl Scanner {
+    fn new(scan_id: KnowledgeScanId) -> Self {
+        Self {
+            response: KnowledgeDiscoverResponse {
+                scan_id,
+                entries: Vec::new(),
+                truncated: false,
+                issues: Vec::new(),
+            },
+            saved: BTreeMap::new(),
+            remaining_nodes: MAX_VISITED,
+            entry_bytes: 0,
+            issue_bytes: 0,
+        }
+    }
+
+    fn full(&mut self) -> bool {
+        if self.response.entries.len() >= MAX_ENTRIES || self.entry_bytes >= MAX_ENTRY_JSON_BYTES {
+            self.response.truncated = true;
+            true
+        } else {
+            false
+        }
+    }
+
+    fn issue(&mut self, code: &'static str, path: Option<&Path>, message: &'static str) {
+        let issue = KnowledgeDiscoveryIssue {
+            code: code.to_owned(),
+            source_path: path.and_then(Path::to_str).map(str::to_owned),
+            message: message.to_owned(),
+        };
+        let bytes =
+            serde_json::to_vec(&issue).map_or(MAX_ISSUE_JSON_BYTES, |value| value.len() + 1);
+        if self.response.issues.len() < MAX_ISSUES
+            && self.issue_bytes + bytes <= MAX_ISSUE_JSON_BYTES
+        {
+            self.issue_bytes += bytes;
+            self.response.issues.push(issue);
+        } else {
+            self.response.truncated = true;
+        }
+    }
+
+    fn scan_source(&mut self, spec: &SourceSpec) {
+        let logical = spec.base.join(spec.directory);
+        let (mut directory, _) = match Directory::open_absolute(&spec.base, true) {
+            Ok(value) => value,
+            Err(SafeError::Missing) => return,
+            Err(_) => {
+                self.issue(
+                    "source_unavailable",
+                    Some(&logical),
+                    "The configured source directory could not be opened safely.",
+                );
+                return;
+            }
+        };
+        let mut linked = false;
+        for component in Path::new(spec.directory).components() {
+            match directory.open_child(
+                component.as_os_str(),
+                spec.kind() == KnowledgeSourceKind::Skill,
+            ) {
+                Ok((child, via_link)) => {
+                    directory = child;
+                    linked |= via_link;
+                }
+                Err(SafeError::Missing) => return,
+                Err(_) => {
+                    self.issue("directory_unavailable", Some(&logical), "The source directory is unavailable; directory symlinks are supported only for known skill roots.");
+                    return;
+                }
+            }
+        }
+        match spec.shape {
+            Shape::Exact(leaf) => self.add_candidate(
+                &directory,
+                OsStr::new(leaf),
+                spec,
+                &logical.join(leaf),
+                linked,
+            ),
+            Shape::Rules(extension) => {
+                self.walk_rules(&directory, spec, &logical, extension, 0, linked);
+            }
+            Shape::Skills { recursive } => {
+                self.walk_skills(&directory, spec, &logical, recursive, 0, linked, &[]);
+            }
+        }
+    }
+
+    fn names(&mut self, directory: &Directory, logical: &Path) -> Vec<std::ffi::OsString> {
+        if let Ok(names) = directory.entry_names(&mut self.remaining_nodes) {
+            if self.remaining_nodes == 0 {
+                self.response.truncated = true;
+                self.issue(
+                    "scan_limit",
+                    Some(logical),
+                    "The filesystem-entry scan limit was reached.",
+                );
+            }
+            names
+        } else {
+            self.issue(
+                "directory_unavailable",
+                Some(logical),
+                "The source directory could not be enumerated safely.",
+            );
+            Vec::new()
+        }
+    }
+
+    fn walk_rules(
+        &mut self,
+        directory: &Directory,
+        spec: &SourceSpec,
+        logical: &Path,
+        extension: &str,
+        depth: usize,
+        linked: bool,
+    ) {
+        for name in self.names(directory, logical) {
+            if self.full() {
+                break;
+            }
+            if name == OsStr::new(".git") {
+                continue;
+            }
+            let path = logical.join(&name);
+            match directory.open_child(&name, false) {
+                Ok((child, _)) => {
+                    if self.remaining_nodes == 0 {
+                        continue;
+                    }
+                    if depth >= MAX_DEPTH {
+                        self.response.truncated = true;
+                        self.issue(
+                            "depth_limit",
+                            Some(&path),
+                            "The rule-directory depth limit was reached.",
+                        );
+                    } else {
+                        self.walk_rules(&child, spec, &path, extension, depth + 1, linked);
+                    }
+                }
+                Err(_) if Path::new(&name).extension() == Some(OsStr::new(extension)) => {
+                    self.add_candidate(directory, &name, spec, &path, linked);
+                }
+                Err(SafeError::Symlink) => self.issue(
+                    "directory_symlink_skipped",
+                    Some(&path),
+                    "Rule-directory symlinks are not followed.",
+                ),
+                Err(_) => (),
+            }
+        }
+    }
+
+    #[allow(
+        clippy::too_many_arguments,
+        reason = "bounded traversal carries source provenance and the ancestor cycle guard"
+    )]
+    fn walk_skills(
+        &mut self,
+        directory: &Directory,
+        spec: &SourceSpec,
+        logical: &Path,
+        recursive: bool,
+        depth: usize,
+        linked: bool,
+        ancestors: &[DirectoryIdentity],
+    ) {
+        let mut ancestors = ancestors.to_vec();
+        ancestors.push(directory.identity.clone());
+        for name in self.names(directory, logical) {
+            if self.full() {
+                break;
+            }
+            if name == OsStr::new(".git") {
+                continue;
+            }
+            let path = logical.join(&name);
+            match directory.open_child(&name, true) {
+                Ok((child, via_link)) => {
+                    if ancestors.contains(&child.identity) {
+                        self.issue(
+                            "symlink_cycle",
+                            Some(&path),
+                            "A skill-directory cycle was skipped.",
+                        );
+                        continue;
+                    }
+                    self.add_candidate(
+                        &child,
+                        OsStr::new("SKILL.md"),
+                        spec,
+                        &path.join("SKILL.md"),
+                        linked || via_link,
+                    );
+                    if recursive && self.remaining_nodes > 0 {
+                        if depth >= MAX_DEPTH {
+                            self.response.truncated = true;
+                            self.issue(
+                                "depth_limit",
+                                Some(&path),
+                                "The skill-directory depth limit was reached.",
+                            );
+                        } else {
+                            self.walk_skills(
+                                &child,
+                                spec,
+                                &path,
+                                true,
+                                depth + 1,
+                                linked || via_link,
+                                &ancestors,
+                            );
+                        }
+                    }
+                }
+                Err(SafeError::NonRegular | SafeError::Missing) => (),
+                Err(_) => self.issue(
+                    "skill_directory_unavailable",
+                    Some(&path),
+                    "The skill directory or its bounded symlink target could not be opened safely.",
+                ),
+            }
+        }
+    }
+
+    fn add_candidate(
+        &mut self,
+        directory: &Directory,
+        leaf: &OsStr,
+        spec: &SourceSpec,
+        source_path: &Path,
+        linked: bool,
+    ) {
+        if self.full() {
+            return;
+        }
+        let Some(path) = source_path.to_str() else {
+            self.issue("non_utf8_path", None, "A source with a non-UTF-8 path was skipped; path bytes were not converted lossily.");
+            return;
+        };
+        let candidate = match directory.candidate(leaf) {
+            Ok(candidate) => candidate,
+            Err(SafeError::Missing) => return,
+            Err(_) => {
+                self.issue(
+                    "source_unavailable",
+                    Some(source_path),
+                    "Source metadata could not be read safely.",
+                );
+                return;
+            }
+        };
+        let name = if spec.kind() == KnowledgeSourceKind::Skill {
+            source_path
+                .parent()
+                .and_then(Path::file_name)
+                .and_then(OsStr::to_str)
+                .unwrap_or("SKILL.md")
+        } else {
+            leaf.to_str().unwrap_or("rule")
+        };
+        let entry = KnowledgeSourceEntry {
+            entry_id: KnowledgeSourceId::new(),
+            kind: spec.kind(),
+            provider: spec.provider,
+            scope: spec.scope,
+            source_path: path.to_owned(),
+            name: name.to_owned(),
+            scope_directory: if spec.scope == KnowledgeSourceScope::Project {
+                ".".to_owned()
+            } else {
+                String::new()
+            },
+            precedence_hint: spec.precedence().to_owned(),
+            via_symlink: linked,
+            availability: candidate.availability,
+        };
+        let bytes =
+            serde_json::to_vec(&entry).map_or(MAX_ENTRY_JSON_BYTES, |value| value.len() + 1);
+        if self.entry_bytes + bytes > MAX_ENTRY_JSON_BYTES {
+            self.response.truncated = true;
+            self.entry_bytes = MAX_ENTRY_JSON_BYTES;
+            self.issue(
+                "response_limit",
+                None,
+                "The bounded source-inventory response limit was reached.",
+            );
+            return;
+        }
+        self.entry_bytes += bytes;
+        if linked
+            && !self
+                .response
+                .issues
+                .iter()
+                .any(|issue| issue.code == "captured_skill_target")
+        {
+            self.issue("captured_skill_target", None, "Skill-directory targets are captured for this scan. Refresh discovery to follow a retargeted directory symlink.");
+        }
+        self.saved.insert(
+            entry.entry_id,
+            StoredSource {
+                entry: entry.clone(),
+                parent_path: directory.path.clone(),
+                parent_identity: directory.identity.clone(),
+                leaf: leaf.to_os_string(),
+                fingerprint: candidate.fingerprint,
+            },
+        );
+        self.response.entries.push(entry);
+    }
+}
diff --git a/crates/daemon/src/knowledge/discovery/safe.rs b/crates/daemon/src/knowledge/discovery/safe.rs
new file mode 100644
index 0000000..0f61bff
--- /dev/null
+++ b/crates/daemon/src/knowledge/discovery/safe.rs
@@ -0,0 +1,655 @@
+//! Descriptor-relative, read-only access to approved discovery locations.
+
+use std::collections::VecDeque;
+use std::ffi::{OsStr, OsString};
+use std::fs::File;
+use std::io::{self, Read};
+use std::os::unix::ffi::{OsStrExt, OsStringExt};
+use std::os::unix::fs::MetadataExt;
+use std::path::{Component, Path, PathBuf};
+
+use cli_master_core::knowledge::MAX_KNOWLEDGE_BODY_BYTES;
+use cli_master_core::knowledge::discovery::KnowledgeSourceAvailability;
+use rustix::fs::{self, AtFlags, FileType, Mode, OFlags, Stat};
+use rustix::io::Errno;
+
+const MAX_PATH_BYTES: usize = 4_096;
+const MAX_SYMLINK_HOPS: usize = 16;
+const MAX_DIRECTORY_STEPS: usize = 4_096;
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub(super) enum SafeError {
+    Missing,
+    Unreadable,
+    Symlink,
+    NonRegular,
+    TooLarge,
+    InvalidText,
+    Changed,
+    Limit,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub(super) struct DirectoryIdentity {
+    device: u64,
+    inode: u64,
+}
+
+pub(super) struct Directory {
+    pub(super) file: File,
+    pub(super) path: PathBuf,
+    pub(super) identity: DirectoryIdentity,
+}
+
+/// Native precision is retained: millisecond timestamps miss rapid edits.
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub(super) struct FileFingerprint {
+    device: i128,
+    inode: i128,
+    size: i128,
+    modified_seconds: i128,
+    modified_nanos: i128,
+    changed_seconds: i128,
+    changed_nanos: i128,
+}
+
+impl FileFingerprint {
+    fn from_stat(stat: &Stat) -> Self {
+        // rustix's stat integer widths/signedness differ on Linux and macOS.
+        Self {
+            device: i128::from(stat.st_dev),
+            inode: i128::from(stat.st_ino),
+            size: i128::from(stat.st_size),
+            modified_seconds: i128::from(stat.st_mtime),
+            modified_nanos: i128::from(stat.st_mtime_nsec),
+            changed_seconds: i128::from(stat.st_ctime),
+            changed_nanos: i128::from(stat.st_ctime_nsec),
+        }
+    }
+}
+
+pub(super) struct Candidate {
+    pub(super) availability: KnowledgeSourceAvailability,
+    pub(super) fingerprint: Option<FileFingerprint>,
+}
+
+impl Candidate {
+    fn unavailable(availability: KnowledgeSourceAvailability) -> Self {
+        Self {
+            availability,
+            fingerprint: None,
+        }
+    }
+}
+
+impl Directory {
+    pub(super) fn open_absolute(
+        path: &Path,
+        follow_directory_symlinks: bool,
+    ) -> Result<(Self, bool), SafeError> {
+        if !path.is_absolute() {
+            return Err(SafeError::Unreadable);
+        }
+        check_path(path)?;
+        walk_directories(
+            root_directory()?,
+            components(path),
+            follow_directory_symlinks,
+        )
+    }
+
+    pub(super) fn open_child(
+        &self,
+        name: &OsStr,
+        allow_symlink: bool,
+    ) -> Result<(Self, bool), SafeError> {
+        check_name(name)?;
+        let fd =
+            fs::openat(&self.file, ".", directory_flags(), Mode::empty()).map_err(map_errno)?;
+        let directory = Self::from_file(File::from(fd), self.path.clone())?;
+        if directory.identity != self.identity {
+            return Err(SafeError::Changed);
+        }
+        walk_directories(directory, VecDeque::from([name.to_owned()]), allow_symlink)
+    }
+
+    /// The caller marks the scan truncated when its shared budget reaches zero.
+    pub(super) fn entry_names(&self, remaining: &mut usize) -> Result<Vec<OsString>, SafeError> {
+        let mut names = Vec::new();
+        if *remaining == 0 {
+            return Ok(names);
+        }
+        let entries = fs::Dir::read_from(&self.file).map_err(map_errno)?;
+        for entry in entries {
+            let entry = entry.map_err(map_errno)?;
+            let bytes = entry.file_name().to_bytes();
+            if bytes == b"." || bytes == b".." {
+                continue;
+            }
+            *remaining -= 1;
+            names.push(OsString::from_vec(bytes.to_vec()));
+            if *remaining == 0 {
+                break;
+            }
+        }
+        names.sort_unstable();
+        Ok(names)
+    }
+
+    pub(super) fn candidate(&self, name: &OsStr) -> Result<Candidate, SafeError> {
+        check_name(name)?;
+        let before = match self.leaf_stat(name) {
+            Ok(stat) => stat,
+            Err(SafeError::Unreadable) => {
+                return Ok(Candidate::unavailable(
+                    KnowledgeSourceAvailability::Unreadable,
+                ));
+            }
+            Err(error) => return Err(error),
+        };
+        if let Err(error) = regular_bounded(&before) {
+            let availability = match error {
+                SafeError::Symlink => KnowledgeSourceAvailability::Symlink,
+                SafeError::NonRegular => KnowledgeSourceAvailability::NonRegular,
+                SafeError::TooLarge => KnowledgeSourceAvailability::TooLarge,
+                _ => KnowledgeSourceAvailability::Unreadable,
+            };
+            return Ok(Candidate::unavailable(availability));
+        }
+        let fingerprint = FileFingerprint::from_stat(&before);
+        let file = match self.open_leaf(name) {
+            Ok(file) => file,
+            Err(SafeError::Unreadable) => {
+                return Ok(Candidate::unavailable(
+                    KnowledgeSourceAvailability::Unreadable,
+                ));
+            }
+            Err(error) => return Err(error),
+        };
+        verify_file(&file, &fingerprint)?;
+        self.verify_leaf(name, &fingerprint)?;
+        Ok(Candidate {
+            availability: KnowledgeSourceAvailability::Available,
+            fingerprint: Some(fingerprint),
+        })
+    }
+
+    pub(super) fn read_candidate(
+        &self,
+        name: &OsStr,
+        fingerprint: &FileFingerprint,
+    ) -> Result<String, SafeError> {
+        check_name(name)?;
+        self.verify_leaf(name, fingerprint)?;
+        let file = self.open_leaf(name)?;
+        verify_file(&file, fingerprint)?;
+        let limit = u64::try_from(MAX_KNOWLEDGE_BODY_BYTES).map_err(|_| SafeError::Limit)?;
+        let mut bytes = Vec::new();
+        (&file)
+            .take(limit + 1)
+            .read_to_end(&mut bytes)
+            .map_err(|error| map_io_error(&error))?;
+        if bytes.len() > MAX_KNOWLEDGE_BODY_BYTES {
+            return Err(SafeError::TooLarge);
+        }
+        verify_file(&file, fingerprint)?;
+        self.verify_leaf(name, fingerprint)?;
+        if bytes.contains(&0) {
+            return Err(SafeError::InvalidText);
+        }
+        String::from_utf8(bytes).map_err(|_| SafeError::InvalidText)
+    }
+
+    fn from_file(file: File, path: PathBuf) -> Result<Self, SafeError> {
+        let metadata = file.metadata().map_err(|error| map_io_error(&error))?;
+        if !metadata.is_dir() {
+            return Err(SafeError::NonRegular);
+        }
+        Ok(Self {
+            identity: DirectoryIdentity {
+                device: metadata.dev(),
+                inode: metadata.ino(),
+            },
+            file,
+            path,
+        })
+    }
+
+    fn leaf_stat(&self, name: &OsStr) -> Result<Stat, SafeError> {
+        fs::statat(&self.file, name, AtFlags::SYMLINK_NOFOLLOW).map_err(map_errno)
+    }
+
+    fn verify_leaf(&self, name: &OsStr, expected: &FileFingerprint) -> Result<(), SafeError> {
+        let stat = self.leaf_stat(name)?;
+        regular_bounded(&stat)?;
+        if FileFingerprint::from_stat(&stat) != *expected {
+            return Err(SafeError::Changed);
+        }
+        Ok(())
+    }
+
+    fn open_leaf(&self, name: &OsStr) -> Result<File, SafeError> {
+        // NONBLOCK prevents a raced FIFO from waiting for a writer; NOCTTY
+        // prevents a raced terminal device from becoming our controlling tty.
+        fs::openat(
+            &self.file,
+            name,
+            OFlags::RDONLY | OFlags::CLOEXEC | OFlags::NOFOLLOW | OFlags::NONBLOCK | OFlags::NOCTTY,
+            Mode::empty(),
+        )
+        .map(File::from)
+        .map_err(map_errno)
+    }
+}
+
+fn directory_flags() -> OFlags {
+    OFlags::RDONLY | OFlags::DIRECTORY | OFlags::NOFOLLOW | OFlags::CLOEXEC
+}
+
+fn root_directory() -> Result<Directory, SafeError> {
+    let fd = fs::open("/", directory_flags(), Mode::empty()).map_err(map_errno)?;
+    Directory::from_file(File::from(fd), PathBuf::from("/"))
+}
+
+fn components(path: &Path) -> VecDeque<OsString> {
+    path.components()
+        .filter(|part| *part != Component::CurDir)
+        .map(|part| part.as_os_str().to_owned())
+        .collect()
+}
+
+fn walk_directories(
+    mut directory: Directory,
+    mut pending: VecDeque<OsString>,
+    allow_symlinks: bool,
+) -> Result<(Directory, bool), SafeError> {
+    let mut hops = 0;
+    let mut steps = 0;
+    while let Some(name) = pending.pop_front() {
+        steps += 1;
+        if steps > MAX_DIRECTORY_STEPS {
+            return Err(SafeError::Limit);
+        }
+        if name == OsStr::new("/") {
+            directory = root_directory()?;
+            continue;
+        }
+        let before = directory.leaf_stat(&name)?;
+        if FileType::from_raw_mode(before.st_mode) == FileType::Symlink {
+            if !allow_symlinks {
+                return Err(SafeError::Symlink);
+            }
+            hops += 1;
+            if hops > MAX_SYMLINK_HOPS {
+                return Err(SafeError::Limit);
+            }
+            let target = capture_link(&directory.file, &name, &before)?;
+            let mut expanded = components(&target);
+            expanded.append(&mut pending);
+            if expanded
+                .iter()
+                .map(|part| part.as_bytes().len() + 1)
+                .sum::<usize>()
+                > MAX_PATH_BYTES
+            {
+                return Err(SafeError::Limit);
+            }
+            pending = expanded;
+            continue;
+        }
+        if FileType::from_raw_mode(before.st_mode) != FileType::Directory {
+            return Err(SafeError::NonRegular);
+        }
+        let fd = fs::openat(&directory.file, &name, directory_flags(), Mode::empty())
+            .map_err(map_errno)?;
+        let opened = fs::fstat(&fd).map_err(map_errno)?;
+        if before.st_dev != opened.st_dev || before.st_ino != opened.st_ino {
+            return Err(SafeError::Changed);
+        }
+        let mut path = directory.path.clone();
+        if name == OsStr::new("..") {
+            path.pop();
+        } else {
+            path.push(name);
+        }
+        check_path(&path)?;
+        directory = Directory::from_file(File::from(fd), path)?;
+    }
+    Ok((directory, hops > 0))
+}
+
+fn capture_link(parent: &File, name: &OsStr, before: &Stat) -> Result<PathBuf, SafeError> {
+    let mut buffer = [0_u8; MAX_PATH_BYTES];
+    let count = fs::readlinkat_raw(parent, name, &mut buffer[..]).map_err(map_errno)?;
+    // readlinkat_raw silently truncates and never appends a NUL terminator.
+    if count == 0 || count == buffer.len() {
+        return Err(SafeError::Limit);
+    }
+    let after = fs::statat(parent, name, AtFlags::SYMLINK_NOFOLLOW).map_err(map_errno)?;
+    if FileType::from_raw_mode(after.st_mode) != FileType::Symlink
+        || FileFingerprint::from_stat(before) != FileFingerprint::from_stat(&after)
+    {
+        return Err(SafeError::Changed);
+    }
+    let target = PathBuf::from(OsString::from_vec(buffer[..count].to_vec()));
+    check_path(&target)?;
+    Ok(target)
+}
+
+fn regular_bounded(stat: &Stat) -> Result<(), SafeError> {
+    match FileType::from_raw_mode(stat.st_mode) {
+        FileType::Symlink => return Err(SafeError::Symlink),
+        FileType::RegularFile => {}
+        _ => return Err(SafeError::NonRegular),
+    }
+    let size = usize::try_from(stat.st_size).map_err(|_| SafeError::TooLarge)?;
+    if size > MAX_KNOWLEDGE_BODY_BYTES {
+        return Err(SafeError::TooLarge);
+    }
+    Ok(())
+}
+
+fn verify_file(file: &File, expected: &FileFingerprint) -> Result<(), SafeError> {
+    let stat = fs::fstat(file).map_err(map_errno)?;
+    regular_bounded(&stat)?;
+    if FileFingerprint::from_stat(&stat) != *expected {
+        return Err(SafeError::Changed);
+    }
+    Ok(())
+}
+
+fn check_name(name: &OsStr) -> Result<(), SafeError> {
+    let mut parts = Path::new(name).components();
+    if !matches!(parts.next(), Some(Component::Normal(_)))
+        || parts.next().is_some()
+        || name.as_bytes().contains(&b'/')
+        || name.as_bytes().contains(&0)
+    {
+        return Err(SafeError::Unreadable);
+    }
+    check_path(Path::new(name))
+}
+
+fn check_path(path: &Path) -> Result<(), SafeError> {
+    let bytes = path.as_os_str().as_bytes();
+    if bytes.len() > MAX_PATH_BYTES {
+        return Err(SafeError::Limit);
+    }
+    if bytes.is_empty() || bytes.contains(&0) {
+        return Err(SafeError::Unreadable);
+    }
+    Ok(())
+}
+
+fn map_errno(error: Errno) -> SafeError {
+    match error {
+        Errno::NOENT => SafeError::Missing,
+        Errno::LOOP => SafeError::Symlink,
+        Errno::NOTDIR => SafeError::NonRegular,
+        Errno::NAMETOOLONG | Errno::MFILE | Errno::NFILE => SafeError::Limit,
+        _ => SafeError::Unreadable,
+    }
+}
+
+fn map_io_error(error: &io::Error) -> SafeError {
+    match error.kind() {
+        io::ErrorKind::NotFound => SafeError::Missing,
+        _ => SafeError::Unreadable,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::fs;
+    use std::os::unix::fs::symlink;
+
+    fn directory(path: &Path) -> Directory {
+        Directory::open_absolute(path, true)
+            .expect("open test directory")
+            .0
+    }
+
+    fn fingerprint(directory: &Directory, name: &str) -> FileFingerprint {
+        directory
+            .candidate(OsStr::new(name))
+            .expect("candidate")
+            .fingerprint
+            .expect("readable file")
+    }
+
+    #[test]
+    fn regular_document_roundtrip_and_unchanged_reads() {
+        let temp = tempfile::tempdir().expect("tempdir");
+        fs::write(temp.path().join("SKILL.md"), "# Skill\nOlá").expect("write");
+        let directory = directory(temp.path());
+        let fingerprint = fingerprint(&directory, "SKILL.md");
+        for _ in 0..2 {
+            assert_eq!(
+                directory.read_candidate(OsStr::new("SKILL.md"), &fingerprint),
+                Ok("# Skill\nOlá".into())
+            );
+        }
+    }
+
+    #[test]
+    fn symlinked_directories_resolve_relative_absolute_and_parent_components() {
+        let temp = tempfile::tempdir().expect("tempdir");
+        fs::create_dir_all(temp.path().join("targets/skill")).expect("target");
+        fs::create_dir(temp.path().join("links")).expect("links");
+        symlink("../targets/skill", temp.path().join("links/relative")).expect("relative");
+        symlink(
+            temp.path().join("links/relative"),
+            temp.path().join("absolute"),
+        )
+        .expect("absolute");
+        let root = directory(temp.path());
+        let (resolved, linked) = root
+            .open_child(OsStr::new("absolute"), true)
+            .expect("resolve");
+        assert!(linked);
+        assert_eq!(
+            resolved.path,
+            fs::canonicalize(temp.path().join("targets/skill")).expect("canonical")
+        );
+        assert!(matches!(
+            root.open_child(OsStr::new("absolute"), false),
+            Err(SafeError::Symlink)
+        ));
+        assert!(Directory::open_absolute(&resolved.path, false).is_ok());
+    }
+
+    #[test]
+    fn leaves_never_follow_links_or_open_fifos() {
+        let temp = tempfile::tempdir().expect("tempdir");
+        fs::write(temp.path().join("secret"), "private").expect("secret");
+        symlink("secret", temp.path().join("AGENTS.md")).expect("link");
+        // rustix's mkfifoat/mknodat are unavailable on macOS.
+        assert!(
+            std::process::Command::new("mkfifo")
+                .arg(temp.path().join("SKILL.md"))
+                .status()
+                .expect("mkfifo")
+                .success()
+        );
+        let directory = directory(temp.path());
+        assert_eq!(
+            directory
+                .candidate(OsStr::new("AGENTS.md"))
+                .expect("link candidate")
+                .availability,
+            KnowledgeSourceAvailability::Symlink
+        );
+        assert_eq!(
+            directory
+                .candidate(OsStr::new("SKILL.md"))
+                .expect("fifo candidate")
+                .availability,
+            KnowledgeSourceAvailability::NonRegular
+        );
+        let fifo = directory
+            .open_leaf(OsStr::new("SKILL.md"))
+            .expect("nonblocking fifo open");
+        let stamp = fingerprint(&directory, "secret");
+        assert_eq!(verify_file(&fifo, &stamp), Err(SafeError::NonRegular));
+    }
+
+    #[test]
+    fn mutations_and_replacements_conflict() {
+        let temp = tempfile::tempdir().expect("tempdir");
+        let path = temp.path().join("AGENTS.md");
+        fs::write(&path, "original").expect("original");
+        let directory = directory(temp.path());
+        let first = fingerprint(&directory, "AGENTS.md");
+        fs::write(&path, "modified").expect("modify");
+        assert_eq!(
+            directory.read_candidate(OsStr::new("AGENTS.md"), &first),
+            Err(SafeError::Changed)
+        );
+        let second = fingerprint(&directory, "AGENTS.md");
+        fs::rename(&path, temp.path().join("previous")).expect("rename");
+        fs::write(&path, "modified").expect("replace");
+        assert_eq!(
+            directory.read_candidate(OsStr::new("AGENTS.md"), &second),
+            Err(SafeError::Changed)
+        );
+    }
+
+    #[test]
+    fn restored_mtime_does_not_hide_a_same_size_edit() {
+        let temp = tempfile::tempdir().expect("tempdir");
+        let path = temp.path().join("AGENTS.md");
+        fs::write(&path, "original").expect("original");
+        let original_time = fs::metadata(&path)
+            .expect("metadata")
+            .modified()
+            .expect("mtime");
+        let directory = directory(temp.path());
+        let original = fingerprint(&directory, "AGENTS.md");
+        fs::write(&path, "modified").expect("same size edit");
+        File::options()
+            .write(true)
+            .open(&path)
+            .expect("open timestamp target")
+            .set_times(fs::FileTimes::new().set_modified(original_time))
+            .expect("restore mtime");
+        let edited = fingerprint(&directory, "AGENTS.md");
+        assert_eq!(original.size, edited.size);
+        assert_eq!(original.modified_seconds, edited.modified_seconds);
+        assert_eq!(original.modified_nanos, edited.modified_nanos);
+        assert_eq!(
+            directory.read_candidate(OsStr::new("AGENTS.md"), &original),
+            Err(SafeError::Changed)
+        );
+    }
+
+    #[test]
+    fn encoding_and_byte_limits_are_checked() {
+        let temp = tempfile::tempdir().expect("tempdir");
+        let path = temp.path().join("SKILL.md");
+        let directory = directory(temp.path());
+        for bytes in [vec![0xff], b"hello\0there".to_vec()] {
+            fs::write(&path, bytes).expect("write invalid");
+            let stamp = fingerprint(&directory, "SKILL.md");
+            assert_eq!(
+                directory.read_candidate(OsStr::new("SKILL.md"), &stamp),
+                Err(SafeError::InvalidText)
+            );
+        }
+        fs::write(&path, vec![b'a'; MAX_KNOWLEDGE_BODY_BYTES]).expect("write limit");
+        let stamp = fingerprint(&directory, "SKILL.md");
+        assert_eq!(
+            directory
+                .read_candidate(OsStr::new("SKILL.md"), &stamp)
+                .expect("bounded read")
+                .len(),
+            MAX_KNOWLEDGE_BODY_BYTES
+        );
+        fs::write(&path, vec![b'a'; MAX_KNOWLEDGE_BODY_BYTES + 1]).expect("write oversized");
+        assert_eq!(
+            directory
+                .candidate(OsStr::new("SKILL.md"))
+                .expect("large candidate")
+                .availability,
+            KnowledgeSourceAvailability::TooLarge
+        );
+    }
+
+    #[test]
+    fn loops_and_client_path_components_are_rejected() {
+        let temp = tempfile::tempdir().expect("tempdir");
+        symlink("second", temp.path().join("first")).expect("first link");
+        symlink("first", temp.path().join("second")).expect("second link");
+        let directory = directory(temp.path());
+        assert!(matches!(
+            directory.open_child(OsStr::new("first"), true),
+            Err(SafeError::Limit)
+        ));
+        for name in ["../secret", "/etc", ".", "..", "name/", "name\0suffix"] {
+            assert!(matches!(
+                directory.open_child(OsStr::new(name), false),
+                Err(SafeError::Unreadable)
+            ));
+            assert!(matches!(
+                directory.candidate(OsStr::new(name)),
+                Err(SafeError::Unreadable)
+            ));
+        }
+    }
+
+    #[test]
+    fn entry_iteration_is_sorted_and_bounded() {
+        let temp = tempfile::tempdir().expect("tempdir");
+        for name in ["z", "b", "a"] {
+            fs::write(temp.path().join(name), "").expect("entry");
+        }
+        let directory = directory(temp.path());
+        let mut remaining = 10;
+        assert_eq!(
+            directory.entry_names(&mut remaining).expect("names"),
+            [
+                OsString::from("a"),
+                OsString::from("b"),
+                OsString::from("z")
+            ]
+        );
+        assert_eq!(remaining, 7);
+        remaining = 2;
+        assert_eq!(
+            directory
+                .entry_names(&mut remaining)
+                .expect("bounded names")
+                .len(),
+            2
+        );
+        assert_eq!(remaining, 0);
+        assert!(
+            directory
+                .entry_names(&mut remaining)
+                .expect("exhausted")
+                .is_empty()
+        );
+    }
+
+    #[test]
+    fn pinned_directory_survives_replacement_without_following_new_link() {
+        let temp = tempfile::tempdir().expect("tempdir");
+        let skill = temp.path().join("skill");
+        fs::create_dir(&skill).expect("skill");
+        fs::write(skill.join("SKILL.md"), "approved").expect("approved");
+        let pinned = directory(&skill);
+        let stamp = fingerprint(&pinned, "SKILL.md");
+        fs::rename(&skill, temp.path().join("moved")).expect("move");
+        fs::create_dir(temp.path().join("other")).expect("other");
+        fs::write(temp.path().join("other/SKILL.md"), "unrelated").expect("unrelated");
+        symlink("other", &skill).expect("replacement link");
+        assert_eq!(
+            pinned.read_candidate(OsStr::new("SKILL.md"), &stamp),
+            Ok("approved".into())
+        );
+        assert!(matches!(
+            Directory::open_absolute(&pinned.path, false),
+            Err(SafeError::Symlink)
+        ));
+    }
+}
diff --git a/crates/daemon/src/knowledge/discovery/tests.rs b/crates/daemon/src/knowledge/discovery/tests.rs
new file mode 100644
index 0000000..74a14fd
--- /dev/null
+++ b/crates/daemon/src/knowledge/discovery/tests.rs
@@ -0,0 +1,468 @@
+use std::{fs, os::unix::fs::symlink, path::Path};
+
+use cli_master_core::knowledge::discovery::KnowledgeSourceAvailability;
+use tempfile::TempDir;
+
+use super::*;
+
+struct Fixture {
+    root: TempDir,
+    project: Project,
+    service: DiscoveryService,
+}
+
+impl Fixture {
+    fn new() -> Self {
+        let root = TempDir::new().unwrap();
+        let home = root.path().join("home");
+        let project_path = root.path().join("project");
+        fs::create_dir_all(&home).unwrap();
+        fs::create_dir_all(&project_path).unwrap();
+        let project = Project {
+            id: ProjectId::new(),
+            name: "Discovery fixture".to_owned(),
+            path: project_path,
+            repository_root: None,
+            current_branch: None,
+            created_at_ms: 1,
+            last_opened_at_ms: 1,
+        };
+        let service = DiscoveryService::new(DiscoveryRoots {
+            home: Some(home),
+            codex_home: None,
+            admin_skills: root.path().join("admin-skills"),
+        });
+        Self {
+            root,
+            project,
+            service,
+        }
+    }
+
+    fn home(&self) -> &Path {
+        self.service.roots.home.as_deref().unwrap()
+    }
+}
+
+fn write(path: impl AsRef<Path>, content: &[u8]) {
+    let path = path.as_ref();
+    fs::create_dir_all(path.parent().unwrap()).unwrap();
+    fs::write(path, content).unwrap();
+}
+
+fn select(
+    scan: &KnowledgeDiscoverResponse,
+    suffix: &str,
+    provider: KnowledgeProvider,
+) -> KnowledgeReadRequest {
+    let entry = scan
+        .entries
+        .iter()
+        .find(|entry| entry.source_path.ends_with(suffix) && entry.provider == provider)
+        .unwrap();
+    KnowledgeReadRequest {
+        scan_id: scan.scan_id,
+        entry_id: entry.entry_id,
+    }
+}
+
+#[test]
+fn discovers_exact_provider_locations_without_configs_or_imports() {
+    let mut fixture = Fixture::new();
+    for path in [
+        "AGENTS.md",
+        "AGENTS.override.md",
+        "CLAUDE.md",
+        "CLAUDE.local.md",
+        ".claude/CLAUDE.md",
+        ".claude/rules/api/requests.md",
+        ".cursor/rules/rust.mdc",
+    ] {
+        write(
+            fixture.project.path.join(path),
+            b"Local instructions\n@private.txt",
+        );
+    }
+    for path in [
+        ".cursor/rules/ignored.md",
+        "private.txt",
+        ".env",
+        ".claude/settings.json",
+        ".codex/auth.json",
+        "nested/AGENTS.md",
+    ] {
+        write(fixture.project.path.join(path), b"PRIVATE_CONFIG_SENTINEL");
+    }
+    write(fixture.home().join(".codex/AGENTS.md"), b"Global Codex");
+    write(fixture.home().join(".claude/CLAUDE.md"), b"Global Claude");
+    write(
+        fixture.home().join(".claude/rules/nested/personal.md"),
+        b"Personal rule",
+    );
+    let scan = fixture.service.discover(Some(&fixture.project)).unwrap();
+    assert_eq!(scan.entries.len(), 11);
+    assert!(!scan.truncated);
+    assert!(
+        scan.issues
+            .iter()
+            .any(|issue| issue.code == "project_root_scope")
+    );
+    assert_eq!(
+        fixture.service.scan_project_id(scan.scan_id).unwrap(),
+        Some(fixture.project.id)
+    );
+    for entry in &scan.entries {
+        assert!(!entry.precedence_hint.is_empty());
+        assert_eq!(entry.availability, KnowledgeSourceAvailability::Available);
+        if entry.scope == KnowledgeSourceScope::Project {
+            assert_eq!(entry.scope_directory, ".");
+        }
+        let read = fixture
+            .service
+            .read(&KnowledgeReadRequest {
+                scan_id: scan.scan_id,
+                entry_id: entry.entry_id,
+            })
+            .unwrap();
+        assert!(!read.content.contains("PRIVATE_CONFIG_SENTINEL"));
+        assert!(!format!("{read:?}").contains("Local instructions"));
+    }
+}
+
+#[test]
+fn codex_home_override_changes_global_rule_root_without_changing_shared_skills() {
+    let mut fixture = Fixture::new();
+    let override_home = fixture.root.path().join("custom-codex");
+    write(override_home.join("AGENTS.override.md"), b"Override root");
+    write(fixture.home().join(".codex/AGENTS.md"), b"Ignored default");
+    write(
+        fixture.home().join(".agents/skills/shared/SKILL.md"),
+        b"Shared skill",
+    );
+    fixture.service.roots.codex_home = Some(override_home.clone());
+    let scan = fixture.service.discover(None).unwrap();
+    assert!(scan.entries.iter().any(
+        |entry| entry.source_path == override_home.join("AGENTS.override.md").to_str().unwrap()
+    ));
+    assert!(
+        !scan
+            .entries
+            .iter()
+            .any(|entry| entry.source_path.ends_with(".codex/AGENTS.md"))
+    );
+    assert_eq!(
+        scan.entries
+            .iter()
+            .filter(|entry| entry.name == "shared")
+            .count(),
+        2
+    );
+    assert_eq!(fixture.service.scan_project_id(scan.scan_id).unwrap(), None);
+}
+
+#[test]
+fn duplicate_names_and_recursive_cursor_skills_keep_their_origins() {
+    let mut fixture = Fixture::new();
+    for base in [fixture.home(), fixture.project.path.as_path()] {
+        write(base.join(".claude/skills/shared/SKILL.md"), b"Claude skill");
+        write(base.join(".agents/skills/shared/SKILL.md"), b"Common skill");
+        write(
+            base.join(".cursor/skills/group/nested/SKILL.md"),
+            b"Nested Cursor skill",
+        );
+    }
+    write(
+        fixture.service.roots.admin_skills.join("managed/SKILL.md"),
+        b"Admin skill",
+    );
+    let scan = fixture.service.discover(Some(&fixture.project)).unwrap();
+    assert_eq!(
+        scan.entries
+            .iter()
+            .filter(|entry| entry.name == "shared")
+            .count(),
+        6
+    );
+    assert_eq!(
+        scan.entries
+            .iter()
+            .filter(|entry| entry.name == "nested")
+            .count(),
+        2
+    );
+    assert!(
+        scan.entries
+            .iter()
+            .any(|entry| entry.scope == KnowledgeSourceScope::Admin)
+    );
+    let personal = scan
+        .entries
+        .iter()
+        .filter(|entry| entry.provider == KnowledgeProvider::Claude)
+        .collect::<Vec<_>>();
+    assert_eq!(personal.len(), 2);
+    assert!(personal.iter().all(|entry| {
+        entry
+            .precedence_hint
+            .contains("personal skills take precedence")
+    }));
+}
+
+#[test]
+fn skill_symlink_targets_are_captured_and_leaf_symlinks_are_unavailable() {
+    let mut fixture = Fixture::new();
+    let first = fixture.root.path().join("external-first");
+    let second = fixture.root.path().join("external-second");
+    write(first.join("SKILL.md"), b"Captured skill content");
+    write(second.join("SKILL.md"), b"Retargeted skill content");
+    let skill_dir = fixture.project.path.join(".claude/skills");
+    fs::create_dir_all(&skill_dir).unwrap();
+    let alias = skill_dir.join("linked");
+    symlink(&first, &alias).unwrap();
+    let secret = fixture.root.path().join("auth.json");
+    write(&secret, b"PRIVATE_CREDENTIAL_SENTINEL");
+    symlink(&secret, fixture.project.path.join("AGENTS.md")).unwrap();
+    let scan = fixture.service.discover(Some(&fixture.project)).unwrap();
+    let request = select(&scan, "linked/SKILL.md", KnowledgeProvider::Claude);
+    let selected = scan
+        .entries
+        .iter()
+        .find(|entry| entry.entry_id == request.entry_id)
+        .unwrap();
+    assert!(selected.via_symlink);
+    assert!(
+        scan.issues
+            .iter()
+            .any(|issue| issue.code == "captured_skill_target")
+    );
+    fs::remove_file(&alias).unwrap();
+    symlink(&second, &alias).unwrap();
+    assert_eq!(
+        fixture.service.read(&request).unwrap().content,
+        "Captured skill content"
+    );
+    let leaf = select(&scan, "AGENTS.md", KnowledgeProvider::Codex);
+    assert_eq!(
+        fixture.service.read(&leaf).unwrap_err().code,
+        "knowledge_source_symlink"
+    );
+    let fresh = fixture.service.discover(Some(&fixture.project)).unwrap();
+    assert_eq!(
+        fixture
+            .service
+            .read(&select(
+                &fresh,
+                "linked/SKILL.md",
+                KnowledgeProvider::Claude
+            ))
+            .unwrap()
+            .content,
+        "Retargeted skill content"
+    );
+}
+
+#[test]
+fn replaced_files_and_parent_directories_require_rediscovery() {
+    let mut fixture = Fixture::new();
+    let rule = fixture.project.path.join(".claude/rules/local.md");
+    write(&rule, b"Original text");
+    let scan = fixture.service.discover(Some(&fixture.project)).unwrap();
+    let request = select(&scan, "local.md", KnowledgeProvider::Claude);
+    write(&rule, b"Changed text!");
+    assert_eq!(
+        fixture.service.read(&request).unwrap_err().code,
+        "knowledge_source_changed"
+    );
+    let fresh = fixture.service.discover(Some(&fixture.project)).unwrap();
+    let request = select(&fresh, "local.md", KnowledgeProvider::Claude);
+    let outside = fixture.root.path().join("outside");
+    write(outside.join("local.md"), b"PRIVATE_OUTSIDE_SENTINEL");
+    fs::rename(
+        rule.parent().unwrap(),
+        fixture.root.path().join("moved-rules"),
+    )
+    .unwrap();
+    symlink(&outside, rule.parent().unwrap()).unwrap();
+    assert_eq!(
+        fixture.service.read(&request).unwrap_err().code,
+        "knowledge_source_changed"
+    );
+}
+
+#[test]
+fn text_read_limits_include_non_utf8_nul_and_worst_json_expansion() {
+    let mut fixture = Fixture::new();
+    write(fixture.project.path.join("AGENTS.md"), &vec![1_u8; 65_536]);
+    write(fixture.project.path.join("CLAUDE.md"), &[0xff, 0xfe]);
+    write(
+        fixture.project.path.join("CLAUDE.local.md"),
+        b"PRIVATE_NUL\0",
+    );
+    write(
+        fixture.project.path.join(".cursor/rules/large.mdc"),
+        &vec![b'a'; 65_537],
+    );
+    let scan = fixture.service.discover(Some(&fixture.project)).unwrap();
+    let content = fixture
+        .service
+        .read(&select(&scan, "AGENTS.md", KnowledgeProvider::Codex))
+        .unwrap();
+    assert_eq!(content.content.len(), 65_536);
+    assert!(serde_json::to_vec(&content).unwrap().len() < 512 * 1_024);
+    for suffix in ["CLAUDE.md", "CLAUDE.local.md"] {
+        let error = fixture
+            .service
+            .read(&select(&scan, suffix, KnowledgeProvider::Claude))
+            .unwrap_err();
+        assert_eq!(error.code, "knowledge_source_invalid_text");
+        assert!(!format!("{error:?}").contains("PRIVATE_NUL"));
+    }
+    assert_eq!(
+        fixture
+            .service
+            .read(&select(&scan, "large.mdc", KnowledgeProvider::Cursor))
+            .unwrap_err()
+            .code,
+        "knowledge_source_too_large"
+    );
+}
+
+#[test]
+fn cache_expiry_eviction_and_scan_entry_binding_are_enforced() {
+    let mut fixture = Fixture::new();
+    write(fixture.project.path.join("AGENTS.md"), b"Content");
+    let first = fixture.service.discover(Some(&fixture.project)).unwrap();
+    let second = fixture.service.discover(Some(&fixture.project)).unwrap();
+    let entry = first.entries[0].entry_id;
+    assert_eq!(
+        fixture
+            .service
+            .read(&KnowledgeReadRequest {
+                scan_id: second.scan_id,
+                entry_id: entry
+            })
+            .unwrap_err()
+            .code,
+        "knowledge_entry_not_found"
+    );
+    fixture.service.scans.front_mut().unwrap().created =
+        Instant::now().checked_sub(SCAN_TTL).unwrap();
+    assert_eq!(
+        fixture
+            .service
+            .scan_project_id(first.scan_id)
+            .unwrap_err()
+            .code,
+        "knowledge_scan_expired"
+    );
+    for _ in 0..MAX_SCANS {
+        fixture.service.discover(Some(&fixture.project)).unwrap();
+    }
+    assert_eq!(fixture.service.scans.len(), MAX_SCANS);
+    assert_eq!(
+        fixture
+            .service
+            .scan_project_id(second.scan_id)
+            .unwrap_err()
+            .code,
+        "knowledge_scan_expired"
+    );
+}
+
+#[test]
+fn bounds_are_visible_and_project_sources_precede_large_global_libraries() {
+    let mut fixture = Fixture::new();
+    write(
+        fixture.project.path.join("AGENTS.md"),
+        b"Project is never starved",
+    );
+    for index in 0..520 {
+        write(
+            fixture
+                .home()
+                .join(format!(".claude/skills/skill-{index:04}/SKILL.md")),
+            b"Skill",
+        );
+    }
+    let scan = fixture.service.discover(Some(&fixture.project)).unwrap();
+    assert!(scan.truncated);
+    assert!(scan.entries.len() <= MAX_ENTRIES);
+    assert_eq!(scan.entries[0].scope, KnowledgeSourceScope::Project);
+    assert!(serde_json::to_vec(&scan).unwrap().len() < 512 * 1_024);
+}
+
+#[test]
+fn recursive_skill_cycles_and_depth_limits_terminate_with_visible_issues() {
+    let mut fixture = Fixture::new();
+    let root = fixture.project.path.join(".cursor/skills");
+    fs::create_dir_all(root.join("group")).unwrap();
+    symlink(&root, root.join("group/loop")).unwrap();
+    let mut deep = root.clone();
+    for _ in 0..20 {
+        deep.push("nested");
+    }
+    write(deep.join("SKILL.md"), b"Beyond depth bound");
+    let scan = fixture.service.discover(Some(&fixture.project)).unwrap();
+    assert!(scan.truncated);
+    assert!(
+        scan.issues
+            .iter()
+            .any(|issue| issue.code == "symlink_cycle")
+    );
+    assert!(scan.issues.iter().any(|issue| issue.code == "depth_limit"));
+}
+
+#[test]
+fn enumeration_limit_preserves_candidates_already_collected() {
+    let fixture = Fixture::new();
+    for name in ["first", "second"] {
+        write(
+            fixture
+                .project
+                .path
+                .join(format!(".claude/rules/{name}.md")),
+            b"Rule",
+        );
+        write(
+            fixture
+                .project
+                .path
+                .join(format!(".cursor/skills/{name}/SKILL.md")),
+            b"Skill",
+        );
+    }
+    for (directory, shape, provider) in [
+        (
+            ".claude/rules",
+            Shape::Rules("md"),
+            KnowledgeProvider::Claude,
+        ),
+        (
+            ".cursor/skills",
+            Shape::Skills { recursive: true },
+            KnowledgeProvider::Cursor,
+        ),
+    ] {
+        let mut scanner = Scanner::new(KnowledgeScanId::new());
+        // Use a small exact budget with real directories to exercise the same
+        // boundary as a full 10,000-node scan without creating irrelevant files.
+        scanner.remaining_nodes = 2;
+        scanner.scan_source(&SourceSpec {
+            base: fixture.project.path.clone(),
+            directory,
+            provider,
+            scope: KnowledgeSourceScope::Project,
+            shape,
+        });
+        assert_eq!(scanner.remaining_nodes, 0);
+        assert!(scanner.response.truncated);
+        assert_eq!(scanner.response.entries.len(), 2);
+        assert!(
+            scanner
+                .response
+                .issues
+                .iter()
+                .any(|issue| issue.code == "scan_limit")
+        );
+    }
+}
diff --git a/crates/daemon/src/knowledge/mod.rs b/crates/daemon/src/knowledge/mod.rs
index cce9d75..b14455f 100644
--- a/crates/daemon/src/knowledge/mod.rs
+++ b/crates/daemon/src/knowledge/mod.rs
@@ -1,18 +1,44 @@
-//! Local user-authored knowledge; no session or process side effects.
+//! Local knowledge and source discovery; no session or process side effects.
+
+pub(crate) mod discovery;
 
 use cli_master_core::ApiError;
 use cli_master_core::wire::{
-    EmptyResponse, KnowledgeDeleteRequest, KnowledgeListRequest, KnowledgeSaveRequest,
+    EmptyResponse, KnowledgeDeleteRequest, KnowledgeDiscoverRequest, KnowledgeListRequest,
+    KnowledgeReadRequest, KnowledgeSaveRequest,
 };
 use cli_master_storage::Storage;
 use serde::de::DeserializeOwned;
 use serde_json::Value;
+use std::sync::Mutex;
 use std::time::{SystemTime, UNIX_EPOCH};
 
 /// Handle only the registered knowledge methods through the existing database.
-pub(crate) fn dispatch(method: &str, payload: Value, storage: &Storage) -> Result<Value, ApiError> {
+pub(crate) fn dispatch(
+    method: &str,
+    payload: Value,
+    storage: &Storage,
+    discovery: &Mutex<discovery::DiscoveryService>,
+) -> Result<Value, ApiError> {
     use cli_master_core::wire::method;
     match method {
+        method::KNOWLEDGE_DISCOVER => {
+            let request: KnowledgeDiscoverRequest = decode(payload)?;
+            let project = request
+                .project_id
+                .map(|id| registered_project(storage, id))
+                .transpose()?;
+            let mut service = discovery.lock().map_err(|_| discovery_unavailable())?;
+            encode(service.discover(project.as_ref())?)
+        }
+        method::KNOWLEDGE_READ => {
+            let request: KnowledgeReadRequest = decode(payload)?;
+            let service = discovery.lock().map_err(|_| discovery_unavailable())?;
+            if let Some(project_id) = service.scan_project_id(request.scan_id)? {
+                registered_project(storage, project_id)?;
+            }
+            encode(service.read(&request)?)
+        }
         method::KNOWLEDGE_LIST => {
             let request: KnowledgeListRequest = decode(payload)?;
             encode(
@@ -54,11 +80,8 @@ fn decode<T: DeserializeOwned>(payload: Value) -> Result<T, ApiError> {
     // Serde errors can quote a user value (e.g. an invalid enum variant). Never
     // attach them to errors for a text-bearing knowledge request.
     serde_json::from_value(payload).map_err(|_| {
-        ApiError::new(
-            "invalid_payload",
-            "The saved prompt or context request is invalid.",
-        )
-        .with_action("Check the title, text, scope and revision, then retry.")
+        ApiError::new("invalid_payload", "The local knowledge request is invalid.")
+            .with_action("Check the selected source, scope and revision, then retry.")
     })
 }
 
@@ -66,3 +89,29 @@ fn encode(value: impl serde::Serialize) -> Result<Value, ApiError> {
     serde_json::to_value(value)
         .map_err(|_| ApiError::new("internal_error", "The local response could not be encoded."))
 }
+
+fn registered_project(
+    storage: &Storage,
+    id: cli_master_core::ProjectId,
+) -> Result<cli_master_core::Project, ApiError> {
+    storage
+        .get_project(id)
+        .map_err(|_| {
+            ApiError::new(
+                "knowledge_storage_unavailable",
+                "The registered project could not be checked.",
+            )
+        })?
+        .ok_or_else(|| {
+            ApiError::new("project_not_found", "This project is no longer registered.")
+                .with_action("Choose a registered project and refresh the sources.")
+        })
+}
+
+fn discovery_unavailable() -> ApiError {
+    ApiError::new(
+        "knowledge_discovery_unavailable",
+        "The local source inventory is unavailable.",
+    )
+    .with_action("Reconnect and refresh the sources.")
+}
diff --git a/crates/daemon/src/knowledge/socket_tests.rs b/crates/daemon/src/knowledge/socket_tests.rs
new file mode 100644
index 0000000..a456d2c
--- /dev/null
+++ b/crates/daemon/src/knowledge/socket_tests.rs
@@ -0,0 +1,309 @@
+//! Discovery acceptance over the real socket with isolated filesystem roots.
+use std::{fs, path::Path, sync::Arc, time::Duration};
+
+use cli_master_core::{RequestEnvelope, ResponseEnvelope, ResponsePayload};
+use futures_util::{SinkExt, StreamExt};
+use serde_json::{Value, json};
+use tempfile::TempDir;
+use tokio::net::UnixStream;
+use tokio_util::{
+    codec::{Framed, LengthDelimitedCodec},
+    sync::CancellationToken,
+};
+
+use super::{Daemon, MAX_FRAME_LENGTH};
+use crate::{
+    DaemonConfig,
+    knowledge::discovery::{DiscoveryRoots, DiscoveryService},
+};
+
+type Client = Framed<UnixStream, LengthDelimitedCodec>;
+
+struct Running {
+    config: DaemonConfig,
+    cancellation: CancellationToken,
+    task: tokio::task::JoinHandle<Result<(), crate::DaemonError>>,
+}
+
+impl Running {
+    fn start(root: &Path) -> Self {
+        let config = DaemonConfig::from_paths(root.join("data"), root.join("run"));
+        let mut daemon = Daemon::bind(config.clone()).unwrap();
+        let state = Arc::get_mut(&mut daemon.state).unwrap();
+        state.knowledge_discovery = std::sync::Mutex::new(DiscoveryService::new(DiscoveryRoots {
+            home: Some(root.join("home")),
+            codex_home: Some(root.join("home/.codex")),
+            admin_skills: root.join("admin/skills"),
+        }));
+        let cancellation = CancellationToken::new();
+        let token = cancellation.clone();
+        let task = tokio::spawn(async move { daemon.run(token).await });
+        Self {
+            config,
+            cancellation,
+            task,
+        }
+    }
+
+    async fn connect(&self) -> Client {
+        LengthDelimitedCodec::builder()
+            .max_frame_length(MAX_FRAME_LENGTH)
+            .new_framed(
+                UnixStream::connect(self.config.socket_path())
+                    .await
+                    .unwrap(),
+            )
+    }
+
+    async fn stop(self) {
+        self.cancellation.cancel();
+        tokio::time::timeout(Duration::from_secs(5), self.task)
+            .await
+            .unwrap()
+            .unwrap()
+            .unwrap();
+    }
+}
+
+async fn exchange(client: &mut Client, method: &str, payload: Value) -> ResponseEnvelope<Value> {
+    let request = RequestEnvelope::v1(method, payload);
+    client
+        .send(serde_json::to_vec(&request).unwrap().into())
+        .await
+        .unwrap();
+    let bytes = tokio::time::timeout(Duration::from_secs(5), client.next())
+        .await
+        .unwrap()
+        .unwrap()
+        .unwrap();
+    assert!(bytes.len() <= MAX_FRAME_LENGTH);
+    let response: ResponseEnvelope<Value> = serde_json::from_slice(&bytes).unwrap();
+    assert_eq!(response.request_id, request.request_id);
+    response
+}
+
+async fn success(client: &mut Client, method: &str, payload: Value) -> Value {
+    match exchange(client, method, payload).await.payload {
+        ResponsePayload::Success { data } => data,
+        ResponsePayload::Error { error } => panic!("{method}: {}", error.code),
+    }
+}
+
+fn error_code(response: ResponseEnvelope<Value>) -> String {
+    match response.payload {
+        ResponsePayload::Error { error } => error.code,
+        ResponsePayload::Success { .. } => panic!("expected request failure"),
+    }
+}
+
+fn write(root: &Path, path: &str, content: &str) {
+    let path = root.join(path);
+    fs::create_dir_all(path.parent().unwrap()).unwrap();
+    fs::write(path, content).unwrap();
+}
+
+fn source(scan: &Value, suffix: &str) -> Value {
+    scan["entries"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .find(|entry| entry["sourcePath"].as_str().unwrap().ends_with(suffix))
+        .unwrap_or_else(|| panic!("missing {suffix}"))
+        .clone()
+}
+
+#[tokio::test]
+async fn discovery_and_explicit_read_use_scoped_capabilities_without_session_effects() {
+    let root = TempDir::new().unwrap();
+    write(
+        root.path(),
+        "home/.codex/AGENTS.md",
+        "Global private rule body",
+    );
+    write(
+        root.path(),
+        "home/.codex/auth.json",
+        "private-credential-canary",
+    );
+    write(root.path(), "project/AGENTS.md", "Project rule body");
+    write(
+        root.path(),
+        "project/.agents/skills/review/SKILL.md",
+        "---\nname: review\n---\nRead this skill.",
+    );
+    write(
+        root.path(),
+        "project/.agents/skills/review/run.sh",
+        "never execute me",
+    );
+    let daemon = Running::start(root.path());
+    let mut client = daemon.connect().await;
+    let project = success(
+        &mut client,
+        "project.add",
+        json!({"path":root.path().join("project")}),
+    )
+    .await;
+    let before = success(&mut client, "state.snapshot", json!({})).await;
+    let global = success(&mut client, "knowledge.discover", json!({})).await;
+    assert!(
+        global["entries"]
+            .as_array()
+            .unwrap()
+            .iter()
+            .all(|entry| entry["scope"] != "project")
+    );
+    let scan = success(
+        &mut client,
+        "knowledge.discover",
+        json!({"projectId":project["id"]}),
+    )
+    .await;
+    let serialized = serde_json::to_string(&scan).unwrap();
+    for excluded in [
+        "Global private rule body",
+        "Project rule body",
+        "private-credential-canary",
+        "auth.json",
+        "run.sh",
+    ] {
+        assert!(!serialized.contains(excluded));
+    }
+    assert_eq!(scan["truncated"], false);
+    let entry = source(&scan, "project/.agents/skills/review/SKILL.md");
+    assert_eq!(entry["scope"], "project");
+    assert_eq!(entry["availability"], "available");
+    assert!(!entry["precedenceHint"].as_str().unwrap().is_empty());
+    let read = success(
+        &mut client,
+        "knowledge.read",
+        json!({"scanId":scan["scanId"],"entryId":entry["entryId"]}),
+    )
+    .await;
+    assert_eq!(read["entry"], entry);
+    assert_eq!(read["content"], "---\nname: review\n---\nRead this skill.");
+    let after = success(&mut client, "state.snapshot", json!({})).await;
+    assert_eq!(after["sessions"], before["sessions"]);
+    assert_eq!(after["worktrees"], before["worktrees"]);
+    success(
+        &mut client,
+        "project.remove",
+        json!({"projectId":project["id"]}),
+    )
+    .await;
+    assert_eq!(
+        error_code(
+            exchange(
+                &mut client,
+                "knowledge.read",
+                json!({"scanId":scan["scanId"],"entryId":entry["entryId"]})
+            )
+            .await
+        ),
+        "project_not_found"
+    );
+    assert!(root.path().join("project/AGENTS.md").is_file());
+    drop(client);
+    daemon.stop().await;
+    assert_scan_expired_after_restart(root.path(), &global).await;
+}
+
+async fn assert_scan_expired_after_restart(root: &Path, global: &Value) {
+    let daemon = Running::start(root);
+    let mut client = daemon.connect().await;
+    let entry = source(global, "home/.codex/AGENTS.md");
+    assert_eq!(
+        error_code(
+            exchange(
+                &mut client,
+                "knowledge.read",
+                json!({"scanId":global["scanId"],"entryId":entry["entryId"]})
+            )
+            .await
+        ),
+        "knowledge_scan_expired"
+    );
+    daemon.stop().await;
+}
+
+#[tokio::test]
+async fn discovery_rejects_paths_and_reads_detect_external_source_changes() {
+    let root = TempDir::new().unwrap();
+    write(root.path(), "project/AGENTS.md", "Original source");
+    let daemon = Running::start(root.path());
+    let mut client = daemon.connect().await;
+    let project = success(
+        &mut client,
+        "project.add",
+        json!({"path":root.path().join("project")}),
+    )
+    .await;
+    let scan = success(
+        &mut client,
+        "knowledge.discover",
+        json!({"projectId":project["id"]}),
+    )
+    .await;
+    let entry = source(&scan, "project/AGENTS.md");
+    fs::write(
+        root.path().join("project/AGENTS.md"),
+        "Changed source with a different length",
+    )
+    .unwrap();
+    assert_eq!(
+        error_code(
+            exchange(
+                &mut client,
+                "knowledge.read",
+                json!({"scanId":scan["scanId"],"entryId":entry["entryId"]})
+            )
+            .await
+        ),
+        "knowledge_source_changed"
+    );
+    for (method, payload) in [
+        ("knowledge.discover", json!({"path":"private-path-canary"})),
+        (
+            "knowledge.read",
+            json!({"scanId":scan["scanId"],"entryId":entry["entryId"],"path":"private-path-canary"}),
+        ),
+        (
+            "knowledge.read",
+            json!({"scanId":"private-path-canary","entryId":entry["entryId"]}),
+        ),
+    ] {
+        let response = exchange(&mut client, method, payload).await;
+        assert!(
+            !serde_json::to_string(&response)
+                .unwrap()
+                .contains("private-path-canary")
+        );
+        assert_eq!(error_code(response), "invalid_payload");
+    }
+    assert_eq!(
+        error_code(
+            exchange(
+                &mut client,
+                "knowledge.discover",
+                json!({"projectId":uuid::Uuid::now_v7()})
+            )
+            .await
+        ),
+        "project_not_found"
+    );
+    let refreshed = success(
+        &mut client,
+        "knowledge.discover",
+        json!({"projectId":project["id"]}),
+    )
+    .await;
+    let entry = source(&refreshed, "project/AGENTS.md");
+    let read = success(
+        &mut client,
+        "knowledge.read",
+        json!({"scanId":refreshed["scanId"],"entryId":entry["entryId"]}),
+    )
+    .await;
+    assert_eq!(read["content"], "Changed source with a different length");
+    daemon.stop().await;
+}
diff --git a/crates/daemon/src/server.rs b/crates/daemon/src/server.rs
index 4825586..5b1b72b 100644
--- a/crates/daemon/src/server.rs
+++ b/crates/daemon/src/server.rs
@@ -3,8 +3,8 @@ use std::fs;
 use std::io;
 use std::os::unix::fs::{FileTypeExt, MetadataExt, PermissionsExt};
 use std::path::{Path, PathBuf};
-use std::sync::Arc;
 use std::sync::atomic::{AtomicU64, Ordering};
+use std::sync::{Arc, Mutex};
 
 use cli_master_core::{
     ApiError, DaemonInstanceId, EnvelopeKind, EventEnvelope, PROTOCOL_V1, Project, RequestEnvelope,
@@ -76,6 +76,7 @@ struct ServerState {
     projects: ProjectRegistry,
     sessions: SessionRegistry,
     git_storage: Storage,
+    knowledge_discovery: Mutex<crate::knowledge::discovery::DiscoveryService>,
     git: Option<Git>,
     event_sequence: AtomicU64,
 }
@@ -154,6 +155,9 @@ impl Daemon {
                 )
             })?,
             git_storage,
+            knowledge_discovery: Mutex::new(crate::knowledge::discovery::DiscoveryService::new(
+                crate::knowledge::discovery::DiscoveryRoots::from_environment(),
+            )),
             git,
             event_sequence: AtomicU64::new(0),
         });
@@ -525,7 +529,10 @@ fn validate_peer(_stream: &UnixStream) -> Result<(), io::Error> {
     clippy::too_many_lines,
     reason = "the versioned IPC method table is intentionally kept in one auditable dispatcher"
 )]
-async fn dispatch(request: RequestEnvelope<Value>, state: &ServerState) -> ResponseEnvelope<Value> {
+async fn dispatch(
+    request: RequestEnvelope<Value>,
+    state: &Arc<ServerState>,
+) -> ResponseEnvelope<Value> {
     if request.kind != EnvelopeKind::Request {
         return ResponseEnvelope::failure(
             request.request_id,
@@ -551,8 +558,28 @@ async fn dispatch(request: RequestEnvelope<Value>, state: &ServerState) -> Respo
     }
 
     let result = match request.method.as_str() {
-        method::KNOWLEDGE_LIST | method::KNOWLEDGE_SAVE | method::KNOWLEDGE_DELETE => {
-            crate::knowledge::dispatch(&request.method, request.payload, &state.git_storage)
+        method::KNOWLEDGE_LIST
+        | method::KNOWLEDGE_SAVE
+        | method::KNOWLEDGE_DELETE
+        | method::KNOWLEDGE_DISCOVER
+        | method::KNOWLEDGE_READ => {
+            let state = Arc::clone(state);
+            match tokio::task::spawn_blocking(move || {
+                crate::knowledge::dispatch(
+                    &request.method,
+                    request.payload,
+                    &state.git_storage,
+                    &state.knowledge_discovery,
+                )
+            })
+            .await
+            {
+                Ok(result) => result,
+                Err(_) => Err(ApiError::new(
+                    "knowledge_operation_failed",
+                    "The local knowledge operation could not complete.",
+                )),
+            }
         }
         method::SYSTEM_HELLO => encode_response(&state.hello),
         method::STATE_SNAPSHOT => state.projects.snapshot().and_then(|projects| {
@@ -801,3 +828,7 @@ mod tests {
         }
     }
 }
+
+#[cfg(test)]
+#[path = "knowledge/socket_tests.rs"]
+mod knowledge_socket_tests;
diff --git a/protocol/catalog.json b/protocol/catalog.json
index 814cee3..5aa2882 100644
--- a/protocol/catalog.json
+++ b/protocol/catalog.json
@@ -32,7 +32,9 @@
     "diagnostics.get",
     "knowledge.list",
     "knowledge.save",
-    "knowledge.delete"
+    "knowledge.delete",
+    "knowledge.discover",
+    "knowledge.read"
   ],
   "events": [
     "project.updated",
diff --git a/protocol/fixtures/knowledge-discovery.json b/protocol/fixtures/knowledge-discovery.json
new file mode 100644
index 0000000..9e0fdb6
--- /dev/null
+++ b/protocol/fixtures/knowledge-discovery.json
@@ -0,0 +1,36 @@
+{
+  "scan": {
+    "scanId": "0198b6e0-0000-7000-8000-000000000001",
+    "entries": [
+      {
+        "entryId": "0198b6e0-0001-7000-8000-000000000001",
+        "kind": "skill",
+        "provider": "codex",
+        "scope": "project",
+        "sourcePath": "/workspace/example/.agents/skills/review/SKILL.md",
+        "name": "review",
+        "scopeDirectory": ".",
+        "precedenceHint": "Inventory only; the native CLI decides whether to load this source.",
+        "viaSymlink": false,
+        "availability": "available"
+      }
+    ],
+    "truncated": false,
+    "issues": []
+  },
+  "read": {
+    "entry": {
+      "entryId": "0198b6e0-0001-7000-8000-000000000001",
+      "kind": "skill",
+      "provider": "codex",
+      "scope": "project",
+      "sourcePath": "/workspace/example/.agents/skills/review/SKILL.md",
+      "name": "review",
+      "scopeDirectory": ".",
+      "precedenceHint": "Inventory only; the native CLI decides whether to load this source.",
+      "viaSymlink": false,
+      "availability": "available"
+    },
+    "content": "---\nname: review\n---\nReview the current change.\n"
+  }
+}

From 393d4879b382b25cd55a0906386fb3e60c617a07 Mon Sep 17 00:00:00 2001
From: guicybercode <euguigom@gmail.com>
Date: Sat, 5 Sep 2026 22:22:15 -0300
Subject: [PATCH 16/23] feat(knowledge): add source inspector with explicit
 previews

---
 .../KnowledgeSourceInspector.test.tsx         | 224 ++++++++++++++++++
 .../knowledge/KnowledgeSourceInspector.tsx    | 146 ++++++++++++
 .../src/app/features/knowledge/index.ts       |   2 +
 .../knowledge/knowledge-source-inspector.css  |  71 ++++++
 .../features/knowledge/useKnowledgeSources.ts | 121 ++++++++++
 .../xirp/knowledge-inspector-desktop.png      | Bin 0 -> 104620 bytes
 .../xirp/knowledge-inspector-narrow.png       | Bin 0 -> 56846 bytes
 docs/codex/xirp-context-report.md             |  61 +++++
 docs/codex/xirp-coordination-reply.md         |  24 ++
 docs/codex/xirp-discovery-contract.md         |  40 +++-
 docs/codex/xirp-organization-contract.md      |  70 ++++++
 docs/xirp-local-parity.md                     |   4 +-
 12 files changed, 752 insertions(+), 11 deletions(-)
 create mode 100644 apps/desktop/src/app/features/knowledge/KnowledgeSourceInspector.test.tsx
 create mode 100644 apps/desktop/src/app/features/knowledge/KnowledgeSourceInspector.tsx
 create mode 100644 apps/desktop/src/app/features/knowledge/knowledge-source-inspector.css
 create mode 100644 apps/desktop/src/app/features/knowledge/useKnowledgeSources.ts
 create mode 100644 docs/codex/artifacts/xirp/knowledge-inspector-desktop.png
 create mode 100644 docs/codex/artifacts/xirp/knowledge-inspector-narrow.png
 create mode 100644 docs/codex/xirp-organization-contract.md

diff --git a/apps/desktop/src/app/features/knowledge/KnowledgeSourceInspector.test.tsx b/apps/desktop/src/app/features/knowledge/KnowledgeSourceInspector.test.tsx
new file mode 100644
index 0000000..a2482f0
--- /dev/null
+++ b/apps/desktop/src/app/features/knowledge/KnowledgeSourceInspector.test.tsx
@@ -0,0 +1,224 @@
+import { act, render, screen, waitFor, within } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { describe, expect, it } from "vitest";
+
+import { IpcError } from "../../../ipc/client";
+import type { KnowledgeDiscoverResponse, KnowledgeReadResponse, KnowledgeSourceAvailability, KnowledgeSourceEntry } from "../../../ipc/domain";
+import { createMockIpcClient } from "../../../test/mockIpc";
+import { KnowledgeSourceInspector } from "./KnowledgeSourceInspector";
+
+const project = { id: "project-a", name: "Project A" };
+
+/** Source metadata is display-only; read requests carry the two opaque IDs. */
+function source(overrides: Partial<KnowledgeSourceEntry> = {}): KnowledgeSourceEntry {
+  return {
+    entryId: "source-a", kind: "rule", provider: "codex", scope: "project",
+    sourcePath: "/repo/AGENTS.md", name: "AGENTS.md", scopeDirectory: ".",
+    precedenceHint: "Project instructions follow global instructions. Native loading depends on the CLI.",
+    viaSymlink: false, availability: "available", ...overrides,
+  };
+}
+
+/** Builds one bounded metadata inventory with no implicitly read content. */
+function inventory(entries: readonly KnowledgeSourceEntry[], overrides: Partial<KnowledgeDiscoverResponse> = {}): KnowledgeDiscoverResponse {
+  return { scanId: "scan-a", entries, truncated: false, issues: [], ...overrides };
+}
+
+/** Allows old operations to settle after user navigation or a reconnect. */
+function deferred<T>() {
+  let settle: (value: T) => void = () => { throw new Error("Promise not initialized"); };
+  const promise = new Promise<T>((resolve) => { settle = resolve; });
+  return { promise, resolve: settle };
+}
+
+describe("KnowledgeSourceInspector", () => {
+  it("discovers global sources without a project and reads literal content only on selection", async () => {
+    const user = userEvent.setup();
+    const entry = source({ scope: "global", sourcePath: "/home/example/.codex/AGENTS.md", scopeDirectory: "" });
+    const content = "# Instructions\n<script>window.unsafe = true</script>\n![remote](https://example.com/image.png)\n";
+    const client = createMockIpcClient({ handlers: {
+      discoverKnowledge: async () => inventory([entry]),
+      readKnowledge: async () => ({ entry, content }),
+    } });
+    render(<KnowledgeSourceInspector client={client} />);
+    const button = await screen.findByRole("button", { name: entry.name });
+    expect(client.discoverKnowledge).toHaveBeenCalledWith({ projectId: null });
+    expect(client.readKnowledge).not.toHaveBeenCalled();
+    expect(screen.getByText(/Native CLI loading remains unverified/)).toBeVisible();
+    await user.click(button);
+    expect(client.readKnowledge).toHaveBeenCalledWith({ scanId: "scan-a", entryId: entry.entryId });
+    expect(await screen.findByLabelText("Source content")).toHaveTextContent("<script>window.unsafe = true</script>");
+    expect(screen.getByLabelText("Source content").textContent).toBe(content);
+    expect(screen.getByText(entry.precedenceHint)).toBeVisible();
+    expect(screen.queryByRole("img")).not.toBeInTheDocument();
+    expect(document.querySelector("script")).not.toBeInTheDocument();
+    expect(client.writeTerminal).not.toHaveBeenCalled();
+    expect(client.startSession).not.toHaveBeenCalled();
+    expect(client.openPath).not.toHaveBeenCalled();
+  });
+
+  const unavailable: readonly KnowledgeSourceAvailability[] = ["too_large", "symlink", "non_regular", "unreadable"];
+  it.each(unavailable)("keeps %s sources inspectable without requesting their body", async (availability) => {
+    const user = userEvent.setup();
+    const entry = source({ availability });
+    const client = createMockIpcClient({ handlers: { discoverKnowledge: async () => inventory([entry]) } });
+    render(<KnowledgeSourceInspector client={client} currentProject={project} />);
+    await user.click(await screen.findByRole("button", { name: entry.name }));
+    expect(screen.getByText(entry.precedenceHint)).toBeVisible();
+    expect(screen.getByText("Source path")).toBeVisible();
+    expect(screen.queryByLabelText("Source content")).not.toBeInTheDocument();
+    expect(client.readKnowledge).not.toHaveBeenCalled();
+    expect(client.discoverKnowledge).toHaveBeenCalledWith({ projectId: project.id });
+  });
+
+  it("shows truncation, unsupported scope issues and their locations alongside available results", async () => {
+    const client = createMockIpcClient({ handlers: { discoverKnowledge: async () => inventory([source()], {
+      truncated: true,
+      issues: [{ code: "nested_scope_unsupported", sourcePath: "/repo/nested", message: "Nested project scopes are not included in this inventory." }],
+    }) } });
+    render(<KnowledgeSourceInspector client={client} />);
+    expect(await screen.findByText(/Inventory incomplete/)).toBeVisible();
+    expect(screen.getByText("1 discovery issue")).toBeVisible();
+    expect(screen.getByText("Nested project scopes are not included in this inventory.")).toBeVisible();
+    expect(screen.getByText("/repo/nested")).toBeVisible();
+    expect(screen.getByRole("button", { name: "AGENTS.md" })).toBeVisible();
+  });
+
+  it("searches metadata across providers and distinguishes a successful empty source", async () => {
+    const user = userEvent.setup();
+    const first = source();
+    const skill = source({ entryId: "source-b", kind: "skill", provider: "claude", scope: "admin", name: "review", sourcePath: "/etc/skills/review/SKILL.md", scopeDirectory: "", viaSymlink: true });
+    const client = createMockIpcClient({ handlers: {
+      discoverKnowledge: async () => inventory([first, skill]),
+      readKnowledge: async () => ({ entry: skill, content: "" }),
+    } });
+    render(<KnowledgeSourceInspector client={client} />);
+    await screen.findByRole("button", { name: first.name });
+    await user.type(screen.getByRole("searchbox"), "claude");
+    expect(screen.queryByRole("button", { name: first.name })).not.toBeInTheDocument();
+    await user.click(screen.getByRole("button", { name: skill.name }));
+    expect(await screen.findByText("This source is empty.")).toBeVisible();
+    expect(screen.getByText("Resolved directory link")).toBeVisible();
+    expect(screen.getByText("Administrator")).toBeVisible();
+  });
+
+  it("retries failed discovery without fabricating an empty successful inventory", async () => {
+    const user = userEvent.setup();
+    const client = createMockIpcClient();
+    client.discoverKnowledge.mockRejectedValueOnce(new IpcError({ code: "knowledge_discovery_unavailable", message: "Source discovery is unavailable." }));
+    client.discoverKnowledge.mockResolvedValue(inventory([source()]));
+    render(<KnowledgeSourceInspector client={client} />);
+    expect(await screen.findByRole("alert")).toHaveTextContent("Source discovery is unavailable.");
+    expect(screen.queryByText("No sources found at the supported locations.")).not.toBeInTheDocument();
+    await user.click(screen.getByRole("button", { name: "Retry discovery" }));
+    expect(await screen.findByRole("button", { name: "AGENTS.md" })).toBeVisible();
+  });
+
+  it("ignores older scans across project changes and reconnection on the same client", async () => {
+    const pendingProject = deferred<KnowledgeDiscoverResponse>();
+    const pendingGlobal = deferred<KnowledgeDiscoverResponse>();
+    const fresh = source({ name: "Fresh inventory" });
+    const client = createMockIpcClient();
+    client.discoverKnowledge.mockReturnValueOnce(pendingProject.promise);
+    client.discoverKnowledge.mockReturnValueOnce(pendingGlobal.promise);
+    client.discoverKnowledge.mockResolvedValue(inventory([fresh], { scanId: "scan-fresh" }));
+    const view = render(<KnowledgeSourceInspector client={client} currentProject={project} connectionKey={1} />);
+    await waitFor(() => expect(client.discoverKnowledge).toHaveBeenCalledTimes(1));
+    view.rerender(<KnowledgeSourceInspector client={client} connectionKey={1} />);
+    await waitFor(() => expect(client.discoverKnowledge).toHaveBeenCalledTimes(2));
+    view.rerender(<KnowledgeSourceInspector client={client} connectionKey={2} />);
+    expect(await screen.findByRole("button", { name: fresh.name })).toBeVisible();
+    await act(async () => {
+      pendingProject.resolve(inventory([source({ name: "Old project inventory" })]));
+      pendingGlobal.resolve(inventory([source({ name: "Old global inventory" })]));
+    });
+    expect(screen.queryByRole("button", { name: /Old .* inventory/ })).not.toBeInTheDocument();
+    expect(screen.getByRole("button", { name: fresh.name })).toBeVisible();
+  });
+
+  it("ignores a slow preview after the user selects another source", async () => {
+    const user = userEvent.setup();
+    const first = source();
+    const second = source({ entryId: "source-b", name: "Second source", sourcePath: "/repo/second/AGENTS.md" });
+    const pendingRead = deferred<KnowledgeReadResponse>();
+    const client = createMockIpcClient({ handlers: { discoverKnowledge: async () => inventory([first, second]) } });
+    client.readKnowledge.mockReturnValueOnce(pendingRead.promise);
+    client.readKnowledge.mockResolvedValue({ entry: second, content: "Current source text" });
+    render(<KnowledgeSourceInspector client={client} />);
+    await user.click(await screen.findByRole("button", { name: first.name }));
+    expect(screen.getByText("Reading source…")).toBeVisible();
+    await user.click(screen.getByRole("button", { name: second.name }));
+    expect(await screen.findByLabelText("Source content")).toHaveTextContent("Current source text");
+    await act(async () => pendingRead.resolve({ entry: first, content: "Outdated source text" }));
+    expect(screen.getByLabelText("Source content")).toHaveTextContent("Current source text");
+    expect(screen.queryByText("Outdated source text")).not.toBeInTheDocument();
+  });
+
+  it("invalidates a pending preview on reconnect and uses a fresh scan capability", async () => {
+    const user = userEvent.setup();
+    const entry = source();
+    const pendingRead = deferred<KnowledgeReadResponse>();
+    const client = createMockIpcClient();
+    client.discoverKnowledge.mockResolvedValueOnce(inventory([entry]));
+    client.discoverKnowledge.mockResolvedValue(inventory([entry], { scanId: "scan-reconnected" }));
+    client.readKnowledge.mockReturnValueOnce(pendingRead.promise);
+    client.readKnowledge.mockResolvedValue({ entry, content: "Revalidated source" });
+    const view = render(<KnowledgeSourceInspector client={client} connectionKey="daemon-1" />);
+    await user.click(await screen.findByRole("button", { name: entry.name }));
+    view.rerender(<KnowledgeSourceInspector client={client} connectionKey="daemon-2" />);
+    await screen.findByRole("button", { name: entry.name });
+    await act(async () => pendingRead.resolve({ entry, content: "Old daemon preview" }));
+    expect(screen.queryByLabelText("Source content")).not.toBeInTheDocument();
+    await user.click(screen.getByRole("button", { name: entry.name }));
+    expect(await screen.findByLabelText("Source content")).toHaveTextContent("Revalidated source");
+    expect(client.readKnowledge).toHaveBeenLastCalledWith({ scanId: "scan-reconnected", entryId: entry.entryId });
+  });
+
+  it.each(["knowledge_scan_expired", "knowledge_source_changed"])("clears stale content and offers a rescan after %s", async (code) => {
+    const user = userEvent.setup();
+    const first = source();
+    const second = source({ entryId: "source-b", name: "Changed source" });
+    const client = createMockIpcClient({ handlers: { discoverKnowledge: async () => inventory([first, second]) } });
+    client.readKnowledge.mockResolvedValueOnce({ entry: first, content: "Previous preview" });
+    client.readKnowledge.mockRejectedValueOnce(new IpcError({ code, message: "This source must be discovered again." }));
+    render(<KnowledgeSourceInspector client={client} />);
+    await user.click(await screen.findByRole("button", { name: first.name }));
+    await screen.findByLabelText("Source content");
+    await user.click(screen.getByRole("button", { name: second.name }));
+    expect(await screen.findByRole("alert")).toHaveTextContent("This source must be discovered again.");
+    expect(screen.queryByLabelText("Source content")).not.toBeInTheDocument();
+    await user.click(screen.getByRole("button", { name: "Rescan sources" }));
+    await waitFor(() => expect(client.discoverKnowledge).toHaveBeenCalledTimes(2));
+    expect(screen.queryByRole("alert")).not.toBeInTheDocument();
+  });
+
+  it("rejects a body whose returned provenance differs from the selected descriptor", async () => {
+    const user = userEvent.setup();
+    const entry = source();
+    const client = createMockIpcClient({ handlers: {
+      discoverKnowledge: async () => inventory([entry]),
+      readKnowledge: async () => ({ entry: { ...entry, sourcePath: "/another/source.md", provider: "cursor" }, content: "Wrong source body" }),
+    } });
+    render(<KnowledgeSourceInspector client={client} />);
+    await user.click(await screen.findByRole("button", { name: entry.name }));
+    expect(await screen.findByRole("alert")).toHaveTextContent("invalid response");
+    expect(screen.queryByText("Wrong source body")).not.toBeInTheDocument();
+    expect(screen.queryByText("/another/source.md")).not.toBeInTheDocument();
+  });
+
+  it("provides native keyboard navigation to source selection and the read-only preview", async () => {
+    const user = userEvent.setup();
+    const entry = source();
+    const client = createMockIpcClient({ handlers: {
+      discoverKnowledge: async () => inventory([entry]),
+      readKnowledge: async () => ({ entry, content: "Keyboard-readable source" }),
+    } });
+    render(<KnowledgeSourceInspector client={client} />);
+    const list = await screen.findByRole("list", { name: "Discovered rules and skills" });
+    within(list).getByRole("button", { name: entry.name }).focus();
+    await user.keyboard("{Enter}");
+    const preview = await screen.findByLabelText("Source content");
+    await user.tab();
+    expect(preview).toHaveFocus();
+  });
+});
diff --git a/apps/desktop/src/app/features/knowledge/KnowledgeSourceInspector.tsx b/apps/desktop/src/app/features/knowledge/KnowledgeSourceInspector.tsx
new file mode 100644
index 0000000..c3f87be
--- /dev/null
+++ b/apps/desktop/src/app/features/knowledge/KnowledgeSourceInspector.tsx
@@ -0,0 +1,146 @@
+import { useId, useState } from "react";
+
+import type { KnowledgeProvider, KnowledgeSourceAvailability, KnowledgeSourceEntry, KnowledgeSourceScope } from "../../../ipc/domain";
+import { trimKnowledgeText } from "./useKnowledgeLibrary";
+import { useKnowledgeSources, type KnowledgeSourceInspectorProps } from "./useKnowledgeSources";
+import "./knowledge-library.css";
+import "./knowledge-source-inspector.css";
+
+/** Inspects documented local rule and skill sources without executing or editing their contents. */
+export function KnowledgeSourceInspector(props: KnowledgeSourceInspectorProps) {
+  const sources = useKnowledgeSources(props);
+  const id = useId();
+  const [query, setQuery] = useState("");
+  const normalizedQuery = trimKnowledgeText(query).toLocaleLowerCase();
+  const entries = sources.result?.entries ?? [];
+  const visibleEntries = entries.filter((entry) => matchesSource(entry, normalizedQuery));
+  const selected = sources.selected;
+  const preview = sources.read;
+
+  return (
+    <section className="knowledge-library knowledge-inspector" aria-labelledby={`${id}-heading`}>
+      <header className="knowledge-library__header">
+        <div>
+          <h2 id={`${id}-heading`}>Rules &amp; skills</h2>
+          <p>Inspect known instruction sources on this device.</p>
+        </div>
+        <button className="button button--secondary" type="button" disabled={sources.loading} onClick={() => void sources.rescan()}>
+          {sources.loading ? "Scanning…" : "Rescan sources"}
+        </button>
+      </header>
+      <p className="knowledge-inspector__provenance">Discovered files are shown with their origin. Native CLI loading remains unverified.</p>
+      {sources.scanError ? (
+        <div className="knowledge-inspector__notice knowledge-library__error" role="alert">
+          <p>{sources.scanError.message}</p>
+          {sources.scanError.action ? <p>{sources.scanError.action}</p> : null}
+          <button className="button button--secondary" type="button" onClick={() => void sources.rescan()}>Retry discovery</button>
+        </div>
+      ) : null}
+      {sources.result?.truncated ? <p className="knowledge-inspector__notice knowledge-inspector__warning">Inventory incomplete: a discovery limit was reached. Some sources may be missing.</p> : null}
+      {sources.result?.issues.length ? (
+        <details className="knowledge-inspector__issues" open>
+          <summary>{sources.result.issues.length} discovery {sources.result.issues.length === 1 ? "issue" : "issues"}</summary>
+          <ul tabIndex={0} aria-label="Discovery issue details">
+            {sources.result.issues.map((issue, index) => (
+              <li key={`${issue.code}-${index}`}>
+                <p>{issue.message}</p>
+                {issue.sourcePath ? <code>{issue.sourcePath}</code> : null}
+              </li>
+            ))}
+          </ul>
+        </details>
+      ) : null}
+      <div className="knowledge-library__layout">
+        <div className="knowledge-library__browser">
+          <label className="knowledge-library__field" htmlFor={`${id}-search`}>
+            <span>Search discovered sources</span>
+            <input id={`${id}-search`} type="search" value={query} placeholder="Name, provider or path" onChange={(event) => setQuery(event.currentTarget.value)} />
+          </label>
+          <p className="knowledge-library__hint">{props.currentProject ? `${props.currentProject.name} + global and administrator sources` : "Global and administrator sources"}</p>
+          <p className="knowledge-library__list-status" role="status">
+            {sources.loading ? "Discovering local rules and skills…" : `${visibleEntries.length} of ${entries.length} discovered sources shown.`}
+          </p>
+          <ul className="knowledge-library__list" aria-label="Discovered rules and skills" aria-busy={sources.loading}>
+            {visibleEntries.map((entry) => (
+              <li key={entry.entryId}>
+                <button
+                  className="knowledge-library__item"
+                  type="button"
+                  aria-pressed={selected?.entryId === entry.entryId}
+                  aria-labelledby={`${id}-${entry.entryId}-name`}
+                  aria-describedby={`${id}-${entry.entryId}-summary`}
+                  onClick={() => void sources.selectSource(entry)}
+                >
+                  <strong id={`${id}-${entry.entryId}-name`}>{entry.name}</strong>
+                  <span id={`${id}-${entry.entryId}-summary`} className="knowledge-library__meta">
+                    {providerLabels[entry.provider]} · {entry.kind === "rule" ? "Rule" : "Skill"} · {scopeLabels[entry.scope]}
+                  </span>
+                  <code className="knowledge-library__preview">{entry.sourcePath}</code>
+                  <span className={entry.availability === "available" ? "knowledge-library__meta" : "knowledge-inspector__unavailable"}>{availabilityLabels[entry.availability]}</span>
+                </button>
+              </li>
+            ))}
+          </ul>
+          {!sources.loading && !sources.scanError && !visibleEntries.length ? (
+            <p className="knowledge-library__empty">{normalizedQuery ? "No discovered sources match this search." : "No sources found at the supported locations."}</p>
+          ) : null}
+        </div>
+        <section className="knowledge-library__editor" aria-labelledby={`${id}-preview-heading`}>
+          <h3 id={`${id}-preview-heading`}>{selected ? selected.name : "Source preview"}</h3>
+          {selected ? <>
+            <dl className="knowledge-inspector__metadata">
+              <div><dt>Provider</dt><dd>{providerLabels[selected.provider]}</dd></div>
+              <div><dt>Type</dt><dd>{selected.kind === "rule" ? "Rule" : "Skill"}</dd></div>
+              <div><dt>Scope</dt><dd>{scopeLabels[selected.scope]}</dd></div>
+              {selected.scopeDirectory ? <div><dt>Directory</dt><dd><code>{selected.scopeDirectory}</code>{selected.scopeDirectory === "." ? " (project root)" : ""}</dd></div> : null}
+              <div><dt>Source path</dt><dd><code>{selected.sourcePath}</code></dd></div>
+              <div><dt>Availability</dt><dd>{availabilityLabels[selected.availability]}</dd></div>
+              {selected.viaSymlink ? <div><dt>Origin</dt><dd>Resolved directory link</dd></div> : null}
+            </dl>
+            <div className="knowledge-inspector__precedence"><h4>Loading and precedence</h4><p>{selected.precedenceHint}</p></div>
+            {selected.availability !== "available" ? <p className="knowledge-inspector__warning">{unavailableExplanation(selected.availability)}</p> : null}
+            {preview?.loading ? <p role="status">Reading source…</p> : null}
+            {preview?.error ? (
+              <div className="knowledge-library__error" role="alert">
+                <p>{preview.error.message}</p>
+                {preview.error.action ? <p>{preview.error.action}</p> : null}
+                <p>Rescan sources to check the latest file and obtain a fresh preview.</p>
+              </div>
+            ) : null}
+            {preview?.result ? <>
+              <p className="knowledge-library__hint">Read-only source content</p>
+              {preview.result.content ? <pre className="knowledge-inspector__content" tabIndex={0} aria-label="Source content"><code>{preview.result.content}</code></pre> : <p>This source is empty.</p>}
+            </> : null}
+          </> : <p className="knowledge-library__hint">Select a source to inspect its origin and preview its content.</p>}
+        </section>
+      </div>
+    </section>
+  );
+}
+
+/** Searches the complete bounded inventory's metadata without reading additional files. */
+function matchesSource(entry: KnowledgeSourceEntry, query: string): boolean {
+  return !query || [entry.name, entry.sourcePath, entry.scopeDirectory, entry.kind, providerLabels[entry.provider], scopeLabels[entry.scope]]
+    .some((value) => value.toLocaleLowerCase().includes(query));
+}
+
+const providerLabels: Readonly<Record<KnowledgeProvider, string>> = { codex: "Codex", claude: "Claude Code", cursor: "Cursor" };
+const scopeLabels: Readonly<Record<KnowledgeSourceScope, string>> = { global: "Global", project: "Project", admin: "Administrator" };
+const availabilityLabels: Readonly<Record<KnowledgeSourceAvailability, string>> = {
+  available: "Ready to read",
+  too_large: "Too large to preview",
+  symlink: "File symlink not followed",
+  non_regular: "Not a regular file",
+  unreadable: "Unable to read safely",
+};
+
+/** Explains unavailable candidates while retaining their source provenance. */
+function unavailableExplanation(availability: KnowledgeSourceAvailability): string {
+  switch (availability) {
+    case "too_large": return "This source exceeds the 64 KiB preview limit.";
+    case "symlink": return "The source file is a symbolic link. Its content is unavailable for preview.";
+    case "non_regular": return "This source is not a regular text file and cannot be previewed.";
+    case "unreadable": return "The source could not be opened safely with current permissions.";
+    case "available": return "";
+  }
+}
diff --git a/apps/desktop/src/app/features/knowledge/index.ts b/apps/desktop/src/app/features/knowledge/index.ts
index 0fc888c..1c16543 100644
--- a/apps/desktop/src/app/features/knowledge/index.ts
+++ b/apps/desktop/src/app/features/knowledge/index.ts
@@ -1,5 +1,7 @@
 export { KnowledgeLibrary } from "./KnowledgeLibrary";
 export { KnowledgePanel } from "./KnowledgePanel";
+export { KnowledgeSourceInspector } from "./KnowledgeSourceInspector";
+export type { KnowledgeSourceInspectorProps } from "./useKnowledgeSources";
 export type { KnowledgePanelProps } from "./KnowledgePanel";
 export type {
   KnowledgeDeleteInput,
diff --git a/apps/desktop/src/app/features/knowledge/knowledge-source-inspector.css b/apps/desktop/src/app/features/knowledge/knowledge-source-inspector.css
new file mode 100644
index 0000000..88049fb
--- /dev/null
+++ b/apps/desktop/src/app/features/knowledge/knowledge-source-inspector.css
@@ -0,0 +1,71 @@
+.knowledge-inspector .knowledge-inspector__provenance,
+.knowledge-inspector .knowledge-inspector__notice,
+.knowledge-inspector .knowledge-inspector__issues {
+  margin: var(--space-3) var(--space-4);
+  font-size: 0.8125rem;
+  overflow-wrap: anywhere;
+}
+
+.knowledge-inspector__provenance { color: var(--color-text-muted); }
+
+.knowledge-inspector__issues {
+  padding: var(--space-3);
+  border: 1px solid var(--color-border);
+  border-radius: var(--radius-small);
+  background: var(--color-surface-raised);
+}
+
+.knowledge-inspector__issues summary {
+  min-height: var(--control-height);
+  padding: var(--space-1);
+  cursor: pointer;
+  font-weight: 600;
+}
+
+.knowledge-inspector__issues ul {
+  display: grid;
+  gap: var(--space-3);
+  max-height: 12rem;
+  padding-inline-start: var(--space-4);
+  overflow-y: auto;
+}
+
+.knowledge-inspector__issues code { font-size: 0.75rem; }
+
+.knowledge-inspector__warning {
+  padding: var(--space-3);
+  border-left: 2px solid var(--color-warning);
+  color: var(--color-warning);
+  background: var(--color-warning-muted);
+  font-size: 0.8125rem;
+}
+
+.knowledge-inspector__unavailable { color: var(--color-warning); font-size: 0.75rem; }
+
+.knowledge-inspector__metadata { display: grid; gap: var(--space-2); margin: 0; }
+.knowledge-inspector__metadata div { display: grid; grid-template-columns: 6rem minmax(0, 1fr); gap: var(--space-2); }
+.knowledge-inspector__metadata dt { color: var(--color-text-muted); font-size: 0.75rem; }
+.knowledge-inspector__metadata dd { min-width: 0; margin: 0; font-size: 0.8125rem; overflow-wrap: anywhere; }
+.knowledge-inspector__metadata code { font-size: 0.75rem; }
+.knowledge-inspector__precedence { display: grid; gap: var(--space-1); font-size: 0.8125rem; }
+.knowledge-inspector__precedence h4 { margin: 0; font-size: inherit; }
+
+.knowledge-inspector__content {
+  max-height: 32rem;
+  min-width: 0;
+  margin: 0;
+  padding: var(--space-3);
+  overflow: auto;
+  border: 1px solid var(--color-border-strong);
+  border-radius: var(--radius-small);
+  background: var(--color-inset);
+  font-size: 0.8125rem;
+  line-height: 1.5;
+  white-space: pre-wrap;
+  overflow-wrap: anywhere;
+  scroll-padding: var(--space-3);
+}
+
+@container (max-width: 22rem) {
+  .knowledge-inspector__metadata div { grid-template-columns: minmax(0, 1fr); gap: var(--space-1); }
+}
diff --git a/apps/desktop/src/app/features/knowledge/useKnowledgeSources.ts b/apps/desktop/src/app/features/knowledge/useKnowledgeSources.ts
new file mode 100644
index 0000000..931afd1
--- /dev/null
+++ b/apps/desktop/src/app/features/knowledge/useKnowledgeSources.ts
@@ -0,0 +1,121 @@
+import { useEffect, useRef, useState } from "react";
+
+import type { IpcClient } from "../../../ipc/client";
+import type { KnowledgeDiscoverResponse, KnowledgeReadResponse, KnowledgeSourceEntry } from "../../../ipc/domain";
+import type { ApiErrorData } from "../../../ipc/types";
+import { IpcContractError } from "../../../ipc/schema";
+import { errorData } from "../../utils";
+import type { KnowledgeProject } from "./knowledge-types";
+
+/** Read-only IPC boundary; a changed connection key invalidates ephemeral capabilities. */
+export interface KnowledgeSourceInspectorProps {
+  readonly client: Pick<IpcClient, "discoverKnowledge" | "readKnowledge">;
+  readonly currentProject?: KnowledgeProject | null;
+  /** Pass the daemon instance ID or reconnect generation when reusing a client object. */
+  readonly connectionKey?: string | number;
+}
+
+interface ScanState {
+  readonly client: KnowledgeSourceInspectorProps["client"];
+  readonly projectId: string | null;
+  readonly connectionKey: KnowledgeSourceInspectorProps["connectionKey"];
+  readonly refreshIndex: number;
+  readonly requestId: number;
+  readonly result?: KnowledgeDiscoverResponse;
+  readonly error?: ApiErrorData;
+}
+
+interface ReadState {
+  readonly entryId: string;
+  readonly loading: boolean;
+  readonly result?: KnowledgeReadResponse;
+  readonly error?: ApiErrorData;
+}
+
+/** Keeps scans and explicit previews bound to the current project, selection and connection. */
+export function useKnowledgeSources({ client, currentProject, connectionKey }: KnowledgeSourceInspectorProps) {
+  const projectId = currentProject?.id ?? null;
+  const scanEpoch = useRef(0);
+  const readEpoch = useRef(0);
+  const [scan, setScan] = useState<ScanState>();
+  const [refreshIndex, setRefreshIndex] = useState(0);
+  const [selection, setSelection] = useState<{ readonly requestId: number; readonly entryId: string }>();
+  const [read, setRead] = useState<ReadState>();
+  const isCurrent = scan?.client === client && scan.projectId === projectId && scan.connectionKey === connectionKey && scan.refreshIndex === refreshIndex;
+  const result = isCurrent ? scan.result : undefined;
+  const selected = selection?.requestId === scan?.requestId
+    ? result?.entries.find((entry) => entry.entryId === selection?.entryId)
+    : undefined;
+
+  useEffect(() => {
+    const epoch = ++scanEpoch.current;
+    readEpoch.current += 1;
+    async function discover() {
+      try {
+        const discovered = await client.discoverKnowledge({ projectId });
+        if (epoch === scanEpoch.current) {
+          setScan({ client, projectId, connectionKey, refreshIndex, requestId: epoch, result: discovered });
+        }
+      } catch (error) {
+        if (epoch === scanEpoch.current) {
+          setScan({ client, projectId, connectionKey, refreshIndex, requestId: epoch, error: errorData(error) });
+        }
+      }
+    }
+    void discover();
+    return () => {
+      scanEpoch.current += 1;
+      readEpoch.current += 1;
+    };
+  }, [client, projectId, connectionKey, refreshIndex]);
+
+  function rescan() {
+    scanEpoch.current += 1;
+    readEpoch.current += 1;
+    setSelection(undefined);
+    setRead(undefined);
+    setRefreshIndex((value) => value + 1);
+  }
+
+  async function selectSource(entry: KnowledgeSourceEntry) {
+    if (!result || !scan) return;
+    const epoch = ++readEpoch.current;
+    const sourceScanEpoch = scanEpoch.current;
+    setSelection({ requestId: scan.requestId, entryId: entry.entryId });
+    setRead(undefined);
+    if (entry.availability !== "available") return;
+    setRead({ entryId: entry.entryId, loading: true });
+    try {
+      const preview = await client.readKnowledge({ scanId: result.scanId, entryId: entry.entryId });
+      if (!sameSource(entry, preview.entry)) {
+        throw new IpcContractError("Discovery read changed the selected source provenance");
+      }
+      if (epoch === readEpoch.current && sourceScanEpoch === scanEpoch.current) {
+        setRead({ entryId: entry.entryId, result: preview, loading: false });
+      }
+    } catch (error) {
+      if (epoch === readEpoch.current && sourceScanEpoch === scanEpoch.current) {
+        setRead({ entryId: entry.entryId, error: errorData(error), loading: false });
+      }
+    }
+  }
+
+  return {
+    result,
+    loading: !isCurrent,
+    scanError: isCurrent ? scan.error : undefined,
+    selected,
+    read: selected && read?.entryId === selected.entryId ? read : undefined,
+    rescan,
+    selectSource,
+  };
+}
+
+/** A preview must retain all provenance from its selected inventory descriptor. */
+function sameSource(selected: KnowledgeSourceEntry, returned: KnowledgeSourceEntry): boolean {
+  const fields: readonly (keyof KnowledgeSourceEntry)[] = [
+    "entryId", "kind", "provider", "scope", "sourcePath", "name",
+    "scopeDirectory", "precedenceHint", "viaSymlink", "availability",
+  ];
+  return fields.every((field) => selected[field] === returned[field]);
+}
diff --git a/docs/codex/artifacts/xirp/knowledge-inspector-desktop.png b/docs/codex/artifacts/xirp/knowledge-inspector-desktop.png
new file mode 100644
index 0000000000000000000000000000000000000000..44c24af26388a10538aa6b02cc7dffe4dbb63e31
GIT binary patch
literal 104620
zcmdSBWl&tv+Af#`0tAA)LvVL@2`<6iA-KCIxVyW%ySux)gvQ<7?oQ5}TQyZv^XIF&
zQ?vi2>D|40?N=UoSAu`Yh{8f+L4Wx00ajd0SpLHYaH$U;z`CG50k32=xOaW{fbc<F
zSU}Mw?PUG43(6uE#Gha!^cVs}C<Gy24TA3V^>ok~9L<ll^?z3ke-N^>Y?F@D!N%zs
zsRg;E-gCQbhSS|iax#<g&&2CVKBiJ!baWyF#J^WDjOFj3zn54z{Se`|zgK+^LEyia
z=AeCX{=Fhk_0{e_Zz}))$D2Y@AUQBGGYz(p<P~P+6%?2l8NvVllAL!+X=!OKTuWSB
zO9KNTSXfvA&tm(i*r+HJWb8ybYdkG2ElW$w+l^@9zt{5f%cH%zy1Jc&gpEy5ad7nS
z-x*m2%pj0HxFZUFCb@};s+u}u!@q5d@i!r3rvCcQ#5{*S7hRAQ5!EZ;7dto-f(Z9_
zpQCYLhkszc%Zf=M%|&BD{9B#=c2qCozkMZ#QC3cvp0*u2f-)0@^-Wu9^5a%U8{7K#
zjEum*_S#&j8C=ljB7i%Ki%pyDc9H&bp9ThNVL=`=a8qVQLP|<WZZ6fod*m7%93153
zXTj@p0|aD5L?9}ai2iQC6Xn;``Kv+V`IkZd;J+Vn&>0}`Z-I!#s1O|ges!KQ#?HSF
ziB{K(68iU&ng9RvP17g`bk7gd&dXP*56B&jNl8gdOR8HMr>o8%%3IveGe8=m5jeL+
zYR20I<357VwaKCXRyQ~(HG#f8Aj@rclXPQrw$?0(Lbs4FX$*gVq?5k5IBC6G!jgo+
zX;^iU-u8Z>cM+wxv2o6Dx^vKE*I)DL^NAl0r_I6CY~ds`3k#J}8TtLfH9DQIuWu%|
zCn<RyUuyHeZS?Z^Y8MB5VUyGAKzi$agT=~^3Qe^w{6+6B0%Fw?#R_5*leG>{<E5bJ
zK=?ECj?Asz02E5Y%`7j^zsYlOj);!_ezSbdX1(bjC<=AsTvIi43Od<QFUgCJ&gTDW
zx6{;;@Z|VZcXM+CgHC6;+`>XgX!{rvufb}K@}`!_>nZ4GU|`U0y6x6hrq%d%ylAa&
zU=SW2?tcy*dNk7<%MUz-n|ppg`<<m=!Mo2I%;r9XP5j<ue$h~*(_06Y100`xaX3Uo
zL}+OzlE}5&RHdZGBGOwkc)X*dqc5iyo%@ES$v4|feVdapNfW5GympV2?vLh0BQOe@
z(%kRQ&zD=@&(>S__V(f_m2ud!GX4Gi9~O!g3Y||@UeD4CftV|fAsL9kOy~3FZC>W{
zehYgygTey&6$BI{BqUT+SSgPy8zl#=4TPm$yuCillSob^@j9Ni+!{}02(6Na;Zqq(
z#`_}!i7+ex2Z<P=F+cL@^%X%RL@V6NI1|R>f}hpG(&A!sZf>rwu5KsKa7X?kF(ZMt
z0~-S)DDj~Z6egR&efm85E0#?5@bECuKY&pF=vwmq;lV|~uJt`g&LD%=Q@Nn7G$3H0
zc-C0G-ZU{OiM-Lz<ME2cbZv-_K=-M#GaQQt4VlN?VKSa7amJ~nX^g{uKUbW+kkMla
zK@kQTTIBil_0`{^xXI>ks&I%=H?eblxq%l9%w7GgPfA7wrFeJB_bb?LcjRZRpqyDx
z9)-BLIM~y@5c_Y0V)sdHczoWK7R%?ZkFSWtS%RCq?U!i!g`Z*2`v=J$o*~&eIfrNr
z=Y|l;WHMG7&wsJ67dp!t26At@Hn*zO);`Z7Ln*55y@5eCT5kTvnG0|<x7(i(=uo|d
z__uA)@R5I%%--o8*sZ;h7=|8WQ`xNJ$(5e2jX#39wK21?;WJp6L?j?!V?V!n?h#F2
z?T)%%&KOB0C8t2g%<1jb?Z`L!Lc$*&A1Bi3z)gonL_~lD+uGWmZ}G`Jli95Cq@~BT
zTJO?$?VU#V!tDemR1#g^UcR5-ZzQSKy5+Zf3J{VhTG0QkWz&(q0uz}SSXgMZnoz$(
zA}2-LG#ebEOU;XMXtvS|6WJLopDMj6y%Uo;aX9psfN0)ub)!{p1E&LuFQ?N1fi@p$
zd2&q5Ott+YPzcnRylK>GgbOFuNu|;(^z~n+7tznrDCAYG!gaLvQX8%NztGUo5C$rm
z{^#4_{ef?fqdjdg?QLmlYD%d;CLCk8+fnU@Mm41RLnAplCJIGNLPDYClU^RqUhRA@
zvmBTm{86OC<1qrC>t$znw)Or@r`hgydVA1(p+d+h-zao%CguKYbFd^mJ#D4V%0IDG
znf7?SQ0M()a;L6=kx}yCh=f&m2{p2#kFW1w7_Rrjl-G_Sczkiqzfj4+hsNj5@{5j^
zi#%JWx7|5lV91YU)6u>xFI}wI>I8D|9-kZK&E;!K88<<&(1!QJuQHf7eSHI3&9;Y^
zei)RqRcGD(iFL8jo9Fz=Gp*H7G)DnFe*Rzj*n+)1NJxz5=aq`pptxb={vHunY|4d~
zBSyIn%TdxkR(ubSy>T7#9ls-3(tibBfIc=?v#}zb&3YLN8@tt_f8;yNUUF*k^78WI
z<Ky_7=UK-qq@a*ceO=8-3nEc~bP~JkQ5~k3=fS~28jmwC3yb5~dF{o*DVMWMI<GH#
zk=iV&>O-q@26>rUZotXO5N>j6s;IDVo#|qSQ+bN5?PcL)8tNve(}_zU+$l6VC9%eP
z>FC`2JdJ8qS5tLv;pBtm;u#N%`GQTQw)Bs1%KvMf*}yu}s;jG$#yA|0ZZw8ZnI+Nb
z#!}gsGPh4(I~+@u=S!RQ)DO!k%GDc^SRHH9%V~O2k;!C}laiz|S@ZpOo+>uI(j$U_
zWy4~#ovt?mMd{^up^Q?yE$QSWNF45DRja_^5FX!Sp?tFm$WCJUpW`p}&XpO_a&kQG
zx3JLA3FVa|jM)Z(cls7gwljv*qCdhzV95UMqOD0^e?Qa_2?2fIaCOkdJ^wE~Lql@+
zT4~m(aB)dlm9|h)A|fJs@}a&Zj7wS8S~3z6V0TxSmM}0pUTLvV6CW+#7XH?|X!Vpv
z-QlI_UZrA8Y;0^SG*X%4<Kz9w!A#tDrxNGZIWAdi>|<^px2;_>j#xf#I9^A!*Kgqk
z1qBb1xy!S&vkI^KCW@MSjgK1WGC&u2w@swgNoF?<xyesXUQU`O(qOhGMewBhPw&1t
z$7XU<G+mVU@_IX7uufujHM`XBf7sr>8F!KW*XCcJLr`cHTk6bb3&J5`Pa+fH@qY3S
zvvQLDeCZQsF`KtsDcik5E$xF`B_$<&eOfJ3cRW%m-(xVjn99l`u>CTb*?GXH`vbM{
zsHn|#RJod-nAmXVp!$r(OzFOe!)`9=;J^gMYOStWFSlTbfW>;b#jAIqRJl^l!|?15
zmn)UoTrOLF9xlCQ&HI9%IxILio!-_C=o7~*Cd@$9_!68v+0*W^OPO#dbv1fEwV(KA
zFeu#xz9;wyR7NhRGoZi*mZ=9R(P?xbkt|7BP%9HAY&N@BdInCQQYv?AwBDbfl9T-h
zz)ZvUP4Zn2Qd*RiGd$t5n+&bD-VcW1Emvrz0wGhb+KgpwxzhI7)h)C=7@p2&J@E|B
zTl;fTAiLAMi|!TD1Nw`AYkvqT8nvd!!;oAY5sur-1MnzwpYD&H-+I2s!6frRBJCdU
zHyRx`MBuLMPiA@pa6~qfH`cPZ{rP@>EFC}y?e*r$K*mJk@z8Q`V4fbb>Hg`LOmx3L
zS}ryiG#Hc(!(f1p-`?J?uFKn@<IBOo!0`L2`;CDRaW@o=jzXcuVG!=L#%ycGXtdh2
zT%!?-&FSX#86E-_lTz#xhed0Ce*XaMF*o<xKAo!H2XTV<OFNc-5qu9s{ozpcc6WC-
z&^o^>{-W<1+$Sm!{fe(#EdO1x$##2hi%2x!D;`kC3yQO&GcwN9OLh)p2m6*QH=BOr
z3;_)&6rFCNO-%tE-B?mmGOkj!Lov!w5(EM*ST8+*b|nw73Z+tj{QHGUsAPA$;<yu?
zXRU|&VD07xp<g~vl^E)O&ga43@^dFhFP-yeff2B-C`6!-4SBUb-JJPnK_L$fkXvqL
zv_F?BR?Ovz6A@n9HsPYtsbQhul$Ga`d?^J71M`(53XH^K5zI={{SO#@=LPfhL^jx7
zZ9K=o#<o`N6p@uZPdDC!ztNlOG`q!;(w(Zz&W?^sV$bsC)6v<SHW=8-2YOSs5QIvJ
zYWL_Uwj(q;Ej4YqW$FT`FTQk9xk8=hZ9zv}J*6Wf!yz10>8rXw8Tmdy);G#ppuNs{
zf405}wDp!-Y-kknsd97U9S?4v_6z0cZ#n>M%@f;e;cjoM*`$5;`P}~{pC$~r!o%Bb
zua(=M!uu>y%#|zmSZ!aLSdJHfbXXZ1E3@4W$Q6y4nx97%V`<Y2{|iCiJkz-x(^wtt
z-n~2-4*1+o*d?IRs(QWACo-Q8y0u=~J>GWuYX^h;ulB}kO}C%07isA<>FJ1x9Ug+B
zF)=Ye!=NEB(xJj2BnF@$e8LtM?iCFi$>e+Qzc$X`_4-k!Du+7{0>{No$DA$PX!CNs
zF1UTX-c9E?zGt)E2s-`p^()FTI0Qs+_}uh_6t=L4aLBH$ZM8&Vah*SuF2Y>B^`df1
z_ye+cWVQW%gbJ+|dy}`U@6)Z*nJ}J7CO@UYe;y5A2;AxF?r5U(d<jdCEDjFNiG`&~
zxmuvhpT|&i9=F@WMQ?&5smx1_)jM27gE%M0aeyH8^$9B|%$A#>5_A5XNVz_^j6LOY
z0uudo<Mr9J*c3o}!{Xv{a?{Uu_%7Fb<sswjE(bQbq~n#^?MFc(Vt7{p^+Bg<jb7Wg
z*lcuKEp3+1PUz_9!awxwey&EOlZ$Rpl)@~<H6RQZsk4~l@OgpO9$_}lH)YdVa|L=y
z<>cgsu(Ce_6$)sGlqwa}KiODVP{oY?LwFBFf79#!`Sqr^wWZNuF~6{|QRP)09j(`h
z*Uss15)+ri?6sykceqd<S`hHF6)xRuzBtfDcjCMjd|1ga6m8-i1!<;UBl3G_VuSfA
z#33Rw^0uB(AW-_MTt^q2&)4aIW)(7Cq*G}%okP1#Dpj(lecczVAjY7kp^?jj%~n=h
zU5&@=axf%kpqb`5(;4_*EkJ9bLi_hfL<AfVHVBz%2~kn17m>%aJLHyxBh@zW@b}`e
z1<d9fM|<TO+XLYOZjhrEGfmSCma9Bwa~a%5So)m-utzX?jNwg97y|9!-~sF$X#c3_
z!6uV+cT9C|Ak3zapx`GY#({wWZ%QdCDQRgI7KZ3j9Dq5Sm=u-2zH?2^&dkKb!~o&$
zha({^**il`L%p*an^aVsolR!%9!cPehqdBcbyOOvWRblzbZ~$H6Uz4*_X5<(-rnBv
z@$ve)I`DZ9p~lYZn}+HMq9Sx&mtTLA!OH{!0zv}%_V)7&#gDc!n5{lGVfL)t@^XwV
z54HMFo}N4}UnqaLZDC?jpl|&O2ncupXC0yV-|W>zb|P}ucXF_)$z==weqxr2msjB7
z9{lrXNJwuau}|Wz=lA$K(10WW(4*o9_pxO$85ytrLz11oPA}rW#P`+lt6fJDz3Y>T
z_vj&45Bt?jym`njnN0d6JQTv)-v)dQ52e`drF=Sx$jA3yIGGVTD+_$s9Vq_-pL8`}
zpgS`HkFWR#;TymSzkCVy8Og~txI5t?-w~FH{HsIc;3N2^d5d}ozT}Up_~VPb>$q`n
zaTIC4x7KYg^8Fc}r4x|peR4dWFD7{j^sJWznBZVIo|TCS!ArWG+ke*htBzDAji4xT
zY00I3wV~q(luxBps>nz`rPJyKXcjAX>FyPpt=aj-YJWy6c|Vu0R_!hYD_C#1adM(e
zFD`PqzkvoLJJ4yhH(KATCI=&FCuCY$IEx;i##b#@oijP@X}>X+6ou9T+p8M%8MO8y
zs^dKe^lPma4`~aFHGn2tT9(n+y?55%pYc)4H$?%RXw_L8=)ZJIC4JBLyZ|h`zPcJf
zdU*u{%D}YPoX71GtVBd6`{_RZpOcfk;%o-vjU38&Dl;>)jShSGRE3p#loHF$X7pZt
zBBI`9d-S8jUG+w<>)L&~YLRBzl`7LxfR-i~7gMHYMnw^<zExF0)m`+Ds;oMllxP&9
zr2ra^xk38lb~l^VhS%#}y6?{YujqoMYI8a_YFgHb;o+_6?LwfLz(YSd9N(=USt(u6
zB5~ct;19RBJRVJ~Khx?oqoJdp6Jy%svc)<1%=L=OvRbV;-M#onP0`;}B_xnG=udX|
zy5HftJzP|0WMnwLc@#OFJW%vE=&885d-K=gbGvC43%WL^=jY}UvEumy)MsI4fmYYJ
z^d>6GQdZUFp#j$&4u{jnxxD;3H3_3IFVC<RChB|KsXPv=^`@&nVQS-<$IA{yg0+cB
zQbNYtaal79cL@M(G0WGh-OuMs*=#(PS4a5@ksiA&xtt8-n(g=RuDs5-w52us@6uc0
zaX6ped?RBGqBWcCPFHH*uZ;<<H^vH!v&7M9wJ4Nonr_4pj?ejA9v(vzKSM92h~b&!
z-dq6OK^`a;Tvkd{FgKG=0aoylLCg%SD047O99R1K`gnY<tR`J_xT}pEb|;4V@<`Cm
z=R7}Z1D;Pd3!2%vv|DXqNP@ov@6&49m8u&Z?bu@cI@@T)_Xhwl1{$mN0*3J#g9x|t
z8xnMH5B<jadX@INIP!q5Nrari+1lRg^BprIa~iW3vmjPKD}mLr_aB=<ILn*c8$i1Q
zq#ETWo9y6iQKDbnQ#hyqBXT-fTP@P#8D@k<;5IQe#l*xWl<8`v({8`Jaf@VNDA;Us
z4HaMt=+Dm9%O=#@9*iJYs__Hm|G;=6qWocdy}Lr!fPkz(7T#OL#!E=Z!J(#UAulg4
zsJ{n`hfxgNyq~zi699K~ez+S>UnX@ZKeT~Dx98(;Vs1|6W2gnCa$(iU%OiK4UWl$w
zgF<-<PBGTx{GR>$^;s&F8?U;rbg@#-<>I1xXD9B`AfVBF_GoI$pd%(jZiV$^B(?FJ
z*>a}JInpYG3kEfV*WK%U1B|*;w(<;W27#5Fhd7UskrCmYofA#KeI${p)~h!mZ)fMk
z`8SAg>l{65aK!AYkHN{Q0WuN?x%9h;$d?$g?efCKxL|`oc<hHiTiZoNCd=Q~+u#2T
z$L<S3-k+})4&L%%1&~@UwT<`pV?GZ}O#B3*pPX8A2(O(|dFW(A@NR~P&>or9ib8P+
zFZD;U{%5}qlg^pm)Sw`8D)#hy*$o(epPjTlwzOjvNkAzp+Ee~qxM3TCPgcdl)BbrF
zc5Ql^0b_r@SgY1`Rz$xZsXx>pEaJE6al*KEyH}_!VGR{KdITm=#jsh5s5T6*j>cDG
zNJ7wQjw~z;=L(eU(}G2bvr;8hgcO8SRM3T-n(GbH+C2x)c-vdV@zs*pWbypKlW?00
z7OgkGBxjGd#*l;(P5z>mE=7|@945%KwR3p*vrPpjA{kE}AgmxJMlLcr6WFv^p#_F0
zcWb8P<KtV~T)$nKTDjzP{PIYpQlgu4k>y4KE(3eCC@|ACGE!rGex}O)b8cZ;z#_nZ
zXu;#@<h!q%<JC^J;3zhm*~Lxd@iGdR03{6z3l9$uBPH~5@R=4@a{^^@b6Vl#G}98|
z-Q8#U(NOeCzp{8L4G3vL#oVUa3)&c&+vEA}v!O&bS;xkbAvGgMv7o8bL({{0bGL)z
z<6Mog@$nar*V@g`AzEf;Kh=x%U2(LQa0PyM*Nlo@1QfxW;@dOTP7?*DB)=Xq!~x_>
zSS2^NoSJ63VN!6<7dq;XgskLs(OH0{utjhbye$xq!jhOsNeIu<Hx$Gur9~=*XzItx
z`SO)`T0pms$J+oXq*^!s?s(?=a6u<FC(b%80zP4RT=iulSur*?W+>Skm!pOA!BDk=
z@r2%owK`j&uui$8!J|=wQHF*A8`f`(GtaM(#NRR`A-u&gzDw-&N2#bQh>8|w?R=`T
zIN`EU)sP%j{JBH<dPo)4rVyh5K8!IpawQ2x%=^T{O^qWku}igx0~WHhyu!}K^^Ldt
zV&yRMnd*nM4$`TvAYCFJBc7d#$F9S*5rwB)JGFz)Jbt>aevCA;pEOK$odbGdb$Aj(
zsZ5k<mF;swxzpK3pe+X@SvWSUnDqB}Lxowo((1apt`Ay6DO>nj*$&2pg1wvBM9Gpu
zx<uNLNz$2OtXuDsbA!wh2n;11FyP7Uy80GzDG8L%3FgH}9UWfRXtXR$EVj;~2#Vr&
z>r+)Whb#H3SBDB>7llz2v&JEG(fuJ%kyQ;7k;+?H--G-;qAd&r1qI6tGe+pNMT-7a
z(h+ExOk55p!6;!aDY}>Szed1y_r5{sPib)dsN8Q~uSDRmaj>!7L37Kvt#@#^Yxw?h
z(>k=sf@mZRgxzy}a}x^-bA5T=ulaB_(3<T7{R1U+3i9$ooX-vO9ZUCq{}uqc?BL;b
z*^#aoE+!&{3{f%yI(noFgwSeNmu?^HgiHjKOT}he_>RyrV?~cnfx~re4nXm41~1UD
zpGAG`MZbUl5>s81#2NJ*uR{^Kwg*MrcL)&o{$CQsA*dr;bmZhNK%d*E(-y1|lvIEz
zMzZ}A@p&&{?IEwu(p$SVCS9pbRj#ol9&v1FVXQ#5s^Z|_T}O~qtyMxJ`&*t{3Y+;_
zop`TvhBnZeMToZ#eh5F&&T!4tOTtgD?fr!E91O!EZ6wFR6O%H9!m=Cu^7Jv8;ZRaI
za!E%5-WtG1Wf+*4`dzO#%l3YpZC0n}0rW`S#Q%cT7e^_tu+Vy?CD*8yH0YZI3Z2u|
z3~KeuWo#jkQ&|@?yQNN_PaGWTaB)K|mYV7VL>-x!W{oFx+*~`Y=W~i<6{4?8Y3FZ>
zXp3E8!Din&Zy1^B!y;vaLL=E2<M<G+_o_?On?Wz%N3GV{!fS6NQg?QK7~Zx>*PFQ!
zG&FnMwv>n0yG)}i+wO0?68b(7*2g3yyuJC#rYev7cj{f&ns&y=qt1}x&6nmI=kd9}
zec~WNL36b2X+Wn^SJcoj-%dF7KZRMSPy*vf22ce!cg^Anp<t`sty^^tZAuDOVufb!
zXk`OE`NM4UH9D8GStg%%htFpi-QQx;1pba&AS2;VmtVd#o~@luRX8eJ#^yU1XRpkg
zvuUQ`0)ToVqtzs1wajCgQ3C#p+?$8%HV9d}!!7(^XmF5?fS{^tamIPsxfmx;K~Sg{
zYp&Aw2Ww+9M}x|p7LK1v#Rk8Mxd~Kar6xMe_3kJ-Ha1y7Rc}uZJRa{ttFcNS4T&TQ
zpZ8@*0D-P)4a{&NpN_mf(wkb3IJ-qpOL(fWRC?ac#lV*B?bEoKQmG++3o_!gH!{Q;
zyWG$q{1jiLz{H}SiN@Tr=~m1xdw6)B^nS!?pIw;4qV-CM{Ucysc)B}_evwI7ELX7a
z2JNQAq*A##9ES;Fo11^FPpnW)kIvAuu$XH#W<$Zk!Xmh)x4+}gGpARK*T{{CkO73#
z1X>-E4Va3dg@pn+-<HsX3Vy6Xz)_H`w9@AY$cD$`7QFa%_|5+$x&{Rw?rxn;r{UG^
zmP(2G{m)kJ@T}K&&qLqN5|z@BABF?gokT6<@_F>y(8<H*gV*S^(n;I~dtnqa%j>1B
z*?TuS#s(|h**3ipj-4w#9<JBAZM=?8QYTQtQ2LF|M^jF{1(pg0lP@o77dFnwm9k1J
ztZEX@36Lo$DBO+%)P~#^7G>^k4#P)L2-yrvM1Zoj-hNLYxLJ|Tm8GQ9-Xz%|S^Z*R
z27vVrr){(xwLUwjPe!xszo5n!7p<@AHti0NT3TBP^AH&$$xkzQT29vL=}1UOc!+Y1
zu1WPtrDbL5t{HnKGxOQ3JeR>~%6Z#ctv8#E-@A#Ra;B11eP(*ONLla3lCQsOr6I0-
z`RnrWLHys?U<aEYGT?7KJ?Wfju-n~$L(DmvEedC^eLzG)M$Tu+kBN!BwcCxMiI&v&
z01H#wwOV^m9kT2oPrW0{(E$G7-bX+2WPsM(BzY)U)0rnt0gjD%cxcxi9TO8W-K@zJ
z*B~7Mnvh70((0JujrQ*%UCczkQYyhmQe}T4E46{bj$lJY&mU<Rl|O+L*t!tmyHK0?
zyUI%Ej1ATWSMb{&sfZH#Fa^#ur7#<QS84xlkWQG*pUhwzKWbLK)VpJ<V>FsCN@zJ0
zggf8^&ptgp@!CT9b(VH0&I$V4wVcFxc34|b92~?oIxfoSk;OHqH8*kP->ph9|Jtt8
zkpTh|Y$ZCKaDz^NH%FL{0D@zaywJGsKelOR_y4CRxot;D`G2(l0J{Ib`ST%e5FF>+
z?Vtaug5REG<tGUS0ZIF>qbMw_lbdk(QM*Fq-#`B6Chz~)E@u850|f*BenSE74M0je
zYpo8u*HbRKtwA(QOvj@!j($73^Lt2mT+iz}EfJA{-$J5tu>Ju56mGuoeZ1)22S{%Z
z{GZ#@MwQA<Me0e@&U9{1R!U0s_>>y={mO?UyAIdy55I^>$VL<X#3JEmW`RyNcZK3o
zQbLH90azm?24g@-D^o$rik!JSnaMYb=9LI`vT)kU%iAHi0684_#~oM3n`#-Z501xs
z>*}|!s2>g<C9t_?d@g@kIfZW2b$<)2Mna`}t5fgZ<~~gdtHIrdCnSKq`Wk`l2cd|_
z@ueg!srG-=)YN<#nLh?(5E>flnb}#P-kv_&qfr%WkJlG}d?|k2DZr`r$NwNQzI2!*
zCMmmFZ|tqFpQHLV?-g6>eY~))Iv;_v+<vX%;mEPs_RWJIV5*eZtT-G_Ab`g$kJ;U=
zeb0>S0Nv=kBc!uC{(Q+hER@OQa(GzUF=f)}aHC1c<Z!-x@t3rVM@B+69#<o1Oy1o6
z;C}aF^uwl#z&`5bSI6SkO=HYy*EX4Kr_1BW^t8axRyJsVKT=nm00_FS(fPMZ&sAlh
zDGY*7d^}&PwVq8l^>lMwoSU;)FKNE8?=cx08>>^6cD~&GrQ-&Z=L3L?FQ4B0!fwL2
zoX^>;RCRzW9@Ac3M?zF|zx5=&l6Jqc3~GPT_NYC;odxxnD5t7w$Wo{3L%};J@L=z>
z6{?6d0^9#HXcsUQ7cJKq9cS3>?U}Z8zVV28@oyg6JZTI&Wp#S%vNVoV<V!$#KmGuQ
zGmuQB)7S-m&{bDog2c#00c3P~vJ(Zc3Mp(%%$5YoVB~p!81xZKs|fq+;bDq}g+~Q>
z`FmXUw)3v+QI(4RzCLyiP7@Q8KWnTLwCC&I2W!otzXb$TgBqNE9{i<T>+bM4T(%=X
z1aWC#Q(t#=6A|j^fs*KmhzurP`oBY?GqSR}Jsb>ItUt@7ac|=z1T8c0U*5wnRk>nM
zh*&Sx&CkuDlq#1IiB+JlG#Ie0T)#Yyt~HNuy1LDmY|*ZN69>E7b~rq3y_X6LFTdVT
z<#E=NLpKJ*aWdIVq6Z2?ogWr28J>`pnyrZF*!u^n;2OkY6&TBasxr~%eeoDHTiWd4
zX!H!NQD=I6CnOrd=kY?^*sO*}MTPRlYOY<O*#gK8!envOa$i%c4A4`YZq~UfUmmZM
zQ<8=pn?RIN#NCI+FV4>qJkDo4{FD2`vCTVve!?d{uaJ>z?e2UG48>y6f`IM?cx{^X
z5+nk4KRvG-(g8IgcNgOs6laq>Q=!V}G<Atw2#?Pb5j8(CA)+HI+hS(H!rAE}hwk@{
zfuUNzQ5TXBjLCRIpZad&6*5T4!m@0iRy8dy?&aVTd8aQe9cLQw7Mf|bIzoE+?Lf^?
zoC+<fCveSAMZundxXveihrfPxf%-#CO^x<s;?JZHH=>Wlmt_>Vi+%)!hlhproi({U
zmbg2z9opG&;-@zlZ+^sC1ps#CW>voMrT&tkssD+)_$3%ft{n^R3W+2HAVk?ahqe1j
zU1ws_(!EGkk$_?AWAO#8B0s<0aG8?t{evuB<=<LUqN@FZuqCG2<iha;9*CcSfP&Iy
zcgtzZN67=153rQQCOsa=z;7T)Dk@0}s0E+Xo+}m>mMZz>CyL@?bULkajlzP6yZ6cM
zAV}5b8YBAfhSNBlOgiljRz_w7z6S|5@LfRE+UPJpKV;emM3LN_-0R)(&<Rlx3Z(d@
zKJB9QT8|gt*MG)31VoE%H18xTMoKgHy}@gG-V9(|s7Jq_=G8lKqsb9K057LY^@aNW
zS4Fu?UqC(he6B6__u6^XIJhByJ}lMmcg2!TUYzO?FC&_40JSgr(CvCpYpdrjAjUxc
z&ZZ}EEa9}3R<j8Q9Y2snw_2ieBoDS%`DER>Nbs=+G+KYmwk=j$SNDTk_r`8l-ZOB-
zv)uFM7MaVYJI6?DNH-tw#|GPG&R5HLDYQ4v8_$+JA1)a9-uXT7F01<&>w(7PE#M-Y
z7hIj4rR~z3Vg~{7^ce=Fi?3I3@4JpIfJg-QvUYw73-8Q{1GXI=A_9V6mSB`-?Df_B
zv6rWN1Rjeb4kuKM{RRdfi}ixbO5B(4At>7QPGAXu>gWQ9Ew+yj&YUzXu)iTm>GivY
zM~9IIb=Ly2X*Q%KCGT%<WyQoWn9MLHtSHODFsO7d7>qzoPL}E!oi=J#$Ri21r)$;e
z`TqTRmj)wov?O9@tKD5H4RCus%3tv=Mxz8?>3>(_LRZfNY8xi2OIMgFG9uS{i=&DY
znx8R-{ao1=@9`pqqnRtgW<04H>A>=2M(0DmY-9pWihfY1Rd0fwk>q3&=f`)gMm?s6
z?@okj<)2=ayC$qg@~Sa(EteaRkCE6ER8*XMmZIC;9NO>yYysH+YIhtND`3(fk3bw<
zcOHt6xYm7dG*Kl=^NVj9n487P!4{MOJ#?HF*MJ5_wX2)E0ig0aFR=tg_>KJ;2N1Hb
zs3;c$#g|lFef_Xyxd<m#GgaBN`;FJYaICphZarqRv&1z)g8VvO5!2VFJ1kbi4<e>O
z*dsW%&$LslbJg%rw0h)2#y0`D;s>wY62bB=4u{(}dU}(Gsoy5>Alk6=S*95yD#K05
z5CHcc&zJi*ah^_!BIe-MxsDC#v1|7B5+QWt*i8M>v2kfMSupIP^Yr866+Unc>%r&o
zqMQJV=PW>i2-He$*y99GeiPOM11Zabkw;b$-hJF0sKBJd&r=bP8XFJRA`R^6rU!AA
z7DA|;h)ix@W;$Mz12#H3Yg<B)fX^4ddZ<po*9?J%3X8<!qY(RK+6Mv5Jt>feA5T@>
zHp3($;1078*$=qGhoDn&T3)%}a7%D~bhH`T+NSqB68?I*Pot^cEbpJpM7p}NLXaW)
z`D8)E`Rw*&!*yUT_`n974Af%;UpOe60gE@)2rv(Tb)a?D$9ctzZ<T)O4!a>KsD=SI
zf|QDIDq34isRO$_tg5dyozFR(>VEy4e6Eq7iIOJKg)ZoCXXKU6`$flArSdha@jC!X
zJ0k>S5~ARG_(dCtIY>x2I5;>tv9kNKK6+}UrT+**uBJ(06JYIK8!NLfbOKc4Tm%D&
zdov~65R`%9OU`<;gTq50*Q!<J(9_mnVPHf*?|@S(4spwc%+}4Xl@PT1diMj9Wnp?P
z5Abaj5i+qNuvJoF7I6#RIX0|VTd-KZi0}*F7QMc*)YUsOGqX52I?|UrV4rVzPnDSx
z0d2UfNbj|UT`#OBE-voormpJ3CNEFD-bA@m+p@V||A)`iXR-{*c<SHNvL<3h56Zqz
zj@NtRzOk()*-Ch$05r&kn*gOIr*ypkA!>~(Q~oW7l@K;wwxx|L#C(G~z$|uKXSx0<
zHTXk;={Cdx?ALOD@wT@yW`4YQYnNSLVbSSy4K$TKzn@`xQgsKIZ?%>ZrAptjTQe-(
z9*BA(qINqRYXP0^`2On7$<{Vzp<CU-kx@Z)>GMhq)6*~J==AjR;NW15dCIr9-!-F(
z>YV|iEPg^u6^s@6Hl$psJhYN4u{Hh@@RXM{Y3~EBp38Me++I&OqoQ%4wI>(?BkTT^
z5_A+L;kOb<a5etBqw$BUt&pt9-a}s=o}MK+1+Z~_q@YOO>ISZMZF;mVzVd#KF;9rY
z50roCBV1!)dbLt1Ak-9&L0IOy(VNbhfFhjAD`N!@7v}f38VrW_AnxA@#sSwIipl=u
z^B#%+3fe}tIRM<5daLEJp(zCMU^hoI3d>-jXhGHD>S_jFWi>~^=$<>1uTGqB+1#$w
zmn=S!s4^NJF&<}S)HH(;SOL}_JU!cI@+G%=bD9#=S=OteaT>+GhPbO8sw7jQz$f9H
z{#dSLIb>ugFaAwOWw|U!7%Dr$B|G`@c$JOwTv2B(e)-7&K(*i7$jBtSyEEzkB+wKq
zl#&L}!JyF%x_lCfg}6O}ieV}S-Kzh()cMGzAz-Hxd1AW9t(?%EDM+72sZwwgTR2HC
z59qD^MO(g?3xKV}@T=AHd6Wr^UKt^m;H8ze{g<$5`hy?%4u9Qy6Bd~@9u;9A<GBnR
ztVaFM_GrDmCK^ss5uD<z-K9F<?yWSc0R)UV-7zw*ZNS?HI4^o;6nR8Xey(vZAH?zj
zCon8<*!f1=A<RvBA5~qZtY`6J1RmTaB}=Dbrfz1a$Q&RsGhSCyBe<#msr#$UjlM;o
zUZ#0*OzS;vk#@V8p|D~1CntSrU;u#*nRH+n+F94&E;O+sXP4c7GhgAkRK=P={rc|h
z7xJB8Lmo|^{_Kpre<j0PF6IE~!0#CB1pt>=1f6IGc*Cg(tKlk292@L^)6x5RM?&8<
zrHSP{JkpVfvXykQ(%ifDIW!dAJ{s*Cna!UmM87qRVxr#!>z^g`B&&_5Pce!M^Yc+@
z4KwF$$^Ex+qLFw_f>8a>Kk_7t?p^B}89m;W8!Kb`sP>543AKqm=_Qh^k3yLeqx<In
zNgB-l#?!1z+ngd9{kuES9IWOL-1C)=3tci+o4uqwpGIs$^zLD(8d;2OD{JIP&Wn^0
zGW+2+=Rv6;|Kwumr`!w}sVJA?o%v~LoR@qRm*G8b$Gs1q=iixR6#5}KT4H9DcZ<fS
z>svt#SEBr>zY2fZdb2UU%qpPlAQM$x1VLTKIK0FH&@K$QB_RO~)UTKmG*lFVN=+|U
zt^e5m43A2!`r)0`KqM}XN@HMvv-4*8!?#P!dU=WCKb!7hrd1-g1gO#1gZ=udz6vD(
z=ctVZ|5+0i*@MqWBN~yxPtI87jlbNmCH!_EC&aMQyD}(~l+$EL+zk}<l}hVLi-nAF
zN<%d@^*<g=18krraz;iZ&(JSv?!16UHG}&-v_&@x7@xa;y43(+o7!&KPS&;DHQ+Ti
zur3@xLI(EG>9j|LL^M=aqrLr<xG$ir;Vg>l5!oG09RygwSG~)b{oKkmmY<tnwH8Z^
zY5_+zR0X03farj%He2hi;`a@3UK4obXs8}g2<8^&=f6XLAG<Sj#0jY?EW6(KetinJ
zh_b(3fjyxnR`p90k_}lb49<g$pMk9&vW)m6s;=gQZV0xVIyCl&ccr_S`@dR%`peIY
zmzCJT&Xq4}0({`$5aD<nD3_>MZEmL`N_+B8N~E4D3X)6=m+#B{fIW4Rm@tc5@(pM?
zepx29H~As0zQ8PsuS@gF`xZE{%)Y4TAh*|*!|u`T+5Gy>L}ezg`&&;w)q_f#t^n89
zj((<?d<ir@*C)U}L;A_*u=5b1<u0e1<5GRhW)*CZD;k*zNDC;Gajv2tueggTD1aZ0
zNO$xLFn_c=T_s<>hXUhy%4O<go(}bKGn`PwcB!eE9PS^ZMKnFQu}F6`gOU1WGTVQ}
zb|(QUSi%Dr>ZDHFT8BLy>)=dJPL!uWGgBo+F-3~HI*4Nho6S1(dZat~9G(}yAHOvy
zI9RRS%7Fh*X2r>f7ivvaG%%=q;A-(xUw&r!8hyHv9Njvj+5O&&L7cL8dHC`s+5Wqh
zV*8QEkklSKE}w0S>hxF`_!SaBno-Y(6Uu#+fYGc6aatw?f67~><!uQg#~()d0<WAy
zl4%^y9|s456^!eYxRl^AHb=FJC<^8MubiA%D>vI-sfS7P3JUZ~t51h;*IVCzsE^N$
z&GGSzt0<DI>@C+O0^?bws&Au({D-#WrQ+KG><|cXAbS43Q2Q5P18ZvPP&U6~@-~Aq
zDbo)RRCjVKD_w}tYV<(i3~H885mDwbR)cQV>m5`-1v{V#1A)ov(giDi1fPPC#9pKG
z()278-bk@?jDzFtSwF`wC2~Lv_}fE5P4#8^xn1Ak+L<iVonku`Q39!aLHM0Ia4ep{
z)vNBti9o=AI{}CWg{0xfPH7D%s2ItK6F|8x+p2gdS_7J50|4E3j~vs~X;rg+rD~v}
zGyuSD|Lk?vJ2f^sBVx93z12}r&vY?nNRC>)<<mQ5YD&_}Oe-V=4@i(Qj?Q^+?GX?z
zgXkn%6QE&Xb*fw*_rtzg;+_Iv+thsYJg)5M=5+lpjZ~>vpIV$PRhxa)pV&?Vkn-7D
zz4ORTvJbKGOuPBdZHBO}Dr-<2CeRGs+}zeVoukq}?@u7ANF~3eW@L1@*OvqYNYIuE
z8qTy!4!%Od4U+X078=i0?CKf37Je1KD~+0cPt?|EIBiLIZ2gUOumsG;gzN&sXlAF2
zKfU-6PB3S#&l*uf%{~YO3^7QXhSj+qPq;ankIr|KSIN*sYPsKS<=FvtXGe>a(ot#6
zU~Lk^sINpZW4;zZI}tE|8M&K-71M#SX38?~!qZqf%@#8&tBhA7Xs!n9=dDN&gKd%9
zY4-zf10o_naFaY$?Q*kSFv!Sn3%F#ic)oGL!Cx53hAAlY--L%i>~Xs%J5wE&r9`5#
zR-4U`qA0B1Ls?!krR3E|=H4%5#Js7JXcLGv{<UB{t<D@a2PSI~?8FRMY-N$V#`T0^
z{+}T}Pij?Rv@X^wewnw{5y$`+y12*ph-$E0FL?yCqngV1d6^$2>hqM9+MT$3rkov3
zz|kV@cI87+gTF8~IXQ*3NX2+Q1y+@mF<(d8+N&2%$$v%`T6wxyNMmO$N@v8t=nya+
z>vk}|P~tTLM;A7;ffEu$MTx(<5Xc6tJx*dMqw1y;nrk)vkjF6Gj@};SM)i%_%kW33
z{toMyc3sSK4q59`=RC!qh1kHcldveAU3MoI_RY@jo_Quph>Le)?OLHI$3;aI6(&-Z
zN)FZN_=B(*`s6On>dudA{f<hNt2-#&H7QWxDf31h9PNX9oq?$z<;rz-<GZg)R~$2;
zVD`kN<K5HwpjSMJNFk0PdR^qa`>vPo67KSc0e`?ExMgYQBb1^s95vL83Q_@EC8%!*
zK-!(0iInMC<O~dmmZOJ-LI6@i;Y}3_KisV%sp+uPK%rPCdaz=kf0(V5^IWx+6c)ai
zm|Y#<jLgzb8XjiIe?KyC$;Q|+R8pf*8fcX`ez|1;AIN%w2E(-sF8e9hQXR4*Ldc=s
z-&lTmo<(@Me(bH`M^xnTgAjbZ#!{5f-5pjM7C<ls;n+nk{VR>(D77m%H1Tw?3T`+f
z3~bLCoo~f;WbsyFd(!V5!8YK-vzdw18oN6?2&ky96vTPXlU5~T`4VL0BZrZbAvJta
zHgzWZZU1}aA)7Q|Ho#FZG$syVGb&Qjh5cMQnIiP6+Fc{=_cqx~!Iu}XKK%8ky(FM8
z9GnkG!6Ci^qhVo^@jLLrFXq5(qA%ay12J#5|HsdZF-o81{C=NUyAS}RNkHc=K3s-*
zcl|%UjKAY+L1O<8r{qEk_&HDzk5Xe$=w7%PXJ%ziGVo9l30_J)+VObXI#eDSv+-&1
zw0wex=sRQGy<T59gdXJj2mR8y*ky;d@NPV8Pw)E6dnQjV%Z2baHc&f;m%;3j^oeRJ
zk?}y+N7HKW@UpYB^59PuZyk}YGVmw(JMNLdlc4!(XJ;{Z)v-}&{lz;~_RV?%H;vAN
z@9@xcix6J{>3z40dg*=qm~6kc_yW{T5oYDzsix_$)Qg?$TeZ{2?f@eq*b_-f$on+0
zdnyQbud6Ags+i=xr)f$N*bpWu5rpW)dY+*J_wu0mK<Z3uDJeB(7duV%%oe7}R(Seq
z-U@GpSL@-HTlMGulP90fYmzt9;qUUC|1Pdg^E40{7xCt5>(H%y5Nb0xqC)##FV!C(
zZ=#HhWFW41MdCqpr<Q8P@<3$EI4YNi{Io0V=0=q5Zr+qvezHrLAec>-_Nm>Q+iqc3
z^GU=dnCW#NZv2?pCY+zIEzOJRg?iH+s6T9aQP-zu+8cOxheGORSEGT(7SQn}(<ZtC
zgV1D7(xa9}I`vkvibF$UI*;bDPM&D{)wUfjhSRmrWW2_PaV1N2GNW>U<tTu!gSX0o
z`fjJgQ@_$RR3=e=W>i}5`S|CiT1x?WI|nVSe4%OfCMW+G+{?rEY{~=tgKHUX>Ee67
zNpcIQM98-t8I)r)Q#V*e6W9=e&3%gUCO4=NX@&Q2aVK-E4P%(vVqx}5>$|u+p<r{_
zr|zg8(Pn37BrjNIp1<d)9yT>M!VQtJ&f|0p+M6P<PW2&4b$Xkp^hQLX)Vlo*OJoVt
z%<FAKx%BQh3@yEObi>(XBqf%mqPH($`AprtglGu^e>puhCD_w9)&s%RqHIOD=(u!O
z8@Q)8%z8(1+=yqaRn?d5S$nRt>HBu+X6xCtLli)oFnNaC>FQ-*nA9mG*Z5P*3t9BY
zI#Y|0p1F}qUc||C8u9m_v&`*fTcx$GdWV~P<bdyvGCK0(;nKt~@A;Y9E|q+>h;j8r
z?7K$VC_eixMnSvICU?8FlY?Q@_Y5Ctu8FP<6l~YC3y-kiacT>5Hf&leFMW@jORd?B
z&gOh;6Xh0p`!cF;JKGIL?Nje7oXtPBy6bs5&hZ<M7|<!=wz&#j+dK5kGB(S#t#2BZ
z+?SU2?`4Te`w040TI!7NxMXbMz3Shme-U&p;)O$0q^EO`YcjQdKOCVsuE(R&n%kn;
z4n?u=wGBFiwO>tiH1`FApVdHfu3UD2g8Rh;>E(TS!K_a_2s#^YotPUp`sHk$vFdU^
z5|P)Z>OOci-a6I?7h{PRK@}+iW<!i_S3H-qdLHtO?&!gNo*gR$);?B#a#WACtyzKw
zo!=fum8hrIxPTW9xt$xWmVwb|sdgTjaeuAORexAZ-l+6(d89@wM00JJr?cI|L0x4r
zORrU2u;E+J3w<TV7QZhmGLZKDht^yxa-xU7DdSVpT<p#(fh6p9D2A4<Cb|d)POV=1
z_rmCKbH}H|9Q-JAi<Oz39$tDr=)xoF(2TD4RLi8SZ{<R%q;((rn&~QF8mad?WRqS(
zg~l@J;Z>nTzP7Ybd2fcvY}Pz_f3&ob&az+sxDhijT&ZO=V}s-B>GBZ{OgRLGqsB7F
z@i%B@GH%YFDAcA7BUx3scs^G@Tt;8-4mTh4d%f=ZYrZHEn!CeuUsojECCQK4!#^`h
z>cgI97x|Z0)62S@i?kK>=4|*@DXZ#H9v5_YT2~Z*$_=WIiV#o{mzsJNfp#+YiB9F&
zX;|DABZ)Jyj6;7R|D~aS;w00z=iB#Eo(|6+Wq+>ktkfm!v^5gV3zgfw?OXSUPTL1h
z`W_yhlE;_^O-(62@=hXwz6D6}Db)@~<#Lgdkqw~HXu!Y!OjTQfdp>QmFHW(Y&c=X5
zr&919TRUdKh9Ahn@vY)h_MB=q4412|T;hnEpPs+>uvOALj9m?cX;q9ir+mAVNz_b4
zMMVTkXK@BmgCkbc)8Trq2`cnvXNUi9_jY9i(aC1*CKJ@JPKX&s^+!!h7m#ds4TtTz
zQ*+1}la*&`Y<bd^{w5I0mlp%P)t2{_XRNHXJu_8fxm*Pgu6zlWQXWzdcc`8WD7`US
zRIIDjIdncPE#)GK_U0-%9z+&RzpMKL8=YlOQ-ePa25r(FV5gj^aS5m0uN>CjSDq%U
zwqWnG?o>Ms9C5;`dY+D{hlTA@o~W;HP7UezjY*Dkz6aRmsU~G)gcOOSE!CUx=Q_ob
z(t7=v2J8joQARf8)Xp+8Ct5U(!v3N5<A9JwmQ&4Tc!uF9(?YI0oyUi}tyS~}U8wx>
z-2KO^mL^pcwCJ1nGZx<)Sm}UQH#ngs1$X0+a=~*wn}w`XKd)_g-GRz8_I{osiTCX+
zM%Ga#lOx-<6Q-Z=0S+~xBj(#Dk0A9u#@<(7u#Gl1JDI3Hc>H!eRdjM7SdtGex_-w-
zz^2(TGtS*FJdPQnJH6i4npYPw*jp3WD6M^Fuh8b<T{Rkd3a})jSnp)dnZQ>+P;R_`
z@OLg<Ja2WsCAjoTN~d}@*x_+_GR28H;5<CViL}NQ*5!C<gc;a#wY3THmuS6t+46@H
zevVjQbswYkxUrcL7*elhbo71EK2@K8pU<uRVjCSKDQ&m^T+`ZlXfk=kAKzl{$~CY_
zWUPb9yek~_ZhndEe7GcEsj`T;3zy`;Ov16%H4shS=ltEmA;>{Qs!*cg`(4s-$zYsU
zFS%B|;@<t_;C?34O!Ok9R&)PezZT#PReK{I;H~q1k&B(t3TV0?uMJ)5R~0mqKmwr+
zBH`Jkp4=Xh3R2(5*G_b1a4|1RUQIuki53SgtJ?in3vkgjc4P)I2WoBAAfxdeOj&bu
zAXM4=^Ld+D>8!2f^(uOhPgOh9oufp)ua`n5R4!PZv}sf*se@7lur84hqp<)tJ8=n>
z_Ef$F?rpq6xw7#+knACGzF0B*Ac!DseXx}sSGz?*Qi{99u}V9&`r&?wxly{jpf_Wa
zk7A-CzkGYcgkZu1jY?zln>FEAIA#W~>4kX&W(T`NgO%rTn$k9ZTT14{j%ow(NT4VX
zm=jN!pDQ9_A`vN2DN-rqqY9!6Ao1z`k#Do`wOBb(u7uy~p}5P*H#cbWi7~#9R4G|T
zC9<#(3m@=hkmy>zv``M8Pu5u3+HoV?mzW?iSKFhqFwx&q%n?~Cq-$hT-J_E)*VeH}
zR2arGDyi$cP-*z6T4S^!XjIa$FwaD}y)e+njUTY6zS05+3J<*j27Z1Y%3?&(TYHRd
zzDffH@ci|N^c(-!s`=bq0?*!%C8CJTt$JklQCS%-y$}4AC&@GI6*qflC~}vH;hRtY
zI`&O$DsC=ESQwF@CxFeO7Y-N=eV4>Sx&0{@&m#Ikb96|&ZchV4P=vbXD-`x}?3+4`
zy9b5$5h1u&@-y$%a)j*g;njAUisVS5V$=j%zUAZ^_2Z?Y`+f6DHs`;>GCQJ^*>jJ$
zWR6N-;SYp_e<bmL2<V7UUoXxJoNOIieQMX<D3WhAuG+-*b6xuU8Fz%xOUNzn`i~>&
zo~yLfH7E+|;X!Z+XM!}x{#&mHA}X^PU%p5zVMuw&vLQLrFZS&Uhj$S9DVG)9H+(G~
zp&MCsGkMhu$Q!Z^!5S!I(DgFvDUTU?gP5lJFm$+W&^N`>gK3JPdlHG7BY6jcPaixy
zY^?Ckf4&ocQ54FUqHd%?La`T77S=_kXdd5Ajl3&^Q>5slrx3qni0)2;5rAT3@*%bj
z88P|Fiog-R7)h6<&N`le$E0?fG-HjCUz*^*u9Yt%dxGc@n@38fSo#iwB*Fdx;c{Tm
zk7C^jVxYM?O(l}a9gpLid8__jLW5l>3+uQ->m!th4K#;Jg<>vM2ZYigxj;Rb#t_J)
zZ{VAocu3@cG0w6a7?J&>zlvr2;J_D1@kg`MP2Nsou?TPMXL&ILP}cW}HsQyBPr!ec
zfv8<^mk6}EVC08J9U&nm5|WSaO$jAS;O`YG))z1k_phWlJy47<vw<|BE!bEZP%+4L
z7)svBqvUKNNT9mv;CK)}8S~WWHyy%5$*-*d40>R!%ucRbtCz1GB}*{Ki|7svHOKub
z;a7&4>Sf9#m>z_nGpybQ!=V(Tj6er5`g8sXq5uT`jZuro(-!L^_QYGrEC$`k#KYEU
zrVL>qcw6uA-skO(ugy6`pK^$N{rQAKsEK%PyYcsL`MhOB6&O6Cu`5H{bk>_(9K?l_
zDk~}kgbxN|cCkl0Lce~6@CMZz{)&!WJ8>x;{d3FS>}7XueE?}VKLxhrA(=cbDn=wm
zYsFAs_4b}~wGs&73KR3zX=g?<VNV3>!~fYf<@{OHrP)NE=8!d^Y)UbWmHy@Zf=cvX
zfM)XCe2C!p1D$JY-kPuzaQ6)^9wUMv2SLe&JHUyzW_P!&b4h7fnjK>cm_!jmk<x<%
z-_$|U0Z~*Mtwxzpxgeh%G;`e-qt=?0&c+FAHyZ=|geb|H<RB42-}W)!91355UdYfv
z<mlE#GeRs=rq2e269unkw4PUjYsU%2*Xa5>huTe#Q0}{MPN{)SvUj$^y9q%vtBbnW
zO^-Tb$1DkS|17M1Ugb%v;zHvS^=6JMVxOH$s~Og9Y@x|6cJ2ouR!bllCETe?tugwQ
zwsCw;^lxvZ`$EBN?LO-0fb=^(`iKK#K(xKyql#9J=SLOLc(^*e+~qgCn4>T6??GEa
zH<troN}Liu9=nv?m_ciU$*-N0*!uyIX7TFleWUY+nD3WbmWDq`c=3>3@f5CKW}uVc
z#BTsuT}+F9=<#ht(bUsoABEVJ`Wg*Q_J2|LmQhu&@4N4^2$2*dM7kSA5EKxQmhSHE
zZcthp=@tP&x;vyxkdW?f0qH(B>$m@B>{olAJ;vVWjN{w2MCSa?`8;=A*XOcZJT%Sz
zm}g_C+Lb=-^6>oPO-y458hV$7igXD<OUzxto<=uM9HR<Mb!1Nc$T1$W-%{t#S$PPu
z*%j0)WMvlaln$>dI+pG(zAv!*KB*C4*=30Q$}9O-|AP&Z1v8eGsT$L_d4KGJ;;aHc
zPL5J?FVktyKYffJ9T~~g5mjmtWy`P-#+&@3(Lv{6wS9()(Iv2KyKy!=6NiPa<p+J0
z0$(z2r!+b}7KIPRz9!}&ucVAyL+!_F+#*x~&cApWYnr%-kt%1wum2=*Mq3LL-qw8;
z9-<VEZ?x2}_WoGr5haA@@zi?A5}5^{T`B2yx$PVhEK|3u<c{w6@h;av0q9}etGrP_
z9u)mYOaBKGk=k?ZAxvN8aoi@<?)oicL`^nF3D-pDA|!A8<n*{%mW*oUERCS|nBJ^5
z)#2||U0ofe{5(&#pKp>QdT-QMGT{+h#g7r~oULYD<ss6MY3gGp*(d(Fxkf&h;D~E<
zYrTUc|CQ`sJNwc=%g2CUBK+?9vMo1JPiecwh)`k`!fCJkWok|N48)x9U)7Cr)!IGu
z*3WE;kdsZ`|3wV)hJXB$-M=cNJF}5F?z}N(Y?<efV&0i!A#);fb1yB`67ih+`ih=(
z=e_&=N1+Vh5|hP+?)ajNR-TTM67$}>4HHS+vB@|o25|{VY>Mz|?)^?~1Th_qC(rO{
zG><gLvr2CQvQvM(u$ubOy((OV##J{e&xJecaJKxnSc*6Z+wQR~l99l!`mBFhZ@j1H
zP1|Q$hduNrn3VbAx91h}-{mHr<DvP6l=-kmp6}~D6->V8bTiOB70+$`MCItk#hRy`
z&HYGJ=VlUc`V_ZO6P<%`n=G|o_+a+t>}&><o$>8mzp*|Bq@6t0r&uP?vsCyeA-T6R
zPUj0SDQuwfta&K2aGiwf(EdfDzEP4;K=0t5hgQ93@)?VIrrBy}L88k=MHZt_LR=W5
zz>T)H>q?tgxtzL40$l-=E8c$N;<mbY<2od6S3e2zu^D+A?KU%>Uc?-aXieBm40q&=
zb`h$jpT^1|qaWV8`@%e5kJTxYa7mA>&0N7$>~rHse6r-~^?}Z+rZ<C6udKC~XxgFz
z*|s0X_3_xs)q2UvVX;PI%b}hy?TW-uF!tF_X=kmWGryyzr0yV_b&fca%GV#sLK<Rv
zrWGW8#}7A*;qxf^o{Q&A?q!2Odh;&2Il;4Mm^30SOTtyhxYjhm>nH#1e$z)PN>d3Y
zDr4L>jYRw?XE;_9T^MRxj&JeGOJ9dC;BNx1+N#}K*UfNx<e~ttzcT6?irn80p9*c{
zDrDQoA%Fg9^vM?0v4BW=yvCNvL$4jb)q9q=z65;(mtx|N=FG=m(R9zUxY{!?w<arc
zdAU&Wzd%>C`83fqXHP0g?t5Zw?fI0_VS|&w+H8e@ZiYa+t^0{)<gyazLC+IdqYkQQ
z<gzIJTb`X4U}&+M@@~w3W3}tlpH&Q#v903?E=$18PDs%(V@{MWGdSU-?BQtPhtU;g
zlTLM5q36yjc@VY&54O-3Z?EjUksHDH&zD68pF5EA^IFD_-MOdE?V*>CxrFxuMGZ%(
zAji1|0VWB&&^7vhqr$=#`P|hQES;{g+m4q>)h4Ku>HTmq;RtJmfTzyOe6{#_hM`8Y
ze}<@;Va3m`u7Sb+k@DUmtyB$14`zQezhK1}CJAAsBG0XTwYbB!z}Z6SjTR<_6#^et
z={3Hs<HD!j456uwpVVe%Ir<Bt3O+ElTYF8Ep9@jNZhWULaAW!*-OX0z(0M0Mayv2X
zpiN}vw<SA&efhVkfl#+G)H*v8`dBq6JXQPrJvLg09Ky_#q-zwNO#T_L81L}d^4EIZ
z@MKA5O}3(~Q-OBlvZ;8fG~j_^(M|6{!IBM@#-9WkKaE^pM6Vp$nuO+ow!5#NnV{|$
z)G`V~dv>3XS*S{q()6AGnb@Y1Q1SUi;9mrxn!#TdZp=M~4PqzET+QFBJEsR@jvj^3
zk8KC71jf{%%@#Xd70(GPiinHTsx;bUC2EwalnyajOncH1yfKoeBqZ(n`KHe4eg5{*
z-^rz^0D5QpXbt|A$r+Y@%{Skl5JX_$Cd?Ho2VD0)=w{us5Oz~U%r*D(*b11dFBTOS
zc-kx^82(c@^rbn+#=xr0L8n41+vEpwi3oK!#j=e7#^5?~9X}d2t&h55V>#vjt#jGj
zPNAclG4Q5P3H|ZKaac#p$o^;j#@6+QN7;h~yDS0?aYf^NG2!o$`^Ienh4w3oi0q+5
zgM(5M;&fUC+?6MJz1{8|hkJ~t-yZ&TQ~2t>)MefDB|M?(zz@Mq<8@hog{^q|6d2^!
zslQ_4o*Y~$Y9HUdE09bWylfoXt??Z3+Y1hNjB81}y#@KaAYN5(on+t<*|&w1Rf<U^
zilw)BBNH`+%orK$khs(9Q)4Hcj41ThIJ!E(Oe|>@g*8Kx>E4Efa8TRU;xgTrIQ?D1
zA0qO{M7kSUy0!xvwB5)PCybS7Pd_U>xhpOi6popOxHnQ$%=BombfWxbELwdnw$J%b
z-FCIPdw+Dgn4CekLmkaUZ#OpWAFacuj%lY|<|;H}L!*&(dKC0xb!>LXs*|==<^~Ss
z^LW9hhlAq`zqEKKv!ajVw{-`#YgWNf^hCCh!<r-`t!WY=>%Th&JPzx_rM(W5%}Re|
z#zrOM1=L`Jm`WyB&XtX-LvVvMG$UQM|Dnr_a22}Z-}SFi^at0(6mdb-@|eVL(?%i%
z-W?7Pl>HL506I@qr~?sS154Dwujasay>GL0l1XZg6psy#eNu7JC1>7LrRSKXG`*5m
zB%pAgikFJPKSGtjL0Rdruw6>e7b03OED{QzQ2Oy1hdeod70ZiD2xo#<eBN!R+T2*b
zN5z+%#=Z_oZ-p?$LutB6<tS<MidKIx3sn9igWh@!d1yDQ8Qd2i>xSAFzbJ&<!3fR4
zilCX%%$j4Fs~1!$Snuh^K`-1Xn6i~;#|+bN=<!+D#acj8Aq*AcZBZHIcz)vP@OVmB
zsoMTWC+=x-w1XLaV>?nnpa?3+4iJUD#lB2Ji>agAo|FCRuD8D+c&NbpJB(b`&tMh~
zxT0dl!=tTcPwPO_TGXlSwJVx8%X&4NJLWqYO=l0e;5@v;3P0sI49Aby|MUl|Y&&|z
zQlPvH%vty}Ncw5#rO~`@n}BEkx6}Op04ME#ETPv=tXV4ik96Pk<NplF=Ep7M_+PUC
z5cvP^koO-5s;aum+uMV9T}&+Z-(TeL06-S3;8}g~68H#MfqY>|n3CGk#f_<jF<B4L
zF#n|suCIL@K14=F#v4!t^vx?owg*`Em#r}t;u8{{x7_0MzNVoel;HJ%<2xuU><Ro3
z8X%ed`0@5X%N!GYg7wahc4VlL--+z82K)=9<9+$a*u||T@PGC;{BL^c|0^IoLAftp
z?@UcMFHVTTWmQ^K>E50@Vm7L`xRR%I^pw5EZMSi+HR+Yf<~(WZzrKvG#P<LQ;2j=r
zmCZDhRAJnpyRx}$rdeyhGI_KWKQK55j{RRT;!39r_##OEnl*S4pcM^0KO%NN7-ek#
zJCYZxRJ2N^X1jasLBaKK0vF4+rF(F{EB&hFm-gSxefZphfDqj$A=!$}@DRkzXR~&B
zstQakcdT|#JX}vEi+Oqp`#U7mB9_08ecAtbFCfzo<dG)7GbaG6!Ma0?!D2mtQMLJU
zbJU9M;-m&-xHNDpE0@}<9K>2k^Jvd&^YZfAbO22Rjqpu*qFW#P4wvP4wP1w$nZMw(
zH}=Z;#RglB^^YDt>^KBKTdn=hCra(JcudOf?rvwNmE4gGq3}G_0wHZ}me?1D)9-9F
zGc))86wbKmPlYEMe|QCU;6lSbHHBRD0=+d$z-e{m?){B1Q|>P_`qlo>;{uiNqLWUu
z!Ija{e65gMGL7dye9IL8Em$qjOIJJO#g<YAx?r5qjGB*C_Az_7nVFi<YV_|vrp9Gf
zG1So+tPo!#7Y@I;#>}Ijq&h!8r>3CLb^RN?0fenMCe2sI+BcwQ*_|yz_dCF4;D02S
z_pP%Fvz6!k{P@aX9+(!GwItd|j~)@ccGXW9%EEk*E-8Z>mzf#;!su79I1ezk($i(G
zFV6}!npiC_DG)o!n)>6z9yT2kgO|;J9C>S|+$G8Xn;~H1-b;k0Bq#T$H37^m*riCl
zA;^hdF^8rOIgQ8fz8F8%a{g++nsk%r%t)S6d{R;<{_8uWQ9~`hzRnEPw49>q{L<3e
zBE~dSz$&{yC&WsNINdrlF+Q$Fj<TAmWxOR^V6NQ1ov8~TpjTV(%j)ZAo?@}0lM%O@
zs;c;MkhP(M6)#VbVFavZv-zKd`)Y$6T3YyDvhkQ18?#ydE*3m6)Lr-#mCgMo7yT*M
z{b5Qm>?WsOzW499E4Ic4Q)7DLqUjV$Rm#4Bfc=f*rE}UWHvxxfvEEvt^QW<*xe)vq
z{18%2C<O4?zVODH8<-4!7eASD`t!R$?x~eRzO-d?{aicFON;5f@scGDs~Jn_rr8m*
zv6PgQXv=SzDGRrVA^%W^YX$mP1G#vdHVt@1^s$VUm6aV-gk0{+pyg4>Q~VEFQ@-PU
ze^qbF>yvrDt9BDRJG-_w{QYO{hZW4q7?^0^B;LOVn*q+&`;_ORYHHbTzj$JD<%!vK
zv9VqT-pBZf&2+fJLu^EyU8up8keKM~($LvUh9=ndm&^~v>vTRUF>w^QMVBWan;0vc
zdE4<_C*$1tWFbSCmX;Qk;AO#FvFNYarZ3B_0qBb%0O^S?Y>>?ga>>sxRIhpR`0>H|
zpx%8|6$_NRnd}8>7BiI@jx+wDN$hhCMplY`D*K0r9bSWYY{;kr2RxpaH2>|<z2Njh
z_TPQ&wBvGfeedhD+ZROIv=5$`!$W%tcW?*z@cO;Nd)hnlT{*p_gd7p5hLP*>9A1NK
zAt71fPk=*)c>jJ74jfJOb4|=DrM@XCjG71!5I98^lL7JtZcBi?yyK$*M4qbo`*OVU
z`56E@lC-saHW-V!#VR`97YrqM`O1BHeZ)**pkD}e%cz2}3q>N0-DP@Q1~gjAV1LS=
zu<Hd%-{NAva!yu^%e>&bcb{GWO-4=CkX_XLrsf4T1H)~f3x~f|%lm#U?=JnH>yco@
z;V&n5f6T$bv8+!ek?N16|Far-QQ(0->Am4}y|KuQ4kQACm7bWFEG#UntRn*hISUJ(
z3yWFz5Yf1u_pI0VA^{gVG&1Orr}|Q<P`%76?F5iQ1yhc*4Ngsp1q6$>iR>osN1G$?
zd3$McNr@wurzqiT1hlj^FCZ^|dM~cX@q^7`5^#-%Ep4<obkV;6n5Z~qyEm{v)u*c7
z;5akb%okD`A`uev<O%KP1fR(gy)if>;}|ra5D{Hxaa<eUyq1!(M>15ea83F5j*Nc%
zbNNyMfOa^=WxdxON#^!{e&1p3fU`#`g=aX!O(}p(aG8z-eYi+#E}_iRYM_|*GaU}S
zB1TcLfGeO34gOsEbv0nqXxHiQyZ?T-SL{3pD?VJut=ZnLt{gbp$b}z0jvLO=@o5*2
zCH2jbtBX}0`sz{^5h1PrHI`B9dr{F`ol<zNLLQBw?fvc*Ya|&!RuOQRNAy+xE>b!<
z-l<!nelIC5{^G@p6m|!!zanBNGBt9Y$8IOj@K~%xI>UB$c2EMvyUcG|;NN91AF1WO
zTXTN2l`i$42beq%7#xiGTl}qdAdp80`~LP1*F`j>?Cpw5NPrb}Y<Rf$8yXgm$P$TI
zB;&i~Tetc=U*U5s=8g`bAoLnVItGU6>1l?fSEyztBj31lQ(oKMEs;AG7uclb;+h;9
zTFmo9$|+s|BwY~7r;s49Y!8fFA$y|4fZAfcbHBNB_o-0Je@vmhBc4cHTwD{vue_Hh
z5Nt8gfZ9PX^h(>*^sBD#y+H2LPu5^wk*~9C1?`~_8u9rEl5j+3>aur2{=-NfS%QTR
zz(^(kmwSB94s@=@mf6Pnh~|4@u?!2_%m1=>Ft7ITmIstxy~4J!?ot_wy48HFYqkA<
zY6$(Gm_YxJlAMhn9y<L!I0z08k7I-)4;~QKwIL!Jq3ii!!rqnnMD5j|hKsvbDV3H}
zE^GZ7qydWg>dy!X^L1Ci1qf10+4de_8UTVTlD^*NV6<PO&M(;wIGxP`0V@x|I%#;r
zgG+zDxjk2}38%$5x^Be53Beotwqnc-fIc!XCNx=hUtb~mB|}}4^4viP6iJ(9>b33@
z!@c6Co_FuwB_}5X5U|^ymJ+?r2j^w^wUjI@BxKKJp*%uF6MUD$HI}DTWHnu#rMm);
z5`=eMxc&i%2nY{zRmvQ%ZYzupr`<QqT8(r{clgjG?^94vxI4&js_t@}`b*)%<#Sbx
zw|u!{ZRy$B-(-(KaId*lIE;#t68R=o^l|4)V`;6fbX;c5H?EiRUwC_S)qsZ!{F-|U
zoum0G!>k#?-<8jLV$3|RuP5XOhKJP}O#OTWFc<0yPo7>Pr9HoW&6>AA9|4`9Sa-z~
ztSs$SP~qGjhnqwdogqmy+<qZnavY}6MyAbxjkD9<8%Ih?Dv?wr<Psn`1H4~<<Ym9u
zBIS`B(K3Y4L`IED{zR(DGAFIFCk1(RW2zOd1?GQ5a&3lJ;kUFLF3eCnB7k}<IILfN
z35=FpPCF$oz3e9h4&Yw&`y7=m>9qbE#{mJ2=p5d5o7rx;Zy9frD$=+-5Ks%%M;e^c
zJQvkbo-oZ;-OPU<&IYt2ArTSN6xPj$4_fEw{Bnbtz&#A~TmNXYMD6lBf2!EVPXC`a
z%8W=rJ?6{gF|k|BoQLX4l=K-}q_~Fe1z1M13&b$RY{h>0GT$uVuViyzJW%}I9_KNY
z<V2;1(QV26(u&gJX>E>1K))_8&G8P9&ebYSm8v{5vU+3n+8AQ#9SzxMo;yqyEi#Qa
z80{w492i}4p=hva&(8~o6B!K)$_fO8R@)qi$FBCzxZOiU#mojq(m;h;k(femIN?i0
zb|Y`g?J+Ow5!09F$4>(vg)0XxS#%Bjoc&Sh*5p-GorQ=-l=#xE(4KjFriwTz#OEQV
zw|bxDj9Y`piDQ5A8MoUF8DnyjHt8|i@hTV-+CHx`PMw~gBdZYN1Z^oya+Z0f)p>L>
zl^D9Zayhoa1wtCU#Ajnf>)8`c<g9$OJ-7C?o}aP`?q`Ox{V3{1wecE8)e1OXAK#un
zh(AcEjrx<h$I4a2FLn6aRn*m!FOE03En6~w|CXPyeZ;-SsLbYhxxOTf4yMi!{MRyF
z^@dayr(LXiLgDp}E4mks7Vv4bGBBv{+Lf%YFc?1PyN9T)d*v_Tv^%R+<#^PAY6eKB
zCY_}x*qU{odJ}&Y<fx_I*jyqZSbzgt-dq$)_tlh(i|y8cW3TIER-3=r*g!3*ciw+a
zMdiBt=NaGw_}}bZB)en?qw(5pI)l#<%2PsI+yK)^naIUc<&8<!%+!}|{d+nB{i!@)
z1n~2`hoJL?(|mn?v_SQDp4!R!!ad+!#aeW4PuPjo#nw9>Eqc4yRawrE&StW?x8Z?$
zSOD>uL51z6tvhP*>S?P`$k5mruf6u}*9Qku$**Wv+XhyZiZo~HUEEIkEzA@do2>VT
zMlD{;@5<I#PSje|W#~oP8A&o|vUx3iV_f{gNk(QncYU=UV4=pbw35TRB=KG%jEIxP
zre)ma09P~vZK9DIB=P4Cd2tMy){Dy<fEGsnJTF%AqHF^+l1Te#h1J!*a2nLqDRs`a
z?UzBhUE)2&^!Xtwij>&p=fJl@WE5=gBknT-u+efTbD{kpJ2E(m3a6y7SwNW0Tp9i8
zY>tk{dmy%mbGet-xcrIgM3+in(^=~1dx#i`K^%ucTk}owjV&2@MzPcR&Cto%oMCW4
z5VmV8;N*YjEQ|~5B8Np`m0$+r{nso2=u8U|No+)~E$^aXVIv?u2xd(m%HX$Y5PO|%
zn<XZEQ+;>u+9!bad$(j*m{>Ss)@$*7xo?L*T5|zn`sa`4&SAHn%im>MxsIcs3Cwf%
zjDBeVay&i^jd+D0v~~j85m7Jbl?t!t4=}yrr9D8DQHM`JP^f;Cts<GqHC$++HYS?|
zJVBu_JjaXvXCas`o)1MuMM0Iyx@|UCKM}Md&c?<DsC3_-C~mgErO{p--(Mp4M=vR<
ztn5$odV8bQpV~`k2rTjvyX<4&O|}mCqv7l8M5>vHLs0@q&h$5mic!=O)s8zt{QO__
zyIrBv=}F@yrh>1?T#3MIhR*TvYNsM1e+2*Vw9Abax-7F!=^`Kj1OEKS<i*vHQFA?~
zF|TS~R#sL)L1;5sCBGvnuxSOXlNp#*f3M7c<X$y2#0%ziy~N{71S(xw*>J~^S#KPD
zcuTfanq=ZDwB`>!0y=E6iGqCV-p;K(JwwguUGscCZSivLaFj*uFLgYE)@cfUS)GuO
zxq1)!*ec7BT=R+NhKApOTL!K{!q={u3Eyd-%zkwl4vu4@J+?Tp)L>v_1PhB|hJWWs
z-WX`uRE!LV8B5hQ#7FWM!caFxD|+F&VqH|46l@tIDYUk>Hl8a4Vx>$&ZH3uLKCp5d
z+<rA`e_ZWLT<m&RwcMA4Xdxhra+c5?)sfL!V&;0hoqE+$!su~v*fKf-W-jgKyH!><
z8{d(^L_G9+;N7$Lft2Gas889U_}&<*A=kYQ|9n3zdQpZnXPWcRNS?>TYYIc(Jr(1j
z>Q52v`y@<!mPXwkJ*Av`Ju%EvnKtA<gHy)yO`-s(^69MHZmoYQ>$XJZMM!nJq&7A+
z?N2>2n{rG62n!YC8{1_(|Cs<ZFHZcl$jAi%4=l|5H3(KJQsHo#ZF#uTdwh|_++kN5
z+%iAg*?AIo?PI&f-YFi^#7a)(?#`o_E6=A|pxx{(rlxCklSP=p5#s9M;lXMFCf6rH
zE4$G9Xf<x%#OZ0xU%91ij!c(o)lIA0S}3yVO-2K<^LN2qj>tkw3Rgwv`W`TM&kok&
z!u-LqNH6l76sZC1j|Kz>D}OnCIq=kihyAuubPt+p#I5EU%WOwfZ~pP}@VLjz+XNrT
zpcN#mHe@R+tB|gzFHOLDM)BqFm_i%{W#j(n#Yq3pRC^O}ppL%=fZn)DkjA0HI=)+i
z&mF`MRZgpd#$b|;49pw*QevOM<MD8`H_Oc8>IN;2h*5==gQHdXM%;&y@$uuw^3yc;
zorU~`z-3dqOGkvGr4d$chk^OhSovo9EcjLW2MqhpV@CebPM<I4M%|wYLwnHQycoU-
z&{W3ed5wfN7*c&&9fZ?JWQPTVB3>Up$^J(KY;S)qXp;%Qn4BCBA?9$sZ0pAR@rg2&
zfZf{Gc6+cPPrc97QehwW@#8YRwLe<tsP#5irQ3B-vEz9%s?`5Ooo>);VV-Z0*7_7X
z^O94Z@8d^53Ua07p|H?UL9W$S#5CTD;eNCwjfC^&zQjpShn)uxvG)#8A{yJeoyo}s
zHujV-`_Gv*N|7R4W9Y{QsDW3ggWTMl5XVT`PAbCW*HTyMSP4TBU2{5M35KN1#C7-v
z2$S%Vhn?QL>r;HjFIg-9^Aqx7yE(bguXt8e6}0@Un-9%F1r-$)tZXc=oL2SOKjCJT
z?*2@cofPb96`?maGl4;4(C{a(X*Zu#m+QrwD$)lC9-Jb@GDJipN=#aGbr1FVy?q3L
z*wOAmJ$35!VNphAazx>1B8kK7@03+j9G$}S>?{#62kF+*LLPkXmr1Y$&=C0~qdHLS
zT%DnXADjz_%UgL5_*}rzhw#2f;{08&GOXJkG+XT=Uf<Z>+UoIZ_DWa(?`d}wkH>}H
zH~|LUc-7q75Ca%iOy?;LM}(BHL<=h}jBIf%+L}5$=c|-4v9cbBmCe+h^q+GdSZ;5Q
z%p7k|tPx{;@FRX@-8H6kMqV&lI2X8wKz;$pQL^-p6<rF@I5(=55|SQ}m6v_|_|ZTt
z?%eJHrCE_mSqC7Qc{~qs)=WpgRyfBAroM53q<|GmA%2vAP&@~iIKCr@p;uyi$vOx}
zLbXDs$ifP}qK;5`v0C^n6hh6?6(3S&0L(8P7-0?rjhANC;<%;eXAjMhdd95A*EMGt
zg*E76Qd9kvn}^6a{L6j;J#}v{Qa5{Ia&omd&8oG75$}q;G?CLRY*FG^%wQxztZpSQ
z+A-4Huf-2Vqu!a5l$4d0c4KdlnIlJ@M(cWF*l4V9?#E%TQc>nfgnW+l^~SK#;;+BH
zzW!)<uTFQSobY<4l-Gm<^u&SN&S5!8cKOofK(*m|sk$!}F262tngvr+QCd!xSEvj#
zZ_s9S3MiKKdfpyf%OsVY9;?#}<eiD^-9KN$93x+)jwh+&_EGY}MAhr}p^02()1XR|
z=CkBiyT7y40Dz6497P=pzP^f*N=HV8QkULJMa3tt<aj|wrrVz`eDX&w`)U&W(r^!i
zJbPigxNK6f#r}@dU)Rnv&F@o3C;>Q`DlNv4v!k|t7b;YU8DyavOE+1Ttrjdj#(IcT
zs#R~@sQZ9|?eg-n)^Y38$HbVJky3+T>sZxF@1csZLWS13Urk0ujiTM%&|{;l-Y~5y
z7njRr|B^3IT>AYf1M+4Tu?AWUB@*8!zJV5<my`253=$~CW8a?jtcXL7$GS`z8hgEG
zL+!KI<$?>jF})pON!4~^sXupe<=o!hcrNlo#Dtllp=Oz*M)~l}jK}<kJDfYR01}^t
zx#&4Mq4#e&2o2F^K8x}*40+07au8c!V)9)%C5Y5gG39%?ntXbBaOU~(&P(kd+Vx4V
zt2jU70mkCzG&t%bvd@pICZLxTi7B@jrlX*cj|f@vO5?U0-R1-o^mh{zi1Dy<bmZr>
zrPb?@9B<U)IM%Bw)L^%opt^iuF;#iy(LW6X9-`?c>Wf5`XE>bRBKIP@TOQc8$BBgp
z<gW@w(_hf`ZvKe!aUMw*Sr{0Qei!e(%vIHwRK;#GB=VjTn!3RzL2@R^8P7|m+Z2HP
zE#5lPt(0shQn%L&T3GlvluqFeFeiQgKL0Qk15?r=L){e>?=zmL=%=9z*>|t@laoK|
z8f$;C7c}Tm;PO2DQc>};qYnN8e`N%HM8R-@TM?56m!5rU-{gbt7hyPM0y+7I-{tT$
zlM)lVc%w*2WvHVn)pY>PGGrnA<(2F9>4A|Hsq@>kz^ag5*%I-r0ju@L?XkUl);WMm
zZ=e@)uuY-u$yI9<Gr<)V6z(M98HCE8LD-7Epvc*RbO_gY@1*vcPFOAXFy}NF8{UL2
zkDg_;H(3!Rxk^Qnb(I!vaYMn=&`ez85W8PC>QI>Lr3gzi!{q7$J3tGMf)=flbvx>r
zxz6vL402*UV{xR3mX;=%mzbv@KhAb;^4eWhq`as=N%+Mg{XC@K^g|xoG7HOqQVB*W
z7i*DjoLKsBBf-L3#la;d+MPWs&uMGL22xpq?&WfIR`)A<+w!c5?Qd4!bYX?)-c!1}
z31zy~bU7sj1%MC@hxmnF-IfV=uiY+*OLfn5#d`_W2`NV^CGx~^`#ldZZtCdeyF5pK
z;@=%?>KPa))@-N+Z(a8)-K*R7Sqb)?#EXg*xqA{lv5e%GA`uQS8})vBSVX5>{Ll66
z5bJ#Ze>K`_E&K5D3<W9*#DL_hq2Z>L7C&*DeH+M&g6cZftrviMtgPwAGPwU)fxTYX
zUA`0m5_GO&9ws(6gF8A9%>jw~bx&`7sA3JytJ3cg5g5dHc&|J<-nUl)YNi~<(F?l)
ze<rJLKKwgKytxC9Lx82lu}G8A>)PGh)#Wct_LYqrzySSyIA2BXozqhe3kCN)r=mYC
zye*xbYi@$^xBH?)A3dtIw2052OU+JF!F8$Q3IPU?%@gI})IWWO%cS1YHd^p{^S7D&
zOv7l1mJua2b?~m|`Qdlys9^waI+3fflKZDqDmgl3jF;q#+KDEN_S@{8olj4ZqaZ|O
zO*5lEcVw&WVKDg3D%}l|9G{hpXZ0$&1Gw1F)6)~+@9jg<DvlcQFo)LJsYTr%%^6&3
zYXQg2`#Oc9!D5>O*pu{HOhQ*&>$s7hl||Y32n~&h-Ch6XNg~n9Eoja(x>U8brMD`d
z4HUyN%}9=sfuY{4O7j_)WBV$zN^QR7m5{EMK?O1ZW}dz>M*3`sO27_L5(HwJO`gN~
zf?LmCJEd_u5j{Q?fB*iSi>fLC*Zrr#-<UKi)wl7ho%jD*z3}RETwvTrg8|FGkIa+q
zk?l2d;ClesC#R&aSQwZ%06u2IsYty>aiH-BL_CaHjI&s5W=bTDa=RV7PaUT$*1_4d
zJL>`tRio|rNW|k^U_Vo*u#&Ls#d+St(2J(gBxFAM^ExLl&+UA<M2<R4K3`fg|1lO;
z5XI2C47nnMmhIvAC#52-3~2#@45{5zCFZob3caTY`$_CpkLmRWZeW^ycHr4$yOCVy
z_Oir!+PB;F+*KIuSv<P|(9G64Iy=Rm&Mz%p>@8#{GO7hKV^TkQ#v`URrwt9SFgkHp
z9CKZ{LZiD2hn2cgog!+R;DkJ+J9zB>ZC?~TfJ8Js-9_MzI4rF)PFS||a5<RHRXdtM
zUcl&R0_xkU-I<0AfeUtMCfe>_9|EFX)Y<Xkc;;nZoYiFUpYu>Pm=-*a!+478wy;PE
z5W@Nj^X?Y)8vB3Ooaf*7Y%7|c`CqG5?cnh`mY<f|Z^&j-I2DuJK;RZWM^&!O;2_|#
zQeRu~o&8<ORkCYUlSpLag7+5IVr?oBcI%^Ab};;Bu`tske*%>F<ISsH7|w2u7BI%X
z6BMMPpn~KSFz)Ng3?V=j&}f?#6#t_IQwxV#@u%Wl)}cBlO(69))YrEqBBB$evg)Z$
zJkMgCfsl)CRd36gT5h+|A_x|^W^flWxc|?hTCv4NSfz#PQ@r(H=ExU(6|iwqQB|Ec
z@HwB*X#EDUSb${9%cEula0q9XwUyM%s@xhowdG%F=r&)1gXJR0{9yL@;(|0-;_WOg
z6B7?N_r0<}Ttr>LKvRIIlvh-=?+MkGz%~N;5mJj|jH3g$=ilh@R$Xx_sYH?)CODVK
z&TByXIi=Cys3EMDZ8}1?*sCiT?0I+w$w{ZM_XTY0ix*|GSz@{*L<9t@+sibgHnz5K
zBgWYy<E6wgstH+^z?#9<-roK1vPx7(Xj>r4u*iSS0zMPX)G?};w`Ca4KmmkG%>Irm
zc!?NYN5FUQwEOXUZ4KD0z71JeUJul!jnib}`)llb>g!u-Al_R@NkbzdEPQcx5Vt69
zL`_X$+O`3g$FNa9(Q8|2Rea3I29G<eEoTToRD+FBG=08o&1VQKpc)AHP$(iP+Hd;!
zb}=1Hp|n1-XHCqh8(-nznYG2gjE{%yi$F~^i$&o=df|OM<WwSz_iqs1RsHP{6t4Ku
z3}K}Wafs?e6b|qS2qP)-X1yKKf{*+i=htUiT3#h#X=zOWino9A=nre$v~Hcl&QO8b
zT5Q2oU7eC$QL2jxJ^}=>{R|Bbo~kzKjW!vUBI2bRJv>3jriO7bgc$jLg2}LAuCh+c
zX-RzQ)rI=ahkxGVJ$<Sp2>o5Jo&lwXxFt$3phe*<r4>Q}9xo8QDq~`@%G+9=bBy8;
z69d1UMu}62X(j|{cOj2_?f9P*=cqLGMbQ7;)Md{~`UgJ7Gc_J4&)-1gj0&tHLN?^u
zY*A4qHZ(Xs#}PbvQZwk#m&h)oUY(x)@!!LrmvJ`g;KUU|x!%6jhVH=t1#`rFrgEmh
zGzNeQ#5}gYM=G!%(nm920L}Ev7w!AVkW^40ovwZ?-XA0WtEEME@^`mfcHdjs2b8Ir
zns}W+zf&ksg{TQ()r02N02moVQkB!6**xWvyJBsxcOP`yp#Tz}PLljGN2PTMa&jO#
z$@%Pf=JjQj_MO)N#s~-}gbfeQmY&Qa76cp&G^i;}P?3rnn3&YSmcFF4`o0Wg_U&wM
zgHfH_omz~8uU7V{*%ns2cpxo_3~<Zf7I`l!8X5aLSLNVmLK)O{@k09RXPpnM{=K!z
z^kCG_PmnFX7RJTp)e~P+8w<T7y+UqglG@1pyi}H$p`q>ONS<1{dku&e*o?=q^`H?w
zRx~(+6DntQmEEJmDjv>%xdN`Esmk5MDXX#oG$M+ErRDYUT8mC03Dt4sHQe1QlbPI+
z8MhONCmO6!`$a%RG?cj18U86aG*7KaCRov;Gdzt!ge=X)&M2+P`n%%Jd7o<epV0;<
zeSJeDd&ob6?;kd;tVks*j7d~kZcac+Fjg>!q*h`z$2Z{=fcmUdyBQ1Q6UC+wmF8{$
zA%|7wGp@(eF7HFqSX8<`<+JPj_>rzmFzK~(egwN_(ca!TW~CfyQhTcggwXbXOx7d#
zCMPG?OGYiY*vzL17jpjnNSN}GGcgHCGvE10Dj6nd%hvl^YM1}mvE^iSZEY-FZmcX@
zilpxAA_L@XiHdfYj(u1WvA2J(tLwe3*9T#1i;LUSC3>&xDXYdK2Bhi5#o_p`@oR%W
z?d_mwkUB2d+p}Ia0$+D<3&ecDJABQhC+7EeC5HXp1W_A$*DR9Pi>#y%{Ld^bV6(0e
z`=K7+R^8=bH45e3Ehg1d=)bQd3CFKOVSE)%%$@1#ORhhQ7bSYC`0X3jsT>0|N(zsX
z^>-U04ai89jCJ;JI+3Ata5?Cxn0Q0VC6(&6Zuiyxap@#e)+5S)SB|pea5oE`W3@Ep
zO75u6T~?RnLlS_&&C}a55n{5)5I9W>9d{D{BYg2f{{L%|>Hnj}9hl3#zhq=Yef~`M
zuSDRgoaIY<u_6#_$@KIxPEYUurvlB!NsG`n*QdeoA&gA;E~+al3%H|$e?vbHhnq>B
z2u!rKQM`B|_t9A@Ohio$umxW7^7bOe&Zcxr|5=D80Lg+Rz~>I5f5lzauE>@<IwmF`
z|F!(X!#4bX#cdC-^<CyD1PY?SV?NYs0S3YCpZ~MzrT=49-oNkp|HH6U$U#Mi6)8kT
za(P{Qr=_LsRZUdDNcIX*zNiTna3BfLY3c2)Gumy0^SA|FYSNIbA}%@k^8DzjyBpF?
zG+g_jM`&+vN1js<F<xJ!?1ikPTT#!|CEl|8{`&qB*AW3pQ2h0lmBZ%C<mV2q5Nx%_
zQSEuv0r6o9MP3UnSy1}uk}+~KvXZiLa|@g<h)%sfEE70fRQ*<OH;9$O<rL$#)g6_c
zQs>C5lx_>hUr%h&c%?_DQz`^r!KKp7VCw}O&ki+4wW{_*AU<aHPSn_Oh<T>HKp%#!
zoMJMjmvH#A&N`T}TFrd(@Do!|t1t;Ts@xjr?p({*OY!ydFHoub12+nMKL>w>$K`pj
zdYoHjiN)RqNfs8uzWAi>WPN8rvq3UtvIV`heZmE#<99Kye3-Nv0UPCu>`TMP*9;@s
z$Grfs9IBIQ^7Zu<3MF_#zxns_EEt*z(z~3l%i0V4er;SZ>^RySjbWk-kIAxkz4R6B
z3?nQpFON{uh@p!)Iyz#tx#~dG(rOCAp?}5oYMwGS0frbgX24Gfg!%}_!N&7?aRu^J
zU623R?O&=$NTe3t7G{sHhvSh&pYERQ(kn8ABOx+_N~_pvmkILH-a}%G%SI^<v>@N%
zg+fOKb!kx9Hm`ND&XS=)uY&n-rH`}slb2>=7RAt#K{OtR#V8gfT!4BVVMTvnsFHGS
zx5gOp&0pH?c-M|zsbDr!B^Ve-bd^S1l{*ktF<ozvbQ^yYr`!m<CWvdap~E$^n*I8+
zA3qo;x=_;G3qrD{bKOGlIJp=Y2>rU`LX%iTlTp-uSDV=FzuAWeY;9R>8)NE&fR2jv
zNWNBvm6a7XusN%m_wr^dJ%o=fVzbKo7Kd`(e)FSe^x<`+V|aMSz)COB;rx2YtF=QS
z9*@=Z=jDT7p)jIgyYY3za*O@X2FkRqwq3=T3kwUn9_<BPraSMn9RB_`xpZpVOFspC
zsZr+2!75`&c=+y#_#9+Y9&OB+ZG0AlAgi`)<c|U6k{|Cr_$HY^aaC4U7S-t2>Tv1%
z>6QPA;#j`P;}TnlGu$h+$?#w7{Y)tiyG1NaNm929<fYC^<3abH<xf#mVMSU^n&ZU6
zjo4&N?m5(wiQeUp8d3MoS^`>zhf&gW-5t+S@vxsgBOi4?SlyXVZw2gV03{p4`&*_l
z?jzghCT3>jRzBMQENw%?+<cowHx{M2g~k48P)y$OpDA9O#nT4|tFtw3R_7se(t!&t
zU)#mq9Cs@{rk<#&CGq+A2m0W6dELNzrqXmm_q?3edBW?*7x?O+Jo)+Twd3JJtFU5$
zCVAnXo)I(1U~3)kYHQP9&SAB^mjde$^82RJO+<$7FusKtnfAZS%h(LOjEvlzoG$ZU
znqQhZCv$py6^#;lVbs^5O`kWys8UOq-WAd86U(HDjfeevEzT3klTMz-YxDO8K=b5(
z2sL=!q?^Xjja$FtVN_$AE4OKgja5u*ylM}Ww9J4V{w6U-v1$9?>nkrl>cBx6MT^*;
zZ+%vC4Qec2{p*9|=){~seqUH1kdQvcQQUej8yb%HB*o20rP?3wia%k7U}cSZ{SEj4
z2cY4X+jqA>`;GdH2g@PaQc%&1x<}L898`fE$%K#{WEEiE4IjI9+jmQge6x_GXJX(>
zW~IrU#^o|}vvzYyZHv<6xkM$2ibMzH5A*d!b0?yf9Fioci)$Tro_lV`!(Pw!CGe_Y
z9KFx&Q^aiX%);H83f79w>n!e1fYkx1M-H=>54@MLTj6v84P`_`{OR^t@b_WETjA`c
zHykx3*3I=WZG|j2-QiV6e*}cSB#xw4I>}*S{f!=oEMc?|1GjlORK;OS(sac&GdQ?#
z+-K%Z@!)s4Nfh)qVnuoz6J>6&FlU9G)Co-KHC|W6LFx<hj=4pKUSl#hqh>u`t_~S3
zr^}BY&0Xx{lj9<4wt&0piJ?P#%7r&<&>Q_-wNIe%J6<U@6&0N2<m_8h*&NrUDl>z6
zosf+<QOxJ@{)S6W73RGx=ik+`kIOe+6l&Ck**>zF&Q&ZaExnZzc&8cmC4OD4w$U>k
zDGc~14>N27j)x0<u&Z+1oz!egN4h3p%LyPdo6X;-s=$wY^jUj|9r3{fM##=w%PyN0
z=Z7AotwMx-=iP04Euq$Ezn{@5#j-7snOThkYDH=F*MmwaP1cwn`9cZ)z{WF6Lj!QE
z+gn>oUp~wPp!2-K(KR$Q)roXzzz@@RM-D8DPmHfL8xu<ISlE%x&wLfCx4UvcJw$0W
zSBX#k3W7A%zv~L(JdNV8(j=_iiX5G;f8g~>(0lmdsqAM7jBYV0sn?!|z90sI=hDzH
z$C0B&d`8m-7H=Mp<3~7!nsr1N7|PYw3qBVo1bFM@!mgixp@4kcp_yb2260ylt^V`q
zOQ#?OEYK_)Z6R}ly+Ru`n#F9XLWDZH{|&+e#H6Hz8y+WERE~l79F`{E#qjYr7H$77
zcauvxySObifv&TLt4X=!>yU%!ulm&(c}Y=85F7-c6Zb^ZGD?#7wEUw14{rKr8i&zs
zf_J55E9WXq4q#5Ly0ICN$9L$*7otovOE<r<va-0SUSv6gg3F{EVZT3=1;hTYmo4q$
zT~@zyuWr<k+<82)eUfjiqO)<Yr|Nz&FFJUvW7s6jjT)A}tL#(8K7Vo1*}2kvkhN88
z(%gJA#};zaW-Pp+7|o!<Z?kiEa4h+=dY)pgem7iH(1DP3aXOsa-*`3|o0uUd#JPIb
z{Bv}LNbF0$$i|Om5}{{l8TJBck?n6#sd$G|SAIg%)zI$#(b0d+0<8YwPZ=#xdzg#Q
zZTfC!@+EBhJ#mr8(TQ(UugiZ%wj#DEi-%=oWB^^1D&q28gwHXGm-{pp<uC7p=r>g9
zIzFy})+~dy1}L`%iA;99WqshfwT?f?zOiY1B8ub7#bG(!R{Rg`vk;=aQjID0(j%pO
zbq^4(ro66vQd-pn6zUVA2JASMVr{-l2rK!g7n>q(9(36H4*d$T1qF<fMM1+5hl2L#
z5uHqZwR*}o34$eb+Ak@uoupEq_q9)O=8dFZee_~L4aTA%C%VMlh$C$kg0#hdMmB#J
z`e8xhxpk>a^JPsb{pY$4A@iF^0mPM-cq{X=OiJU_al?AQ=2%$x$2zX+;N#%<4Lo>k
zvoA&z6Re>JRqhUs78NMMYegbk#H#o=CNa;D-l+tKgw%VIAH>#xR81U3D)r|hTZl0S
zdIP3p@TX^)tVJ3%knh~f=M%8nmm~~Bkq5GEDvWcj4X%*t>a;uY+N+t2&j2=W9cd&r
zDO3juf78>Q{!Cj;S4ZkfNQClggyyHGlPdAm?=XUvby0ldJ_M=}%yV-l{QUV|sX+6E
z#pEL|FRx6b{?yku$1`<Mz|0p+R+vHn?*s&$u87An3BQSgt{y6;I|58I>VcH(Vt+m<
z`JN(v{{%`-UG1y>;WCX2$tkC8*(_F2sA@F0?hGuDBjG@*bYNtx`UB#$aH#Sc?9YN6
zt}g)-{Pi77_3}m*>UY2OscF``f2!}Cb~%7FyI^$r9QB&dA3rvO@)vq?YM#FDjytMr
z%<65qB@U1VXfc%UcSB6tcEgby!L3+sJ-Aq0Y@Mm@k4pUMiKkmq^Q>p{*LLF<T<$O)
ze);ANiz5SB_b*TnKD$@laB&=5lJFH?na<c7ul>d0Y^e;0;pTQETve#W5gTK|FhH5R
zxA?9}>wJDUt}#K0bFtOW>K@3L2@k-KzW@1F8O@Fvp%wdP;A>8B@Maz!hhw?!<O}+>
zUs^x*-#E?Q-KXT~k_<~g*Bs_x!FV3kji37YUEU@k#V?CG$18tlrlrjaGbmOgYqhDU
zqu{21cwAPoLXE0Bnz~&OY-Ggh_QK$A8%TOVM0}^_?mNt;U#XuW?c@5NS<Tiez>X}F
zq}G0e;UWrG_LWtwPV1yhM#pHu7zVT1=pNp4=Pz`j&91D<37mG0{JOf?lF!8IYI_ul
ztC*GZ3`0Tm9GH<;q9?>D*1;vF#NqHa6UK0bGq>7cTxLb{C4Yy-7{l=(Ly08FJTkc)
zXI<2dTn95kGK<MWGLCm18N#9OWW|}Hd}@kg2QxZr#&Y~BlnPW0OpA!TvihEK6t)fx
z7;byRQ|n8OIa5b`bm4lkSp!L`zDCNW%5s>FsFGPuTeFYr5EAhBqico=-qs9NJT?$;
zFC+-dqw-o7g^0kD?U{i5-2qY`5Y)LGj9T0uBIY@*u8noQg2-B<Uy<6|Q)@RaGgVe|
z4jZEa=eC>CqM$D-&HHiYcV@R{zdfzsUZ{QC6GOkXwB&<6*%?lZxlr$X_RvIMK%iAD
z=K1dCnZ@e1M%@XC>E=jTz!!q5Tm^`fBYxuy!%ibRy8}0nUfo{t{Qvz-#MjC@(nemM
z4FNXGUJq}EKuf&1$Z8zR2vL^JNCJOk-30Nx&CJX`rTcBl$_;~fzTIpkhW`{=%5-PO
z#vwRRz@cJX@Z~PU6LO;VU^RWxqAXJ5u9v$-<to&}Y3GEflA@xRR&-qm?2N3eG9`(N
ziux6fvTl$HVt1bMf#GYNFe4#vm6c|k=N>E$Car#uyxTUCN^64(M=LaqMfCjMm%wtb
z3x`_gEtDbudkAQ;YTr&nP$_V<8eBaV$1zPZ8_eON$s0XfpS6H-<WLVt#rW^P)I0wT
zX}h8*X>VM(45yv7w0QR^V~h0%`4IztN(gv5fQAwrCZmlSQ=mz6*qY6gZ4a8NG+a#>
z#40yB%EduCiX6|^$mSut3C4Y%7X2Z4ZJX0Ba<d!~X9t?*mT8CKFmXMd_k`KOwfG)-
z)_;71U8H0$Pf+>7Hpw!+US3_o_x?t2|Ap?+hYxR)gQ0<lWb8yHsCmpv2R<%VI0r$S
z*d)g2LwFl9bGY-f?`Ipe(WRcPI87{&4e$L+8@&2oUc3c^dJB>-8a%Jq8Q!Rqd?gOa
z@)HDPc9w=Xm>d2LGn&wih(gBfPbcpLGnDy6>Gzl{5E}8u4-~T``}|ldR|qx?v4d-q
z#tkZd(f}W%&W73~_#Y^eJ&JQJA;EV4v|G+o9;R3{Zi#o1@AhLrTp<I-U^rwbZuBKN
z-OiO{DuL;U{e-AL?{}c5`)TsuLXZoRozwmA^9M?NY@~Yg<_#oNR#JfYos^XCl(WI(
z;uvm|pcUA(K<|p<X>Rl@HT2ds=SgQ{vk#qX(2CV;qxgSQhPuHB)d9kbCu$uac0MhO
zl3Fsk8bX}+?1F-Wg98Jl8NAN^8dzHw@A>dWfvT9%<CDmv9o)cch{9vQ=hEFi6&>yf
zNh`HK+x+sy>c;-`>;lqbG)mkr`WyE5_r1A#y1JZ?x6i<zL!R-~moTwOTLuh8FrGZb
z1ykmyxVX5X?ap6tHP}idvEz7RLE<t*>%c!?1K{TruJV)@W*tBAqkzd@Yukq~@!}b$
z?C<uoI38}_n-Gw_DdoyqY*!<1ahT^T)cpY)o$YT2NXrWP^a%$Z-}T+usEp5`u}Xu@
z4MYZ6&DNK$n3$MQOQk{!g)gbb#mQM=Iisqi1og!H-a@NEPjn3|oxpy>Wxr0MN$S4=
zLxY;yTHOwqdXfu=)q^e+LThGbp2d`@9>K(<rKJU0oZXo^BTGxo3?bB#=RE=f0yYGA
z`0=17PmGWM;%6)>CiYNu=&K+K1Z;yGQSa;9k9WN(C`--83Kv=fc%Ao1SXeMtXzD#K
z*a`fn1Cx@HwrQ5Tqo^UFvb9^@+_pEC5uT*XEBNgbUz%w)y4P4Qv{+1*M=ExN*yagQ
z>&x-xG4j9h@r0$`Jw>JOvRSGXrlj?p_UjnurqC%Wo0sUeOEc2Y7~fo989yBzY4mWj
zupnwZJZYh>`X+p2x5nh}>zkOA)TdFL>F-tn*^Wn>gCm3KT|l%3bTCkIH5<(ns6wCK
zM|iNyYwbK9ac8l<S25pYIM;<=cd<{+sn%)7_cMeVKwv2;4^yK_l>d+dXsrle*)RKq
zTP^S(Lwm>0&fbwNYAM(vwFvb!T+kXUUck(HxeprLA{cUjKMOV*x3;Wn+MmlgZIhD(
zdVgl>ob+hO)xu<62~D+9!1t$6>sLM51Bc72E6ih(V;Z%}ZFsz_U(#OL=%#Qvpb@>H
z>A-sJxcx)g^JhFOUL7&7Cn5Poz9Km0+)w^!w6Q4jxB8>9uH)_|^KrJsd=(51BjzO%
z_<FGRi(DTrxUqqB0oFJCaxdA~ws&^Ycs%Hs5FZCR4t&ncq}YF$00zcnPP=blAA{U%
zfux3prs)@Z*H><A-(jq6Ohf?kW62Uiwe!XHU?OhUE=q4~r4)~={7NJp*r}dLj~A$M
z_zJB@!G9*Vd`IFNTU}ipSVsO&Yc0Yfybsbl9idO}4$d*Nvomp0J|Jdu_k_C*0&RiD
zui4c&4|&6|C>bk~`jzf;4yo9+wmU))WI#?vCWC0_=kG`A+6^Mse*d;M!*5g=R67$+
zISRqwAO+>n^M>z|VzExQb=3llvk+|y!;^_x?t{k^Rb&fmHsD?IM<ocvL<0}e$yCvB
z6joGQ9BlK=hYJPTdlbAjcrmnI>XM$XfqJ+`;Uq_{Xu&TyE;AUuW%%5N>Np%HiWZYP
zLZo)WZI#9&tA85Y;yaY^pE!X346X-}JCMpqy71v~?OK0I6yv*xcYT~6BO@Xrwz2DS
z%HogYDhPPU|EQj8ZM{bs-_g_~k~BYOa=8_j&dZN<p9sD%!YmPexd+SLKIY-6sYD3p
zfr*(hC^&S!2D<Z5g$vxkyQZe9`js+J4IG|+N3rxuXgcwDiaK|h4RE2<w~jF6dqKcv
ztgWw45zFg&SuGYrXN=cV@?J_xicQTu54tnsN0s7^oMK8T67Z~YRLTqkU8Do;Rjx13
zFk7|jB69f3{qwQEwYv<KC}XyyLoY>YLWOa~jWJU1euUtKq{nVPxv84#`;pI3>@lML
zlK)Y}P;>Ly;Y2Vb94vS1#k{U^SrS4`<?#q}>W!v7x?G|E?Y_V007g)0GL6+O4l7tr
z+S@ojXMb)wQBT{F^s8kpVxai2oDC98ls#L|9XzfsqbQ`fA~hoS4&G8_+nXp&-1aMz
z6}>-KW*a?>R`Vx7Dc0zGZ4T=f*OMLUS=}oAjlXaU{+VvHxESq&Ra^|uy1{s$4AnQP
zY)PV|=Prx8cB|a(r$|~(9&RUz&mFin^Hm$ZS*P=ZsSOvth1h$t#0ok;2Ga!s+JkY$
z<sJgZ!DhJ&^HBxs{qUfm(z3G0y{xjh!t5YviO1-qiGMP8b-3~PIW^3waI|!V_6aKU
zl~q)_CEZ+HJ`DqXd+~nklP6F7Sp?iow6#AV`1<=#j*pZ4*gH6A^|C3%{`733{p;Pk
zFWM`no4kniirhZiWqB`$*g8AEdP2#hQfM)euWE8-UWqh_tt&#&hJm3Q8mJT9A1o7Q
zzli8Ad-r>2n{V3~@f_TQo9o7Pv2-e}8MVq`=%s9yH`rLZCL2tWYAUKEGCrS54aA5!
zUB4=#o~$uzv0F_lJ0^7f{F3-8G(za|gZnu))+Mbz0K|1U`)S|#3M(rw$7&2pQIN1;
zP}4>?I&2;$^rvtI>4?HqB>dTHn5jSZeG3gt%F6>KH_;Z;mTFc|%wRun`qC1SrBY>x
z)5t4cR}0g=#Y;aF7^y(}hFQuDjyh0NpDhSn+-e^T@RpZ9)YNd6qSiU>#?B_#?alL1
zP}Vx`1bO*`3^{+1JRaWF(2`zX<j49_`-TF?d;;+u+qO6?c+X$F5Gd9+HKh|NL~MQ4
z-9l!^;Kw!yB{c>+i4Iv6mwDLq=XPZM02U#>Z-UZ%?0NlzPe_#~D=pNfDlNog89q5$
zPFKs2oGT?HBsk^{RoZ4focIkf0z@zal@t~hCQtMEbl0(xwQl;a_J7R+SW9#k7M$~7
z%R6ztYWOWuMl1DWYGNWC&nKR$nuL^szId5deX}0!%4=#_P_Ppd-|DBa=l&ia$4b;=
zmou;LTs4ZV^mKg`XYMYms1TH=6(KtDX3AB&=}i%b!F?!!M*<PAWr$noq{uGGcY4@g
z(6;uD*dnmrv&DuLJ5JG^)~4oHxWP!&?Ci&IiPACM*K@s(09`O&%YEcn@Y9mJkcoIk
z2%E(F%0Ie`!}s~F>)!lFIQDc?KuQbV0HS;3?@*vL5*$Ln$Kk^&sdqoaD(ltALl6;#
zJSG%Ygvu4Te3a{yHOq}<qJ>3?E`yqTphz0%GH0jGQ!o;+32rN7dH$T=*GDo!Ge4Z~
zk?PmN@QJLnl(MMXXc0NNVe37uT3b}+c3Y(}EU>chT?-dBf^%z`3EUWa>94)^OO@l{
z;X<{_VKt`%Q+Rh+98Y*HdRn&!<J5UxNpbW-zin~z(I>u`UYZ016{<woc=BI9JmV)w
zX6L^aW_W~*isSVfBD+Tie$4-EKTu-Q_%Sy%#{7ginR#>qj8iW;s`}I_+i%L7lpt!s
zi^I^?_R$1_35{%%=M~IFX6s!ZXV|qp8hW*m=XwM!>=;uUC*D)i92$*UwufMO``8?M
z%EG21V)@49?|l{W`~SQ&{Vh$f3<g;HxkeB8kUgOY7hNAMNKy_Xx#JQO9gW?-{ctgD
zetsT~480Ocv1rhOWA%#1(D|XNG`e%%MQ^hzP_5{>j{N|4GHMoV8*KC_tT9L?CMHCS
zGFtBr^4hKb<f}4rxbt+dslB0AO?oeTqsfry5)IAoDSHlmY#iefh|>%v*0MiEjDJ@c
z*8Ag4IXS5cSw3v+?4uZLEIqpu8NK})7kmE~Wp5dkRok_VDj^^s9f~v}ASo@<sB}no
zi8M$_gMdhhv~(!l(w%~obax2S-Th7O`+44Pzx&S~+u<1M0O8_VYt3`cV;;dP)7x$`
zUW+DRW82Gf8eqRZQ3V<}Se2~yr;>b+gdR{fhQkO*4^Fu%-4ED}FJ~%ks5MFA6*FZ)
z03FE`aXP#_ujAg@IouV^)Zae>ehXEV57X@TG?#TNJPbj#zT3)UymbLdaG=fDgHsQZ
zarr$C`U)Gm<M<q}3fVJmW{tZX3kwEFhq&0p3yU!&ZTUS(C3*`d{mm7U;^OUVe<L<1
z&%Xhm4U>|~VoW~!^&_NP#SXB=dWefVQ15;YZ3i$}RxghwDZ!x`7&Wit@4pomkX%i_
z=AB?3R!!_C)Tdm*+YK1DMIQ~tUJ=|T5y<~{xD2JfkDDV%CKO&FJvtn9{ey<~(dtrX
z`kl7ZuIR$I7hL;5dp<#E8tocmOPwgY+`~Qv^9ifza?*J%V02?AM@Bst5MX1oIce`d
z-kR=8k2gQr`PR@I>$uVW?Ivuij@@iX4YpelVPnJf=IFO>zXNCr69g=CTn|CArGQDo
z2_4?O;%6`nT_T_O4gAOF{`6iwQ!@@tLj&bG?kOH*h~zPN9zJ00i^R4?I4r5I;(axF
zh?%Q0Ma3x0){N7I{GD7`7Ry8FrG24VL1DA;MW%eMQ<1ytdk9{HU@~e-YLfE9%|Q}R
z8ylN}HeLjQLvz(aY4LWqUx>1i_9nBkj1@)YGbOIC+(f*~f3p)aYoF}-OF?crUq!*q
zlDHH2Q(mPO<F9R|baRyGSMg$pea<YQ;NT|b7alN;qrQ@K6RDv3Y0V!5pM7nFVe3IL
zP-F1M{ZPV4ko0g8sy9q^-~RtjseW+6f_d>>PeZl{7*9>qVqm=Fa+75`MYX;8f)DQS
z#s(5PcwC<4!w1Tt@vN%k`JdS}yVN`zOMtv^wzAdjUVjK$vW%O^tmh8B;)L>zCrT&b
zc1On>$U@F}Q372#nSk5#|Cxl5ZFx=-76$*J0vH7e_Ye{DR;fDvO#X*4A|}ZG|1qA1
z)qZGfOz#@iqhey(gsvIH)G=HA`HB!vjbQYIk?}b#twusmG)se*m&egz$U|N;OGE7<
z5oBltSI%!1<utv&CR}E=8w?hve5GI}v(&7>7Uu+cFR#Z!+Ka8J`^oGGh={o=`PC*(
z&#6-xlLH(NCl0}3;3<F$-?xLn&?QU~!N>b}Q;@@LMQC>^P<dU0!y4jR-)&!sva?6P
z7Ie8QzQQOd;|LjjZhB|OAJOlN+s-bNR(rkS`3QInG<&}6BJ6%FOY9c_T;SV?D8LVO
z+e<^c*)|LM3*M0wOACh-D_~>0pW%D2`nR`(RGwu0B0D=<E=gc;xIdB0S;TkGh}&{J
zDLgzpEUZX>pNoiSIXmJP)G>?cdd(BL;^Jb9fwX>j)L7k*XX<9$&m?Boxb^ygLcX{L
zpiGX;<h`g|73f1OK#+Vh59i<b1!ao?uTwhqb?+n5BM4ZJV%Ele6vOrOX`XIjIlQBs
z6%6fTC#NVNTu9GMcUE!~)&Ea-7#`t!odlEfY?WQ_a2ZWTL<B^5i>6!aYZS<BO*dSh
zPdP`>27|EjV|GA?f0!ZAWWHOsb`AUcD=C*tulo3f3}-9<X$?{hCK(|@&u3&xCx9F<
zFo6I-3=AWrV+9l$r6nc*O}A&c;MS^g;iREKT4h|U+*4BrVYNh5)t6+R@gh;bfr5e<
zGIkfGs=HC}pNp$v;a;aBxuJh3DL3|TF>^7)Z9+v=3?V^9tPIaIG$@}v`}O<xP+wzX
z&&b=~S^CYMuW$3!zz_>Y+`83n&P##m3@;u1?vYAJNlkjreE>U>@WMjfB7+yuJAF?u
zgu5ydF<mNps@%{qJG`~kd>E-?^H2`xyiCdi=a+sdb9#K5n%dga{~onfJbaW?B72#R
zy#*5!*HPP(AR6H|pFqNc0b9G&Y4vaLI$M5zIsxAK^`r&v0^Z_Zvw_O6k`l$jB>tPX
zt>N=AT&X3Y@uvj><nFt=rUBq;fPzIXmvl4<P9H!l2O|_9+)S6eiUzf~Y@&eqZn5%G
z=hv%kF`nW(m>bsz9fRhh)_OPF0_b**w*?yy;J$!;Ph_rE$=l$>nj@q;cl6Kt|FrSD
z9NhqjP%7%tAa+AcJx4Y3tCobBqy}(wH#aQOAH~IK)VaQwl9cU9&wV1ZjbF^d<Gc{l
zl15XfRh8y@%?TqZ?6a0@PtjpD*b&doVvwZc?!g8U%6El2O7q6bBtwPAyQ$WbN2CLT
z?6ymtobD5EXj=ZcKfqQk(<)>Y0~MnwK-tS*d?7LO`1ni~Tw(SgMR~HqQh6hU?JOu7
z3?wQ!Q*^DpltSa;;t~=PF8?3_0tk2>e3`S%IdVyo_2=F$^GjxX-@pH(%D><SmAq5K
z^^WDXhh}#nL=9=1nQ44^8{q#LzT1Ua84${hdv)KI*_C)ki!ZKe*luLax4tRH?veeX
zU1JXw0}79>yWWEvFNU*qpnlHIr?x$oi?1^4{v@I3!T)}tlxL>y{htvCeO@wSV0s8x
zRcr~-8>#T{2nGL=TJKKK#z0^d^M#_fw;(AHYbR$e%j0x?zXXSb^!76XO#pTse^qn!
zi!ytYAocU&lcQa=F0*zOVc|Pn&g|R3hZ7Y=9LI$%0=1~<4TZ{s2E(>q$ZcWu&|{%8
z46iLX?zzndm^?uuEyH48Hv94$#oNG(!J!eP$U4JyyF^TSetAUkn2A485HE?q(D08<
zs$W;Iys{g2<~cHooSR6G2<JbCi_XcM7fZo(C9jE)E~3wGwgRXGHRbsbk`<r&NYBl}
zRDZW;uxq?Sf$=7>stG~YLxLI(?pd#&5YfZ-l*4Q+#p=}72uT9pe(j*DC9MSrp%tdX
z3*-AlFy%|i$Uq$W20dPz8BiN2-~IV(DI?Pz$2m2fqtwg@7Xe=YUF}Qxm!nXx%f$)o
zhxl$Q?YrN6&Yy6xu+f_yCtX_4IurgVVN$47Q?i%d&j^0=L@(C=0Fbf7gohIq=J|!0
z;9VRH#GsPmQj?j|qSVD-pMag|dPI7Fh59?5TW<NDWyu*1MynZoC5XUk6w<wJN^M(7
zha4LXwZ)g+{|i`>)F{YX4}J9WZ>{rr!H2{|(Xi%$45~C>YiJAU>4A`SUrl{W@Ey_;
z#9h*B{vyDc`#rv&Ar}kkhNq5A;gHLe_}rNg(_|=xtX%4BOZB+xg;>MWnz>c>TGwZ^
zTqFJ8-bKr90^kN|WMm{H6&9@;Foip;4`HBV3BKFO>TL@t=i)L6$PX?X`|x0E7@Oeu
z1}vMut_W(+f1vJNTFPN@1-O~C%xCk_9EAc4Qzgx6H;3gfo4{^FlGw^M@GV~H1<nH?
z#%>UhWsk#k7lqYUk&^P;mwWdBCu>q*5`Qgi`$|bquWzdk1@ND~=Zu3>395GiRPL7x
ziA|6$vVo-Aj*-)ALA8pW<ihtdSd@M_N(D~KTVVSvda)RZZyIX1-9(MynJJUh_f2~p
zq7T#4(x}$PYOebluiP_a$U+phfk6TmJi|XcrWabZXoJavQI{dj_!uIbeFf^Obt|35
zyUzK)M#O|VK@b=cVx6l!o~^-ly$?KjinL$M<r}t6gH#up(S8y;w)NCOdS*O_J_c1C
zX-&P>XCiFun1smZmU}!{$7b;ro7gN(&m8A*KlQU4OEYWdEGAu|lxU<Hlno6H0Z2i>
ztYrc{F|n~>X|TxW=Hm@M=v)SO|Gac*xK44(k24tkwlnuF^<;Yy&2Viv+hJ+Kp@{a`
z^42s8sLzCB9FI1Tkud(WeK8p>UTyl>)^Zml%_l6ymY|gWMyc;qq11spfWFz{*ifze
z#_@Lf3P@fPpOq&*Gfl|I81a=-{qd2~=Zxh3gQM-qlD9I)P<tFm$|?Mt2l_|=Sr&FW
zO24f?Z}<w61){X8(*tvRrUrhtg-0m<3b{X1Ad@TV7jk-bn#%f&mX@DiJK+g4^S$my
zq;Mymw;rp5cz(>@!<KySx${(2i$xE?o9y#l$q+g*9#p5d*Iclc-qnz0&ZoKQ`SjV^
zJ3jX32L$Zudj2-=2yd;c6ZAiJpqLQ;O?^=$oiJoQn(^pUyf6A>JTZyqT{H<PnN}Xo
zrwj}*_fFTmw`Ees{o`RtO3K8<wA+*o25tGeh4+d@Pxt<2Z>bytn7i=3Gm6P)%Gb$2
zhk@<{?^6T$?((`H+C^)J7&@^sq_|f@*Yxt`ClFcWsMY6bb%k9D{ekq@&=8T@-M`(F
z938|DY;a!gr$|1}_%9ZK>I!LXK@>YaAy{{799Gr3^8*1dhNXd<`(?=*X8Q2n-wvOc
zrm^-cvna{J*?Lhl+<UNzF&L(^0Ich~cW-m@)|KkUGkgKhUEFv>3yaSu-`vKZ4s;e2
zJc2gFGA|!O5reo=mms%XHc+rqq2@hit!AA@6rAegnl|<ST+%aRXd8Ud$5Rb)kSQ&F
z9UUD0iJ-MxH8VG*{3s<S^=inACm*1V_J|XSY6KKb!02{fA1y25s|Mdl@+-nEvO$nw
zKM_P!_%Toa1&;>nc`mng7`li7O5H?;^8N#|VPD2CS&NH{D=WkgDZ#8FQfdpHN1V$v
zrz#EFCr`SvvP>}6*%%0}5HQrFqL~lp=BX=kqR9E3pIIG%?x8ox8rkzMuhR;u2+rpy
zw!l_-vY#VImYS5DUV}S4ZL^j7h@^>vn_r;T&2RVN;7J=2YfO|ys#%>Z@4U2M7>ex+
zmCr*Sgxv<tQ%`|f{hL0=5f3lo$4gNk7Vd<Y*!b2<Uj03KnjuNs&4@|@XkO>_=VQu$
z{0RN!k%j#rPW|Ly9Q}=HpCNIWVUY-7q{>ef&sf%{k`g@_&qMn{3m)kEczIoDvju8L
zhlYNTWoPHS9AJGS#a7*}<$V>MyMZ0+&xSS;Vp`Rfp-<AfzRUV8S_+F2+W^-Ty=0cf
z`!{o=0fbdML4Y`oW~ew$Vg0#X+b6ZFB8LyAk$@`)SqjrpsjAxyXJ@aZy-`%eTit-e
z38$ELlOIXdIghc`RLsEOrNS!CaJFHM=&LV@&+P88DGY)tdYS76jr8}hg;kt>ZIE=2
z-?6|K&x@Fsz&5Mce$GFYi^ltLqx*=o2JBAI$B82Ag52R$B38V&GKzw@HT$*~kJ=CN
zgXdZ3=$v}%eW0y28%jyq_zq49fqH17a>^r<6{?OGqqBlStNgsEWVdX*9j@G*R{!iP
zY#ooXl?H$I$IoPY7ZMc29gQRcZi@rY`q|iedcOFhlv~YmzL6KSp!jsy&=Z$i%Fm#J
z_mrH-{K5T0BPQZ0>JMSLDPs;}gksED^j}s}zc=ic5Ejp}6u%3dYPdFOpY!mqBolD)
zJ~_JHmiV4CRb_Xbjg@Lx9746IGX29tn@NU=Ca$F=5vFS%Nkvh1dS3N}7psNMnu|T8
zgk;R_vEku?7vTfco#5FJ_VZ5LuU|<#4)5Cv>LjgK{^=a5KvBiAHkx1Oy6v^IgDP$K
zF2r<qCM2OVnT17mfSk{UVPAvuK5_U0hv28xB%K*3n5Z<^wiFmbXLO(-1d<oF9cjBY
zj2i)i{&c{wf|$%toyI*nm9E!bJ48bVS>?{_U*apa;itGrEli%Ok-hhVjNh4dCerqF
z%|VmIoDCBf56|^j=da7<1!C>&`4|ynOn6-2t!|O0L%#-!&$RCo<a!~hT%Mq*1a|{@
zqu2nswLmoC&x-s>bL*3sUzOL8Gv0i>KYU5`1R||LWrSyF_$IecVW3-#LAo~YUYn?v
zTXUCctmEj($;llgB*K$FTujO;!AuUew$P~BzFoXe?z!HhZTuKTIK0;7ifUigJ+x@|
za9>d?GD0y7q#K_k25g`^nJhJ`N!johDH*k%2s9I?ilWnD<X^9S_|K{PF*bqa-6uZA
z=LSs+Mxf#lAw#5;+|<w|d;adaN%SIMur;vy;5uFPD5$v>TBb+=Lz$0?d+@Zfv2xI9
zwL@S;VmOO6S(;*oY;wTuqOfoJAy$bBD+?P=keG@VVf;IRtu?ipq-RAgkxfdp??+M5
z)@uKYlLs6#v_Zy+!v)HSr;l3DQ1#4Ql!&%<ql?SROovjozNbH7y?9Y3P*?waI0ewy
z-?keqri+dfrDj%dzdHNIxN>s8Q3}n>(aIK4VQM1Gel4T*B0rAIj)<{;WJF|CzchH0
zpm_7yN?$?u1ZMoUbX~|B*;Cu}k~8;s>m7K<HLJ3M_JiXq9?M<I$mtd;1uQHqdCS*n
z4D-8U-MNEI?ex-kYplxgcm{fc32i>d#-|b2;>}sbYqF#hR%4}>0HXV+JfE7@f&g;0
z2AxfZb?(`EyV+-+Iv+&?gNlpFttQgu2MBW62iQLc2fG~qp86K}3Ljzbdyg!7G$S`B
zoAA5gDnq`T=6Yp0^JW+k%>4&QQxiL(C0_9J^@C;Ub!)s`WOKkNfRA;8WZjI-?N6!s
zwOwA-l+xl7E!bCo)bh3dFn9!~Ai;L`*bh_l`DS0U;diQeU!5HTo2x^mI$&@**Spj4
zr<McXS|u#ifK#}*!_;(4Ix%lXd87LGr$>+I2|b8(r&(;fg=DHK1f;~#+3f`Ga?fYg
zn=KOb2ix}k5|@@90uxpb(=kUEPo2UA9N+f_c=gp;$)ljTvA&YMVGq0hKQJ&n3@SL>
zd>c@H)dW)S{Wg)LObI7tHkUy4j14GaGa!Kj1)f(a^q@|HC}Y*gmx?ZTQ|(Aem-^c)
zl=14HKNez-cZ|Bj?x_g*k3V$lConM4R;6xCmsRpPE)*XzDoi;BzKV2;kGO$#(wJdB
zQpI<$N#b&LGf}Gy`{s3kV+<bvI*gxikEefm`FmI-{v*PqD*Kh0i-TiC4+aWcTq^Lo
zzbD_lnLH)M#9ms>6jO6C!&cxiKU1A%^cN6IBAvwnh5}d=Bhyn)#8Ge)IIQV!1Z&W?
z9&K1XcC1}-LnR_$1MucG81*PJ_s9m547VK&8ncvdj`2I}@p#q0g(aiw(bkhU*2&><
zxBz@sDx?DaFsGB6@U}!rNPYe4>U~~JTi`|i0g-mDIX&DE;@&qv5bpduj*(<d;9x<z
z<k<MQzo1yq9-uw7*K<H3O@iZfTun2z8G^oh66&xC3AYv@8dcleoxiSPyLM~Z(**Qk
zfBtT|Iq#QS^bhIm1-&#~T?MEf2>t0%QOYH>m_hi=G+9JUO!-^W)v^hp_p#4T+%^RD
z`aT7dpd4&xcGd#Uty$xe9%>iOtX)(BiZpNneqBrR!CySU)<|l5+H(hNeUoV#cH<_e
z9^%NpeEF+7SQ8u?zzowZJ&*uwH$JyN=3un=pAPynP~;#d8Mz}wjNkc8TJ@FV#3C9&
zXY_Qbkt+}hIzt}vLlNe(nOXtQ9)N3~0PRCw7p?@bI6R<vm)@Q#JFkc>c@<2iS#9Av
zH>Y<n2^@6jW3{GJM?MBbw9f9kpKoc$my@<Q8^W0za$mKzyG}X&J<Njm=xn3m>0NB9
z!)9ba_6OTWQT@ywZ7?8WHy_ysb`?H6iZnMs6}`gGR2Rs!)vb5CJg<FW_m}19VDII8
zW~jUv%i-FP2<sn+cr7H;27|uYT4&YbH#S7Zk3~g&RG8xGo%ab>A1M7VR0~i!kE`2s
zZU-k4U4LbERRR`XfH#cbi5vb<Ty(VKjN2(IWW;)&?BHNw9iuPzPz043Eak*=Tjy)n
zt<8DWfx_1CS1=JxnEp<tp3N_P>X)%GaS6|yEr9e7nDz0_JT-oSR@vXq;aqc-!snHq
z))4f3aKGW(yZsDISy@@bwl6b3tb*Zbp=r7S#Ue$YqIilwP2lsyk%*r)mPJQH3%jh-
z+r7&nCZO__&>#TV3NU0isqthOnSU2CF;TmMmpGDKqgSLxOiHR)8xxeG6KYZAv}&6!
zNdW#;uuO42?Hn#MR|&9=DwMBRAEaI22xq@>`BlQo$drkHJ>0D={nx)w72qH>*czUd
zl;)b}er4*>tpxS+xM5pJZ;U{GXdVCB?^yo*OFt~{#pw5(oE#4J_W0zs@0L2171;-$
zrb_{)eL(&b+$P0!;AVrY^d~BGnc3L^O49ppgRQ5lh{$kE!}uKEC`Fb&c#1{ryWC?*
zb{~iStDb)d>o0KG<Y0V$gUR9TevXaJuCGthDbR|b{oLQx!QSS<ymA|~3*aMTVq${N
zpk%WD>kuqKuxFogv*SGmejK>MFwq3OYq2#nq$VdPUljo&eqRMteSF<J$jIEVJF;R1
zN<;V~$v3kx4kTQJjPf7gG4A&S%^4Myv%jU)OtsIHNPgUw)9G2aCMG6jNR-j9<z9&Z
ziT|K^ZEcRzzq;8oWNmHfie08NG&uROC$;Kbrbm7Oi$^syjk+anW?K*m8D(;O!eDB9
zW%1qW-tecxbr7a(OnYX%XM%`JWHUtV$L>2qD)#oJKv6@vgS^xof4bkYi-yL=R`mXT
zIk~%g>)jYG4%SMy-RCaS?_X+?ka%8ya0_3b1!o@|IRLrdlzh*R=QcAn1x)^6_Mi7V
zfH`r(dZPHUxwY$A^)u6KQ^4g0BcG2|%586f+sL@*4r(z!P?}nurbk9H6nv_Kz7`1K
z{sft@T%pwhF60(GcRC^FL>5jpJTL$B=?>k-Q2pj78O<9C4u~?c4V>36PJOS_fCQAM
zR^&2X+*<vt8aBA#rj`d1&I4@_<z0-Ng0gfh(^1ZT2y6_cBI$r$+BH#T&ZJ#$aM-z2
zWxLuP%g4gX`VKgLS;<f&!AOJKazM?B3C8-sT#sE`oigjuo4SA4dUF$@eU5+pnS_9Z
z$PX2T{(-6UZN5o~Kd&J8q)W&4uS(g|tIz}-J02<-8K#dfvtp%GRpY{hve+%!Zw(EF
zV_)UcekS45Us#MQThpt~3hLTR4_ac#gMvAfRRqf>Nhzs(h18d+pD^Wl-v7>$h{zl%
z&=ln4gsIqc-uu*G=^p9CHJ9B;{$xc6nZU`g@+_DzuJr%8!IFpKUutQ6PSJtHhj$3D
z^$2%bUcKz~d|V5+4j2s}o*fd>nVaH*QO-gaD0P0Hx%UJZzDgrlz{4#qD_u;Y`=I{%
z^=nLwgQc&Z+F!NmlD;5h&TQZY?ElyQ&>15j8sU<ck9T5{2%AoG0(ap6RKT=yu_HOk
zQsZ|)8ZzGdNU9YaVyAe(`ZY}BrurXT>Nn<}#l$zlngePJm{Q$rZ9MN^W71N6_e{>u
zhkcINLE``27p;e1(=a@H2FStT8F15poOiymo_V4oDQO1c7}e-GFlr)*It}sysJN*q
z`6IcUt?eG49Lv0ML}=*T<&}@nwc$2n%7j`qPkm)g4WI9W*7Q=7?3(}lLVtZ*QmP-J
zwM@vyF?ySJGCKMbjc<8jA^G-|tZdKX*2c!~yv3{Ko-Ha=ZwgfJi{nP|9@PPXOx-#U
zDKRl1D3unbidv&g9_2Z#_gr>%GJN_?5n(k|9i0@`^z-M>4%x{M=>Nq6I(QA&Xl!iQ
zR36oO{4suGqBm0Fx|nIg%*^cU%)5Y<T3fp?vUyH2l23D0*xudcd2w(W?z@kQB#aHe
z7X|MGCKST6Y`E8Avu2iq{d>IHT`pux`^AeF^))IQ8fOQl5%~4WwEFWnoSeh!DlE%$
zbCt()MaNyE)P7i}Rti?kvPd^S!_99&%)p0tWxBh!3VKrBQ7|#n-bo%PetIWte_~W{
zN0e2})aCv5-~Nz2jcRRIEW+r>hl0){o!_Ht;@O!p6Y?ysJ**aMu2X*Z?Sx>&cXf0i
z??yx=BHm6I8BrNHSqmn|;;yJmgn4rlEG=FS3IJ0QgZ!zu-<e0q$wx7{?Pz3V-)9pO
zU}cGij}N|e)ppzZ7FymhS>oicP~?qxtDGIT`L%dFxzy*v3^PAr-p|U)+WED;S#wNI
zkufyc)H5;gkT6lewZBoQw^uO5IK-;&9o>a*CKg9kZgxjs6JmRupzAyV{zC>jioOcD
z?Q;G*GL_EfI{FG>#o+^E{nYKMkAAg2c5-fDU|<*-9wy^8$hswXow+jBlD0T6iqiDj
zWP6`ThdonHLRu0H4b$fgy1UKkvi!8PgBhP!*b;DJA#-M>Wr>$Zf0OJ}kV|$JF}Af8
z615=Rux!vIpIf!-J@#sP9gd6F77`W}WvVHmLzXn{idCRi4g|(?QF+v%_X8h`LO0hA
zC%+QD?e1ohS6=z}BLv5#`q>Z7^fVf@|6KImJKG)K8oOJKW^y0LUhO@~Eh<t_5cU!f
zJ!uo)`Cu#?U#qv3m$ry6kEy3s{H`D-W+fq3F){JH&sarO71>lcL-3^-<Ub6uAjjHY
z4JcEKUdpVic6ExkwfqV@(nu+|hs&aS9vB$7HCBz2;L4J$s&_l&qO&aCsz=sbl?BDw
z?)XZSb;k1~t-fA=c<%-ECrsy^9f`lujHq;8dUTA8-sy8&L`2babnUO)1Mi`s#j~4F
zl+xqr)*Z=6$oQla5D@4kvsv0E&m8^eJdAflxwlebJ5Ht6y1Ycvj{Wcf;r;t{dNYjv
zipaI-7L$f4bV5&s9~~ar&%9=DBrMc!z%&TakZ3aJw!(`fiFlBclhdIr6cwc^Z}r-H
zEBNzST6%Vo{-$IovvH5^K%e|<rB#$O3%k6op1#JTQ2u}p`t{K~wbFO@S~}ZFV#kJ1
z+Rwt7o=}%qb=wjUES-lWvF6jji~r%zx?!*O0FNj+A$&xvjviV@1$BwAyqt`TUvbJ^
zLQ!5SG&fHml5nUX89wjqt*3tmhDk*IF!Y?7UJPXtt1j1L-wln7Tv^_FKtO=`Qb$L}
zpS6+OgeD{1OHNBiLEq9y*!p)b3xx)nf87Tyugc)hr5wVg1IAf}g_&!K&rnH!C-dPk
z+Moq!e-5TNqM~BNXuAK@|F#41(=0(TS0P1p^|-c{7Ga}m2ljxBoD8rovC@`lL}2J@
zttu>yjI2$_%P%94QS_?4jSg*v7?*T4v8lPKh{9HZY_frYzNx)^Uapj`JgPju|6-|!
zrf6~a(h>oMxZY~x)fUnV0vd-^gS5iTCp0vu1c+gMEoV6QQYe{zcMEkb5#f7>zS~+y
z4M+Sgtw<YeZD#gX<B`05Xi0Igq==T=csMdf1#ekC)-6ijzJg{E5w4N1RlLr54B5G<
zm%RKD_^PzOKHa|`i_PXkDpT)Ex?tNE(YN2%u^S-qpGvgX<})~am64vlw2*E-T>~ir
z_WEj(y7ClEmaj65($X8zuB=S4cc3?P-2GmKfs5*mHZbtIG&zNuSjFDXq1x_v{!C_a
zNJ&}Pbj8HH=`Y1!QRb!jc?Csf*hXhtXZi8qntntOCKmecT2TOyubusmpfACsV-4hL
zR8)dZ%T3ghvZ1%NWn|iwk*-}roXjSS{S{v*`ig0j`un<=Jqj|7O0$eh0-NdQP6vy=
z(OCY4SC>;lxF58_PR$9dtgQ6)=NG;kcq5nQ6XD~_8_lS;-}jNuePd>j5PNFWd-Zd{
z;QRacT#L1QT!*(){ry?1l$69Oi?YK~HeS(2A%*=}KUR6HDfL2KLQd{6FR!wQh?c5q
z{O>y=>*gYAmEY>Ug#NwruAJl-FS_ecLclI{N;`3qIXpb_makAoS67z=c^oFPuP?a2
z#R@oluO$9sHw+FG-;gHc&N$F`1{EKNfSU>iCc2=*--{m0_;i{_L4ntV7(c{?ggyjC
z<Yr_LHVY4lFwi`rKMu^wp;J{-5_$V0OF{Rc)f<yr-)P=lst-lVE2t3S5s-59`OMG>
zt9BG~anfX&z3FInj*5!v)p63Tv2ksxRquP8{wRI%wSS<Jva*j-duLB}ZXtDWFlMl2
zmsdvA*QkCEk-R&lD1!{(v2*Vs5P|$ivf7@ET6rHJoVH~MAhE}&;4W&(%95FopeB0F
zp*daOM$k=h_-`$|#!DzTBDnr=%*$J4_$q|Ly2kj{l&;|QhhM)kzyg%p!+QR4{CA4q
zwtEMs3e<iKPo9)%=TNZdDyZKlA;MaP(k{I=O>ywt`R^(Hv#-(7@Jta$N}HPp6%?q5
zi7DZ5vhMvl-h_R}w{UDTr^AWpg=|$-=ziBP37lCuIqO}wahQmazoA`MY(s}jkr{oQ
zJJ-khse5(BL^#W@wiUVje6C+{U}gFG-URx|88T}gLgKrlW}_@DG2YL?81b4Kjaj+*
zhirR_rt~k0PR>y1p3v{@?Rn!%$n_#^-qy4}zja4QN4UPAoOun;=!|@Es?z9{B8)8z
z!WJlNSg%p+{nI{*p*y5nto_8#h+14&KuE;H$Gxk4my$M1Xkyu32Gc>sH?&O%k-huV
zzvuh~njVcG5FLK{_{lZm=+;_rn%)<%56urIVDd@Kcd*jA%3$K7fTnBpZ|9axZ{f@d
z)WZ)wl%68?CT%0ZrRga;(4xBk8PR?>NI-!9nU3wN^_!@$Z&$<X6-oTZd4<-*JbgYP
zA#xH5I8?-bA&C~IRya6bJiSQmTyKYV?1&2TW=r$SqJC7AjEoLGQuV`b=~Ar^O};S2
z;_U67{Nc=p()2AYjc45Bp{S*DWK_c0(Tw8`-Q&kgS5$lB26da3?CcGBla)~+(W5;*
z)hm+$#wm9(4(yM~pWWRh40TVzXhIF_nI2wkoHy(X1|8L4hBQTR<SRytX?g|*Gc$v!
z^1{lh$_$xA)Xh5AYaDx2jzB-Zc+)8RQqI|WbR>EN1S~OHcVa(N_n79=a3tj+Utjl+
z#1GQSIEDl>6=!T(a<KcdbaYrS4-WCKYNH=e{@Xs?dZnz4++Wq+L*F;tPjz)$BkP^r
z^#da{Rn=EB6Frf@xKr!IR>{dNTweZ@S|RlOw$kmv6+HfKB_Y-y9f+Fv*w}h>3Gwmh
z-jAjCePln-vgV0s=X&Xj>dh}M7#up?2``s1)JQ)&b6N3Ze*2;*2TO56rC7AFynb@I
zJz4a%?V6yy%uQtomA!SLz(C)Ln~0uJFmk(b`daxeieBowTkl3DtNSgDZngMM{IT?5
zI4O{uRUs3a&%?iWYtkr(Zo<mH8*#;?)bat`Tv|avFBJ0DenuuM@GO?2E;a~TYHJ%A
zJ=(n%g%%DfBErqtcQu*P4u9&4NSLl(`MiP#&1vyum1**QW~MQ&C&TbCr}f25`07;c
zMVnkQUgDR$jg6E!?1k%(zz+iUM^k2LX{5e_vvceDv6q-}TFQ?f1qEMD(o0KA7nhg0
zLF^>x2Tv4BA&EDICl8%1e8-rb#Z`27{%Pn~3bo5D=013+7EIGzDdm{w%$}U#d6I$4
zzU$Qm^6nE<baZeQz~41~H#awrNy1&yA+M^ctDsQi+B?HyNyZeBlvHoCud-0_<6S>)
z)}39u4-D+=6`kGP)Se?FBk$QZAz{e=>^aNxx;)Fxw%}wF!_o5%-p<P`U*8ulcYfV@
zNn47gcJ{1he1b3B8u`}qI~dh=%QLYh%N-b@$>ow377yFwnI_ARZERy%O#`EX6Qe7z
zcJUZ>i`JHF5QIaoS$3Kb;l`1MT&~rT!}W+38JW+@N|EiZMS+1q0D>hXg?-CQ<1k6_
zD-Jh!@nUJUgy<`aw)oqbYQx@6qacbR*I7ywzIY-X0XT$5`$xR>y3QL@U<NKBn?84~
z6jp#v9xlk|F9A_uVfW|eGt#q#b#HG+7gkkOLi?SW<}uPg@{rx^V`wPFP}AW0lHXkD
z*RLbsEsnLat@HY|%i`E-XJ<~Z=KIei?BNLpX9rcw=Z$*w5&;2!+S)riv9Ir7chk`^
zzH@M(d`85{Sq3uOI*0vd@z1{!{@tl^*?c+qA|r!VK&OFz=xFUQ-obnnTd)nrQqql0
zeEh|ZWO8qBa7X%1m70^A>-+IzBQ6n9gVp6Pb5&+9QY2}4c~;A5M{D==v?~vmhYv55
zm7`z}{E*!RU)bGP$WCe>+`Z-z1v91NZzpoOPbfVtDNLTtl<V(J7632E4<FPdB<Q^;
zPzP{W!+j`Fn?Hi>$V|QKby=aOhsW)U$jH!J>IkV_#y#2)nlw>qrQAz4-IG+Kq^dhR
zFd-tan~+vonwK7hfT2x9NKmL&EiS6fMD=v-@;v3f;$x;5z9+no4n?tz{tl<M^+Mqv
z$<z8flzF`Lgxk!_Y~_i(rsDekT5ws^(kF)}P4PgxU?yg7c;mI9UTiY+9l0b`pcSa4
zQj(It;{?>z#8Iha)1*89UwtU{HSThcZUTo50ud1r#y;d^g?RKwWcETD7!tVMc<b>r
zxXRhRduLjNpf?a{dUa(DVB}Q3-#D1Et&SpdyEHYog7p}+r+~|W6A)76o58-Jq`0IB
zVF`moU~MPN@bA|V(NDqR5)zN>k_7B}iVE5Bc}&`W%!M`>*SmlA2P+b3P>*X(ogv@x
zpa{nPU~9KM`}4QKRdZ`;bXwR{jc3EFUb3|{v(mGTsj{}7Z&+`1N}cGN2vI)>@h|_@
zZWJI<^4O|HCj83fcaIzpEj=*COvxML(BG~{>?zpdcUA9+;f*iN)2?WmHoWyv`wy-3
z$CgucA_-SFx8@bLKi`TVZ9r05k}CN0^t4Z5d!}JqP>;2AVK*YPG+g*A1P8gVMRstY
zn}pQ6KLp|G>?P;w*50uB<<zv$JoeBeEoAJBaafM^eFI(!v}LsQehr>N$5zwrj!hEc
z;^1zDOS)0;@uS#^<qvW`k8mOE#RinXhtSp2@{CR1BYn=w#pSV_gjjP#CY^EC3G->U
zOt-tsBswapT1>ozxW8w|Zv$ln|L-1FJ)y8x;iKA%fS#I{SDt)eFjICY!^MJ}nhFJL
zgN2dtjm4Xkw6qgmexGkhhG3X1>W<ASih|`IL=kwh@Lw!I4k;i#Bj>5-mNc4;jVV37
zgTrvb)bp{sEaWUGhtBJ7h+j!-{jOD&Q|tOQ@s#^<$O*T&Trbo)#1O)PoE!!ZkJ;ZD
zh?dk(o@lD8^EzHNe-r)WROiG%%TWFP@{YzQ;As4O6@p2|(Kos7o0^K)eNTX!4(Y`U
zU!0$QIFZgSoHg&ar|T`HoJ{(@SZbc0(#hGGnwdcX>FDlqKU>6c>TrcwdlXsScC&LS
zGzCi$EEV}($yQOI%ax9O_A}d>TyRzulrqa{0;5O<^6}*snl<kUK58MIoU-UtOXuEl
zT85=z>@y?WZd)kIJ0av)WMjtyjUjcOSP%K#-YxAJ(Pw9GlnCeJ<Ku(jhRxrNDm!C2
zWff&#U%wJFfQ-i`D{fa<PoL}v=rw;VWI-FN)StersSwsr;<LMpi}x!8#ZXz9Ad8Wk
zo5&>ZmEdu=XLp>rg_)$ZbhYi_*_!ebGQsM?j2y{aG*l34kh;6`$F=ruLo*UpR`w{1
zbRaw~E~hZFt&|eLM{o?{cPqD?mC*Q%ff*SURqL*UJNvVz=V+$xyswTUcA|f4qRcfU
zJ-rnYBmm>2G!vsh-6KcL%!P)46~&u(=eFv=^3po2ZMLS$*&0%WG|skHxkK*+ea_<;
z9Byh|JYO&JO8Fu*6Kbk(H&R_rS$VkTn3N_MoB0<1PkHYR-CQAFid;!aDdFm=x@+Po
z0e}3csOTs345iZr{{B0om;tEVT$g<Hq^Le&)GtGS?#$g@URw6@+g#d2>^Yd=%!S^k
z?F%U>KK}3SZcb<1B?o223~BEj^aHf2yTZ<Vv76v>gDUyhEzwGKRvyde;O^bMT$KU}
zCWo@J6uXo+;yw@43U9UFQnLZi9oAB;PNXB>pb|W%YOp`>_V&g$>+0_Ioon1*PNIly
zr+@uJm1Ag_(q_4*t{{U}CRir<duolty35v-uP^%FuwJEuqoc5>Fyu|K$v%L?%dKZ8
zQu$gDaz49Pp!$4Im)-q-J1i@1Lc;}}=NM^;zo&ZQ*+fcc6h6W5@Q`F6J<AiriH|Vm
z`Hu+^W2Y4cmvO42p5BtkVi#<<wOJGa7Nd7+asuyWJylj#?$f|Nf35Ppw)BBy%ySzA
zaRl)QLhrLYH~;E9&5}Tsipol-tPem4v_to=%T1{kR*jB~^!E?MjvVWngto*h4NSJM
zVs+(I{VZ6>r}x=2WfCz4TBp0C^nwhnQ9{3fatV2Lpsk1-mDR||NF{diJ(1X0v*1f1
zG;HKJ4%23!u6*N#VfOlw{37(+tOzrj;Q7W<LN@o)Ym)z+P(x!%=tB5w;G^yBH5g}j
zJq0(3xy89WYZHp?F)xBx*;X%tuFg(WPUVF{ZYwmQ&mTgpH`kV=lapm%AB~pB#l@SO
zo3)6w!X4=)SnV?WT5WwK@w|onl*4YvCAnee!0pOm1kb4sJ1j6D*meI`#g8o1Hxe*%
z(j{kQ$yHbD&Kl&slEEh=%*l4gq*halVaEsO%He$T(U>u{osy2xLrDpVeBFw-r+do7
z!^0pAO5`)<IyLbaGuMcVREteWc(@TcRLY@Enh5S{!deL4hS;m#R=L^f()WJ%bbwfd
z@8>65TU$LmYs8r_K}rEcGIsU7Ds&>_-UQ(;G?ZH$nU-jqkGYuZi`U|fBON)@r_k<T
zF3$g@jYlIzMIok%;R4uJfa<APV<YA3*Wv6LawJ^#sJWI#%ZnnhrSF{&)?clO+TvMi
z&M$BGcKtN8ygYU-0>R(X(vseCv#^eW0uCvup_v(i>$hU>0VHKkWxNPxIE2!d{5tz)
zBSaA-Ex>meyPLWm<>0xSP=IjXDkL0gR#+HBl~_7@B@p7^-1bEz96P_ci2VP#h&p@c
zjTESiJVzPQLV<GPNXfVh3>30CIp&RQoKHER694Y$QBYRK!No_Cd&Wkut}DmQ_}qK-
zLy=eg7RhV{K;PIkJf5pL8PytqXp(Aga@Su0{0co##kRo89}}!UeFx@V`xBWJ{4GHg
z@qsyaPi!0x55Iq>N_p2<_sNWBY+Q(oQuy22T3pVW*}Qcs(lsGi^nZv!WU@uJ-yR`Y
z!0P**#P9OlX{WER9s9Y0|MNF*Jt)~j<tXuph%)o3XlUBy8F~7^rZ|zul%W!c_Dqz)
zkOJe=3w;v^!$%=LvTxQWrBmGBwz1I@&X5&60wW`NVc^Pvw=&MqU5>F}l8W}>Z`QgE
zyGCQ7k)<35JD(2C?{5e<QKsBIJFrPpr!cwm#X&@bifKv=i=2Gh(O4osJt*RbpE4c=
zPl;`7F~lX-xm>;lCpWGUmAyS(a@<>fM&{<|`ACx3;XbLBHK;k_Cg(>#?3P(%zs1L(
zK%!GXK%hv=odIkdgl<HtSFberxR~!TVx!posK_MZ&5L>Fuy=n=bZi1q?CY;!(h|E-
zvbd#zr6)gvUWGj9_&aS97Y7L35{2;m!SBvaDr}_FZLi~h9!veHn6M_wZ{{PGGnGbd
zha`>}vPnYq_namo(SUQTSz$A|WX}C7gcP|NL9646%nC><5Ge7=N=IN&_0Hsk8vT<e
zmNV6M-Dlm4awlZ$wobOTYXCgy;mt8WVPNgyUmvfV97m7VC+L#}rD;l@iRFD#yc+%e
zqmpG7(`$z(Tr0OxpIJ^8LBy!<Nkw*kex1$!QDjHNO0ag#`#OhnS<nz|SXja~6EzOy
zGf3=iSd#b9Zu=c}3>stq#=*lgQY^kDxJ1xV^WN&l>jxrAg)#3F5E9}jT_T=^K5T#N
z{L<aNEHj$OX@2f5%u}P>LqFHBy(^v9@5%TdZEZqqpqzm9EhGu>?xs0AvT-{WV5Roi
zdrRXVFWeIF+ikwNwIhOdpn>ZCfcryN;GtCDH`^nHg~o{M&g;B=du5I2uZxsRE5yIP
zwl<fA2)b%UX<dH*(~q8?Q!Y!(is*qpc6`Nu%1-q(yc>hLFIZiDe9Ov;LrOt`?PLGZ
z=5&c;FY}3XvOrWVlkr7mk&ezxQ4xOP&mHCmS!RQ}eb!ym-JJaViB}4EmR`*bZr@Dw
z`hF$N%-p-@IlEnIecd$edgS%PxTN~Wk015*0!kR==-(dS3|C~t9XE5ScS6F(T9nk2
z+?==v@ia77Us$tpvkNp!9xfmrRNNmMS5w!F^LdQ&%j<Gl;*VDy-wOIeHj5qD6*PX!
zJYArWCG1JY6nID!Rqg=qlxCd)8qb$SE&5`W_>sbl21nmF2krW>Mxi8~dW60l_7bcH
z6DPTF8lrE`kODm?LY0bwjJf_Bm)Z4IVS8i_EMfxu#nC(sUWW+`G&BiRo`-z4F(xR1
zfp<ZFrB!5mIM{||XKSbL;LPhx{9|-v!1n!`)Zg36h{CLzu5CFvoj?8P9QnQ6;&}9%
zKM0FbR2vwX(m#Iu>MxQ}ndzT1=Y1l{F7eTkA<)7p0bNk*9cs_Px}cD#cIuC;_Ks|<
zQaWB<<i#cMow~nP@*Yl<F4boTTe;uA{}z7t+<h;!++-uB9})yt$GdRT`lonHW=_sF
zC+afm>%V1XwU0;HhMqV%%smpxi@WuGslDH@QxdzJfrRgUX<i<qWmL8zZK8nPJp&5J
zKTF`WyJJu4kLQ1ciXQag3>z2MTVPR-?GH}rN(<T_3McUraJ>MNn0^HN5tXmGqj`W?
zva|NhRvQh1cl5l|6DB5Vax58ynh#&=9ghi_FvBedTF`(S_BOTHw)loPLP^W4qN#~O
z^}Z)hT?{3b-E{<vJ1L5hYC=}~5WOi9NxtOd^c=b5Z6qLQlQIEX@lg^WlIuU5^ZkE}
zA$u3{m}sv&Z=o%3OjtvV4|a>mGDFHPh1e}`zdwFkEZ%CuRys+gk@zww%{$kP!lHto
z{P6J!CH;d2{TziJdfTy3Q4N$&q(p-z<0H~_67}fVSY$LbXOCVyP|a7*g~{D|>tV()
zEUB_`a<1l8O35>1Zr#UdmQYX#6ZrfyP^A+OeGdugq~lyU2Em=j{-m9|(2asjq!g=I
z4MIK22WLEp$6(|@ejOfOnmD<O`#@M}us1;r`y>6%tL!v7DSPIdb7`RCRFHtT%)uct
z)3C^cv56d2{0sba6a19dcR9jDFJ22h4G0Rj6v4WZ%lH}y(nv3gc26H!dRx{HLC~!}
zrrJqO9lfT4`0?w4W=gt<gO;}g{I@n$n-2OB5(#eKzRh)fKn*KS-49eK@I<XX_YVl@
zNni`U0h<1U{@egT*lCJh|9ryDKSE`Z|CyrxS&uv;_y@PS`5dHGrIdDkiK5Z2=FB8c
z3Hsni>2SU_;E+k63G<VV-@c?tB>flH4ZY`0<;QEvcf`rfC5b_jl9J!SL@x}lm&BBT
zK3__L=?Fc~|01p400%~V*j*0b)L*|}yrxKb$Mew_Ke`)lYZ#H>p7({vTrK=n(Wcd#
zkgTA$1`AdNH=j>>`^7!#R-MAQ_y<OrU#Q_os0fQ^%g!#ZZdvC1&sVgPUu1oKa!{3(
z{|Mf)WH0}G<)%TRe>W83HNs&(#bsVIG?df+^T7{aRAdb9{`Y?Zu=APYYvh7E59;1>
zBh#aCH7${Uq1RFpeBOUw0;;z?!#{n+zpp>L(e(!1@?fi~a&~q;4Fy~UmP2|`n|3ZQ
zm6Z=2N7L2+c?V4&|MPCD?Fq1&G%XOo&`YZEWKZ!RGe%9^?X&+~G<4&r&2jWX0NS<-
zq)L=jM{9Ror7p(t2?#PTUjXA^cM$m4Wc=?FPJG5|wuMYhZ$J|73yFVmJP9YUw8}~~
zX$v>M5nDSO+pTr+3v5gH=KqD)xE{+UJ>YejN~l7A+Z_uR()L##FLc~3a`IYQZp&Mj
zM~g^I)o(Y?pr$Px+iso(2L?*sK!v9fLSZ*JOu`<R<qhm9P=EU5`I&-=+iLm}pHwP?
z(&q9nskoSX;CQ*=cHl5cPf~-Drc{7-t;?U~>myQk1-%Bh!(W}8B)}fVBP0_pA;Krz
z6m+sbtd^<Rp0YMI)vsnYg*X6S+YNgoqv2mneBp|(ztM&%^uM{&r>9ytOM68OVV^5Y
zr@!0QeYe+DAGJP$e(;e8I-r?=E9K?p!fgNt$Mb(tMm(JRMgy(ls;bNT%NPR=BSZ2b
zpU=dYeUUCcu6Xr!jT*khn*H$}GChb;alIK#%^DoaM4JWfqM}-8RXm`<6Hop0sc?Vx
z;sOC8`Kk@Zzt>(MBu87v6i8`+!Pr}wWJX4s()YtpnPf1>?8O#G<KQPB8B%(-I7s?m
zEa36gb1?nke?A2wr}pID<OX6cw@BZp&2Xb9Cc9t3=Z*FKy8eh~qn=<xp-m2qW8-#z
z4>yc>4TfSOhm;0R7FSDrgTD6N)ddgaZcR@qKDE~2IzgIG_sGkjoO$OcL^EsZTbgfg
zvCR#wvRmd>7%Z(xMHe>GPGvn2iGqk@Q&UUsH)H;w<ce^%wcCH&oiUUqr%R+knUYa%
zF@5jRvBP`U!!yi(ZXf4=Zy#A$Kr0S1PibjE<fcMDn;zS$K|)N-ln63z2CcS}lM?`#
zsNte&YVGavf=~GTOcjpGM__$Sh>w4ZlZt^VTzBWt6zP4rN~dHX?!p4urB(-twHk~9
zO<iqWO&v{eNOW|daZ1R_ngX0-X&EdhzGgPyd$Rwb8Y-m_xyUmb4*TUTesBrebJ>-a
zR<hp>U()+{M$TjJ1X|T?go{ks#9F<6+`XgBDmW}9CC{ArXG`@jW7(J62OzZ^Ampe>
zd7U_<xc$=-qVjUCQp=9^_UA6|h;T;>b#z!g$;v{JDHxLlJe(H$nt%tbQ{@u;%?0}*
zVr;4HX>mL^T@WF&4g&-2*}`eW;ra;RVvnC+P!qFg)u!d<Zk|spuY`$0NX+A4?D)XX
zfz=*|pp+*f7jV(i)s?%c1fIkvsHQgn6g~lw@f#1wYeGlEl#`b93aL_;lc$FkAlo!q
z*fuMR?x)<&pE}+8dzj~Hy0f>w-J++L$VeAX`3o?7mGddo^K>Jl#orv>57tlOLccOI
zFj7rmT4>0~JbJ_#9PRf?L0CszJoLnHXaCr*@@^@Pw|4Q<rz9hV$kZ(_Uxqw@nHzrq
z=7UZBw>rwokHBZ)&jf)j)8ou~FatPENMfd91h^JU19|bGc%tcGMkwA49E28m`8xG3
z{I)GS71oFtH=s$R35hR%b8jyenumvge3HCZdwV-j5kq|$bxP+pPSF9eG0a-?pa1D{
zuyQY;x%oQ~W7#uh-`UxTKJvpLJJ=h3qE`C8o8f6@dHL6*0xLHW1Y-WW+6wE*?*#>S
zj)tE^H@F<e{c{+x{yV14|7oMsr=$cFNE~h#;F4D6<UDBRgf;T7mR~m54?{n^2$1Ob
z_KkeGH=Z6SE@8>6YvP`oz@nQR9s<#TDfY+lYC|li#k9J-i}k$xy}-LRXg1%e<;`&M
zAP`+WLJ&onfZ$cz4EC(kpLN%ZG5r@WkXZ$scCxawSHaNW4OysAY^*K@CMIYYZMUy{
z_KI!6cYNULbl+GFxdkm&QB*WhWiLe-k@5(Es;z5zDa8wMY>1MRQ$~1xTV!ZxxN(3h
zzVc*LKu$u!iy}NCh~$)=o4a>9G5j9J#k<9oT^4m+BqXE;x6_5ce+QuJfQ$@bWu6bk
z#ZR%Yt|EYvbYU}>eoCHMnpay{DXuMpc?UIM76C*5YgDv(R<6&n=*6?7h8;<{-gl06
z{eAL}vC~TMuGkDZ7k4K#;ud>LOM9`Se-xE(7+4(am64m^t47!Bp{OQ>B+Ds@rGeoJ
z4-Ezf#^Au(+B#)BqEv+9Yf6(_yW|68*gN&FxD|I=;UQW#GcPI(4^5GGaF9`UC}UN|
z5|T-BJrgo98DBVUN&c9T@%O_OS*W<U`15x=JFWZ1l$-s%+H!J^or@9&ywudGLLyTQ
zjwA)DeO~;(8BudA+Pk{^lKVKk&rnS@u4e8XK_*j2SJ(LtrAb!?ro~#y_nh!#xd7TQ
zR~qie(L=e6`?+-JXm`)*JtPK`k(O*MW%mEFOx3&R0(=$8Zh0on>YWxA5z*Dt;brZ8
z_Kdpy<-ZS~lUz?P?gPS^y39vzvI%c$iw^t$WKzEh-X0uvXlb|MdhZT|YF!l-S!QoR
z4_l^*w%-X)t7@yO9}IkP*S?F6Zn~7GR(0ny&~jNT+kX(A-e)!8i5<M&<RcorD%e7N
z6`Z7Jxn5~?NlO=c@}kz|@a)1@Dpt1`6=`*&u}Vc<IX(NEY>7SRCW6-k@24bzx-VaX
zQBYvQL!*?!$24?5tbUGc)*R6@w3jgSb+@ig9BRgwZ(U&He;11G9xClBs6!den|-aI
zK0f<1*ggN_M<mzS!?AKhx!1OL)$zdc4%`%>qgx1hvz4H(5T;;_NQV`)K0P@P+`lw~
zQ(_!8)4d@u9h#_q)`t;}8_DZ|{hcyd2E|2GLSgqLAR@&M$cMd2d~#2)hbUHpVcbxU
zImRU<d^`3K>}sHIuz0w{i_!@syqp|))Q=&sYzOWCpRq|V8D(L0dOC&#URN@%yUh;!
zUoGLxwXm`>GqH&L8jj$LM{r1gP^d~aJ~>Xt=TTgpaVPHGi6cMXy_=>Ho4Dgt-OWuW
z49%K6nYYBaZv!?>lV!#YSy?MkInvS}%{E-m?e8gz7&O=Mahp<-iXtKcoAzmU$LaBo
zzPfsA^<lhR5>GQL10x+BYC6tP<}GLE^AACy_o5}m{hJ(ZB|BkuXl)TA{GCiqNx6F#
zyp1krO&m2<ZA9%wA^z$XX|drt_hVU@=5{Ct2Q#J9#+x>i_*`FVYm=Tnzcnz{FsoX%
zur?Jf{o&=)RRbgeHu_-kzrC>%e{b{gtmKWPtAFUH_6vR}@Ui^c$X69j^Ct^(FJ8a4
z?TqXI3V%s?vAu&$PkZ}A0b3<IJ9LisgTEa54Bzs*g3I;T#4%t|WPEQ+ksS7jwaR24
z3L>bMbg342x$mU~z<ww#ir1;HQ4`3T$=sQne^WHU=)L&u<{keB`PwCGzgHu`u(rWv
z^BMjM#(>Gz!=p0a3#sS=9>*&YMa5JfAD^1|CmVT7U0<c+*`(lH9%^Z6Zcg}J_4csy
zh16H!x>Ki9LMDwJsMP;7aX;s>a?Yl=WzI7@{@rqWM9z_w|FWJu4?#Bk*i&!`%M?AQ
z!}(M&;?ub`Eh3+MVQ4-}^b#qAoX^BmIQB#T*cgY+UTI598aRCO9y)v!zlX6do6Kc&
zl(%|-EHa0zLNmDkw<qbTGlFpNVy(-jtKKykimRrr0&p3B;G_ZzPS-^+Gv9T005)&3
z7^F{4Hshjp@TO={nZ4MXexS{Pb{)2!#B6RW%e|`t0xU*v-c(qqCm%jK?+g1Qf7_8e
z`cV*3s2vw9`{178yjb!{o?n-8R&Q%Ublu#vKt(zYZW*hJ_d~%JycrmKweYT_feQ!r
z?O5LWS5vVE?0Hvil3krNEe%!YSwNI|>AbQ;jwYr@q4l$`dS@pDfHcqj&iG-ZIaniu
zA){>$i8>ECIm_m<qt^)rHxZGH9q!P&n~V(RXEnCPkKvRUhvvq}H#63gM)LIV?~MIb
zKqr;Md5C*g0dfzPb>8v|FFLt4P`!|Sjl0xe@ZiB(S~F$VV5PNIP0J6LCj=96pRV^H
zhcfPX&GgM1@lq^a-uvFT@-C3G495GZSt&nE=AUQq0-!uFAOI3&-#szfdp&83Z~7Fl
zNnb0;cXo7CdHnfWU#}zRI0{Z6$<JTJN*Ctj)VjA>+3bFqCJ3fz7eqOkV*O6}g!=M2
z{oSnqE>&D%;lG2Mz|tjVge)we!CWo8Kp&f0KqVDnF;yezxl1YhYk8=te1ai?obLY3
z0FVeK%Ywe#4h3=f`3@|0?8LpUr)!+_8bB^a?VPT7@TMGWN1y`@Pd@e{H_1)r^DOd<
zB{=;*q`hTS)@%E%O?L`Nmw-sObc=K-f`pVb0wUdAN(+M0r6Ao1(kLY*UDDmsCA_C=
zJ<s0ne}CFz>@obbbdkUNy03Gda~|^p-%G+iPI^w)T^w_Xi_L1vX+O;<)0bg1;`L9p
zw035lT5@h;uaU!~8N*VS`iWg!sxRGu5B!RJ=)(tH(b|_G3M0Y4O&2WrkA0}!b|0q)
zRlRDTlE>dQY;>f_h4HZ~1Cfg>rXiKRaE;1Yo1dQ_k5-J^eNgHjf5SvzTq<o|R@TDt
z3!}h;Th37z^`5c(uU{)Z%E<njoE)1IsTyTuWP{g+wv79MhQF-2`W@4Uv7w=npJR82
zr{*MdK6{;(5HUvvRlDv@s#oFr`d$-t;-RB79D1Bzm_B#_l6-i+`cIxbH7b+jX8or`
zffs1va9fCdY}OU-eJD%4g1Y5m)MVD~pARoo9cLG39NeQU7nnl3nu7}?`2LwVcM#<I
zV-6*_!z1Irc;RG|H#QmtcF|{OB`2iHNVGWjEMw+8#QW-UNfUlsSC?GRBD}Gx(Iga&
z9Sa8s`jX<U1jWQ=phj#zV5iA*=c~<eeQfMtcJ^}^4J{^{KdiKIZ+!gx88iEF=Gd1n
zO?V{3vqJw4x^P?N6*AcAq+cs|9T5>28W5v7C$WDxx+O@*4c8yI55m|01^4(5O-xMa
zO-wY{Q3M!=`VTzZ-D~WoC$7Kh#ZXHMdoSx`BqittR8-Vf5)u&jqi}J34BkvmE-Jzk
z`$N9T&dmH2?#4|sWnaE9O3=ss$NC1Q%gE&`I)Zl0%%-cqWdgjsMnQZm?T;n$EJ1wa
z-kLP+-zEnJ_iW>u|IPF%)`25^)&h`bK!wM{bFGqrdfeYUcLG(M939dnTp~@_ru6g<
z*ZL(K))l-8%*@Q37Z%^)Qq}_GGvFH*hCBYd?a3T;k00B?uQet8)S5ldy)QG&=0|Ez
ztG8+sOLa`GO=yTHr_aW>MgLJf{tmp-afd-D4LJ%JU{g<SL$tLmg4gk714<m9a~GYo
zbb!w#9wa>Cm0=I5U81Apm%|<GIWPN3SA4;Fd*abG;$GY51>%z<*E0QP`(x;?rxo*7
z(FhWDt+}sX>+QoLgc478@7s^@02a%`wLVZ<5Bw<i4@S2D?Y6qMa^CDC|Bti)k4gq^
z6LVM`UL$j!xPK%I2b-3r7Rjw!cdkA3^z}h*WMg9$;2+sAIv$*vc?Jx&lenU}k4;T9
zJ+_xv*eK_A^Z!T_1j`x7bMZk}7_cPVr}rg=3P+_kZ-VdSP~VZ0%ydBT{22V7&*vxc
zKNTN%@&EJZ|5_sYfA}9-73m~ZJ>=v-S`5=xR8zFGwY_tVyGZm_RBt+inX5T7Gc)|Z
zkC5NrM~HYp+$US&J0`~d)2CXe+mn6YKMSIx%X?`zIPG;eOlrcd;I&a}l>X_h_{U%B
z>h$z5tXUM@1etMNw6s4!8oSYa*v6idGkb|j-1k1Spt?qEb6uU*BWZhMKS5#P$&(^7
zBBFuzb`CZ+)vA>D6YiL=c$k>vkfcRW!3GWQ-x`{llp<yhfP_8Ts7z$n<%gqZ(Wvdm
zv_%U&`~T7cI63V{y5c}n`9>>cYnxgd6H{IN&ZE@uA35rZ3NA>m{*p~jgq?m~kw=jB
z>Qz`lY|f(PEB?3U2RFVYTjT6TwVtm%N@<cxW~^*3<l7!Retb(7{WJ`>*sxqfU48B9
zBjpYb*71(%%a@j_&cW{|f{Rkckfg7f;NkvgX-u`hEB-qoKfg!}dYfT=K?lJZY{L12
z1INX=_VEGQ&G@97yj1hoii#Q;5H$Sf@bsmCpRW*Ype#57*x=%24bOZ4@=W|&&2H%Y
z^TEKqoS2yz8vQmg`B~5!Tn0YJcQZfLcYL3W(*{q<#_*aUT#ZMcXocczGPAQ^b#Nh2
zWrEY942DAe#M|O7E>+XIOq`r0G{02E8;wYaZ@<RCZr?myRbe3Ak#zRHPThbgRaGz8
zpw!bn!PyU&*E%8L3e4-O5Wv-R^vn$G8JL)qfBCZhlgP4|-LvuJn3m7xeZiZ9rMz^^
z*DTq0+FWZAKi%z!ox9obqA{fDLf-H{g-w?U(0azSZ?9VXViB;m@jU2dlaNr<P-ywt
zdRyD$q8FPrF%_J+31Yt6@PiN`{Z;RZi;o++4^kma_+63+4;_7D3pO_|F3>!Lg_GqB
z)yDceZrys6@w}~#;cg_gfKSiaNY%ieWUxQsx0d$Kbedf?s8&=N=qmdB8PQZ(`A2oi
zDa5c6Ig<<X??FzRfg5O|P*A+Kx*{!17e7_%pn!!HK}ktzZl0^Jr{D8~&FZA0;!Wbq
z98NAVqriF{e!rT=;^Q4r{BBm4O!R_+ElP^ukPy1}nopiQe)d@8<%zR~(179D$haV9
zs-Tat->Kz*Pep|jM$Z=)0|Ps8>9pXJ-=-tW5Fd=D`F)>`d&db)`or<*EnfEbf~JH1
zzI3sfr8CbiH@B=$H|!*Bz7fEK#JIRbWYL#yX<|KGdIL?bc>IEb@h5<8z@y@?(#Pj}
zDu^Gh5G&meN59sKu_@sratTLg?`LAgvEX$AbDfyiu2?QeCtHhS19LYV#Ouq8u26!c
zSF^;dR(DK^@G$%)l3dWFMXF;M*jN@<-@3tH)OJ_9RQIW>c!YYY7%HlS-!;IuUu)k#
zNvXAEV_~5`ygX~5680>LN^4JVyu`FH(a|%%z$e?D825lu+~r?EU^zm+{5)*A%Jt0F
z-r4|E6>aUN=PNc7oKIf<sM&$ltr;d^T-@-dfo*dW)N_0)F_o<hP|RXz_-G15tPh@8
zNm#2WsipJ0z<c7jdlj-`KKHHq{i@~Y(=rmPxK4lRSXvR36GCfCEk!sZbBBZOtf2?o
zs1XvHd~%!r_U*2Wkj%q}N-{DtpI`1x=)AFvPkn1+n_HSw%*4*Pyt|2V@adfu2Ro~^
zy-gtG_+gTrvRqpp8y&|6S;xuE_v+grFsG2wzwi=YGqI%*qu~IRV6Og<KnA9nG&h&s
z_C8=jFRK46hsaM`TOitn2o{zjfoisq9^4ejN&3pL@{_;i5{C~3hsr(s`ifK!MF3s&
zC`gmm3ld8c_9`l3R>ByHp9@%zdAHJIW3P4|E_sShC@CuSbSvo}ZGMP-|3Jg^8O?70
zU<QF|vVc#8KLTw+dw2Ku?|psk?Xq-Tw6faTV?f52k&%^;B>R+`?+!mDFlz?=8P2nE
z_;ikX1~LsB-97Md(i=(om6hr@|6XYCe4d>RraNeg$$N)v!zeDEQ&ojCBs?h`E8)Cs
z6|?(`jg=LTS^`>Y(N7A;O8^*GR8!M2)`8aGG4a5&LvYO(z-CqCd?vqi`SMbdlOaR6
zzW&qHn2VDWaj8W767E?K<Q~}1G#sD()+}RYyvwOugM?MfEr^ec4L7$6JLK*j+nI*%
z6B8JB+F=Dh;kQpWL63ra5}(&Eh2|wHiif8*afGct0LCgHrx`W-I<0J0$AXxDQMFN-
zEg=^}BcP<Jb$s-pG8fO|_@eKCq;TG|4oZ|N4jc#nGUqjJK+X+%{&RdhNDO-4^0b1i
zeee6A`glRfw6Ja+L=Tvl^CGDQvp{=Dz#mrn8$`Q7b*T7;e}{<)^VM7MzSp?zgLP3+
zNzc3QE(_u-Oa)?+B&lTnKyJEfX%mx2(k4Iq#lsXtuU3-YC4!dX!gGKB&@Zo~1naqf
z)_&|@OsuM=Y*Z^JGjn0dCoG;j=1g*IKlbKo^ffgB3+Ht7jr_n;PVQs+t{{C*!pPBD
z`YfE3M=~W~RA*r!$>tOjd-gE&VoZBAmpYYRLPEl(TmUx;7t9Q~29F;@nTJpLPo7u%
z9=jW|_9GKr1lj>z_&ek{)Sg0!fmarW&A&M~*z~KPpD%Y4(Gy_(4glhj-PD)amX>)_
z9qv?AT->P4-c|;5)#ooQFE>YD5Zu(-8$#zZ$cQ|Y%w9LMzvzO&jpVj7xpi|=92b|B
zB)Gya?6N3i<sTS`r0*qvz@7tg^5yC~d|`sv59g@a{AG`(hCp42rV+Ts-x6!WaCP-3
zs|_yf1gi!OR;@)J_~;~%vlt0*RM;wgwr;<80c+Fem$N<%jXs%;xs4Dp`xvpdkQ^Hu
ziy_TuHQ$0rV~mgCe!3X423|Vg`an+Uevv+4)~(hvOgq(;!Zl00ptCS=aID}RoAJ85
zv?0yn{Xr3QbWwt+vMlVid!%>59|Wi|2!7*l&dNd@ZbA|b_JNIndYV{&d%K;<EZe@U
z2K*v@48(_(VDUfzPk@3Yx?Dd#((l`UogdymN1iZqoS%pMRg8@ll)?ip)hJ-Lphtr{
z$j^%AyD<S7h!n`TZY^djy}_!Qwy-iY^S1t|vaG;Sn(xnJd?6QveiC#~WBMZhbHUNN
zy^UFJv)j$j$X<2<Eps)z{?Lwx4#X`C0a{k^51YnlDOx&f-4|@HU;esF0q=M`{DbBg
zS^>o5Q<Yu=GzOU3zwXereD6jrX3(OlK3_Z{KRR~y{BZ0)LD)#RcwcK&piL&>Yl@Vh
zqlOlddFxBR5rM!m<~Rzkk>O#c{LbQ<L~S)SP6bplbEqa6pZ0gFdTrv+zp}C>$j|S*
z@f-&Wo&A%6>SRJuQ4!7@D{I1DL4i%+ErFg;A`N~0h|F+5U8snxaZ=(ks=Jt9SOSD_
ztYpdtC*BciTR56`d;p!MrjmdZ4jDOl`7L1r(m>cKv4E}{t6rsRXi)D=Uy4aUeCOWj
z6zZAi*Pmlbii#okuo$cIT|%#Qs~jZi!Xqc~XoZs#g#j!8@@@qO5z)|4bs>xDGI!rV
zK`G2ZboQpknd-AkX6ELYv<hNSnP|;q67!#5T3+EFA&525h<SqVT1mtH=Vy<zGjg0o
z89jYvK1g2TBm|bYlairGw&rJLov?`16ctfD3G<Vp(?t^E+{aH#mGO8c{pwZsN@1<>
zHqn^p+1YvK^)3Ok$H`2JNe<jrY(HfOJTEV=aX;_DAA<Gpd~|N^CutF0*3bnWt1<;m
z<v+hJ>B`2($LE?Zxdmf>(<^(kAK_DG>Tqxz*CGaJupcQ}xd+!Iiuj<}*{!D%Slu;q
z|Fdf6{(yMW6vR$rL|XfsfF<F&gk%g%Oc`Kv#!6xWPb!dAvMWP(Qkbp_B0<1(#O6Hi
zB_9ryXqX0nUELGyhqwF3xIP$lP3wU&K}0PruaB+v24A{0Hgr$}egU#*7^)zO;bgP<
zzBD|)Y`U-y0C91|CO1yf`gKk2<5J2|0fF;#R5}+ceD*9{&-}tif!*L0Q;m$t@{tnD
zFVx(goHV-Z9R5MckM@DK#DH)itE$&hErXGkK>cY(^JSQ|uXZ(RNcX@%Mtr=i;Yy|y
z#`f~cN_hcn$w7}n2OTEHbhc1l(R%Xr@EYu8jWdZCDP3z47G#yNE3X3E#4n=>p4bg{
z{=~b*+M`r+KT%#i6*Z}=$WjnSUc5l$4r=fqdET@VX~=V<Ob--ueR=TG8`<~>vQUbO
ziW2-srq8@@J$N!@#5N(KkW@9Wkxa44+206r1smf%tLM*0v?*}OCvGnKMCr3=f!k8=
z#`n=LylsHnEVlDF<<xao809+j-Nz4jE-Fc(B+hESttE|NS?4gKX=^v;7k+^Z*2~Ua
zSvub$4lijV!i3j69d5f4toQDv^IGEs(B0gswV(4i9oNi7KRPX|tQ2-Unt-}I;W{B$
zI<{og)K-QdSQz+FoB7AeJb17?3E74#hrpDSQ_mX-hm+Jguq1tTI;HtZcvmfTUt+&~
z#seD%7w6#MkWOT3=1P^gwj}+4JLc`s5cm#wZCYvI>Iz36jhHh^n<||tP)l@Io>hD9
z_#@KLWgDY>8~t8qhX#Pi*n5KZvtvUe!G+{j9AsJU*W2Y$)yHu;oeQ!WA(Pcxf_GI@
z5e$~MXHI`zp1v3>p}cRa0N}qJQ8&0O@Y${tV5oz>Ydc$kd$E5Jl~Q%^VKprK{n%~J
z0^k&YBq(S*GgGWT9-pVSwz`UTc3Dxtc<;{Nk!52$v+JB?=Gny;5mCrD1IlCAzCXaK
zV?N*y+KJl>YwN6}+b1>JHDk943KmvYUTrQ(QH(x$m&Bf|ss9vRn#_?V-1McsBjJ@(
zd-ll_Q{byr@h4RJ_VM!CS=)~lTDocA5yS@+yzQXYACJSNrw<?>zI&ga-{H~5dZ?Au
zg1%t!r$69)PL*&$I_^iYpRyIS%KRc^K1HJ=g(|%!)$-=P7|wOy(dQ)-NEvdHH8Dle
zxg>I?|8Taa3B0-wO%AHcaO*!lUH{9Q2J%P=lxcadfI0qjdloa|lS(@AZ3^Fw1Cnrh
zob|bw)IQYh$!e$8Ho3i7bl*48u-=><vl9(>HGN^~v#}`raxW=LH41nk?<GuK;V|?;
zL-!K3w9JE+rI66jzEqw+Ur|q>L8))^9Y}zPpO@y1_f}Ug7DJeaQ=v}mSB;&#k8DtN
zHJ~I^b{PWWPl2`$4Jdk*_Q<I};Q9vbQh|6pyu3gb*_-`?K2~Ia|5TDd0ZKiCt{CKT
z;4;?a`seO9*ZCgq=il~UnRZHr=7iyw%$03)^yw#4Pz>j(ioZG_)|D8(vQ4h>TEoLw
z67#sgNysgV>@8;qla>fbvu671Cs~&KpV6%Uh}K2~U8PHKKL(Qk-zQbz<<k@7F8v?c
z@B7Ev+MJAx-}bXpdU}+&hk`|-Hj^n3eXna=Pa5`*u<&m%78o=&;~~%VD5vvy)7<s=
zKrR&e>Z&!OP9(!(Q%RL(?~Wv1BclQSL0;Y`I3NbbzJpbf`z>Qzl$%W7zLRf5K^}pa
zwSHk>n~WkRW@roV5oKWn^6*uWKVljT*eoocXH-xd{;LJJYTtq<l|DdHiAhd3+bJN9
zYMHjPZ6-3cGK?+_jhD9@flb{Y{Gw+*Iy<WbdMx^Zn%hz%r5Ui-<o+|TX0oYJmdxLZ
zl`TXTKRop$LB&g(5!sCHBL{(n^$Rn;t5$wVHYx0CEg_Vxe=e12WW>T<lF_jQ^`sa>
zCO9}pjfP^l*f;M}QVQWM)@DfVXxftFny5&(vY?=%A}x;Suhw&J+Umy(ZVE|a4T0!J
z>hQVnk0HYUOusib|2PHyQF#6z^&q*<*_Nm)v?eq2HB#bRH_R|Df%5kzJktIvc&-?k
znUmI?AxM_+^ht~0Z)FJng29r>H+pk(D)^h(KLQ2BJ#b+bN1RXF6?OM+ZP-|R{`{Ld
z(X9)@o;auN7O$ooVYRe6D{B)Ao9Df(&`~67tvfmG-(qj@m7D!dR0J0*C%MQM$=~=y
z)I|7Ltqo7{7uOWj6n#$GEPr0<f<U&<$HDPuJEX85+Cp5*==uE1etWEtQrzaecTY!O
zU(n{8u^mTWzB*6st{CG}M6=wF+qT6}5xKiL)H&6Ys@FKNmR_pOVf4l1u>aF1i?XVk
znz!e;M=oGV{cs|@bWC|ORB;e`fyTn}dXg^>_7!jiI3$(0@D%yirqty}1_}&PpltiG
zbG7g5w)32>uHJ(DqRr>FU3b+_?eB_vIh)sGc>kdf5)1cB&(2<)nGsve!*nOLH8q!x
zXM;pG1%(Z!qGA<J0Idvw6O%ZTu`|w{@(vFU;#_rgH~t=D8Q-xjgKjU*FN1gVOWlV%
z*08Zm`8;LuqhmDIWc5f9#AP!J4IyK{h4Z1dhP5{z566pjHy3BZq^@zWup?mb8_ov|
zn48tF-d-*+_+4u)G{G%yN7VJt!TdtZtKUQKKmZ6gQiYLigKw?IcDkQc7AB-?Wc2Q%
z1%}Rp1K(Dbn_swpbVBzm@W5@lS-tg*w&kTz)%*nxt*0`OFfL0cnsZAt12QD!E}L=v
z>4lTaVQfksh$Z5ja%j4dr9J>Y3JjfV%gfg_d>2VC*JU;KmzdRG&nbW$3P+;vbP+))
z_9KX&)a;1PHRCh-Cd@ta3r2*WF1rJY9|l&M*eibNV{NS`#9zrMe<n)!>=tL0SlH&$
z?n|uu7(2kKtvpLw(v8%?$;8@2?)&Hqw`Zwd?FxR7d_=&1df~2MZ9SRh6?0K1%Erc`
zt@X4W!^cKX<XJI$U*Cn$lr$RG-gxS>)Yq?BR!CMFJx?4qw-E3=UnzD6g$+159-0t^
zUO-!_!2SCk&E7;rL`HLinK{M679$$m+FIjc9-AMM6YsWgt#6M^=l&4%ygP4@8TC$>
zdF?3^j)3>U44b%ke0&fQN@Q^qYM}&}nwuT};4wzx9Ca1&ek>^1oa*zUL!d}WraL1b
zAwiA`X?i{y+}pbi(Q1ga9UdMY@2x%0EX5{`o_3?v8XxhGJxfi;^nfK^$B!S#jYpf+
zH=W_?`!S=HmQTYwVuzUSbMi0=sLIHQadQXH)7@34Vqm@$c%GP&l$4SrX)=SMcYNzs
zJUaf-7w=;WEv=}sGCG}EKMdDbo46)a3K6g0w1sI6gIu+|V#Xl({b=1nsSNeRR?R*=
z@e|s)Cd{m=tJq2Q;2<&g?G7X(q;jzk|0;a^3c<_lNmXqO7do^2(=i^w+#D)VUm&Z9
zQfzL*T#AZ{3aPPLyI(RiZ{|LNm4bn<vaT+~^`a^s5)Qihx&R><q=X~y^G5-<{Hkxc
zxoZPP?79u%XTqQ|2-;6o*sM4{+C<DqOXFZ*P`$E&lpc=#`Up$Bj`=+<E~pM!9b$^0
z_qpu<1#ia?Q+Vx%aPjXmi&jcoAGc1Y5)(!1f8BCcE?X!oRo&R&lP>AQ2;+pFSYt!0
zBXp$SFC5gnF!hle*b;04^#40h7!%{7qoUFz>^8S``4(sqmxsGG^Jpa-)HBFY-s?9b
zn$Xk2f-c;s2Via|)Iu2YNLQjQlH-!&J2&gsA$TeZ3RFV=D=4@Vl@Ry|Lc?YBC7ge5
zZebC42Yhiyq}jmfhYu*NUXY*foE!Plwe@9*WE;Yp)C{IOyn1Td+5s1C*h$|<s&G8x
zh%#bF3N35l1`Fc=Lm2LDBBDl@)1O~kGG|W`$Tc|nIOcWGeKCGJxCJUZn6J#`A>s(7
zH9Pl>*5TiyIwPl|>hJ4o^zIh>q8D(gzWO=8NJT{nv97JX&+E^a0fVeKXy$l<?X&$@
zVwIc8oBD1vO+KU(d4h5l{%rw2S0LDbkEO@&&1(kbFHWa%z=g>^uRO%Ydil#Ev#{{{
zz^Q=9qbE<0DonnWNiPq;TDEX}ud7R;?}LDxe}*KJK$>cX6mVV0for0m>mi(CJC9^x
zzQV50dpfp*&h5?X93D2HY(yYzn~ZSBVe#w{9p0ABR!ep!9ex2CuRp@p+yDuCro;TS
zBptUfQ&hH?u+ZL&55_GS{fO*4#%y$lAl4c`(sbg(K+`jyMe{DJ;0{vzB+y)6uPtk!
zrK%;sBTQbUBrD4hE;#XgI`qktC%^p8TpW}Y9|c52JZ4{S35&^a+q<BSc>qz-o(9i9
zHSf&1#0{t`u8Z#d4GC^AFmRw2zZdkH%F4;xwksB@`$8lBn~FC-qak%>=PN$uGAZKa
ztHt2ofN=|U_Vnz4I@y6VN&MYMUSk4q|MEEy`uS?M;dhYa6Et~kBcr|E&qNQ<5l8Xx
zItL=C&f=SH<`=R<4i)1n?RRVzY3Vp6d`I#L)zo}m-yle?BJqmf_eHosUh2dvjz(H2
zf*$ZxA>XRB^9}ur_+7_m&#o#~*ud&P40$PO+;S*9(ACxTkh+=U`Qe{_cIGasKixXA
z+Vc5mz~yppuKCDc#-Bdj=$_-*`T0P)u-p~rI@g1478U?FLEi9=2*w}Iv%X__vX%`S
zNz^abnL69H%^mztwBEJ82>S+MToVWChUKX#5fCuRF8$r3L6AyKW&g7A>ecJ2TXd_&
zcIH{dA2AnD!PPc|fwi`MUg$%;6BUJ{fQ`b|(v8+krABtq>I>9_{dp5Paf6+a0dixA
zXF;UDq@V=S;pi`gByYC(a6qfKE8-X(eFC<|u6?90+ubam^^!Lyh3g2`;zAykd_mFc
z9^`bYq=6;GvU>P^sTyB<Vji?CoY439$lMBd>F8S8|I`MDMq^;%nVv~GwR|TfC5lf>
zeC*#67K!s9ae^OFBn!51o;ccZNl6TXC<Xr5Gu~=y3WLNlRyyFI^0d|!&PO64F`po<
zO7`z3=WoGvMad_$!nQ`?L350|E}_9#k{XaYhfcuPBl_pkuLu*cZ_A-H`2ZcI@3P5v
zud5e~ns2Zim*pSJr1Hx=g`@l~<0pbS(}Q3hn*!FDbg?<Fc^wA@q03&ZgNh1A-a%84
z?_>f4;dTqV^-NaPda~{wB{zYcA*HHYU8P`$v4g^>)>iu1Cf}u1c;8Iq)c;xiRoBpv
z<{66d{=oO*jN-<nO@S@r7=n?w29tLAxUIH{eRw=Lig!YBD1RSKIt^jGpce5a9;>J*
zH!61&cp%U!WU+k~{4E%ocLHf2HXnm;K_^K?^lN>y`@$sHU(q|8(D7)HP-Qd*N}-HL
z8g(87CkbxP%Z6vw76#hdu6q({+;4G9W+AUI07;rr_k$x{2ZgQ?Yrn#3NbA2n<e3`7
zlF=#IO?Wh&1z*x|NsE5St*%}>%Gqm*Awhx*R$gA4@e=X&hZ-Wd9qgH2#dbTt#L-ek
zd_s*?r&Aq#{8cR<bzWm*M`WIV{%pN$=>LXCMHCX3DFR-G1BQtV52FG^@M(oFzOD@K
z|Mr;d>>lmtN5n&Oe9lUYXI-YFGs$UG{$`BcuFmOnHnBM2oZErjZm#@Adq*E6r-v<j
zVaQOh@V`+1a348RV@*CLgTO8tH#Eor($oY=bmM;rh{a4-ZFzAoeWs2+47LOWg~>1?
zvg4qm{mJ@XRbFIswjfK8U~O-Wn|7O;NVd#;IeY;ekf*znR$tdwi>C)WcEvrTQn*<d
z7%J_QyPE=oaPi(kOmJCGV+RpAtmV-InsPNx`!cS1tKbZrl^_W>Cl@9XJn8co?a6v`
zBH@Q)^iwBhVV*dyV;_G!1#@QRw8`3#o9NLpM7Y16@*91z>i!;)WMaTwAtJj_)Zl!M
zMO9)yQpwBCPF4RAHa|kEf3B`x8`b)4U}6IMye#>GRu!ogYeIx-M>(<B{}7wq!AADz
za`JGk%tfO{<&gVXL{|pTAHv?Wen)ZT2_9Vd;<&wqlgC(><@*OcP=qN3pCp~%gLUL~
ziEx!-j0T2t(ucay<<G+)YFJVKSS2v`TplzEpVw=&`pqj;m&q}RrL9lTwdc^fy|s--
zsBkaLgmiEdKgyuNS-2Pp^o3@pHJZZbaYm@{)`#>=2ZTs!JB|Zp6va1hl%=9z{^;mn
zGG8+*yvG)h^X!qXs>lk;sA32PPB99`ogl$p4O_D(k(vHdo*i?;Av?D03(J$`Tk{*0
zNnIYgjE;^*mihq?&JIEjnhkYzUDmrke?6sPzWXsTArUTg1S9ecEwp8!7lM>XxCo}B
zAB-I7EFU`-KmxN1#SzkmeR=CTphY$FB_%2=D}x1*Nb-TErjxcSUVC2k$9EAF$^mNg
z+3UodL&qjlD8|Nqwdy?OP%hB;Y76lmzxH%sbl^t~lL~{uo1w>#t3I-_D)Fy8WZ>q`
zO|d4GmPSlwlHkEy6ocI)1qH?1_~B$0&&Z*ZdXYErC|^lXR6ILKc`Gwx{Xfca9UwnW
z)DBOJI-d4F{dNlA*x<9?DJ^CC%+uu$q*o;6-8kYMayy(Ab8wS{nN5~G?inlBjl5WC
zwkF&&Smkjiw6(M(z0bO4XLo_@5*dke#T0b&>SFoz<*9uTTeJ5HYoN$?Hm;j3+Wofg
z%5vWy7>W5+`2I?U=9gG|s0q&l!5+kM-<#c?srq`=l-j`Giy=<+_4RDp?4qYTT}Gy|
zriQcQXLf38C3&^@%VMra+*dEqP|=B=sH2MIJ(Wn0p`BG$P(d-BlZe*8Z|6U_8)2zV
zwY@XX9UUFb!o}t1uoqpaId^dp+Sb-gyMVDFQgAv~qdnLHZlcHcUmYI=o*!atwsUlS
zCRO?O?AV_gRVKKEQl9VCY)SKLGw0aG3CkNxVe)v?-dATEP<f}blTahPkc%J>G7wH;
zliv*u=UuR61`#gMO7`^h9Q+~qd^evIE4&}bH4R6;<>rUv24g$_)dD((E&G3pd{8~l
zZTwVovT;ZXCiQyHm0Jnk%lDXU*1!@8GSLyYcawK_z4JM5p$&K(k`fc&cHVMdz{5M4
zHROVU{&ag<-D0A`Tp#R>v`EN!)D!s8TsU4lRFpXAuqS%-%V@v?;t?E~yE8B$Ztz)3
zFEo|<&=LGC%N*F)`0qKR@&Y61ITRf0RXctUJ4MWqj}r5}5=9;jlnL}Y1s}ZE9_U8v
zJDE08?NXFJa}7hIqmy5(`F^gl(_Lb5E<tIn*TRNe$@<2I-SZ(-q&>)3<6>cjYLz@|
zLO>sdgPQz4E{z#1+j_}sDyzwPo|F9~eE;{{u^sJM8GHn{_pE6Mi(CInPmAaCTUaz{
z4@Eg^Cg;wS<PQ_$)=A59I0;~XR_8t0M>#%kw9%5)9?z`mPC75?vbl^Jk=SCsmb7i;
zY5d-F_9_G!&As8+YiD=&p(v`<`Swhs<<69rAy+yCQ8^7|Ud<)38wz<(Xgnn)ou~(C
zb65;#{LUFU5fQfC@82iedkZ`sJ^Vr;K1R*S5K99ZslrZNO8oT5h{FAwscOm><3+w_
z^E5}@efqT+o4FOb5Zu^WL-Xp)$q>zLMLgT3?>XwqY9^?wtKXh!(vs69pMp-PUT3zl
zo`&;?FCJeYe&7HCAMDO&8{IPg9#$`3nEtsqrgY?R=$<#OsjfEBVm~O9iaXRqX#fY0
z^d;u_GhyM4vVDy3LjU}(tGB9Xmf#MaUuHZcCQS<T&(aTxNJ)7$1Y_ZO?&}=W=S#*%
z5mg|6Mv)6R?-YC|AoSed-<!TxQtG)@O6Yma+=Ct#DvR;Fqv~~n`*$P3R1A#$pqHsB
zmwiTG%E}0y>2BL`pr5!gNg6~pqeTY>%0}TF%RRVG<iFD<Q&ucuQETMn^c%F98fuvw
z^fwgu%@EqdMt5*kQV^{23;WY~%zwA(MnxUJyh5^aJ-d04H7#-#{E2-1#qiXM@k>?x
zp3csEhn5f6mt^LqcG53_lofo3J{?&!Iw+nfm}%s;jLPy(kOmP33gKM)pj2%^y$AzC
zgcZ7jIndFypTw#UoUuNaZiF9=QdYEVB_gq!t}e@m(3}V<UqT0kb|EV7`8kY-zr6ok
z$>ZE?QXcbf31>E=e;byvYxAEwSW%`QLC)%mq8xAbSW=b@#&1P&_yXxo#D&h1PoHGb
z@IB8rNhUJHeCi#)JL0;yprW1|h}Nj43Z-XKrFy4Qr4qdOc=~;s*ZknYL{)iQT#o5W
zBcq;u4l5i28rWsb>pT<l8|#>&U`2bL9{Kt0Te83w$dvf^Ne60m+r2<#ian<f#U#lY
z=>4>?^O@e~Q5mKUcOvPn`6qG@AKL3Q-*$vXA`ZhU|J&Ek{k7B_sAXhiFgL}wz(C?9
zkNYYZ{A}^k%_8m-8|36L4kUorZ+tjK*i=vS2XlTWpbgnzIL#`Bpw8mT4sORa%^$EF
zvnoq>w6!&)1y#%kik`Uo8*eWw5}A;tH1N?pAjTje+vDcvcfVS13jX3gZ5nh<XQp=$
zmPrTKL=bHOetqQXfROR{fllsD!0%rjHN_^%${;ibJP$Bo5&FB&JZaRv_3Nt(rKrWx
zn|Cj|@=0GOCvUc2x@AQXB)Pi0iVlywqmzLegod|&@|*s~s-eMWo|zHa6B=wcp2y<8
z!NLN^aDWD8yQ{R^y?fp_dVMsX#3!?8f>s?g1MKs}r_tPRILnktm$GEhfJrU=1v7PH
zPaCa7M%>dGJqf{eF6zb8i({v-*d`+L<!qYVajwbcqZI5bf?Qyvh#-av8Av4@y<*%c
zyI6meGoOsc#%WZ;zu%6IaV5iNl2c{D+b3I9cf0izf~{F3$ms4Zagr`QW@HY*re7;6
z-mVJ$B;&X8kB+`yB<g*}eK3VYNVy*YSu_kE40#5edw!AO|LYYm%{Gq_?B{2No%_Ka
z)sv({=>E$YIwq!%rKN5wLm?2jE^<YDW?59s4xm|FYcgeCfeoZ$V?FkOE0O*5R9bXz
zjc`70m6^v{kI*`uzd7_2vjg=|7VVTFU!pwkbPLP{LQac|@e^~;@LJx<kVT(K)11<X
z=?lHQ8+jDugy5H2R$o(NVS6=K`3roMFo(9a_$ujLNa6RWvT!@fa<X!8M8v4y2|HQv
z4&vix+|GIX_SQX4vZ(+kMLnfkj1P3&bAy6#73jL~nHjGpr5IW73E5s$y*|<kWJAPw
z*Md(E(XQAJ>;cbEM&sYUMKDUe{qsWc{e46_L9CloSna*j@|$ah1C^GV2z{J4`58*c
z?PHePxt}sKjlpVvhUMs3QFNb_;vz1UQ=ziuy?B+?NO<e=01#loqhbBRT1WQ;Opy77
zImkW}3W9TJ*KQvqn$YThjZGa)V$(L=FK3`|ppSm7>@RdHoND67{3IZN-bMg~8-i3k
zd!w?KT-cf;qgn^pZ{`{3Id5n9b9JAax7hdf^wa}?eOn&<J`R1Y)bymS(h7Ht8wkA3
z&yuny7x)$Pq7R_$Jhx@P;6HI4{D-pSV}Z@JoE_Be&w~N&$sygp`2M~NRw{eDd^BVx
z5Z4gUq^G0lT0Zw(uP)(@zR_xLHTknZ@izC<r+}wQ*tG?p3qMv2o)<YzP3V9Zn$UGF
zZ+#v5BAzul;`UbzmX&d&+#f1UPf0@OF`SZ<ZR*=`wY5Q-#osv*bHR04$J+mu)nYg8
z+R^d7b&w=7R4PBf3cacci5A0E!%mgMdG(}N|782u+Wf>*edQN3UwCq52M~7X%uq+P
zHD!ZNG*fntKd7317~2Pz7eUW-xsw}LWqO$)c{Y;@;#0@vuRN9mX?fxS2)TQ^;+IHB
zvjPHwey6WI9IOH|{%mOSKN~eUqoslX?C>z(CqQ(ytE0F`W$n0-appPb@UBlsw^cE>
zitlK|@NkevlY<RzN?j;_elE;7LdXD;iAHs9H_{%u!l}h5E+uzc>oFy@rw1~IrMriH
zZLIR+1-$p?39r`R-7lu9{nLU9v$`LJ${~SWiJZd*T?p+uLs|S{BGqGSQFqoqPwnU*
zY07>OO-g-BK}<FDHHOGK>;*eQNSW}1X{TlG7H2l3tE<66egRJTTDA|oR)Z~H-S%)P
zMZW#`k<uU<VO@@Lum$g=OAWXf6*c^pWOABXk1(-g9&2ia#*dBPq*d@Ty&e8O!Og>B
z4trj2Z!ySgH+oIi<ax^?H-0($2HH(Dt?1DBjSs*W$sPiq+Tqp3B}+Su)X>-iAxp$p
zAC=NhEXFD?t0~=1XhraT+cU@_Pm$dq;IHYs(eBK;y>}eOK<~^xPw4y+Ng=!pnv^ts
zmcwhflx6Un5I^$)@=QVgz3y(`Lj<OMg@-Xzo~N@*_|hh^Xn(lNnknr*N5n5V4Lp7K
z4!<LsqU7`E-NPP15fQvlGreSeI>zjxA|b~!<LqB$Hqag;=<yj@uAxCJH<A%iUHRcd
ziu$B^y4zguah209gl7EC%+}J|xqEeWA8l+7g}v)S9AEwu7K>>rKS(LfYW3o}m<=F`
zMvcEu9o)+K_b{bTe9)t@A~0I#_;k8(LPEa35cKw0WVB7QV9t-3@ICK|`QyWz`6ff`
zIM|@&`}fJtpN2XLvFjLD-ri%{jnOoc$T>!UwMIFJ@Nd?i3PRUGTtiyFNu7CiuvZKr
zAvEeIPZIcen?slAa2XPsN{xo_=aA?|07Top7St-Oqosu#l=dwKNj8-G;aA^Z6lCEB
zjjrO6p;b}JgUCz7B=7tN-V|l^SBBM8HES19s9ibZYCX}C+6fwvu9vP8t^=kPbq{8-
zKbj0izmyT}ruFQP-hmsAWq$6#JR<`mb<)uD){k`4%KZ*6ELEihNJvSQAFZ_p8pK_E
zi33oIzp~HSps#~xf2ug`@dnZF9I5c7vvLNy7$2WMiN!jol3!hRdhSXJk_y`0cJ4EB
zQ*9Zg3$%Yic0%ZkT}Wqg`85s24A~oK)Fsav@0)KP&1atC1T@vOG);W<8sCr0p{JA5
zgTG3D|K53Tm&2iSq2>L3)7zJ~TDXGA@Sd$hYbHK3F)>EL{KU_80zR|qH*s0?;rYLp
zI)>PR7H7h4eO8wB;H$}0JoOIGr<Qq!;5;h^XZkFYw@*;Jj&RKBczHLwelDHv{X!!|
zvV4Khhkc*&Vqq!}A2|rMD#M{C7Bj|o*VD6p`(=-1GV@!C(#wz*^Ul`Rrkx<e399TJ
zVaKUT60#ru*cf)F0VknOiNvWY0pXLY9McDfhqCQ$km6D+D-rwWq8db;l#uJAMyZ55
zG6=6G|J0+8C7&R5B{GDO^p3C{?fBHe&c-%70~zgSP#>i>PlD9VNw0})6W+Y^lPn0~
z^wXkcz<$mLR_@i+E>+K=9h#KmJ?bk%vZL(NLMb}c3|^XNP8xVsGO#wFchYikanj`L
zqU^#)X5K@V4aKoISSHu7|B=}H5hYrvu1lVE7(pD3c1nG%sc}Kp8(#^-3)4JNa>qsF
zg*K<faPTPG?SMGsn(Ja5|1E5eO&O${z)YO2&8>xI#2Oi*Z1MV(wlE3H<vcPL7Dc8_
zhHb0CbQbxc(JE|jj7?u>Hy0$ir@FeR-`~3M3GmooRy?Up|7GO@h=0sKch);NC~tfv
zNY1F}gg)#(L-%@d@!A#PNYcmWHrJJ>7tc{maTHUeC+1*Z@B?4`MlVq+QP+d6xS$5H
z255T?K(x3B8-U;)+dWqQAEI`fW@lV5dzF@#{~V+bx;%O%=6y8Ly(E8rcILJ-3&e8d
zrDzm$c8&Y6Y;Trt#v4UMV_%R;mat=efIsp?tDAvn89fp^F(E<W`q&?rVm_k%j>A@8
zuV<4V?fdjN>8TH6SW34^NrMnVii&J6DQD9ucu^U#%!GUwm;df0JY5cs$oFwXl8FL^
zL8VI;32|JjZ%o_CVvy(P_2RK5rrP?M^AMatP9RFn-}qo)ZEC1y_8z|&mwG^&Y+<QP
zURzLHNJ2yuWO18>MAGw0C&+%gS++&aeKt@IMofsQ)>Ksy5Rt4bX9|6?jmDkG0&AD6
zlgrBT@|T-^LTfM?&()ZY!vX~8HY&=>lsq=u@03Z6i_$g%eqP%%=cn)11Ng^&4(noY
zwtsi=BU>(Yw3C}4snDu!F~;#TaQ?x{FUtVsn1>rF5NV|K>!%;iZieMH);HHQrX6bj
z0lAvYO(G%Djb5~pz6UMWjSd@7LvOLUR)xDYHdM-May0>>BDLfzo1t7x?imD{`&Qdf
z7yM^*9OX~tJ$K#U8Qo*EORq>02ZwZFC;O9BkLc(|Ss58@Y%ImN_D!6Rc{L@`ysz~F
zE1+sOdxlird#5quSMyv|<I~bK?09+J|7roEZhv>11rTy>a$gvoZcWcjzxFz%c5r!x
z7;?jNXAvW^CS3yPT9>;^ofv1L$a1ax_`eHz1ou!))G>-$rBM%DcBYP%lh|()l9+gg
z51sAC4W}3TKMX0Gg>QhABNZS0FqdWcqVB7DI)A`uHR;8-$<JI*a7K~{jtz*5-Y~@)
zq0Gh~28Clpup4qG^=+TjNSVbOE;tiA%zTJ02&DW~qjNTGy!o)@9OoLV{f-Geeew^y
zo6_ODXiL5<yefjAw(~IKDHQG+$w5SVJdB5x$z^KKGxORBI?g#YjHe~86m@oHPLSnE
zSyTN&M%kXWSjoNYY#OU^1t*m}K3~&0;q|zQ*lb(RSX<AhqK27YQM|>@-w!^*eBhJ%
zte2yBX=zEY=w{O;ib4RYcm<Ks-HhLpBMAPjbiMD2*LW#(xPRd9r=o%Wx|MnZl)#`l
zobv@qcgV^nthwn<N_bpE-d;4;V;elt%u~@tZdKZJ%9xtl-y4f188i(Dkk*EHaGHUO
zi_2<X+VIcRd0Dv1O-?;dA9-nR{vj?-@e{dDt?MxuNx|$EWLe|dw|SC;kN2i2Jw2^4
zC#qOH)vZwb@ov6hgF`F0Za@;htNOvla=gSrTyuVk*L~jqUE$c#D@T{DaleVOtmR(8
z`<)#{x_m$$%u3&-LADAS=GMj)HNOdvZDcQM;WFa(;}lK_AN~8BKYjdU+s0;dmuK*M
z@m!!>gxlT>-Yn%eK|o7Mc_C1+0XNIk&Q9*r0{1;GHo@Ae0NH;3{&LgN$KV3rANl^^
zyVaxc(L!wu3@k9_^YGPro~{25ezipQH13_a%i{Z+>00eE*RmIMIw;roIDoDC-fE~C
zeFq>K-BtZXo)v$@JFpz+`_n{sj9)@hcz$)0*L{DSnX6Jnc7tbYvV9B<uVr?u=7gX$
zvybQU{Esre^YO`!KKQh7#Bm;BkP*`DlyLR~sf<$M?ZI-@cjZKNn5PrMjbGYZhxP)G
zx9H$XPpTPkQk0t(Ce}-<v&~+o_JhbO_>V5Co4l5*EZK}DVav5HxUNO{brxDCOglBw
z@w->2M6KriYZ3RXh%|IbBCc44;2l4_U(Qu6prk)$j_TG-``FnI_To*z#FqyIR8{Ee
z3<{P^9sR$=#Qe`5y?v|cx0*ailbk>JP~6ze{<7a-AYClm+*m{xL)+TQD%Y=w78A#|
z_OLkT2n>JH=QuYjWtg!mDgwfhHErCk)ADzDi%C3|bf@W&Lql(*aCH$ER3#(~PlAZ4
z`?_1e=SHWOt=3q%{;gXx%Va@iPNTcv>LHdY4z-q^_Q|iW=2MD*XtO(eZJ)y)6LoNa
zMTTnQwWc+lFVuR`V&!Mq_8TF<hwOJ&?Ny61bE|Zo+L+yR<Bm8souz>R$K|+Nn|9BS
zAD}hyEorKF9faXa20G4Jv$#(XJYo#XzlSeh!;QY6%4zNr%4<vA=4Pkfk}=ne)AIAX
zGh_4y;y~G+?}B10T7Fj9z99PJY1xE;6Dr}kUs%#RS~OU5R3)}0jXUfog2;XeN^dG2
ztRaENmDbcO{0*)2HAa^_bKJ&!Y%DNg@yHMQh?N{2ky5JH&k;jpHE0m;^g0t29cbRX
z^O(|QJ1exfK<_QU+$p7Jo3d%n80ba_FX36btE2ZGSeLS5VOrd8w9ZvT_en*ZRMPnF
zccK+qacj~>j~c%4vkXi($zOm4bKr%A%BPc)4Aj{8F!|-L`X<#`C+$_tP>scquTBWv
z*$$_>K17=F6B9aWcxo40XoY-L;`%q|e|{ho=0yDa%?7p6zaK5zq3@CMica0L4>A5(
zxYNvitLQ7~x#B<Mi7TZ9ViGPxp;KfxdWL3lGF~^=O-f+Q@0Pw+OqyGILyv(=CMx8$
z`s9I`nZ?7^{VdsfXC8~2Gj|ke5tP5Yq*x=&6w1;#NnBM{l)x)xjajFuVoGmldhr$b
ze+txHb!qMp!Y2`rp%KT!#03u&q;C=u6J-|R?T%Igg%F(M;C8(YWdei=iSJfcR|x&c
zV2=rX5b$*{|MsIKpd^yNq5|y|j8(x9T6KM;i1}}r=_TS{@A9<k?hAW+CZpd)*+pVz
zv0?dEorY=33@j`HY@(Ly^Vi#zT2IG)BO@!SYv_EjUm{BY56yXNDg=PLYj7t1i(Km3
zLt+q?{C*`oJXWgPWZUfxE_ImfiEg+Bss#}DB)}_uWtcAEC1Lw5-|)6JpG6;3+cQJ~
zFsagFU~BS6g}PA^q@ZIvK7IPcp<k;%J@p?#O>r=+r2jetZ?S2Y{M}6Ec58C5+d(o2
zJtUS~!W)A^+`{`beHELOqt5;J0hFTt+pgnF{MS7N>{<@?UbT!ym1{`ycpOhP7d5m^
zbY=QUlH%b-1KX`ry|IOp@!mw|&yqqGru&bd8o|1}GGT<DNlp$@f@Pp{QVILI9(?-=
zsg?cVwRffY;o%`3>J<}j-wsu-mBQL%Z`RH1Y!DI5zp$7CgYcUO<?1SaG+gH}o5Ar-
zh`ZI->+K;2nK;3!8hI8SH7pp)67=+S->0~Q;i$ZLmy~pKROhB<FL7mSXU7D7NBpiB
zyJ<I|%jv*2A51RrbMd}7%PK3|4~a-}cBwwyojhMr9{YkB-|Km@{WIqh-r^Z@vP+B_
z+d4aI?K=B`GG7t9xcC<6&b+U7rlNpyCxZ!ncnuy~V{gAlR5&?8B&xx46zeIerO>1C
z5`&kfrmFwsKM!(@8P~>R)6+la)8W4!8mjQZPp_*#GT?R-$@Td&8^CjiRZq&_Z*tKC
z;ssw%=dHo_K$anX8oI}XZFyQ#i-&_1%72eQ4z=#=jIpA(E1yh*t4dWtAzYn8@)k<>
zB5LKx=#vN_q|bT{)yDjR6%Pt3>aMtZo5n|=l|ydvx2gQ3p8mIQ9e!720v?O+%X8#m
zc2~JfZLQMo>+2hT`D=K1)Ue4cJ+jJ7=J_pfL3<dwdqz?7P4yP#g@<<?S!;%b1Vcqm
zpwCXSR;GGOesS@~yh6&1ScHe_Tze!xl0Fv}vfS$`HLOeBP-q2^3)nm8+xHjRA?49}
zaBX0m#MuEwFt=~r+64B+_wOJ637jr7|JCEgycT@6`r82sEWM5vNN)^PLXeag9?=Lg
znQDr5eT7M!W^DfR1%yXq@7UO|-f3$Kk&`oyR9Dzu+eMk=7Z_FjN*0fr?9B5fPbmVR
zQog>v<kl=xHFS5rwg31Rk%a9Cl)t_~4Rv{aWd()Ij1)~rM;kDo$R2OovM-x`G<k5Y
z>HO>^x;~4d;+gf&LgvqgQ)2~XW#Lv#U_WfJGM~ggAVNWNioFp5&*bLjW>tpGrp@Qi
z3FI#V0%#vb(OCXNjoLSTfb!ruC1pxQMFk{nx>8|XB_^hly)ra3RP_Mp28@n}2g@tV
zR^-I_40r!MVz?nLp64Hq71<CP>Qhz4jckIPcofM6+eN7ssrsg-fYhS5MjA)kbx(bz
z=}AeSf)__fc7D=d@`0K%!@Z_xGkC-qL13U2^Bfx-MEFfbWGZ_<g_E5%@ofU#@XXAN
zM%3HI$GW=K7h*_Afo69^?&3*6zL(D6(IabHv#u&_0?)U(7?g{pdWwV?2O08mS^|QC
zNhf@Q%uiinu~M7=HzWo}L?uOn=yt$=C^2z4tchUH?HWs0UEkXBxIE(*5NNH#k(8Bb
zXJlgh?{Ps4e1r11fZW{Rs)XfH%G%=MzVq`lcvpBJ7yRp2>UyQP_Ytx4cTm(?$fx|)
zg}#{q$45v=NO}_k>#?(fhaAZVqNC9C64%F$6e#)+acI9;3`0D}{G+*9eRXwpeLb|d
zC1_drh^GM)0_VtOVjQ^ERoRPsmJf&X2$v-RP8<d=`;)D;lA_$B#Slw4sZZ?<AU8lk
zLHY4x?)=f~Hy6Ydx9u%0u|ELo0^;``M_u$Z_Pgz2F*Qy^Wn;j>vKaWVwmu=s$XHdD
z8GF|ew2QsnRU~Qpe;l*1uF%ZmiwIBV8>}}00rar|EsKbL&1}R)M45E9jmqTy_~{%%
zGD>O|IKkxPm@*Zm9$DGsH{qTkSYs4>N1i=k>&uN;fEBTEQZ{x$ECv?F*vN>smgZ`$
zm36-Kw|oe;4DBHWk&rCAdwA%MLU;%AFBp+TvgM_74Y)Dk&-K`ZbtiiY3c$mwll(S0
z@m-oS01auvM^(rqT}Rf-;p(df){Mn(kAR&8>8*d!CO@Xet|4r9`}V5YszBk>gZ=%9
ziK*#HQP+*<y*E2cQaXr}|HtiAYRJ$))9JbmmEh68W?JfioPvVNs4>em;`L1{LP;eD
zeEp?buBmvZ>3$z43$=H-{p3Ho&K%FDidU3ZrNi&u6WWfN6IJW!;}gqyi1X-4Ec)c(
z{DLN;G@^jk%1lFGR*?9Ugm+TV#OV69q2ZZ^2ErW<&@Ps}9Kk_5W;e62Iy62O+I{H&
zv7p<Oq>>gR+#IS=^RfGazKC>c59H)JqsZ@a-hG&HIPuyE`Qq#6f_sD`8UyW}151lU
z!Wek4c>0+Wim`vlSFGizwD~7&AQSJv(NU~nrXv*XES+lEi1~lsWToI6R00_EED|z0
zK@1p+aI)KsQSk8v^Qp6a;JzT?edK<WALoD=kdc6{qW^v%SvV-ukU&WI6+hNr(>MD6
z@}%Dhi#v&+IvE)odwY$A>COtexm}nGFk;CfkB^TpA+RLs_2&J(!wpLuHGJY9cSB{>
z`A9B$cS=bDuOhDK@2q7Yhthu<c>gXf&Gfm=ElSEC-L04b)G&<v^Auith<xm7^>Vys
zSqC4Aj~Kt^WQ(zig38H(hv`@j8(7<K%iUC_VTEPR?jv7G6~osizc4@lf8M=TmzMrA
z|KM*Q!PQ3>ig#3~1Ru-Dr2g#zKv_?P`r6j8f6wkbU^!T}axc;TV_b);T6Ez59qsZz
z|Nj3LkLhr$t9D;OiT_;!kSedp`EMsVC@cL9iNT*8G=NqHdQQ2pe1<2|56z|9TIRn_
zZvax7{iK}yuNDy39^Q)(<2WaU1Rne#$GKYGpbMh^-$!}eAKlO<<6+4O|M6;iIjz2h
znVx=h{6D=?)`IsO-)90_(^6LUB)$Eev`N%=Cis-iq(Xc1+drmW`4_&E_1QrB*F&Gn
zFh4x{KBwGK@%N8$RQ!xl#=A>S7zE3L?Hnxh`FRYY6S4*BFaPszgMk0}Izf~6>_6WV
ze0rn*!3~{_2T0_>z+)q$44{`>Q9*|lEJgo)1@0g){Do(#d~w*YdFG8IDCnlFTv!x&
zG%x+9nqMHCHv4~9CHe-&5I%~Eiu!X|N0^obgq63qZn3iVQ0r~|NGf_e^jI^V^Pi7-
z^)IM&6^D|yt8JzT;AZ^WOWnh3u6A=c$>31uxs#I(C$9*rBX4De=HthY{&J(~j^=6a
z!>>dXiXMBtj=hhTJq&#Vpri%t_fW<Kn=>1m{1_VHCl4M3X9m+fPnS3>$}a*W43(fo
zuD?G5Sw`bN78V`}F~Rze6Y^K3K7WuUQGyaSCmU1bC7+hLH+%PWw|+=SeH))LUMc@H
ze0DIRkg|4{f?^#&>1Rhg<-ZBzG9Uw>sIRA~>9sVL2Cx8)@&#Em=$r~5lzD78TMED;
z0O80-ld-l8K;@0c#dgSwGU?kFcE8FkS1ROUCmQ!+gVOr2xiVPdI{*sztMTUE-MeZU
z3WK9{FQGn?9(j0m7&;hjzA8O>^}F#hW|)r`V18)0NB$DFR#yJFQ1B_?x68rAw6VL1
za}3?lzo91)Y<ge5oNZ__!!l^D@swNSt~Nj@{KF{8ABy^%WPg4Qhq%7Z)buRuw|TEj
zm*EyfL78&jezM%R59>+R-v<=)-v@yD02>REOrX{3>*@6yG-Q{S)<UNr2?;pNUbYQE
zV|GSTX=fx2-a|0+Jbii9LiXR<z@m-eyU-hGrp0@<P8%p=@lP2dyM}=8%ejE^nolPN
z^I@&X;=px&_x^qA`=h=;Vws#$6R{icjKI?QNZF|A1i&1>%3YR#0^Q(k81S(ye|_qB
zde^=mx(}h~qQQ0PKG|QYLQjwNi+72M)m4x0v9q(Xvl^B=6W&Wjk4X<S)2s9Tolhvc
zH{+$Dq0v=!e#C9C(p#sTX>z|rf3#A*wsMVgbadSBmxlDu0+I;TdNN7h3#u_{q0Ef9
ztfrKR;ap79g*EW9O7Rx!*7bf?-}~{@eq?0CzdSn|X-dNFBoc690oz5zg<E5zDB1xe
z<0X2bSby=nS^vD4f`wsN;52GP{22u67o2?ublUpNvi!Qw-LqqQ@IK?c)yt(jUvap<
zFQtG|6$XwC_i0FJmf8Q?38;%9tDr2)nD@>K)l|zxph(6Sa90>M7#MeG{y)~<GOEjU
zZTqD`RKfxUq+1$EX+@BhmJ$K!F6oj`QM$XkyIVS>r9rx+JNC(3Ydz2N?mgZ;#vc2f
zgHMh*aq{QBuj`EC_#GgOhn4T;ltxN&a;H>Gv<=9r-AAOPYA7hEevM%&2w7QSzH}9&
zYo(^Jy|jx~a&d7nW#GEDg#=50>!3&o3%`wE6g_jS78dptK|7QY6Z_1JkwXP3HV4+$
z;ej~5KSf`Pdc3{&@Sz7y7sQ+bA32I6!PS;3=fMLG&gVdr!2ZQ>+nSB$RN~{Ks45v^
zbQ}$ET>>+g<oo+?IP8CxlLTeAg}xHLC={^Cf?6y%cwyz>junI73<zQ0MFT&xvoi|}
zv4xnqfE1Ltd7C@5<|^?dV9P>JN8hAlU}i=NH^O%dOUu38-7jASC50nTj%8&7(e?SB
zZ<R!6f31tVtFpI$dvEXdsQHBGM+64Bx9Uj0YyTU?34R=L&wB#2;o;$AC7oSjAzvV_
zc!jC9v(%v=-i7ey*-lN{68q*~`alecm4R-rY#!=-oR3Kb4>9gMe;x*{qvq46uTUKV
z84o0;)#J87Oa5FzUJ*4cEhP_Cn<lEk2uWC2MWwPbGcq6{;5}L<>Z*e$>sB6GG&v)q
z=)}^Z?mX|7wdmxs7e2XLu?l6}C^kZBQfHz}A{Fd9b;C|hPY9koNz^DcNpt{Py8T~X
zv8!iH1qg>HWg=JGkAu$4DIeWjIRk=0Erb?&@7}4+%__WmgLHKWZaP<Tob*g{gUtMV
zn9PTTgppoRl5iovMfpG*Q@;6G%+sejI`wnq*W!CyN{{aOm45bdjTJCYuZ&bVY40f9
z33wlhgU7^l%|o2KS%A{2kG~xd0ilK1@sc90ek(XziB6nDk&#?}p9DR%as86BLfXOL
z?c?K}z+>&YQr;{3(NLVW>Vc;K$y1Wpx9FsiP|4g%f~4p0WsV{uzasYw_kobYK%9%u
zbJ*xY%%)fNN<pEihsb5$AI=);&{Hm=l9IUc*O%o)?C<aXGxr#@w5Wb^UvR#WxS=#O
zH4#C8ju7SaveAK>hJ=LSE@{x{MS~~7^`kj`-lKAIa%PC;gOK~h3wRS3;P~Qr{#@t<
zA`*Er85zk#Pm$(KO`fEbl%<vH{36_N&eJp0LOOLB<@SC7gyN=Zh(c?YNhY#k;rROF
z`?s$@Se~<dR5@6TS^)_sNTl!I*I|^-A02(9VVV~Zl+a-jSm5Sf98AW<#N<EMsL04d
z``901eDieE8eVD1jIAsgtDulZ=S|w_>#Z=G@}Da{SX_cIiVuGlv<)2{Kib&=039>O
zPAC-gn<%!Uu|M*U2(;X2FsqLt%JnxlckU>XhO(>*%G-Zf-hmB`Vp!x4ABOGdiy!90
z8xY|!AfzoP4v}vy^0lsPcIBhy&a+e*sp|&DQt|BDXWx0Ds_SK7@IrSK+-w%q`a6A&
zy}@C!gg3{@!qJsdUtCgAXZmqD!j_<7Z+CCvx2hM#dqu1N87{a!9Dla6zYj=X4i1js
z0Lzs24%zGVL$&^RC*jnObAs4Fjex)2UO5BVH^AdP&i(r_9C}DXiny12Q^1G5BNwqf
zUBg<Z=LTxI6-IT{3QGc$j;21*?{v}=9M?5D|AfW5>>s&2eYy=pfu={QQfwQ)QzpZ5
zIQRE3mwTc)J}yEUAtU%w(1=iX*<YceD%B+wfV*uZW@LlIe6sc_htSOlfpIYeh-;j<
zZ#OLYb$NL=e`r&1<+T0gZ)Q@6a55_?DT-Wp{AVQG7zzYUza4jlL{(^?Nram_Po+N9
zCM5;M#C&TS4}U}ll#B5%@+;369Bns@nr#eCO&Ksq&(`JWhZ-&H`9B8;3hxxf-TPU3
z%QWVCT9IZq|EQPGD?c&sw(WBAU{V<rt$|pG{~4^J*Wp8^X~eSWSSgGWUE$KIJ#0&B
zB}Q`?dck*bAt@>ft(2c#qqw&LG0uZ(mt$9eOrB;FE{_=BpHEWq**(?S`h_hSL(<qk
z`%Cd;!o~isi*o68lwqdDO?B)D9CW07<QZQt5;rU`4D{v_J6sUIR8X*44HPP79n3|d
zz4?ed|M7L6x*;u4>{-Q`zD2zGvx|5C6LJ0z0Q}~UNyIXcz|Ql}M+>BW%>Nw|{r~fS
zFh>#S_GL4cP`Tpj{D}D9`MmHf+rmgnE2TWWyfBl7lQZDo05F`zF%Pm8EfF;}`kgq)
z$R++~q<M2A6d(gpkIiC-888=$IpKe&?FBWZx5s~p08`l)oA@>+=JMQPDf8bl-CZPH
z+@R;ioUK3G7&MAI`bN=4c|NWBC0tKNv889_WaVkr%ye`Zw3qk3*RS4A@0}zgBd;)<
zG59dJ1crul?5C`2gL)g`-vix7H-Rs38o?L~SuHn2`Vj>srB^RS+uEtYiT+Qyyr)l2
zNo)8%aV#$<3qoT(z^nckv`ceNBkN@lxAf-CS7@$oKYE5J^}$rHt*y=Sc;?dIzXuj<
z8><Ea0H&H1aDTwvuk{HOeqd)?Tv-yi1;Wzzx@GwwCtv*HcY#7i4Z1e5m8B)~nbP|5
z@}uc<!ROB(Dgeh`1_5&g(9)m}H#2jAxY&PY9;YR=jI>hH(%u3Epsh>lBL(ukK!573
z`$#kO+|Cx)zKQQ;X&L*ZGh~Q(EiW=-VvNNM3}9LoB2V1$=m8<h?AlsXqJ{tW?=T}-
zyRBW84;N%1J3s%^dUCR4AZ6s_<bX~Lur5u5-MM(cY7{_dwGf<Fi9CMk4SfPM4+w55
zI~AyInvk=03kAl<{X6p_oiEkZ37wtJYjdOI?|yN&_t+sKy3bkU#3}ong{25`Vo8%o
z-=na!$YSK!LJdhvLV|-wtR*iW6Bt=()K(l<bL{Hx2gR??om3QIoW+Ry#0eNIg#YS1
z3kH7u+B<O8GuIcnSb?Un1aNqPU%+m3vb?mUD4Pfw>Ad6O65TYkbT|r%$Yj)96cjXm
zWL6#HSbVvoOY`&FGkI!r=za&EVKY7Xdy?Pr;y~x+18h#c_Nb_&4xvD|&kMo#{O51p
zjcfbH1iYCyZ#>CXBD5iPcecd`OS8n0lH$#qH&B4U=R>l!Ib{#~J`aGb35$IH?hiHk
zL<1vD)Uk&Lr`Z$;_+;NIu(NIKHV>(Z$qGtH$iqYOUr)apbiJ%S3_XxZVm@8p-QG^k
zK<TnHaoF74%v+J~^#IZGgNX^?Fs9+h)7wkM$}`qB6O}bvyS4WB7xq0qr=v=nQ#uOK
zfT!aBev>f<(VTZ0nM8!uFAh5Yh>H3s=WEW^TqCST@zvPF+$=~!LnF3HST==+=-pVO
zpq5JHo}Yg_UrmcWOsTlJxJb0kKK=t@zBy0^(QfE*ED8LqDllv_(`<PA4|wRtUD;qT
z*t)xuRAKXX=6gMg(uS3#B`Rut+9iY>eE)$-{ZCI1#jrNw*I2E9#6*NGLzD(<jhjyY
z<_qJ095<~0XU``wYEl7#>)nu*z`*d}C#<^feMiA7KR!PG-cVcUg3L9Y_2wtr3$eJ#
zq3Gzh+&asHsF;e<Qpsr6y6SWvsXlNp6}&6)IMJVjf0mcuKxu7#%>PShrv5H?homle
z;Co!7z!*Dc%<LI(=HcfFyhiwEJ>>d`iHX>hAulqra*iTO{XesS^q(I|g@hKggux2c
zwfF@Ks~p_X#EOp-)6zyJCo`(6eQq9zE95zw=kUFV^=B^H!W6?ScXvTN@Qj|RAU{8z
z%V8p3V-h44JPOipt@c3h7jiEoEtQg5Dwf&cz1!f-#DwF@b{(%hF{HMNM1h8&w78Up
zo_@B_(%QsCT}QqIn9{**5VcT^LqyHVX}%x6Wx0FH2ki{<++MtR!44QDbm+7{Ih+FX
zoy%oH7o!^pIq+gEhD&X9zKGYHxw`smw>5>i28dXQFm$<!C8eilbDJSVcd~0nqib;b
z>k&Bj-puSNUIYXQPi=Q8Zj_ci2M~G7XwrAk+vD83SN&<t$V6RTcab`TQ54W4!0`i3
zw6)!Oi&07fe;XmU9YEF+=#>j3{3LoJS=!(z-;_`9dj>3|R-kl$`cw%+hNI1ye=34F
zyqncfV+rEx&qpPRg){;UfhTeh)MssFJ(&Oi$STjXm1)=YjSZlqe@TF5sW`tr{-^}v
zP`9jkM4paga+^iR2dOG5N+lRj1IsE*QSso>(R6p|6M?AvLgR&2ZEy86>S0`|R$=x4
z7gw{~W`0?UfPylOM?nl+Obe9s?CitDe6_qT6T{$tc`52bhUd}D?KZzxniZnia4=Ql
zM2$zilzcaW02}+5I^eI96Tjv9r2S0otId^;qJ`E@Ag*~HZ>tk?4YWWd`A%=SM~#G>
z+-YU>`=yh;qoafO=g*$gJ-O&8xv-4tFacaQD+en@CiP*g!)^4t_;aThziPQlILs#A
z9d2=VHv%+me}Atpp1aJtT}i6}L6$s~kC%6)Z~FWjULUX9k%H*QWiQ`=CKX_R9ah=?
zc_V9)=~K;faP-?6Z``CbKmXAKIVcu$BKmoGCWv`#LZ4j>ccv&a#(A|~x$pw%xYT9x
z<INGgHhhC<iGSf#<S-e}w!&yWQM^%=flX@*&rb_EnIADF3k&z0hOCp-=;(+>rHyU(
z5no21`e!4!N^!PQYHRmqE~#4sz;aY>+FmaY(Tvk>i>+(>iFS>V5n4N&-kc)RkmX%s
zP2<@+bgpP8jpedX^Wf1VVgUy;hywNf5&L<xt(7X!?!SLqiOI<qOA_VZ%hGCNO_Y?%
zAtKQBxuV}gn@k)(0l^b+Nzg)u9W>2{2R1H%G5@wbRrPmy9f=s~TPZ19>wV3erU+RN
zRRlp>n;4X9#zw~06ZY?ZA&=!WVmGC{4gkcz_nxh-jo7(w;#_R()b_Mwa*7TnCMM7Z
z1YoDI2_)9^bPW*3liWpSk=0jL))y1_bRwpzDlYt%jGdj(Rd`~k+jm4%TXwmZU{<>Y
zO+>BQ{_pzmSkRRyi7|b*W?fHdDf=0u22YEn{3w6)G77;3na{8B0Uln_tN~zqz{n24
zCGd8lyvr=~3r>hYBBpFYChC0sP4y=II_@E)u>U!!J&+QY0$g!C2)3o9AT@pL;$rsj
zO5^@OlTek_A=O1tfmR7bT=T+7l?n)|%IvSKyD~_Vb*>xRt3fR`wxx3`Db)Q!75;?$
zk%r5L@>DniFBNSMAw+G<G%xpAFI*Ch^4zw|&EW4|TH@tE#SprZbJna!vfSe!X&n8z
z-0|x^5)u+b!az8jvb_A7EVuV7Zzys|I64x}934}QvB0i(u=y*F)Xmg%Yj~}ss*>yO
z-8*1Io+r%8%Od9y`}k1_;+KAubDYX6E5{I~Bi6O{GvN^3e?0*t2}+9A&eGQc_88^<
zL~LC{LzB%@cS_NpyD{QXD}Oq9%_;*Pst?Izxg3~5>+rJkY1B2m%idqz)tPv!F<l@m
zp{91eS|qRQA|}+_-E#L<C7>EPi)S+_P;ZHW+os9>m4i2E#c%4+i}rs+$JaRQ)@Kw#
z>ry`fTL();F)_*XeuV1*ex_LzUmv(RjyBCE`lnHyas8y-DM;eHU{H9xshypZqM@wi
zwzA!ly7&Mh{J_rq?v|^$HhB}wKA@EgU;cRD4cL^W<z?_+JiR)cr~Y&eMgeLsI`@L>
znz_J%<>l~g4XG*hII)zB<8HtK!sOsb-Il=;7=~Ur?mgopmk`mgJsI#IBO}{Xn;saD
zRaH$(%@n*ku&~cMwTr*wKdf0}IoUCgs2^Y!k*{vQX?l%ZP0zuhDXsK#Vtr%CMBBjm
zpkrQdY3UA`uOXX9M8PGA9|Z&Dt&yS8QIzhCRWAJ1yv*Fe(YM6UKhSWcfE0l}kAVTi
zK8LopU<7czy7EDDv|um4mq)|^4rY)s=a%NGd#*=7_BbR;2Y=Jm(_L8jV``eWwhz)g
z1xd-x#od-bX>qAKyURzHZ}~OrfBy9OYo;JBE~KKu#kMa2qp2M>ayEHI@8sUpG(Gqx
z`jQDqdp_D>^)8N(zbpVW7w?SYp2zay0GwnO`=KX+$1;s6qSxBiO55^iZ4D>iBOzgk
zjk1-}K!OcWJSfAMed-<Jh3>tgs(G!Q;;I9KgOdN0c8C_$6WDLz0#H^iAYqazq3P&8
zEU!rF->0O9(aq0`DmLI}JOQlC6Ey#aVGrlff*v=97?_xNg2g?wLOfT!yimrx#{Jl1
zaS-U8aBO7A#Bo_(sAx5~!!#Ivw<{~Kq7K3IZB6|aR1}0rK}IIv{n<w<ip%xLpSF|M
z5CFUgItC{Y%l-jEIe8og$B#X<Ry;tgpkD2GUsOi9KqWUd6(DbX3r;(`yN@5Q$MHC^
zJbQt}{!qbv=01{!{YD=$L=?+%4gXYX%4GOuS!}(hpxE&EHkhmi$A;1>m`$mKh!#vU
z;gz>4%KN?q3(=e$W1wX~b|e9dGc!A=PrJti+yw)*0CT`b7{0u`3=V$-L$f$mhkF!)
zAthQlRaIGEvGDQ0UIg90!_FLOD%^e_KIkwoG|)N2DJR2ZKERFg+&v`p<zsO}BNMbG
zgedL9jafRvME(A4oNGvV*44Vp<p2d!Jm2x>pl{=qT==RaTg!Eh!YXT{TTX@Co;+B>
zW<*dRtZ%)yp99cA@&~7y0y$$&W&KRWIbV{>_{RR>VfM2c%*S-dP55jj@sJ1)0$Xs)
zYqNWfzV&34XQbfet$~5ih_M#Egq``Oc7t3x%nu(E5TK#@4$KOFfnT|e5>(qHdU{J>
zp*KN$g6Q|Y2jB+6>V&bbiZ|;(BqeUR*U=B`y=XA+XbQ`EvWtqoYN@2nrDvkn(bIm4
zmmt{iM%=I}GLmL!ki=+yIHLldcUU#&NX)LTs(3yjfcsrdN%WoQyC+i*tO~0V3oEOD
z+Wr#fi<PAnilXTCGenYoiAP?QNC55qotM)|(BRH6c^q43@fhh@>8pOtPrIPX?)hrK
zIhTTRGZ7Isf5u1~eqrq6U(vroKW5h4-hX{*A0sYHT~S%XE%G_<^>KcpFf0a|isA6Q
zYx`VVn-tkaV~>Lr<&@HW5G_kqQ!^+m&eR}tHeOM);i$~oBH1Nb=L2bSvF(03P^q}8
zK1oL2#B&Q-1P4b!#_n);k4bZ@;Uzkj^)Wt%C4uMJFk<BiSIyBeKC=Q$$ojO-_Oz$8
zPm9}fMsrIFi;oYTy3?uTsibxe_pNRJHt4Qp!(v>FT-^_Ad-l)P*3ekhY-3Z4&v*PV
zF}#$c#3_dR5PpX7hbXmeIJFycOGk63R~JTS+e{m4Q6;*%yM8Nt?9E=X&|VvJ>u?up
z0fK$HOpI{1iLNf!$0=O{1xvZzz^2U^;x5;e+(>@gE_jsrrSnU`!g^DOOW&1NJ{L+&
zOA}mSf6i%bZCTU>SIF_)ul>@}er5}dH-d6P@rLEmPu^q-sZ07Rv9_|1;2zSV@yo=^
zh2E)@rPA<U8w(B!hl1<<yZ1ucNuk4IoeYC-gT1{&J1@OoQ9>1wDyOu(k&*ycKj2M-
zat7$s-@VNiRPM(XN`i&YyXYqeO8{r$;u&wwNG!zoAj@e!>#Kq(6lJuB%8z_rbDs#&
zak(i)KT&YCf}V;_G{!L_D~pkyJ|r|2Q+n~{m#e=x)Ji@6?dzMwYgmPx<KwDo&0=`9
zmbwZCCg^uB7nmO%I1S~msF+L_<MNwsad0RVXgNY_0L1QJG8rfgMIR5p!m$V!OLvD@
zh$AQ#HaFMq<LKbtyZ2ceb)tvm33RbO*t>lHLWx1LxYs;_bYDYzEvVtD-Tpob#m;De
zafD0j_+ayb&N#Y{723hyvDp@)545!}Ua+#VZqg$QP1IBrz%FKIXD?`I-vGkcA;I-g
zxkSyAXBx$Ul7cQBt>^BXCL9wv5x*t=u9PA@&IVUxFY_+;O$C_?6{HZzx=4dVuDHEw
zmykQU=>gkSR#ud{w0n3PI{$a&Hv9s_v(x7RommTD**v_fl|p&<ZfMr}+<=9Jh37D-
z`Cr=W?kZ09ffDAwdb*kIrAT{w#oSd6;CU<+ni{V}vDnsTpcUWU+bi&Pmywxazte|8
zLpdn+tqwq}wDh#Xp<eHsc9M`gf0MAkpWfVjQLKc6XJx<TbkzLN3b$4KV}GpU#iD8;
zrR=j`{2(zYH&=a4@Q_MQ>8+oiKUKm)Vv3YQvyjoczGam8)9&ulDBbArjO1eB*RSbm
zxtIR5cL3PfJ=h;cI!3+#<HQbp+||`%{{GL>lIc0KmloNWcFLQtJ^iCtVc2-YN=wY%
zN1>=_iD{V6etNmOrrdO=Zs<29-GOZ>`kHY4^W^O6v+YYTz|HnlW#<&&J$#7fjl50<
zfeeY#D87PHCh9L*A7NsC1!q6*@U@{SgRSh#_n%|6=e0B}h={iA{|dNECi6Eoavl_{
zU<8Rth_7v|P1Rio#&Tk}MA>iiQD~Lrr{odsFcuc!E=cx5_(5lTqM@N7TJ1T4=$vWe
z*e@ykl)UV0>D0bGCOSHPw_Umx2KG6GU)T%xLMQzkKphftHFnvAW1P&VjG#{Dz^&@H
zs9xv#O?!gC3I74s`_Youa+XC2*G^VP&cNLC3o+A>THC+5qg*^>4DizmfNws?ub-Wj
z4b=0UJ=pyC3HA*XV#Edpkhqa()I>L;e!gjx1GNwV8AmAbO|y+M%{L$piI^zW6S(?y
zMD-3k?qS}iRo|48brxQJ_BQO7+?Z^iZ*DVgA|-yfsAqUQicP?}dXZ*Ks$E0!Y^Y8x
z;>r5Zd(%7ySSnO(k9P}M(9qG1PyEo$Z0wl#DwwXUGi~P=B5j(Os1`z=>MYVEP+@6!
zf8OT;p16pT5ONAY{eZK7qSll%^8q9%zm3`5u?QgM+&hXxC+Uw?dx!R^l2vS=Mtbi*
zvw-Mw!6`$q$lx(*cqswxRl@I^Of<6(zexYn>EPfYXoX&w^<XT#_W0Tx%MX(vwSt)w
zx$NNy9;;Sa48mV4+7ptVj`Rv|)>l^InY8nokk29bL#V(N1M_#SEoTEl0#MFen*tiL
zAHpCDL#bb1<mMA2b_ZdJ=c>By%7X#4LpS%-MTNVEShatUgzw^5126f#tu@xAKkE}5
zSHtrMf2yl_K-7k&!}d^9Q_~X_r;Db5CL*~8*E`i4)5`#nrKPv`mB8thvCI1*XXnj?
z6hZ7#@Zdi%qNkt`y9jZ2g!Ob_AdbEwXL>J1rZ#(^^?|X_u`p-3DevCOKKEs}O#CpB
zhD&?C%k7o^e<s9>*WX)S%M_@V<%;Co1n_*&|CXjhv7(R28GRYEJV8h3`2^e0*d)gS
zV_iq4N=0DOJrRvBH7#{wf;)>D-@zfOVMWdTclvLHyeqznzqfDS#{G;Fb4N1f)=otf
zQu}NZ#|@hszOFO=kD(9$U*c6y+jLz!7nYVnB0@;7T2l3OA3b^`)Z8d2qax;aatoH0
z1W(o#6+^!yq$ee@F!Cqm7~-W%fJw8pwT+^+t>H>{^fSmlLA@0yE2k6;;GrwN4<GIy
z*pvb0$WQAv<Z3v)^3L?b7>daG*Uxo9>@m~Bl$f4wH~n)9=Hr1_m{{Mwf2Y1;S*<uE
z;Bvf>e7Q)S?8VN(0o*M<hh;?|9A6L)L=B{Eb)HVgXXR(rJ6>|+q%mooXQZVKxw4uH
zTT9%=M;7?pN=bpc^>b)r3G@eFw7Nz%DzbBo{Sv&&t%YX5#$<Aye+ixac%`2Ha0Wi}
zS)Gg9UJoiOb!JW8<S~ScLLQ%LxfP#tc)kky?CT#1RBVFM9sRQP{q(c9Bl2%1aPZYY
zbTi07@)8C)ouQDsbP0psM+F6?=xF@=L@xnH%nxETzu69%qn=XQKhS*|2t;uRDTzMe
zuW~qjSpy>f6C6Sww?4^*h+^Y&(X)vwgackqM*dr5f%M^wb4yEk*{~-)6XjP_P>AKX
z?<}e?1v>rQO8vANX{_zhMHu8o|62;<MnPlc8V=g!V-KOB4CzEwBcmLdggO{X80h`#
z&MH7Q{A{@m!)zR4W)_YoT#3Zk*cB1|^cE2UZhh`12_HV_rKUk;C*&A~{ghuyS{&ph
zHrBT5Mn*kGYBNl;e&4=8KGdzXb{Q?ec?U<eG?UMuqrn~e=8d>?JhLdwW&A<&js29b
zySFzaB<wMZb78YqNnT=hImf80IWinH92>t~I!Lf5mM<=lH%)TKWi-Le>Nvl&zb0>@
z;Zhf$fArZhMP<qVn~d}Pn!Ng3GCH~sI(ml2I-S|Ka8y1WHPchD1C2mkRXj)uDTj)A
z`Zg4u?X9gs(5_`k$FO=NvEt~0!kiG8nquD2*1#j-@vFD3b3ia+l}nO0mV%2yU0y^=
zRP^hGs*<Mb?w~CMvH0NvTUx~Ycy*?1>#4bc!3)QQ9*8~bh_YfSy2Vmt3EDdk_5(X-
zVOENdl5r$tWX;+7KN4PWIxfndMGFq29{s3{#6JyjU7@0&0%31s5xU_x+2tJ(jOkb&
zr>qE7Y-9R=vd;h`dyN8DVhKP-LnA`u6=V}t`9)vy9&Yiute*f3u_+5x;*HV72B&L_
z@10mSYa_>HylaH6*7&`>H}F3KiMMq}F1Iy5nQHKHYpnn5b(%9{)GB_z8i<HZEP%S(
zXru;$`%)qMok(M&Y*INbt!r2f!$nYGs)|0FnBJ(OtZcu$nU+uW6VhBj__289MP15z
z``gz#7tN@{)pEx+GIEi+hAr>5EW^jp;1rtkpG?7m<<HL_<E5@?h-%)A?d`md!-ZRF
zqcVg76WuG%9jtE;Q8`QZ`<*@D)tP8@HIq(A*6Bzyi5@7|e>=qAPEFC9z-ztlGm;ve
z+<v~avA8&l_%vUaxphF+t*?g`P+(<c0<4JshQ1-tIM%x0t-jaauSlz+q~^R?2SdTh
zpuw*E?kkz=#I_|A@GNq;IEHRzjKbo(#zSX3M?MptiAH8-+Cyv?7tT1bNv1H+$j!`*
zOt-+dgMq2EMF$+r5e^Qhv+Q~KPsupGV(x(g{s!p_*UB|9bW{&;tP$E4019Fb`l{h!
zS#)1D#a9p@dH>m5o{?ep#>NJCT$(!gdL0yH10y0LpbQNT4McFm6Fq2pEG7A7^w(%d
zSDy#Tmt22I8_8!ere$eKMMd@Xh=f{VBKV&PHv_(W2S{{ya4-nSZ_S>fq8?O4<F9TA
z-+2w&6&YpUkDpCdRU?B^&Q09KyzAn=`&2){#tu*o*fy~;GBk3pxzm&r9Biffc<se#
zNPV#UAmn!`hK42b%d#5k4t*}?lh@D~8XQ!gmF;h9do@ebxRS<%B1*C>V*G>?F9O73
zixjRH=|s{<EM#)HxQ7kVf=FHH!ur)b6F48`<mI)?+H0ci5Yt}EQrA*aP{l;!2jzHO
zc}xuAb(HE44=Xe{cY4Ni+brrr+CxOH$#cbr6LfcY$2w%)rXqu~4A;)Fp4NR@a<sI(
zW$0U$s3wTh9Q5yH&c(GmD1E<Ho=`|ji*kbBXd`6=g!UaZEu`v*jy~*kbR8hGq8OT*
z)3Ua*l%F=<p(2Qh2B8p1P*9ZANB6Q%4kzO#ISim|5kYfMZ?MHCy8{m;&+*pXy_D2a
z|B!F@o%Q~immS(5l9@6{`3Qp)g*=5nPo+BWvK*vmNrX~&6_bge3FC9zgWQ#O!s<vA
zLM|fYIk8b%_4tohLkv+-xmkx>(r=kM{TvWvB4@L{Zu$d=8JJT!MqLsGeElYa0Mc(&
zaZx$fr|=;%?j7D<{j=H_2()*3`9J2rTZ{q-2p)s0{lSlf&|!rEClVo5MR&vg%$zI;
z>O!1XP}YhF4OQ2ayH)Jl(`d5-61-;g;a``pWk^c7K8%yR(OX=CIgQ=!-XUPw0tnbV
zZ%Ra1-U=YT>XVsYAs(2V@oDN1VxGYTh_s5rfvpXpPbX>v(U*+Zpx>#gdfXKnh;zMN
z{>h<|Am&Mj4fwfwvGO^bSsQdUYAn$&hGEkC>g8v+cvk;bBmqhwpb3({Grtu9;}WCp
zMuejCvNRDQuh?z~Ji;KQ&{_9vNrutmL_g;h;<gzhmBt;?y5mMU4k_8d5ajkaNxX+)
zd-6H$Hy;`r8370+53Q}g{P^M}?Oyl=QfH&y&6PFm-mY}m;HRiR&(-yz8o)F+GfJ;0
z-Lha#Pfhh0U;SV*@X?l$#^Wet<SERV#zscIe);ajg?;IwYN|cK2I~yaV<kFIsmBTp
zf&}<*Yu~o(@lc!uQWK@IM0ZBNW+05Byb~9jyj~n_^4=qeKtLq^mp*jy8u6y-aF<tm
z`>t!fj{d;FFgwFV+Lz_L`s^%n9L1F3t`axgbD#?Z<$X*vtr@$2ZbXD~;Y2t{mnT;I
zK?qcP(F_5(B8be=Abb>8%}#zs%7{gZCAP7#F33H{7~(L<#;T^KraFRn@dt<`M|S=T
zd8MTnYt}Ma*9g(5FW!rYcqInPvc3-k&b?Gl8T<WfOeWc{dDnCw8_zR(6?G<17#O~%
zriMmGKUpn0@V_(Ik$p?jDZMZ=v#1D{-9J8`gNEe{JxD0BEh_+d^(&|ozx-_)K)Gki
za2Q%z`txVOg0G?P{m|D^wIwBGXWMK8DqEI`IpPt8I~}d94?-9>Ut$f#16>}Vlm34G
ztgOSvaEEvHQqDeawOR2DrlVt|%Ir5kc|g=+Vg8W4t2gcMrLT-pmi*qk%mHe#cWU+X
zIYnh<dAK)+B!sr1!B+f7!7Q(uan8|Hx3<v-!i2z5<9>)_(KMvZ;&&lbSwczpG&LRs
z_Ab|JQWX^ykaoFFgzkR$kStjNinG&gmw|9oClU+<!$B2TBA!j@siYMp$w^B``^O6U
zu%!6Fql)+9Dt!5oCjSg*-%GMZ3{)U>*@|~opXXEJ`Jviz`Sv(HB`soE2Gi(7*F~p%
zKd6F!|9%Hpwyp8WD_EE^)z*Sl;_lspadsg!2?-T0gZ6DNb@kZNG52C4q@j4k?~6<O
zXbbleLld725FAJdUHCuc-rOmY2iUdj6|nRm+^f5bzPQ9%vwp9vyu7fiTz3LxFf$_q
zd^@#z=T9H%r2%Z8b!!JqGXo~~+XJZT(R28uWzEB?T#l3A)E@8bfkFb9TI88Vizivu
z>anp9^6pE;y!H6*^O4}edwx%{va`dL6@u*Nn5V1K^wP%6XK)`paHq=5rYm#lasOWS
zYP`K8qrdjWRNR>PgwT_Sf(e8eO)j@br~AKeo1X+4!s1bP^3OsD34tL{{->%9{|QgO
z(L1*Q$xq0JvDg|Db|A3BqUBZ;(O9ba{eJO$=a;;(GQ-l!3iSl~ozGtPJ8hz6)#!4v
zqhq3*exp)HUY3(&_!TnOq5AYd!Y3RShMc~EjfFhp4xb!W6L5PF77<xEKAey+NQKX*
zmk*B$|5*oZ$T&J<;tu$w%J~M$Z=vYfsi!3dk{nm8dnes8aYQ5ImPJ~PO>j<-bTXKn
z2Rb=|;_|}c_?7VLF_2<ityY8$a%z*2j*wbd_I-E$*QV-vp@QIMCDdU)xASYrSczd{
zfNtk?Rw|8z4I@a22Bm|B1_s6l1_TK{T)#ezn?!OWDn;DF3Kxi-{mn*{3<_5yyo2MJ
zi(40NTk0S_x~bB|c!h#QJmEgVfg<7rr@?!+ia}bs@0y(Y#QsRq_x(O|saw!>LEN{S
ze;H%1<$v2~@e4n>spBGl{`_e?W~QX9eE(Xp5Is;!*iiK}rCnxTh3v|0$KjNYkw1Q9
z5c(Cr4jFhY&JJjON@E)=)_Q*5-br#J<@#ru3xC%I*Y;Dd?HMP*blCHraaGM$IVGHY
zhYV3dE}K+HTstY))7nPdvHUw#HP#12(En`hd2or=5jiNRsO}PRkdd*naxw*+Tq82_
z!yI3gL8HoOt4YMy+RBP9hfe%9*q~forXhpOt)!y~`QfSZKdPv`+X&Q#%ekl4D?NlP
z&NLn*4c>4hb!4vEeKa#PJUlugot>UCT$RNxoL|Zrt0N-hFjsGI&iuYR_Mch6?+?lH
z2t`uY6^Q3Yo9ac*U&=<tA{wNkxm<@k=3C9tu@x4zU<z|Oy|{$O!9F}RWBG+djQWQC
zdv($F4Ub{<@4PfyGs#AtnmtS-4-ag|a^HbpOj=fp&UW)8Ys~xtf@*W0F(~J&(2<e7
zRaWM-yI2%LKA)|!Zm3UkJt-uG{08lYHVB;6s&YiWm-6~@tN5kMSAGZtU+I4gvH%UK
zn%s9)pkMP*)Dv!LX40$%@$$gLAjF<qo%hvwAfNTeNI29O|KB7D2oK3K14xMZtu{kD
z?-!_7X)0=<zB60+Y-wVI(Nd(}rwIU9ZuTmeUgsz=L<EJ$^IP{NqwWK6((pI1wzX*-
zFRMp3M$M6Gt|#rq#XF^4&U<2b?>nNgE-o)`P1}>O(tVAHaO;@!fFFQrma?rBUBz-~
z{cv-0%G2{=Cm;xP#snO>ipuhocw19t%CBGZa&sRZ5@?y3ZP(S<Ls}6iyC5+4zZDA*
z-$|-PI`ThN6mXM+o@}6N5NUIM9@jVEsaJeNSeQo-)=|0cJST9i=hwo5b|FOC`Lwvf
zMM}vo-T5@wc47E;z&tU*lMSbXRYWs-e4vO!%(05nyNQ8ub{npx>6#p629Q9a4?6>0
zwy4PRyHqa_{v{qUu>(m=B11AxRa3}8=YP>VG_8-X8tAEPQLTov>G!voxm=ul$&93l
zC4n4Llu6{Uwe3$kJG+Mj6^Z?At*wMkybweUDEA0O?84tfl2x_@c55Pj1Qu5Jg5(k!
zt**Cwe>^3yplkct_Da+h!m<Hzj{AVH*rMr$eg?l}#p?dvVa>6J8b@9Rr*u3k@|lpD
zTF#bgOFC=mNOw2=Xx^*=nAeoC_Y_Rc%%J^@e(uDNPE8$~2Z13vBgm36BO<;5u=yG)
zK=s{#B!B`<{{D5MRkvY}uOuiixDzNU+7)Wj2J=T8>PbR8pZ@%KQOerGKG5<u)_JiE
zuk=5SKHMxaJy+JU7>jrLA}-$k<7uVqA#3G>)EF%Chy;O*^RqKzK1Yi`K4p+n^MS4Z
zX-8KVQd+6=TJr4`8IVm3ZNi)yhD%PDdu`K`V<#skWBHRk>8#AM(a;Gj53^WW7M+}Y
zCKzM#B31>b*Z6qlr%uefcMo4<|Ai!M+m(F2)D`qAK7~D?bk{lAnaq@K!&)1BpeA&u
zJHJBUVK7%|Sf2>nx3#@Xz+r}(Qd#-wq#fhT1iai{)Nf>K7pGvm(ih1A%s93t(k5_i
zVys_sST8dK1_jkwZ~VNf<K?TXg;xCc0Rla28z7?>?7Nq9GvMcF^YZ;M@Cbsn68M~i
z6ciSltK?r}ZIRE`lo|J5UDVc==u2-+6^)EBA+X<zdOS71kH;tz!?SiM(GSnImF3$j
z5!eW=^r&$eG$Qn`1T6PPm01pr0#>0o7(!yEiyi)`HAJ-kAPfx&N!#L2w^NF(v5-@j
zJlIXCnThWQES}&KA@rF_JHtlzE0RDG!~}3*$=Tf(0{xAEgY)d<{ulY#`u$~w?EEBu
zzXTqKgRV5|!0`riYTcRo@6$!UesvX2NIif4JTVRA{M$2CEGDaghXm#B0#b$ivZ`BH
zJ5@;)vuAZYuA3IH+>?D^;^;oI{T@}}&S+Uhg)NYcyGeOmO+rIM1*xa1Eh%ZZ6ht(L
z(3s#gYBc&b7uV8>_4f0}&c41M-(+N!m316P3$yNsYirM!J}!}xtagWBZu8sjN`%}t
z?!^s#@ty}j-N6`Tp3e02oN`*{7DIlJ8yH9e4z&wybUII*e+jpOq5L_pvE{3CUd^bQ
zt#+wU8_S190&^zheMUuw#)gM$YG_;@tlch&=WEdYNJ&BADZjVa$u_u!{QiQV`Su)U
zBMD9Al}R~1K0ZpyAD6QOB?Vdh=X-yXl#r1xK_m^@#MiH0<z&-QXHXPn-5Cdm3#d6j
z(`;*N+ZX^X2oodi)d4M<=#r2LEOL&l?MH@&4tE`1O`<5gRa8Vp`vBS}?T$y!NSxk3
zi@ieL#ux`7%jATL+B+4{c?CRXBje&iL5r!e-@r^cDYTh9(pV&#Nk~qqvE6v{$jn#=
z`OtSyJFn2<>!UNA2eBa`lXWrTHa2(s=j>QGTu)YMW1hbE3Qi`gbOb@zeJcOE5UayT
zYZ??<Iy}YArd>0D4R=Z5Ye3W!ahNc3rN|Oz)WcKCO8t3aN?l{FrM(?pqPN${W4Ed0
zHN^DX3%-|>^q>mWkPDwgPE~aT#0g68&`^b`4UAn}$QkH)>ASkY?m=(7u}<nN^zGEW
z;Fhhs`HsP9rp4Qb5uYm~f%5C)BkC6bfPvBB(dETOoY0D|h|ZxX*pzIKBR^Q1*krQi
z+THIQ?hKh@25cqBWM0Gcpy^CdubQ{<gRya5etvXdWMp)3c2-tUY;bcry2=)olAyxp
zw^-C5fWuS8is>rk=CCO(n_ERXxO+fyC9B?Jg@MpVWM<X}ohU{W76A(y8ZZB=c6<VY
z=Jcre=O&Imi9co1CF4*t=v+?lzIqb9l-d!75p`CS*@M2W)l~!h33uj+?2*vK`<v=-
z6ABjscw})u117)W5mz0PM%~EN@bLJsu0bLm?yjMrn|%nQk44nKrgBKm7!dCWW<hBb
z{|%W~X0wCwTR2mRQmg%)o#CM;yhezBqHPb$xT~sAY{wtwKTMtO%)<7!v$m9DY@4eL
z6x|6=&TP7`^iuSd$Wzw5oE)i=_MdHe8WnPy(wY(yC8?#k>FGbD^hktwa9${2e646l
z=E*C}#93e{F4k(f4Z55ITml#Yu#!?SzNyxViqZlp-D(asqo~7*iME_j0zYuOGQ)*&
zxbYY@(eMPQI2akWtQ%a-NHQg>@k4%t7Nb6#gfToiS~SlAOQ1o}Mv~AFR#e_OH1J>{
zGsL9(0Gr<B?ORsU(b%vwZkIlYB>T5Khpym8p2Hd!7B^J#+TJI)sbOVd5s2%K*Y^Kt
zc|yNH{uGlsvpvMUg7yT`jFx-i0S4Xvvk$Yw`K-s`*cF)+?YUty7k0I~wpyc3JdX=U
zWhlgq&&^p`SPWm;;xl`X6#YuNIhWi4hU)40;wB;92e~FE>sAhO*k^5f1Yog$j?DP+
zBRn`6sa5ji6a~YM;X^&ItN#%(!J>HUjZ_Hd;o;%;+^)}YNLM`mRG|?OB2PSFw!y+z
zE&qc)UH|)yE}$#0G14<AiC+x05;KU6n-_EFJGeC}%B=)dHV=&(ptgntX}{I{_f9Q?
z#I}iK7$AQi8=RU#(xJ;yz6slsHZ`60oA-KAr|Hpg8XFJGX*)pt&h^3~E#@fT2h@KE
zqFJY>r<|th0;XpsY6SGRZ+|5xV_-;0N~+i06+Vki(_2E(Q<?ZV)8{jT)e?fD7cGUB
zWi80Dx>{&Gb$DniB3$3+*xPX-T%uKLQwGGbEO{!Sv!l2g=0(YgD5dm75_iM-;CuJ<
z^l(1X_$Dd6$s1(T#<~34W?GvG;hcqZ)O>tik|DQlS>D=l(cV1z%_c(++k#HlKO5+f
z<~XCJ$My*8x$n-H|C)TGIn~53WD^AY?~=OuD~&3}5c*>pl$eO)B5lcHnJMn*$U|EV
zZcX9d&R4~(tRQ*CQ8_6O9-LEQQmf9~5{2kK!~~#DR+!E@Y+tn58Y>r7u)PAv+*n^;
zqJY*XNAs!L-kx0F*ePW>6y(K&l6ZG$AHRP20uXZi!GW7#*kp!<#Z((}35orRFnuc%
zo6?(OLx|`cSrusoL+I&v$j|$^*b4W2rV&{xpt}0|yAF96_W}@~Qc{PrGp3VI-<R;Z
zy2DdIgd|J`@kJ|351(mOuY%BI;NtdjFO^E{^ISR+R@<&tNQC`CB(Mfb)uD80=xwpF
zDVvAJ$6uB(Pt&m9=XpUvky@YBH$B}3YEKLE>cT@!_Nz4HhYDmi>0iIHe)hpYNkRsc
z%LiCoLMWM@Zfe+rr6paxoXi3<*p0KX4=Bqi4SM0QO$*RN?SuvfT9_-(R2r&1R_v^-
zsy;bw@DechbmWw<u)w&3;AK)+TKH*ik@nPP7#4abPU&HDTbIR929W=eQ2F$k^3cvs
zNkvulWqT`FiUe=<XIi(2k@($V!4wnhSnV8Y*pj4g$+mzjKo*uDbnK@boSf}IGHv}?
zTyTf}eO@CraU%=Tt>cq5Ha<QLu-nPv!G<=L&kZ*;KJWWs)qVu18@tkR_BHuPb8R+`
z`0$S@Gb=^|?dgl4?{ZJZxP6Ur*KO~hDl6*?EDLjDnQ_cNj_!MB;Bl?O<L!E7Zpb&c
zzP`D(BsGedjWSQ-Iat>hh;f1Qvf2{Ii%i6Bz|QKmF|ev(3WwqRU7)bI1W9xtNf!j2
z7-Y9FF$So15U8kr76z>9gLa*RlY^tN-b-hVC+?4!ERmFsPD|n(4i}oiPb?yWT)Gw`
z&L9XN##eGUX2eNG<g2zPS0T=n^mzB2^ZCe_oX=@WiViZe*J?!h7NSzkpNPig@l~8@
zC!4!iSW8Pw9)lg3>0fTWYG&ax9>+sHN5WbL+_XmJC+{oAW=xEb<_^#PZspPz_YqNO
z3hdVQY;W&tLg~K3r0x@hdepw&V4H}Bib^bCdG^~{21%$Mm7Kc)pV6#~&td0v-z)DI
zx7Zq-Sy%_C*=T4w6cy*aaB)-bvpS6)xZD2)nPr{*@ecq>hK7g#c*-UR-T4KngF_X_
zctzrSV@6G9ihD;~+_S%0Y0DLTlhA_trDNpP%a>?(o<P9#Gz7wM8}wqDGB8k6x67qa
z!;WfVa`M+^2(`?3v2FW4UVK^Ea~;uuH{#-yTkt_WfI2HLhBI%ra_#K<B>eC??f#ov
z?_b-*7U_t>`1|f-4$K$K_;a%rD;wm&)%F`t?i1-4eYis|#B0BmHXYdVU^T?+{Mclo
z_HZxEcyKUyj*=--09&11iLcQop3e~yBU93=v(w7-X5*(f*<dB?ytb!!d4`=;Pyn1l
z^er=ALwRbU1j$G)DIuYx?CcMx#gsVC$SyV7m(gGX@<hKg=3040JYFFoCxm!L{Ieu2
zmBPq)Ls3zo-1PFv-UmJXHVCgCWE-TUOnb6U@UbseTJ)6|#Ncj@<g7$m-ZwVhC^w(P
zxHr+#GA%&T_`6J?G63h<y$2UR>El3d6lOfuAJ1EmlViV*vb1)ah=)T((PzYrj0Sn<
zEpylQ;-;pYYMH_Oi@hIsO6YX*VEfYVkFPRo`PfzWq_!3Z3CTWI3cGNEsFlfcq$rUM
z-{e2DfM29ge!`eBH;;kzJ(5l$4Bi&wKiG~s<GHxhy}G@euUa#|d`LgAvdPBuj{SIe
z&Ds}>n1K5OO{?g5Y&JSJQCUgJuL0SWKYz5{M6h;!i83*eEE@Hq|JnKfi<a@$itbK+
z8JqQR#`xeMs|Yfms%n?WQ*D%E&|U*mv&#B!P<1q>dKCb0%Ppt7^!w{Du&}W0@j9%R
zCQMyj>wy6Ze$CQ={xvPvz0~d1bzZwIH7+-*-67a4LxuL`%a^b68Lq!zc!}msPE9ZJ
z!@n6J`+MA<q4wiORTCql@KBR66ny+griP|rC*`^%OiWrzN<OtU6?|dZnEoB`Euivs
z;p}UCx?>MIMFV@i3uYX`%pCBzhNLujM=N5NqB=j{2^6epO5|@H|2^v~m6Dj~?i*2H
zdJ0a+s;W~QU~Koiw|R`YvNWH>cQ-0g8WWaJUPN6uT=1KJ1#vwcY?PFg$u5HSz$O`7
zMs$sU1Hgo?r7#8n%3h0ZyPI;_+DU<d%wFW(>w<cimCYbIE?twE^<LXP@h;@yaJ|*A
zo_l&paG8QNe9h_`5U*Kcr0T2mU)+tL*aR{zif1gessM_4z?}<n)13oH#Xs-WW(NY}
zgTUJej^{mMcVFMvQr|lhzu<(GAC*_I7kb$7vLfehf6!NaobJAnm3whpbA|Ga_laSo
z^n~^Za<03aHDw#ti!<+|15`AU)PZv9s7F{$C=WlHztYjuN97tK+RJF*ZO@W&;ju7*
zhA3x?Rq@FtaYZ8nOs~!#V*T26nU+%_B53%mWjlIt_5Df?njcVM5g8a8-nxyxHSU5V
zJb3a%7DWgjOfSVnMGGs}S&_Gz(WIolcXhexz9iQ6N)3Gp1Zrs9I~owBm32}@hDLY*
zf^svr<lMkBB*kbBy`Eh&`ey(b)3jzpf!}%R;&;`Wat7?Pf3`A))c?OQYNZ=eEjM$`
zYbLlNV2tG6?}Z*P*`OpRXQ?fR>jg9S=k)YB_4V-voB;_hjMe%YFov&x{mIzs{5?J%
z8MK>bsw4ka{_+CZFJW2VF+DA9X`(C!pr+^dFt|9(rt3v6-U5dzEiLVa)NxJsuhuX&
zDCMUX9OjZ<B2#r4OA$<}VC+OkN9W{JHZqz3tJ-A9^@#B-j0e9zVbgByV1d)B50(X6
zFg0?Coq8P*WuP;*au8*mip!2%dS>m2mNR&hR2{YJJrf)oTx>nYzo13-oZ<4qyL)rr
zz1HK&1UFZ2R7GMy$mEDI=W2wHuUoC<AC4Bf0a73XzkF>l$+ndN4|`)0Ifz+X`*$hn
zH$c+f%5)<af)Z+TU+_}7U>ZX>`h**V`PC4e19J93w0}%jafGU>ziC6LdAP>QsjVGF
zm$OGUsHE_(yH=|H8Yl48l;7UDjib=u)|Ooc9$&4q7qb=icqf<eH*e7n?4O31O-rsZ
zw7qHru1_m*kB8Um4?2G!CJ%$S08i$|LKuNXz_WN#<aH+p1=U;ErIU(BcryO<FT4ip
zTU)Sc6}cc37pH~1S9pxX2zKIcpnGngV=A^G%GGlR3<)QDdJ=%wZ-R7Ar~k(gb1!ZT
zC4fLcZ)PeACO<#?{NBEO%j0$x8kk6eqKHMzcXVp)lbhRf;b2X;NsC0aE`I<~Oidjv
zEkh%v-PvK?y1Kf4Six~|z3uJ#W@e&S?5wO5_lZ3{p)c3(js4l*Z*HzX)SbIxEmHt~
zjPVC$rsw&Q<6L4UDh(3@jR^OkFM7nJffy(I_8pJSi9sP`_?p95lW6O)-+Pns%EvZh
z|I=yZemRs8N#6bg1Pazm>$bNnzdUA3AOAh!URMv<U-e$*&Mq)WaN-@mZ$isJ@3yn^
zs|nc&j;Fbd!oorbKB%JM=hxmJB?@HbU{$ZMduTXSagAdmEiG+kC*23Bxs6s^U8snN
zh{@!9$hm3_w;U(0w`x*Tbq$a<5B@$SfCy^`XzXpK3zNJ)_C=zR@+$Em3;OTQC6SZd
zdZ!lC>lnTDyDl#228<BT?^3UG{!v_9JiR6*EluyFqlhH(Uz6MCA5LVgW)ZdL=WFc#
zLL#u$`ea2_R+LNG&8$*7&VbWx{@&B4W&lRwtD&vyTE_>C{Dj+_g@u@fxOmjp;yrK=
zfjSkOG5<9Pefd=4-&0T_ZY8gLtp*|jyzZ73UZX`ncr<Su-N*kLv2S#Cb@4c?Z!Sr!
zun&)rXdI8Z5Y-%QcK7vh+a0(ECJxkJq8F&wvDo)X9=%G_PbKDY1};6~##n*4wDdd)
z7s)uQ{!DXNcLWdb@hwnJRvK>XXJ9wt!S$fZ<)#U416VkLPg%3ZY(HwK-46?C-8&#a
zfBWJU7(I$h3qkTuxdnK`g@t?Uvl>D|q}<$LE^>3)6{YOQ#9XQ6=|4&{Gihck?Pw_|
zOg4_<0uf+YFot~~Nq;jf`#V(xH`o4^S36A0_VyexC&0?b!MYa`pT9lQy+X|A>bN=}
z_jd7<<0*thJ{54ROe(URu9iYUM~^Ym*VT1bHr<IhN_?%XyfPJaA2da-$J@xgl@?94
zr~4oKBcG2=_u39LUcE;Q6SFDQ$9RLi0_YCY=~}sW?~Iy~DW_|qDl554m{v?1Ysh_%
z!BQ-o^6XhpO>}f2#F0i%K%mdz=I=ijRq}gQ#hNorkG~>4bOFP%&TA~sW>S^SAFzFa
z-V4BhQ#Japg|wS`RQIQ+HDLKmdVO|R4gKx`KEKK868%`P{M&Kmb1;kH;Fp&Dy>0bM
z@f9lUf>nu-6ZHj))L*zMDJa0E<wr!sU|k}zPyzJkSU-B8IQ2j+<rAt?GhE5PwAPpL
z1zusMq{KPcGxictpc8tNO^+$ielC<;o=w5F#<yE@5_}IO#;0|KYc@K2;qS-um5w)e
zrN8d!ma((!y#o2A%R)p*46dB!Ui&nz#|3&;ZmyAm0S!F^kTI2%ltxDfk#uZr4~H_C
z0J(S(92FKAc;f=^4ABpquSq*xAJJL#)1H%hr}_>o#e%Uy|9H2M9$-E5X6M=sWM&@t
zJ5y(@sp+bqPztM6t2g(4SvJbo+WyHd3c~e|JKhjj-3j``TrX`Zmj;3W27*i?{BC`%
z2MP~U@zCRv-Pth^@N3bte!ljOi8)7i6ctwQ`JH7hBBG-*{@T#6GkRhIMAufhCzZf9
zMv`&qm=j7w>*PI0Mi$`WJ@&rxDD;6dp(#9g;oixkhqyj}osNkaHR>_>=VtFKh@&wq
z{P{y!zs6!_fI*E;jm?Sun`XhObnEdwH3EWhFKGKnm_Tq=uhy67fh_n+<Rcqf355Fo
zKInn01qcBSXHdmB)t<fkl-<3a5NDCZsxN^LHA#5EsYVCZEV3egQ3i%au6M36!hxg$
z02;p?!A;|{(oRB?=M;?+9)l9K!&u~Pw_?7BM}&=yJqKluJ0U9z3jk%PGtZGmz0H|}
zr=`DAsz91;a%t`zX+cX%mQ`qW0<UkX1k0m7xJ<KG=1%AyQ0E_@-NIdVde_pJL_)ni
z5?3Zac9|}|Qjg7{TEjHLYIip0($TD!l%7O>ZqnKx6mnIROEXlsLW1VBSVR9;YqP{c
zv(cz+^0iMspL}0iuY?3nL-a8d)~cN?TM?lMY(+i30R*DCQ+#))F+sEP{dTzNWK)UF
z<`%R5k)(qI_a4?&bF(nc9o>)A8T>HEo{bCBH8hmIW`jKIZz1%t>sm<D)zM$SynW;M
z{hL~iSxRkeZFu-caYNO+8lj0Iu!|60n!is-SnT@e5rfoS3@pDdUq%$h2KU@0vQtyV
zF35N$*b-~fr4#O6<t2F_iec?!8<OIRV}=@joSSO~0~)HIh^$M#+pAY3PxgOCOt+~<
zKZ&McDsZ>*|9+>bg5T}}Z#KFglY!wbD`FV>($4fnb@hZU=+3_>)aE);(evUVsl%Yj
z^tOj0_{ag0G&sc8$&8gVO-e(90lILhK^iJX%sP}?tD3gYpTEs<|3n`4_O-V4ojZi9
za<U3s4qZ0VjQLGoXwq@4LEnQv8<|X2pTblFnhdXj(aqm%b1^q~Hgt&M`!E_Vd+YIC
z$8UCc`U|r<JquVbh>v_brLH66cgpiRIwdjLH`r=?TiB6=uGqj{$NBtukfGIZRKoSf
z=X}7<H?Hij8~`sdp4ZKCdO~q<FqBsp_^F#)CVoFiC}<?F@7G!kaCe6@e(12<9UOru
zB$6M9Ym@fd^$`5j5E>8xRDF+CjOFDz6Vu#TR5XtcIVGiMv<x6qM`8+3oT)}O@;D)F
zR5Ud^r3#<?74LAdNb8p$(vE$97@bF}#`RmdpWy=`87)ro{SE6LR<?$HK{i`kMGSUe
zmrnei0K+^40OD@BhkPrkS~?fvK62(nYep#bu1!OKmywYnQMmmWbY;V(r7&Ru$+VBK
zATt=b2$j_9K3?_`L<p@wtEc6~ZAzDwQ4kUra#w;h|Awm;5%Jm?+v-`OcYgagA#$R1
z__KF~pXOn4i3@n#kpWq2Yg-7od8GCZe+5;r@jgHFs*uGtTk5cpf^Khk*l=U|N4v8_
zqW_x|WAF=9+6}?}t?uU;_~sUpUyisdM(nOX*!FLHo9z4b^;WfuN!YJ?Z#o&qJ~N|S
z`i`$vm4E(n^@P=#IYh}BTADwNkJ`KFx|p_J+K$IpizKrD7_ziowa4@~_an_#UlHza
z!_XC?=@;x=WOIXGY^MYAII#BlS_1E4*49p@<uCu$58xP97U|18R>o!=sV*&H;$Fj|
zp%tsKw3v%`z|@uMz-*|m;AdG_o7bzB`tH`izwmp>frZrm;;Cs}`K;I4S4qPdhLe$9
zL76U{Z|~I9lCD&<NCSOdRRm!9zBHU)A@D`piYoZD(J_#{=Ug0k!SpM_j(aPb{Cr_O
z+0Eb)p=Y76nglr)#b@WRu1R+UjIluN&rDjy9qoT0rv}DDffdEz>{NZH^1@*+R2}81
zzJUrTD8N<;TnnJS1#J`EISomf1AK?AZRr2i-gibd6}4G|A{G!uRHTDaq)U?yDoP6w
zrFW$F-b)f2ARxWhC{?=jUIghNC3HeSTIju(WRCBA@2oYmzBTKcZ~nf&vT|<9z2}~D
z&w2K<pS_cs``MsIPYQrj_EEul%BN2+5B)!K?Cl;h#p;0-Wa^zK^=e)Opy8^$cyYej
z5J+@DH9$`O2CS6j6`;N)5BDJj(@rdN`J%f!_}8x{OO$)LWfFDr^B-^6STziC)I<t?
zRF-Zd&MGrAi7s8i&G@$6{3H%U)m`?y&MW?j1<d`TD&-%UNsg5>u`vOAtHFT*KB|*w
zFYks=^zT02Y!Mld{ovjYu)7Zlgp^IS0lUx2zC#hxkzYVLUtpl`_`pv9#TDsPT_?*6
z+a$ZKTMtCkFuZ?iFP3-IlGZIRf2R0%{L6)&@#o=#&*9K_A8*|KnyWy`$45>`_*_>M
z0B0aGZT2jP=+g5A<>xWaQcAu7(AJ*Ztp}Jq{!x4V`WXl)CV=<`Ct<9r!A@URS^1NT
zF8@SWpd+$|y}ICu<m`&WX%?eEnn9wp$4c3ix_KHJo2c}9vzRa4kjA@9uj?a9)4$Bs
zGmGAfZV#ya6dvwgcbHrykS)S{g2~-!wJ=Jq-Q1AFlf0?{<u1isJ&rbcIjp;LFBp`x
z4_i#<g5s;RP-}_kFW35QNzR~BUA&JEkCF-t+q~Id9~bm}^O?R{Ut1UVHLPS>OhVmY
z#`tHN7e&aMsxZ?0;zB_|8XIY+)Ue#O^$l{g1OocNiLMM<tcM7Ez9#p(smHCYa=J}0
zImIP@cwFm8IU{Fn`T|6E-B#X`xgk0R6>we^9yZMHk<`SgX;?A!Q6TzSH&Szcnj*tp
z34MQ4IVNgMA=pm^EHq}TF<la9iH5Uku|xMd7#3H_o!t5JI3{M8sa5tSy;#c#?5&Cl
z=GZx->l}b;m!-!?V9gQV9;NC_)WZyM&9Xm7rhdTtk}7Bn(5H3PHxsJfDu^Dyz#bXu
zHNS@4<g;3@4qDh7T_&7?{il+=Jg03@C{onYerjrB#B?;}3hY!Q3OWF28<;ZR4!{%u
zOqp<MNn=d?#B?oAlEeyq%<e&^vS8W8-)-7qVq)^mVVj+|SRdH`GFugozSkZ=i<XT#
zj?aycErN<|=>dV;Iv?O39vfSHZ@<^q*MDWKlS?Gz`5p7X7ytfmwO@Wl#w)+@D|^^?
z9W#j8*H!S3aXdzn#^>5DRYkfD^wchM3lra=$j;ICag18;XP=p>Jz5BS^esCewbv9S
zKzGH=5@@Q-%CDK&4HxPOgVFx3qY1H91R@m!gEO$x@&frydx&0>!@ZZ+`qS#3xjA_@
z->2kFYBFC7YXlO-yhcFz=g!94(_wa}>O*H2|JE<%KPH!fbYY5t1USF>L4-V|sp;u!
zC_pqCd=6*@93HxX(tgGtKuW4Nt?c&iIuJR&@6{`R%L7Dj5O;u*7ZPT)i<AY%1P<c3
zR_#bouXnk4qpQZVQB`?lEM6l7lK(L}m3nXYBIJTX)9byO3MQK3bV-oN5Z$3>LAH>I
z@Pm6}_CwzT5A6HSX8yQ@w(yaI4XbuAl&=SOYS;1lC&=pjv5X%)yYtAX-nWuO{U#R-
z=4b$MjYi3L<597aMfZ6~+?A&ppJVJ?;mNQW@~IIwd&Xf?VW&d4u;S~*T?eco3`@2D
zfM9~uhm6b{=5m~pT&g%DA@coOkqy>vCAMSl`N=as;uo?IGB|OT8+Q4Jcb!R>#BCFo
z2ldZeo0-sC`aUgF-^z-fxOHZ@qK4fH>n4<WI>Rh$=i=BeEfk8FrHe>c*gw5z-_zRT
zZoKxBH(Yph%ui)I`3HIr)3swz*b$_VJ1xp*vw0}bFa62k{uY#*^OV8&h>-5pNPx4S
zy#FU=BKhxxcY^PR%B$Tb$~t=Z^#h|u#KR9?KbH?&$<!i@<)OQiIez<jF4H?f_B*<a
z%*+v(6O5T#Q-YcB1kn?Hd{bFqS?}-Py_nQ#G`3No43~Vr(OSE6j!($YL29^6MeF8`
znpMQ3Kn5FEq?Gw&FEHIPhv9(B;&Q^W$*U0RB8sdm{i8#mHat{QUR4DZKmb_a^>)L<
zBA#qsLAxZ<_mH;s_DQim_w+6FbvJi+g$9<1+tfbN9AX@OTdm8S4c>ckZjtu(_7+OW
zq}b^7J`>FzbRDIMqhmbonA7yq<;$rlDWy_PI5I``h!=rzdJ2CY0<NcYe0%fD9-=E(
z*;ttsyWaF%D#MWFT6Q}`x3MJGsdj}vfBut2@h+-ZJ(AtKn47!s1|?4>AzsoI%S$KZ
zQmq4xl#XEuuCuZE1HuHVCnx1)5URf8_rqhnIG?4?0O@nT1-O!%wtlbl4eFEB;PQ1T
zBSp!bok7)ZuZmVL&b4|C8~4dFc=e~a5H`<-NqB*jrD5HrQ#uk7PDp-}&%LPor2e@5
zU2$AR*`#=Fd&h;)XtnLZ*{+)$mQ;l@uJnuHltQD_YpIUv@y^*Pgh(B($#!{tl}U{`
z-zu?djv};gNjE*1Sq4ucExaWrr>K3W*1>4c9%b7VD<DmDH3ccTUhHaUn!zC75}6s}
z!{i?lhkD1xvv^wwD@c)LxxS>y-+Hp4W+nQ_NF4B$I=y+-AnfGJV?Pv|RK4GnS@vny
z*o3;-FnD+J<(uEQ$MHQeL!Nw3xBZuRg0GpEJuwBh>1fSkiw3$<0f{IWZ)>cgLY~_S
zSE%%AFRYmGdtgNLBhAsLxwj@1i?tJN$bPpa)$b&hP^BSG>}#eQygjhp@2@tc4t||Z
znA;r5XxR)PGW5Q^Zq$+ycPKBkCdRqlPK7K!gYdDT5>pKn1O15~;Ar4@kM}KE6<nQv
zFJCiT^`k8%BD9)eS-rEb&~JmJacYAu1jt<XAVOk`4mXcwaw(%CZYTRN<!)W}Qp)T&
zF~m1g6A;wg!!Ae|ZpN-6#Va-Ni*b967~ipQ`HSzvoRwTKHa@1`6=tz_=!K%AaAG=T
zs-a|4aR+|cx-_oE<<Yq<uQ&y_#5k8n{Y|C0``j$z=VCJ+ZLT!=y6$yHijP5Kor;-`
zHfZ%_F7dKaHHAf#uvs`iWnZGba4z}Ouy7Vjvw4)5r}bVRq8>)t#Cbql!^`A!k#eZI
z;LL3(%Fp%Ms1s?4AgxYHMO70L5PZGEAsVh#GQ?YtHaQLsI^g2sDzx7)+-ed#$nX!*
z0wpMk7sfhu=l&bCH$2bJ1}%-&-L|Jz`exEHB#B3#o`~JlJ{uVh$m$+rpF2zm63vny
z@g4}E<Mi1&_jwoVjyZ&BcFK0|m-atBcOUyg^%3GH(qWWsc@d<OQs|XvW6UHxtp?x7
z=@mG5v8m6YRs!!n_ZDxg8a?Z2bS`<L5OiG`laL)hIC*r@jm^hNDO`W0D5dqyhGgRn
zn+yQ~frLTz_A_0brtNn+Ch40rzw;GjI7EYjcAi$^rHOR9sWC=}3{OP&kackWIg^KW
zyGu}kHzoo8SsG8%5;i7CP15Pdmt2+9mV!gcqJyZ_W6pRb2ne3>{Pe%-rtXq<+w{5|
zqz3*DO^TO1-cXu>8I><fL3@Pwl^7FQX-%QMhjzsH>f?hMc@c0f1LQ6)sft3A8u>FQ
z9%;%(BG6X)F(P{HE=S9&2+-H>)*mf^HiFkTn684CcdFM!|GtfR(FqO`e7*aE?C;yG
z+b(}!9{WdJ1~1Rp?^ENthK3&U@x8em0VL#Efs(lmIG`ijsn9dp{`4u23TXe;);=*g
zY4y+c!7e6#eqGQG=p*8yV*l~^!Jj`trigjJk$86I{+&BE0B)X*FarP6$^SxyIJmmj
zN;mE6Y{d8P%S6BX3DZPQ&|NvakCzSUNg!JBEnsB76Rob*ZD+=Q@(&F3_wT@vEQ%2|
zQ?QPx>*>+3$;sJ(eqf}zCMv6Nr04)XPVg@0e{`+q4;~XNc*Ga$pLpX5H-fy5xBnyw
ztuaVkL%IBHKd;-ILHw}Z)7*Gd?Y*~jNGD~@y19*^x=UMNK2|jC+o*k*g)TZZLeb~U
zH?on@Nfli9o~xvd8s+LFGYKFiJym4l7M%i#TxdW?FL*RIvW*r_MZ}6yP*6ypxam7>
zHz;9g`Q5xKs4GzDC0=bnSQE7UT^}*<n!AH$ubiZjQo?<b6#V&a4nCMyD?3rd6LY>c
z=3q5pZf$IAZhq1ia1*C>QPHsyZ$##IG#x(K#0I5THe7jsxrtuF>+xFuWNqJ6!3nC)
z?PPb@TA+ef@3d_<qa(~Vyfd>4wU8}ItTV&JpwUARelIYe@R`Hd&H)+SWK~ahih{ze
zqs@yVd>ss|A!a_mCy>zi^iVX_KJLj8f0i`u)0dli+S>A+gY<*#5*yt<UgsW8$iwk<
z-00Ngq;5}9wsLZ36Glp0XhZ{sQF9<9tm^X_jZrZ4W~N_kZkY9z#@FMcBU>v{ME#Dx
zLyY5fg>0=vJ+LaXpj(CQwZT;Xk23>9mp-)2vfum6PcQxD4xkctBgPPA&SRUB;3hoQ
z{?YvTPpe^(njUgvdC-)Ek{4{obQ|lv>)gEOQ#T#gP&1pOwgb&@zy{vl6W2(88FY^`
zZhUGYRT}ZrcJ8kC{sc#?970SLi5eT*3Nh!*Q_rn84XnzDo*%e{L1Y;kBx3SCo30vn
z1t#94=kJ}I%qs{y+wafrOjxV;CIQ-BBVXZ?K<B!3R55LEYeB)-+B)&HB1OX6W}$PC
zJd!+Byuo3-g;ZD;BFba6F?kbsu7cVI@4e994L%;i7<pYkzZPuS61}JoGxI{DURM;d
zKSeiFo}7De{71h<ub9um=h#?xRCXxfRWe?1E9g5mj=&DrS6G56<GtH`mGdrCxf@&&
zi`__M7!`g;uGO+X(RZ<XB%oL*VOB^pTTWJ%N4we#&wI6{wS`mtv9R;p@myPQ*S>Oc
z6@0I+z0UJvTCTS7aA&xrM7I@d!^i>M_4h;kYh$>kORn?neXk&KsoRp|lni>HV-rz1
zN!l;$?AE^|mLVpq`X_2;^KY)^z~yD<`csspqHNX^pd4CxX6fc21gP~`n<%nh116fk
z+S@!<$G<ru4Oulg`b0cZ;@5+Bt_N*yW(D4)+pWjC4t;^0-CQ24@+{O9I+zF`qZzFC
zE@KU)p|(w&s@n2WPVn12_wSD7P<;Eld`sN^6nl2WaP8KuX#35{#Xho)sZ~_pq_7md
zXsy0zIP!2KzG5u*Vkjp=s<f)Azg@A)Zn}uU@^RmRPhiuflNFTZ61Vnv^_y0W{4p^~
zC-~8{;b{)5%vkZvgVR59gM)*rLw*e?J^n1^wYbx(&sn?44(FlL9c^vHxdvzR;Zkl+
zPSt*k!SQ1;Kp(U-uG2xlX8#zQR)}6K6t;j%VF&&^y3_A)g{Z&)A1VRs%j4Z!?8z~I
zp0q_VJ;pgEXtST>C%udps+8$|YKJcOp3g3P|Necc0{<tbja(}HuvxW?qRe!y``PC7
zvl$Aup4fv2;)f{yEC`h?75ln~$T%2sd2ZIiH#_OT^E~3w(WbwA!o;5j0V%1XS1uhT
zk#R13g-FJKVgY3Bb1XfY@CN;0W*5M^(?p)kwLvZeC{FMPB3Y*}^O4K?IA5#FdGSeq
zV%-ne*;CW@FSTwfF7({qw`*Vc@Afolm%C4e4PV88Of8-G=9*^SLU!ny$JU8M@A!4;
ziywNb-BE3Oz?g4s#F6=8Ue&?D=S!qGFz7><non6G`>fEJ&Qqh@oEmuvD<P+wXAD4)
z$wheCp$Yd<uiR=$wfaX%Xe8PGur>0QU-4Fb4H7))@h4af6a-UtB)+l>uP{l>$Y=$&
zCU$mq2P;Fy4Kxp`*F#v2wq_WxLR~-$+_RW|=;aXXOGwBVHZm>!j~Ua-j!~nZ`N?jv
zkK2}JMIN@sm2!V&o=u7D#*L&|p(XErEHIxVXNYH{fO%|2X^Q~rpZCTcDK_P_)5YMd
z>?+rZA%6sJWhO&wW|$%#aiT%U)<HKVtT5HB_txk7?&$GJs=f%qLErCud2qf$UE@j@
zy@Emz&~g487R)!zubNcnGlH0Dyx7C`H@dHlF7wSB!fPtO(Ilk}FX>j;@VR%toM_?J
z^CYF-|CuH!6%~gpR5hPpD)i|*nGX*M45!_rmTrI9!=+n4jKMhUwO2H<owtV~hf7}x
z^f7leH25~C4NRO2=gyop2!D6WRUOH1db`=^yr$WFUAn1@qJxq{-D~~$dTEZkZ(T?Y
zXY5L$UWL_U=HR$9g(^c86$J%scVWenLtVSUr46iWu1meb<SuBmVv*k7!C*!Qn@Spo
zr&+M^-M5qbiKVF|OZ}x)Wyq70bueRY(hd~sPn6!I9zHvc9t6m$VU3OZv*yC<^Kw1C
zG8hIyuL0k!Lx#sQq*3bT!G(o|7ODX=Y+@57Sx!|v8mmt$WfWU<b{4z8F_6MHMu_jI
zfB3MuiVB6<@S~Z`Ay4fwyDQ(rr9r^5S%0Mr3#vAJvrFPu#!IHd=)}+Jr;K)idlff}
zbTZlZW{PG}FaeaAn3(t<;w<7FhC&~J+UPL*<g<pU9IL^F+LvBlKt~pRF>nT`B`lD*
z7^w(cOrKt*f-r<wDm9hlF4uAaB@3y|NFGiW8y5B0Y<%Q5k9W0}*zJ=&Y*j^tLen8e
z()TWx_G{uF+}wNT@TCH!5`{Rle`!fvQB0xKDUau5rFDf{*QFJjd)#vzbfdzU^|+Pm
zX#U5Bc`<sSt0O%=UY#N(QhcqUk(3X}$?yB%8|yKbuB7B?<lFdk-P)A?92x}VCZZh@
zbFgJYWT!9Sr`ARtVH;Ur7$H{Z<%)t7qKB~M->F83jSAu+GBB0~Rcp<qan(>=*-CvI
z9o|N52!j^RqBWZ`Pct+)IPPIWU|<IWC9lFez6K}nERVyJA$vb<ApGE_R3KRXP0+H}
zv55}&m_~lOnw!-rn+=!8=<C3fKIZb<QKi<?@qgyAjTt<Z2@Ffn&UGbZTe%P6l7OGT
z{L^wJBR%8trAubDcLm94MILWFI;yfivL4C=TIm@UndZ!TIFIE{J;#PWtE-dsI;b0q
zJ+_I~Bc(MmxO291m4JYN+E^~<m0gy;bC^u0Z49$!Wr6RSW*<V}L@~5b9dg1bzo)C4
zMb{onCmU6^&JFe<drcnGzZ4F4M>G9C6qptKeCn^!J(Q`kJYSY?5lSswG*j>N=N7ad
zTi@W>-4he&bKuue^X$DbL)dt=b<e(a^Z^vf^*qfsvZH0PTh}PeA|(hsfx9(qf%oRC
zL!#EZrsA2y7Ym`$$pvqu)OMfCPhYc^5=x4sQ<cA>aY)O)=)Q#+89Vy)<=X?>#NEa2
zoA~XIl6CdIN1M*))sD#?smx{;KI@#@+T<<-jLCq-Py{$_b91WMUr3GaLoXuS>;vni
zomw)x4vg%%5bFR57|wwly<)KY{d!}P*G6Z4cJ_6F_L~d%MCqbRs#xlZS|(HtJbC%e
z6%}TF|7t_IEq41Xd#2nFNlMcZbB$*8f#F-B;KzoF@n548?G>gf3k~xO@-2%SLz64@
z%a23GW2m)&IP;4aEduw_2C=!vN+(}u>vS!cN$a)O7_g$9x9iUJxD7~pI(^*SV(zjm
zu-cC_8YCx-TlM+vrm-?JS6WR}nqqmxJvaF!%VH=qu{ksG4-?`NN%dI!P(AUSwx<nY
zVPTuQ9^psQ4?MQVW&i}jYoH3VGklm&#O#Q4G%u+;THhG|_E8EE!0mc*svLAP_i1BF
z998l4=sJ%zcK2^;IZ((V2Zwpq(k4x=k#&vBq6!jcAZ_1U5S#S+Nn#l~@)rv}!2FP1
zo_E$`*ZaBZn?XIU$B(O>=L1xAMpRt}o8Mm`E;fE-Ub?uZ<eGRaHK_V<pmGBP^Er^0
z92_U}-qU;r<{iI2<P;iuJ)jEHIxWe{s(E8D8yoK&F_eW~@RjWr8FMtlr&BjS`uWEO
zJV5RURNCp{&$cWZU>+X&hnlh7vB|=YlV9PmhHHDH$*GGT2YGm4I2d1itSBAS)|NF;
zvxg1k9>DN4#R>8Iai-F*lv=Z6Z^dj4DkB|?BPH%9$HZ7AsMQ9+;W?Q`oLN!9_c$x;
zQ6@n0I2Zc6D?!xK4l=Fa05~y_CT%{9?c8BuvQjVCj@|gxty^^b+NYlxVCT7YzSdNZ
zJhST0PCw&tIQ~z(d-?}WoBGY7i;LO|eaTure@<NwNKF|fIlKiAfTZI>>*{Z$G;eIm
zFp7lI!`YKpz;5|Ax1|{qU=zor{IEU3I2%UWj21Ygi=QdA-54vvkM!5UCHKgT0=P4z
z7Z4jsm@_E6xCj5pWqfiWG(243+%vE$JUSW$4Eic!LSV%@XQ6+-h0#s+r8YH>jAUsK
zruR!~y+S4!_sGx2IKy<}rKT#@#vnC`VuQe!5^{z(X|wFmT$${iy{M`?q^9S$osl;j
zt5`dw)A6lwq0hA?DMcx=02yGRc685eZEamvT-kl5J{J6FK9GOsw7%sYZ67_r!tUJK
zu3X%xEA4*L(*h#X5jj=117xvQQJlE_Wckpot3nsBQlGxl__g{>#4}QK=z2sE56`Zo
zS}~?)#ZZkHNlkH%hl?*{uraiQ*<~xM%PP2!JDS1&u<gf8RbAGrw0a5%AV*D>#5its
zFq`EvA02~L$a4cdnEpz@5oy4w#bR{4+#Z^IdP1<dX%1ZKNOP!#9Y+@yx=_+v(u@YQ
zK|s9`IamtFpL9c2;$GWTfPu3*g3B|IzqK@B2`oBYhMy4ed@NRd&7oV~SzEzL$&)ah
zsW9J55hlv)U{LF)1EFX2jMJE!Fn3|Zo$OI&PBNyBVI`5EhO{%jUj-tXmt)aK4Hz_$
zSyzaOarOB4Np`FPTmNA_7Q}nq7e-{Xf_Hy?iFBAF(EyRrh3x(GEWoBda&UPiKh)BH
zc1tnG2%-R!3!{yN*IP*CzLHM{v0C?&8iPi^Y-mS3PwsvTOGtM!9>;ZF`WlRgsk);x
zQ0o9{Y-x`UP<rjNS@AX-Q;31rhYFveF}=|)DcZj#)vwFd?<!6My=qZcY?b3o`xCy_
zxRTORpPjZO@uq1yN=nZ|bPWjKk}<o#KK(it@lGpv>fAHB@eN^wK%-$YkjB?P2SF6o
z#dFabeztnP7dr}HX`AnWWl1U*?~~{0=bCtVjWZzh1(lq^TsX^$uWx|uLp_z0zWh;2
zSP`%grF_h2O7)SL?17Yty7oA}=ViaI&*|x@f@!v4wcTOME68H@Ryr{i9Qg@@_~E@b
zD%IedJ@LX++^oz(*-T%C0UDXgfx7X9k6+dmee|ikbeLc<+DfF471pDa`c!6V9hHwQ
zN}a+mNWA;>5&ce)j6mWNzepYfQSnh4@F{<IIp6<=sGM9!_v7Qtpsm%ihGUaL^47pG
zDgh~^fz%38$YFQ@wWmW7LU+>jpeZ`XL{-o}4J|xfYMmM<k*>eIzcNE3Y)yWje&=Vz
z^W5-*t*N@PJR#e7ZlgEfS_B~X`#AMRAEEy2adkVHf}}i#=E=+2w#v%UlikUiG-BiX
zFB<WGa+H%R@3QMMOK|D?3<Z$yym=(&Ct_mOGfHP-YMQ52>`)yrp6uwBbU4u)N+ay+
zBV}1z=mr)P7UbiZTA8k>HlS`D&lNT4Kf1BOGjtuE-y{Ai<bG^g)yqa;(w(5)3H;SH
zi*)mwVoy2gggs*RYp}l!W)Xc&Z-2gUE^)p%Js9D%ZWpwFNY}TeTea~xbWgD%9-4M)
zfP^pgPTZ37d+13oaSgvb4=pIL7b|x}ZB0wH>&imdcgwAhe7wBOTE`3vPwOpLE8I5E
zPtUJF3~h(et<$iBynBVZ72}B6XVDggS+}_TUp8F(8r^3#Q*;1Whq{7}HVIY*<~|3@
zQfABBTZm&IVqU4)x0<97%b{U6S?*j%Mpsy9pQm1AR;^iDa~AMjHOnQw%2yE`<r4kJ
z##+oey4HQoZ5^#~zs|ENyd*aGe&HkwE2~1Uh~M((FIPI{-VS~cO*+X;5psHl=QCv^
znju+5=bGZ-U0UC^sih}vTQV)UCu3YVsqXp}Tcc!!Y?&FZ0#|Gq{xC)=ji*!nTMJ;v
zZP}kxq?MkjDS-HyzQjG%wKloZAasyyqLj21?Y`ES`zAy8^do)fMg+{~$ZLD{`H|=8
zT~1A|hY#(3Z5y+aB?y8@@ow&CALWEQ_oyQGpI9&L_bZk6#&j8KYPzvU)-6Of7^(FX
zzN@>}9X~?A*wzNo>b+1&;J06j_<2#D5)=-tcEyH$G0th~jv#F$CL$W2!a`v#-lGcU
zrmL0$K$D$^<&uuP=BZM6vbqWvcOn0UGkvNVP~D%s!xEgeb+7AtWkqPAYd1Ru@lby>
zS^mn)$bkJZ8JR7}EvU`QfS{e79YR7+kW?T!cRjI)<a1xyqbmB7%x+D^#+JiH&luBa
zZl*Y`Ww<v{qT>>lX>t)0r8NET=?-|7TDD63yF4QykqS~h*~1|~&5$2|qHm8b@9dPH
zz=Fb^(WB6+x`Wl>+>h$w=4Ur^Qp_E*!jlWM?x>J!#d8_n5@R#NI*u$Iw2@#HFDc=_
z2hpk8$W=LBt*yTM8>97WU38Cyz&DhE!s*O|TuY0;SIunmJS(I3{NAGz8J+a%{OtQ4
zIs{%^nZ6r;69|EsW7?%=3fvv~`ugSQp9KPiSv}_K9fJA>0>_-34V-0n!s1j<Z(Fkh
zq5<|?PJ;QJXfi4buFjodM9Lj<<DTM_zE&|PF7~j)R@KGx>czluf3HjR0vlA?InMI2
zPm*M&y`44WddDwC2H~^2lN3ygUl)zI_%(z1N@NrvOMZdz70DGe1T|Ly@|DJag+x?3
z$_OgAX=!e*Q{|9a@9nC~BeLn+vbC@UYS*9c(1_z}^E4zw?!U3;62<Z>twRAd+}F#?
zfl8LJ^nL3Hki%yoAh;@|@bbAj0b`+@OEthrq4a_IE8qV=z~N7{0AwXlWctrv<q{-l
zmcGZKy=^G}otU6m?G?_e3;E<G_^^DjYSxW-9)m#w0<XMIhGMW0vSM5yc;>^aUg&et
z-q$J@rq)kLAaQTuR^0hSl(gZ9;rG1fs9j*YXKhn+&#CIgNhvkK!ZR<gU)P(WDS7nk
zDet5c5=7L2e|v2s66HioyK8F!d;t`L=8BSZtG5XV%%0)ohY?vtXh8yk?ehO}rvFa}
z`2V@cl7SdgW8)p*Mso8nvaB#<ANRW~oA!!PR7HgbklrT-t<B6UPa#+xwXhFN9qp4G
zJOCUAt#6~;lI^dFLa$uCde&U`^Di(>5S=;2m1?OhdLsZ}gS#RNRU|i9v40Q9Ub&*s
zQWE`-pOy*xQPy*|Z9Ftx_gw$|-=p#}VqIMZ=G<L8Muy6-YyxPF9pib!{XG_;c(6DF
z&GVtZAU<wB6T(F||G86sg&CryBi5Ug{*NwPjS}YPlHicic>#21|DNx;mJU#d(bJpI
z*30*aNqRr`kIX<bBJ>00m%nGeZ6y2OCI|lS_y2#=tN)7|@~^M{_nDi2-JE|7#Q&1a
x``3{8UknKx$eQBuwS$sM;K@k*cLBXjkaXwE+7xQ%Z$6bk;g!nEq8D#J{2P0~MS}nU

literal 0
HcmV?d00001

diff --git a/docs/codex/artifacts/xirp/knowledge-inspector-narrow.png b/docs/codex/artifacts/xirp/knowledge-inspector-narrow.png
new file mode 100644
index 0000000000000000000000000000000000000000..a130703cf36101381f5d122676ed5ff331001b69
GIT binary patch
literal 56846
zcmcG$bx<Dhwk4VbC%8*+hY;K?1b2tv`r+>OLGa+g-QC^YU4pwyaCdv1bKZG%>&-oL
z?@Y}URs7M_-Cy@l*4}IFwL4f|Rtymy5B}Y|cZd?=!iw+Sy?1%{4#FSy18`)PXOH9E
zJCt`4!h*`KsmEzhS{T~c{XwS~zrMhsqhq3CLSeRC)wQ(z{r9m20`+4Hrl7n6hS|aC
zefsL}m)igk6bSPA+56Ag=_-%Q>F7AG!+2B6z9bbD6*GmP>G#|?5XGK}o8o-dskTcX
z@lUiZk(fC|ofShbtT*KM(2v~G62xODkb<^wMF@f@E8l2^P#_zA4WmGI(dRM)hd=)3
zheOG)u+i~}i11LmVwrq<y0_6K_dYH{DqvB2*N?VhTG-p$Q&3RIvoo<C|1N4vE{4BS
zYQ1~I!N8lVae%oPQ&d#UaBH(Rwi$TF;yvRlG_X>sh({Dc@rK-;icey8zn@y1-j^n<
zD9?949_0!&RGd=eI}<R1^}VMVw$l<7)LCoSf1z)=t6^9N-~aKNX5lC4%Ga13x6+gn
z7thVhOKaM>z3mYLiR8tPrOcJ7LyS$aFw3U5-1Be5M74WSD51~n?Crg_IPF)y2hXag
zTuhzx(>r0ti6UAqS{oW{*Prmk#->&qodm9F^Qb2#wcosL*gaWGOP7KuYOD#C^>Mm$
zmK^TCgXltAkcsAt)N`D!jMI?``8*%B6cwu_astCGkFtFR6#_&&`CR(=Sb0A%TwPw`
z_}=?buiGVcb}|IIH&gfa_YnzrRDtOVXbeR&J$qvAlxFrTz&n^2d(wF8ZH6t|CJaW#
z##xuom}?9jCbBr&Gc%i~+f>v-9}un`U)I`9o;)9x2C}1*^stlh4uzg>R8^HznY?P7
zg6)*0N2{jyH5*LX4ZCrmMEVR(7<TX#4HTmrD%LmJ+diF~$h*EyS=|3<hw!*-1fL0Z
z?thKS86Fzqa(z}-p$lz_88|XkIR~Fjp!5<6H`Rj1Tbf3OhWjbVMMXrA|Ev<QojnUE
zR~TpyjbiMoj-{kGyY?+s1q<~&T6(aclc|7qD}MhLeRQ{3Ys=tv&JC$%em$HiOi${I
zN!MU2UiH32xRqL%7hj;{*3j?;cTq;i#YO$<eXB-z+drQzQLV4v*lql?Gi5(st+L3)
zHKnN7-Q!@nBCaNe55+*FTVO0x%gUxuUt#m{p%eCFgruZm^pN2vf@6gPz4?uys{{n0
zJ%o#W`7bKa>;ciyQ``Ft_#CAZv?B!!f(&iz_wCz@WCyrOxVX5~!os3y9rl=SQW6q<
z6y!U*d-?hK#vo8tI_l(H@jEIgsKS2We#|T^`oCw2b!0}%J46Re&CDx7W@cs}3W`Qq
z%!g#suL^=b^sa3eJ?jA_^YXId(#7g!#e)hW1AQv@YgChHQ=Go{5Y!2@euE#arPAP&
zJtEUh4c6s#WXI)obyY<2{G_BdjZu(R7J6WwAu>$+0_iIyF)%R5$;q?WLPA1JQ8E&H
z>w6J(`-U%9gWe_LgIip%YAiVA?d&crao@-8#3~~?)pg^k)zw$mlxdb#$K5Lwl@w7>
zzIq>WlSJiL1q+1Oe@b9tV`86~Zn^t~tyyGb{rDJ8^u&fv)Zwzf>beK<8Sm!@>%GVf
zh@5OgV)({9`cY}?Rga&{VWImKIv?HrrX7#gAZBWiA{Zs%LuiW3hG=N0$sRvmk$>TT
zzsrM6M3&j(u1H!{&De4GN5a{ez4@lmY5#zZAu4BT_P2zz?Co}t;WGq3R8Sxj<OPgE
zd&krAaMjQ$*#I6#tw?8{2>KHu&#m|+1ohkXpAZ*KZgxKBz2|@uc;kLicg&7mtmCz+
zmo>71^m0!qhkV(wLo>4j%eK6x#d7)i+p^S;ry>#(zw4dH;_w@g{>&1LX>iyyo6YMK
z`V|)+X7cm(A|R6_{;Y@!oi9z$Bfq|JeBv-Cwpaf7bbYe6+uIb{)Rb^dt6Dl-111MH
zsnW0ep37H*^zWM<-~Bfy6v>uI-`0nWf2F6VSD;b$hahTFMc~o?T-t%q?s|vXD%@aD
zilc9T56ki8u@H8vAgi@Qi{vvCf_J>e4mhO(ZEYAcG6nH)?u)d+Lb<;#mVyC}*QD5C
zM~uA4CrrU-+{p?GHyqqQ$PWb^-4p-{Qy>;0AY+0+fyA)Z#Bn6BzMA47Sl<mSMO<Iv
z#sKBNhe`hbhx1CGH55ga$mrN3NMN(c2SbA6uq3Gzn`1HK6l&|GpKv-+AQjMZy<j`}
z`eG4>Lx%r2TH<>=@e82{OQ5(sS@(^fBvlKlE8xoP?@bL$X0_b1KngzN>GRwTnVOo`
zoAv`2$z#z?AD}z1)U=l_{yM+MZIuK9%GQq-=)3U*%(uN=CQ7A#CQx8C+kg?fp<?O4
z*x*%y(%OTG5@RB92t;?AWL%jecm1@Zd4DX$@QQT3@d(zvA%N*hnP(&aRlxaY98%m<
zrsU$HAR!?kV`1Up2?AbqP+UrCXlS^&sECG+jtLZ8oyV+8mUC(E5T_DLH#oebNfS;C
zd$F^#vvH9co0^&&pPy6K7mGVQd6q~@mP1aS2#?8%fw?1L0Gr*oQLdmYKUtjFwX?hF
zGX|U#GE7cEvA?%#URc8PcR29y%+KL$<(NQz)!EE&!NCvljg-KIE6D#E_<x7h$jE4T
zXqXXFFcz}fzB(x>NqRA}RM;D}G5b4$U@QgzWFV9H_;!Z>UYPwKqc4d1s^^S^^>b;R
z)KlGCxd||Q^v_Q9(i-L(%8rh%u8=|~y*8T_O1K|GC6UiO06_oy;8?>M12a_)4ddGG
zyl#)BnvrXU12V!gTAt6{B2t?$O|>VDrWe(@x#Y^@=`2L_XKO7J)^%Pzl&y{}ho}2@
z^<ow6HTz%mjzp|O@mOzfZv`JtSD&aSQaXNG3E0mp$Z9ta3{U|tjS+rX!2JGw2EXSs
zr^8%o1*&ddZXPo;bAM!p=i{h4IyyRw(za5;gmfY&8y(&9)YJ$1vz4X+Yp1?30tSn@
zS_wHhF%nkR*iDK$)HbWW5X|3uaS0qtyq?#vpvWT*dj|(4Ma5GA*TlHEB3Z5%VD@9@
z|D1KczMQSL)!DstL=p<P?e5MN=Ut5xXx3Y;9&b%O9@Lod^Yf37(@!2>#0=aEFfvk;
zl4iT#m_t84cBf&~TlqcSoS!Z?*j&7os8u*QI%YDwz7nmqc|;~Z*53eIE=1Zbe8ll=
zEsp;F;bHU5f^c3*tRU0&>{aOb?5f}9YueJUI1U@np6>1pevc5zLWy=+_~m-JvvhcP
zcrTlEAfB{&ym{?i7tyJfxjh_WreOV?B?fLQ?xun((q|*#J3TdZ(NS7jnoc+&YiBtp
zEG4!4RX1{T1YUV>Xu2Sh=t?=T&f1^GQWF>VfV<A3N6r0t$4pjMHYOiwpFzw0;jk`@
z^~`Z`DS8-1n2Gw%L3*}Wwd-xQ**Trh0vf)ms!F#*^ze^q&PsLObjJ}pucyEGMa|)C
zF)khs23S*k$S(*vl8`UIq5?)>WUjt^dDcQQ1U`;7Nv%-c=kE@S^@uZ@tn^7wKfORN
zVB{)O5j>hioi8jbj2Y0*f|7^flsP?}zr4JJM#lSIYK6~U33Am>D>zxM6UowPYlcB0
z6wPuuO9z0hFKfm7PEAM~ynkCZTdcz8xZpI_aYRgAqDEh#wU`WUa4Lx})W3I@sj4qi
z%&V@hX6~6z;J)vWJ<&izL!)M`tOIb68VPM^h@!?+>R-w2#T$yAv3c+Fho3VBl;TeX
zSf|f%R&d#tmt2hZ*ftUnV1j(|dx!R?P}fRg@@Jj~3fOPF*D03&9!viX#QyUz%|J(d
zn4GwtH{1{!F6PUP1;$kkkjMoD1Yx&<fk`nixbXTA9~E`6Y54BSf}D~v&%_8;2UrAN
zkDn4N5O1TSqeH%JBxLUFU~GOv9U2{#l$6CPNA-3WLE6UFMDs=fGT<iH#gn*sd?=^~
zAhbW;9Mzkhd?q2;yjh~+;VF?hiXWA`czp@V+?Y&X<$0?FX}CXDZ5Omd22j(`=I5C>
zTCV4-jvY#)ii?YLgZH*dabprQwzdc42ISJ?;$i|cR0=a6<jx3-i)m4H$rxI+@db?i
zZAW-qh*<3^8>&kkZ<fOM#y*vneTE7kI;Ehc-P<{E_|3!wJb6=-n>LS2p-vg|VPA$$
zRL^~1d@qsEgA#7!QG)<9q-+YWs)7O&8=KX-4_Ug)DG$4Yp4Z39bR+`){GuW*n_E^O
zYXAIM!Q*@~KcmdS&TP~O`Q*gsRqQfheOzHVq1*allUf=*2<dd<83RZ#TJ8ue4<`$w
zv>{+QK4%iN+{%37kW_0R6+#h^dQeJ&i6o4~VMjshIro-Yt&<9JITL{8=tMlQdzp(d
zVK}EQS1T}HW-qhtv0QD3xyy~mVi;Tfy=`(hTV@6_dq2OuQ{?bU#E*xImz<IW?|$AI
zn#SAJ^9jpG+wYA$_5lx<fbi96Fw<-5`8c)lrP<LMnIRB-cboPkm(D*jG*qTE(w}$J
zz}ll$q3!*6oafu>=`cX)>t$eI0KCYjdy3xCnMRNK2wGa&tw?Sb78V+sq%l_br8+aH
zd7;Mlyp3dHa>^wdc{;00Fi1`8E|!nz-TOyR_1O{i;GDo?DJAsnHNKV}mazh6Qe<?k
zjsrLr$r4}6Kofoa2s|62j*?TtV2L5DIBAcYKgF3}1w7yIX-w>JAwNz{vs^nmL9w|v
zV-lpWV_BnrLVG;8O0Y8wjKpQ@-5=BZ2}_F}gJ!2zi3sp8V3#RydT+wNW-vK@`#3;(
zN62fmesg;Petq7pB!PgwKJr+;(&;Ri=uY!~!OJQr7?DH>l?gYWExBO!XurJldOUvE
zc>f}bNc6n9UC?qzly$inny|Lko+FBY%UXHn7bLeJ0{}PjCw?HU=CXJshkyXj8x|xH
zkx)^ol@;GatUhIQxI!uPyi-<Dfjay4eN);@rSM(wCXuB*kVh(ce(NC(3xA8*Ey$Ot
z8=h0`W&?)9KOn%w*l0AJX(+2|bu)(w1!s78xY=!_M(l2!Q(8izXn9?&jO3MlIBB?d
zfQlHWE5D2mfwxC29H%s^JfdZMVS$mCw7N3B-OGlj*2Raw2Zn)g#FF9ziY)!7sxoVl
z6H!F``!+CDtAwSNZ*p?+;M)0$v-M_SPEKA?(eLKCn8-+mo(81Uv`<d8b->@J6t*El
z*UiJh!o<{L%LR$bJ`FC8pwI9yj)L;G;`~k!V2`^}?UB9s{kFal)t(BUU=r7(>Xeq&
zR^C$f{K2mWg#7Lw?pwjJ|Iz|TP|CxC!++1nn~co!S`%{HBY3B~5I&zX`h<l^<0r&d
zG9Aqo1q{4vrJs>bW?UMb5mr|(k_44ZRvJLg2MYw-?=f}l`b-+_?}$rDV9rtU@x2^B
z&}Hz0`_Ty-vfI<k2aV4;Z6g7e0O#Hx^C@6{&F0+Yf>}-y09q^aXR7LwGL^20v$R1Z
zvYc#M<;u4?O{lTLLQ{<FY(vx{5S>$PM;=9FSlA;TE>sl?0_PWYSvk{GApT0p$(0yc
zQ?3934S}@rzQ+-{w9=4jyfgXhO9DgJy%0(=4H74d$%JkoB<z`*jEc<0OHxV-5T2gA
zVPQ8beo?(LzBf?$a3cnGbo@Ln;8~bZ(aOwR%}7MWiQKy`%B6%W%%L{|>Gj&({6b7h
ziiX}$IR$04vDc}a$PG$uO<gHs!Nz&bW1t~Pih3B+`5NXoALr}q?@wMEh<HKn+0jz0
zT4lYE$-jag1u;203->Yd>x}v@&58Llg3~XSDuPM`HR6^O*0hN23Yl5u&_xDxP;)`~
zfyr4u{OMQHB*cmknnI1x%YlKSl{vnknf$uxQ*h8igC0#M*>W?O!}0wpvxtzAkm2H1
z)5F|H4%SJJ-QAwRDSCQW{k<PQCJvY0)N2HH^s7OF`1b|z@o^g^?Vbm0_Pu)IT+g2e
z5rv-PVmr=8IN5CAPrhEqZcYTJay#&|TnQKpv?8mhfW#53&l=9wSf0;jI+cCA{R=FN
zj2vynVa<sVVI{sr%Lm6#=z6xme5R)d(j>^VEwLyYvP#kwF5aTyx%h(dR4FN`o{`FP
z+tDZ53#Z|!?ya?#pr7}|C?5N35YEhniWFBKz!pYZX}hEMSEw@R+u4b|du`1G(xOq|
z%&Pze6jv;ymv>z1>hp$Fn}L-K`c`nhEtRN_bcdbsT*vOb8T%CJo@fx3N3(sO*tN)S
zL&d#pUb2wtEM_sR$u1djU$NcN`S#OFeoa=&W%x;lg#+m!Xm>|hMS1da@k;I6x)tf`
zm*MqKG1@(kOjUOH4ac1_z8-agFU=8Sujnr#jG&2EA%2@@<=8kV7BN}+<dbFZouTOj
z_hxS2cP0&A(ryVkFRvdYaVVY4=f!1q=|Al2t)pB`OT|}2{bhbPpFUkOg!?wpj_!Td
zZdX;1V4|mQQwn0Iq-;gPH|(j18c{6;-Jgm|?e9_Rsd9318vUM9`32|k6j;hRJScwm
zRInc$W0Dog)zn0=R5xBg1Ld<jTcE}vy}Vt>!pw}~gtyQUX$#Q{ei85lqHnhV*qu?}
zBQ(3g!UkFSfX&L~4k8Uhg-K*N_nS=f7hpiVIFAiG_vzFs3`@odmWxYDHcR>4pB;Zk
zt6aj{15$`j%pi(4#jX<~1h3`A%<SYO_2;i-$1|`$-YeQNW9p;&%U-GMokzvRf#BaG
zU-|d?!+-07jo0FTP=+ukrKgAbNb%-cX~D&H(PgP`J5yC<hf@|EP1-~8%jQ1rJP;l~
zWw6KSK9Kxc*_AF;C$-;qK-LzqO#i%OgS)>pJQ137o*d-?9PWz-k$cY=;5X17UnoLJ
z@vu`OyrF7D1)uFq5B=%pEI5mFu7^?50PiQSG_h{y#~6k^CNyutYYU10<uq#-Ss^KN
z14Uh(Yc*tPR9AW<ftVdxD2{e+SW<G70p)^?mW3rpcq+`;*!ZChtX5)-7<C2>?WLfk
zHZA{l+hZLSgo2JfLP^fS%u2nwl4;|)uCA#P9TlZ7iL@5!gpRJFqWro+q#wHtAtfV|
z(xRuX<;go7nZbK^10JyrJa6}cNNG5A-`yR<hyil)+S=>TgjGYs?L=J&D)fR{YI<*1
zV?{+Jq?UB*<JBXMGtWm1YFC;|6nlFIg@^OsN*yk*(os!^UN6^4AEkrs7j8IPID0FI
z?`^Xf_Q!Q~>Mz%UJcj;z>sH+zeqaWo^HVw4Qflxh8f2l<>e(0TFkD4{b$&5T8&?Jy
z*(G4C>zYnQNikbXGt~^+{ar)3d;KLSGHHE~Aw4O}?+Na$R&j^qkEz8b1Me1{k`W+N
z5%IaPTRXy4#8%ob`ewh?s*raRm9J}hFKkQ~geAnq$;e7b$i7B;QBYEzt~g{i<p`~E
z*CpA@x~U``A0NXY6CvYYz8Sp~nbGjLoCOuF7wUse3XCl&(h;7GsMXnLOPr1;RYgUY
zR=1(c=O;2cGL!D`b*;+afdHo`um`Y2@I6juVdkHyC3V+}7|*9>=a=~AWOIOI$+z1M
zjrA@hT0KAamB1ip2#boEsZM^H>4?nFhwgbQa=%}^O6ch!qdhde`?IEg*3uQ3#m!oO
z*XqH*$vIQ6llCQT3C?-nZC@v*KfHH&LS22)`jimJG!Afa=Txy?-VRj0OLa7yt(Lp@
z_VyPS7qeO$4dg$exxu>D>Nq<9Ia*v`V6!cIX*ZJKPJ!*>$x;f37iUsFWj|Dc;(4PT
z4--?7#r|!hS{vB2V*Oe;Pl|58Sfw;^i|o?B2B6K|E2F|s9<OEh{{Am8TFZ@`J(3}j
za-ECingyy|a-YUm_pDk(5%34OEzTp??jLUse?x&%Pa4i#AASTPA25hR>7I`QnP`E_
zM0q#aVyzPuKY^g6=qB>rs)x6d64|ZG+d@udOiFTcv*Df3W4#kp(%J~y?yRBv#gtTo
zfe4t7PjGBRjelG=q9^dWW!EiXO!AItV|q+8eYM5$6Q6;&p8R>5N9%JP9GnE6xp|wr
zV~g9<7i+)TYlJxi0rz88{xh?f0hg1h&6NPD?t{$B6FL$Sh4Y0jij?GGO&NMJvhA(i
z622A}oo3fBuR*Cy&$%!y&P0VECGgsDQJuwNDwl`Cq=~ZQC|e|cy_3a6GQR>RgRZi&
zbY}qr;^91|_kH6Z2nfH|gJr|bR$P_dwQPI)>NXE2&3f0hA6{*%eAd<Pk)ndmxz0x{
zY}Pl0U}~N0Zg1Us+UfRC;M0?S$YrdzUlDN__hvuT_}5@pYqfY?^#uJuI?<@v`#M`3
zCl-k_syR)2V&aJsMU_gy!Etx`5;T_lEN~=mEo=SVwf6-klDpm|iP;X}$?(xPqp`F!
z3@AM)Uq1bAL;H-kIkSSA6OavOKNHH!a(QXbC<plz9vT`M5rHZ$-HzN)UAG%kz_7U}
z^31{JB<kLO+7<)|g=xtgpjX)8yy1<ak3*(&Gdhh^Q{5{oqZn$u2JyQ0T)VbS%FG;P
zT8r=`LcA@IYLV&b<>lq|09ncpg#N<GJ8jDbR6g{~^s&(JpjiaPG?(|oD-yw&<ScY_
zWMt@Sggqk`MHBp|YxnJO@$u#If>+b~#LsVR%!-^V@5CTf!+?c+ZeY2fmJ?WSaJf{u
zp}txxVaTF{E=+25G>1A}9o>Xmu9j$1RRwp>LkfS#186VGb&??A?@WZ(qpBfX{=O#A
zOra|)sbQlCG&Dt?bfa!s9f;HKR3kSgbMtZmnYp)M9>s4Eef$F*T$l3nSy1PP1D^|1
zfFcR?^!653%6(EW7pL#JYg%i2lb_DVYvF>V)?Gr0GU@N_1>z&5iE&T<NtD9xE|M(D
zZx-Kno@`50%AVyi(%)x%m@i*%efve1vKh9?(Cst*L8L!!=ovLuDiRK<EZ6Au=)2hd
zGGt74_6Pjz9th1}+?u)-q*_$<pTj?DDTc^+2Sl>a@!)q!VYEYnrE<c{j6gfR$0fwH
z!^4$5+L0OkELiE{QdD9qZ&h{|(TdT&yV>UR#YrSar0UAd6Y~=G_962YX9r4@Ki9E8
zl>Zr68BL`5aJKdU@C^|$F)1N!h&!Wx@0tX7bc|10Ws;!!(gL+8Hs{_?-?~_o>OyW3
zGBdsBZB!Ig%}*B~p*uF{rCB!nMa91vDW+$9-GMV%Z$5FW5V<mbSn84RL8fq3U!c-y
z(}-i)|FZe`fP?a`3sWb8l8AI7tSI<5TcoCZ`E{71_Zu=?u*4)mz0V*rb~))Qv7E`c
zuD{)CjwV%L$Nfa2g3uk2BcJ!?aD@^7XP#K8I3I@;8$?Rtt{vnN8X6i=F>eq44Z*DM
z_tAy`<>BJu`lIxVPII)~2$Wk>&9cb6f+)yW?)2QH$8Ud4{v{UBi;4@Wdw5VHnqbMO
zG6Xi!4L-3Is|mdmX+%@_%IOypa_O6*Dkw;ZhKq$oa!J^!*{$wxv)VM@pBE<+UQAt~
z-k?58@<*lgCr=Q)nApJ3RS?zR-HOY*yxibqb~H7-A5J9u0RhJ8#%BD3b&6*CT?B!E
zUpI1r<rRT%=2hzPr_E$vs?^PjtI(D<(HmMQ_5`%?W3>gUFANMeAQiYxobTLQ*pygq
z#wd$$kw1T2H`bcN$#l&mDuvqUL=GY+K<&k~rLE?TSRYFXn@&3H%buuKtnM7$AyFbL
zjnjA&qL&vhG&Xj(dy^onQ23La&-jiYI;>_#tLxLFLd=yFUR^JS9)DVM3N!iGa{glw
zjEj#Cetd?);v^kov|g0tEm~j`-Kfy-hC+6WrPEZ;CSnie?8(p_q~q;l{~|9v$8Hs^
z%eTFS_C>piw$%vFX2`!-g-`(8pKSS)|8>8RE~x`s!;*z%J0*GJ7QIo56gf+gg2nqS
z@+Z$$7?jsTw<?x1Ea`-_vLow<6BJa)T#|t9X(mS2R87{NaPamV!JgO-4<uHoWImAq
z*dXD^5T0ujfnm+NBUmVhXdDvrHrP*toh`lN-2Ls<uwBIdlH_u<vubK)#&h=uud4p|
zxD?3dZ+XN>1+>J~9i<U^kh959;u+cl{p`(l9rsrHSliXUm(u`cS*wXBq}%Y2tqH?+
zl&-<J5)R@I@Iq}Op~eAqy&?~C>*-=za=fnB0Fi`?fHM9*JEJUe`tg0{6EY!#PBUJl
z;K<p>`rd(ovlR!F6eEzaN@-!=5|Zg;fm#EgWNgL@y;D?0s_M532;W@1!tU=66nQq#
z-;c1``21PDJ^w>K3pu%eOP$Tk##Ua51NLXDEj?s`>?XtMkJuHBO}a4&F+pNvdnli2
zRTNddT0Ljo?_+$=wlV*X9fI)i>NZyT=r39Xvh_<>`3yi8v0AByP>{RsaJci~<WztQ
z&dSoCw^^xgu=%5BLv@L=AZcMiH+uP5ryef?;oA(UoNMpA_)p5MmC;D*V|0`I&1m$3
z@v6|-s_>ZTXhyf*^Ig582tLK=Xt2A>0Lf2Y7Gui(D!Z!6l(6vd&6*kooG2n|Ezi`W
zsu<gIJJ|kyXeh(B@DqG~?*pfUYMvvBINf1&XFJok{xP1t(Nx82%W7AQ4J8b-A}n$m
zE?i@-a(1nNt-FADSVY+QPSziH?}fP6U4-01C;F%c2Zw(?@PAqQis<2Z7HgBoagp0a
zDhE^SQur?|VB&`w>Fe+Cao|xuru+B?b)IAMDkv+CCe-k)ll<gjsRT_z`0rtNs3~H=
zr=M?AO?<=B1na71QNwy~NnbqlA!GMze={KE4~Tx@XOdbR`l2(g3>{D9`{o;jQ1Cns
z-VE#-qxoqNYv;9}M1%EHpN5w9)pjvyUD^!XSR2?S_o1Vq^5)&}P5XvSEOxNI*BNk@
zLB79a)aA{l{reZnl>e+C6`;!Sg;u9xT`xHv(2x^j1vK~85jBDI4iJhL7&uG6H-81P
z$nE}<U%!5JK|H}VJYRF!PPF%oB#atL`Wg<%jiqym$dr8^FGCSl&wnl&jSV(Df1AO*
zqKv>dGd2BN&Z^I9L_pT<Z~^o<WF$C1bx2N2!z4hz1GLTNW^Vn>%>mg|8F6vbl|i5;
zwpEbXh!A;wecjtjjw5E{`C>j>TclIRoML&iMd3pC@rnk0KvYDmMxcZYs095Q_7u|8
z1PFqPh=_<TP?Zqlq2Z#SqkD4Lz!n>zEVMbCgtfX%<OK>~2Hyy$ITnaI#3dvpH#5i?
zIwV|${e4?`pXeH=v@`vPhuOS~=pF9XgeG{9nOXYAq>oH3^78YliZ%@lyqr!@eeW%3
zylG=bf;JhZd$7JUHl)${CraA(oh;?isj)Ek?!rVTBydd5dz`#Lr@6XedpME%5`Q1w
zy#p<z+N9JU8@WpDd^Wn8e`>qQV0YkO7FAHN8|q#}5D=@)M3YY8E&tvgsT67)q%GIz
zvBJv4{_L0VN(L)SWAXs<5=hjLl#!q}K>O@V%_HxXWbaoSiy?s^_zeF)Gk^S#RjL1Q
z_9fNx2Sy5}!z)cWjHzftzh@%Gj?j(B$SMmA{-;%0nTQ8{mQz?b*R8ilbN#dSJNuE5
z5zH^KoSV8j6up6rkR%~M3CW@#w-hI@&b}7uDd-5_Tdv%uUo%SIYhG^L*bBR1;!7Cp
z<+sh>b%>~f72XTS*l-^`5AL2lyWA_Dg1#IR#A9G<ECf=qJB^JEVF9;BUYP^Cc_)y-
zDgcRx+0K>;-jZ=Q8y1@ebDmg+1UAko9I_|w{i*e=d)nnJ%!5F!6;rWwO%_nElX!)U
zJQ#WMFmb+~P<!}2U^sym<V}^N<CLa6DdT!|-y5GaJ15K7+~}?Btm<wwnDR1`@^Ou?
zwjZi~h^j+#-x;yp-gKpy2~*DM2p{vX!6Iw5n5h|fjp6y_A$q=V0(?T73xVSmrvwY^
z4de0Zvl;7aaTU1Syp6>w?&iLklq_UW^tu9^tzMFO5Ok^EJCJ)ty||m(w-2k_kHr_>
zuk-Sqy_87d7ifS?K(OwOp0>v+1yp<!3|yBsJW==|xq3BJ9QFLI&FP!_FWvV-AJVhK
z8e}a`Bfe?P?C0Qfmk}0tdn(QE_*Ym`>H2|@N*x2a4xC*{#UgMnOwOqa5sXMFm=qf+
zztEm<wWG?eCWL>#C+DX<U&~YJKHK8&@HEw0r%4#7a8HR#I(%EwUe46`W@)Ru;L(at
z^g=<|-H{z7qiX!vl7L-mUPsWfB_rJ%G|ltqgzscDxYELKb{vXyhkeRO^J?Mj4BdgU
zd3S92R%CqwZQ0^w5MP<uS=Qoi^zBJ-c^7l`wF9K1Bi$?J$Z!9f<%pZWIyJfHJo^3K
zr}c%|TKk%dlJzClV<%6ghOpY);(F~A=Tr;znwvsUMJ{LulA!jqX0F-!$vAEA=97!$
zP9T(A!k{rGq6OsrT4zfX34d@^SB9re_H*A`yRpc}T7jx2lf1+6ZPmv^ym|f>3*t4P
zkjh<G){qxI;?H(Q_ebN=Lt7s<8wKD6mdQG9zlph?tx}EYtGmQ9EaHwF8Ov6L)yoW~
zWqHxR-fI^sTFa__ldddnwVy|Y+4KYIGRie4hi6Vnn*rhsYGw0D+Kq|>mC1QB78EL0
zQYrCRvuSK}s#8-nQ!GUU__*>53y0iDYO3>n<u_x8US1wSW&S6&&hwe4hO*{|iP$T-
zQ6m^oAerSoGEyPWX~ivK{U)xYa4pIqy5f0zoXmVP46OTaijsI+q%<^SbOq$CWwl|g
zv9V!cVXa}MzJrJ#Pi2i*dL$9`CcDVH5>K@Ap)dVDcM%b$s90m6zXCdajn6a=6h$~N
ze1TxE_bMSs9x%bRHY~Vth^Yf#!_K4sZmp5V(LbOyyrq2VN)36GQPws$dtc0i>)PJY
z>o?vh5<aUZo4~4=xVXTeCc}h)MzxaJvr{k2VsHx0tB!R<S_j2NFL)4(oFXqTw?iF8
zajM!aU|nIjczr6Ars&WJL|FrB=-IAnDh~AOx}8LtYZerg6~yFMcD(mMOnWQfoStM7
z3s;Xb1_Jz6U;x`RQz3K(<9S+v)H)*L)<!~rx7%<1^N1fD9N9f<<r&X1L@ZNiTR9Mh
z?a;6;*?AUSD8eK_vK<v4g?WnypKYQcCL&Y;notQ~D>QpUe%0gA;^*9Zjbl6K)N{|J
z6z%sy6#t3D%2+WGOI`L<{)G3uH{}zxDn|6AZ-{6W)7!|{HIjR8>qL*94~t>f)1928
zYIfWACTRbxRtGOC8t;6jld7gz20IPMa3g()pnEUgi0=BcI}J7gj+DsTxZkpdRtA+w
zzoYBowy)1(ARn$Hl<GDq4Z^;fWfKKAad~ggD`lljv0|iY)enV;W>ommtk$ti>#;l(
z9(;E^H%`PpH&>Ay|Eb68je>jw?pr0a@r}Hy^6%i6M^uIAE$i>S#*8NEYb!`~yKyD;
zjSgl|7BB}m$}$om{vv+N$~dUjiCo-|DoSV_)oH{(Avi)vetx@W>39mA3<jqZc_eU(
zOG*w6(l`^ieZSYHe;EeqNQrX_%5#d!zYlL;Ru2)I*E_10b~6wWV2G`!z_mxOnDk-v
z_$sW$B>5DhwS<OpS_?comp;F3ce#;QLj|+j6>qQroG!&RVFU>gABMK;qoy3B%t?eH
zGL;OcSg_PN{|vv^(`cgUX!C4PD964-92pe{@ZEaRfx<%EnXvwC>NP6Cz6O=6zIZl}
z#>|ZJ73cMw4Pi=Y8>%YKvopR+IM|jE6ZtmuNi;&|HiQP>D4&XqKdl1oj*GNQplVZ&
z1N{dLi*Upxt~;(-aG}x9Y8XHTO`(<s%sMF8-o6QU6{TQ154DunltgAfak%@eUX1#`
zSDj~Y-JkvHMG^4#qJIddz2TlU;}%zF`T#g<g1^yTg~MZ-eTgUL^!d+yJO8HE4A^-n
zH6<l!si^*XT*wE<hoa)+4ThmXBA}h!9cE@0z?UHDI~pdfuCAVM3CyghiVOuCTln9T
z#bspF)RYYWaWbHi=aJ`aZK31%5_^R=HbOQ^4G&8Ko)m=L;pyMMjW5Zwa}4!ojFiFx
zi9_H{@m6>g6smv{(9)8IbW)b(7}LQYQwpjAa&k)J-rlH56yd60@zK#S2}&v|J|><2
zu<@{uwpJS+ph8|8P2T;NHl=^_y8k<eX(Zx+%0G|?3O*-9E924ubxA?MKuTfC`fEV=
zzhz?mpXM?DeJ89E;m^>>ySH-^9-fp3ZO@m-o7JZ~U|s<AcXKQ62A>`LcpXggvm=mM
ze}vcT(y_C%i#iOC%V5jjuG=P!-{E#Li|p*>MIk;e&dL0@XV<ga;i0)}ll|=B3k(t*
z2Qc239#`BH6nV03(54Ot-CP6&1h-`u=#<)5jqO%Pd$e(MJoUC;IHAeNa_|Y&6dIkD
z9lCr)q7)RUfoe~Komrc07cbz(%_p~Y=?HuUY&J|B944?^XPMH4VJXWh^|pOuGT%X3
z+L81+&C)6=bv7Am!2G)a@-X23IojWMejq*du9vwnpS7K?21yLPr5Imaz)j~*taR8!
z+EV<`$>hKQ*31`OyO@N8v!y&19dmQ@4e!Cl!rz7fi!6{$$}K8_({FY?sP^~oJyfCl
zyBI^J)Nt<w=XrS%5D`!C*g2gZNAY!aVPOuZr>7Ijz6W<dI$7W?FXu2i4*nu+bMF8@
zo%WAumTA@*ao9}t>UZB)k$MCM*LqB}qxJ;Bt9=vPn@I8d_O+9$Fs!;7?I{}STi}~!
zgE^b!9~6wG28$N`ZDTI3Cf~FcLO$o~1v^-*$0qx}GK0R55><L+BzT>=JzX3nf~AHO
zE<?N>IQj;w_4juES8N9NjDf_j{F1sLphAn#lB2y`UplPSWFM!J<Z`yQzq8X>qelTf
zI4GXM<3PK<=jI8?u!yhOnLnn9x5!qiki)IS>gYtr%o}r992b|DW5@ylemR)V|7i)x
z5Kk9|oe^m*SxRWp(Xd;cG=5+sQ#~9!Jok-_tYVcC$K%P@jjSGg4l6+qboA|qk5~Zj
zVT8O$P<Z^kPUq=Tq+XNn9DWQq&dQrxYKq@az`kjI_tca)U98z}xjP2EovyVoEO<Ue
zq{WrY>AgWC6MQM0msfM)^F-lhGaF{b!Iu7QdT^}V(QajLe;J)OlG0$h*xkftnN(X_
z+r5;MlF|iku{~uS)@_F@dviHSnx+awAoNeDXlui5AM$%kV9?y!JavAYxoB+U1O|y&
zaxot8v$Q&oK|qB{#xYM#XVKXH)Nym0Ez(X2Z#DAH*llvSBfJivcR5<h3l=i0w=^@;
zw*vLWm$hSmKb$S$aU9gMtaBY=&Nn5NuCbZ0mXnja=bT6vK!$_!32|%l0_&|4Mx6kK
z@9;NNL(xVU4P!$kzfCFRS2-yeziDg?jIcz<pxYA#rNt#YW4wq6VABOFs^Wg9D9xKJ
zZHmc6lSNksL`z7JD``_x)6b2FPfVrj0$?N}F8JBP?+Rj*3yVWVm5m6Uns=wG0^XaX
zN=6$ATs%CR$WJ2IE?c=YfK4hQBt-PSNzV`tZs@K3IkF@07y2>tU|#G@gE63X1Jnr=
zTRqU*ES2aa8iwWlrA%`(@2SqBu?JPU>$BYV@0`A+h04&hw0HOIXvR6A3j$h|Y!<3p
zZ>06Q4PHVmNNIY5jL*0wdl6%RFe|S&O9G(!d#@jS|Iz|DITLA^ajMJ9twlxqV+tnD
znYp?5!YhaX?>ugv*+^$d6L=XNYLlV9)%)!2;A+2MBAvrho~UN&XCkSv{ZV~Ed-__=
zfZRrR=Yi?(?550^E9@_wb^0TK^Z|o>Jko$oCpAJ7Ls_oX7D)4fot>Qrn0F=z_G4_*
z)Pj8iglfT;$3&TdmQ|1I?y#wYn1N72S!c6V`!^q<?S45&Q_DzknPBg+NaA7sydvg?
zhdbLi+Bhh{q0`eTpG0SEEuWOm*GxxC`$e;UtIIFwxW(3p@#6C{CJqkIz2V5uA3s-q
zclx~8xViK1;$v*t0dRN_EkdVO#^n}*J=qrl*eo<_9+wk9dMTZsqv<2&SwNS$6}n_L
zYt7)<7mW=5w(g#8n~Q)r;#WfQ=os{*XkymSQ^VD0J&2Q03yt4dl%}H}k;+|Bq~Q=h
zN=b{CDi3Mhk1!`zNdin?K|wzRE|u~+c#>HNWf$^a?Gf_)Ui3v36+r@fE<VKNSw8Rm
zI^I5L9#D}7ZbE@~0k^Pb*18e;f6*`Te<ajM9aPY(EBXhC2@89Uso~;dW8-1<13HL%
zY&AWL*OcRPMPcEOx3aR&9yiDN=QT8qZLQ$k+}wqLa;R4D)2o!cZHCV3-^AhXrl6qc
zD~jn?E6hwvOmy8_$wQ}_Ksa7cc%aeJ-~z0_v3$dlTB1NOXflk^_CU(?Jb9F%jJ)u8
zlGPA(U-^Ry_`wP$v|yhv`zAXxl?I#xp&!K}Gm3S}iUDts>G8?-(N%wg%^4wwwcD_`
z6o=ImCm-4N!iCb=+7muLE+EfiA8(zs+*zyfZEbB^%+?+(HTn7b3%3&hc2(Q2xFI9L
zA|fTlmvbZ%QZgRrf9#%|zX(C!PK=EOTz}V4)nIfnZfmY{IpcbV%EZBP<9;$`9q>Vi
z`8keudTLsM)8Y2RYX*;nhE%~`y31MBn1SK8R%F`YLe@!G5xSv)0blw0a0A(2BQ-TB
zPC`QB=Emdb=x%(wzYHk$9^=iK904GM$O3thJUCdGdYp<CA%ls5fyZ7sJ1GwYi>e}p
zmzO8xCQtc7GbN!$xkUCfo;o!J1s|Y1s+3aZ-}PY`2Ath4V_|Z}(f;7v3z(Y`^Uj!7
zFI!7gvV60%4W8=1)ZZLd#!0T*JXJ(RX=q?VhAW67?(_h@q>X74S3XhEz;3*#<m6-^
zXq4yox6jPY!Ncv2F=btZCg|{c+DQa)#YRQhhyjBod?4nHiXwR3Pzep34+jV5n*awF
zoSckDJyWE86<(16N#^5g>ygNdh88`EH;ARvPvxnZF+VsdFQbB~PXH)b>r(1(?P2NG
zeMaqS0rq-&@}{PVRaL0NK%KzjX`JZ2Haqm^cXQ!+0T1CR>27Xrzj6yEbSiHcy#Z_=
z7`TG`_<p-)pW&ZA<3|_oyu3WX!ROt3(_4jZVq}#2baRqdn(OZlT<IzlR!DIQ7}n|?
zCSC`wGP+WW)EZRH&GC9_KnQ@D3MdzSrlBDLbhhcMUBFI^9lWz6oKFsm7+PCh+G`6<
zO4Fw?&CkcDtuurD%!m$E5kdm{?ei-U&=2F37@fKD98vTg0Gn`vs2g&i%^)R9R|@Ta
zZ)Zv+-OD(;yFb3bAnUZcCXLHEt2q+#dD(B0zBDHj53}akjFhfd9&~mI&CRJUE-rR;
zkyxmfna-7(p*Gyy+<@;+!2?Jqz-Ak!%`0W5l1=Bf+uDhf+DAl0ytq7Vd&(IIyRq#k
zuBaG5fxHltA10iRA`>$iPaT&;Fx{GT?Y}nbBI%;u-`y?K?5K*9(hSNUGZ{-C$q#-n
zm%(?mTA-Wejz}q;ni?HV`)7FK?BrJ#nI%3e9;;DeMFo*LV7O#<ALYDV1&mhV1OljF
zpq1-cM^Xs{m~B4rgNwCG;%z}4-jD2s6C+IRprd*iWWv*x_LI>AbfB$e+IUnLWMs6n
zV294_XzDV5Wt_tPWfIl7WMN?;DrcbH>d5{nU#z9xN<Jb|?$2t8iMaTm0~V8<9K$)A
z1x~wXPGAxKV_BIMkIq*_0X3=zRX+^dgUdLx>HNgxWWcY$@SX8&u56jn1jwp@ECB97
zURBk4c51Om#G(EoM=WwoT87)@urN1wCeMND`r&ex4i`6RwnXi#uJJ??kL%>uj~|g@
zEKwm9aPn{ym>4G$Vq!i5ShO@uyRHfN0)UJ~kaHmc@9>b8cG$<qCqn=xIVl-F8SvwK
zJ>&f74vKsaI6j;#FRa`oUXvG5sg>*Nt=CpA`olGs8?5vJlQAMNSO9i1)&a(Euzs8m
zx^h#s6IfFd@<&g151s0cIyX&GQE;$?s3`0Pj_cDsEM8DxKowMLKvGfKa>L%T2oUNY
z2U-RqGme)VIR2XQ3u1FRVyI*ns-2$7meUjaMNP4ome?%jlakM+al{6UHR~<qHp?nv
z+w^<#o1KmTdo{7q)zZ-o!D~pAjVE|@Wo6L|kG1e@cNeMyZg;S-P`^jaAP}EmJekj=
z_gue3^~-vrn}fVO<3E1vx+XNE!`5yfLK{G8F0RF;r6qYtcEZ%SxPYR(mOEEp#XS4n
zo1-~%^UHXv=0h*5-D0+)q9WMEg}IU-*YhQ|5}eo1_m{hL+uPeU)ips#xUA+oKYPTq
z7<BD;yslw=+ka9Bc;5dR-1Li%27&Exe5pUi>N#IjR|mc)rGcG;XCNDj9xKo*J_k^p
zjcwNVB~u3|EVbhRPseZ$Q?8#`P(W9$lPuTe9)(7hpHBR9%GZlt;{O6~lLA)Zst59y
z7HuIC78a!t<l#{4@u-BDe{`Nu%fy*&=|u`))SoO&50-nCCA0r!k)J^0hTQJY%Cod_
z7PF;Y=a)ep;N9KT3Y&?vmb-ZXR^#_qd;NQxoh)2V7b3JfPX518mL(4uq%%cUVY3kw
z_Y|#CQj)%@FI-yK5CN?V7-;C|fC22&x!l<h`T#Vfr*BE$`CLqx1D|uTVNg9wzHC@<
z@J*vvD8S;6750?-^F?oviTL+`=9S&uHt@dgNItaY*}{yVT7y9Ve6p36hI_|_Ncj4)
z3p-me5K@5%WH!B&R7MV)U8=ChODQ4(g^r#R`98x4WCS=F;$krt-L0(3Y@q1N{yI4U
zAn>}F8VO?fa&UnA;~&3?Wm1jm>vq*ICn^dJB?$WVEjtr1K}PsSWo0E7n-@f!0L*Qe
z5o8Bfi#J>HaR1nL>!viF-<&yhb=o#MT6&!NsrLu{!$*NlZ(-Z5ZFKqD+Y3IAS2REh
zS<Lyo#0->vFzEm-4@5&v4NF_1QdI5OXAT>lRAhG)FN-h{&t&Ut512k`a&!GlOOHEW
z!GH0S5cCZs8u=-?f|7w_qN_d1HoUHmf|Y`Y2j7>p(9+T-sH3))RiBR(Hd|U@&ob%H
zpG2Uv2Mk%YZW5{}U~v9!012owKn<z1G=}~izk;P!YD7I2tB8D3Y$^gxRQ_xQ+?LA)
zOnD6bS5;Nf27^~aB?VPu00J^5ZK~n^i?*x(C|pQBZ~$STE8`v#+G}Wh{8j%cJf&V(
zSom)<5D~zQaJk$q4Gf~Avkf%d-90^@1;9_zY0MJRk89{ua$I$$<s~IR8<c`9H8|3&
z>$wR931jW)>F&>BfvOC?i3t^er~(1Zv3<i!!^7=StN6MCu`Z`eHEtuS_5AeoV^skT
zlIF#>+pVpwi1-{l4fbZ6EAFe0;jTl#Jt=8~Xk*gTUoYd-WL}E_f3$=zMrxCro4)?0
zTT@eaIB=tv`-_;Dr`u25jb|4zR4vYDe_JhLV%rC5UCv%d5-M^FOnAYMGebop+i#Q=
zv|$eW44*Zt7ryEe?N%9zR%mwU_nreK6BJM+K<x2T@PPgf;FdY_NAscB^e9OMv_t?d
zC&u9MIyM4!FC9@4k^R^CslTgE{*l(uLKFG7E~M(|N|Osfext|&a}*^d;bqa6iP<RF
z)+w2pr`+9}HQ8-Sb;|JmuBQCbUJ#=PA80sNyXCgGw|4`SC%Ff>kAuU)gdhG?Z9^?{
zxHzsfJMnzzp>Am=)NFOc1ujd<MG)~$;bbk>X?xtGUzWFCEe7ol&qdH{uv<?_D<}wS
ztgEvW&{5N}o6U9C3zGGkKE7Qc|Kq~Z-4{$s3JMWXQBmn!==aIj*Q}VBn82K%?aGZm
z(S=1vN8dxkP7V(KU292!|Hq*WL>j7MV4&zO3Jm~ghB(bKGZ8=JCocDIvN~UYd`POK
zyVDD-qC%q!Fi?fq{9ynw2zc#lb=TJbYn-ba-~$-3J_Wlw{cRZY15ghj>e7;u?5vX}
zy3UsCls8WwqHWgOI^0j(jf`UR0z}TzS1~X#t7~e2;_Cj<ove&X9$<8FI-2=bV=-?d
zDJ22r`S{GVQIi+omZ1YQOJgjK{q^1T4a^stP1iZVFnzQEI1w8Vougu6N_5JG<4;=B
z`8|9l!vJvs=sY<DvIQgpuDz)#xA9W5$pj^naVAeGDl#&Mz1m>DW+yI>Qv-QhSlVgD
zX<qA<Y8xXC?^6Uo12d$O&0=O}AHP{BiXd1TPvmBzq@3G+qz7hVDhG(L5RW$jD)!s)
z`>g>|4QEUE8NYr=cDS5beDx~+UP4Xhax_(?t^}jp?sYPqr{n=lp_0<Js59bP>xH2Q
z(AT0-2go#Wv3fOt`9C8i<p^l^0Qd}6-01Jde`fQ*3eOXx5%UItK&i<bJ-SB9GY2f#
zNG*g!9PW^xC<v_R>j8&;Sa208ZxLX)Vq;UON3$~!httHW^#|o<W}@I@!@wN&Nih($
zH|83ih8S1CW-HUk#QE$33L11tz-DlO^HY79{&=RApb|@R$1T2;u`$+;kfb6lAn$6Y
zJdgA<{!0s>0qlE9N=lP(nt(nG@FW!_6&7YzWhIr9nJNNc)#7F<Z!=d{1D?*8Pxk@f
zhvAXs-US>ex)R9>oi<TN=v~c*vr`^hoJ~zSx=?%$8$%6RE{fgFZK~s13~xHY5gyTg
zQDEl*CiO`bPhL52E7)@)y#rt~0OPzYwmG+mAQXTyf$<8@5A2`pf?#ExQF!}vp~T@5
zxss}diMdPS_h?~Z(Pg$&bB6M%q?I?{4E-rycI@}@bHGTV$0N!);AfIhS9e?Z^?pf%
z7v}KQPwbSC15he~2my0@Mwi$RfcnqajbfX;j(YM@^ilYsk&&91$!_98QU)q2Er>I?
zxez^LJldSn(w&)ZCO$p_zMW-WdV0iiEa3Go9&+a5{f(3hGiff%JONse)0eG@^$X`K
z5RX7UmoFAWs%5Ev@LeDk`f1i_bBKri0W^{pOd|TPdTswB=>MZLHy+^AZ^%T<Q!Kzn
z$ji+Q4+EBJXjJgl_^Jm<7YX?3_HR7tiLD;4J)6XROG!$m1O#;uD4c-BeB;Nf$O=0*
zH#h6&Fd9lg2d>bvOW`#GdYpP~vSL;GyR)ZqgV9qpSSLnCJRXl1I|YR-lq+-^tkbeB
zm+PcV^6!QH#Ts?5fJWh;>!L~DHKRB8y-npi+S9aqsN^!XcCT@3kUsIw<fsuPu%BE^
z&ClBmPNLQ$;@zB1pY@N~SfHiyy15Tc?ONjQNi>|c;j!B%@;bR2Y&C>&QA?+>=O}FF
z%hGGt19~V)%bp#0@3@JCBrAeG70_IO4@Y$I0VRpA*4C#5av6?JP6`ph!F<loy<uib
zkpz5b1OzOWz0@ZASPeGrVR&o?bH`2m{5F%6Tohbi_z9tK1c8>wbQY8RmSqr|%B)08
zK@~v+0f&Ny=;KsCjV8NQqwU31(X@#kE4>cqdgs^mlgmD1nG_(P+RD**NCRH>2J6*8
z5_BRW@0(&CgU*Pt<Z7FnKWpJmX<xM44UCPKN=%Sr0l+_<Y$uS8#$zk~$Svr%*5*E2
ztd72Grc^LfXZ0%;XbMh#+}a&kZAl*-8d52g-<<RT1C46`Y>rwWplBooMz*L#`Z%d(
zpOlO&FArosTij%MU;vQ0TY4uar+O5WbGS|YF3S9TN+4lFJKZ^6yaGsJfoz7cZZ{>+
z2P!KrJ~=%d^OSB?0Z7h&K}1kJ_%+1L(9&|}WSh(tFyC2^>K=am3b3luvNE8Pl3FX+
z7!?&&p2*B>jS29&8z2E+C<q38EO&~5Tg(B!GX=pmHW@8<r!1Z=dn-*>58r4bBF3~L
z34=;ApD$-ieEb5xDgo^d#QON`)`63qK8IIwZ!rbqjGj4^yu2USG5)c@K6&2Ff7SKw
zd8`|WFH7aNYHn@qzP~VJ!lYQq1e!4c9_4hlNJmA5{bi~f$^q3=@MZi&lS(FOuFwvB
zfeBDIZ%(E^#>LTTl3n|$7wnG2>j?p>N(9YIoMH%)G#Y@CT~Z4)!4kn&`{SrHdczXi
z9;{+t&CQb$BH#YdAbb+`rD5R`#1Mrmk5xqCrF`Fw=5Ri_X*dwsV1Dp<B{Q@4orp*P
z&`yF<N&=Kn)`i?&>T<2x+)vdie#T+~$sxwB3aD7MtQ){2!pu?RfB(Uf|F!@JV!aZw
zw;v8deh<vjZiZq#$aqXUF)gh}SNZGO%IHjy2q58uXJCT-S6bc%FR`Z#09j|bvpyYY
zssKQzNb!+ydekh2R(aC@;_@<Xe(nSyfw)B_npKh@i)W^e&a!2fVzrXL<)u7X_23a|
zIyyGH%E-{r4)DGX5Ow*XJ>AdGFMfD|*PgsRACH@Ib9d+}<}FmegolUofN!7oJBe}l
z+dQ2A>Xr9Wy;+yj`<)?}PVUZUA1wZ?-=qL8F%GN6#hI?P#UUnc$~~YD!AG|p2M@>b
zaAAD%hsl?dm9`E^Op6JgJD?MifG9)0PI6a+%_8$P{A^iGXYJ+j7WmK#HQcbOR{zox
zGdXM6=KijXwB$EHmKiy!bD?mkd2lcW@{5y2??QW!MJ#}JNQC_T=W4o3b$36Kk`8>E
zSny{W0-Q4!8=1&}Xex??zw>9oe_n6mJ*TeeJHf@a{jWeG)1$k7Th}mgp5>>($sS-V
zsJ_6IIkmD93!tz+wI*#&QI>)&B089_EfCRCMMVYZLvyIE(NCwQrERRWM}kN4(eVrq
z^F^z3G%p9}jLp2>d8Zfb_2BTZxVYrt@DPxr0NL8E(f-%JpVFB8e^`6VsI2>K-`fC0
zN*bg?Ns*E+X=xA%X+%JzyFnU6K%}KnO1dt(J0t|@ZlyuG&UCH4_E>wIXYXh1G0w~T
z9v0X2kNNw?XGR1Dy4fhBPH{3hGXIAAd}1W$YN53=DT$0>WXk!f!s6}UIUU>BoR0L9
ziVD5=q(fI{rE{Z{lt)-nr48dbhmepEHyt+<zm~R~+~D{~Th-Ile+YN1Al#8^5dOiK
z;9zI>O{8O{{Zf=IH$>*kAleh#<8ofd4n>qrT?I_XIswZbqy<@C3ERCr-?(D)t43i_
z3U6kG@BaQsqJPy-1%)u*<iE$u@1!EYCc%f(mTY+GBD<uNq;A9F)$H|c-->{Wp`Sk`
z<^PrjqG5)@_7y#m(oo_NVj*wFe}RI60@V^S3cOZ*b!2XIG^l_^sXq6-oGrx^6K{nq
zBbt-m7dI|S{l+n2>$j6HU>aoLlbwrwS?=)gO1cV(dRB!tkml;SrW{nwMQ>l*3b{e0
zgp;19(!SGalVn^x2!nUi?P4V1pxFHE&+q=ihULMkp*=j)mKItqzDi>Ls%xAvJc!*j
zYr|#qoUlR*0S(8j90N3Jk5;%x?V__Q9wL9u%<k>&UeQKiMjE_88(ZFMe#CpuK}##X
z-H5qgV%bSi8+d3wR%(d4Sd@)47W*i!(dhZdI95$Y{imW2PEhsUM-rdt(<>%-cXt~%
zf>tkaSFAC1`6f?+d7L8uq*i%8i)b|OR}MiKBOI7xKiEFQmJt5`CuscpTfJwU1f}Kc
z*R1X7il9?2Utiz2BF&h@#NKH3$9gqn*t_s75{a`*<It|Ox;`v_4(BO-UtdU@7jR4=
zc3dte6B$+f&!2E|=@!3X2WRH7v99r_sHlik-idTifz`1b^@88<9G&=z-M%==GLSZJ
zkR^e$T_zRw`|jS|ffOMyXYXa^=Yec-%&dVhiRwQ&t>2ocW!3qR6|Q)4?mTl=C#c6S
zIQFG8_K~iz@$Wxcjux~uG|JUhmmTVlEy+J~r*gSlfvh@NcYM4vT2C}(`s&r<h#BYR
zW}?Hd(WM_N%oYz3lf|~2h_@qEzhFX0v&z{VuAHkq-ic+=9<pvq^SEt3QS%*Mc)Qni
zr|5gQmkt|4d0wqjt<vFFe||-!4fxVBj%Rx=N%2_Ey!z)q7eg@go7%VH6*yVw>(8AZ
zQzi+!dJGhjQ;b<}ir9QyV3ly)o<7Y|NSxla85<p)Ep?poyK~RkYR+l(PY9d}%s5Rr
zF65J;lRoZ6C;vI)Th?!<mBqU1GL3wl%f)uN7gjTf)`R|J@~O%cK1UiBA<u=3hdF;e
z=$M$Fe}1W!)Oy@TM@Mh;x?Byn)HdmlKUyDJ%Iu9Di03|BJv0Zw9qT@~F9BmD{L4)%
zzNzUq9>FE{_k)&~m&foI-{oLtCjF6CPylEjcH0)0%Din0PoXKd-EZaPOwVLwn)Bni
zE#HIc7mhgcMLw{asrgQV^GHQy$VSQJdwgMGmU^Da_s7Wsx{bDe3zCMc-{XZbRd9ub
zW@38du!sjE7P7xaMt=m^9w#Buq%S^lb#+x%R+d<5PPpFEaw9h<2ZNMf;-$>#3Nve<
z^*lbAOtY}<yCL==IMJm?A0}*$Kp?yQI=joip_sXz{i5pE+JKM6OL5&~mZyOY9(Or7
zxo}4Eav1KQprE;(ob1tVlB}se-t67o4d%Ag*|$Vq$WgiMobW~#z(hrT*M|CAL0*B)
z^7UA8dROF&0<DMoB53>jyz*e=Dudfy=&ExM6Vq}uKesyJWwZ0opFi>NqL5g@J3$WN
z5^rt6K!4=&?xe7xK~K}g1wbA5uO9Jo^KfvqA>mEkFn%c6KE+eCCZ}oq#sC`^7fOwx
zc8ZEvb!=P}Vw~7(tzF~1f`U4`9D<LgtD;m4X&I|r0ZkPc2!~s525?G}VI=+eyJBay
z0q^v&)zJLMYo$G^lp47H;wj=2W=rffhUu`7d2Agl5XQYu(?8!J{wbQG_E8$Vd6Sb}
zRB3*!_v|i``Osn}>S9KNWauiKZ$t%=wORB_-md0P%-u;_>eRn}it(L1k=#}Yx;gJl
zAqo*}k~~?__ThnkDj;SE9GN(f_JW>|E^&lylAN8?;na=%EC}xOTB1`(d}5AOPt4<F
z(X4=NKQyT9Y_a`%XRvK<&ikO_@RVe8vikDKav(5_jD-6wS?b5Zj!Z75Y^B7EqU^Dj
zYPH(}=atrT{i!^0meY9}O7b@xH>cJ5sI)5_w&#khi)KC9JIgIQ`z@!q%Mdb#wB2L$
zScCnAH~)S(#-5nBHOan{C5Mv<zj^g)bLG%&ahWlt(#oKek%vb^??t%n%?S@AOE%1M
zi}s#gq5*W0rZ&jz^bn1<(<LOlY>A{IB&L--EyR?khUskYAAfjpt`YiJYmhuz{(Bkh
z%x8BC4V6bN@AutTND$l$-cVVPg*3|^6hJdGku6gMJ^7tyZ^exk1dvkktJ<uhY7;~g
z2U2buzJDqj(#`Y9*Hh22admT90$2Q^IoeNO&S`TzokoPg+{y~^cEv91gm`^pXRcCu
z`O~LNtUr>k9YUzCh<jGPS;O%5eXij*DU4mH{}bxy-yhWf&11bsVl}9(?dzWp7+DwC
z_X!RU%^$#P0*Ap^dld?0P*>>c?#;~3HaAlv9xp2T_6<#y&UI@GCXQyhZO_x+j_T^_
zV9~(<D3b9+jgFOdXFl=^ywDJc(xzT$_duI)XE;wlm2S^%%g9hg=CzxRFIAiJXQn7H
z7^0&s-lPpQY>qdC88l-<A91>9COAC2q_lK>;!B=yU0r3wj{Eh!nOdioTIzH|jp=D=
z4AP6)>!o4S0XX~WyVmQK*#X|AKbLcDu5M5D#dC|9AGucKdhh=hziV|5A#GHoHk@U?
zw!RWH{Vy#5t3{5;;6~o4)jJux)oEn-!qy1GF-gZWKpWfweh0B%>8DaT^EEd|^He_f
zo4228czIa|VczeW<2D~lxddd7_6rWm!J;Cl?TcgkGstp2rUgC&w3%3@oP|7(Zl&J`
zXUHjYGG~3Awvc|ZsyvC){BuSIjSf>_5o&ig<7OZnc<x@TsLmr?>W>OvTXB2$V{~;w
zrSrM!u!(%)NS^c<<P|_aYwzf&rV#j9B0hCrl^)_4ZaUWkVkK-@85tQvt>xW#2I9$$
zE_}THl~~QgYpmeA680qrc!7WGpOzN%R*ku~+>T<rk+qg3DNCItIZG)4HNDRL8tx8A
zaN7MLQor#ioU~GKjYX%%b8Pm+AL&Jd`<nh2slV(9S=slx{1x6{&N(S68Vap%{A#{o
zxN?^eGoL`hDNP`X{)3wG#~`6ss$WR@FbN1^xC@ej7Du>w6M<2C_iS&4)!@fSbAxnc
z|NHl7tE*Yxn3(iwY17}qN%04V;CKNQKV63u0n?k&TwTsbkCI@J#g^qeLziyNb>+M;
z9Q`|r2kAyckP0oDzm7(zBO`8FSsNR##IMJ<xV<ZBC7ibe+YKI;C9L2uJ;d{uK3L3*
zyQi=7gFQmcfDU~&Hfyz#U<_~*!h1w{A5KVIS2s_0gNu|2tF$1`f_$8pk#SL<c54b;
zQTUrxjSZ^({r#KG#9m5k*LqHkvY9G(SW*&^b|QRKZ%fOFi<6hcLn95r!OWRwVEvKw
z*>gMD_obh3^;#}OZ*=^_Ag%ywKOpQT+NY$XzQ-N0A3t_ImUZ7eVMMZ(3L{3t)GGBj
zycXwkb%k4{{p<g&HpN#O1jk5b#_7!hsg7Z;!T#QYp}z?rGj81m+vro8z<^#I{seW>
zBY-;%-EjK;DKn2s{;%F-=^;3PBYr~Yljy6h+xRO)0YZn+k23koJ|Pye37}%96h@)4
ziRvUGihp5~41@A}8M8@_;Nqj}Y$B7l*eHRla5u9%?A{2h?8?9SieZD>s(Gs*D~sE~
z#v6f~{xLvKoeJr%chQCAe!N*@I+tFJ9!tYCoiAgAclCn-O12<##zsfKdvW(w<*gHH
zQv!(qK&6nAOo?VIhcN8mj4j3IaPV;c93D2-ewFnL4y`yikzb^-{>tVYnT^lUz9Mmo
zg5eQ-xay96Ap0@UgX>dpi>yq@FKkt@;GZqHIE8J?Pb66M<(^IDSBC<m5-TL~V>I?Q
zVG90{noR}w$l68%)z!1BoS5g>hwt2J{%TmXrBWm6Gz~S+m0$TYRyjQQDzWVQ5u9!n
zovYvaa$;qx1If*x$vpI~=xO@!973QVW#RT*JpEtWY8MHOJ$pw-r@ITZs)|)!mmL$J
z_v_$C#?Y|shQb#yM=1qQsIek_do(4V6MJB+JfOS!UF5yAxFjUB!zR(KqW*%8ntBK!
z`ek<)HR}Pd*Wxl)#0CUUHFmrUb!_p5so+`n<cY)VMF8^LewA12;W~SuyG@PFk9hr6
zNCrK&6j=6DIzBw<R^4Fw>AX4p@XZb5Q|B2s0r#M*+jn@Z7Ej>c_G0lO?Pbhc?oItf
zCvvLVpO$Yad0m2MdbYl~t4h=3TfF@#>DQxXjyf4Z!HIPU&iQ%vb<^XSno5fqV44Z{
zvF<+H?cI;bBhFZ6V5S(}!=wMqWl8gFb-#1Br<a+7snl^p{nezy?-88+8b})YT4R#(
z$DguzTwPR4loIXCcpL1d-Spk`1u)>@#?<Ul9j9HJ4PtfBa12<iu2uSK8XA6lcsP48
z1w1@FjczL$X{kUzgIQA4`0VHxEiG*_r0ina<vy-&9r`Y${=9iRsMt6b;(8dA+~uIZ
zFo?JxB~ka_8n^sS)(LvFId;v9G8F05quhJE;2g)Ie>e4303=ZseMSch_b!k_k?wog
zW;(%$f8}>)OTeMfe2Oh~4hNTHGTT}tmB(5c<hcZHPm?9O?{E~bn5ap%EIyh$+~BeJ
zJ(5XUqg&}kdyb8Th1KDQQ=eY4+n}sjV&@oT!m>NsCZjsu13ABF__fO;KUTh-S9k;=
zOn0t)ZlB3{4(Q<F;INx)o}f4#g^}>gR9@du<*iy1aN2(FV>yEmmoEcbZr1b6abp%e
z=pJeMOMChw9q9Jy=@kV<5F?kB1gPd|R|=`zj=(^)Hj7KMx!~`{#m08*61{J_+uZyr
zXJgbFJD#4$YFel2P4}$l`5vJ#mf^skncCwtqo5;SlJ(w`5~JD1<A|^@V{=G92s*4A
za0}VPU<z?p#?8TUrWZNStHI9Jh^O>XB9t~9E2cjGF^T{mUOX_In9J=^p-*zH)6%lV
zba_BQqr)j$zn*<|?4}vD>_?7tj*lpEa=kq<1^2yf&C@HTpf$R0j9TKUMuEU;HCJul
zy%-RLwdH*|scj%<YHYeh(}8C<+V_j7Kh@CQt<*m-0Fy)zpT{-qcipsGXLxFKOica4
zg4g9|ZND>wMIwYp<5f7bl%{|L`---~%M0VWa*{Uip1aF+e=c69Es-eWct_O+;32BL
zfE9Htn8<C}qOO?0Ev_ee)sq=2M+j&B*Y~F>n{QyNxn5nkRu<|`#8s(CN037x%;jv^
zwz8M#5Q=X}c)Bz1gYIoRza4_<J1HbGIeF!v!}K5v6V4%!W$2B2JW*j<bRzy{;>T(C
zmvd<>%8{`(%p2L4eYtp^ZpRKzZ+&iEjq3;w;#6_EJMA>FLBjO<WDgG!)b{nki7jCB
zc1IB`iJ%Q3`8CsBUj1V3y6N8v-wAxVipl&HJJa=@yY?ZXLh0nl_mC*tHu(<58^3gh
zm&J$&VNH}d>(55~V9|I-p_VK7_7Cx~IYqw2`vo~=<+%Q2NQ0oN3Avv=ps>!(HDik=
ze5Cor^LMmRt<!Y9a|E?)^pE3s8%$uq*lcemZ1zr8nCq@ev+p7mY7`avi7&wz0Fl(#
zB28m+^QpFU_SxTq=`%m`#%zd666bRT-aPdd5SabaH`w&9K;r8c{c9gQ`VXB7?W0ZW
z&lHw)m4M;Z5>X2zwka-)cVck%z^?ks&)fHTCfW$cT?j%nAp{+N|0y+=`wi(-j>oEj
z*0xl*B{1*8QCN`fUYPBjQfnW`b02LEiL2~s-(nH8_Vm1T+8Qrx*H3Sj%qM*a-F)!H
z=#Q`EwSvv{9%IkhzOg9EeR(q_D>vcp_7mVamaq%vr5B4g$vlH+Z+CY)UB35wa#8iy
z^Rdt5(AUoRUH6}m)fW%4k!fscRXo<IX-hG5dVsz<fJa7zo+PaK*nX{#aAe-NH4t;K
z(UZ1zs#3^S>(!Er%+iG9dukcfA4YxooDX5>t9VP`B>sVnjtPzTCv?nHoW00GXKLN)
z3o{^ty!f;ujC>e$b@s4=f&x&NT4-q;92}l-aV;(_iHnK<`Exi~zQ7_go$gr+EzZBM
zf-@#R^JnT(9kUHM=cQUdzxkxz-ji@!+DQEPF)cm)<`)u;w=Z7cCq~CD=sr{jTp;0}
zcT>0T^?A(b)p$(w^!)zG%&POm0#mT`r}=2hRgp^lWOR2FQljQdtzzWq3|74cF={3z
zx51C;Row*z`DyBQ7hhe2m9oEPtxl<EY7$#1O|xwF_Kc4D#%Rye>e$x09riq2=m4!=
zYmUf=@i8QeW`%`MnMfzNUdIK0T3{s%P>qaCP#LFwhkUSB=wn)8sA}J7GMuGo_&ve*
z=@|ro*ykZalXdeEEvG7HbM1-5z6=Jh%ZW{PI5`~Bk-1QN-k6(<-v@7Q=O3&}O#0x3
zkQcZfnIN-5?8EKq0-4iyOjAK&E4AS|Vv^=@D`6n!{W|yKSz%8%&R0VtBT4+mVEZi1
z%oHi4@{zI&>&}Q7d2EJ!T1n+O`q0deC@p_IS5aE}Iv6+ej~YtH#eDN^WL86KZLOD!
zH0F!*?-G9>Zj1qQNus`{#tkw-Qz*zzGI)eKPmnnsvB=mA2Ai(7_#Lc9G5W)9zqOIJ
z)VyX*Sq9TTnai{==$xmP%D*w?fp*U8e(l!zw(clQ(kJl(ri49mv5%o?Yj}drW+;s+
z)Rc_}*gJLPX+h8hAG_32*a}U4%Pd16Vr`5zZ#|B|^=2V5TwZ={Z*Sj5Pavhi9LL(L
z5%M&mtApm=%_c!X+dcyB{)~1x$l8}UbkiX8#KfMDvl|Y7U2GHO1*OvF0)#cl#0fYb
zMcaHoAY#?7c<Z{>uUjYa8m*r;pL(3pMvjGrC2b5`GwYeN=2GnMi2`DT`VDUF_%}B*
z;rM)hkIZdv@gW+<wE!kS`QDxJynRh?BL3`y!E+8?UVnIOJP+@kr)dfs>u3icLaA>T
zgU8K85-!D5K6Fa7m_y4AIQo#8@NNG9`QYa@g(f2gq!_C<f|vSIIO8yd&b&|Fk=`YA
zS?UNwl9S-LkWofLo|hGLyQrd`bM*bv-w-gr_g#CAu)h6rE~9!WBr1Dx(N(UBYB1y)
z2c-qm{;co56AIE6?P*?a6QO|HX4|~z?SLR8P6au+jll(43nRoGLc#Z8A3jhDyR}7Q
z)7%p+Rt5JVNqZqmxn4`HtqUiRXoR=o&BCfvjP7fcADh=RYq)n6<&4gyZaEWxLD4kc
z^=4-Br@4Aj8)e%f_q80u<@upxPJmF*{a<3CyDKZk=+rqKW|SOnuph|x%^DifWOaC*
zqbywzV^a-AL!vidtNtiR-~8PP%I=B(z3tWS+88PsU}QG&Q4U_GdUV&Dj}<0IM`M(c
ziQeyX7%g8=5T}xQ_tCO<)RK+QH`HsSYeDiC<&f&Qg#8-JQ~35~uoTE4RNi3FyeNa$
zfj+6J{nB}T<Y%=S>9o5=U#9f26(sY_R(>Efb{f8ulOwaN^(Dk4MUV6i<?0404rlG%
zlBv3LrCUo<LL5XF4r8K04Sj5*-V6+=>{qfeeF1m;23tWt9!L_3sKy{`-&?vq_3DZ4
z#?vU!3a$Ruc`?tEL_)R+GX(ZmiJN6c^0o|{*nyao0kdpgyx)RD(SPIQwCHfm+F300
zp(xWUB;BySWtwl4T^KKn=MsSI!xhB%janS#u7;c2Y>D}Z@-8lk!_+Vya+M@j80pe3
zJ9po{!-+8UA!P60a=k6_KKy;%xxGG;dpn<gkA2?r9LqoqlT!l1@?<<tPsl8@c+;-0
zF3&&!YOjt#PZ9t7>8{E$##?Sp)~^+iQb=Cw7zSl$o1)fIx8Ev>DKCFv7~y&L;br{(
zI^+sxd&VqZzlcV}j!q}Mc=s<Y;F>7*0_#;O9LiCX(HaA~UuZI*@}%L0E5Vlnr45}q
z_3~zdZhaThBlK2wxD{hi<?#1}{Z~+#i(X02`1T5-z9YY>*8T!t^);0|YPlgr0n(U1
z!^r|6k&}X`(|5-VBn?@JEXXV!kXmuG7c+6b8N89T{O(tOW589pH8CMd9g~?EBgf4v
zwyTea@%SffnX+=G^lh^7xXA2Xjnc1(^$b!*eW=>@DzE9Lx^t0%g&e26dgp&l3j4o=
zpjf*)#MkSf2zZq;)a`j{Yrg+7GBN^Oq0rKTG)Rbi%9PLP^ARt^%f@FVBCB#dw|e%5
z7_Ii0qO1Em!33S);zod+#(Vg+s}+^^jJ+NP<9_`klm)>yrPSNT#;<YlqQ<$NyzlB-
z5NX_g)oh8(rB~$n=n)fGHIT23MuJT6N!=bW*vl&`-GR=*+S)?PZ8iJY#d$cE9HLer
zpg<NQnce;BlW|^Z<4J74*Fb}xenZjQCS067$JQ)MRntD*GOMUvw|q!KC$YOXPdX+F
zd!RB{Xd_npCeUYv8{!_<Hg|M?|E^o&rt2YgYihnU@%-}6!`RD2s62pftJkpq%}n)+
z`gammJ=cXy2z8H-SAjhi{RN7CuU;MgaYz;R&P_`zHrUSB6RN495V(5)<N-T|q)iH!
z=_<7%tF6q?)zQ*i+l!G(WKVF7Ak_c@%uu<^(q&M1adVvSR4Es^KzV_BMJWKXd@j#n
zcqAcNZ**Pi<bGEJ!V~yt_)(CEAZE0QW75|COicQ)jb2P2VD@jv5PN$oGgH>Hbp^V;
zC|nBUo9+%9`8hcTR#xA>W$bf3|3f1T9Iu)2Sw%g)2EF=8QPH_q%n(}MnyLohZ*nvb
zytQLKHswAS5F;UJae|(+r;d}WT1zK@tEu^sZy_cg&fhedWO1U{NFD77_CzY-p%LDH
zmd&)|)By;{@4aAmV4~pR;VFQy4y~kVkV@fmr%2a%cH{F3A?}7JFcwzjJv_t|6~ogM
z0?-JMWG*Tym?R|I*(9?{D}I*XWrH0Cn*bJAg{842Y#EJXeDYu9T3Ghot1ubOJKx1o
zGTz0FG~ktk2!65c?kI41firQR>lH&?{KH-iBAt5wN>>xQS3FA{AJ{m#WaQ;_>MRJf
zQ+I`mTbSwTw6uu~J%8*REMkK{!32)*b;nqdcjN3|c_sUaP!=STgLjL>Q4TB3H7UKX
z|11=wVU-0e6twAFj{G_Z9xG-U=H&QmJ-2zB5Wo8v)@9xK+QeAYgK2k6*L8P2B<(KJ
zM)&X<15%JbiU-;gE_NIdCQyM5BQO+)!xAe?q@BV{K}wMWDW#~c4(7Yp#*GDE(9kop
z6b^}4_4ksqJ_BV%N-)3^ePJAMh6FMA-@nV_U=U6umVSC3)p1np00|gU?vraf^WwlX
z1^7Jy0Y3`lIw>D-_?+yew|3Id&`3v+_3WxEBgQG};vA<Tk9Jqq{%7SYA6|418VRR%
zo+VaM78M(62~Bak(o!1Tf)=OF$L{fwktMHBKj%hu=H?B36K~URqb&WcUD70UEgoWc
z!YNC$v9hup|7siS`uwau0O$2sQ|yC4Dld|=im$xbK@{u`AG1vMVx8zw#fYEZx6R4H
zUm}9EK(PP+u9X{Iripy#jyKe4Paf*;*Q72DEkQIw?^O>I+}??m7RIQH))~=iCd=z3
zw^1<3g-kBqiHiT8<kl&3(ls<s!N-Bqfcx<_QRa%f_qF2&4_jkge0+S=oN54Wo4(ku
zwM$(#@51w+y<m#*x-PEcjD3M4?`tn~oCTciF+otdc(X7H&P*(gjpw?yF+~O*Kl=P%
z!k+m)t#U2J4z6&%|C{51lRlV$wF{suyB+`1$ky|_i$`D9-8$5ueXPf-@2S0YgW@H0
z&Pq$Kb|Rro3SHFcj~|sg3H!m-GjWmnIQP$5ftUu5)hrWlU2MS=FyOGR0sM~53OS|L
z$84XvRkP{oyn0jiE>6*3jDq0MAa1HOAYk#gKmh&Ejh~fZ91e88yYaUn*z>XHYj*a*
zC})nD-+sStEv1N8srOup_?=@Rul?6!+x0nrs=R0g1ur&#MV+8yVe#4QQnfY)b%rMn
zri<6srtnOa+wwV_ptdRnt7R)%^6)q#)_{Wy#Q;1-{-u$O)5U-TOpHG>kM%78CJ)Tg
zVw^8Y$=cHmzu4c71ivg>0~e>8N6`O8p?+hv(Nt^#XO`%gdcKyBX}`R4W$)W>-=gT0
z#Qh)=<VebmMKXSURWBeOh(RJ^%ONs>$!Ri;q@bX1@0b~VZD6Xx9Fn0>x+~&<Z#0$H
ztfx!Gh;)L-Y;mxv#FO?#ih#G_?`Ro-%%8cr8FhYW_}xDodbBlZHC6L6D98y8VIHUI
z1Fg~#Fu}SX|IW?NpZ=D~x$L)vQ0>HG)6}Hxnz_`114V!{6DVc9N^djM(%$WV>5TZ^
z2gK)1A4Rr6tgR`-DPM7NPLr=7|H7J+%w7$*<KJp|CJK<ahj<fk^BMT~?q8A#+2z1A
zEc^a_f4^dJo$wu$z#wVxlmj$S({r^ddIr-)8lRJkMytwt(@jC@yyC5zh}XsX;o0G$
zB)ZK(YejSPFf>so+8%@3x#^2Uot`ciSGaq45EUEiYi!s$fOc_epO%oDo5sV*IUGUh
zs(07Q?AeVEv<{!5lSa}S3gX$3kUVg=+eSu~7sPSU>&$ZU$^yzv2aKdPM}7@&%3-iF
zFc7;7+UyQOj|6WKFHOSYa%~_rJ(`!Hc^4{ny$qf)B^3pCZX-!`CJP+f#6feDtS}6S
z^s(Pb^EC44rtO-2+W}c`J-u55kq(cXvDw+2Cr_U29_`_jL)Q;4+OWUry-!aQH%@Bk
z@c2037M?-JsU#l05kv_BK_d7j%_cK$Y(pUt%w^A8zQ{XwRZT7y?n_B{w99GoTMYc8
z*%?!X@xq`dS_W0yppb|)QGg#zU?G+;qB%!LA%x2>4*VZKhGF8MVn_Xw)M(=~Qw(*<
zqI$i#YWI69JPi%Lni%h@{vJTj`uMsOnuXN!HF37(Ei4`tMWGzl*L!a7XEzy+!Fh+G
znS}j|ql3k&+aF%$`@!t@$euia7Y~aN`B_eGv$n*-_#WQoJOpnRjzL}{7sDeWs&pUF
z`^PP&{D<gfB(!O*A@s5GpK<0}QNqDPf3DXkUnqWNyIL<Xayn8#!J_cR#;PUg`)J%7
z+oxZQ%0k4VH(4g_EE*I%2dvRgF_EHdne*FB8VDzg(UIIt^wlzIB+}6$-I7;omw{m@
znD@E8E;I#d178JB)~NMT%+xyWbSD~#tvffp^V$so2C$@NcY5xZdU4f0{*rBi5&Nl8
z1s?0!!nwf)`>}0ZerJdduzry*GJJPK!Ocypp*;R?H0C6j4PKw9ZOeK7F+(+u%>IrE
zVozO=8$L9pieVGoG|1}0C&O4BgWCd)PE1KwR%}30U&4n<Hm=ba^ENLP2gfPr&iiQM
zk4mrDZX+KrZ;U<LTLlWHcmLCp2U5!hkZYDee8q2R)0exyA1_O|j+`Hl*QtwqAOJ%g
zn)jx4se=56J?LerO#VNaO8>{bEh|dBUB5OqDy=R9K}^gLw7zP=BCkbdjkrvN;h@c+
zKS`)F`u=p0tHHDKNBDaJFmagu$PaLg`3+X1{N26TIq$VXp&~ukbTYsK5K*QkC$~rA
zhRDbe_pLBn$tNrzptZ}mXbyWp8bd`Uj3yf_<(!<H8r0C>#rr*4GJ+8>d<U@w<N}Tb
zbHzi&3$*&Kt|f<XpQ~mmI=@-$D*R4Jd=gLqd;`Oit|1V2$vLgW#5{b{QiqH>DlF$9
zbt?q(c8uIqNL1G5ly_6Q*@0gDb@i%kvgPe5)3zM;I?K**5wFDupOXb0`R807>(u!-
zkHCv!GLszRCdR#(akMa40urjrTWL4ZU_?K~`;g0Vb(61nsOEU{a&*VC`3oM#DirO$
ze-=nz`>PgOmw49bI(A+|FWBTH&v<drrcSr^P;k-h#o*mKHZn=5#_>CEdHvcaKyU~P
z8^UR6oU5Y@Zcm?p^#$8{)18K}#3$PItNMW=F3qm95QFK6Xr<&a#NChz;nQGeXOGHO
zwEn&BUr48rfFclC(0SwU+q0-)2C}ylLT-K7ZQhKbOl5BmKeK38=H=xbZvX6^>NJH|
zEu{!bn%7ZMH7c{iuOHRY$J>ww{rtq3iHVx#i&RAGj9zsqm!4P((j{oZq9Hb{E6d9n
zHXDdF(6N6{jUKojn9N=vv)QMi(n^IN{i#!}v?51FMxOS61I`<jAhESI<#f$H+Wt~U
zxQg<Nr^>e#@BD5Rb4|7$FR!*r<_~V1canUDdI%?NUgvG!&)>dPSD!9E>_wwUHeiDa
zqSbh@sHV#aC@y=?2iM*c<iT`qbntO-kXk&b(R)Y4ZRDBf?aPO9apHG|HhTyvC+t@r
z(mjONpojpo`|tAm;Ge+WgZum*{!>5mgle44f0kzEZIs+ETTR=8<PbF`v34s8W{Qya
zw(aHF^}xaB3hYkE+}<PSSpPMg4FgffUB*ov>N+l)LFLVwm&0`Zii#RVH4&+7cax{9
zT+Ju{B;exq`R^Gm;o(w6du5czoFp>Z&mu`I^i3SV?wwjEE9m)gvJFaO6Gf<kAWF)e
z9~J%aV`QX^tfH_-8-WIAp;u$2wYZqr<`(JJR2h2Wz-OW3&FTXh_m1R7=Yhv?p+-lK
zOr@lN@la-O*V0N0!Rom>TOks7{H?cjtDYjhJ<sgvT~lKF)YtcDlSCk3`-!tfN5lEf
zXSI*Fp*|jyH#S|}t6D?KV<kozK`D^&^{WHOc}ME3!O_vn>|?EOTrbbUN|xvsZy<XX
zo;!yXSPJ1|QSf6Nyq+APX4%yn&SI14Pi`E{GmQxKSTbHZbBv88Ocrny^jdtOrF9l`
zkJ8g)_KD@<V2QXuoja5dc`EZjm=6quytu+=Ua#fg1?Bfn<ou=FRQ(4-UpiM-R$!pM
z8`k8?>u?f0#$5FFXU=N_^M7dp-$Dd6249YUDA3|()#6QED7p?E4o?|K7KkW>gj8XA
zdSP}Rx;?IvF90WiEs@NT&4GiXZ%6{&VNxD$y~W({>$yhnh-*qAk8;-y?rB9AtFka#
zPw!J)e=!A8Qbd+|!RLV74=D{4R;2hJK49#5!*LK;muL{7u()k*p69C#2errA4S!3o
z@WQoFu(ArD*A*8R7Yzb|0!P2GMajnzwmpP>Q&-5sh9njhJHz<+NYgdcHhn9{Nv>4R
zm#(2Exe!s{dK~UdA?$U+Kuvwq*60qKBicX~tgfKB0t)18a_nQ@LWA2VUJGWj-#^zy
zf~z7fp&8Tc+TYdn^yYR<+U1n<j%Ey_OJN!#!_%?xSl`30xxG7gkCg|zYn^w9eX%q8
zazBKJb0-n;3jAZ7`n1_@`Sz`^OS8X>Dv127NdkUyjrL;{utcFno6Tt#h=xSMM4tMw
zgmvz#drS0iS9UZ|2)bw%e+R0E?d^fjeDy}1Sa04neT>I)EO*4Vz`{Zc{P|8>tIq(=
z)izP$G85b|9{N@ynVX4+>|Vn*7x0(St<7J(y=BTIC`g8T+h}d}@_g0AB<rH1H3&0-
z!}XJmQEM#<#`VQGmqin5GQ*J|^j%W~y<Sv#dU*JD-89NR5qa<++Vd{u*2Y-ZXn~et
zqoJW8Yl;w~#V<Wy20SLecc|yfNL34oJkI{tBBt9OyjYN8?9_(vc<JeUItf16rtM|m
zyj8ANCfYQ!=C5F@c?85j^ViP{)C=BTo*|S{h0SNO$VaHTxGD@1AwO_&FX&d;5`2aP
zbJWq9qJC%CUsS$yjuh(F8c@Bwf%STPSH;N*bDaAqY!eM(HaT+BFss6RteHLJ{d=uO
zLp(*)B!Ls9abyp6e*^3UDc7md@5(f&+e1e5ObLn1%*@u)<;X$yEBnX-0s=_Y#Vi&j
z@7^ipbG7a2a5EkWT2ItqqRdCqc4AlX6?;cSrbl+&ToTlP!OBMu6;Dvw<MpoLRHgY8
ztUiJ&H#Wz{XhCmlP{e}WA|4rUnus{|93y-tRH12tuXmdWdSjai>>7dE7ZDjb1RYqQ
z2?tctDH2zDc0TSSTUZ2XM<V{+LQzl{>Ae!tzLEJzVT<*TmQ&97wvEcM1&KT<eD+wX
zd^YyjUp0$u*gudgaQofC^tjqYUiGu_b9^&*1ZbeebDes-_LIAKU=9RV9iG@4;gk|g
z<ikcPwQny12|?#L+BsGN6AumHQ(0v^90-2!2NEGdRvh=wJkH!`*MGL~$jSYlv9<hw
ziGCd2;SS+o^QAkK4WKmT;SwE8Sn#q8SNcVz;?_i&$$Xut`DZTk--|y;_DB%kM}j*u
zl_FeRnA=kyeyRR#lEkyzF58&*sUObzu5-TQ7N3B<?r1*7<}r5HUP)RfLf5eoC30)%
zi$Gu}wm&wkUJ8+y!6qRzGkzJu$Y+yB_4Kv?DCa59Ow{SD3VgQ~o<oq4t^FnnGR6LQ
zdlyct0fWM4!Nb*psi1pXMb_rp#rFPM`*%N9rKqYBEU!o+IxVN0`Ws9XNUNCQsUW-F
z@tv`u5{%|`<VO`Ahw+nRKfY1z7Hd+0OLHIk+$}N6c=6m8<qVX(yW>^7mMjGxm%)7H
zb<;Y*?hR*MISdMzm}gEuDE+R3Zv12O6GQD7lKk1<`j76XmhJ9ES&Sy#AX2;GRhC+(
zg9c>3r!wF!vT<H+B!`YP`#u$T|093i)nI6Jlu0w><XJQJU3`hJZEPNXiqhJNj2r>v
zS|$9{S4=&HEC*A&hlhTY4<0hUtd=!)k_}Zg2zPaJ`<9zWP#*uc*654C_`5un=7d?0
z&X?*6<G;zO{Wt$xmX9|3I_MtMWrTqrwIZi%Wo1=@sJA~($uno)7Yv36!<`lpOjb!T
zF|k+{{g=~aD)=cv?hOtTXpv?Pn*FJbyMHD)@%0+qz?Zxq$muoSXz)N%^z{;$kTH=D
z+KktJFtNzKG@f)`pDvItf?@6$8X}j0M_|A)ogs#XhSCiU<=I_#b{b(e^*v-?XL%CM
zNcSK4=2K&T>6oOX{f7+CKHe+-8XOiz{^WH|Lqkerq>7;>)pUck%S7m0<8h<w0e9<t
zkxhNJPZ?CD?84vUcYa}pK2ujGWKFkwb@yUb>ZIkQT5dxrBU*?K-sn+uiZ<X*v$Ecc
z_yP@<(Hy;cs~LXD350oEzx-YZYJ^SWD!c2CHjl$(e#h7E2MV-Ps?5ORH}t|>P*E$i
zs5kHA&iZ<~yJyt?z6Nf+*H>7p{R!>(QLx(pSO^M9Y>H}XF{fPqtRGTq%dZ~v^pK!H
z@eb(qm1X8#kJ0%&J06X53Ar8GnhmEcTwA#Pdsj+(lMc*(!sXx^AV-0Mf=S9JpTe)Z
z`$)_XrXv`Q9pC=)HAVN|{M>m6$>~6Ue}05bgX@OKzz>)x%jB^B8ROo8>EJV$GbAn&
z4UD^B{Av~t;wd+uE(Oh@+bXr;a<<;P(qiJh*KL%A%#9%<;(_SgVRJwg2L}@inUKjF
zJ57NxgF(sup5@DRdaKk(p7j_cVvjWU!_f3z$5{!Dcfj#!eQ-A23{o*p;4G-WlD5fR
zW!3a=#vm2mZx4-|JKA4oKeI3}ovSyshFpk$#5QEY@#q!WbBaTmFVxm0Ql3ZRTZGsL
z+$`QHd|7KX>l<L<3de-=Bg(EyKB)lAjS+J;!^LIDo}h8#4~xjjzU`^H8&zzW>U}2S
zedSw#aW8_H@9m?0J@jmKUp$&meD-Vlbq)y&`f|KRx9?y!|N6}3{@Bfcv?<fhYQ@*w
zq_65O4BnBEkp-tj+8_j7>2~&VN8BSx6~0R4@isIup;Od-{v5Y<>xf*S(&{|+(bhfz
zPttA;0`m?ASzne-pR*zAW0oVocYAt`hF=zFrP23=2yOl4t1~eQqJ5ts_16{_K5o@M
zqbEE*{r@hf-J-lL#`h*F=~Lh1yGXQe+Q0p@U+r^nuFcQ-#&5R&1kqZuL?_$(Ouxp)
zsW%G~R6jAQ8&bpnE;xnk&Z>S=U0hsLZaVb8QfY8ln2uMWC3>U-deVn8_}E7a)eeSQ
z-AP9;Lu-+1Xa6&~e!RJ;YqRUnpDZv}ZWcvKu?@5am7$?uW@Z*^zkZnk$qi$mx3%Ph
z#b`cbIPySWw`!Ir7DgY>xBR|*Sf{obXw(s=p{(5WjN4Mvd!Z#$JSd`Apyg+TVqtZy
zTJCe#!%6S^USc6|-SsE2Uk>@X*SjB1*Bpx6y{)TNsa0YT5}8izH1tiaw?)xRR02_+
ztFp9OU~Ol!w5p&qP@C`VJawQ5nos~wkQ{pEI=n&a1uB6I0>hBi(Sy*PRL_m3=2nR1
z*KW9$6@>NzHzXs&C3imk72M}<>Rg8db!(5&@DWs1{*aU$ZvoQDT3?Fe_U12uTo`q_
z=II-<x*u&j3V943jKZp{OX$Nd&<c3RR{A0{bw(^bq{sO8Sbv~2z8>%|wZAh_vqyTy
zFPxURbpK$CqMxZ*7%DcrEf{3Ow69C-D~Ik|>o8%b^OL7YzpOyRxvLmwGgGY%hhqim
znhD^Fz}T~NGkgj~$(@nWtkXncqSDP_2W3n~S9fb@sS{?ddbgv$SP~HQ#Lu049lJDL
z^1=`QtGtFvNkO3i2?U*T123=(=KaX{i;Efx3ZkQ<^Yb5V(oNU+%C{oJWqqIBBmVvS
z_hn^Kxw+jifG8(??odS|CQ{2&ueQ1R5Li<K7s*%u2P9>^EbrV9hirl@1!w_|;YM&*
zoMu~7I&6>UPfQHct3|7!krH4v_x74!)$sxF$79T{&cLTqtKu!JkPBQQe`0gv!uy$?
zm6akyZEbAW`mUgour=Nw>C*V)#}DGK{$C$B`Rw0Q%H4ejIQLV3!lgoVjEfBIk_?5g
z-&GH7`f*x{RL@0bxBbrVnUCaP&8fpSHA#DER2`Kw)48|5HkX%2ZXH6Um79ypIBc4)
z%(SJbZKCyV38K_ZyZjKB-|@GBnHlVfo2qxOoT}W}75V-`!qC@G+(ye};4?d%F_XNx
zbK~pk$b?m$TG@@HJ|`v;#ooZEs@C0_%2sMcIox{*bi`XqR7uyqL>-kK8Z+ldzbpX|
zutdr25M26czgI&~l9F20igBe1L+sNa(X`@^9~@Qou`Ifey3n()gtA`)1&~u!wVBR$
zO0Q|6Y;A8Sh5wQzhQ|VE7W2@x0>z@aQ>WyWWL6iH1<<#hK!WAoI4OM?s!{Y3ou?<`
zd8YT(ui;#yJ2<3QJoijQZ63i0?i*L7*2dF8{q)^<99<S&j$!YlmeyR*H)`1H7yCI-
z*Ln`R2&0z08u{O>weJxb7qpC-oh~q58p^r5pPLS(F1gNr4Y}>V56L{2I-|x@j{AYq
z66<KmuG5m6x4b0pha@B@*C%wZ4b-($>~3d$*Y*?lh43?V?&HS=@ib|NmkxJ@6{^;F
zCE-2R?D!+Y)t;d$JUm#3N%G|B?eX?9&9<Zi->`{$_>*VMw2z3QW7dn}xjQ<fAlu>_
z=i*O7N{Y_&W()!J47G+Ty3f=Y)SC391A2n@+XSP%f<r>~Mp+UEySJuNAfebM$Gzri
z2%F>Ry_}a+RT~Pz4c@-GfFO=&V)V!hGuR@cBzP0r;jmb=l(}Qxn0KcstZj2By+r8B
zX05e^MDX=^ROdaUfn|@2-RP_0hfaSWB}VK#oFxzYAye4QWZm4PmaYreTXtzD00D`V
z+5#2@*L9-qi@s;$1dcClHmf#V^cJe__QtZ9{rqu%4QYX8m53My_A4qiSe2E`<vu$r
zB+&lEM8x;&SBddQ7}vLrhuK;=0;;Lspr~rVE<855(Z4N|3z0j<)7?2=r8Hw1Lz%}{
zzrguqc2?MVXU6m-Lby$MKi~x!d15t%P`_R@tA4#0KIUg%M(tU<Xi}af+#vP{)WvSq
zI@UK$Iie0Mh<N)Xn_e8BRy@*U7O|1wtELC5$62c5z6GE>x8^A+D8TYNkpoZa8Wc<t
zfTI{2C83IOS&sU0DM^I)3^p~jjk|0hws?`+$e|VRP}94VD)=1+2?s{Y`_srQh0o7|
z75uMSRnJ;u;i!ad+=PiDK$-r8Y$=SChn$3`ztR<gXK4Fqpd?8~TmD$iRf$xQq`aH)
zZL|9DPaQ-j)t@RVa;Fez5irfC1f`yAx<5OiH_0%3@h>f)Nt(@Q)uM~g#24Gj2ro~3
zdm;V&EF@mEa}7(>zY}e!lio40aghzUfPA+qH-Gr;rszx}I)mEr?F{Fa1Qy*M`HSR*
zb;QpWs@AHPNCh(^9T58x4ECb0%-1%edRl5WI!%<usAem~#c2?Wcs<&-UqAs~XItlV
zy(x(DIywyKM198fAApaf_?e?XWr?oX2>WVtDx0X)yN2dJ`oraqvFR8vc(;-ToSL%3
zZvsBdd1o|C_hzX^Q3|Aw#2>7;RA0=olk(Y}05-MQ87h-bmQ%Bk0bHoXNaQJmA>(wD
z&mKpXOvDPKc06x4=flZ{S}7EA$Z-|{U&Q_{mL<6}{Qh@*uUPDax5I^B5D3D;7B%Kr
z0+TNM6}VV4Q7D^bE5f$6gbMXp-@K*%QDQovSjnt0*Weixaf3&*!Ck5EncLBNxNAA9
zs3<fFnAIQot!CIwj&#F&*S}tQxFd_&o4hvlc4Rb!rpG4)ngpcQO}{hE_7Sz2cg;7K
zt@Q;tez>9Bps?Eana^`I-}C$)3F-X_9;-I>77W14U1iU`gX+q-125qy2Z5_$6B0Ta
z+V7vWtin`PB2x&<$B(Q%3~BwbcP7g2**Y9qL=*L>&g#cMXhC;qQk0RGO%gf2MpvOl
z)f$Wp<f3j}5^;Nf2di(ArVx_`yzN^Ss~)7K%rfsS?%|OT={G-AHAtM-+&@$u&#^%T
zgypN2pSO0uD#**f8tY&|J5@9bDaS{#XRcCXTWdcfs_UK%#FPpr*86j1d+Q~=<c)q@
z8luLl7{V-U5fUe6#V=iDVU>$`xDqJl^ErfM&kc#BhLlX2anJ<c6sB)3*2Vlb<hPov
zqS)pak5;qM#v&Ewc=Dt#D=Vz1h;>>%p1V9tw))+Rz~dQiA<ueB#hcifSpKjBT4OMd
z3N)j>w?u@$>3T^1xo@B#S`1sF`o94yXGVJ)Vv~{eT?y(xef|1D;y^k>^s~`+SO5VF
zP3m0saDi{+;2_`pfdcqsAn7d9XwbDPG4pvhXA~Fj&c!yBw5fWh2)a)8Zg3rt0?$XU
z)S-HpHH8=1baT#eBch7JSpSNx)l7wdnc@6x!hg8FMjZ-Wy}fuN`8xGSZ6Q&wxN-U&
zPw-w69h7*rW}!HR@mS8*ShULm%?)Dms7IytV<{eCuohc)(y5C+^kEB_@S}y=`n66h
z#>Nj7@px<W58fq}tl%nLy23C9jES}<47o^Ix6(L7MMZTyXlR-%NC?PvzqmPOy}7R_
zxldYJ6w4($XXMLnx4s*B^YWaaq~4~mHMOgTp%2n$X>T+hC-W>{JFNdFg6_Rs&?#^t
z&k-Sh;-+4|rQk1hb3cc*=OwlC42RjovP?d?H(Xs$p|8Z&h^$GrGk3l-j!;vIh<me@
z&6#u+xS3}h_TyUN2y|N>tI2)nRC^pkB8DxHl*eqeII^|;7rcvIUDx(k_+OVjZo&UO
zS|2x09nxtQ6t24)Ee<|XVzPF1xs6r5)uohSXvj)e<QGm;MV^bRjW#;0FjM(dLNeSw
z{3u_(`w3#W3h(8!LR!Ho+*NaS2BR9R$d<cgl38W`krjVYNTOO=Bna6B(+4>HR3UM&
zpRUO)S9c8I8PuO2hIo58xkRt1*I<X7*hGo1c=__r(CQM<f{J$r4dB(?Vp?SoKH`y@
z+@%zx5LDwl=Ou7Xck+57ZkKY4{4>JNEHr}H-3$&*)47>Y7IcyZ;Rgc^&Ey_s4DYzf
z_hf@d#f@PmXx*bsbndxbCCwGhiYiSm^A8F7Y?$m=B?lVb`z1dy{%mjqo&bL5-A7Gc
zkNpBMT20%cl_0tE?M1GjUE40;E}*x3cg$U<5r=}p>*$Zn1@fIBGF}(#m{U9Q(w9UJ
zA3XRylDp;fGkIqB_fK<fZZ3$z{1f1WXJNNK-vDc#Hz(^gs=RYFo3fQo?b`mFXItBP
z6F=mjH%fmgA^C7PiO)!DM^9)9VYcLSn&H#XK;>g(`0J73hX)TlYQybM6KD=j!s~5N
zWIh<q1cv#c9DzH~|B>3SLn-OQuz>3i|LvI?gw;<p0a!zX|Mlw8=$nAQWM7^BcJ#F`
zqU!2LQQ32`%s2_OTyv)M`@@FA>2wbs%!^z9+VqdJo;_LA6fD%WoGYA3YZeC+&w8#7
z#=@>sbfU5rd<w!8aIh$@ewtIP+w`u6RhbQ$8q(sV*1uRD$H2fS)LC@>EUkMFy0u*T
zfvS=2jOs^fK^;e6D#9*4gA<YP_V&&BL1M-GVrZ6AHEBWca!BjrW^j%Ux!{15Dx5zi
z%TGmQ9)KoTYq?=UPBB^K{*s#Y(U>84?S-x`#c||)D%_DX)dxgbiV6Pb>iSC7oAE<z
zg#J9IXI!{(MTJ&yYlTR>R+M57p+lz|UcNL)ihzdr?!8j)`2JEVUyM)imw+Vyb_x;p
zDI=q-4DSI!9IuoAnXdp7d{EBLTc4!?y*NHOD()wP*9ipH?$OY`$j>`v%$vhLcu$~t
z?DBB#z^JD+u|owI(2u!TETQ!QjWc5EuY?2f9zh~5gE!!G@H0=%e0DnWyE&uXgT=DA
z_hgAw`q_UM&$!+-<t3<&du6N-+d_-2Uk5c2LWp~Nq&(M$^M+q<-w2Y|6Jg~Kcw@ii
z((&J{1aq)Qh20qeE;qm9_Go$cwLN3Avu2G$Kv8OHc{x6Xs)cY|OO93r+BP;4Ihdz=
zH}bVBu~IaAeDn=ozInU<+yz*zYoW_auD<9{ry(+DW?m)2PKZ*G&yb1iej<5v(drP3
zjI;e4JiP3IB!yrlg9DV{gszicLta;83`xuFf86P5?7yOY8e;P>&nQ-sR#TJYE%SNb
zQ+YxBQF^2dtv#!sas3v$ROqb@DFSX>_6a#}mlb@8Wxe+?o-qrZOVBNtDKIB;J~p@T
z-)`-E2X{bA<ttMEgHjPGwv~^i`=0m3Z~Of{s#uri{Ml;NEH<zOUKlCQMJPHt-G=!N
zWuL;lpAUiG9bI7D+3GI3`c2_>aHd$$OfAX0vb1#k2Ln=+jO1qZ83G{>1@5Slbw<{9
zWles$4}!T*3kN(5r0(OHnkuHg^Jsc4-uJ98+{>*T`pkx6=sS0N{{C<Wt&m7(uz2vQ
zH14WxTw=R@Zmw~CLgT&{9jxGr^8#u-Y|Ua;-@RoI>{pvAC#$(0SO%&rrPw7=@%HET
zjCYgpmw%=Uc5|B=VL_a4+Dk(jwy8>M=gW@odD~<BPA9R)wbfsifU7xt(i>Ct5A4~?
z1_e5$q+;WZBk0#mD6_x9HXkkI<YG6RYyY0GN6yZNExG#okz0=(JAQ0G?qaBcGQ2EX
z?=`%i=7zL^b7&UIKtS`V+1!{#^MrVskUr{Ww)E835I<&-_6PkG88P{%P57T^V@`KW
zkKqTDz~=izX~N2~4L@L}Cj4{_K7q<3)2`@L-n-cMuhte<R@%L2A8|0D-8=z&IwyQL
zhck1Ta)b-zr7JRc*riE!ZHEkXo;u%exu+LDi07Z2r0eJaE~RhX$1)SeRCaSkXd@|i
zXq%7a_f!f%@&HCk?Rqzs$(7~Tz?!0+r0>Fy&_!?XMmBF5>y%rL|F@s66be=GKkY1r
zo{Nju7hB&LAI;l<td6*<G)68U?{D!0%@EoXjuq(=Jh}QcMB@Y-gmiTET9i%cB?yt+
z;c2FJQg*(Otx6M2)_t!mj?meH=J@&aW*&w}T`*t%rMq((tKodn%X%~vMGp@TbtmqY
zxbaxVpy<O34w@(nj#p6zgcb=YDS@a-@!T$md4BQvkEh5ItFNI;7W-&%_~k1*Oe4bl
zFEqG)>d$1o(6!MHHWFw8e6~=GB0MivMUYe|Q+H=W_kTsBB1`YLZf1(Gb4PY+=WpiG
z;50tDC9O=D*LX|TR3@6{D~C6FbpIy?76y&kxm!EvK^5jp5!AtU|04tEc~2wTc$HZ%
z>(z}%&|OtP?8iOec@S(T&6xLhazMNCYSaYKUXoz@d2X}*r|FMWJ>=fuoqzu0SG_z{
zaMIJ8tvMuxce&%6Ne@6hSzIXuUb`<sYHTD|`#SaN_QaeJ=Y=DdR2YSJQG;%To+rR=
z<f>_s^h=AEKLlY>+L}$J`y^k&Z!qmoX<dE(0M%Eu=Y5aGM9mgd0tG6q1?)e^Wf@F<
zNXYTePXbC+YmK+{T#cczakaq$4Pr0e77uzTLeoW$l0>Y>j$=@ex-k>PK5@Fa=*%HJ
z*Ge-(3-xQ67#SC~x0|ziAO7=C*QxO^o-AjCItW~C=!AW>jvL&4_W`(XZ>p$Ppe3oM
zmI)V5(TVvbkhej>g^1o`e-vv>a(>O%LC8^@dXSs5dD;kz7W2M+3#Z_EuA~90rhMId
zBy{KiC}9$s@T>BV%73D0L08ICFRFLm@p4iOH(>gGur>e*G2ah&-q4l~_;%lKrKKSQ
z6Od&6cVrKC8|-KphxqFc?C|1UYi6XDNC<_%e+xQ{A6~j&4`+wZReLTi?|rd2B82hS
zMasAOYeo@s@a`^Xyc`c8FIq<sV-o?C!t8t(d9e5p786*WKDuT9$(V&W9`Fv+-u3u_
zX2_B*40$!}O3R?Zw)Xa|*|N&u+Vx|lIdck%(6~qTLT(l#>$W{}Wq9>_hwc9SklW^o
zCWuMkGOB^ax<>Z&?m=`{S66TflQxF&0(TLQWSq-tVftIov5r5e>{AG<8rK6S@ED+K
zxAUV~7021o<gMF9yg5i`;BpAsca%edf8q?-A!NKZ!SE@P_NWsw%k%kp+<yR5@&t0=
zJ{Muax-v#XgBO%OUaI*HjeIpbn5jjS<!am6+e1)JIm6MH!SQPRk^1JM=_wPup^X`>
zN;QFd3hmBRVS7TXv87I>&j5imJFsjv`9$nHAKu7JYpSI+85;MOZ^6Ry$e)Os7L|rF
zI`V*CMOpcch4lbHnn~0DpYWyrZB^P|1{6}|#~x_xvUn@f^}rg-!D6=6u@kbBhkSei
zP~u(&Vu8u%bO3Cw`1Gj`V<C%<4#-c?E4r*MoNe&De#lUzRJ7g4Y6JAe>Hs5SbLQ27
z6=2h%APymi>)oo3)EtehZPGCk!W_q<wWiI`^)D@e%{n%)W)f)5_kE45W*VYCX<4{$
zts!Vovo_m|@t0S~$u@Z`COaBD&bRBQ)FP@*PPDizYn-;JsHtHSjnn=gJ|G)J$3*LD
z35@0SYA-zaFL-wkef?Z2-~o(}j_o9W{w5o``W<?40X@k;&n?gOnmVw8i{D5U1~(_)
zBf|w8dZpxKUau$TcD)GQWPSwalfi3mzv5khJxWVTladhs*_wgNn>>ccdd~G^T}Dw+
zv7WzTs=_ktb7<W3pFa+k8$U%)0UrqYjsh)2mD43%ROkHDuf|_H!zgg@@PM0l`hS>v
z>!>RG_3Kv!Boz>lE)nS#kQM<^x>LH5?ndcSq@+QRR2u0n>FzE8=`N{r`Ru*l_jk@1
z`;7OWGsgLs=aIo$>t6SLedjgjXM%;FL1kopvMv<n-HsM~L6V3>+?fman{cqTs4B_1
z035X}#t5(v5a7SA@v>J?ILKn+OXQv4<KrpO0=*s5-rKXK-$Ozq<jeI@(w{}ARrUb&
z?gPd>IoN;w8{*4qZ$s?zroq1}yI+T%mX<M&@4ISvK|#BWv9WR50eJY&ym#`<n35CR
z=jv3|`c3+@dOA9icr5k9t+e`5Y6x&in)hN|p?+Mzc*LgCY>h?xwWKWmkMZGr0(|@%
z;8?U^o<eap;qOgUXOv)Di!sCVNTis2rrkO3paguDI$)IZ>i_<-Z}1YbNxxlB1zU8E
z>8PlDXCH&=$;pK0|6}9_ayVIq^%}dO?#;~1jFvlQTzoup9ABxhrzVPywss1<ITUs{
z5$^q6T?cO4mR43=?yE|W#OffSZ~s7;o0sv_Zh`_z5PzHZUyA_xtv{8crK4kEVbMTr
zGK4ZnU*QkE{pyTA+)$cBnudvAqM7d{RpiRwD@P^Ex76Ts2WByKN;)t;Rg{!ixw(~<
z<<E&aqi&^g*8@dgoI|o(!X==Tbg9qpW07~BQ!S7>{pWi|Mk*t;e7UVJCq5VHC@Cu!
zQ5hJtV3OZK6!F=Xt115wUP$hZ?*)@mhl%uaKDgP~y7QIU0EFY7HU6BnMuo%B;NaNE
zi0O0|=LzlVr@tK{$xCYWFJCSe1c*Ysb84ECfWJt`$?4-iFF&gJL|a}w+lh%7&&Y`6
zc>44@Cn6>W^7)@)qGCQrhJ=Omb@u%XZhHl73Cj+dhn(`4Di{!ZfD|gY7U&olTBfX*
zbo<=|0IadRxYg27Gi1AX$Z{1_7y*wq%<wZX^&+X>>0eZuOP^BTFgLdlnwrv}OsnO|
zf`~}N{#6zg7_0`zhkHAEun=R)e$X#)8FvHBd>*Zf{?1q5Oqp$sqIW<b^?h9CXclAL
z1M%Ev?$_ywHR50+SWsM;3)nC-^K|cf`&Rkgc?<5x$n-m!L1AGdV?z%{5)%mUozCuv
zS}9D-A)zk|L!A`+;XQ<(M131TO`VJ_D%UsA_pZbf#*GD*uOHdMIaF3QVVjQi2y4sq
z{i`@24QtUjsNu^>4z`HiPZsrhqMt}4v`{>5dM{<e6f1Sl^1K@C$qozC_>4u*G9G6F
z1O)f|l*<B3TDq6~W7k9nD-RtHFYn#!(BNSCdS_c}*%VeTI=c0e=`z5xgpu==_+-6o
zKD`a8k>}2G@V>vgDZtJPjSWXjNRX3ik_^fMVibH-4Z$6Cp;Y0gsaXNMZ$``%pP)40
z5aY9WG5F9j8&NYG7#oMwZ1$0Ag9Qll(G#dGqIJJG1B+VlBC;Fh%TIBb<OskWNh8G~
zl0-iw<`$6uDR6Q$i5?;FH9jV$4dj?X#(yzU$5bAQ5k4Tv6cPW}<l4E$OxaxRJ}-=d
zm2wW}u-?vIG3q;+aL6(;qKr=ReXUb#=&~AfQsaD`)4EXSIfpyrUyx$urt#;kb&4+z
z0l^R5eY;AbN0>U7Pad6W6BLoCdn>A{;<L><d!(WS`eI=={}P%Bfg}dupPfQUhHTQB
zQ%+k`KV-%y>|@Z85Ulp@A3pZ^E-$&QKtWDM&?J`BOi|*|#-Qa|%2oK9kS~v7p%oJW
z<0JQ-;qMnIo`DNQzgF0!6DRQZH(4PFQ|q<tbXov?mn}x$^(~Kg1A2>|*=QPkM2)dI
zUFc<cQ%homj&9G@IP%4-4sJqyT15m*;C)Bixuf?nP2?_#lYrMokL%exg6y!c|9lSk
z0V2yU+hvoQ_%#^T9{S$BUUtJxJCZUrTKl+-#;m|>#{eZ`BJtWZ#HHglp@=NDii=*K
zVq^QqF>d?&#2~%z_aSCa)q8YT4NY7&DM7#>q{CT{P_Lo6#Xub8VD@{^^Ok$K4LSsT
zrcs6L^NTk&aF1fK0K$jfptzb1!&3jMwK@&oyg<OFW<~<8m_EU^C@K{A=*_zC<(Ql@
z`*Z3dh@8_?pa1%<MBBWFCV`>2u;*R*_xcg_!BkAbe)#tdN4e5ac*^;9tmy5;yLvfU
ztcLr!VWxg2p{PD*c>l$z@n3!n{1t7)j8u<LdzAdcLX1>`)G!vNi^{7;{uqia9g5x7
zD^zK(ebqp<=%b(*pP8NR^d|H#uLFa>Hr4A@%X|bMs=>5r-<AUJyeSK5j9Jao-;NY4
zs>ZPa-<TbvH&qk{<i9F~Bg!|6KKWIP^2**l!eQt2(8G#}3u{G|el}w-zRWM|-}}Wy
z^nWO4mSYT;7QPS?e~ePl*g`C8d+AuAO58v*vuXdQ0bf7MA+PaL+pD6>#k+IDAwKqv
z)3~XpCb~aR)ME>^p?XX33D@5iU(wtzx$2oAj>%J;iAu^pMe4>IC^uQ!o;!Ra>SSw(
zn9pZNw%XTc^GwVsegN54R|5l)*fAMA`b%16CP*+ne)43;ppj<AXtvtP{Eb*uVBJP1
za&RF3vg*nAj?0%`&U2;Vi?vB-mKz5pzgj}xw?56$iG>tT<t^ujJ1kUG2s3Y8CO>=6
z7oRTd{&N1_QzNG>b2D}Mn)8{2{zE^Y-isFf$nkT(=fCl!_F~7Nbyp>Rew!`Rc<=MH
zobp00u|At&8y4dD0<*z#3f?(K)nG7B&#r&{h2;O5!v4!}_J8tYMGI&{0bB=(KUiL;
zI4#tU?v<95$Rs_Rt+Gc3l`G5dY`qDXzRS)gUT1j5z3L0QH;V?(8++6bTPqyQrq_?+
z?J>Aty<#02QaIfasPw*(FXrm$>3LJ3r>LO7u4s38r2A~Cr9GTMrN9W~MUdTBc6cU3
zAr%(~M~(Zba9aqk)VloltX_x^=jAiSvp<g~!UzifxPMgJ0>-VCMgz2a_mTyig&`5d
z|1qsa{4O#w1H<>bNJ#lQ6#;ZlAlEfjZ14PQ{FNd{6x>IrCzMP!eSJls(&N|h6b%bY
zdwI(ChH|&u`P8%taOG2lykV`Kt6ciChfuMstSo-X{%9f?HX!K(HLA{wfACqfEoW+x
zt~P(0h7<Eut1AYA1qaX`J#k!_K-o5hFFv=!L<ief@zGpG1|}v*43lzOyTb8^yQDOc
z%@da8A#uqt#1xqyH(c)uDGdyPVb2@%nMr}2sXF{*ok|;dWogHu)_rLbqOV?4VUuS!
z=Z9+$DsVd=VxZ!%U-aQo`OLq<>-c92+?iBVU-K9=p;WqMW(GF~EYhMh&O38~X6suc
z`de|>1X6Nxdl_`YY<)0=7tFeURS!I|L_WF+q`Y?Pde8Lr>(^4#MGtiJQ13q{DID%E
z-P~6Hc&h>+?LFO-R6!&t;V5)2B*SM(f-K?*7>Pjxl*7CtVl&Sx3F(4W<qWe<QR&;p
z^4OS&cvh>e-c74)8Ip*os8kMTY()?7aDBNC+tHZ{=l0=j7R2NCIzBJMlLvA|0>7*F
zg_8={H8oQM?h-cm@CL;)>ljV*d+#6E>*{_W8kN(oa@&SH8B^kT6`5cVUwlk{^E(pR
z1b$MjWFcqsi2+KuWKN(WNoZ)qq+jRp6Y3OR*B_eW%!jKifRR|lWdETtN)Hr~8SjNX
z@Si|-1ae?vBRbVvca;+aEe~S4*C5KFRc(PZ?d{@nhCOc35_n&*$QpQFvSfn4c;13y
z1%hWBr$ItM0596vCam<JLF<K)u0&h{f%n;78ldCBk_29d0;SHGfq_r|Ty9TU2R6sb
zIIMgZTLR(MAmn<0aeTTvA083{f1gi$Zm^Hfi!~Y2iIcy!NI)U)1ICT~pQ-OEe(7*;
z(SZL%^M}pI`0(avY2ue_uz7>vMwCF*pR%8UyaKT>+8@^As{rkQ;sM&4s;UYHtKgPE
zBJJv5#+rrNHgX+cS+%q<e*^VCcqkDr?hUAz;qTA@7d}}o4O$WdW;n5rb07v$4wM(7
zeu|9Tb6xIMX<jQS%4y}>=!#*8Pi${({o--inmbiyF6^&|7@wHfaC&nq(|DTisa04M
zu$}!r9UkHr5@`Fqf<!48GBkV^@otGmfflpKM#{St5_lNPB8&;1W+-(LT3Se>s&jK{
zcYKrQm7e}JFF$Xx1O#M2$(zgFN4-~3UZS9^+&exu-f!JEgH(;@NNHYdyPuo8F17z2
z-?+2E{XLYsd=X@1d?TT-0dAwe6cqDsxd;4TsvS2v7-;`u34}eTfn)#+oZ#_i{7Kx`
zIkbq`6DNIrOuBKnt4|jzM@C2W5K34WG&SMiRcd6Bo}JzOnL)V(n5M)Lqya1|9vPGm
z<pROzeN7?4$vL7^>(N#oc%5aE;W<AR#+38@I})M?9FA<d-gm*%quzB{v#JE|Xr-69
zfr~j`t_7D|`kwUexb+0PA;aURQX*QUMx>VckkB3)9$s0wDgDGc0|kCl_X+v2R=@=`
zTkWWMrUjW|hl7@6{Ryxhn{)$d73o+*Ljx-zSMkZ}+wjC%OX64t)fqOj*0&S4K74-2
zLiTH6pwcYr=cCg|Yt{rJqW%4S+kI3bDAgn+ATTulV<{&5TM1HE7KG8*uZu}0!s$r1
z#(R1k4q$0S_mj>J=QUk!(i@F~q%%yoZ4x~#N=-=6So=uo?y!4@TW`s)*cbWuCXLe9
zY}t@f&cI|G%lzQ74LxTRb_Q^x-yF&H{qyp}*1+_8-#|qLMMAHE*lkKa20nr0n^%~a
z4KAHbIyX-Di21#*ADxJYj&hohU}>YSI;RoEvfMP_#Evmx^Ln2Bwq?Fa@#ASEV!TBU
z?siW<EqUFy6c25rn1Pr^+G}q(fY;2Re^(J$Eu5S&5T#pmIREqKuP#%JPLwL(e4DS%
z`$kV+Uw@XjtPNu>(~$vq&q8+*Suf>|09%BOO}5?mA1xr&xK#ld&>0!6r@P)iYaU-K
zbp@_n9!(zVi6A%K6q+g41<hSgd2=s>GZ{o>hwqLS7y;)B#t)jtw;jz-yDld+G-@;X
zIXOA6wMwD$)CkVIY=`N<9@_9@*g(Fw0k8Rh!Af;_Na5mW=Xl@Xoz2ZXq6sdmnH<gV
z`n@*=T6Gy&S@d=U4`b+g__%jRYZ|H(%!jk25sx`7&3jV00fL2OqX5;=6t0_N1)^Jb
zt>fbeC?$NVQZhsFQKlf+;0&P8{AmYPF7~jHk7lD?sEcZBzQVN5;9D#ZmxV*b(f06g
z@nnV8@+ZjIC25w!nmj-|6o1p}<|sHcbaU3^9ry#oDE<XVGHOlF%i}jbdes{9)gT>Q
zVO(~ttN~}65dhvXl<*lSdIfE>LKeo)qEDmICk^~>Vhi8!>CK?5p85nKtQuh_(&nh3
zX#X-?ThM+`AbNzKg0A%L90}`3UvIa;6~3M>MWbJnp$hg|2lm~7R;7`_m(hO$Kj;<t
z`TGNXUU=Yat_~T%__j43WRzso)J9@$<j&1|b=^fpD73L|@Aq+5{68c*_oeWF?0%1y
z?4P1S>ch4l4OS0t$y)bRg?LD6N`BWh5*$3|K`V8@nq?grHwg)Qkot%#fc+sCj%psu
zHN_K*LpZFb`mYk*JbKDtI#Q9}4sxTv(ke?jAbLh0DnXX{^nWT;|0hGx|JJkqzxlr}
zhaMezV*;BMV08M|`oA%-grs@o;s*u>c#pRPz3&_9KrqaDXQZpWJ@)(qq6gYc%`U|u
z{^5Aad$8B3+dmW)Z^tdZ3JfO)rf@gbi)aqb)ghw_@0-~o*Wo`fxUoT@K~<IOc!4WK
z?H?9<N;!l<?PUN~I)9rHq;@KeHUTZnt*)tA%(=LT4Xczxw<`@5m3qmwk1YZBBR_qj
z&AV<3RRwty(h?i~==jQ`N;J|W^Q~#cakCJK&Qq_s9^0NKB1(X+0<?|(l$r&%qch;>
zjgE{Y@Np4yJArS|LXR(*%YbVRI6<ypPS>tK>gwou1H0*%OltbV`N}ebwVjT_h%DnL
zFfx=E=YH&htv0xgGfgt)s~xj}{b2Ai{F_pzR1d}SGLA~V`sq<8^t#1E-373lNbyJo
zTo1xp0#7<SE^k`e-Yc<lR}|&^FzZ$^$$l7kzs5Z0Ee5%un$2AsJD^t_oFC$ol3F?p
z<>mUuamW#H826PGu{Jnf+?NrfstK?+mQ__y(4YU4J-<+F@RCHpX$i1ez#)fFw48zx
zuIt_BHZ~o9?j_c0UjP?uVyslF&YV!wd*f&lWLU5$s;ibK2-pWyRngJIynLfovEMmN
zQ(V0NG9cilKuaE6dgW1;d`=A>`|KPHUm<V%R<#gI=uAAEyrwz@BFHfj5!<7s?F+(J
z@;ojbL4K{GxId-i!Vc9tXDp7tt+@PqTz#emviVsYWS+j|=ab^%@|$%Xfr9Y=820Ec
zUtCGja+mjjeLI#>t9WN#`A%>rn8XE~YRk*}I+w+7v`Ux0)m#jNM{XoLD@)M*`Vkx5
z{z&InIMc*)d$Wb<vANf7?Cfs<`M;NVtv}Iod&*I`4hSs?$_zVha}(7@%MkiLC4a_f
zoDD@9qu*52OH3&fq!YPvwd;6I`n5!_vSr_w8uxF`es6C>H`y2|5U@P}KPm3WvI>vw
zfkS=*Csb|3L`VAkX4O}(`ZHgMja}ostyb*OY1!}o2~$98HYev5bk;ZbTDi}$aj{9s
z${rpZ{Oq+kTbNtzO@tI+yeIdb<iPJ@9A3xYHpgA(#b3pl)hZwJ@Tm6?(uTp#7<wY4
z5?GyfcSzxBOVRFAai;;%YNB#<u6}T`l;&qRIaAXsT&KGr>bwji`kt3w;@p29Aah$=
zL`4FPVQnJ%e|~hTGN=Bv-L98de_QnGMHnjb-rbqzp4~6V%OlZjFq!vq<Qzp`lhvwm
ztFq6&za*ZLm{_B~(g387nc5w%gUYwi#b$B!aXS%{bi(&e>*ntWgznGG`kMe^c@jqK
zepo%7iz5y*##+zHC@~>ndT$=#@ZSoWMjZfZ$2AvzXb6Ne($08+rqVZu{Usye-mmSl
z&CSi5BLE?B^<C5aurb=7-0(On#i--UdvMa8on>Y`_LvJo-{JQ-%Q2G7rdOs1wR*7D
zl|#7B*S9V=_ixG(LGW%IG$Ui;Hz>Y+D@g#=fw^x8?}|xb^tUv4EoZ%duU%1)Y%6x3
zT<|eCcRQo3Ra1h4ZEMPz2{I(Ve`e9HH9VugRn>VKSc6LsPqS@^H!SCBXUi~|WUrEu
zaqoZ1Q?B`3aY|e}y_WjEh!n)BB1Meg#d#T#yN7+ZEEpWnTLKr=P5u^1K7GmwiI4ZO
zv?4mKNw?W1xJ$n4%s)KA-<b#uPeEx=Zt$9gwq4<`daIBrf{$xwzJVMMPr&g2kwXy&
za;5K|lL*;<bIR8kpor4~8u{*(&;rI6K}tbNDgh2QHhJ*dk72nPOw+W|K=oB-rb**a
zYfdXB@ftl34;!<fAhhXeY2BlV%8y-XiegeH<hj-DpWn_SoCu!uLY)f&Vq&kej$wx+
zS1)2S(;O0LGBH~f$Nx3|ylOvAr9dqmn&qamfR!LFo^nj~@Zl4d!iB@1;g(;%ee2TJ
z^B+aPgFjY4tNcxFWZUNWoKLoju+8l<tI<d%h`cpp>vn^gfY0G9C)0=;!Lx2+Ld}&2
zX`e6VJm6`;i#JX-B65Uyq(+uTy<G2hb@eU$h)$?mqnUDYzk?U$%crF1Ben&_`bDtE
zBYk#taw`9l+BNohjb*PV5H@*rCtkjMw`B*Xop%;W3bga-ncZqLJ4FzXW+cyq*eJ0p
z1a@xIy{1zce7>#0IjW@m_wD~OS@E@~Xrk6g95nPsPAoNQM*rmZp9XBe50TX9ArR>A
zZ*HE`;Bp?~iF*9H|CLCZLAz7LpuF#0OyBkKD#dn6U*sZjUcJk><eHOmv+2Rc=ia(E
z-cx07TX63SrofVXd)8U^DuAi-@yicH%&X0}02OJ!$~=&tqnR7&YVpRy+`KyOr+&eQ
z20ys)@t$%5DMI`M$z8=NC>DT<S-9Ql8DNrgJ)6f<R}*M#xmW$}0>kLp{m%#&!IM-;
zH!Q+U7CgV*Z=W)4IXzq3QVuGTG?z#?OAZlL6dAraCKgTwT=l?!^)BAt1m%M>h6&Uc
z4=Mu@5D+FOdZCm=RFj~-i^9&((3I7wCkH%@tgfz*^JC7ihM0BA094&Y&@~fc^}~tB
z=OkzlMVveuH^yJ{q0?Ol-~kJIO32E_#>U?4Qk22pO(UD|$vWJ{PAcV@*N~qr)|YjT
zRajG0{;=|Qd-^j9HDSl;c*;ji62SQ-`w7kO{QVmyCZ3rNH;YO3r3$o-NlF~tr{q2r
z>f^kehx0@;z34d{%8O``tcADi?CcLe)T)jDOcm!zG}xFgEQ}}~gnuY+CD)KrUHxYt
zCmY+kr8_Q84YI^-Bc&8-w+a`puL6sTVQau-tOJD8xhi-3Z;0W`eaY??)MR};laqw&
zwI=w+!{mY<J!7HsX2NhQT+(*CUP9s(RU#hqg0xbc{+)}Cv2wDkleCnem+o^_p;m+`
z;l_}n`diDb)$+%!+6_dQhn2S;*_zD`&EFvCOI2M?Q&B7^0%Bj!<T*d|+rhWKt*XxU
z(243=7wu~i$3RX5X;=gTGG=zhL6#$y$(3M-3aHTD7$~}Dsm(Cx>$Rs{o^10a*>@1m
z@N#nEAt8yC*NwlmCb?hzO|{}<x{pueBsQuH#pZeQz<2GsZ|Uig3rx_<HNx+8fXj!c
zWNcytz!nRIq#W3^`PF>W$h1>XSh_g92@l0PojN<DHJQI^E333=s-5%vvwVA~RQ&Y#
zrr@W+8XRUdG!iOH+QW%8%OvplXGF(1YO^JfAj7`)+44bDB#jI~cfy$e;5Q>lKbk4$
zt-IXW!M*}n`~>x11p(FqhpGKbM|E}n0oK^2z0@54ZKcO$Zzsb@*c?WFqfW4*<H#PG
z7+6T{#|zj`MVoOzFfB47;$wU?99l|EP;toFFTcDP&iY_IQ|r$sCq?6ezYmPKhtJF5
z7*TXyUB+;Hd?cE3dtVo=uwTg6M&uF7hfZ8JCUic8%6@pr|K}Kk2N9KjjxiTk!!*py
z1<t9rtE;QAkl>&Yq{nfYTdkPgr!<lu7ace9<-O(blX>G_IM?`mD$O$X?+NR{rV1#&
zYoVuWe2c0{?@>WIMd35op=XQEKwkIw9kjV4;GUnC=WH?UmjJ$W7VVPDkm=DMKSrS6
z$Mcea!Zhz+$B-T-(RNYjwX*ybq}Nu*b<O`6>q!6qb`Htjr*wBY6zx_mNM^M{JnUXr
zd^d?R(PB}QU-ZZQlq^rJ?C17@D}Q`UbTsxmMv1kpFh{{n(x&F$zfB_^y6E|0qi(tS
zAz;(fOBk@hda<jc%WO}CN$6h2ZCT@<6kP?CO6^~SSg2XwK{L72jY1=gb@L!Rj^ka2
zgN)Pt5z)#A^~!2$ehCTRst1}LJq~-vrr&wa8yqV8O8WKBRvyKtHW`3O7mIZl^=8}0
zlxNnz(AOfS?*7@!XVRb4b$NOhH~c?&%`+UYcBM2Q<Km6OS+ON-I_jcybo&GJ>D*Vk
zQhI-)&cU=Rv0(mgSno@rPLa09v#%7aUqWcv!X`N06*)9XJQIBK<mEa2ej}|KDn(73
z!rT&>nIO_7Wm`4Z_2cVw9Z7SQfgEeiaLQ+2RhWopL#PjrsNg?5ipf<eGcQ9@CiLMz
z>r=o+6#1tHj_Cirhaf8&sLZu+&Q?>aEVVye@?yyQ;j+DrLyXgX&940z+Oveb4%9?M
zN;B=z15!mfA3w%Gf-*GYtS1=zvBHyW-T{$a+fea6TQ4%spgIfI4|a~yIJ;(;jQg}I
z)h22nZb-&q)eHlnt!=Tzhv<w9xH!PaaHoOB`dR??%<r3U>#q8=+@V^r4~zQVB)bqo
z;<V#KkS!aU5Apj~@P5IOJo4Pv#=e2eZDbEL7$na8v)ATOW7Bh~eR(C+{Az3PHC3hG
zf3$$Fn%L98{!!ADOsuESUW&$yp<}H0-r?|VeSO{Y;@-wc@l|J(32Y3joj04W6?lNJ
zaqS}pb`14N9ti10(MV%mDx5E6GC;@zcEdGf0uOO;xUIHmE!xbiRIPWpLq9W0%1Fq(
zk}|wduQk;M&KWwfRMTZW!D#6k%L(~25(xUnCT=bbZM1d{180t$&p4w)!0k<g>rGP&
z_)Ae$?-TKpv>RDkDyyMsNBCk}{2d&vuCk88j^c;2B_t*LlPmV1j~5!b6DzhRYIb!Y
zvxUzTN3&|cR5^T)xZ?Nv`U&n3(ledX)gC?%n?e|^6@R^Lxk_l?5x7`hUScmTnH&xk
ze^FQMNa%Hc7)air>ZGf~R5?NZvGB?nA#srTDPzy^gzX3k&ktGQ_owa}5uE|S`tpKG
zFF#E~RTaoxLR_yOCCZf5TV6%Ahl9J%ap%&X)AAd)shkiu_wM0ZBSfPt=4u52fxc6V
zbaLXP{9UQjAkJxfDo?Fm6ubvu6)<R*ad2+P$moz1hm++(XU#z*ypF>Be55+v`ZcF~
z`L7!AtpZ`DFTTcfypPGkY8?CsEb2cc5xe)idFYH;{YkNRo?Cd0&Muz?D<Yrn8lN>F
z7|uW7A($bK&}rD2E29z=^lD1aG&eUFxr+(CuvcgM%llsgv!qjxPqu5m79jIEYz6R%
z8`5*lkV$?n=tve4-y_yfA_4P<l(h5&ZtbVUhrOhjBmi?gh?d0fD+z8AyB~m5aaxNM
z3UZHXzFOCHhfC8X&p@)(?1fYu>sXpC)xMC*!zx9Ax)4x4AE*%Klt)JD>pf7MC|leb
zX)acWPyJN4G4x>{o?sp9R!P}i-a*0S=C~l$%MYAvTm_mHf4%0EU!aQUJ!-%jPRk7;
z&7r{L-cTDlc&I(L&N?%@Rko&Uq9{XNp9ggZ^=#7%Cex?LXFd4|xtfi!{EMK}cPb)U
z`I)6S&E#Ma9~l~wl9q((po<&k2M-{n_OWlD(a2uVHenhMx!J1w;k!M7cx%>2hZiMG
z(CrQuGpJ(A&tohr`(b0OuP;_e0;)EN`vn2k!p)*c1(_!V!7pmxPw0*7M`DHYb5Jlb
zc`jv`5w4rroFcxaw4ph)l0ii+rx3J_?noXh(CTh)hyBX#Ruwvj$^I5aQa?y`)WkTh
zmd|5YZ(Zu_9hJY`Oi$0dg!bMyZ;~R?nn1reql#TE13yB<XT9mt59pFyQn;Z9djEd0
z-zaY9XNqNx7uFHZeTd*PoS=Q<QuG!`ylMDmFV;1_D}PVVI!W~l&WxMpoYzI`-tG4A
z7A+0-mwzYJwu;A$@)4gKgP$|!Zr5J9c7vB<Y-);()C2vOBk_7J4Bu<>bmoD|^ITv5
zLE@{*%Ags#)%=5l$8bWNtz9Q1CB3)3=e8~2x$&6o3itDA1?xj5?Ypj^hI|7}&sb$F
zTu^23KVKF@E7kpVC4>eKJ^z5%`SGDUAegW;4NlZMQgyjxz-F6yMo>pZBTLD?W|cUs
zI-$Dbvc3)J<!v8E=vn~nqt^EDgjlCx-$0ygDGDo;m*W=Y5a~2mZxSGAF2yvt@);za
z(D10A=jDN8AcAj&sZnlt6;L#U@#~gTKVC4R%BO(l6S`hrRNH_tpWb=3+m6V$(>Gg_
zClpjsP^pFErK%vozSeN=32$)EUhGlbsx878EpZH0tDGSJlZYy<wrs^Zr)@VoJ9hm*
z01WGwE*hJxEYPnN21jiD(Fw+WJ=wXfq2@Keq>ydJ<U(Ci!v6c-gTwV<6JlcRk4LGm
zUNADWYyP&HOCn55qjWzZ(+znJ@LKEnDi+o<v}wBZ$H@1qxh&)wf<+AcK0z0l{?{UZ
zd9^v6TgYfl*M5FCCcZtLeVtu?T0!3_)_{^@lK?ZCnE^sSEyv-Ff|^>19u_VM6m0=(
z@06`IoR+*itYfBNX*hRj_I`5p6HrtuI|{hp4eTbnpK6p_g)`*A7E7q7Lp{r`CZuOq
z^9^hv6ciP)(c1-3)BFxQQv6b7USNdkt{i0g27b&_?p_VVX%ujCXq!>Ar@^=9C<R&R
zVfio|p@1e;^*ZV&tgC{ygD|^T{nxIH&hDy$&-u?K$1V8`BT0Nfm;|Y5epl&Bu6Brm
z<hM$hL_M4H?*XgB&z1o86_#Vx;SY^cgcp&n7M)nz;J@NzgqEQw*8NjD0b<yom#1i)
zr{6UV;|WbSEH<K3tkRNv++eL2t@L1NzCn>~JmA&Bw7!p2T}QUOVaehF(#jRngMWUB
zY&Jc+sKU(5cO&|Wx52+onZhC^UR+){)2~ip1?wK~JbJ`F$tv$~-MD)V4-`(T859md
zKsgw_6OuE6bOyKO+238h#q$P(M<_m;|HS}6tEwHm=rrm%zT<gzL2{P)Thrgq@9~q>
z8+}9A4vMy_W_3VsMiQ^*XFAEh+dK#zi<!X}2#1hRz395Rts5fXJ%#&h6pe>{0;?vj
z#~a6hFp1asx%}tDgUdG5mIjMHoyyi|9N4vh!abI2vbKG-9qVY)uWdS;MWuK`t1{OK
zb>MXu_Z`-!>?eYX;Z40q%$AT3&aMOw=l2GoV{lpQOyxs%oK;iE`Z^tCFZ?l02dSfw
zn70SY54p*WI_+Q?E$kN340FwJn&K&0-JheK;RcgJuk)uy%UQj`IzIky?d<Gep?ynP
zKcpuVp9OZ(O_z*tZ?APbCW29vaPRV5GV2%08E&QXyl__1b27zX`MlaF7de;?oPO=y
z_7o79;g?PI>|V1w7$KZ-hX>Wz__$8J-7%o5PIu02r!pi~S21_z`&89uJfa&2Cs?S&
zKP2)Pn77~G-aA+?UE`U&ITtt@Wxzi)$^kfTjZ?3|FW5R>#^e1SE0Y8bl>kbX=jm}s
zNJ=c*cVbzzjg5^)@->~eH}EVxiz5x#{nwIl<3H@fEx15D-23W}vb1!5l>x`o&oMDZ
zA*f-v3=D5yVYJA~>5lJBTj$LdXun+^s@CAtHt$RGMLyZ#qhRDuvQ!~3Md(IBcIi2u
zZjqJ}?E2RVeC2SBg_m~<=s;FuBf?VskL)AUy>@E-2^N!UPOq+np7E6t@EQ9-zN1BG
zJM<yTq5DOFc}y49oqhGZkCkK~it17aEZ&sJ?~M%^G0dMGuph%pL~<{5xJl&Y<2|iz
zTbw7|9j{c`xi#y|tKzO9r&wW%S||)Yu(iJUP8AS#oOUOjp{OMAe$|ug$EUyNjssnZ
z;ai<8mAt=oF6r^-aJ9!c${N?nxDj;Ca;y2^3UGj49IeL}dK0X|s@!y_^?hBVsCEwP
zG*pX*;JE)T`W{gIb8pc%@!6i&odjUB8gGMd*!r!hDKFRCu4wWu=Qqav^;a9_-=GAe
z+UeNt?;=-%izn-Us;GQ|F8fzSt~99v?!~4}mpJYBTb}CHn;0bhkDc>YqMzAYvwZck
zrGm8&`I=mU9!D-W?^~qyZSCwlPPWdW^8~vVIzJzdESKP1+Wi#~RB;|s)_<SntAGuO
z*0Xy^%mYx%;{ZI2`Uq0AGXw8Qu-BR%O`s<8I#jx?Tuu!BMKnOc5o4AK7tQ+r+{_Q2
z3I~Wl69=h>?tB5@`9K#8$_FQTc4XwzdQ<@^U-@C>HG=bcOS`Nx+IjDvU$1dawx&*w
z-}>1k6q8PKlk*lK`+JWc*rhRRR=@JNQBnE)JL7}occ=jurv7yXQy?7J3e@X72AiuA
zxvVerek1EoeG$F_=Q)UHg<2Kw^BK2#o;$UNCHk54``bfANgzXWU#NjEG$e$G*CYCa
z^gR`Qv>LhL;bHiq@00L)*jOK~N^@IG^jQ6!`bHTF0ZIf#a~D%(n^Na#9^a*2cs#n3
zX|_&S^u$KIIHpbd<9Yt~JFYb7-9LXX=vtebU+!F8ybHg*x@t@==w%2a+8}^?db|3d
zHpZ#FZx(oj{bS2Eh;(!lN_3rcbW1e~K>AYp(;r@r)-CROGUF;Df^bjz-fueX^e}YQ
ze=hfuXRr>hfc8;ce*y0%N$No2v&FA8b?&DlgM%P-baf3yVoO>`<q_Si<)L`V#&h9#
z?*&X$zyd<<yhm1@toE@>$z@Xf(mm>v$6s)Gc(9G1<lPM;`AJGf!|K;|st7xRIDT;L
z-X|K^UFlY}xc<`I*R#&C2G1_t21xk7H8(Gkd5XTZ17DbO%VCXAWg<QPXo--;{VV(0
zobFlZW@4Gom1N>LX$@z+JY4OKI}qX7i^EdrRi&ak-~N-x>eT~>tmz-yrn+B*if)9q
zr^@uaxOj}4YNPy(3|eCxe(%YHZ}sjUH$a>n*a@ANN}=?I7==Q4>b|Le_&|}KCt&+s
z^m6Iu?F6&-j@ufahtpBoNK3w!s5|r087)v&lvWm#a%batt=@k7-&=GSLETp{?`8TU
zX<}NVR8wWy1E)ahLmCCpag?V@oxO{Jf`Jq&v1%bKt)={|J?51Sg+)_zg|^ll_zppO
zgKNhxAYeS7ftT{W)G{=uQQgJ3r;nu6<NvMGH@4WXmop;n6AC&}$k?A6izbB{*y$+B
z&?3`+&B*XWj-?P+cakY@KHXx4XE=i@<NJmXo1g!Z+?F~I?K|1fSO4BKu~nF7Xhjhx
zdenxEdmaYek*u$c5<<i@<=4O@<GuVn7-gl!M@+PV9OzNH2Oe%)9wNePLw!G=b6Q&i
z5mU(6skM@|{(8(ru;xS5?DQ@fn%X#PFCX9<T0Cafe6iB?IsBZb$M$ZL#<LV~9Gzot
z4O5>syyoz}TP$4dfrx}ujD*;M<yBs^K&PZ<@=~+rg&xNkoMnCw*T9Mafvw`1LkGo6
zi-)Qa2%<K7-KRX_O}`APzIeDux#&Yb!Yw4z-j=}d?<!ZT{qA)qP~&h>r9I0Vf`*od
zr=`%zCT46PN=d`VN0ofKb+EtRrh8x+!?J6rH`8#l7Zb}peF#rvFiD+<OU%j47HUD&
zjflXT@|RBc5UWb;?MkBj8+)S9v~YXG*N3X9?;r<J7jGaCBRYSK`{y+W{rKVFd$+u(
zTQ_-8es}Z2*M6=>Ro3s7F2U;lYe`8XFGPn@x8rY6h=6BJ9m5EE!r^LzogG*J{x;MR
zuQ6}+EMQP&_z;j!8GQ07)M34p;<Yeu0_|16z3)&h)IDvA+uUVsM=P#BXm{q^pXK(I
zS64g9a4io9xRBi!m)Zbw2-GD2-RN!tY5Kt#HTSHE+kdnGImOZ!#xGZc0ODoDF4Q%m
z?jUMx(CX_vl7kJw_9Y}#L!<rYz70&Z%J7-{JEkNguzN2?_DG3F8#*{1XGx{pN;7n!
z^p&aivIcc7EL1^D>v*r}COf7Ms8H94ET`MEsO}rEhC;@yDhbeLz}LQXZ@QfPaHjqq
zef6uKP<Z3w77seBI2B!I=v1C&jY1FN=eVSdM}+)EH^AhBO(-)JmFj$X!P(C^zo{zE
z?wNCRF6&8VCTjIGAC=)JwWx*M)*jhXiEVq2j9w3$^hADspFghGx|g=4(h`6n=+NqT
zno<{+HeGBP6?bjYmvGv(>Bvid(v!sFsN{jB7tx5IQLnG8psyffH8;gMZ(N4P#}R}h
zo5*W6SL=@!f;KtHgVKUN)^E_nzuLNQVB8<?-E)ium|5l#6(-F`AIItqxKZ42klhQ%
z1*Le>W(<F|M%`}WQe!x;XTZi!{ge=Cp{pxr6ZPQrM>=+5suU%lZf*VfEOZY8jXydg
z(+DkV+?UexbnXg|VZ52#;z%*Lwe1~8Fb%8mYs9F+B{~%u1rj9}QNNS|t75yjW?|h_
zEF+wgFy)cKPG?FyCu5rjSoW~RVO}!lX{(l-ER@3)$Yew}`o;JF1+j>u=6pa-m4Ok{
zD)@2x-!F331&ahmi_Teok&LcJi(_O|3{J`~W;&ZE*v8Cm7y2uY+l2AH+XpO@WKqA+
zGs!FB@Qu<{OET3c?rSX6acLm`vtvD(2?$dR;b`ywG7|rnA9qQ6#bc5S6{uBxJ~wjO
znL0e0w1>Ked9f<___*H$vi%QU<?NsB4}V&a`{&1SZ-&Gz)X=8@JChi{-MDyrpq>fj
zmZHo0M~Aon(P)wx|F=dHeig9;@T1v+YT#Dp<>m@nZWszr3HVTWB}0kxzuapse~!*0
zjcWZ0F>cyJdQN}jLitN7zt_>`cp+Tud0>J8g*Hr1P#0X6T(QV4l6l-tGZXS4LYToQ
zsMvmjA+&<rqBCWD@o^RzbBm3GQ<&#UJXa6u2p+CHH_}bnJFJzEWPRWhEz{#YoV7%q
z$Q7d;?|0Ukw3YPZ2;-h3=X*ULGMn1S2a)VU?9Eq@z&9~A{@LEPMnFh(ZK2QWLxJ{{
z!~`EdL)vry0Ph+y5KIj;mGP`zQcg}XiRGj<$G`2*4=^KZVWma5jnASrHZtgX?bFt#
zF%m%$M6O_ETtc0hVRv9s%=FaqTYQd3<NQTL58bC{<#6OXySU`BSueo@3==-%JOc7Y
zLi;^4vvu-<DX7)dize30f|2y~>)__^_k&+2(zBDZN=g$a!hqW(_F#lUsfRhl+}PM0
zqN7Pa*l3>_ZkGQ|c!8VwOug#^)7O7g><-sMeDVJ!W9uJWg!CZy3<1`?SF^n8$98mV
ztn>Mjx|o=MI5~puF4*uOXQXFg_`{*o=5KY!SANga3h##cGn|54`L9#)!|mu<(z6ZL
zs(R<|q@}|^vRA15IaqAA{PP67f(Z#kz#(n6<}7)8c5qGwzd&a}_RRl%$B$h7gWLFs
z!?JNKP=3B}>klc8FxJff-+V6r%7jH?>?eaD0!}=R27lP8!oJg>>!+?nESMiI{+zQ>
zH$f-TV4_Vg(DlLH6_>gK7c0E)E%TG5_yiwqYc{Ue6)6sBUeF(Ub6HK198p)&G6{KH
zR_d=zk#oU0qg+Oy#>X2#(g2g-bKcgI&}UsqE?r}uYq$xbL*1FHTU)eMtXu^zp?G+T
zuGd3UR8%vwT)=NaUQ6%UYS5<b8`hpw6j!O6wT+liFj&C(6^C?r-PL5QCwD1PIbUIA
zGU|dBtd)f97QcFlcfQegxzJHlw?)tBcJTq#wz;>*Mg&Ng)ebwYmyEo;ynyVh-0<37
z5LOL<ODDd|(8Ofkd+#@p?O|NZQ>~BzGYMSkI@jTKhqpqPHk$W}hJ<-T{Fx^h#%PNX
zTjwP6iVZ9#YG~Eugxltd($amtyz>cRI+uP#PoExq4}B<udwt=CDJl=qDOSumD0I#9
zWRY-3duOhS<FsZism30qCROK?36!#yPx|Md>@SO3r<TqMdKI}q&k?AuEzZfj=_H{;
zA<Az*Giq1%db%6_+9Y>#uy?W(J%{isxzHl<_Q&s^g^4C!@`tB}1qVyMav^uR(L=E3
z5O2qWdRTe+-Bl*Fq^PK<$OK-8Gg>9$free#<@V+ux$27f-VI(qe+Fdo^`M~@-kmqj
zYl>p{%3@O6zoZDQui4UxM|F<)<#MJbXlQ8AVM*pj^OTypx5(>?$%^?I3mXEpx#5cf
z?fHru-R28K9K~fZ^wkQ}K@5LvY+1Oiy6fIBm-hul7|g!W3JW`<d4T1zKln8Ww#g|+
zys(Glbsy^o%B=8tGM_U5l5YMSYvLKL41N{YN0bZFn=EsmFWclkJhX4v95L%$LV}b8
z?(l1!hC@M<E1P#*f%nfdkg{dmTRdGZPLe-<9832<<ntbXEk$K(yD!tXd2_i5p3D!B
z)<YV)9M_Re9<yo`F3pk#Cjh;dVRJJXFfMY;h9N<E8%(^1t9{sS?x*<)g-ldi^2v~s
zkAE{dgdO<C=H~L8TBT`xdy@blp>v`VJ`47G1zd2AyE$&AM-^CUk_QAb(9>fQ^4n}g
z2j>;dp`%Y%nn~K(Mdp8yme<2pl#U<_N4--#>M6ckk02l*>j3rCw#zSRkDhsmN-DP8
z)b_6|pu=^Dr4-N#2P%uMU#R0Re6+Z$Mi#C-6I{<-S#(~yxsbq(_sy4^$&_*~i}Op@
z`((%`wcg~ZQOOLZ;G=0<%d?JUPQL0(f&RfAu2WLlr%&^C9hZIsW9&y+na#WLxIv+G
z58!cw*-R1C_NSBAGw1Js7Ov#-68a4*SpY3P@>N{b`83(bE-ksr;k+wKD3yfAVee;|
zWGH^Gs*=)!`O1Na_tOm)=ilUoKBDZMS`Jqq!vr+pwff7j!Rt_CuOi3@7Z<mv9ac9%
zZ)fU=SAR_H_v9|G8XMC>gJ~Pcg<x%5_3m4Xj?EU{*05OlkO+nm@A|iEW3aRkw&f3Z
z58gGr@$$6Ea@-_<2NF6O_~1`>_<nEw_%ohJS>t5!{YrK@eWKL4At7NyeK!gL`K0E-
zL8n&9j~~yMJ>90o#Kcseu|p8ldDq{_(D=*+<~#M3-*1#2TlF!}(>?<VAk*WHwH{Pz
z>J>bOWH}Tq$OQTcmN>%W9rh>`Yy>?(7yrFEejvDA);3CgHbiauRMRA8Swl0CtX|MW
zNl9rTfMXPwP%b`jG5qI;)LNT;1xL<fs=yO+!5`$3sR`fc=Oh5J4?&8~-j-3Ox+Pcl
zi<2Frz*wjsj*ov0wVg=Tc=-6?1Z+RV!>!;Bq*d+F{&2}kPF0n~x?=fZ6HzFh-Q^kE
z-kxpEm-|yna-U)i&XAvLr&wcZJT)z{X_}D~z72c!N@o^}#xIK>zbEgj>-VAW%A`EK
zJ^SwU&8lTI#Tdg6j&-wj*Q#^i;_#DU-bH!(5j%7s0=3F5A3R@R9Q>Ioo5;mOMaA&+
zh*=RED`BPk;j+l)2%G6}7M=uFg_Wrp>IKp^ENiDHk3}gF8CY3!v|yx8PX}<(Si0EZ
zyLae#J<4KYNoM!Xy$MI4=RF9p+gXd&@IaVvoOvUK&Z^;kLxmf_^oID26|6d%G+BuU
zD<dNxQ8jfGNu_i&kf?E)k9-PsxfJbL(~oG8qwoW=p`M}AO&gg1&x`bYuP*OQ7%*~S
zF$R#&-G}|h+u>?4(bi=@zt+{>gk(PQj%dat@D1#Bum;@O%+h#-KpzzokB3igZDDAk
zZ;_Lot@?*4kcR^j6n~CLpINm2M#uL-Tp465-plqY4^W><^VEFF&d5YuglwFZ#j0Es
z5Ly_{H$BlY0LC6^X{HS=q+(4{!Kr5hLqo0oVMiEjF~xGuTO(de8M)<7o~K&^5GbK3
zw_K!(ii@5YD4}%6h<~Xn->f7G9sqDAOT;!t{3tQk%F?iSLvlm)0H<X~sF8t<t#j-I
zc>+a>x(V^+TJm`Q?$qo<i4XCNS?pWUQ04fF|Kj_CTd?qm0K(dR_Aau-L~ayJ@5fo#
z79sbD*gdWSq$ft*i1CuI!bi=<hgUsc+~Jq2)&0^WBdlj(kylb8(Yh=&8S!4oNUteY
zhBi95m~C@O7;AI%d%F^Jt1%;lQk|vW<ZCt{A!^%9{xY|;oUN#U4^|~^2yg_%T4VZM
zNJu)`+dm4l_!zh}<Rx{;7v0`&_N{2P=s?C)@@$ZmZNe9fDjiY5!E6@{g)cv(dr#BZ
zc)xg2a969E1pl<&I#qjmc2?>pmoY?wNh=QF5H!IxR^p2FC29sK=?}#Yp}E%d7KRQ#
z9LfBJj2Rl4eILGkyKngj4^P>YcIysfHt;8n5)>4bSrpR?3pKsCMP+5lh4S-j9ImwA
zh>AQ|7+!>$m_)}-E&ltYbfn632vQt9vd>a_6S><8t-q#+VccuuwxVB3dH)`v`%ZKJ
zUfX7Jo1d+Zki3EtJ#7ceEYP0XFHSen6{8oC$338zr|EOce$%Ls^Bg%<Fv5vUOGo2C
zBA4R>;zI0!q6jf53k)f)nW*2g9v=K~EB{c5!5_UdTVpl7v9W1CmHxhJ^P#f~wNx+%
zQUih&IwQU^9-i>8LV(9j;Om;)xr2x|MUme4;bR*br3s?2X1T>}bbluCFKiqf%K(b>
zNnj?{lDF^52o}cg>x~!q`XV@&G0131)MmHbV(^V(=@SQG56?8J;atV`4zQux`h96k
z3A8FVYpFQHnh{$my13*J<59#0ysF399`+Jv9Hl85pD8V*Zns8?4W2)zAT|Vfx=z#X
z13h|rsRcTG$^iiZaTWUXEn3^qNb4WkWK*K6!|$rFFH@A`9<aEZd$F9aS>Y9EVm`VW
zRXkR1NleQ=^IZ6~o-n0DJYDg^ojbk~6__mR5*?!qss(5#<+^-t&CHU4bD;W(F8H+A
z`N@lmphCD7eAxJR$%C3qzR|IlxBF!p&rA%u6vrA~oM>5tt8;L$x4*lhBDITI^p>rT
zD9+EDr<pQaeLMGV-MUBfT2xpmnO9w%a3cFTqnuJ=IJuB|kttyd=5s@4?Gh<%VcU*{
z+b6?WUo!GzVxkTMwlLM($U|qjtRGyWj`c&w64lGN=%i=*XGQBLirjh5k+HGOx*;1F
zCjr1oc}qOf*VEBj`)xoQi<cdEfpJzsD{F-Ji^9+j4#%G{i+2RmVeg{~eMsiEE{-fY
z=)e|X*m}J52KK{H2l^r88(J-<W+M4S9ep+@Lvqsi@dig@N0FDlLP>J6bWJ(bcdrjy
z%gM{LWgTq`y<ltU?d?6;vJ-b9dlFDk;3OkMh7slXHamE?Cj)hvbd?FCiU=s7BlWY{
z;hNPJqrQQQRn!y5tKzPnp0zfMqO%+XXj@s6CtFbw@tos&4-H=p;96iM?E*a+tk!S1
z^0w!;FM@H}`3h%k*k}pfLqmg?Xev?+HnN|&K}*NXOf*xIsr7V;>xbbfgA^JVhHUEX
zjr)CCb$jE0?LIYGJv!Tp8&L9hOlf&+m?11>;gjj_>OZ<63)KySWS`Hf^u8vxSh%lt
zH+oSjJ<pL1J-&AxT3=7Llq<C|xmu4S*f5-+tX2r*dTKoE^9LoR_E=l*!YTA*ML%GK
z*|$<)`_c}}fDla*-X1VYeY;!m(S39C4Wk!>d-o~W%HFPra*MRSvvjY-MA1MEYe#eU
z>ChrYKp>NSG+leyak=Z=&_sw?Z9`^DofP56jiC=+QR}fc1CS^DK+bKv@XpJqORw$M
z>T07fgTO&0iA}{lj8;#U#qP;^`<sKvLg$#2cT29<k4m&>HNu{LI=5bFk{f3ZPWg<S
zh+<S<cR;Ay)Fgv*i1$vjK_Q#U+^|T(K&ak>XUsK=UDrtuGsmM!1GNYL*0h8vX4_GQ
z!uYEmfv<&y{ja24&0O~O23Hs;CkmevRC;)7X(b={SCYJu?D4+ud8+ytG|c$;n94Pj
zNilKN8c)90&SY&i>q9Zk%|1ZXkf?9jV|q?c6?yQGMPAEnD&zI=sB|1lR&$_Cz4U((
zE&lUkuQ9QkccIS)hDS-+4Zrw#$9(=wW_L`KXyO0KFBWP928(B_H8@(i?;8EO?8ys#
z-T4}BGVv@1H@Cz2oOjuD0{qs6sULGO@6<5QP9o=JhW_eg19|^*zM2;AItJzNr>@In
z$70QjuKZ${+#2Sqn>+|BtmlKh@LN0xE!^Z@N{|S+%@kxy&+<AFm~lWK0pL(xE0k8A
zErS>?=#k?vhO)FN%EkYr!Ty@2PNt;{`h~X!>!!EVg&61$N^yd__~>wR4YdsCi8xnj
zxMZ85WN#u8FxHDy?a%Z11!RpqJBZjkXcIFOaIG|FCV#zTD=vl;;LA?b{+2CYAsGK<
zQcq-Fy|S3-usa{31{)9vW3V<N67q70?YsP;Nh6cw_GfESV{P=AXWF_jA?mxb2LuF1
zaNmZe0TeWx2M?IvU<hun(9vSYkSLnIl*#%v>3|-3mqlAtyT(fdxI&J@0bpH6lm1Az
zVJDSfk($!vU2aw0;(>(ZYR@s;o5<CuJzZ?z3{|QNHpQ_ipC}DQjE;_v-f&mN#Sw_r
zg=!bs1cPty>PM$k?p6ptSz$9jg2kAa$k#uDbJ|U@1$lN3^<JE6Qt8%Qn~$EnhO1@z
z^EQJDFDm;o*-XR5=yz_MC(?LI0l#a#uI?(1I35Q0wIW`um%@@P^JX_mGt)MX16_m1
z@=p&~_aNJpO6Qt_B!s|%sJD}EuRU97OVzUn&&d1aQ-$BY`5bDMSgh<D1b&ea|44eu
zzk2(F!LaXKmA&=08$Jo^gI`Sj@R0CYHh$jN1`^A}#3k!SJ9g&0fZdTx_>R_OSVNCc
zCtEn_F)JtAPum@#+|r4#B*0^l7nPCAT<*-uqMpM38_@gXw-Nr3o=gPx>mSk=b+Q#J
zMPKV6r8BqJ*YN>SG_PjL!q%RR{i$K9SnF-K%}sZ!;U}uoDdh+kr$&k;57^&Z<b;(u
znh>C?H7@HfgDV$_P+@qOJp?V(&hGF>+0(YQFApg?s$GCI8PqPTQD#B;?TI^ii?+)-
z`%p*DHF<?lFIGp=w}emaPJtL?L3APbmvm}s7T+Y&bYp%l9R6|vm~CbhMv~z2aJ4c6
z0gKv3Z%+>#I)wXl`_$CSQdqsVU<;0wZ{wuVCP<?8M1WQi8`6uYs8z<JS)&~hEj121
zN~_+FzpT7#3}wwlq)v@AAR1%2(#@ctqPch*KRhxzoXoSV6FwCx@v#%7hJ;o5*RQj#
z^bYd423a&@1mvR@^b^L%X2%JR&rYlCO`J9+A}H(K45^rXr=d<f0*F-T-bb|5)MB5U
zG?kph<X=&5rV|jwB^DzmXb`Qhr$#AIadADNp-GgU4cfU!_LPE~CD0Rn=vMe$H=48*
zG&BAuS-*H34GgHh9^3@99k#x9F@z_+&ja~RHh<$^xO-aJ_rna8HtdR?M-F(Zl|gG)
zDtEK!C>26E#+J!5Y@0sy8iT>el}YmJ6ql?=B@7`i=+*Jt<U0`uYl&*pm%LZz$A*Ww
zIXUBn`qMm&PPh4(7#WwA^cUS4P3cEpO&)z=w5k6hu{~X8P^#<$eD<HMt&RDK9M1It
z0WVXvot)|{)GL^&sYm;FFC$uzyPiIJ%9Aw^mUKr+nOgdSV#99F<x-E4nUj65n~Wa?
zv)+MFHBJ8OPk7&ip9SA}TH=E-!Cu)Cf`)!*cb+9G+8Q+vm82{ZZHB72{z@gx5}}`&
zG#WX4R3Fi<&vx&uvQ%ilJg_fZY!wmNEmFT-yk>XxlVx+9N7&MNYevy6GFBF|%WiDk
z`ZVPV%ma*CYK7VY7iNlgt~}Rxdwh^LD&3egy@ocG{+`*)s?|lQ+i?>j4iB;1coy_P
zi}>aAoAhblXNm`iQC*E+%EvnmCUQ0=hd)1l8Sv@0=H1ibexd0?2Z!eOk?D`N&}Xi;
zG}Hh6j@HQ}^Q^i?CSO{7YajjC&G*B)U5QNeH83@YAwDLRjegrJ=-?wUANZ#oM}DUQ
zhO%hHK$~)jnDE@Z<z>b8j+Mn9>LZWAr4^cw<VK2YF|wE%i))W^2J5vnYbQ!yNlKoc
z?DG{_tHztBM;e55b<m-ub+Qo_#~N(>dcC)B-;Jc?hef4z|9yM=(nBvn49dg~sh2X0
ziJ&yEkUnA~<mslE%?nMsL&L_!rLCwaA}K1t4Y8V=CZQX*>K0FQstlS(QUCm2%2a2b
zpnhL=I|;-*(=;}Gwn;p(eSdZQ@3$(wbW$Xh>?|xTbP?H_-5;^@WaWe<#bheP`hF6t
zPg{%2h;c0bL)lTT6Em=K=5!XI^io3|A2s)R?DF*cl+Gvr-RAP2=iq;@Z_fNysx~_G
zE4x9aXCYg7cytf|PDUWUKImbejU16gUB7f~?`!&&@l81^H;vs(@Z%Cq{o9#|1EXI6
z3_)Rb-DfYcT@H8_L>uqi`yo31TV|K?&!AMy-pz4`ON-&^(dnGu(`lz2>69qUjXlkm
zA#V7?S&ovIZfEq~>6{#3rpVo>?1|gubVkZVobRtbR&|Q~xd9RO>i&KrPfi|cAZ@+)
z)+q1ue@(PGa@o3dbx#wo>HBY*D*6PtH_esl*rkwCH@^+m7Dtbod&Vz5)~8vzX7&o;
zea{6vUsC(rV~Wx)u6p?ETiLBie>!v0pUk-#&A#o-;p;mWZ*${+7qB`0_N=gHT2)e^
zvJ;g$vix(r5`WCTvtYxS;)OGRY~8wYQ;U#t>_6t{w$#5jkL;bUA>%9%$`bZH)%mN+
z`gqw*-RmWm-Ctem`~Lo=_#;p4`_Fp+4gj79q!_y8O2xF&sXDK<`d+NLd2G$9=6y{6
zPUk<3oT>d7c*I5E+J*1`2?0+P!`OxC@s^WWuKzo5ToV|wH`$9LyZ%eZW$|iioDdfi
z1A6L&-Hg*SF7`~BFzb|t)`{oOpBqEOy5bj}y0T{FH#@~nU|@Ya7;~&AZAr_O5H~-+
zb<1{TB?)ozI-W4=?3^GGdM3lo%fono&#G0Qj`tr0Zu=KuQ{#waF`jN;KQk#*G_y`K
z{#4|eD<PpzDtw--HV1C*25v=CF=zSswYjqE=B%#|nbY*1>8BYghc5Z%Q<iz*WzU&6
zOm?kDkA9I*ajdzTa9PUQ3phV}sdNfU!6KlO1(;s!-VclpZqQ{r12>ZYN1lP<|9|g$
i-6;$V3~Zn-6Eg!-%^j~_ECN125e83JKbLh*2~7ax^?_6X

literal 0
HcmV?d00001

diff --git a/docs/codex/xirp-context-report.md b/docs/codex/xirp-context-report.md
index 03cf72e..cc7b0f7 100644
--- a/docs/codex/xirp-context-report.md
+++ b/docs/codex/xirp-context-report.md
@@ -96,3 +96,64 @@ remain unverified; CI state must be checked rather than inferred from push.
   initial-objective contracts; mount with S1; verify additional agent features
   only against trustworthy native sources. Portal/MCP remain explicit separate
   dependencies; no connection is simulated.
+
+
+## Canvas integration and revision provenance checkpoint
+
+Published `cfc79ba` merges S1 canvas through `6f6af26`, preserving both owners'
+coordination notes. The merged frontend check passed TypeScript, all 137 tests
+and production build without the earlier NODE_OPTIONS workaround; all 39 daemon
+tests passed. S1 subsequently began the per-terminal prompt composer and will
+mount the library while retaining hidden editor drafts.
+
+Published `b7b0b4e` adds sourceRevision to KnowledgeInsertion. SourceId/revision
+identify the editor's base snapshot; title/body are the actual draft and can
+include unsaved edits. Both provenance fields are null for a never-saved draft.
+Fourteen library tests, typecheck and targeted ESLint passed. Insertion remains
+explicit draft composition; S1 owns delivery through its terminal input queue.
+
+For b7b0b4e, macOS Quality and Packaging passed. Linux Quality failed in the
+existing adapter catalog test `detect_and_set_enabled_do_not_require_real_clis`
+with a version-probe spawn failure; frontend, Playwright and clippy passed first.
+The runtime owner received the exact log and is investigating. Linux acceptance
+is not complete: https://github.com/guicybercode/Jig/actions/runs/34002926329
+
+The concrete next organization contract is
+[xirp-organization-contract.md](xirp-organization-contract.md). S1 supports S3's
+bounded modules; S2 has now delegated their implementation and allocated
+0005_organization.sql. S3 owns those modules, with S2 retaining runtime and
+initial-objective execution. Implementation continues toward the original
+objective.
+
+
+## Rule/skill discovery increment
+
+Backend and typed IPC published as `4a367d0`. Approved knowledge.discover/read
+inventory known root/global/admin rule and skill locations. They accept registered
+project IDs and opaque expiring selectors, never caller paths. Reads revalidate
+file/directory identity and nanosecond mtime/ctime, stay <=64 KiB and never execute
+content. Skill-directory links bind the captured target. See the precise bounds,
+source policy and remaining nested-scope gaps in
+[xirp-discovery-contract.md](xirp-discovery-contract.md).
+
+The isolated KnowledgeSourceInspector consumes discoverKnowledge/readKnowledge
+from the existing IpcClient. Props are client, optional currentProject and
+connectionKey. S1 should pass daemon instance/reconnect generation. Lists show
+path/provider/scope/precedence, linked origin, availability and incomplete-scan
+issues. Source previews are plain text. Correlation and full source-descriptor
+checks prevent displaying another source's content; request epochs discard stale
+responses. It neither edits sources nor sends terminal input.
+
+Verification on macOS: full core/daemon 146 tests passed; a subsequent independent
+QA review found an enumeration-budget edge case that discarded already collected
+candidates. It was fixed with a real-directory regression; the final 21 knowledge
+daemon tests passed, including both socket tests. Final core/daemon all-target
+clippy and formatting passed. Full frontend check passed TypeScript, 162 tests
+and Vite build. Targeted inspector/IPC/library 43 tests and ESLint passed.
+
+Chromium screenshots use an isolated mock fixture at 1100px and 375px, not a claim
+of canvas integration: [desktop](artifacts/xirp/knowledge-inspector-desktop.png),
+[narrow preview with keyboard focus](artifacts/xirp/knowledge-inspector-narrow.png).
+Both had no horizontal viewport overflow. Temporary preview files/server removed.
+S1 mounting, real desktop smoke and this new increment's Linux/macOS CI remain
+separate integration evidence.
diff --git a/docs/codex/xirp-coordination-reply.md b/docs/codex/xirp-coordination-reply.md
index 1ebe839..eae3025 100644
--- a/docs/codex/xirp-coordination-reply.md
+++ b/docs/codex/xirp-coordination-reply.md
@@ -72,3 +72,27 @@ working transport is available to register knowledge.updated/file.changed
 yet; continue explicit refresh and revision-conflict handling. Initial
 objective execution also remains S2 work; host-owned editable drafts can be
 built now with S1, without hidden sending.
+
+## Organization ownership and migration allocation — 2026-09-05
+
+S2 reviewed `xirp-organization-contract.md` and agrees that S3 owns the
+isolated organization modules (core/storage/daemon) and UI, consistent with
+the original user/S1 split. This supersedes the first reply's retention of
+pin/archive/workflow implementation. S2 retains shared-contract review,
+workspace/floor/canvas persistence and runtime/initial-objective execution.
+No duplicate organization implementation is underway in S2.
+
+Reserve **0005_organization.sql** for S3. File list/read/write needs no
+migration; S2 workspace persistence begins with 0006 after integrating your
+0005, without migration gaps. Approve `organization.get` and
+`organization.save` with the proposed bounded distinct-target batch,
+revision-zero defaults, whole-record optimistic save, FK tables and separate
+workflow. S3 may add shared registrations on its branch with real handlers
+and SQLite/socket tests, then publish a commit for S2 review. Maintain
+spawn_blocking for blocking storage work. No metadata event is advertised
+before the transport exists. Archiving must leave process execution intact.
+
+S2 has merged S1 through `1e75081` and pushed `45d817a`; frontend work remains
+preserved. S2 will inspect the Linux catalog probe failure and coordinate a
+narrow fix with evidence. The local file editor is now being compiled and
+validated before its next push; its contract remains ADR 0006.
diff --git a/docs/codex/xirp-discovery-contract.md b/docs/codex/xirp-discovery-contract.md
index 7916630..f1e920c 100644
--- a/docs/codex/xirp-discovery-contract.md
+++ b/docs/codex/xirp-discovery-contract.md
@@ -1,11 +1,12 @@
-# S3 second contract proposal: rule/skill discovery
+# S3 rule/skill discovery contract
 
-For S2 review after first knowledge commit `2f3b7c8` and UI commit `a757f05`.
+Approved by S2 in `xirp-coordination-reply.md` after first knowledge commit
+`2f3b7c8` and UI commit `a757f05`.
 Approved narrow filesystem reader remains inside `daemon::knowledge`; no
 migration or generic editor is introduced. Source inventory is
 [xirp-rule-sources.md](xirp-rule-sources.md).
 
-Proposed methods:
+Methods:
 
 - `knowledge.discover {projectId?: UUID}` inventories known global locations
   and optionally one registered project, returning `{scanId,entries,truncated,
@@ -18,8 +19,9 @@ Proposed methods:
   changed files, nonregular/symlinked leaves and unavailable content return
   specific safe errors; refresh obtains a new scan.
 
-Inventory limits: bounded scan cache with expiry, 512 candidates, 10,000
-visited filesystem entries, depth 16. Read limit: 64 KiB; JSON envelope remains
+Inventory limits: four scans cached for five minutes, 512 candidates, 10,000
+visited filesystem entries, depth 16. The selected project is inventoried before
+globals. Entry JSON is capped at 448 KiB; at most 32 issues use up to 32 KiB. Read limit: 64 KiB; JSON envelope remains
 under 1 MiB even for worst-case escaping. Truncation/issues must remain visible.
 No content enters logs, Debug, error details, SQLite or telemetry.
 
@@ -30,12 +32,32 @@ NONBLOCK before verifying regular-file identity. Merely canonicalizing and
 then reopening a string path is insufficient. Rule/SKILL leaf symlinks are
 reported as unavailable rather than followed into arbitrary credentials.
 
+Root locations come from daemon-owned HOME/CODEX_HOME and registered projects.
+Their directory aliases are resolved using descriptors during capture, then
+reads reopen the captured resolved path with NOFOLLOW and compare directory
+and file identities. The viaSymlink flag identifies skill-directory links,
+not OS root aliases such as macOS /var.
+
+A skill-directory link retargeted after discovery does not redirect an existing
+capability: that scan still reads its captured original target if unchanged.
+A fresh scan follows the new target. Source replacement/content edits conflict;
+daemon restart, cache eviction and five-minute expiry invalidate scans.
+Removing the registered project invalidates reads from its scan.
+
+This increment inventories root configuration locations and recursively grouped
+rules/skills within those locations. It does not walk every project subfolder,
+evaluate session-cwd ancestors, import rules, parse activation conditions, read
+native overrides, or enumerate bundled/plugin sources. These limits are visible
+as inventory issues and remain open parity work, not claims of native loading.
+
 No native credential/config files, support scripts, imports, or transcript
 files are read. Editing waits for S2's common file contract. Root will publish
-wire/catalog/mirror registration together with functioning handlers/tests;
-awaiting S2 agreement on these two method names and response shape first.
+wire/catalog/mirror registration together with functioning handlers/tests.
+All five knowledge operations run through spawn_blocking, preserving the S2
+composition change and existing generic transport.
 
-S1: proposed second isolated `KnowledgeSourceInspector` receives project and
-client callbacks, with refresh/list/preview. Keep it inside the canvas surface.
+S1: isolated `KnowledgeSourceInspector` receives client, optional currentProject
+and optional connectionKey (daemon instance or reconnect generation), with
+refresh/list/preview. Pass the connection key to invalidate scans on reconnect. Keep it inside the canvas surface.
 The current library also needs a host-controlled editable composer draft;
 S1's existing terminal-card draft is configuration, not prompt text.
diff --git a/docs/codex/xirp-organization-contract.md b/docs/codex/xirp-organization-contract.md
new file mode 100644
index 0000000..cce9d91
--- /dev/null
+++ b/docs/codex/xirp-organization-contract.md
@@ -0,0 +1,70 @@
+# S3 organization contract proposal
+
+Status: approved by S2 in `xirp-coordination-reply.md`; migration
+`0005_organization.sql` reserved for S3. Implementation is underway; names are
+published only with working handlers and tests.
+
+The original user task assigns new organization/context modules to S3 and
+shared contracts to S2. This proposal resolves the earlier replies' ownership
+difference with one bounded patch, independent of runtime/session execution.
+
+## Suggested wire contract
+
+- `organization.get {targets: OrganizationTarget[]}` returns `{entries}` in
+  request order. Between 1 and 100 distinct targets per call. Clients already
+  obtain project/session identities from the existing snapshot/list methods;
+  they can batch those IDs without a second session/project registry.
+- `organization.save {target,expectedRevision,pinned,archived,workflow}` returns
+  one `OrganizationEntry`. A project requires `workflow:null`; a session
+  requires one of `backlog|in_progress|in_review|blocked|done`. No partial patch
+  semantics: the optimistic revision protects the entire organization record.
+- A target is `{kind:"project",id:ProjectId}` or `{kind:"session",id:SessionId}`.
+- An entry has `{target,pinned,archived,workflow,revision,updatedAtMs}`. Existing
+  entities without organization rows return defaults: false/false, null for
+  project or backlog for session, revision 0, updatedAtMs null. No DB row is
+  written by reads. The first explicit save requires expectedRevision 0 and
+  creates revision 1 with epoch-ms updatedAtMs. Subsequent saves require the
+  current positive JS-safe revision and increment it, even for reverting all
+  flags to defaults; rows are not deleted during ordinary edits.
+
+Unknown entities fail with `project_not_found`/`session_not_found` (the batch
+is all-or-error). Stale saves return `organization_conflict`. Exhausted
+revisions fail rather than wrap. Malformed payloads return `invalid_payload`.
+No native process status, PID, worktree state, transcript or text body is
+accepted by this API.
+
+## Persistence and concurrency
+
+S2 allocated migration 0005. Add two tables,
+`project_organization` and `session_organization`, each keyed by its existing
+entity ID with an ON DELETE CASCADE foreign key. Keep metadata separate from
+the process-owned session row. Use immediate write transactions for compare
+and save, and one read snapshot for a get batch. Database constraints enforce
+booleans, workflow values, revision/timestamp ranges and typed relationships.
+
+Pin and archive preserve files, saved knowledge, PTYs and session status.
+Archiving a running session is permitted and changes only visibility metadata;
+UI makes continued execution apparent. Workflow changes never start, stop or
+signal any process. Deleting the underlying metadata removes its organization
+row through FK only; it does not delete a repository/worktree directory.
+
+## UI and integration
+
+S3 can provide isolated selected-project/session controls and a typed batch
+reader for S1's canvas/palette filters. S1 continues to own selection, sorting,
+archived visibility and canvas mounting. Conflicts preserve the desired flags
+and offer explicit refresh/retry with the newly observed revision.
+
+General metadata transport remains S2's future work; initial controls refresh
+after save/reconnect and provide manual refresh. No unimplemented event name
+will be added. Initial objective delivery remains a separate S2 adapter/runtime
+contract; source-backed editable drafts are S3/S1's composition boundary.
+
+## Required evidence
+
+Real SQLite: defaults, persistence/reopen, concurrent first insert/update,
+revision conflict/exhaustion, batch consistency, invalid/duplicate targets,
+FK cascade and file preservation. Real socket: project/session workflow and
+archive changes leave runtime snapshots/processes unchanged. UI: explicit
+controls, stale response guards, visible running-state warning while archived,
+conflict preservation. S1 mounting and Linux/macOS CI remain separate evidence.
diff --git a/docs/xirp-local-parity.md b/docs/xirp-local-parity.md
index d51a5d0..7c2e802 100644
--- a/docs/xirp-local-parity.md
+++ b/docs/xirp-local-parity.md
@@ -13,9 +13,9 @@ added to this implementation's scope.
 | X03 | Resume/fork, agent switch preserving supported history, linked shell. [Sessions](https://backstage.spotify.com/docs/xirp/sessions), [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S2 adapters/runtime, S1 canvas | Current adapter capabilities do not expose verified conversation IDs, fork or usage. Await trusted native contracts and runtime integration. Local context reuse is a separate feature. |
 | X04 | Working/idle/needs-input attention separate from process lifecycle. [Sessions](https://backstage.spotify.com/docs/xirp/sessions) | S2 event source, S3 indicators, S1 canvas | PTY silence is not proof of approval/input need. Explicit hooks or native signals required. |
 | X05 | Local preferences, shortcuts, supported native settings, diagnostics. [Settings](https://backstage.spotify.com/docs/xirp/settings) | S2 settings/runtime, S3 rules/skills, S1 UI | Existing diagnostics/custom-agent creation are baseline only; do not expose unsupported options. Credentials excluded from editors. |
-| X06 | Global/project rules and skills, including symlinked skill directories. [Projects](https://backstage.spotify.com/docs/xirp/projects), [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S3 discovery, S2 file boundary | Need verified location inventory and safe bounded reads with origins/scopes; docs do not enumerate complete formats or precedence. Symlink policy and editing depend on file service. |
+| X06 | Global/project rules and skills, including symlinked skill directories. [Projects](https://backstage.spotify.com/docs/xirp/projects), [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S3 discovery, S2 file boundary | Known root/global/admin locations now have bounded metadata discovery and explicit UTF-8 reads, with origins/scopes/precedence caveats and skill-link target capture (`4a367d0`). Socket, core and isolated inspector tests pass on macOS. Nested project/session ancestry, native activation, source editing, S1 mounting and Linux evidence remain open. |
 | X07a | Saved global/project prompts, searchable picker and insertion. [Changelog v0.19.1](https://backstage.spotify.com/docs/xirp/changelog) | S3 knowledge, S2 shared registration, S1 canvas insertion | Persisted CRUD and paginated search verified through real SQLite and daemon socket; isolated panel CRUD/draft tests and responsive Chromium preview passed; canvas and Linux evidence pending. See S3 report. |
-| X07b | Session archive and workflow: backlog/in_progress/in_review/blocked/done. [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S2 organization metadata, S3 controls, S1 filtering | Workflow must not mutate lifecycle. Session pin is a user-requested extension. |
+| X07b | Session archive and workflow: backlog/in_progress/in_review/blocked/done. [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S3 organization modules/controls, S2 contract review, S1 filtering | Workflow must not mutate lifecycle. Session pin is a user-requested extension. |
 | X07c | Tokens/spend per session/day. [Changelog v0.18.0](https://backstage.spotify.com/docs/xirp/changelog) | S2 verified native data, S3 presentation | Source documents feature existence, not a collector/format/pricing algorithm. Currently unavailable, not zero. No proxy or PTY-based estimates. |
 | X07d | PR review, Doctor, cleanup. [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S2 runtime/Git, S1 UI | Existing Git status/diagnostics/removal-token safety are baseline; review and expanded cleanup require their real contracts. |
 | X08 | Agent-specific options, including Cursor. [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S2 adapter registry, S1 UI | No flags invented from agent display name; support requires installed-version tests and authoritative CLI sources. |

From c98cf253e42d80f38653434340177c28d4eee995 Mon Sep 17 00:00:00 2001
From: guicybercode <euguigom@gmail.com>
Date: Sat, 5 Sep 2026 22:36:11 -0300
Subject: [PATCH 17/23] fix(agents): retry busy executable probes and retain
 safe error codes

---
 crates/agents/src/probe.rs   |  15 +++--
 crates/agents/src/process.rs |   7 +++
 crates/agents/tests/probe.rs | 106 +++++++++++++++++++++++++++++++++++
 3 files changed, 124 insertions(+), 4 deletions(-)

diff --git a/crates/agents/src/probe.rs b/crates/agents/src/probe.rs
index 37beb48..6697e2d 100644
--- a/crates/agents/src/probe.rs
+++ b/crates/agents/src/probe.rs
@@ -93,7 +93,7 @@ pub enum LaunchTestStatus {
     },
     /// The version probe did not exit before the timeout.
     Timeout,
-    /// The process could not be started.
+    /// The probe could not complete because of an I/O or process error.
     Failed {
         /// Safe explanation that does not include captured output.
         message: String,
@@ -196,14 +196,21 @@ fn probe_resolved_executable(executable: &Path, options: ProbeOptions) -> Execut
                 warning,
             }
         }
-        Err(_) => ExecutableTestReport {
+        Err(error) => ExecutableTestReport {
             installed: true,
             resolved_path: Some(executable.to_path_buf()),
             version: None,
             launch_test: LaunchTestStatus::Failed {
-                message: "the executable could not be started for a version probe".to_owned(),
+                // Error display text may include paths or other caller data.
+                // Retain only the classification and numeric OS error, without
+                // assuming whether spawn, wait, or output collection failed.
+                message: format!(
+                    "the version probe failed (kind={:?}, errno={:?})",
+                    error.kind(),
+                    error.raw_os_error()
+                ),
             },
-            warning: Some("The file is executable but could not be spawned.".to_owned()),
+            warning: Some("The executable was found, but the version probe failed.".to_owned()),
         },
     }
 }
diff --git a/crates/agents/src/process.rs b/crates/agents/src/process.rs
index ffb8786..5effb43 100644
--- a/crates/agents/src/process.rs
+++ b/crates/agents/src/process.rs
@@ -145,6 +145,10 @@ fn is_transient_spawn_error(error: &io::Error) -> bool {
         error.kind(),
         io::ErrorKind::WouldBlock | io::ErrorKind::Interrupted
     ) || matches!(error.raw_os_error(), Some(11 | 35))
+        // A concurrent child can briefly inherit a newly written executable's
+        // writer until exec closes CLOEXEC descriptors. Keep the same bounded
+        // retry budget when the kernel reports the executable is still busy.
+        || error.raw_os_error() == Some(nix::errno::Errno::ETXTBSY as i32)
 }
 
 fn wait_with_timeout(child: &mut Child, deadline: Instant) -> io::Result<(bool, Option<i32>)> {
@@ -301,6 +305,9 @@ mod tests {
         assert!(is_transient_spawn_error(&io::Error::from(
             io::ErrorKind::Interrupted
         )));
+        assert!(is_transient_spawn_error(&io::Error::from_raw_os_error(
+            nix::errno::Errno::ETXTBSY as i32
+        )));
         assert!(!is_transient_spawn_error(&io::Error::from(
             io::ErrorKind::PermissionDenied
         )));
diff --git a/crates/agents/tests/probe.rs b/crates/agents/tests/probe.rs
index b2cef00..01562cd 100644
--- a/crates/agents/tests/probe.rs
+++ b/crates/agents/tests/probe.rs
@@ -24,6 +24,112 @@ fn version_probe_captures_first_line_with_timeout() {
     assert_eq!(report.launch_test, LaunchTestStatus::Success);
 }
 
+#[test]
+fn failed_probe_diagnostic_contains_only_error_kind_and_os_code() {
+    let temp = TempDir::new().expect("temporary directory should be created");
+    let path = script(temp.path(), "probe-path-secret", "echo unused");
+    std::fs::write(
+        &path,
+        b"#!/missing-probe-interpreter-secret/TOKEN=must-not-appear\n",
+    )
+    .expect("invalid interpreter fixture should be written");
+
+    let report = test_executable(&path, &isolated_env(&temp), ProbeOptions::default());
+    let LaunchTestStatus::Failed { message } = report.launch_test else {
+        panic!("missing interpreter must fail the probe");
+    };
+    assert!(message.contains("kind=NotFound"));
+    assert!(message.contains(&format!("errno=Some({})", nix::errno::Errno::ENOENT as i32)));
+    for sensitive in [
+        "probe-path-secret",
+        "interpreter-secret",
+        "TOKEN",
+        "must-not-appear",
+    ] {
+        assert!(!message.contains(sensitive));
+    }
+    assert!(!message.contains("spawn"));
+}
+
+#[cfg(target_os = "linux")]
+#[test]
+fn version_probe_retries_a_busy_executable_until_its_writer_closes() {
+    use std::{
+        fs::OpenOptions,
+        process::Command,
+        sync::mpsc::{self, RecvTimeoutError},
+        thread,
+    };
+
+    let temp = TempDir::new().expect("temporary directory should be created");
+    let path = script(temp.path(), "busy-probe", "echo 'fixture-cli 1.0'");
+    let writer = OpenOptions::new()
+        .write(true)
+        .open(&path)
+        .expect("fixture writer should remain open");
+    let error = Command::new(&path)
+        .arg("--version")
+        .spawn()
+        .expect_err("the held writer must cause real ETXTBSY");
+    assert_eq!(
+        error.raw_os_error(),
+        Some(nix::errno::Errno::ETXTBSY as i32)
+    );
+
+    let environment = isolated_env(&temp);
+    let (sender, receiver) = mpsc::channel();
+    let worker = thread::spawn(move || {
+        let report = test_executable(&path, &environment, ProbeOptions::default());
+        sender
+            .send(report)
+            .expect("test receiver should remain open");
+    });
+    // Keep ETXTBSY in force during multiple bounded retries. An immediate
+    // Failed report would demonstrate that the busy executable was not retried.
+    let early_result = receiver.recv_timeout(Duration::from_millis(60));
+    drop(writer);
+    worker.join().expect("probe worker should finish");
+    assert!(
+        matches!(early_result, Err(RecvTimeoutError::Timeout)),
+        "probe must remain pending while the writer is held: {early_result:?}"
+    );
+    let report = receiver
+        .recv_timeout(Duration::from_secs(2))
+        .expect("probe should complete after the writer closes");
+    assert_eq!(report.launch_test, LaunchTestStatus::Success);
+    assert_eq!(report.version.as_deref(), Some("fixture-cli 1.0"));
+}
+
+#[cfg(target_os = "linux")]
+#[test]
+fn busy_executable_retries_remain_bounded_by_the_probe_deadline() {
+    use std::{fs::OpenOptions, time::Instant};
+
+    let temp = TempDir::new().expect("temporary directory should be created");
+    let path = script(temp.path(), "busy-probe", "echo 'fixture-cli 1.0'");
+    let writer = OpenOptions::new()
+        .write(true)
+        .open(&path)
+        .expect("fixture writer should remain open");
+    let started = Instant::now();
+    let report = test_executable(
+        &path,
+        &isolated_env(&temp),
+        ProbeOptions::default().with_timeout(Duration::from_millis(60)),
+    );
+    drop(writer);
+
+    assert!(started.elapsed() < Duration::from_secs(1));
+    let LaunchTestStatus::Failed { message } = report.launch_test else {
+        panic!("an executable still open for writing must fail within the retry budget");
+    };
+    assert!(message.contains(&format!(
+        "errno=Some({})",
+        nix::errno::Errno::ETXTBSY as i32
+    )));
+    assert!(report.version.is_none());
+}
+
 #[test]
 fn version_probe_times_out_on_hanging_executable() {
     let temp = TempDir::new().expect("temporary directory should be created");

From 12259319d37448fa085b256f42a2ae50ea68c36e Mon Sep 17 00:00:00 2001
From: guicybercode <euguigom@gmail.com>
Date: Sat, 5 Sep 2026 22:36:54 -0300
Subject: [PATCH 18/23] feat(files): expose scoped file listing and
 revision-checked atomic saves

---
 Cargo.lock                                |   10 +
 Cargo.toml                                |    1 +
 apps/desktop/src/ipc/client.ts            |   32 +
 apps/desktop/src/ipc/domain.ts            |   64 +-
 apps/desktop/src/ipc/file-client.test.ts  |  226 +++++
 apps/desktop/src/ipc/file-schema.ts       |  197 ++++
 apps/desktop/src/ipc/methods.ts           |    3 +
 apps/desktop/src/test/mockIpc.ts          |    6 +
 crates/core/Cargo.toml                    |    1 +
 crates/core/src/wire/files.rs             |  514 +++++++++++
 crates/core/src/wire/method.rs            |   10 +
 crates/core/src/wire/mod.rs               |    6 +
 crates/core/tests/file_contract.rs        |  339 +++++++
 crates/daemon/Cargo.toml                  |    2 +
 crates/daemon/src/files/attributes.rs     |   82 ++
 crates/daemon/src/files/descriptor.rs     |  251 +++++
 crates/daemon/src/files/error.rs          |   60 ++
 crates/daemon/src/files/listing.rs        |  168 ++++
 crates/daemon/src/files/metadata.rs       |   79 ++
 crates/daemon/src/files/mod.rs            |  188 ++++
 crates/daemon/src/files/tests.rs          |  313 +++++++
 crates/daemon/src/files/write.rs          |  206 +++++
 crates/daemon/src/lib.rs                  |    1 +
 crates/daemon/src/server.rs               |   40 +-
 crates/daemon/src/sessions.rs             |    1 +
 crates/daemon/src/sessions/files.rs       |  125 +++
 crates/daemon/tests/file_ipc.rs           | 1005 +++++++++++++++++++++
 crates/file-metadata/Cargo.toml           |   19 +
 crates/file-metadata/SAFETY.md            |   50 +
 crates/file-metadata/src/darwin.rs        |   68 ++
 crates/file-metadata/src/lib.rs           |   42 +
 crates/file-metadata/tests/darwin_acl.rs  |  101 +++
 crates/file-metadata/tests/unsupported.rs |   14 +
 docs/adr/0006-local-files-and-editor.md   |   48 +-
 protocol/catalog.json                     |    3 +
 35 files changed, 4267 insertions(+), 8 deletions(-)
 create mode 100644 apps/desktop/src/ipc/file-client.test.ts
 create mode 100644 apps/desktop/src/ipc/file-schema.ts
 create mode 100644 crates/core/src/wire/files.rs
 create mode 100644 crates/core/tests/file_contract.rs
 create mode 100644 crates/daemon/src/files/attributes.rs
 create mode 100644 crates/daemon/src/files/descriptor.rs
 create mode 100644 crates/daemon/src/files/error.rs
 create mode 100644 crates/daemon/src/files/listing.rs
 create mode 100644 crates/daemon/src/files/metadata.rs
 create mode 100644 crates/daemon/src/files/mod.rs
 create mode 100644 crates/daemon/src/files/tests.rs
 create mode 100644 crates/daemon/src/files/write.rs
 create mode 100644 crates/daemon/src/sessions/files.rs
 create mode 100644 crates/daemon/tests/file_ipc.rs
 create mode 100644 crates/file-metadata/Cargo.toml
 create mode 100644 crates/file-metadata/SAFETY.md
 create mode 100644 crates/file-metadata/src/darwin.rs
 create mode 100644 crates/file-metadata/src/lib.rs
 create mode 100644 crates/file-metadata/tests/darwin_acl.rs
 create mode 100644 crates/file-metadata/tests/unsupported.rs

diff --git a/Cargo.lock b/Cargo.lock
index 618eeae..2658b81 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -493,6 +493,7 @@ dependencies = [
 name = "cli-master-core"
 version = "0.2.0"
 dependencies = [
+ "base64 0.22.1",
  "serde",
  "serde_json",
  "uuid",
@@ -505,6 +506,7 @@ dependencies = [
  "base64 0.22.1",
  "cli-master-agents",
  "cli-master-core",
+ "cli-master-file-metadata",
  "cli-master-git",
  "cli-master-session",
  "cli-master-storage",
@@ -512,6 +514,7 @@ dependencies = [
  "rustix",
  "serde",
  "serde_json",
+ "sha2",
  "tempfile",
  "thiserror 2.0.20",
  "tokio",
@@ -560,6 +563,13 @@ dependencies = [
  "signal-hook",
 ]
 
+[[package]]
+name = "cli-master-file-metadata"
+version = "0.2.0"
+dependencies = [
+ "tempfile",
+]
+
 [[package]]
 name = "cli-master-git"
 version = "0.2.0"
diff --git a/Cargo.toml b/Cargo.toml
index 145602f..0ce1017 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -6,6 +6,7 @@ members = [
   "crates/daemon",
   "crates/e2e",
   "crates/fake-agent",
+  "crates/file-metadata",
   "crates/git",
   "crates/session",
   "crates/storage",
diff --git a/apps/desktop/src/ipc/client.ts b/apps/desktop/src/ipc/client.ts
index 62b2cdb..2ad5ff0 100644
--- a/apps/desktop/src/ipc/client.ts
+++ b/apps/desktop/src/ipc/client.ts
@@ -1,5 +1,14 @@
 import { decodeKnowledgeEntry, decodeKnowledgePage } from "./knowledge-schema";
 import type { KnowledgeEntry, KnowledgeListRequest, KnowledgeListResponse, KnowledgeSaveRequest, KnowledgeDeleteRequest } from "./domain";
+import type {
+  FileListRequest,
+  FileListResponse,
+  FileReadRequest,
+  FileReadResponse,
+  FileWriteRequest,
+  FileWriteResponse,
+} from "./domain";
+import { decodeFileListResponse, decodeFileReadResponse, decodeFileWriteResponse } from "./file-schema";
 import { invoke } from "@tauri-apps/api/core";
 import { listen } from "@tauri-apps/api/event";
 import { openPath } from "@tauri-apps/plugin-opener";
@@ -62,6 +71,9 @@ export interface TerminalResizeInput {
 /** The sole frontend interface to daemon and native desktop capabilities. */
 export interface IpcClient {
   readonly platform: AppPlatform;
+  listFiles(input: FileListRequest): Promise<FileListResponse>;
+  readFile(input: FileReadRequest): Promise<FileReadResponse>;
+  writeFile(input: FileWriteRequest): Promise<FileWriteResponse>;
   listKnowledge(input: KnowledgeListRequest): Promise<KnowledgeListResponse>;
   saveKnowledge(input: KnowledgeSaveRequest): Promise<KnowledgeEntry>;
   deleteKnowledge(input: KnowledgeDeleteRequest): Promise<void>;
@@ -141,6 +153,18 @@ export function toIpcError(error: unknown): IpcError {
 class TauriIpcClient implements IpcClient {
   readonly platform = detectPlatform();
 
+  async listFiles(input: FileListRequest): Promise<FileListResponse> {
+    return this.fileRequest("file.list", input, (value) => decodeFileListResponse(value, input));
+  }
+
+  async readFile(input: FileReadRequest): Promise<FileReadResponse> {
+    return this.fileRequest("file.read", input, (value) => decodeFileReadResponse(value, input));
+  }
+
+  async writeFile(input: FileWriteRequest): Promise<FileWriteResponse> {
+    return this.fileRequest("file.write", input, (value) => decodeFileWriteResponse(value, input));
+  }
+
   async listKnowledge(input: KnowledgeListRequest): Promise<KnowledgeListResponse> {
     return decodeKnowledgePage(await this.request("knowledge.list", input));
   }
@@ -313,6 +337,14 @@ class TauriIpcClient implements IpcClient {
     }
   }
 
+  private async fileRequest<T>(method: string, payload: unknown, decode: (value: unknown) => T): Promise<T> {
+    try {
+      return decode(await this.request(method, payload));
+    } catch (error) {
+      throw toIpcError(error);
+    }
+  }
+
   private async request(method: string, payload: unknown): Promise<unknown> {
     const request = createRequestEnvelope(method, payload);
     try {
diff --git a/apps/desktop/src/ipc/domain.ts b/apps/desktop/src/ipc/domain.ts
index d53c607..75ddef9 100644
--- a/apps/desktop/src/ipc/domain.ts
+++ b/apps/desktop/src/ipc/domain.ts
@@ -1,6 +1,6 @@
 /** Additive daemon contracts. Existing UI DTOs remain owned by types.ts. */
 export type * from "./types";
-import type { Worktree } from "./types";
+import type { GitTarget, Worktree } from "./types";
 
 /** List managed worktrees; omission includes every registered project. */
 export interface WorktreeListRequest {
@@ -55,3 +55,65 @@ export interface KnowledgeDeleteRequest {
   readonly id: string;
   readonly expectedRevision: number;
 }
+
+/** Registered project directory, session cwd, or managed worktree root. */
+export type FileTarget = GitTarget | {
+  readonly kind: "worktree";
+  readonly worktreeId: string;
+};
+/** Canonical padded base64 of relative Unix path bytes; empty means list root. */
+export type FilePath = string;
+/** Opaque v1 SHA-256 revision; preserve exactly as returned by the daemon. */
+export type FileRevision = string;
+
+export interface FileEntry {
+  readonly pathBase64: FilePath;
+  readonly displayName: string;
+  readonly kind: "file" | "directory" | "symlink" | "other";
+  readonly sizeBytes?: number;
+  readonly modifiedAtMs?: number;
+}
+
+export interface FileListRequest {
+  readonly target: FileTarget;
+  readonly pathBase64: FilePath;
+  readonly limit?: number;
+  readonly afterNameBase64?: string;
+}
+
+export interface FileListResponse {
+  readonly entries: readonly FileEntry[];
+  readonly nextAfterNameBase64?: string;
+  readonly observedAtMs: number;
+}
+
+export interface FileReadRequest {
+  readonly target: FileTarget;
+  readonly pathBase64: FilePath;
+}
+
+/** Text is bounded to 128 KiB UTF-8 including any BOM; line endings are preserved. */
+export interface FileReadResponse {
+  readonly pathBase64: FilePath;
+  readonly text: string;
+  readonly revision: FileRevision;
+  readonly sizeBytes: number;
+  readonly modifiedAtMs?: number;
+  readonly observedAtMs: number;
+}
+
+/** Existing regular text files only; stale revisions leave the buffer unsaved. */
+export interface FileWriteRequest {
+  readonly target: FileTarget;
+  readonly pathBase64: FilePath;
+  readonly text: string;
+  readonly expectedRevision: FileRevision;
+}
+
+export interface FileWriteResponse {
+  readonly pathBase64: FilePath;
+  readonly revision: FileRevision;
+  readonly sizeBytes: number;
+  readonly modifiedAtMs?: number;
+  readonly writtenAtMs: number;
+}
diff --git a/apps/desktop/src/ipc/file-client.test.ts b/apps/desktop/src/ipc/file-client.test.ts
new file mode 100644
index 0000000..e90800f
--- /dev/null
+++ b/apps/desktop/src/ipc/file-client.test.ts
@@ -0,0 +1,226 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const transport = vi.hoisted(() => ({ invoke: vi.fn() }));
+vi.mock("@tauri-apps/api/core", () => ({ invoke: transport.invoke }));
+vi.mock("@tauri-apps/api/event", () => ({ listen: vi.fn() }));
+vi.mock("@tauri-apps/plugin-opener", () => ({ openPath: vi.fn() }));
+
+import { createMockIpcClient } from "../test/mockIpc";
+import { createTauriIpcClient, IpcError } from "./client";
+import type { FileListRequest, FileReadRequest, FileWriteRequest } from "./domain";
+import type { RequestEnvelope } from "./types";
+
+const REVISION = `v1:${"a".repeat(64)}`;
+const NEXT_REVISION = `v1:${"b".repeat(64)}`;
+const BYTES = "name-\xff\\file:part.txt";
+const PATH = globalThis.btoa(BYTES);
+const TEXT = "\u{feff}olá 🦀\r\nlast line without newline";
+const NOW = 1_787_941_200_000;
+const READ: FileReadRequest = {
+  target: { kind: "session", sessionId: "0198f000-0000-7000-8000-000000000001" },
+  pathBase64: PATH,
+};
+const WRITE: FileWriteRequest = {
+  target: { kind: "worktree", worktreeId: "0198f000-0000-7000-8000-000000000002" },
+  pathBase64: PATH,
+  text: TEXT,
+  expectedRevision: REVISION,
+};
+const LIST: FileListRequest = {
+  target: { kind: "project", projectId: "0198f000-0000-7000-8000-000000000003" },
+  pathBase64: "",
+};
+const READ_RESPONSE = {
+  pathBase64: PATH,
+  text: TEXT,
+  revision: REVISION,
+  sizeBytes: new TextEncoder().encode(TEXT).byteLength,
+  observedAtMs: NOW,
+};
+const WRITE_RESPONSE = {
+  pathBase64: PATH,
+  revision: NEXT_REVISION,
+  sizeBytes: READ_RESPONSE.sizeBytes,
+  writtenAtMs: NOW,
+};
+const ENTRY = {
+  pathBase64: PATH,
+  displayName: "name-\\xff\\file:part.txt",
+  kind: "file",
+};
+
+/** Use the production envelope code and mock only the native transport boundary. */
+function respond(data: unknown): void {
+  transport.invoke.mockImplementation(async (command: string, args: { request: RequestEnvelope<unknown> }) => {
+    expect(command).toBe("daemon_request");
+    return {
+      kind: "response", version: 1, requestId: args.request.requestId,
+      status: "success", data,
+    };
+  });
+}
+
+describe("file IPC transport and decoding", () => {
+  beforeEach(() => {
+    transport.invoke.mockReset();
+  });
+
+  it("preserves registered targets, byte-exact identifiers, revisions and UTF-8 text across the generic transport", async () => {
+    const client = createTauriIpcClient();
+    const page = { entries: [ENTRY], nextAfterNameBase64: PATH, observedAtMs: NOW };
+    respond(page);
+    const listInput = { ...LIST, limit: 25, afterNameBase64: globalThis.btoa("earlier") };
+    expect(await client.listFiles(listInput)).toEqual(page);
+
+    respond({ ...READ_RESPONSE, modifiedAtMs: -1_000 });
+    expect(await client.readFile(READ)).toEqual({ ...READ_RESPONSE, modifiedAtMs: -1_000 });
+
+    respond(WRITE_RESPONSE);
+    const written = await client.writeFile(WRITE);
+    expect(written).toEqual(WRITE_RESPONSE);
+    expect(written).not.toHaveProperty("modifiedAtMs");
+    expect(transport.invoke.mock.calls.map(([command, args]) => ({
+      command,
+      method: args.request.method,
+      payload: args.request.payload,
+    }))).toEqual([
+      { command: "daemon_request", method: "file.list", payload: listInput },
+      { command: "daemon_request", method: "file.read", payload: READ },
+      { command: "daemon_request", method: "file.write", payload: WRITE },
+    ]);
+    expect(globalThis.atob(written.pathBase64)).toBe(BYTES);
+    expect(transport.invoke.mock.calls[2][1].request.payload.text).toBe(TEXT);
+  });
+
+  it("preserves daemon error messages and conflict/durability metadata without adding file contents", async () => {
+    const client = createTauriIpcClient();
+    for (const code of ["file_conflict", "file_durability_uncertain"]) {
+      const error = {
+        code,
+        message: "Refresh this file before retrying.",
+        action: "Read the current revision.",
+        details: { currentRevision: NEXT_REVISION, writeApplied: code === "file_durability_uncertain" },
+      };
+      transport.invoke.mockImplementation(async (_command: string, args: { request: RequestEnvelope<unknown> }) => ({
+        kind: "response", version: 1, requestId: args.request.requestId, status: "error", error,
+      }));
+      try {
+        await client.writeFile(WRITE);
+        expect.fail("a failed save must not become an acknowledgement");
+      } catch (caught) {
+        expect(caught).toBeInstanceOf(IpcError);
+        expect(caught).toMatchObject(error);
+        expect(JSON.stringify(caught)).not.toContain(TEXT);
+      }
+    }
+    expect(transport.invoke).toHaveBeenCalledTimes(2);
+  });
+
+  it.each([
+    ["noncanonical base64", { pathBase64: "YQ" }],
+    ["nonzero padding bits", { pathBase64: "YR==" }],
+    ["traversal", { pathBase64: globalThis.btoa("../private") }],
+    ["absolute path", { pathBase64: globalThis.btoa("/private") }],
+    ["empty path", { pathBase64: "" }],
+    ["different file", { pathBase64: globalThis.btoa("another.txt") }],
+    ["oversized path", { pathBase64: globalThis.btoa("a".repeat(4_097)) }],
+    ["revision", { revision: `v1:${"A".repeat(64)}` }],
+    ["NUL text", { text: "private-file-body\0", sizeBytes: 18 }],
+    ["unpaired surrogate", { text: "\ud800", sizeBytes: 3 }],
+    ["UTF-8 byte bound", { text: "é".repeat(65_537), sizeBytes: 131_074 }],
+    ["byte count mismatch", { sizeBytes: 1 }],
+    ["fractional byte count", { sizeBytes: 1.5 }],
+    ["null modification time", { modifiedAtMs: null }],
+    ["unsafe timestamp", { observedAtMs: Number.MAX_SAFE_INTEGER + 1 }],
+  ])("rejects a malformed read response: %s", async (_label, change) => {
+    respond({ ...READ_RESPONSE, ...change });
+    await expect(createTauriIpcClient().readFile(READ)).rejects.toMatchObject({ code: "invalid_ipc_payload" });
+  });
+
+  it("contract errors never quote malformed field values or file text", async () => {
+    const secret = "private-file-body-not-for-diagnostics";
+    respond({ ...READ_RESPONSE, text: `${secret}\0`, sizeBytes: secret.length + 1 });
+    try {
+      await createTauriIpcClient().readFile(READ);
+      expect.fail("NUL text must be rejected");
+    } catch (error) {
+      expect(error).toBeInstanceOf(IpcError);
+      expect(String(error)).not.toContain(secret);
+      expect(JSON.stringify(error)).not.toContain(secret);
+    }
+  });
+
+  it("accepts the exact 128 KiB UTF-8 boundary including worst-case JSON escapes", async () => {
+    const text = "\u0001".repeat(128 * 1_024);
+    respond({ ...READ_RESPONSE, text, sizeBytes: 128 * 1_024 });
+    const response = await createTauriIpcClient().readFile(READ);
+    expect(response.text).toBe(text);
+    expect(response.sizeBytes).toBe(128 * 1_024);
+  });
+
+  it.each([
+    ["another path", { pathBase64: globalThis.btoa("different.txt") }],
+    ["different byte count", { sizeBytes: WRITE_RESPONSE.sizeBytes + 1 }],
+    ["unbounded byte count", { sizeBytes: 131_073 }],
+    ["invalid revision", { revision: "invalid" }],
+    ["negative publication time", { writtenAtMs: -1 }],
+  ])("refuses an inconsistent save acknowledgement: %s", async (_label, change) => {
+    respond({ ...WRITE_RESPONSE, ...change });
+    await expect(createTauriIpcClient().writeFile(WRITE)).rejects.toMatchObject({ code: "invalid_ipc_payload" });
+  });
+
+  it("ignores future entry kinds conservatively and keeps byte ordering independent of display names", async () => {
+    const entries = [
+      { pathBase64: globalThis.btoa("\x80"), displayName: "z", kind: "future_mount" },
+      { pathBase64: globalThis.btoa("\xff"), displayName: "a", kind: "symlink" },
+    ];
+    respond({ entries, observedAtMs: NOW });
+    const result = await createTauriIpcClient().listFiles(LIST);
+    expect(result.entries).toEqual([{ ...entries[0], kind: "other" }, entries[1]]);
+    expect(result).not.toHaveProperty("nextAfterNameBase64");
+    expect(result.entries[0]).not.toHaveProperty("sizeBytes");
+  });
+
+  it.each([
+    ["duplicate identifier", { entries: [ENTRY, ENTRY], observedAtMs: NOW }],
+    ["nonchild path", { entries: [{ ...ENTRY, pathBase64: globalThis.btoa("nested/file.txt") }], observedAtMs: NOW }],
+    ["empty page with cursor", { entries: [], nextAfterNameBase64: PATH, observedAtMs: NOW }],
+    ["cursor on another name", { entries: [ENTRY], nextAfterNameBase64: globalThis.btoa("other"), observedAtMs: NOW }],
+    ["directory cursor", { entries: [ENTRY], nextAfterNameBase64: globalThis.btoa("nested/file"), observedAtMs: NOW }],
+    ["null cursor", { entries: [ENTRY], nextAfterNameBase64: null, observedAtMs: NOW }],
+    ["unsafe entry size", { entries: [{ ...ENTRY, sizeBytes: Number.MAX_SAFE_INTEGER + 1 }], observedAtMs: NOW }],
+    ["raw display control", { entries: [{ ...ENTRY, displayName: "line\nname" }], observedAtMs: NOW }],
+    ["unrecognized nonstring kind", { entries: [{ ...ENTRY, kind: null }], observedAtMs: NOW }],
+  ])("rejects a malformed file listing: %s", async (_label, page) => {
+    respond(page);
+    await expect(createTauriIpcClient().listFiles(LIST)).rejects.toMatchObject({ code: "invalid_ipc_payload" });
+  });
+
+  it("rejects a page before its exclusive cursor and checks both entry and encoded-byte limits", async () => {
+    const client = createTauriIpcClient();
+    respond({ entries: [ENTRY], observedAtMs: NOW });
+    await expect(client.listFiles({ ...LIST, afterNameBase64: PATH })).rejects.toMatchObject({ code: "invalid_ipc_payload" });
+
+    const entries = Array.from({ length: 201 }, (_, index) => ({
+      pathBase64: globalThis.btoa(index.toString().padStart(3, "0")), displayName: "file", kind: "file",
+    }));
+    respond({ entries, observedAtMs: NOW });
+    await expect(client.listFiles({ ...LIST, limit: 200 })).rejects.toMatchObject({ code: "invalid_ipc_payload" });
+
+    const directory = "d".repeat(4_000);
+    respond({ entries: entries.slice(0, 100).map((entry) => ({
+      ...entry, pathBase64: globalThis.btoa(`${directory}/${globalThis.atob(entry.pathBase64)}`),
+    })), observedAtMs: NOW });
+    await expect(client.listFiles({ ...LIST, pathBase64: globalThis.btoa(directory) })).rejects.toMatchObject({ code: "invalid_ipc_payload" });
+  });
+
+  it("the injected mock rejects unconfigured editor calls and permits explicit handlers", async () => {
+    const unhandled = createMockIpcClient();
+    await expect(unhandled.listFiles(LIST)).rejects.toThrow("Unexpected IPC call in test: listFiles");
+    await expect(unhandled.readFile(READ)).rejects.toThrow("Unexpected IPC call in test: readFile");
+    await expect(unhandled.writeFile(WRITE)).rejects.toThrow("Unexpected IPC call in test: writeFile");
+    const configured = createMockIpcClient({ handlers: { readFile: async () => READ_RESPONSE } });
+    await expect(configured.readFile(READ)).resolves.toEqual(READ_RESPONSE);
+    expect(configured.readFile).toHaveBeenCalledWith(READ);
+  });
+});
diff --git a/apps/desktop/src/ipc/file-schema.ts b/apps/desktop/src/ipc/file-schema.ts
new file mode 100644
index 0000000..f6a0b1b
--- /dev/null
+++ b/apps/desktop/src/ipc/file-schema.ts
@@ -0,0 +1,197 @@
+import type {
+  FileEntry,
+  FileListRequest,
+  FileListResponse,
+  FileReadRequest,
+  FileReadResponse,
+  FileWriteRequest,
+  FileWriteResponse,
+} from "./domain";
+import {
+  IpcContractError,
+  requireArray,
+  requireRecord,
+  requireString,
+} from "./schema";
+
+const MAX_PATH_BYTES = 4_096;
+const MAX_TEXT_BYTES = 128 * 1_024;
+const MAX_PAGE_BYTES = 512 * 1_024;
+const MAX_PAGE_ENTRIES = 200;
+const encoder = new TextEncoder();
+
+/** Decode exact Unix bytes as a binary string, never as a display filename. */
+function pathBytes(value: unknown, allowRoot = false, singleName = false): string {
+  const encoded = requireString(value, "file path identifier");
+  if (encoded.length > Math.ceil(MAX_PATH_BYTES / 3) * 4) {
+    throw new IpcContractError("File path identifier exceeds its byte limit");
+  }
+  let bytes: string;
+  try {
+    bytes = globalThis.atob(encoded);
+  } catch {
+    throw new IpcContractError("File path identifier is not canonical base64");
+  }
+  if (globalThis.btoa(bytes) !== encoded || bytes.length > MAX_PATH_BYTES) {
+    throw new IpcContractError("File path identifier is not canonical base64");
+  }
+  if (allowRoot && bytes === "") return bytes;
+  if (
+    bytes.includes("\0") ||
+    (singleName && bytes.includes("/")) ||
+    bytes.split("/").some((component) =>
+      component === "" || component === "." || component === ".."
+    )
+  ) {
+    throw new IpcContractError("File path identifier must name a relative child");
+  }
+  return bytes;
+}
+
+/** Reject values that cannot be represented exactly by the JavaScript client. */
+function integer(value: unknown, label: string, minimum = 0, maximum = Number.MAX_SAFE_INTEGER): number {
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < minimum || value > maximum) {
+    throw new IpcContractError(`${label} must be a bounded safe integer`);
+  }
+  return value;
+}
+
+/** File modification times may precede 1970; absent times stay omitted. */
+function modifiedTime(row: Record<string, unknown>): { readonly modifiedAtMs?: number } {
+  return row.modifiedAtMs === undefined ? {} : {
+    modifiedAtMs: integer(row.modifiedAtMs, "file modification timestamp", Number.MIN_SAFE_INTEGER),
+  };
+}
+
+/** Keep Rust UTF-8 strings exact rather than repairing lone UTF-16 surrogates. */
+function isUnicodeScalarText(text: string): boolean {
+  for (let index = 0; index < text.length; index += 1) {
+    const unit = text.charCodeAt(index);
+    if (unit >= 0xd800 && unit <= 0xdbff) {
+      const next = text.charCodeAt(index + 1);
+      if (!(next >= 0xdc00 && next <= 0xdfff)) return false;
+      index += 1;
+    } else if (unit >= 0xdc00 && unit <= 0xdfff) {
+      return false;
+    }
+  }
+  return true;
+}
+
+/** Validate text size and encoding without ever echoing the file contents. */
+function textBytes(value: unknown): { readonly text: string; readonly sizeBytes: number } {
+  const text = requireString(value, "file text");
+  if (text.length > MAX_TEXT_BYTES || text.includes("\0") || !isUnicodeScalarText(text)) {
+    throw new IpcContractError("File text exceeds its limit or is not valid UTF-8 text");
+  }
+  const sizeBytes = encoder.encode(text).byteLength;
+  if (sizeBytes > MAX_TEXT_BYTES) {
+    throw new IpcContractError("File text exceeds its UTF-8 byte limit");
+  }
+  return { text, sizeBytes };
+}
+
+/** Revisions are opaque; the frontend validates their versioned wire shape. */
+function revision(value: unknown): string {
+  const revision = requireString(value, "file revision");
+  if (!/^v1:[0-9a-f]{64}$/.test(revision)) {
+    throw new IpcContractError("File revision has an invalid format");
+  }
+  return revision;
+}
+
+/** Decode an observed entry without inferring access rights from its kind. */
+function entry(value: unknown): FileEntry {
+  const row = requireRecord(value, "file entry");
+  const pathBase64 = requireString(row.pathBase64, "file entry path");
+  pathBytes(pathBase64);
+  const displayName = requireString(row.displayName, "file display name");
+  if (
+    displayName.length === 0 || displayName.length > MAX_PATH_BYTES * 4 ||
+    /\p{Cc}/u.test(displayName) || !isUnicodeScalarText(displayName) ||
+    encoder.encode(displayName).byteLength > MAX_PATH_BYTES * 4
+  ) {
+    throw new IpcContractError("File display name is not bounded escaped text");
+  }
+  const observedKind = requireString(row.kind, "file entry kind");
+  const kind = observedKind === "file" || observedKind === "directory" || observedKind === "symlink"
+    ? observedKind : "other";
+  return {
+    pathBase64,
+    displayName,
+    kind,
+    ...(row.sizeBytes === undefined ? {} : { sizeBytes: integer(row.sizeBytes, "file entry size") }),
+    ...modifiedTime(row),
+  };
+}
+
+/** Validate byte ordering, direct children, continuation and the encoded page limit. */
+export function decodeFileListResponse(value: unknown, input: FileListRequest): FileListResponse {
+  const row = requireRecord(value, "file list response");
+  const rawEntries = requireArray(row.entries, "file entries");
+  const limit = integer(input.limit ?? 100, "file page limit", 1, MAX_PAGE_ENTRIES);
+  if (rawEntries.length > limit) throw new IpcContractError("File page exceeds its entry limit");
+  const directory = pathBytes(input.pathBase64, true);
+  let previous = input.afterNameBase64 === undefined ? undefined : pathBytes(input.afterNameBase64, false, true);
+  const entries = rawEntries.map((value) => {
+    const decoded = entry(value);
+    const bytes = pathBytes(decoded.pathBase64);
+    const slash = bytes.lastIndexOf("/");
+    const parent = slash < 0 ? "" : bytes.slice(0, slash);
+    const name = bytes.slice(slash + 1);
+    if (parent !== directory || (previous !== undefined && name <= previous)) {
+      throw new IpcContractError("File page contains an unrelated, duplicate or unordered entry");
+    }
+    previous = name;
+    return decoded;
+  });
+  const next = row.nextAfterNameBase64;
+  if (next !== undefined && (entries.length === 0 || pathBytes(next, false, true) !== previous)) {
+    throw new IpcContractError("File page continuation does not identify its final entry");
+  }
+  const response: FileListResponse = {
+    entries,
+    ...(next === undefined ? {} : { nextAfterNameBase64: requireString(next, "file continuation") }),
+    observedAtMs: integer(row.observedAtMs, "file observation timestamp"),
+  };
+  if (encoder.encode(JSON.stringify(response)).byteLength > MAX_PAGE_BYTES) {
+    throw new IpcContractError("File page exceeds its encoded response limit");
+  }
+  return response;
+}
+
+/** Validate the exact content and identity returned for the requested file. */
+export function decodeFileReadResponse(value: unknown, input: FileReadRequest): FileReadResponse {
+  const row = requireRecord(value, "file read response");
+  const pathBase64 = requireString(row.pathBase64, "file read path");
+  pathBytes(pathBase64);
+  if (pathBase64 !== input.pathBase64) throw new IpcContractError("File read returned another identifier");
+  const content = textBytes(row.text);
+  const sizeBytes = integer(row.sizeBytes, "file text size", 0, MAX_TEXT_BYTES);
+  if (sizeBytes !== content.sizeBytes) throw new IpcContractError("File size does not match its UTF-8 text");
+  return {
+    pathBase64,
+    text: content.text,
+    revision: revision(row.revision),
+    sizeBytes,
+    ...modifiedTime(row),
+    observedAtMs: integer(row.observedAtMs, "file observation timestamp"),
+  };
+}
+
+/** A save acknowledgement must identify the exact path and submitted byte count. */
+export function decodeFileWriteResponse(value: unknown, input: FileWriteRequest): FileWriteResponse {
+  const row = requireRecord(value, "file write response");
+  const pathBase64 = requireString(row.pathBase64, "file write path");
+  pathBytes(pathBase64);
+  if (pathBase64 !== input.pathBase64) throw new IpcContractError("File save returned another identifier");
+  const sizeBytes = integer(row.sizeBytes, "saved file size", 0, MAX_TEXT_BYTES);
+  if (sizeBytes !== textBytes(input.text).sizeBytes) throw new IpcContractError("File save size differs from the submitted text");
+  return {
+    pathBase64,
+    revision: revision(row.revision),
+    sizeBytes,
+    ...modifiedTime(row),
+    writtenAtMs: integer(row.writtenAtMs, "file publication timestamp"),
+  };
+}
diff --git a/apps/desktop/src/ipc/methods.ts b/apps/desktop/src/ipc/methods.ts
index 530b06e..81a2d7b 100644
--- a/apps/desktop/src/ipc/methods.ts
+++ b/apps/desktop/src/ipc/methods.ts
@@ -28,6 +28,9 @@ export const IPC_METHODS = [
   "worktree.list",
   "worktree.prepare_remove",
   "worktree.remove",
+  "file.list",
+  "file.read",
+  "file.write",
   "diagnostics.get",
   "knowledge.list",
   "knowledge.save",
diff --git a/apps/desktop/src/test/mockIpc.ts b/apps/desktop/src/test/mockIpc.ts
index c5bdb6a..6a650cd 100644
--- a/apps/desktop/src/test/mockIpc.ts
+++ b/apps/desktop/src/test/mockIpc.ts
@@ -24,6 +24,9 @@ export interface MockIpcClientOptions {
 
 /** An injected IPC fake whose unconfigured application calls fail loudly. */
 export interface MockIpcClient extends IpcClient {
+  readonly listFiles: Mock<IpcClient["listFiles"]>;
+  readonly readFile: Mock<IpcClient["readFile"]>;
+  readonly writeFile: Mock<IpcClient["writeFile"]>;
   readonly listKnowledge: Mock<IpcClient["listKnowledge"]>;
   readonly saveKnowledge: Mock<IpcClient["saveKnowledge"]>;
   readonly deleteKnowledge: Mock<IpcClient["deleteKnowledge"]>;
@@ -90,6 +93,9 @@ export function createMockIpcClient(
 
   return {
     platform: options.platform ?? "linux",
+    listFiles: vi.fn<IpcClient["listFiles"]>(handlers.listFiles ?? (() => rejectUnhandled("listFiles"))),
+    readFile: vi.fn<IpcClient["readFile"]>(handlers.readFile ?? (() => rejectUnhandled("readFile"))),
+    writeFile: vi.fn<IpcClient["writeFile"]>(handlers.writeFile ?? (() => rejectUnhandled("writeFile"))),
     initialize,
     subscribe,
     subscribeTerminal: vi.fn<IpcClient["subscribeTerminal"]>(
diff --git a/crates/core/Cargo.toml b/crates/core/Cargo.toml
index bea1173..cff9c6b 100644
--- a/crates/core/Cargo.toml
+++ b/crates/core/Cargo.toml
@@ -5,6 +5,7 @@ edition.workspace = true
 rust-version.workspace = true
 
 [dependencies]
+base64 = "0.22.1"
 serde = { version = "1.0.229", features = ["derive"] }
 serde_json = "1.0.151"
 uuid = { version = "1.26.0", features = ["serde", "v7"] }
diff --git a/crates/core/src/wire/files.rs b/crates/core/src/wire/files.rs
new file mode 100644
index 0000000..2d04977
--- /dev/null
+++ b/crates/core/src/wire/files.rs
@@ -0,0 +1,514 @@
+//! Pure local file identifiers and editor request/response contracts.
+
+use std::fmt;
+
+use base64::{Engine as _, engine::general_purpose::STANDARD};
+use serde::{Deserialize, Deserializer, Serialize, de};
+
+use super::{GitTarget, WireValidationError};
+
+/// Maximum decoded length of a relative Unix file identifier.
+pub const MAX_FILE_PATH_BYTES: usize = 4_096;
+/// Maximum UTF-8 byte length accepted by the first text-editor slice.
+pub const MAX_FILE_TEXT_BYTES: usize = 128 * 1_024;
+/// Default number of entries requested in one directory page.
+pub const DEFAULT_FILE_LIST_LIMIT: u16 = 100;
+/// Maximum number of entries requested in one directory page.
+pub const MAX_FILE_LIST_LIMIT: u16 = 200;
+
+/// A registered project, session or worktree whose root the daemon resolves.
+pub type FileTarget = GitTarget;
+
+/// Byte-exact relative Unix path represented as canonical padded base64.
+///
+/// Empty bytes identify the target root for directory listing only. This type
+/// does not interpret Unix filenames as Git pathspecs or Windows paths.
+#[derive(Clone, Debug, Eq, PartialEq, Serialize)]
+#[serde(transparent)]
+pub struct FilePath {
+    encoded: String,
+    #[serde(skip)]
+    bytes: Vec<u8>,
+}
+
+impl FilePath {
+    /// Validates an encoded relative path without accessing the filesystem.
+    ///
+    /// # Errors
+    ///
+    /// Rejects noncanonical base64, oversized paths, NUL, absolute paths, empty
+    /// components and the traversal components `.` or `..`.
+    pub fn try_new(encoded: impl Into<String>) -> Result<Self, WireValidationError> {
+        let encoded = encoded.into();
+        if encoded.len() > MAX_FILE_PATH_BYTES.div_ceil(3) * 4 {
+            return Err(path_error("must decode to at most 4096 bytes"));
+        }
+        let bytes = STANDARD
+            .decode(&encoded)
+            .map_err(|_| path_error("must use canonical padded base64"))?;
+        if STANDARD.encode(&bytes) != encoded {
+            return Err(path_error("must use canonical padded base64"));
+        }
+        validate_path_bytes(&bytes)?;
+        Ok(Self { encoded, bytes })
+    }
+
+    /// Validates exact Unix path bytes and encodes their wire identifier.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error for a path violating the relative path invariants.
+    pub fn try_from_bytes(bytes: impl AsRef<[u8]>) -> Result<Self, WireValidationError> {
+        let bytes = bytes.as_ref();
+        validate_path_bytes(bytes)?;
+        Ok(Self {
+            encoded: STANDARD.encode(bytes),
+            bytes: bytes.to_vec(),
+        })
+    }
+
+    /// Returns the root identifier accepted by directory listing.
+    #[must_use]
+    pub fn root() -> Self {
+        Self {
+            encoded: String::new(),
+            bytes: Vec::new(),
+        }
+    }
+
+    /// Returns the exact decoded bytes; display text must not replace them.
+    #[must_use]
+    pub fn as_bytes(&self) -> &[u8] {
+        &self.bytes
+    }
+
+    /// Returns the canonical base64 wire value.
+    #[must_use]
+    pub fn as_str(&self) -> &str {
+        &self.encoded
+    }
+
+    /// Returns whether this path refers to the registered root.
+    #[must_use]
+    pub fn is_root(&self) -> bool {
+        self.bytes.is_empty()
+    }
+}
+
+impl<'de> Deserialize<'de> for FilePath {
+    fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        Self::try_new(String::deserialize(deserializer)?).map_err(de::Error::custom)
+    }
+}
+
+/// A nonempty single Unix filename used as a directory pagination cursor.
+#[derive(Clone, Debug, Eq, PartialEq, Serialize)]
+#[serde(transparent)]
+pub struct FileName(FilePath);
+
+impl FileName {
+    /// Validates a canonical base64 filename without directory components.
+    ///
+    /// # Errors
+    ///
+    /// Rejects invalid paths, the root, and names containing a slash.
+    pub fn try_new(encoded: impl Into<String>) -> Result<Self, WireValidationError> {
+        Self::from_path(FilePath::try_new(encoded)?)
+    }
+
+    /// Encodes and validates an exact Unix filename.
+    ///
+    /// # Errors
+    ///
+    /// Rejects invalid paths, the root, and names containing a slash.
+    pub fn try_from_bytes(bytes: impl AsRef<[u8]>) -> Result<Self, WireValidationError> {
+        Self::from_path(FilePath::try_from_bytes(bytes)?)
+    }
+
+    fn from_path(path: FilePath) -> Result<Self, WireValidationError> {
+        if path.is_root() || path.as_bytes().contains(&b'/') {
+            return Err(WireValidationError::new(
+                "afterNameBase64",
+                "must identify one nonempty filename",
+            ));
+        }
+        Ok(Self(path))
+    }
+
+    /// Returns exact filename bytes for lexicographic cursor comparisons.
+    #[must_use]
+    pub fn as_bytes(&self) -> &[u8] {
+        self.0.as_bytes()
+    }
+
+    /// Returns the canonical base64 cursor.
+    #[must_use]
+    pub fn as_str(&self) -> &str {
+        self.0.as_str()
+    }
+}
+
+impl<'de> Deserialize<'de> for FileName {
+    fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        Self::try_new(String::deserialize(deserializer)?).map_err(de::Error::custom)
+    }
+}
+
+/// Opaque versioned content/identity digest produced by the daemon.
+#[derive(Clone, Debug, Eq, PartialEq, Serialize)]
+#[serde(transparent)]
+pub struct FileRevision(String);
+
+impl FileRevision {
+    /// Validates the wire shape without inspecting or hashing a file.
+    ///
+    /// # Errors
+    ///
+    /// Requires the exact prefix `v1:` followed by 64 lowercase hex digits.
+    pub fn try_new(value: impl Into<String>) -> Result<Self, WireValidationError> {
+        let value = value.into();
+        if value.len() != 67
+            || !value.starts_with("v1:")
+            || !value.as_bytes()[3..]
+                .iter()
+                .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(byte))
+        {
+            return Err(WireValidationError::new(
+                "revision",
+                "must use v1: followed by 64 lowercase hexadecimal digits",
+            ));
+        }
+        Ok(Self(value))
+    }
+
+    /// Returns the opaque revision string.
+    #[must_use]
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+}
+
+impl<'de> Deserialize<'de> for FileRevision {
+    fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        Self::try_new(String::deserialize(deserializer)?).map_err(de::Error::custom)
+    }
+}
+
+/// Request to list one registered target directory with a bounded page size.
+#[derive(Clone, Debug, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct FileListRequest {
+    /// Registered target whose authoritative root the daemon resolves.
+    pub target: FileTarget,
+    /// Relative directory; an empty identifier means the target root.
+    pub path_base64: FilePath,
+    /// Requested page size, between one and 200 inclusive.
+    pub limit: u16,
+    /// Exclusive cursor compared using exact Unix filename bytes.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub after_name_base64: Option<FileName>,
+}
+
+impl FileListRequest {
+    /// Builds a bounded directory request, using 100 when the limit is absent.
+    ///
+    /// # Errors
+    ///
+    /// Rejects a zero page size or a size above 200 entries.
+    pub fn try_new(
+        target: FileTarget,
+        path_base64: FilePath,
+        limit: Option<u16>,
+        after_name_base64: Option<FileName>,
+    ) -> Result<Self, WireValidationError> {
+        let limit = limit.unwrap_or(DEFAULT_FILE_LIST_LIMIT);
+        if !(1..=MAX_FILE_LIST_LIMIT).contains(&limit) {
+            return Err(WireValidationError::new(
+                "limit",
+                "must be between 1 and 200",
+            ));
+        }
+        Ok(Self {
+            target,
+            path_base64,
+            limit,
+            after_name_base64,
+        })
+    }
+}
+
+impl<'de> Deserialize<'de> for FileListRequest {
+    fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        #[derive(Deserialize)]
+        #[serde(deny_unknown_fields, rename_all = "camelCase")]
+        struct Payload {
+            target: FileTarget,
+            path_base64: FilePath,
+            #[serde(default)]
+            limit: Option<u16>,
+            #[serde(default)]
+            after_name_base64: Option<FileName>,
+        }
+        let value = Payload::deserialize(deserializer)?;
+        Self::try_new(
+            value.target,
+            value.path_base64,
+            value.limit,
+            value.after_name_base64,
+        )
+        .map_err(de::Error::custom)
+    }
+}
+
+/// Request to read a bounded existing text file.
+#[derive(Clone, Debug, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct FileReadRequest {
+    /// Registered target whose authoritative root the daemon resolves.
+    pub target: FileTarget,
+    /// Nonempty relative file identifier.
+    pub path_base64: FilePath,
+}
+
+impl FileReadRequest {
+    /// Builds a read request for a non-root identifier.
+    ///
+    /// # Errors
+    ///
+    /// Rejects the empty root identifier.
+    pub fn try_new(target: FileTarget, path_base64: FilePath) -> Result<Self, WireValidationError> {
+        validate_leaf_path(&path_base64)?;
+        Ok(Self {
+            target,
+            path_base64,
+        })
+    }
+}
+
+impl<'de> Deserialize<'de> for FileReadRequest {
+    fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        #[derive(Deserialize)]
+        #[serde(deny_unknown_fields, rename_all = "camelCase")]
+        struct Payload {
+            target: FileTarget,
+            path_base64: FilePath,
+        }
+        let value = Payload::deserialize(deserializer)?;
+        Self::try_new(value.target, value.path_base64).map_err(de::Error::custom)
+    }
+}
+
+/// Request to replace an existing text file after an optimistic revision check.
+#[derive(Clone, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct FileWriteRequest {
+    /// Registered target whose authoritative root the daemon resolves.
+    pub target: FileTarget,
+    /// Nonempty relative file identifier; this operation never creates a file.
+    pub path_base64: FilePath,
+    /// Exact replacement UTF-8 text, without implicit newline or BOM changes.
+    pub text: String,
+    /// Revision that the caller read before editing.
+    pub expected_revision: FileRevision,
+}
+
+impl FileWriteRequest {
+    /// Builds a bounded request without accessing the file or interpreting text.
+    ///
+    /// # Errors
+    ///
+    /// Rejects the root, NUL-containing text or more than 128 KiB of UTF-8 bytes.
+    pub fn try_new(
+        target: FileTarget,
+        path_base64: FilePath,
+        text: impl Into<String>,
+        expected_revision: FileRevision,
+    ) -> Result<Self, WireValidationError> {
+        validate_leaf_path(&path_base64)?;
+        let text = text.into();
+        validate_text(&text)?;
+        Ok(Self {
+            target,
+            path_base64,
+            text,
+            expected_revision,
+        })
+    }
+}
+
+impl fmt::Debug for FileWriteRequest {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("FileWriteRequest")
+            .field("target", &self.target)
+            .field("path_base64", &self.path_base64)
+            .field("text_bytes", &self.text.len())
+            .field("expected_revision", &self.expected_revision)
+            .finish()
+    }
+}
+
+impl<'de> Deserialize<'de> for FileWriteRequest {
+    fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        #[derive(Deserialize)]
+        #[serde(deny_unknown_fields, rename_all = "camelCase")]
+        struct Payload {
+            target: FileTarget,
+            path_base64: FilePath,
+            text: String,
+            expected_revision: FileRevision,
+        }
+        let value = Payload::deserialize(deserializer)?;
+        Self::try_new(
+            value.target,
+            value.path_base64,
+            value.text,
+            value.expected_revision,
+        )
+        .map_err(de::Error::custom)
+    }
+}
+
+/// Observed entry type; visibility does not grant permission to open an entry.
+#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum FileEntryKind {
+    /// A regular file, which can still be oversized, binary or inaccessible.
+    File,
+    /// A directory that may be listed through descriptor-relative traversal.
+    Directory,
+    /// A visible symlink that the file service does not follow.
+    Symlink,
+    /// A device, socket, FIFO or future unsupported entry kind.
+    #[serde(other)]
+    Other,
+}
+
+/// One observed directory entry with separate identity and display text.
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(deny_unknown_fields, rename_all = "camelCase")]
+pub struct FileEntry {
+    /// Exact relative identifier, never reconstructed from the display name.
+    pub path_base64: FilePath,
+    /// Escaped display text suitable for rendering as text, not HTML.
+    pub display_name: String,
+    /// Observed filesystem kind.
+    pub kind: FileEntryKind,
+    /// Observed file length when meaningful for the entry.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub size_bytes: Option<u64>,
+    /// Modification time in Unix epoch milliseconds when representable.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub modified_at_ms: Option<i64>,
+}
+
+/// A bounded observed directory page, not a filesystem transaction snapshot.
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(deny_unknown_fields, rename_all = "camelCase")]
+pub struct FileListResponse {
+    /// Directory entries in exact filename-byte order.
+    pub entries: Vec<FileEntry>,
+    /// Cursor for the next page; absence means no more entries were observed.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub next_after_name_base64: Option<FileName>,
+    /// Observation time in Unix epoch milliseconds.
+    pub observed_at_ms: i64,
+}
+
+/// Exact text and revision observed through a descriptor-safe bounded read.
+#[derive(Clone, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(deny_unknown_fields, rename_all = "camelCase")]
+pub struct FileReadResponse {
+    /// Exact relative file identifier.
+    pub path_base64: FilePath,
+    /// File contents, preserving line endings and any BOM.
+    pub text: String,
+    /// Opaque revision derived from content and filesystem identity.
+    pub revision: FileRevision,
+    /// Observed UTF-8 byte length.
+    pub size_bytes: u64,
+    /// Modification time in Unix epoch milliseconds when representable.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub modified_at_ms: Option<i64>,
+    /// Observation time in Unix epoch milliseconds.
+    pub observed_at_ms: i64,
+}
+
+impl fmt::Debug for FileReadResponse {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("FileReadResponse")
+            .field("path_base64", &self.path_base64)
+            .field("text_bytes", &self.text.len())
+            .field("revision", &self.revision)
+            .field("size_bytes", &self.size_bytes)
+            .field("modified_at_ms", &self.modified_at_ms)
+            .field("observed_at_ms", &self.observed_at_ms)
+            .finish()
+    }
+}
+
+/// Identity and revision of an atomically published text save.
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(deny_unknown_fields, rename_all = "camelCase")]
+pub struct FileWriteResponse {
+    /// Exact relative file identifier.
+    pub path_base64: FilePath,
+    /// Revision of the published file.
+    pub revision: FileRevision,
+    /// Published UTF-8 byte length.
+    pub size_bytes: u64,
+    /// Modification time in Unix epoch milliseconds when representable.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub modified_at_ms: Option<i64>,
+    /// Publication time in Unix epoch milliseconds.
+    pub written_at_ms: i64,
+}
+
+fn path_error(message: &'static str) -> WireValidationError {
+    WireValidationError::new("pathBase64", message)
+}
+
+fn validate_path_bytes(bytes: &[u8]) -> Result<(), WireValidationError> {
+    if bytes.len() > MAX_FILE_PATH_BYTES {
+        return Err(path_error("must decode to at most 4096 bytes"));
+    }
+    if bytes.contains(&0) {
+        return Err(path_error("must not contain a NUL byte"));
+    }
+    if !bytes.is_empty()
+        && bytes
+            .split(|byte| *byte == b'/')
+            .any(|component| component.is_empty() || component == b"." || component == b"..")
+    {
+        return Err(path_error(
+            "must use nonempty relative child components without traversal",
+        ));
+    }
+    Ok(())
+}
+
+fn validate_leaf_path(path: &FilePath) -> Result<(), WireValidationError> {
+    if path.is_root() {
+        return Err(path_error(
+            "must identify a file rather than the target root",
+        ));
+    }
+    Ok(())
+}
+
+fn validate_text(text: &str) -> Result<(), WireValidationError> {
+    if text.len() > MAX_FILE_TEXT_BYTES {
+        return Err(WireValidationError::new(
+            "text",
+            "must be at most 131072 UTF-8 bytes",
+        ));
+    }
+    if text.contains('\0') {
+        return Err(WireValidationError::new(
+            "text",
+            "must not contain a NUL byte",
+        ));
+    }
+    Ok(())
+}
diff --git a/crates/core/src/wire/method.rs b/crates/core/src/wire/method.rs
index b067015..1d83f08 100644
--- a/crates/core/src/wire/method.rs
+++ b/crates/core/src/wire/method.rs
@@ -62,6 +62,13 @@ pub const WORKTREE_PREPARE_REMOVE: &str = "worktree.prepare_remove";
 /// Remove a managed worktree after token-bound state confirmation.
 pub const WORKTREE_REMOVE: &str = "worktree.remove";
 
+/// List a bounded directory under a registered file target.
+pub const FILE_LIST: &str = "file.list";
+/// Read bounded UTF-8 text with an opaque revision.
+pub const FILE_READ: &str = "file.read";
+/// Atomically save an existing text file after checking its revision.
+pub const FILE_WRITE: &str = "file.write";
+
 /// Read a sanitized local diagnostic snapshot.
 pub const DIAGNOSTICS_GET: &str = "diagnostics.get";
 
@@ -102,6 +109,9 @@ pub const ALL: &[&str] = &[
     WORKTREE_LIST,
     WORKTREE_PREPARE_REMOVE,
     WORKTREE_REMOVE,
+    FILE_LIST,
+    FILE_READ,
+    FILE_WRITE,
     DIAGNOSTICS_GET,
     KNOWLEDGE_LIST,
     KNOWLEDGE_SAVE,
diff --git a/crates/core/src/wire/mod.rs b/crates/core/src/wire/mod.rs
index a5e6657..6f99b2d 100644
--- a/crates/core/src/wire/mod.rs
+++ b/crates/core/src/wire/mod.rs
@@ -8,6 +8,7 @@ pub mod event_name;
 pub mod method;
 
 mod event;
+mod files;
 mod git_path;
 mod request;
 mod response;
@@ -25,6 +26,11 @@ pub use event::{
     SessionExitedEvent, SessionOutputEvent, SessionOutputGapEvent, SessionReplayCompleteEvent,
     SessionStatusChangedEvent, WorktreeChangedEvent, WorktreeRemovedEvent,
 };
+pub use files::{
+    DEFAULT_FILE_LIST_LIMIT, FileEntry, FileEntryKind, FileListRequest, FileListResponse, FileName,
+    FilePath, FileReadRequest, FileReadResponse, FileRevision, FileTarget, FileWriteRequest,
+    FileWriteResponse, MAX_FILE_LIST_LIMIT, MAX_FILE_PATH_BYTES, MAX_FILE_TEXT_BYTES,
+};
 pub use git_path::GitRelativePath;
 pub use request::{
     AgentCommand, AgentCustomCreateRequest, AgentCustomRemoveRequest, AgentCustomUpdateRequest,
diff --git a/crates/core/tests/file_contract.rs b/crates/core/tests/file_contract.rs
new file mode 100644
index 0000000..8b7ba8d
--- /dev/null
+++ b/crates/core/tests/file_contract.rs
@@ -0,0 +1,339 @@
+//! File IPC boundary tests: exact Unix identifiers, bounds and optimistic saves.
+
+use base64::{Engine as _, engine::general_purpose::STANDARD};
+use cli_master_core::wire::{
+    DEFAULT_FILE_LIST_LIMIT, FileEntry, FileEntryKind, FileListRequest, FileListResponse, FileName,
+    FilePath, FileReadRequest, FileReadResponse, FileRevision, FileTarget, FileWriteRequest,
+    FileWriteResponse, MAX_FILE_LIST_LIMIT, MAX_FILE_PATH_BYTES, MAX_FILE_TEXT_BYTES,
+};
+use cli_master_core::{ProjectId, SessionId, WorktreeId};
+use serde_json::{Value, json};
+
+fn target() -> FileTarget {
+    FileTarget::Project {
+        project_id: ProjectId::new(),
+    }
+}
+
+fn revision() -> FileRevision {
+    FileRevision::try_new(format!("v1:{}", "0123456789abcdef".repeat(4))).unwrap()
+}
+
+fn path() -> FilePath {
+    FilePath::try_from_bytes(b"src/editor.rs").unwrap()
+}
+
+fn write_payload(text: &str) -> Value {
+    json!({
+        "target": target(),
+        "pathBase64": path(),
+        "text": text,
+        "expectedRevision": revision(),
+    })
+}
+
+#[test]
+fn paths_round_trip_exact_unix_bytes_without_display_normalization() {
+    let paths: &[&[u8]] = &[
+        b"src/ordinary.txt",
+        b"space in name.txt",
+        "açúcar/日本語.md".as_bytes(),
+        b"binary-name-\xff\xfe.txt",
+        b"-option-looking",
+        b"--",
+        b"literal\\backslash:colon",
+        b"C:/still-a-relative-unix-name",
+        b"line\nbreak\tname",
+    ];
+    for bytes in paths {
+        let path = FilePath::try_from_bytes(bytes).unwrap();
+        let value = serde_json::to_value(&path).unwrap();
+        assert_eq!(value, json!(STANDARD.encode(bytes)));
+        assert_eq!(FilePath::try_new(path.as_str()).unwrap().as_bytes(), *bytes);
+        assert_eq!(serde_json::from_value::<FilePath>(value).unwrap(), path);
+    }
+}
+
+#[test]
+fn path_boundary_rejects_traversal_and_nul_without_echoing_path_contents() {
+    let invalid: &[&[u8]] = &[
+        b"/absolute",
+        b"trailing/",
+        b"empty//component",
+        b".",
+        b"..",
+        b"./child",
+        b"parent/../child",
+        b"parent/./child",
+        b"private-value\0suffix",
+    ];
+    for bytes in invalid {
+        assert!(FilePath::try_from_bytes(bytes).is_err());
+        let error = FilePath::try_new(STANDARD.encode(bytes)).unwrap_err();
+        assert!(!error.to_string().contains("private-value"));
+        assert!(serde_json::from_value::<FilePath>(json!(STANDARD.encode(bytes))).is_err());
+    }
+}
+
+#[test]
+fn path_limit_counts_decoded_bytes_and_canonical_padding_is_required() {
+    let maximum = vec![b'x'; MAX_FILE_PATH_BYTES];
+    assert_eq!(
+        FilePath::try_from_bytes(&maximum).unwrap().as_bytes(),
+        maximum
+    );
+    assert!(FilePath::try_new(STANDARD.encode(&maximum)).is_ok());
+    let oversized = vec![b'x'; MAX_FILE_PATH_BYTES + 1];
+    assert!(FilePath::try_from_bytes(&oversized).is_err());
+    assert!(FilePath::try_new(STANDARD.encode(&oversized)).is_err());
+
+    for invalid in ["YQ", "YQ=", "YR==", "YWJ=", "YQ==\n", "_w==", "YQ===="] {
+        assert!(FilePath::try_new(invalid).is_err(), "accepted {invalid:?}");
+    }
+    assert_eq!(FilePath::try_new("/w==").unwrap().as_bytes(), &[0xff]);
+}
+
+#[test]
+fn root_is_listable_but_never_a_read_or_write_target() {
+    let root = FilePath::root();
+    assert!(root.is_root());
+    assert_eq!(serde_json::to_value(&root).unwrap(), json!(""));
+    assert_eq!(FilePath::try_new("").unwrap(), root);
+    assert!(FileListRequest::try_new(target(), root.clone(), None, None).is_ok());
+    assert!(FileReadRequest::try_new(target(), root.clone()).is_err());
+    assert!(FileWriteRequest::try_new(target(), root, "", revision()).is_err());
+
+    let payload = json!({ "target": target(), "pathBase64": "" });
+    assert!(serde_json::from_value::<FileListRequest>(payload.clone()).is_ok());
+    assert!(serde_json::from_value::<FileReadRequest>(payload).is_err());
+    let mut payload = write_payload("");
+    payload["pathBase64"] = json!("");
+    assert!(serde_json::from_value::<FileWriteRequest>(payload).is_err());
+}
+
+#[test]
+fn directory_cursors_are_exact_single_names() {
+    let cursor = FileName::try_from_bytes(b"-next-\xff.txt").unwrap();
+    assert_eq!(cursor.as_bytes(), b"-next-\xff.txt");
+    assert_eq!(FileName::try_new(cursor.as_str()).unwrap(), cursor);
+    assert_eq!(
+        serde_json::from_value::<FileName>(json!(cursor)).unwrap(),
+        cursor
+    );
+    for invalid in [&b""[..], b".", b"..", b"dir/leaf", b"a\0b"] {
+        assert!(FileName::try_from_bytes(invalid).is_err());
+        assert!(FileName::try_new(STANDARD.encode(invalid)).is_err());
+    }
+}
+
+#[test]
+fn list_defaults_and_limits_are_enforced_at_the_wire_boundary() {
+    let payload = json!({ "target": target(), "pathBase64": "" });
+    let request: FileListRequest = serde_json::from_value(payload.clone()).unwrap();
+    assert_eq!(request.limit, DEFAULT_FILE_LIST_LIMIT);
+    assert!(request.after_name_base64.is_none());
+
+    for limit in [1, MAX_FILE_LIST_LIMIT] {
+        let mut value = payload.clone();
+        value["limit"] = json!(limit);
+        assert_eq!(
+            serde_json::from_value::<FileListRequest>(value)
+                .unwrap()
+                .limit,
+            limit
+        );
+    }
+    for invalid in [json!(0), json!(201), json!(-1), json!(1.5), json!(65536)] {
+        let mut value = payload.clone();
+        value["limit"] = invalid;
+        assert!(serde_json::from_value::<FileListRequest>(value).is_err());
+    }
+    assert!(FileListRequest::try_new(target(), FilePath::root(), Some(0), None).is_err());
+    assert!(FileListRequest::try_new(target(), FilePath::root(), Some(201), None).is_err());
+    let mut value = payload;
+    value["afterNameBase64"] = json!(STANDARD.encode(b"dir/leaf"));
+    assert!(serde_json::from_value::<FileListRequest>(value).is_err());
+}
+
+#[test]
+fn targets_are_registered_ids_and_reject_arbitrary_root_overrides() {
+    for target in [
+        target(),
+        FileTarget::Session {
+            session_id: SessionId::new(),
+        },
+        FileTarget::Worktree {
+            worktree_id: WorktreeId::new(),
+        },
+    ] {
+        let request = FileReadRequest::try_new(target, path()).unwrap();
+        let payload = serde_json::to_value(&request).unwrap();
+        assert_eq!(
+            serde_json::from_value::<FileReadRequest>(payload.clone()).unwrap(),
+            request
+        );
+        assert!(payload.get("pathBase64").unwrap().is_string());
+        assert!(payload.get("cwd").is_none());
+        let mut overridden = payload;
+        overridden["target"]["path"] = json!("/tmp/unregistered");
+        assert!(serde_json::from_value::<FileReadRequest>(overridden).is_err());
+    }
+    for invalid in [
+        json!({ "kind": "path", "path": "/tmp/unregistered" }),
+        json!({ "kind": "project", "projectId": "codex" }),
+        json!({ "kind": "worktree", "worktreeId": "invalid-uuid" }),
+    ] {
+        assert!(serde_json::from_value::<FileTarget>(invalid).is_err());
+    }
+}
+
+#[test]
+fn request_payloads_reject_unknown_fields_and_missing_revision() {
+    let mut read = json!({ "target": target(), "pathBase64": path() });
+    read["root"] = json!("/tmp");
+    assert!(serde_json::from_value::<FileReadRequest>(read).is_err());
+    let mut list = json!({ "target": target(), "pathBase64": "" });
+    list["recursive"] = json!(true);
+    assert!(serde_json::from_value::<FileListRequest>(list).is_err());
+    let mut write = write_payload("content");
+    write["force"] = json!(true);
+    assert!(serde_json::from_value::<FileWriteRequest>(write).is_err());
+    let mut write = write_payload("content");
+    write.as_object_mut().unwrap().remove("expectedRevision");
+    assert!(serde_json::from_value::<FileWriteRequest>(write).is_err());
+}
+
+#[test]
+fn revision_requires_the_versioned_lowercase_digest_shape() {
+    let valid = revision();
+    assert_eq!(
+        serde_json::from_value::<FileRevision>(json!(valid.as_str())).unwrap(),
+        valid
+    );
+    for invalid in [
+        String::new(),
+        "v1:".to_owned(),
+        format!("v1:{}", "a".repeat(63)),
+        format!("v1:{}", "a".repeat(65)),
+        format!("v2:{}", "a".repeat(64)),
+        format!("v1:{}", "A".repeat(64)),
+        format!("v1:{}", "g".repeat(64)),
+        format!("v1:{}", "é".repeat(32)),
+    ] {
+        assert!(FileRevision::try_new(&invalid).is_err());
+        assert!(serde_json::from_value::<FileRevision>(json!(invalid)).is_err());
+    }
+}
+
+#[test]
+fn writes_count_utf8_bytes_and_preserve_line_endings_bom_and_empty_text() {
+    for content in [
+        String::new(),
+        "\u{feff}first\r\nsecond\r\n".to_owned(),
+        "é".repeat(MAX_FILE_TEXT_BYTES / 2),
+    ] {
+        let request = FileWriteRequest::try_new(target(), path(), &content, revision()).unwrap();
+        assert_eq!(request.text, content);
+        assert_eq!(
+            serde_json::from_value::<FileWriteRequest>(write_payload(&content))
+                .unwrap()
+                .text,
+            content
+        );
+    }
+    let oversized = format!("{}x", "é".repeat(MAX_FILE_TEXT_BYTES / 2));
+    for invalid in [oversized, "before\0after".to_owned()] {
+        assert!(FileWriteRequest::try_new(target(), path(), &invalid, revision()).is_err());
+        assert!(serde_json::from_value::<FileWriteRequest>(write_payload(&invalid)).is_err());
+    }
+}
+
+#[test]
+fn maximum_valid_text_fits_the_existing_ipc_frame_even_with_json_escaping() {
+    let request = FileWriteRequest::try_new(
+        target(),
+        FilePath::try_from_bytes(vec![b'x'; MAX_FILE_PATH_BYTES]).unwrap(),
+        "\u{1}".repeat(MAX_FILE_TEXT_BYTES),
+        revision(),
+    )
+    .unwrap();
+    let envelope = cli_master_core::RequestEnvelope::v1("file.write", request);
+    let encoded = serde_json::to_vec(&envelope).unwrap();
+    assert!(encoded.len() < 1024 * 1024);
+}
+
+#[test]
+fn response_contracts_preserve_byte_identity_and_epoch_ms_fields() {
+    let entry = FileEntry {
+        path_base64: FilePath::try_from_bytes(b"raw-\xff.txt").unwrap(),
+        display_name: "raw-\\xFF.txt".to_owned(),
+        kind: FileEntryKind::File,
+        size_bytes: Some(12),
+        modified_at_ms: None,
+    };
+    let list = FileListResponse {
+        entries: vec![entry],
+        next_after_name_base64: Some(FileName::try_from_bytes(b"raw-\xff.txt").unwrap()),
+        observed_at_ms: 1_788_566_400_123,
+    };
+    let list_json = serde_json::to_value(&list).unwrap();
+    assert_eq!(list_json["observedAtMs"], json!(1_788_566_400_123_i64));
+    assert!(list_json["entries"][0].get("modifiedAtMs").is_none());
+    assert_eq!(
+        list_json["entries"][0]["pathBase64"],
+        json!(STANDARD.encode(b"raw-\xff.txt"))
+    );
+    assert_eq!(
+        serde_json::from_value::<FileListResponse>(list_json).unwrap(),
+        list
+    );
+
+    let read = FileReadResponse {
+        path_base64: path(),
+        text: "é\r\n".to_owned(),
+        revision: revision(),
+        size_bytes: 4,
+        modified_at_ms: Some(1_788_566_400_100),
+        observed_at_ms: 1_788_566_400_123,
+    };
+    let value = serde_json::to_value(&read).unwrap();
+    assert_eq!(value["text"], json!("é\r\n"));
+    assert_eq!(
+        serde_json::from_value::<FileReadResponse>(value).unwrap(),
+        read
+    );
+
+    let write = FileWriteResponse {
+        path_base64: path(),
+        revision: revision(),
+        size_bytes: 4,
+        modified_at_ms: Some(1_788_566_400_200),
+        written_at_ms: 1_788_566_400_201,
+    };
+    let value = serde_json::to_value(&write).unwrap();
+    assert_eq!(value["writtenAtMs"], json!(1_788_566_400_201_i64));
+    assert_eq!(
+        serde_json::from_value::<FileWriteResponse>(value).unwrap(),
+        write
+    );
+}
+
+#[test]
+fn unsupported_entry_kinds_stay_noneditable_and_text_is_redacted_from_debug() {
+    assert_eq!(
+        serde_json::from_value::<FileEntryKind>(json!("future_device")).unwrap(),
+        FileEntryKind::Other
+    );
+    let text = "sensitive document contents";
+    let write = FileWriteRequest::try_new(target(), path(), text, revision()).unwrap();
+    assert!(!format!("{write:?}").contains(text));
+    let read = FileReadResponse {
+        path_base64: path(),
+        text: text.to_owned(),
+        revision: revision(),
+        size_bytes: u64::try_from(text.len()).unwrap(),
+        modified_at_ms: None,
+        observed_at_ms: 1_788_566_400_123,
+    };
+    assert!(!format!("{read:?}").contains(text));
+}
diff --git a/crates/daemon/Cargo.toml b/crates/daemon/Cargo.toml
index 475d9d4..13aa856 100644
--- a/crates/daemon/Cargo.toml
+++ b/crates/daemon/Cargo.toml
@@ -18,6 +18,7 @@ path = "src/main.rs"
 [dependencies]
 base64 = "0.22.1"
 cli-master-core = { path = "../core" }
+cli-master-file-metadata = { path = "../file-metadata" }
 cli-master-git = { path = "../git" }
 cli-master-session = { path = "../session" }
 cli-master-storage = { path = "../storage" }
@@ -26,6 +27,7 @@ futures-util = { version = "0.3.31", features = ["sink"] }
 rustix = { version = "1.1.4", features = ["fs", "net", "process"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
+sha2 = "0.10.9"
 thiserror = "2"
 tokio = { version = "1", features = ["io-util", "macros", "net", "rt-multi-thread", "signal", "sync", "time"] }
 tokio-util = { version = "0.7", features = ["codec", "rt"] }
diff --git a/crates/daemon/src/files/attributes.rs b/crates/daemon/src/files/attributes.rs
new file mode 100644
index 0000000..6619878
--- /dev/null
+++ b/crates/daemon/src/files/attributes.rs
@@ -0,0 +1,82 @@
+//! Only explicitly supported, bounded attributes may survive atomic replacement.
+
+use std::fs::File;
+
+use cli_master_core::ApiError;
+use rustix::fs::flistxattr;
+
+use super::error::metadata_unsupported;
+
+#[derive(Eq, PartialEq)]
+pub(super) struct SupportedAttributes {
+    #[cfg(target_os = "macos")]
+    provenance: Option<Vec<u8>>,
+}
+
+#[cfg(target_os = "linux")]
+pub(super) fn read_supported(file: &File) -> Result<SupportedAttributes, ApiError> {
+    let mut names = [0_u8; 1];
+    match flistxattr(file, &mut names[..]) {
+        Ok(0) => Ok(SupportedAttributes {}),
+        Ok(_) | Err(_) => Err(metadata_unsupported()),
+    }
+}
+
+#[cfg(target_os = "macos")]
+const PROVENANCE_NAME: &str = "com.apple.provenance";
+#[cfg(target_os = "macos")]
+const MAX_PROVENANCE_BYTES: usize = 4_096;
+
+#[cfg(target_os = "macos")]
+pub(super) fn read_supported(file: &File) -> Result<SupportedAttributes, ApiError> {
+    let mut names = [0_u8; PROVENANCE_NAME.len() + 1];
+    let length = flistxattr(file, &mut names[..]).map_err(|_| metadata_unsupported())?;
+    if length == 0 {
+        return Ok(SupportedAttributes { provenance: None });
+    }
+    // The list must contain exactly this one NUL-terminated name. A longer
+    // list fails at the syscall bound, including resource forks and ACL xattrs.
+    if length != names.len()
+        || &names[..PROVENANCE_NAME.len()] != PROVENANCE_NAME.as_bytes()
+        || names[PROVENANCE_NAME.len()] != 0
+    {
+        return Err(metadata_unsupported());
+    }
+    let mut value = vec![0_u8; MAX_PROVENANCE_BYTES];
+    let length = rustix::fs::fgetxattr(file, PROVENANCE_NAME, &mut value[..])
+        .map_err(|_| metadata_unsupported())?;
+    value.truncate(length);
+    Ok(SupportedAttributes {
+        provenance: Some(value),
+    })
+}
+
+pub(super) fn preserve(source: &File, destination: &File) -> Result<(), ApiError> {
+    let original = read_supported(source)?;
+    let staged = read_supported(destination)?;
+    if original != staged {
+        #[cfg(target_os = "macos")]
+        if let Some(value) = original.provenance.as_ref() {
+            rustix::fs::fsetxattr(
+                destination,
+                PROVENANCE_NAME,
+                value,
+                rustix::fs::XattrFlags::empty(),
+            )
+            .map_err(|_| metadata_unsupported())?;
+        }
+        // Darwin may report success while retaining an OS-owned provenance
+        // value. Never infer preservation from the write syscall alone.
+        if original != read_supported(destination)? {
+            return Err(metadata_unsupported());
+        }
+    }
+    verify_preserved(source, destination)
+}
+
+pub(super) fn verify_preserved(source: &File, destination: &File) -> Result<(), ApiError> {
+    if read_supported(source)? != read_supported(destination)? {
+        return Err(metadata_unsupported());
+    }
+    Ok(())
+}
diff --git a/crates/daemon/src/files/descriptor.rs b/crates/daemon/src/files/descriptor.rs
new file mode 100644
index 0000000..012763e
--- /dev/null
+++ b/crates/daemon/src/files/descriptor.rs
@@ -0,0 +1,251 @@
+use std::ffi::{OsStr, OsString};
+use std::fs::File;
+use std::io::Read;
+use std::os::fd::{AsFd, OwnedFd};
+use std::os::unix::ffi::{OsStrExt, OsStringExt};
+use std::path::{Component, Path};
+
+use cli_master_core::ApiError;
+use cli_master_core::wire::{FilePath, FileRevision, MAX_FILE_TEXT_BYTES};
+use rustix::fs::{AtFlags, FileType, Mode, OFlags, Stat, fstat, open, openat, statat};
+use sha2::{Digest, Sha256};
+
+use super::error::{api, conflict, io_error, target_changed};
+
+#[derive(Clone, Copy, Debug, Eq, Hash, PartialEq)]
+pub(super) struct Identity {
+    pub device: i128,
+    pub inode: u128,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub(super) struct Fingerprint {
+    pub identity: Identity,
+    pub size: i128,
+    pub modified_seconds: i128,
+    pub modified_nanos: i128,
+    pub changed_seconds: i128,
+    pub changed_nanos: i128,
+    pub links: u128,
+    pub mode: u32,
+    pub uid: u32,
+    pub gid: u32,
+    pub flags: u32,
+}
+
+impl Fingerprint {
+    #[allow(
+        clippy::useless_conversion,
+        reason = "Unix stat field widths differ between Linux and macOS"
+    )]
+    pub(super) fn from_stat(stat: &Stat) -> Self {
+        Self {
+            identity: identity(stat),
+            size: stat.st_size.into(),
+            modified_seconds: stat.st_mtime.into(),
+            modified_nanos: stat.st_mtime_nsec.into(),
+            changed_seconds: stat.st_ctime.into(),
+            changed_nanos: stat.st_ctime_nsec.into(),
+            links: stat.st_nlink.into(),
+            mode: stat.st_mode.into(),
+            uid: stat.st_uid,
+            gid: stat.st_gid,
+            #[cfg(target_os = "macos")]
+            flags: stat.st_flags,
+            #[cfg(not(target_os = "macos"))]
+            flags: 0,
+        }
+    }
+
+    pub(super) fn modified_at_ms(&self) -> Option<i64> {
+        self.modified_seconds
+            .checked_mul(1_000)?
+            .checked_add(self.modified_nanos.checked_div(1_000_000)?)?
+            .try_into()
+            .ok()
+    }
+
+    pub(super) fn revision(&self, bytes: &[u8]) -> Result<FileRevision, ApiError> {
+        let mut hash = Sha256::new();
+        hash.update(b"cli-master-file-revision-v1\0");
+        hash.update(self.identity.device.to_be_bytes());
+        hash.update(self.identity.inode.to_be_bytes());
+        for value in [
+            self.size,
+            self.modified_seconds,
+            self.modified_nanos,
+            self.changed_seconds,
+            self.changed_nanos,
+        ] {
+            hash.update(value.to_be_bytes());
+        }
+        hash.update(self.links.to_be_bytes());
+        for value in [self.mode, self.uid, self.gid, self.flags] {
+            hash.update(value.to_be_bytes());
+        }
+        hash.update(bytes);
+        FileRevision::try_new(format!("v1:{:x}", hash.finalize()))
+            .map_err(|_| api("file_io_error", "The file revision could not be encoded."))
+    }
+}
+
+pub(super) fn identity(stat: &Stat) -> Identity {
+    Identity {
+        device: stat.st_dev.into(),
+        inode: stat.st_ino.into(),
+    }
+}
+
+pub(super) fn directory_flags() -> OFlags {
+    OFlags::RDONLY | OFlags::DIRECTORY | OFlags::NOFOLLOW | OFlags::CLOEXEC
+}
+
+/// Walk even the registered absolute root by descriptor; an intermediate
+/// symlink cannot redirect a root open after canonical-path validation.
+pub(super) fn open_root(path: &Path) -> Result<OwnedFd, ApiError> {
+    if !path.is_absolute() || path.canonicalize().map_err(|_| target_changed())? != path {
+        return Err(target_changed());
+    }
+    let mut directory = open("/", directory_flags(), Mode::empty()).map_err(io_error)?;
+    for component in path.components() {
+        match component {
+            Component::RootDir => {}
+            Component::Normal(name) => {
+                directory = openat(&directory, name, directory_flags(), Mode::empty())
+                    .map_err(|_| target_changed())?;
+            }
+            _ => return Err(target_changed()),
+        }
+    }
+    Ok(directory)
+}
+
+pub(super) fn open_directory(root: &impl AsFd, bytes: &[u8]) -> Result<OwnedFd, ApiError> {
+    let mut directory = openat(root, ".", directory_flags(), Mode::empty()).map_err(io_error)?;
+    if !bytes.is_empty() {
+        for component in bytes.split(|byte| *byte == b'/') {
+            let name = OsStr::from_bytes(component);
+            let observed = statat(&directory, name, AtFlags::SYMLINK_NOFOLLOW).map_err(io_error)?;
+            if FileType::from_raw_mode(observed.st_mode) == FileType::Symlink {
+                return Err(api(
+                    "file_symlink_not_allowed",
+                    "Symbolic links cannot be followed by the editor.",
+                ));
+            }
+            directory =
+                openat(&directory, name, directory_flags(), Mode::empty()).map_err(io_error)?;
+        }
+    }
+    Ok(directory)
+}
+
+pub(super) fn split_file_path(path: &FilePath) -> Result<(&[u8], OsString), ApiError> {
+    let bytes = path.as_bytes();
+    if bytes.is_empty() {
+        return Err(super::error::invalid_input());
+    }
+    match bytes.iter().rposition(|byte| *byte == b'/') {
+        Some(index) => Ok((
+            &bytes[..index],
+            OsString::from_vec(bytes[index + 1..].to_vec()),
+        )),
+        None => Ok((&[], OsString::from_vec(bytes.to_vec()))),
+    }
+}
+
+pub(super) struct TextFile {
+    pub file: File,
+    pub fingerprint: Fingerprint,
+    pub text: String,
+    pub revision: FileRevision,
+}
+
+pub(super) fn read_leaf(parent: &impl AsFd, name: &OsStr) -> Result<TextFile, ApiError> {
+    let observed = statat(parent, name, AtFlags::SYMLINK_NOFOLLOW).map_err(io_error)?;
+    require_regular(&observed)?;
+    let fd = openat(
+        parent,
+        name,
+        OFlags::RDONLY | OFlags::NOFOLLOW | OFlags::NONBLOCK | OFlags::CLOEXEC,
+        Mode::empty(),
+    )
+    .map_err(io_error)?;
+    let before = fstat(&fd).map_err(io_error)?;
+    require_regular(&before)?;
+    let fingerprint = Fingerprint::from_stat(&before);
+    if fingerprint.size
+        > i128::try_from(MAX_FILE_TEXT_BYTES).map_err(|_| super::error::invalid_input())?
+    {
+        return Err(api(
+            "file_too_large",
+            "The selected file exceeds the 128 KiB text limit.",
+        ));
+    }
+    let mut file = File::from(fd);
+    let mut bytes = Vec::new();
+    (&mut file)
+        .take(u64::try_from(MAX_FILE_TEXT_BYTES + 1).map_err(|_| super::error::invalid_input())?)
+        .read_to_end(&mut bytes)
+        .map_err(io_error)?;
+    if bytes.len() > MAX_FILE_TEXT_BYTES {
+        return Err(api(
+            "file_too_large",
+            "The selected file exceeds the 128 KiB text limit.",
+        ));
+    }
+    let after = Fingerprint::from_stat(&fstat(&file).map_err(io_error)?);
+    if before.st_ino != observed.st_ino || before.st_dev != observed.st_dev || fingerprint != after
+    {
+        return Err(conflict(None));
+    }
+    if bytes.contains(&0) {
+        return Err(api(
+            "file_not_text",
+            "The selected file contains binary data.",
+        ));
+    }
+    let text = String::from_utf8(bytes).map_err(|_| {
+        api(
+            "file_not_text",
+            "The selected file is not valid UTF-8 text.",
+        )
+    })?;
+    let revision = fingerprint.revision(text.as_bytes())?;
+    Ok(TextFile {
+        file,
+        fingerprint,
+        text,
+        revision,
+    })
+}
+
+pub(super) fn require_regular(stat: &Stat) -> Result<(), ApiError> {
+    match FileType::from_raw_mode(stat.st_mode) {
+        FileType::RegularFile => Ok(()),
+        FileType::Symlink => Err(api(
+            "file_symlink_not_allowed",
+            "Symbolic links cannot be edited.",
+        )),
+        _ => Err(api(
+            "file_not_regular",
+            "The selected object is not a regular file.",
+        )),
+    }
+}
+
+pub(super) fn revalidate_namespace(
+    root_path: &Path,
+    root_identity: Identity,
+    parent_bytes: &[u8],
+    parent_identity: Identity,
+) -> Result<(), ApiError> {
+    let root = open_root(root_path)?;
+    if identity(&fstat(&root).map_err(io_error)?) != root_identity {
+        return Err(target_changed());
+    }
+    let parent = open_directory(&root, parent_bytes).map_err(|_| target_changed())?;
+    if identity(&fstat(&parent).map_err(io_error)?) != parent_identity {
+        return Err(target_changed());
+    }
+    Ok(())
+}
diff --git a/crates/daemon/src/files/error.rs b/crates/daemon/src/files/error.rs
new file mode 100644
index 0000000..3b03d16
--- /dev/null
+++ b/crates/daemon/src/files/error.rs
@@ -0,0 +1,60 @@
+use cli_master_core::ApiError;
+use rustix::io::Errno;
+
+pub(super) fn io_error(error: impl Into<std::io::Error>) -> ApiError {
+    let error = error.into();
+    match error.raw_os_error().map(Errno::from_raw_os_error) {
+        Some(Errno::NOENT) => api("file_not_found", "The selected file no longer exists."),
+        Some(Errno::NOTDIR) => api(
+            "file_not_directory",
+            "A selected path component is not a directory.",
+        ),
+        Some(Errno::LOOP) => api(
+            "file_symlink_not_allowed",
+            "Symbolic links cannot be followed by the editor.",
+        ),
+        Some(Errno::ACCESS | Errno::PERM) => api(
+            "file_permission_denied",
+            "The file operation is not permitted.",
+        ),
+        _ => api("file_io_error", "The file operation could not complete."),
+    }
+}
+
+pub(super) fn api(code: &str, message: &str) -> ApiError {
+    ApiError::new(code, message).with_action(
+        "Keep the editor draft, refresh the selected file, and retry after resolving the error.",
+    )
+}
+
+pub(super) fn target_changed() -> ApiError {
+    api(
+        "file_target_changed",
+        "The registered directory changed or is no longer available for this operation.",
+    )
+}
+
+pub(super) fn metadata_unsupported() -> ApiError {
+    api(
+        "file_metadata_unsupported",
+        "This file has metadata that cannot be safely preserved by the editor.",
+    )
+}
+
+pub(super) fn invalid_input() -> ApiError {
+    api(
+        "invalid_input",
+        "The file request contains an invalid target, path, text, revision, or limit.",
+    )
+}
+
+pub(super) fn conflict(revision: Option<&str>) -> ApiError {
+    let error = api(
+        "file_conflict",
+        "The file changed after it was read. Reload before saving.",
+    );
+    match revision {
+        Some(revision) => error.with_detail("currentRevision", revision),
+        None => error,
+    }
+}
diff --git a/crates/daemon/src/files/listing.rs b/crates/daemon/src/files/listing.rs
new file mode 100644
index 0000000..a39a6b7
--- /dev/null
+++ b/crates/daemon/src/files/listing.rs
@@ -0,0 +1,168 @@
+use std::ffi::OsStr;
+use std::os::fd::OwnedFd;
+use std::os::unix::ffi::OsStrExt;
+
+use cli_master_core::ApiError;
+use cli_master_core::wire::{
+    FileEntry, FileEntryKind, FileListRequest, FileListResponse, FileName, FilePath,
+};
+use rustix::fs::{AtFlags, Dir, FileType, fstat, statat};
+use rustix::io::Errno;
+
+use super::descriptor::{Fingerprint, identity, open_directory, revalidate_namespace};
+use super::error::{api, io_error, target_changed};
+use super::{FileTargetAccess, LocalFileService, now_ms};
+
+const MAX_ENUMERATED_ENTRIES: usize = 10_000;
+const MAX_PAGE_BYTES: usize = 512 * 1_024;
+const PAGE_OVERHEAD_BYTES: usize = 16 * 1_024;
+
+pub(super) fn list(
+    service: &LocalFileService,
+    request: &FileListRequest,
+    access: &impl FileTargetAccess,
+) -> Result<FileListResponse, ApiError> {
+    let resolved = access.resolve_target(&request.target, false)?;
+    let (root, root_identity) = service.open_target(&request.target, &resolved)?;
+    let directory = open_directory(&root, request.path_base64.as_bytes())?;
+    let directory_identity = identity(&fstat(&directory).map_err(io_error)?);
+    let names = enumerate_names(&directory)?;
+    let mut entries = Vec::new();
+    let mut last_name = None;
+    let mut next_after_name_base64 = None;
+    let mut page_bytes = PAGE_OVERHEAD_BYTES;
+    for name in names {
+        if request
+            .after_name_base64
+            .as_ref()
+            .is_some_and(|cursor| name.as_slice() <= cursor.as_bytes())
+        {
+            continue;
+        }
+        let stat = match statat(
+            &directory,
+            OsStr::from_bytes(&name),
+            AtFlags::SYMLINK_NOFOLLOW,
+        ) {
+            Ok(stat) => stat,
+            Err(Errno::NOENT) => continue,
+            Err(error) => return Err(io_error(error)),
+        };
+        let mut path = request.path_base64.as_bytes().to_vec();
+        if !path.is_empty() {
+            path.push(b'/');
+        }
+        path.extend_from_slice(&name);
+        let kind = match FileType::from_raw_mode(stat.st_mode) {
+            FileType::RegularFile => FileEntryKind::File,
+            FileType::Directory => FileEntryKind::Directory,
+            FileType::Symlink => FileEntryKind::Symlink,
+            _ => FileEntryKind::Other,
+        };
+        let entry = FileEntry {
+            path_base64: FilePath::try_from_bytes(path).map_err(|_| {
+                api(
+                    "file_listing_too_large",
+                    "A directory entry exceeds the supported relative-path limit.",
+                )
+            })?,
+            display_name: display_name(&name),
+            kind,
+            size_bytes: if kind == FileEntryKind::File {
+                u64::try_from(stat.st_size).ok()
+            } else {
+                None
+            },
+            modified_at_ms: Fingerprint::from_stat(&stat).modified_at_ms(),
+        };
+        let entry_bytes = serde_json::to_vec(&entry)
+            .map_err(|_| api("file_io_error", "The directory entry could not be encoded."))?
+            .len()
+            + 1;
+        if entries.len() >= usize::from(request.limit) || page_bytes + entry_bytes > MAX_PAGE_BYTES
+        {
+            next_after_name_base64 = last_name;
+            break;
+        }
+        page_bytes += entry_bytes;
+        entries.push(entry);
+        last_name = Some(FileName::try_from_bytes(name).map_err(|_| {
+            api(
+                "file_io_error",
+                "The directory cursor could not be encoded.",
+            )
+        })?);
+    }
+    if access.resolve_target(&request.target, false)?.root != resolved.root {
+        return Err(target_changed());
+    }
+    revalidate_namespace(
+        &resolved.root,
+        root_identity,
+        request.path_base64.as_bytes(),
+        directory_identity,
+    )?;
+    Ok(FileListResponse {
+        entries,
+        next_after_name_base64,
+        observed_at_ms: now_ms()?,
+    })
+}
+
+fn enumerate_names(directory: &OwnedFd) -> Result<Vec<Vec<u8>>, ApiError> {
+    let mut names = Vec::new();
+    for entry in Dir::read_from(directory).map_err(io_error)? {
+        let entry = entry.map_err(io_error)?;
+        let name = entry.file_name().to_bytes();
+        if matches!(name, b"." | b"..") {
+            continue;
+        }
+        if names.len() == MAX_ENUMERATED_ENTRIES {
+            return Err(api(
+                "file_listing_too_large",
+                "This directory exceeds the 10,000-entry enumeration limit.",
+            ));
+        }
+        names.push(name.to_vec());
+    }
+    names.sort_unstable();
+    names.dedup();
+    Ok(names)
+}
+
+/// Valid Unicode stays readable; undecodable/control bytes are explicit escapes.
+fn display_name(bytes: &[u8]) -> String {
+    let mut display = String::new();
+    let mut remaining = bytes;
+    while !remaining.is_empty() {
+        match std::str::from_utf8(remaining) {
+            Ok(text) => {
+                append_text(&mut display, text);
+                break;
+            }
+            Err(error) => {
+                let (valid, invalid) = remaining.split_at(error.valid_up_to());
+                if let Ok(text) = std::str::from_utf8(valid) {
+                    append_text(&mut display, text);
+                }
+                let invalid_length = error.error_len().unwrap_or(invalid.len());
+                for byte in &invalid[..invalid_length] {
+                    use std::fmt::Write;
+                    let _ = write!(display, "\\x{byte:02x}");
+                }
+                remaining = &invalid[invalid_length..];
+            }
+        }
+    }
+    display
+}
+
+fn append_text(display: &mut String, text: &str) {
+    for character in text.chars() {
+        if character.is_control() {
+            display.extend(character.escape_default());
+        } else {
+            display.push(character);
+        }
+    }
+}
diff --git a/crates/daemon/src/files/metadata.rs b/crates/daemon/src/files/metadata.rs
new file mode 100644
index 0000000..e85e6f9
--- /dev/null
+++ b/crates/daemon/src/files/metadata.rs
@@ -0,0 +1,79 @@
+//! Metadata that this atomic-replacement slice can preserve without elevation.
+
+use std::fs::File;
+
+use cli_master_core::ApiError;
+use rustix::fs::{Gid, Mode, Uid, fchmod, fchown, fstat};
+
+use super::attributes;
+use super::descriptor::Fingerprint;
+use super::error::metadata_unsupported;
+
+pub(super) fn inspect(file: &File, fingerprint: &Fingerprint) -> Result<(), ApiError> {
+    // Replacing a multiply-linked inode would silently disconnect its siblings.
+    // Special mode bits and platform flags are outside this plain-text slice.
+    if fingerprint.links != 1 || fingerprint.mode & 0o7000 != 0 || fingerprint.flags != 0 {
+        return Err(metadata_unsupported());
+    }
+    attributes::read_supported(file)?;
+    inspect_platform(file)
+}
+
+pub(super) fn apply(
+    source: &File,
+    destination: &File,
+    fingerprint: &Fingerprint,
+) -> Result<(), ApiError> {
+    // Source metadata is checked again to observe ACL/xattr changes during staging.
+    inspect(source, fingerprint)?;
+    let current = fstat(destination).map_err(|_| metadata_unsupported())?;
+    if current.st_uid != fingerprint.uid || current.st_gid != fingerprint.gid {
+        fchown(
+            destination,
+            Some(Uid::from_raw(fingerprint.uid)),
+            Some(Gid::from_raw(fingerprint.gid)),
+        )
+        .map_err(|_| metadata_unsupported())?;
+    }
+    #[allow(
+        clippy::useless_conversion,
+        reason = "RawMode is u16 on macOS and u32 on Linux"
+    )]
+    let permissions = rustix::fs::RawMode::try_from(fingerprint.mode & 0o777)
+        .map_err(|_| metadata_unsupported())?;
+    fchmod(destination, Mode::from_raw_mode(permissions)).map_err(|_| metadata_unsupported())?;
+    let copied = Fingerprint::from_stat(&fstat(destination).map_err(|_| metadata_unsupported())?);
+    if copied.uid != fingerprint.uid
+        || copied.gid != fingerprint.gid
+        || copied.mode & 0o7777 != fingerprint.mode & 0o7777
+    {
+        return Err(metadata_unsupported());
+    }
+    attributes::preserve(source, destination)?;
+    // A parent may have supplied inherited ACLs or attributes to the new inode.
+    // Never publish an inode whose access policy differs silently from the old file.
+    inspect(destination, &copied)
+}
+
+#[cfg(target_os = "macos")]
+fn inspect_platform(file: &File) -> Result<(), ApiError> {
+    if cli_master_file_metadata::has_extended_acl(file).map_err(|_| metadata_unsupported())? {
+        return Err(metadata_unsupported());
+    }
+    Ok(())
+}
+
+#[cfg(target_os = "linux")]
+fn inspect_platform(file: &File) -> Result<(), ApiError> {
+    use rustix::fs::ioctl_getflags;
+    use rustix::io::Errno;
+
+    // EXTENTS describes the regular ext4 allocation representation, not an
+    // authored inode policy. Every other flag requires explicit preservation.
+    const EXTENTS: u32 = 0x0008_0000;
+    match ioctl_getflags(file) {
+        Ok(flags) if flags.bits() & !EXTENTS == 0 => Ok(()),
+        Err(Errno::NOTTY | Errno::OPNOTSUPP) => Ok(()),
+        _ => Err(metadata_unsupported()),
+    }
+}
diff --git a/crates/daemon/src/files/mod.rs b/crates/daemon/src/files/mod.rs
new file mode 100644
index 0000000..6e021c9
--- /dev/null
+++ b/crates/daemon/src/files/mod.rs
@@ -0,0 +1,188 @@
+//! Descriptor-relative local text files; all roots come from daemon metadata.
+
+mod attributes;
+mod descriptor;
+mod error;
+mod listing;
+mod metadata;
+mod write;
+
+#[cfg(test)]
+mod tests;
+
+use std::collections::HashMap;
+use std::path::{Path, PathBuf};
+use std::sync::{Arc, Mutex, Weak};
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use cli_master_core::ApiError;
+use cli_master_core::wire::{
+    FileListRequest, FileReadRequest, FileReadResponse, FileTarget, FileWriteRequest,
+    FileWriteResponse, method,
+};
+use rustix::fs::fstat;
+use serde::{Serialize, de::DeserializeOwned};
+use serde_json::Value;
+
+use descriptor::{
+    Identity, identity, open_directory, open_root, read_leaf, revalidate_namespace, split_file_path,
+};
+use error::{api, invalid_input, io_error, target_changed};
+
+/// A root obtained from a currently registered project, session or worktree.
+pub(crate) struct ResolvedFileTarget {
+    pub(crate) root: PathBuf,
+}
+
+/// Runtime authority supplies metadata resolution and its worktree-removal lease.
+pub(crate) trait FileTargetAccess {
+    fn resolve_target(
+        &self,
+        target: &FileTarget,
+        write: bool,
+    ) -> Result<ResolvedFileTarget, ApiError>;
+
+    fn with_write_lease<T>(
+        &self,
+        target: &FileTarget,
+        expected_root: &Path,
+        operation: impl FnOnce() -> Result<T, ApiError>,
+    ) -> Result<T, ApiError>;
+}
+
+#[derive(Clone, Debug, Eq, Hash, PartialEq)]
+struct MutationKey {
+    parent: Identity,
+    name: Vec<u8>,
+}
+
+#[derive(Default)]
+pub(crate) struct LocalFileService {
+    roots: Mutex<HashMap<String, (PathBuf, Identity)>>,
+    mutations: Mutex<HashMap<MutationKey, Weak<Mutex<()>>>>,
+}
+
+impl LocalFileService {
+    pub(crate) fn dispatch(
+        &self,
+        method: &str,
+        payload: Value,
+        access: &impl FileTargetAccess,
+    ) -> Result<Value, ApiError> {
+        match method {
+            method::FILE_LIST => {
+                let request: FileListRequest = decode(payload)?;
+                encode(listing::list(self, &request, access)?)
+            }
+            method::FILE_READ => {
+                let request: FileReadRequest = decode(payload)?;
+                encode(self.read(&request, access)?)
+            }
+            method::FILE_WRITE => {
+                let request: FileWriteRequest = decode(payload)?;
+                encode(self.write(&request, access)?)
+            }
+            _ => Err(api(
+                "method_not_found",
+                "The requested file operation is unknown.",
+            )),
+        }
+    }
+
+    /// Shared safe reader for explicitly selected, registered S3 capabilities.
+    pub(crate) fn read(
+        &self,
+        request: &FileReadRequest,
+        access: &impl FileTargetAccess,
+    ) -> Result<FileReadResponse, ApiError> {
+        let resolved = access.resolve_target(&request.target, false)?;
+        let (root, root_identity) = self.open_target(&request.target, &resolved)?;
+        let (parent_bytes, name) = split_file_path(&request.path_base64)?;
+        let parent = open_directory(&root, parent_bytes)?;
+        let parent_identity = identity(&fstat(&parent).map_err(io_error)?);
+        let observed = read_leaf(&parent, &name)?;
+        let current = access.resolve_target(&request.target, false)?;
+        if current.root != resolved.root {
+            return Err(target_changed());
+        }
+        revalidate_namespace(&resolved.root, root_identity, parent_bytes, parent_identity)?;
+        Ok(FileReadResponse {
+            path_base64: request.path_base64.clone(),
+            size_bytes: u64::try_from(observed.text.len()).map_err(|_| invalid_input())?,
+            modified_at_ms: observed.fingerprint.modified_at_ms(),
+            text: observed.text,
+            revision: observed.revision,
+            observed_at_ms: now_ms()?,
+        })
+    }
+
+    pub(crate) fn write(
+        &self,
+        request: &FileWriteRequest,
+        access: &impl FileTargetAccess,
+    ) -> Result<FileWriteResponse, ApiError> {
+        write::save(self, request, access, &write::WriteFaults::default())
+    }
+
+    fn open_target(
+        &self,
+        target: &FileTarget,
+        resolved: &ResolvedFileTarget,
+    ) -> Result<(std::os::fd::OwnedFd, Identity), ApiError> {
+        let root = open_root(&resolved.root)?;
+        let observed = identity(&fstat(&root).map_err(io_error)?);
+        let mut roots = self.roots.lock().map_err(|_| {
+            api(
+                "file_io_error",
+                "The file service state could not be locked.",
+            )
+        })?;
+        let key = format!("{target:?}");
+        if let Some((previous_path, previous_identity)) = roots.get(&key) {
+            if *previous_identity != observed || *previous_path != resolved.root {
+                return Err(target_changed());
+            }
+        } else {
+            roots.insert(key, (resolved.root.clone(), observed));
+        }
+        Ok((root, observed))
+    }
+
+    fn mutation(&self, key: MutationKey) -> Result<Arc<Mutex<()>>, ApiError> {
+        let mut mutations = self.mutations.lock().map_err(|_| {
+            api(
+                "file_io_error",
+                "The file mutation registry could not be locked.",
+            )
+        })?;
+        mutations.retain(|_, lock| lock.strong_count() != 0);
+        if let Some(lock) = mutations.get(&key).and_then(Weak::upgrade) {
+            return Ok(lock);
+        }
+        let lock = Arc::new(Mutex::new(()));
+        mutations.insert(key, Arc::downgrade(&lock));
+        Ok(lock)
+    }
+}
+
+fn decode<T: DeserializeOwned>(value: Value) -> Result<T, ApiError> {
+    serde_json::from_value(value).map_err(|_| invalid_input())
+}
+
+fn encode(value: impl Serialize) -> Result<Value, ApiError> {
+    serde_json::to_value(value)
+        .map_err(|_| api("file_io_error", "The file response could not be encoded."))
+}
+
+fn now_ms() -> Result<i64, ApiError> {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .ok()
+        .and_then(|elapsed| i64::try_from(elapsed.as_millis()).ok())
+        .ok_or_else(|| {
+            api(
+                "file_io_error",
+                "The current file-operation timestamp is unavailable.",
+            )
+        })
+}
diff --git a/crates/daemon/src/files/tests.rs b/crates/daemon/src/files/tests.rs
new file mode 100644
index 0000000..d922758
--- /dev/null
+++ b/crates/daemon/src/files/tests.rs
@@ -0,0 +1,313 @@
+use std::fs;
+use std::os::unix::fs::{PermissionsExt, symlink};
+use std::path::{Path, PathBuf};
+
+use cli_master_core::wire::{FilePath, FileReadRequest, FileTarget, FileWriteRequest};
+use cli_master_core::{ApiError, ProjectId};
+use tempfile::TempDir;
+
+use super::write::{WriteFaults, save};
+use super::{FileTargetAccess, LocalFileService, ResolvedFileTarget};
+
+struct Access {
+    root: PathBuf,
+}
+
+impl FileTargetAccess for Access {
+    fn resolve_target(
+        &self,
+        _target: &FileTarget,
+        _write: bool,
+    ) -> Result<ResolvedFileTarget, ApiError> {
+        Ok(ResolvedFileTarget {
+            root: self.root.clone(),
+        })
+    }
+
+    fn with_write_lease<T>(
+        &self,
+        _target: &FileTarget,
+        expected_root: &Path,
+        operation: impl FnOnce() -> Result<T, ApiError>,
+    ) -> Result<T, ApiError> {
+        if self.root != expected_root {
+            return Err(super::error::target_changed());
+        }
+        operation()
+    }
+}
+
+struct Fixture {
+    _directory: TempDir,
+    access: Access,
+    target: FileTarget,
+    service: LocalFileService,
+}
+
+impl Fixture {
+    fn new() -> Self {
+        let directory = TempDir::new().unwrap();
+        let root = directory.path().join("project");
+        fs::create_dir(&root).unwrap();
+        let root = root.canonicalize().unwrap();
+        fs::write(root.join("file.txt"), "original\r\n").unwrap();
+        Self {
+            _directory: directory,
+            access: Access { root },
+            target: FileTarget::Project {
+                project_id: ProjectId::new(),
+            },
+            service: LocalFileService::default(),
+        }
+    }
+
+    fn write_request(&self, path: &[u8], text: &str) -> FileWriteRequest {
+        let path = FilePath::try_from_bytes(path).unwrap();
+        let read = self
+            .service
+            .read(
+                &FileReadRequest::try_new(self.target, path.clone()).unwrap(),
+                &self.access,
+            )
+            .unwrap();
+        FileWriteRequest::try_new(self.target, path, text, read.revision).unwrap()
+    }
+
+    fn staged_files(&self) -> usize {
+        fs::read_dir(&self.access.root)
+            .unwrap()
+            .filter(|entry| {
+                entry
+                    .as_ref()
+                    .unwrap()
+                    .file_name()
+                    .to_string_lossy()
+                    .starts_with(".cli-master-save-")
+            })
+            .count()
+    }
+}
+
+#[test]
+fn observed_external_write_before_rename_preserves_external_bytes_and_cleans_temp() {
+    let fixture = Fixture::new();
+    let request = fixture.write_request(b"file.txt", "our draft");
+    let changed_path = fixture.access.root.join("file.txt");
+    let error = save(
+        &fixture.service,
+        &request,
+        &fixture.access,
+        &WriteFaults {
+            after_staging: Some(Box::new(move || {
+                fs::write(&changed_path, "external edit").unwrap();
+            })),
+            ..WriteFaults::default()
+        },
+    )
+    .unwrap_err();
+    assert_eq!(error.code, "file_conflict");
+    assert_eq!(
+        fs::read(fixture.access.root.join("file.txt")).unwrap(),
+        b"external edit"
+    );
+    assert_eq!(fixture.staged_files(), 0);
+}
+
+#[test]
+fn applied_write_reports_durability_uncertain_without_a_second_implicit_write() {
+    let fixture = Fixture::new();
+    let request = fixture.write_request(b"file.txt", "applied once\r\n");
+    let error = save(
+        &fixture.service,
+        &request,
+        &fixture.access,
+        &WriteFaults {
+            fail_after_rename: true,
+            ..WriteFaults::default()
+        },
+    )
+    .unwrap_err();
+    assert_eq!(error.code, "file_durability_uncertain");
+    let encoded = serde_json::to_value(&error).unwrap();
+    assert_eq!(encoded["details"]["writeApplied"], true);
+    assert!(
+        encoded["details"]["currentRevision"]
+            .as_str()
+            .unwrap()
+            .starts_with("v1:")
+    );
+    assert_eq!(
+        fs::read(fixture.access.root.join("file.txt")).unwrap(),
+        b"applied once\r\n"
+    );
+    assert_eq!(fixture.staged_files(), 0);
+}
+
+#[test]
+fn relocated_parent_aborts_before_publication_and_cleans_only_its_temp() {
+    let fixture = Fixture::new();
+    fs::create_dir(fixture.access.root.join("folder")).unwrap();
+    fs::write(fixture.access.root.join("folder/file.txt"), "original").unwrap();
+    let request = fixture.write_request(b"folder/file.txt", "draft");
+    let root = fixture.access.root.clone();
+    let error = save(
+        &fixture.service,
+        &request,
+        &fixture.access,
+        &WriteFaults {
+            after_staging: Some(Box::new(move || {
+                fs::rename(root.join("folder"), root.join("relocated")).unwrap();
+                fs::create_dir(root.join("folder")).unwrap();
+                fs::write(root.join("folder/file.txt"), "replacement root").unwrap();
+            })),
+            ..WriteFaults::default()
+        },
+    )
+    .unwrap_err();
+    assert_eq!(error.code, "file_target_changed");
+    assert_eq!(
+        fs::read(fixture.access.root.join("relocated/file.txt")).unwrap(),
+        b"original"
+    );
+    assert_eq!(
+        fs::read(fixture.access.root.join("folder/file.txt")).unwrap(),
+        b"replacement root"
+    );
+    assert_eq!(
+        fs::read_dir(fixture.access.root.join("relocated"))
+            .unwrap()
+            .count(),
+        1
+    );
+}
+
+#[test]
+fn extended_attributes_are_rejected_without_losing_the_original_inode() {
+    let fixture = Fixture::new();
+    let path = fixture.access.root.join("file.txt");
+    let file = fs::File::open(&path).unwrap();
+    #[cfg(target_os = "linux")]
+    let attribute = "user.cli_master_test";
+    #[cfg(target_os = "macos")]
+    let attribute = "com.cli-master.test";
+    rustix::fs::fsetxattr(
+        &file,
+        attribute,
+        b"retain attribute",
+        rustix::fs::XattrFlags::empty(),
+    )
+    .unwrap();
+    let request = fixture.write_request(b"file.txt", "draft");
+    let before = rustix::fs::fstat(&file).unwrap();
+    let error = fixture
+        .service
+        .write(&request, &fixture.access)
+        .unwrap_err();
+    assert_eq!(error.code, "file_metadata_unsupported");
+    let after = rustix::fs::fstat(fs::File::open(path).unwrap()).unwrap();
+    assert_eq!(before.st_ino, after.st_ino);
+    assert_eq!(fixture.staged_files(), 0);
+}
+
+#[test]
+fn mode_and_line_endings_are_preserved_and_revision_survives_new_service() {
+    let fixture = Fixture::new();
+    let path = fixture.access.root.join("file.txt");
+    fs::set_permissions(&path, fs::Permissions::from_mode(0o640)).unwrap();
+    let request = fixture.write_request(b"file.txt", "\u{feff}Olá\r\n");
+    let written = fixture.service.write(&request, &fixture.access).unwrap();
+    let fresh = LocalFileService::default();
+    let read = fresh
+        .read(
+            &FileReadRequest::try_new(fixture.target, request.path_base64).unwrap(),
+            &fixture.access,
+        )
+        .unwrap();
+    assert_eq!(read.revision, written.revision);
+    assert_eq!(read.text, request.text);
+    assert_eq!(
+        fs::metadata(path).unwrap().permissions().mode() & 0o777,
+        0o640
+    );
+}
+
+#[cfg(target_os = "macos")]
+#[test]
+fn macos_provenance_and_complete_attribute_list_survive_replacement() {
+    fn snapshot(file: &fs::File) -> (Vec<u8>, Option<Vec<u8>>) {
+        let mut names = vec![0_u8; 1_024];
+        let length = rustix::fs::flistxattr(file, &mut names[..]).unwrap();
+        names.truncate(length);
+        let provenance = if names
+            .split(|byte| *byte == 0)
+            .any(|name| name == b"com.apple.provenance")
+        {
+            let mut value = vec![0_u8; 4_096];
+            let length =
+                rustix::fs::fgetxattr(file, "com.apple.provenance", &mut value[..]).unwrap();
+            value.truncate(length);
+            Some(value)
+        } else {
+            None
+        };
+        (names, provenance)
+    }
+
+    let fixture = Fixture::new();
+    let path = fixture.access.root.join("file.txt");
+    let original = fs::File::open(&path).unwrap();
+    let before = snapshot(&original);
+    let request = fixture.write_request(b"file.txt", "preserve provenance\r\n");
+    fixture.service.write(&request, &fixture.access).unwrap();
+    let replacement = fs::File::open(path).unwrap();
+    assert_ne!(
+        rustix::fs::fstat(&original).unwrap().st_ino,
+        rustix::fs::fstat(&replacement).unwrap().st_ino
+    );
+    assert_eq!(snapshot(&replacement), before);
+}
+
+#[test]
+fn symlink_leaf_is_rejected_before_reading_outside() {
+    let fixture = Fixture::new();
+    let outside = TempDir::new().unwrap();
+    fs::write(outside.path().join("secret.txt"), "outside").unwrap();
+    let request = fixture.write_request(b"file.txt", "draft");
+    fs::remove_file(fixture.access.root.join("file.txt")).unwrap();
+    symlink(
+        outside.path().join("secret.txt"),
+        fixture.access.root.join("file.txt"),
+    )
+    .unwrap();
+    let error = fixture
+        .service
+        .write(&request, &fixture.access)
+        .unwrap_err();
+    assert_eq!(error.code, "file_symlink_not_allowed");
+    assert_eq!(
+        fs::read(outside.path().join("secret.txt")).unwrap(),
+        b"outside"
+    );
+}
+
+#[test]
+fn previously_observed_root_replaced_by_another_directory_is_rejected() {
+    let fixture = Fixture::new();
+    fixture.write_request(b"file.txt", "draft");
+    let old = fixture.access.root.with_file_name("original-project");
+    fs::rename(&fixture.access.root, &old).unwrap();
+    fs::create_dir(&fixture.access.root).unwrap();
+    fs::write(
+        fixture.access.root.join("file.txt"),
+        "replacement directory",
+    )
+    .unwrap();
+    let request = FileReadRequest::try_new(
+        fixture.target,
+        FilePath::try_from_bytes(b"file.txt").unwrap(),
+    )
+    .unwrap();
+    let error = fixture.service.read(&request, &fixture.access).unwrap_err();
+    assert_eq!(error.code, "file_target_changed");
+    assert_eq!(fs::read(old.join("file.txt")).unwrap(), b"original\r\n");
+}
diff --git a/crates/daemon/src/files/write.rs b/crates/daemon/src/files/write.rs
new file mode 100644
index 0000000..9b06f6d
--- /dev/null
+++ b/crates/daemon/src/files/write.rs
@@ -0,0 +1,206 @@
+use std::ffi::OsString;
+use std::fs::File;
+use std::io::Write;
+use std::os::fd::OwnedFd;
+use std::os::unix::ffi::OsStrExt;
+
+use cli_master_core::ApiError;
+use cli_master_core::wire::{FileWriteRequest, FileWriteResponse, MAX_FILE_TEXT_BYTES};
+use rustix::fs::{AtFlags, Mode, OFlags, fstat, fsync, openat, renameat, statat, unlinkat};
+
+use super::descriptor::{
+    Fingerprint, identity, open_directory, read_leaf, revalidate_namespace, split_file_path,
+};
+use super::error::{api, conflict, invalid_input, io_error, target_changed};
+use super::{FileTargetAccess, LocalFileService, MutationKey, attributes, metadata, now_ms};
+
+#[derive(Default)]
+pub(super) struct WriteFaults {
+    #[cfg(test)]
+    pub after_staging: Option<Box<dyn Fn()>>,
+    #[cfg(test)]
+    pub fail_after_rename: bool,
+}
+
+#[allow(
+    clippy::unused_self,
+    reason = "fault hooks are inert outside deterministic tests"
+)]
+impl WriteFaults {
+    fn after_staging(&self) {
+        #[cfg(test)]
+        if let Some(hook) = &self.after_staging {
+            hook();
+        }
+    }
+
+    #[allow(
+        clippy::unnecessary_wraps,
+        reason = "tests inject an error after publication to verify durability reporting"
+    )]
+    fn after_rename(&self) -> Result<(), ApiError> {
+        #[cfg(test)]
+        if self.fail_after_rename {
+            return Err(api(
+                "file_io_error",
+                "Injected directory durability failure.",
+            ));
+        }
+        Ok(())
+    }
+}
+
+pub(super) fn save(
+    service: &LocalFileService,
+    request: &FileWriteRequest,
+    access: &impl FileTargetAccess,
+    faults: &WriteFaults,
+) -> Result<FileWriteResponse, ApiError> {
+    if request.text.len() > MAX_FILE_TEXT_BYTES || request.text.contains('\0') {
+        return Err(invalid_input());
+    }
+    let resolved = access.resolve_target(&request.target, true)?;
+    let (root, root_identity) = service.open_target(&request.target, &resolved)?;
+    let (parent_bytes, name) = split_file_path(&request.path_base64)?;
+    let parent = open_directory(&root, parent_bytes)?;
+    let parent_identity = identity(&fstat(&parent).map_err(io_error)?);
+    let lock = service.mutation(MutationKey {
+        parent: parent_identity,
+        name: name.as_bytes().to_vec(),
+    })?;
+    let _mutation = lock
+        .lock()
+        .map_err(|_| api("file_io_error", "The file mutation lock is unavailable."))?;
+    let original = read_leaf(&parent, &name)?;
+    if original.revision != request.expected_revision {
+        return Err(conflict(Some(original.revision.as_str())));
+    }
+    metadata::inspect(&original.file, &original.fingerprint)?;
+    let mut temporary = TemporaryFile::new(&parent)?;
+    temporary
+        .file
+        .write_all(request.text.as_bytes())
+        .map_err(io_error)?;
+    temporary.file.flush().map_err(io_error)?;
+    metadata::apply(&original.file, &temporary.file, &original.fingerprint)?;
+    fsync(&temporary.file).map_err(io_error)?;
+    let staged_fingerprint = Fingerprint::from_stat(&fstat(&temporary.file).map_err(io_error)?);
+    faults.after_staging();
+
+    access.with_write_lease(&request.target, &resolved.root, || {
+        let current = read_leaf(&parent, &name).map_err(|error| match error.code.as_str() {
+            "file_not_found"
+            | "file_not_regular"
+            | "file_symlink_not_allowed"
+            | "file_too_large"
+            | "file_not_text" => conflict(None),
+            _ => error,
+        })?;
+        if current.revision != request.expected_revision {
+            return Err(conflict(Some(current.revision.as_str())));
+        }
+        metadata::inspect(&current.file, &current.fingerprint)?;
+        temporary.validate_ownership()?;
+        let staged_now = Fingerprint::from_stat(&fstat(&temporary.file).map_err(io_error)?);
+        if staged_now != staged_fingerprint {
+            return Err(conflict(None));
+        }
+        metadata::inspect(&temporary.file, &staged_now)?;
+        attributes::verify_preserved(&current.file, &temporary.file)?;
+        revalidate_namespace(&resolved.root, root_identity, parent_bytes, parent_identity)?;
+        renameat(&parent, &temporary.name, &parent, &name).map_err(io_error)?;
+        temporary.published = true;
+
+        let published = Fingerprint::from_stat(
+            &fstat(&temporary.file).map_err(|_| durability_uncertain(None))?,
+        );
+        let revision = published
+            .revision(request.text.as_bytes())
+            .map_err(|_| durability_uncertain(None))?;
+        faults
+            .after_rename()
+            .map_err(|_| durability_uncertain(Some(revision.as_str())))?;
+        fsync(&parent).map_err(|_| durability_uncertain(Some(revision.as_str())))?;
+        let namespace = statat(&parent, &name, AtFlags::SYMLINK_NOFOLLOW)
+            .map_err(|_| durability_uncertain(Some(revision.as_str())))?;
+        let observed = Fingerprint::from_stat(&namespace);
+        if observed != published {
+            return Err(durability_uncertain(Some(revision.as_str())));
+        }
+        Ok(FileWriteResponse {
+            path_base64: request.path_base64.clone(),
+            revision,
+            size_bytes: u64::try_from(request.text.len())
+                .map_err(|_| durability_uncertain(None))?,
+            modified_at_ms: published.modified_at_ms(),
+            written_at_ms: now_ms().map_err(|_| durability_uncertain(None))?,
+        })
+    })
+}
+
+fn durability_uncertain(revision: Option<&str>) -> ApiError {
+    let mut error = ApiError::new(
+        "file_durability_uncertain",
+        "The replacement was applied, but its final durability could not be confirmed.",
+    )
+    .with_action(
+        "Keep the draft and re-read the file before retrying; the write may already be present.",
+    )
+    .with_detail("writeApplied", true);
+    if let Some(revision) = revision {
+        error = error.with_detail("currentRevision", revision);
+    }
+    error
+}
+
+struct TemporaryFile<'a> {
+    parent: &'a OwnedFd,
+    name: OsString,
+    file: File,
+    identity: super::descriptor::Identity,
+    published: bool,
+}
+
+impl<'a> TemporaryFile<'a> {
+    fn new(parent: &'a OwnedFd) -> Result<Self, ApiError> {
+        let name = OsString::from(format!(
+            ".cli-master-save-{}",
+            uuid::Uuid::now_v7().simple()
+        ));
+        let fd = openat(
+            parent,
+            &name,
+            OFlags::RDWR | OFlags::CREATE | OFlags::EXCL | OFlags::NOFOLLOW | OFlags::CLOEXEC,
+            Mode::from_raw_mode(0o600),
+        )
+        .map_err(io_error)?;
+        // If identity cannot be established, leave the uniquely named temporary
+        // file for manual inspection rather than unlinking an unproven name.
+        let identity = identity(&fstat(&fd).map_err(io_error)?);
+        let file = File::from(fd);
+        Ok(Self {
+            parent,
+            name,
+            file,
+            identity,
+            published: false,
+        })
+    }
+
+    fn validate_ownership(&self) -> Result<(), ApiError> {
+        let stat = statat(self.parent, &self.name, AtFlags::SYMLINK_NOFOLLOW)
+            .map_err(|_| target_changed())?;
+        if identity(&stat) != self.identity || stat.st_nlink != 1 {
+            return Err(target_changed());
+        }
+        Ok(())
+    }
+}
+
+impl Drop for TemporaryFile<'_> {
+    fn drop(&mut self) {
+        if !self.published && self.validate_ownership().is_ok() {
+            let _ = unlinkat(self.parent, &self.name, AtFlags::empty());
+        }
+    }
+}
diff --git a/crates/daemon/src/lib.rs b/crates/daemon/src/lib.rs
index 685d628..2833805 100644
--- a/crates/daemon/src/lib.rs
+++ b/crates/daemon/src/lib.rs
@@ -13,6 +13,7 @@ mod config;
 mod diagnostics;
 mod error;
 mod events;
+mod files;
 mod git_inspection;
 mod knowledge;
 mod lock;
diff --git a/crates/daemon/src/server.rs b/crates/daemon/src/server.rs
index 49aefc5..7172a32 100644
--- a/crates/daemon/src/server.rs
+++ b/crates/daemon/src/server.rs
@@ -34,6 +34,7 @@ use tokio_util::sync::CancellationToken;
 use tracing::{debug, info, warn};
 use uuid::Uuid;
 
+use crate::files::LocalFileService;
 use crate::lock::InstanceLock;
 use crate::projects::ProjectRegistry;
 use crate::sessions::{SessionRegistry, encode_base64};
@@ -76,6 +77,7 @@ struct ServerState {
     diagnostics: DiagnosticsResponse,
     projects: ProjectRegistry,
     sessions: SessionRegistry,
+    files: LocalFileService,
     git_storage: Storage,
     git: Option<Git>,
     event_sequence: AtomicU64,
@@ -158,6 +160,7 @@ impl Daemon {
             })?,
             git_storage,
             git,
+            files: LocalFileService::default(),
             event_sequence: AtomicU64::new(0),
         });
 
@@ -557,6 +560,21 @@ async fn dispatch(
     }
 
     let result = match request.method.as_str() {
+        method::FILE_LIST | method::FILE_READ | method::FILE_WRITE => {
+            let state = Arc::clone(state);
+            tokio::task::spawn_blocking(move || {
+                state
+                    .files
+                    .dispatch(&request.method, request.payload, &state.sessions)
+            })
+            .await
+            .unwrap_or_else(|_| {
+                Err(ApiError::new(
+                    "file_io_error",
+                    "The local file operation could not complete.",
+                ))
+            })
+        }
         method::KNOWLEDGE_LIST | method::KNOWLEDGE_SAVE | method::KNOWLEDGE_DELETE => {
             let state = Arc::clone(state);
             match tokio::task::spawn_blocking(move || {
@@ -590,9 +608,25 @@ async fn dispatch(
         method::PROJECT_RENAME => decode_payload(request.payload)
             .and_then(|payload: ProjectRenameRequest| state.projects.rename(&payload))
             .and_then(encode_response),
-        method::PROJECT_REMOVE => decode_payload(request.payload)
-            .and_then(|payload: ProjectRemoveRequest| state.projects.remove(payload))
-            .and_then(encode_response),
+        method::PROJECT_REMOVE => match decode_payload::<ProjectRemoveRequest>(request.payload) {
+            Ok(payload) => {
+                let state = Arc::clone(state);
+                tokio::task::spawn_blocking(move || {
+                    state
+                        .sessions
+                        .with_metadata_mutation(|| state.projects.remove(payload))
+                        .and_then(encode_response)
+                })
+                .await
+                .unwrap_or_else(|_| {
+                    Err(ApiError::new(
+                        "project_operation_failed",
+                        "The project metadata operation could not complete.",
+                    ))
+                })
+            }
+            Err(error) => Err(error),
+        },
         method::AGENT_LIST => state.sessions.list_agents().and_then(encode_response),
         method::AGENT_DETECT => decode_payload(request.payload)
             .and_then(|payload: AgentDetectRequest| state.sessions.detect_agents(&payload))
diff --git a/crates/daemon/src/sessions.rs b/crates/daemon/src/sessions.rs
index 7813266..b86c7a0 100644
--- a/crates/daemon/src/sessions.rs
+++ b/crates/daemon/src/sessions.rs
@@ -24,6 +24,7 @@ use cli_master_session::{
 use cli_master_storage::{SessionRuntimeUpdate, Storage, StorageError, StoredAgent, StoredSession};
 use uuid::Uuid;
 
+mod files;
 mod worktrees;
 
 const INITIAL_COLUMNS: u16 = 100;
diff --git a/crates/daemon/src/sessions/files.rs b/crates/daemon/src/sessions/files.rs
new file mode 100644
index 0000000..28da821
--- /dev/null
+++ b/crates/daemon/src/sessions/files.rs
@@ -0,0 +1,125 @@
+use std::path::Path;
+
+use cli_master_core::ApiError;
+use cli_master_core::wire::FileTarget;
+use cli_master_storage::{StoredWorktree, WorktreeState};
+
+use crate::files::{FileTargetAccess, ResolvedFileTarget};
+
+use super::{SessionRegistry, storage_error};
+
+impl FileTargetAccess for SessionRegistry {
+    fn resolve_target(
+        &self,
+        target: &FileTarget,
+        write: bool,
+    ) -> Result<ResolvedFileTarget, ApiError> {
+        let (root, worktrees) = {
+            let storage = self.storage()?;
+            let root = match *target {
+                FileTarget::Project { project_id } => storage
+                    .get_project(project_id)
+                    .map_err(storage_error)?
+                    .map(|project| project.path),
+                FileTarget::Session { session_id } => storage
+                    .get_session(session_id)
+                    .map_err(storage_error)?
+                    .map(|session| session.cwd),
+                FileTarget::Worktree { worktree_id } => storage
+                    .get_worktree(worktree_id)
+                    .map_err(storage_error)?
+                    .map(|worktree| worktree.path),
+            }
+            .ok_or_else(|| {
+                ApiError::new(
+                    "file_target_not_found",
+                    "The selected file target is not registered.",
+                )
+                .with_action("Refresh projects and sessions before opening files.")
+            })?;
+            (root, storage.list_worktrees().map_err(storage_error)?)
+        };
+        if root.canonicalize().map_err(|_| target_changed())? != root || !root.is_dir() {
+            return Err(target_changed());
+        }
+        // Projects may be registered directly at a managed checkout. Enforce the
+        // same identity and write policy even through such an alternate target ID.
+        for worktree in worktrees
+            .iter()
+            .filter(|worktree| root.starts_with(&worktree.path))
+        {
+            self.validate_file_worktree(worktree, write)?;
+        }
+        Ok(ResolvedFileTarget { root })
+    }
+
+    fn with_write_lease<T>(
+        &self,
+        target: &FileTarget,
+        expected_root: &Path,
+        operation: impl FnOnce() -> Result<T, ApiError>,
+    ) -> Result<T, ApiError> {
+        let _lifecycle = self.lifecycle()?;
+        if self.resolve_target(target, true)?.root != expected_root {
+            return Err(target_changed());
+        }
+        operation()
+    }
+}
+
+impl SessionRegistry {
+    fn validate_file_worktree(
+        &self,
+        worktree: &StoredWorktree,
+        write: bool,
+    ) -> Result<(), ApiError> {
+        if matches!(
+            worktree.state,
+            WorktreeState::Creating | WorktreeState::Orphaned
+        ) || (write && worktree.state != WorktreeState::Active)
+            || worktree.path.canonicalize().map_err(|_| target_changed())? != worktree.path
+        {
+            return Err(target_changed());
+        }
+        let project = self
+            .storage()?
+            .get_project(worktree.project_id)
+            .map_err(storage_error)?
+            .ok_or_else(target_changed)?;
+        let git = self.git.as_ref().ok_or_else(target_changed)?;
+        let registered = git
+            .list_worktrees(&project.path)
+            .map_err(|_| target_changed())?;
+        let inspection = git
+            .inspect_repository(&worktree.path)
+            .map_err(|_| target_changed())?;
+        if inspection.repository_root.as_ref() != Some(&worktree.path)
+            || inspection.branch.as_deref() != Some(worktree.branch.as_str())
+            || !registered.iter().any(|entry| {
+                entry.path == worktree.path
+                    && entry.branch.as_deref() == Some(worktree.branch.as_str())
+                    && !entry.prunable
+            })
+        {
+            return Err(target_changed());
+        }
+        Ok(())
+    }
+
+    /// Metadata removal and the final file publish share the worktree mutation lease.
+    pub(crate) fn with_metadata_mutation<T>(
+        &self,
+        operation: impl FnOnce() -> Result<T, ApiError>,
+    ) -> Result<T, ApiError> {
+        let _lifecycle = self.lifecycle()?;
+        operation()
+    }
+}
+
+fn target_changed() -> ApiError {
+    ApiError::new(
+        "file_target_changed",
+        "The registered file target changed or needs recovery.",
+    )
+    .with_action("Refresh the target and reopen the file before retrying.")
+}
diff --git a/crates/daemon/tests/file_ipc.rs b/crates/daemon/tests/file_ipc.rs
new file mode 100644
index 0000000..18443b6
--- /dev/null
+++ b/crates/daemon/tests/file_ipc.rs
@@ -0,0 +1,1005 @@
+use std::ffi::OsString;
+use std::fs;
+use std::os::unix::ffi::OsStringExt;
+use std::os::unix::fs::{MetadataExt, PermissionsExt, symlink};
+use std::path::{Path, PathBuf};
+use std::process::Command;
+use std::time::Duration;
+
+use base64::{Engine as _, engine::general_purpose::STANDARD};
+use cli_master_core::{ApiError, RequestEnvelope, ResponseEnvelope, ResponsePayload};
+use cli_master_daemon::{Daemon, DaemonConfig, DaemonError, MAX_FRAME_LENGTH};
+use futures_util::{SinkExt, StreamExt};
+use serde_json::{Value, json};
+use tempfile::TempDir;
+use tokio::net::UnixStream;
+use tokio::task::JoinHandle;
+use tokio_util::codec::{Framed, LengthDelimitedCodec};
+use tokio_util::sync::CancellationToken;
+
+const MAX_TEXT_BYTES: usize = 128 * 1024;
+const MAX_LIST_BYTES: usize = 512 * 1024;
+const INITIAL: &str = "\u{feff}first\r\nsecond\r\n";
+
+type Client = Framed<UnixStream, LengthDelimitedCodec>;
+
+struct RunningDaemon {
+    config: DaemonConfig,
+    cancellation: CancellationToken,
+    task: JoinHandle<Result<(), DaemonError>>,
+}
+
+impl RunningDaemon {
+    fn start(root: &Path) -> Self {
+        let config = DaemonConfig::from_paths(root.join("data"), root.join("run"));
+        let daemon = Daemon::bind(config.clone()).expect("daemon should bind");
+        let cancellation = CancellationToken::new();
+        let task_cancellation = cancellation.clone();
+        let task = tokio::spawn(async move { daemon.run(task_cancellation).await });
+        Self {
+            config,
+            cancellation,
+            task,
+        }
+    }
+
+    async fn connect(&self) -> Client {
+        LengthDelimitedCodec::builder()
+            .max_frame_length(MAX_FRAME_LENGTH)
+            .new_framed(
+                UnixStream::connect(self.config.socket_path())
+                    .await
+                    .unwrap(),
+            )
+    }
+
+    async fn stop(self) {
+        self.cancellation.cancel();
+        tokio::time::timeout(Duration::from_secs(10), self.task)
+            .await
+            .expect("daemon should stop before timeout")
+            .expect("daemon task should join")
+            .expect("daemon should stop cleanly");
+    }
+}
+
+struct Fixture {
+    root: TempDir,
+    repository: PathBuf,
+    selected: PathBuf,
+    target: Value,
+    project_id: Value,
+    agent_id: Value,
+}
+
+impl Fixture {
+    async fn new() -> (Self, RunningDaemon, Client) {
+        let root = TempDir::new().unwrap();
+        let repository = root.path().join("repository");
+        let selected = repository.join("apps");
+        fs::create_dir_all(selected.join("api")).unwrap();
+        fs::write(selected.join("api/notes.txt"), INITIAL).unwrap();
+        fs::write(repository.join("outside.txt"), "outside selected project\n").unwrap();
+        git(&repository, &["init", "-b", "main"]);
+        git(
+            &repository,
+            &["config", "user.email", "tests@example.invalid"],
+        );
+        git(&repository, &["config", "user.name", "CLI Master Tests"]);
+        git(&repository, &["add", "."]);
+        git(&repository, &["commit", "-m", "initial"]);
+        let daemon = RunningDaemon::start(root.path());
+        let mut client = daemon.connect().await;
+        let project = call(&mut client, "project.add", json!({"path": selected})).await;
+        let agent = call(
+            &mut client,
+            "agent.custom.create",
+            json!({
+                "displayName": "File fixture",
+                "command": {"executable": "/bin/cat", "args": [], "env": {}}
+            }),
+        )
+        .await;
+        (
+            Self {
+                root,
+                repository,
+                selected,
+                target: json!({"kind": "project", "projectId": project["id"]}),
+                project_id: project["id"].clone(),
+                agent_id: agent["id"].clone(),
+            },
+            daemon,
+            client,
+        )
+    }
+
+    async fn session(&self, client: &mut Client, isolation: &str) -> Value {
+        call(
+            client,
+            "session.create",
+            json!({
+                "projectId": self.project_id,
+                "agentId": self.agent_id,
+                "name": "File session",
+                "isolation": isolation,
+                "relativeDirectory": "api"
+            }),
+        )
+        .await
+    }
+}
+
+fn git(cwd: &Path, args: &[&str]) {
+    let output = Command::new("git")
+        .args(args)
+        .current_dir(cwd)
+        .env("GIT_TERMINAL_PROMPT", "0")
+        .output()
+        .unwrap();
+    assert!(
+        output.status.success(),
+        "git {args:?}: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+}
+
+fn path(bytes: &[u8]) -> String {
+    STANDARD.encode(bytes)
+}
+
+fn request(target: &Value, bytes: &[u8]) -> Value {
+    json!({"target": target, "pathBase64": path(bytes)})
+}
+
+fn write_request(target: &Value, bytes: &[u8], text: &str, revision: &str) -> Value {
+    json!({"target": target, "pathBase64": path(bytes), "text": text, "expectedRevision": revision})
+}
+
+async fn exchange(client: &mut Client, method: &str, payload: Value) -> ResponseEnvelope<Value> {
+    let request = RequestEnvelope::v1(method, payload);
+    let encoded = serde_json::to_vec(&request).unwrap();
+    assert!(
+        encoded.len() <= MAX_FRAME_LENGTH,
+        "test request must fit the wire frame"
+    );
+    client.send(encoded.into()).await.unwrap();
+    tokio::time::timeout(Duration::from_secs(5), async {
+        loop {
+            let frame = client
+                .next()
+                .await
+                .expect("response should arrive")
+                .unwrap();
+            assert!(frame.len() <= MAX_FRAME_LENGTH);
+            let envelope: Value = serde_json::from_slice(&frame).unwrap();
+            if envelope["kind"] == "event" {
+                continue;
+            }
+            let response: ResponseEnvelope<Value> = serde_json::from_value(envelope).unwrap();
+            assert_eq!(response.request_id, request.request_id);
+            return response;
+        }
+    })
+    .await
+    .unwrap_or_else(|_| panic!("{method} must not hang"))
+}
+
+async fn call(client: &mut Client, method: &str, payload: Value) -> Value {
+    match exchange(client, method, payload).await.payload {
+        ResponsePayload::Success { data } => data,
+        ResponsePayload::Error { error } => panic!("{method} failed: {error:?}"),
+    }
+}
+
+async fn failure(client: &mut Client, method: &str, payload: Value) -> ApiError {
+    match exchange(client, method, payload).await.payload {
+        ResponsePayload::Error { error } => error,
+        ResponsePayload::Success { data } => panic!("{method} unexpectedly succeeded: {data}"),
+    }
+}
+
+async fn read(client: &mut Client, target: &Value, bytes: &[u8]) -> Value {
+    call(client, "file.read", request(target, bytes)).await
+}
+
+fn revision(response: &Value) -> &str {
+    let revision = response["revision"]
+        .as_str()
+        .expect("opaque revision should be present");
+    assert_eq!(revision.len(), 67);
+    assert!(revision.starts_with("v1:"));
+    assert!(
+        revision.as_bytes()[3..]
+            .iter()
+            .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(byte))
+    );
+    revision
+}
+
+fn entry_paths(response: &Value) -> Vec<Vec<u8>> {
+    response["entries"]
+        .as_array()
+        .expect("directory entries")
+        .iter()
+        .map(|entry| {
+            STANDARD
+                .decode(entry["pathBase64"].as_str().unwrap())
+                .unwrap()
+        })
+        .collect()
+}
+
+#[tokio::test]
+async fn registered_project_session_and_worktree_roots_list_read_and_save_real_bytes() {
+    let (fixture, daemon, mut client) = Fixture::new().await;
+    let session = fixture.session(&mut client, "current").await;
+    let isolated = fixture.session(&mut client, "new_worktree").await;
+    let session_target = json!({"kind": "session", "sessionId": session["id"]});
+    let isolated_target = json!({"kind": "worktree", "worktreeId": isolated["worktreeId"]});
+    let isolated_root = PathBuf::from(isolated["worktreePath"].as_str().unwrap());
+    let cases = [
+        (
+            fixture.target.clone(),
+            b"api/notes.txt".as_slice(),
+            fixture.selected.join("api/notes.txt"),
+        ),
+        (
+            session_target,
+            b"notes.txt".as_slice(),
+            fixture.selected.join("api/notes.txt"),
+        ),
+        (
+            isolated_target,
+            b"apps/api/notes.txt".as_slice(),
+            isolated_root.join("apps/api/notes.txt"),
+        ),
+    ];
+    for (index, (target, name, disk)) in cases.iter().enumerate() {
+        let listed = call(&mut client, "file.list", request(target, b"")).await;
+        assert!(!entry_paths(&listed).is_empty());
+        assert!(listed["observedAtMs"].as_i64().unwrap() > 1_700_000_000_000);
+        let before = read(&mut client, target, name).await;
+        assert_eq!(before["text"], fs::read_to_string(disk).unwrap());
+        let text = format!("\u{feff}olá {index} 🦀\r\nkeep CRLF\r\n");
+        let saved = call(
+            &mut client,
+            "file.write",
+            write_request(target, name, &text, revision(&before)),
+        )
+        .await;
+        assert_eq!(saved["pathBase64"], path(name));
+        assert_eq!(saved["sizeBytes"], text.len());
+        assert_ne!(revision(&before), revision(&saved));
+        assert_eq!(fs::read(disk).unwrap(), text.as_bytes());
+        let after = read(&mut client, target, name).await;
+        assert_eq!(after["text"], text);
+        assert_eq!(revision(&after), revision(&saved));
+    }
+    let listed = call(&mut client, "file.list", request(&fixture.target, b"")).await;
+    assert_eq!(entry_paths(&listed), [b"api".to_vec()]);
+    assert_eq!(
+        failure(
+            &mut client,
+            "file.read",
+            request(&fixture.target, b"outside.txt")
+        )
+        .await
+        .code,
+        "file_not_found"
+    );
+    assert_eq!(
+        fs::read_to_string(fixture.repository.join("outside.txt")).unwrap(),
+        "outside selected project\n"
+    );
+    daemon.stop().await;
+}
+
+#[tokio::test]
+async fn unix_filename_bytes_round_trip_through_listing_and_followup_identifiers() {
+    let (fixture, daemon, mut client) = Fixture::new().await;
+    let mut names: Vec<Vec<u8>> = vec![
+        b"space name.txt".to_vec(),
+        b"-leading.txt".to_vec(),
+        b"literal\\name:part".to_vec(),
+        "ação.txt".as_bytes().to_vec(),
+        b"line\n\x01.txt".to_vec(),
+    ];
+    let non_utf8_name = b"bad-\xff.txt".to_vec();
+    match fs::write(
+        fixture
+            .selected
+            .join(OsString::from_vec(non_utf8_name.clone())),
+        "before",
+    ) {
+        Ok(()) => names.push(non_utf8_name),
+        // APFS rejects invalid UTF-8 before it reaches the file service. Linux
+        // must exercise this case; the pure wire contract covers it on both OSes.
+        Err(error)
+            if cfg!(target_os = "macos")
+                && error.raw_os_error() == Some(rustix::io::Errno::ILSEQ.raw_os_error()) => {}
+        Err(error) => panic!("non-UTF-8 fixture failed unexpectedly: {error}"),
+    }
+    for name in &names {
+        fs::write(
+            fixture.selected.join(OsString::from_vec(name.clone())),
+            "before",
+        )
+        .unwrap();
+    }
+    let listing = call(&mut client, "file.list", request(&fixture.target, b"")).await;
+    let paths = entry_paths(&listing);
+    let mut sorted = paths.clone();
+    sorted.sort();
+    assert_eq!(paths, sorted, "sorting must follow raw Unix bytes");
+    for name in &names {
+        let entry = listing["entries"]
+            .as_array()
+            .unwrap()
+            .iter()
+            .find(|entry| {
+                STANDARD
+                    .decode(entry["pathBase64"].as_str().unwrap())
+                    .unwrap()
+                    == *name
+            })
+            .expect("every byte-exact filename should be listable");
+        assert!(
+            !entry["displayName"]
+                .as_str()
+                .unwrap()
+                .chars()
+                .any(char::is_control)
+        );
+        let payload = json!({"target": fixture.target, "pathBase64": entry["pathBase64"]});
+        let before = call(&mut client, "file.read", payload.clone()).await;
+        let mut write = payload;
+        write["text"] = json!("after 🦀\r\n");
+        write["expectedRevision"] = before["revision"].clone();
+        call(&mut client, "file.write", write).await;
+        assert_eq!(
+            fs::read(fixture.selected.join(OsString::from_vec(name.clone()))).unwrap(),
+            "after 🦀\r\n".as_bytes()
+        );
+    }
+    daemon.stop().await;
+}
+
+#[tokio::test]
+async fn invalid_paths_revision_and_unregistered_targets_are_rejected_at_the_wire_boundary() {
+    let (fixture, daemon, mut client) = Fixture::new().await;
+    let invalid: &[&[u8]] = &[
+        b"",
+        b"/absolute.txt",
+        b"..",
+        b"api/../notes.txt",
+        b"api//notes.txt",
+        b"api/./notes.txt",
+        b"api/",
+        b"api\0notes.txt",
+    ];
+    for bytes in invalid {
+        assert_eq!(
+            failure(&mut client, "file.read", request(&fixture.target, bytes))
+                .await
+                .code,
+            "invalid_input",
+            "{bytes:?}"
+        );
+    }
+    for encoded in ["%%%", "YQ", "YR=="] {
+        assert_eq!(
+            failure(
+                &mut client,
+                "file.read",
+                json!({"target": fixture.target, "pathBase64": encoded})
+            )
+            .await
+            .code,
+            "invalid_input"
+        );
+    }
+    assert_eq!(
+        failure(
+            &mut client,
+            "file.read",
+            request(&fixture.target, &vec![b'a'; 4097])
+        )
+        .await
+        .code,
+        "invalid_input"
+    );
+    assert_eq!(
+        failure(
+            &mut client,
+            "file.write",
+            write_request(
+                &fixture.target,
+                b"api/notes.txt",
+                "changed",
+                "not-a-revision"
+            )
+        )
+        .await
+        .code,
+        "invalid_input"
+    );
+    let missing_target = json!({"kind": "project", "projectId": cli_master_core::ProjectId::new()});
+    assert_eq!(
+        failure(
+            &mut client,
+            "file.read",
+            request(&missing_target, b"notes.txt")
+        )
+        .await
+        .code,
+        "file_target_not_found"
+    );
+    let mut extra_path = request(&fixture.target, b"api/notes.txt");
+    extra_path["path"] = json!(fixture.repository.join("outside.txt"));
+    assert_eq!(
+        failure(&mut client, "file.read", extra_path).await.code,
+        "invalid_input"
+    );
+    assert_eq!(
+        fs::read_to_string(fixture.selected.join("api/notes.txt")).unwrap(),
+        INITIAL
+    );
+    daemon.stop().await;
+}
+
+#[tokio::test]
+async fn symlinks_directories_and_fifo_leaves_are_never_opened_as_regular_text() {
+    let (fixture, daemon, mut client) = Fixture::new().await;
+    symlink(
+        fixture.selected.join("api/notes.txt"),
+        fixture.selected.join("link.txt"),
+    )
+    .unwrap();
+    symlink(
+        fixture.selected.join("api"),
+        fixture.selected.join("linked-dir"),
+    )
+    .unwrap();
+    let before = read(&mut client, &fixture.target, b"api/notes.txt").await;
+    for bytes in [b"link.txt".as_slice(), b"linked-dir/notes.txt".as_slice()] {
+        assert_eq!(
+            failure(&mut client, "file.read", request(&fixture.target, bytes))
+                .await
+                .code,
+            "file_symlink_not_allowed"
+        );
+        assert_eq!(
+            failure(
+                &mut client,
+                "file.write",
+                write_request(&fixture.target, bytes, "changed", revision(&before))
+            )
+            .await
+            .code,
+            "file_symlink_not_allowed"
+        );
+    }
+    assert_eq!(
+        failure(&mut client, "file.read", request(&fixture.target, b"api"))
+            .await
+            .code,
+        "file_not_regular"
+    );
+    assert_eq!(
+        failure(
+            &mut client,
+            "file.list",
+            request(&fixture.target, b"api/notes.txt")
+        )
+        .await
+        .code,
+        "file_not_directory"
+    );
+
+    let fifo = fixture.selected.join("api/notes.txt");
+    fs::remove_file(&fifo).unwrap();
+    let output = Command::new("mkfifo").arg(&fifo).output().unwrap();
+    assert!(
+        output.status.success(),
+        "{}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+    assert_eq!(
+        failure(
+            &mut client,
+            "file.read",
+            request(&fixture.target, b"api/notes.txt")
+        )
+        .await
+        .code,
+        "file_not_regular"
+    );
+    assert_eq!(
+        failure(
+            &mut client,
+            "file.write",
+            write_request(
+                &fixture.target,
+                b"api/notes.txt",
+                "changed",
+                revision(&before)
+            )
+        )
+        .await
+        .code,
+        "file_not_regular"
+    );
+    let listing = call(&mut client, "file.list", request(&fixture.target, b"api")).await;
+    assert_eq!(listing["entries"][0]["kind"], "other");
+    let root_listing = call(&mut client, "file.list", request(&fixture.target, b"")).await;
+    assert_eq!(
+        root_listing["entries"]
+            .as_array()
+            .unwrap()
+            .iter()
+            .filter(|entry| entry["kind"] == "symlink")
+            .count(),
+        2
+    );
+    daemon.stop().await;
+}
+
+#[tokio::test]
+async fn a_replaced_registered_root_and_pending_worktree_removal_reject_writes() {
+    let (fixture, daemon, mut client) = Fixture::new().await;
+    let before = read(&mut client, &fixture.target, b"api/notes.txt").await;
+    let moved = fixture.root.path().join("moved-apps");
+    fs::rename(&fixture.selected, &moved).unwrap();
+    symlink(&moved, &fixture.selected).unwrap();
+    let read_error = failure(
+        &mut client,
+        "file.read",
+        request(&fixture.target, b"api/notes.txt"),
+    )
+    .await;
+    let write_error = failure(
+        &mut client,
+        "file.write",
+        write_request(
+            &fixture.target,
+            b"api/notes.txt",
+            "changed",
+            revision(&before),
+        ),
+    )
+    .await;
+    fs::remove_file(&fixture.selected).unwrap();
+    fs::rename(&moved, &fixture.selected).unwrap();
+    assert_eq!(read_error.code, "file_target_changed");
+    assert_eq!(write_error.code, "file_target_changed");
+    assert_eq!(
+        fs::read_to_string(fixture.selected.join("api/notes.txt")).unwrap(),
+        INITIAL
+    );
+
+    let isolated = fixture.session(&mut client, "new_worktree").await;
+    let target = json!({"kind": "worktree", "worktreeId": isolated["worktreeId"]});
+    let before = read(&mut client, &target, b"apps/api/notes.txt").await;
+    let prepared = call(
+        &mut client,
+        "worktree.prepare_remove",
+        json!({"worktreeId": isolated["worktreeId"]}),
+    )
+    .await;
+    assert_eq!(prepared["status"], "ready");
+    assert_eq!(
+        failure(
+            &mut client,
+            "file.write",
+            write_request(&target, b"apps/api/notes.txt", "changed", revision(&before))
+        )
+        .await
+        .code,
+        "file_target_changed"
+    );
+    assert_eq!(
+        fs::read_to_string(
+            Path::new(isolated["worktreePath"].as_str().unwrap()).join("apps/api/notes.txt")
+        )
+        .unwrap(),
+        INITIAL
+    );
+    daemon.stop().await;
+}
+
+#[tokio::test]
+async fn binary_oversize_and_unsupported_hardlinks_are_rejected_without_data_loss() {
+    let (fixture, daemon, mut client) = Fixture::new().await;
+    for (name, bytes, code) in [
+        ("nul.bin", vec![b'a', 0, b'b'], "file_not_text"),
+        ("invalid.bin", vec![0xff, 0xfe], "file_not_text"),
+        (
+            "large.txt",
+            vec![b'x'; MAX_TEXT_BYTES + 1],
+            "file_too_large",
+        ),
+    ] {
+        fs::write(fixture.selected.join(name), &bytes).unwrap();
+        assert_eq!(
+            failure(
+                &mut client,
+                "file.read",
+                request(&fixture.target, name.as_bytes())
+            )
+            .await
+            .code,
+            code
+        );
+        assert_eq!(fs::read(fixture.selected.join(name)).unwrap(), bytes);
+    }
+    let before = read(&mut client, &fixture.target, b"api/notes.txt").await;
+    let too_large = "é".repeat(MAX_TEXT_BYTES / 2 + 1);
+    assert_eq!(
+        failure(
+            &mut client,
+            "file.write",
+            write_request(
+                &fixture.target,
+                b"api/notes.txt",
+                &too_large,
+                revision(&before)
+            )
+        )
+        .await
+        .code,
+        "invalid_input"
+    );
+    assert_eq!(
+        failure(
+            &mut client,
+            "file.write",
+            write_request(&fixture.target, b"missing.txt", "new", revision(&before))
+        )
+        .await
+        .code,
+        "file_not_found"
+    );
+    assert!(!fixture.selected.join("missing.txt").exists());
+
+    let original = fixture.selected.join("api/notes.txt");
+    let linked = fixture.root.path().join("hardlink.txt");
+    fs::hard_link(&original, &linked).unwrap();
+    let linked_read = read(&mut client, &fixture.target, b"api/notes.txt").await;
+    assert_eq!(
+        failure(
+            &mut client,
+            "file.write",
+            write_request(
+                &fixture.target,
+                b"api/notes.txt",
+                "changed",
+                revision(&linked_read)
+            )
+        )
+        .await
+        .code,
+        "file_metadata_unsupported"
+    );
+    assert_eq!(fs::read_to_string(&original).unwrap(), INITIAL);
+    assert_eq!(fs::read_to_string(&linked).unwrap(), INITIAL);
+    assert_eq!(
+        fs::metadata(original).unwrap().ino(),
+        fs::metadata(linked).unwrap().ino()
+    );
+    daemon.stop().await;
+}
+
+#[tokio::test]
+async fn two_clients_cannot_both_save_one_revision_even_through_different_registered_targets() {
+    let (fixture, daemon, mut project_client) = Fixture::new().await;
+    let session = fixture.session(&mut project_client, "current").await;
+    let session_target = json!({"kind": "session", "sessionId": session["id"]});
+    let mut session_client = daemon.connect().await;
+    let project_read = read(&mut project_client, &fixture.target, b"api/notes.txt").await;
+    let session_read = read(&mut session_client, &session_target, b"notes.txt").await;
+    assert_eq!(revision(&project_read), revision(&session_read));
+    let writes = ["project wins\n", "session wins\n"];
+    let (first, second) = tokio::join!(
+        exchange(
+            &mut project_client,
+            "file.write",
+            write_request(
+                &fixture.target,
+                b"api/notes.txt",
+                writes[0],
+                revision(&project_read)
+            )
+        ),
+        exchange(
+            &mut session_client,
+            "file.write",
+            write_request(
+                &session_target,
+                b"notes.txt",
+                writes[1],
+                revision(&session_read)
+            )
+        ),
+    );
+    let mut winner = None;
+    let mut conflicts = 0;
+    for (response, candidate) in [first, second].into_iter().zip(writes) {
+        match response.payload {
+            ResponsePayload::Success { data } => {
+                assert!(
+                    winner.replace(candidate).is_none(),
+                    "one revision must have exactly one successful writer"
+                );
+                revision(&data);
+            }
+            ResponsePayload::Error { error } => {
+                assert_eq!(error.code, "file_conflict");
+                assert!(!format!("{error:?}").contains(INITIAL));
+                conflicts += 1;
+            }
+        }
+    }
+    assert_eq!(conflicts, 1);
+    assert_eq!(
+        fs::read_to_string(fixture.selected.join("api/notes.txt")).unwrap(),
+        winner.unwrap()
+    );
+    daemon.stop().await;
+}
+
+#[tokio::test]
+async fn external_content_and_inode_changes_conflict_and_saves_preserve_unix_permissions() {
+    let (fixture, daemon, mut client) = Fixture::new().await;
+    let disk = fixture.selected.join("api/notes.txt");
+    fs::set_permissions(&disk, fs::Permissions::from_mode(0o640)).unwrap();
+    let before = read(&mut client, &fixture.target, b"api/notes.txt").await;
+    fs::write(&disk, "external content\n").unwrap();
+    assert_eq!(
+        failure(
+            &mut client,
+            "file.write",
+            write_request(
+                &fixture.target,
+                b"api/notes.txt",
+                "stale",
+                revision(&before)
+            )
+        )
+        .await
+        .code,
+        "file_conflict"
+    );
+    assert_eq!(fs::read_to_string(&disk).unwrap(), "external content\n");
+    let before = read(&mut client, &fixture.target, b"api/notes.txt").await;
+    let replacement = fixture.selected.join("api/replacement.txt");
+    fs::write(&replacement, "external content\n").unwrap();
+    fs::set_permissions(&replacement, fs::Permissions::from_mode(0o640)).unwrap();
+    fs::rename(&replacement, &disk).unwrap();
+    assert_eq!(
+        failure(
+            &mut client,
+            "file.write",
+            write_request(
+                &fixture.target,
+                b"api/notes.txt",
+                "stale",
+                revision(&before)
+            )
+        )
+        .await
+        .code,
+        "file_conflict"
+    );
+
+    let metadata = fs::metadata(&disk).unwrap();
+    let before = read(&mut client, &fixture.target, b"api/notes.txt").await;
+    call(
+        &mut client,
+        "file.write",
+        write_request(
+            &fixture.target,
+            b"api/notes.txt",
+            "current\r\n",
+            revision(&before),
+        ),
+    )
+    .await;
+    let saved = fs::metadata(&disk).unwrap();
+    assert_eq!(saved.permissions().mode() & 0o777, 0o640);
+    assert_eq!(saved.uid(), metadata.uid());
+    assert_eq!(saved.gid(), metadata.gid());
+    assert_eq!(fs::read(&disk).unwrap(), b"current\r\n");
+    daemon.stop().await;
+}
+
+#[tokio::test]
+async fn saved_text_and_revision_survive_daemon_restart_and_remain_writable() {
+    let (fixture, first, mut client) = Fixture::new().await;
+    let before = read(&mut client, &fixture.target, b"api/notes.txt").await;
+    let saved = call(
+        &mut client,
+        "file.write",
+        write_request(
+            &fixture.target,
+            b"api/notes.txt",
+            "persisted\r\n",
+            revision(&before),
+        ),
+    )
+    .await;
+    drop(client);
+    first.stop().await;
+    let second = RunningDaemon::start(fixture.root.path());
+    let mut client = second.connect().await;
+    let recovered = read(&mut client, &fixture.target, b"api/notes.txt").await;
+    assert_eq!(recovered["text"], "persisted\r\n");
+    assert_eq!(revision(&recovered), revision(&saved));
+    call(
+        &mut client,
+        "file.write",
+        write_request(
+            &fixture.target,
+            b"api/notes.txt",
+            "saved after restart\n",
+            revision(&saved),
+        ),
+    )
+    .await;
+    assert_eq!(
+        fs::read_to_string(fixture.selected.join("api/notes.txt")).unwrap(),
+        "saved after restart\n"
+    );
+    second.stop().await;
+}
+
+#[tokio::test]
+async fn pagination_is_byte_ordered_and_rejects_unbounded_enumerations() {
+    let (fixture, daemon, mut client) = Fixture::new().await;
+    let pages = fixture.selected.join("pages");
+    fs::create_dir(&pages).unwrap();
+    for index in 0..205 {
+        fs::write(pages.join(format!("{index:03}.txt")), []).unwrap();
+    }
+    let first = call(&mut client, "file.list", request(&fixture.target, b"pages")).await;
+    assert_eq!(first["entries"].as_array().unwrap().len(), 100);
+    assert_eq!(first["nextAfterNameBase64"], path(b"099.txt"));
+    let second = call(
+        &mut client,
+        "file.list",
+        json!({
+            "target": fixture.target, "pathBase64": path(b"pages"), "limit": 200,
+            "afterNameBase64": first["nextAfterNameBase64"]
+        }),
+    )
+    .await;
+    assert_eq!(second["entries"].as_array().unwrap().len(), 105);
+    assert!(second.get("nextAfterNameBase64").is_none());
+    let combined = [entry_paths(&first), entry_paths(&second)].concat();
+    assert_eq!(
+        combined,
+        (0..205)
+            .map(|index| format!("pages/{index:03}.txt").into_bytes())
+            .collect::<Vec<_>>()
+    );
+    for limit in [0, 201] {
+        assert_eq!(
+            failure(
+                &mut client,
+                "file.list",
+                json!({"target": fixture.target, "pathBase64": path(b"pages"), "limit": limit})
+            )
+            .await
+            .code,
+            "invalid_input"
+        );
+    }
+    let large = fixture.selected.join("many");
+    fs::create_dir(&large).unwrap();
+    for index in 0..10_001 {
+        fs::write(large.join(format!("{index:05}")), []).unwrap();
+    }
+    assert_eq!(
+        failure(&mut client, "file.list", request(&fixture.target, b"many"))
+            .await
+            .code,
+        "file_listing_too_large"
+    );
+    daemon.stop().await;
+}
+
+#[tokio::test]
+async fn maximum_text_with_worst_case_json_escaping_round_trips_inside_one_frame() {
+    let (fixture, daemon, mut client) = Fixture::new().await;
+    let text = "\u{0001}".repeat(MAX_TEXT_BYTES);
+    fs::write(fixture.selected.join("escaped.txt"), &text).unwrap();
+    let before = read(&mut client, &fixture.target, b"escaped.txt").await;
+    assert_eq!(before["text"], text);
+    assert_eq!(before["sizeBytes"], MAX_TEXT_BYTES);
+    assert!(serde_json::to_vec(&before).unwrap().len() > 6 * MAX_TEXT_BYTES);
+    let updated = "\u{0002}".repeat(MAX_TEXT_BYTES);
+    let saved = call(
+        &mut client,
+        "file.write",
+        write_request(&fixture.target, b"escaped.txt", &updated, revision(&before)),
+    )
+    .await;
+    assert_eq!(
+        fs::read(fixture.selected.join("escaped.txt")).unwrap(),
+        updated.as_bytes()
+    );
+    assert_eq!(
+        revision(&read(&mut client, &fixture.target, b"escaped.txt").await),
+        revision(&saved)
+    );
+    daemon.stop().await;
+}
+
+#[tokio::test]
+async fn directory_pages_respect_the_encoded_response_budget_without_losing_names() {
+    let (fixture, daemon, mut client) = Fixture::new().await;
+    let mut directory = fs::File::open(&fixture.selected).unwrap();
+    let mut relative = Vec::new();
+    for index in 0..20 {
+        let component = format!("d{index:02}{}", "a".repeat(117));
+        rustix::fs::mkdirat(&directory, &component, rustix::fs::Mode::RWXU).unwrap();
+        directory = rustix::fs::openat(
+            &directory,
+            &component,
+            rustix::fs::OFlags::RDONLY
+                | rustix::fs::OFlags::DIRECTORY
+                | rustix::fs::OFlags::NOFOLLOW,
+            rustix::fs::Mode::empty(),
+        )
+        .unwrap()
+        .into();
+        if !relative.is_empty() {
+            relative.push(b'/');
+        }
+        relative.extend_from_slice(component.as_bytes());
+    }
+    for index in 0..200 {
+        let name = format!("n{index:03}{}", "b".repeat(216));
+        rustix::fs::openat(
+            &directory,
+            &name,
+            rustix::fs::OFlags::WRONLY | rustix::fs::OFlags::CREATE | rustix::fs::OFlags::EXCL,
+            rustix::fs::Mode::RUSR | rustix::fs::Mode::WUSR,
+        )
+        .unwrap();
+    }
+    let mut cursor: Option<Value> = None;
+    let mut all_paths = Vec::new();
+    loop {
+        let mut payload =
+            json!({"target": fixture.target, "pathBase64": path(&relative), "limit": 200});
+        if let Some(after) = &cursor {
+            payload["afterNameBase64"] = after.clone();
+        }
+        let page = call(&mut client, "file.list", payload).await;
+        assert!(serde_json::to_vec(&page).unwrap().len() <= MAX_LIST_BYTES);
+        let names = entry_paths(&page);
+        assert!(!names.is_empty());
+        if cursor.is_none() {
+            assert!(
+                names.len() < 200,
+                "encoded budget must paginate before entry limit"
+            );
+        }
+        all_paths.extend(names);
+        assert!(
+            all_paths.len() <= 200,
+            "pagination must not repeat previous names"
+        );
+        cursor = page.get("nextAfterNameBase64").cloned();
+        if cursor.is_none() {
+            break;
+        }
+    }
+    assert_eq!(all_paths.len(), 200);
+    let mut unique = all_paths.clone();
+    unique.sort();
+    unique.dedup();
+    assert_eq!(all_paths, unique);
+    daemon.stop().await;
+}
diff --git a/crates/file-metadata/Cargo.toml b/crates/file-metadata/Cargo.toml
new file mode 100644
index 0000000..1686f80
--- /dev/null
+++ b/crates/file-metadata/Cargo.toml
@@ -0,0 +1,19 @@
+[package]
+name = "cli-master-file-metadata"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+
+[dev-dependencies]
+tempfile = "3"
+
+# ADR 0006: only the private Darwin module may override this denial. The
+# workspace-wide forbid policy remains in force for every other crate.
+[lints.rust]
+unsafe_code = "deny"
+unsafe_op_in_unsafe_fn = "deny"
+
+[lints.clippy]
+all = "warn"
+pedantic = "warn"
+
diff --git a/crates/file-metadata/SAFETY.md b/crates/file-metadata/SAFETY.md
new file mode 100644
index 0000000..9f927bd
--- /dev/null
+++ b/crates/file-metadata/SAFETY.md
@@ -0,0 +1,50 @@
+# Darwin ACL boundary
+
+ADR [0006](../../docs/adr/0006-local-files-and-editor.md) accepts this narrow
+exception because the editor must inspect metadata on its already-open file.
+All public APIs are safe Rust. Only the private `darwin` module permits unsafe
+code; the workspace and other crates retain `unsafe_code = "forbid"`.
+
+The three bindings match `sys/acl.h` in Apple's installed macOS SDK:
+`acl_get_fd_np(int, acl_type_t) -> acl_t`,
+`acl_get_entry(acl_t, int, acl_entry_t *) -> int`, and
+`acl_free(void *) -> int`. Opaque object and entry pointers are never
+dereferenced by Rust. The positive `acl_type_t` enum uses C unsigned-int ABI;
+`ACL_TYPE_EXTENDED` is `0x100`, and `ACL_FIRST_ENTRY` is `0`.
+`sys/errno.h` defines `ENOENT = 2` and `EINVAL = 22` on Darwin.
+
+- A borrowed `AsFd` descriptor remains valid for the entire inspection. The
+  helper neither closes it nor constructs a pathname from it.
+- A successful `acl_get_fd_np` allocates an independent ACL. `OwnedAcl` owns
+  and frees it exactly once, including error returns. Its pointer is private;
+  it has no clone operation or manual `Send`/`Sync` implementation.
+- `acl_get_entry` receives a live ACL and writable pointer-sized output. The
+  borrowed entry is never read or exported. Darwin returns **0 for success**,
+  and **-1/EINVAL for no first entry** in a valid allocated ACL.
+  Both mean an ACL is present: even an allocated empty ACL may carry ACL-level
+  inheritance flags, so the helper conservatively preserves that policy.
+- No-ACL files can instead return NULL/ENOENT from `acl_get_fd_np` because
+  `FILESEC_ACL` is absent. Only this documented absence maps to `false` at
+  acquisition; other OS errors propagate. Errno is captured immediately,
+  before the RAII destructor can call `acl_free`.
+- This is an observation, not synchronization with other writers. Atomic save
+  still requires the daemon's metadata and revision rechecks. This helper
+  does not copy metadata or assert that a later replacement is safe.
+
+These semantics follow Apple's primary
+[get-ACL documentation](https://developer.apple.com/library/archive/documentation/System/Conceptual/ManPages_iPhoneOS/man3/acl_get.3.html),
+[entry documentation](https://developer.apple.com/library/archive/documentation/System/Conceptual/ManPages_iPhoneOS/man3/acl_get_entry.3.html),
+[ACL file implementation](https://github.com/apple-oss-distributions/Libc/blob/main/posix1e/acl_file.c),
+[entry implementation](https://github.com/apple-oss-distributions/Libc/blob/main/posix1e/acl_entry.c), and
+[security-property implementation](https://github.com/apple-oss-distributions/Libc/blob/main/gen/filesec.c).
+The constants and signatures were also checked against
+`/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/usr/include/sys/acl.h`
+and `sys/errno.h` on the development host.
+
+Integration tests use the safe public API on real temporary files, covering
+no ACL, explicit ACL, inheritance, ACL removal, and renamed/replaced paths.
+An ACL that denies reading security metadata verifies error propagation.
+Only test fixture setup invokes `/bin/chmod`, directly with an argv array;
+the library has no subprocess or filesystem-path dependency. On Linux the
+helper returns `Unsupported`; the daemon's safe rustix xattr checks own Linux
+ACL detection.
diff --git a/crates/file-metadata/src/darwin.rs b/crates/file-metadata/src/darwin.rs
new file mode 100644
index 0000000..4e11d52
--- /dev/null
+++ b/crates/file-metadata/src/darwin.rs
@@ -0,0 +1,68 @@
+//! Minimal bindings verified against Apple's SDK `sys/acl.h` and `sys/errno.h`.
+//! See `../SAFETY.md` for the ownership and return-value audit.
+
+use std::ffi::{c_int, c_uint, c_void};
+use std::io;
+use std::os::fd::{AsRawFd, BorrowedFd};
+use std::ptr::{self, NonNull};
+
+// acl_type_t is a C enum whose defined values are nonnegative; its Darwin ABI
+// representation is unsigned int. acl_t and acl_entry_t are opaque pointers.
+const ACL_TYPE_EXTENDED: c_uint = 0x0000_0100;
+const ACL_FIRST_ENTRY: c_int = 0;
+const ENOENT: c_int = 2;
+const EINVAL: c_int = 22;
+
+unsafe extern "C" {
+    fn acl_get_fd_np(fd: c_int, acl_type: c_uint) -> *mut c_void;
+    fn acl_get_entry(acl: *mut c_void, entry_id: c_int, entry: *mut *mut c_void) -> c_int;
+    fn acl_free(object: *mut c_void) -> c_int;
+}
+
+/// Owns exactly one allocation returned by `acl_get_fd_np`.
+struct OwnedAcl(NonNull<c_void>);
+
+impl Drop for OwnedAcl {
+    fn drop(&mut self) {
+        // SAFETY: this non-null pointer came from acl_get_fd_np and is freed
+        // exactly once. No ACL entry pointer escapes or survives this owner.
+        let _ = unsafe { acl_free(self.0.as_ptr()) };
+    }
+}
+
+pub(super) fn has_extended_acl(fd: BorrowedFd<'_>) -> io::Result<bool> {
+    // SAFETY: BorrowedFd keeps the descriptor valid for this call. The supported
+    // ACL type is fixed, and the returned ACL is a separately owned allocation.
+    let acl = unsafe { acl_get_fd_np(fd.as_raw_fd(), ACL_TYPE_EXTENDED) };
+    let Some(acl) = NonNull::new(acl) else {
+        let error = io::Error::last_os_error();
+        // Darwin's filesec_get_property(FILESEC_ACL) reports ENOENT when the
+        // descriptor's security metadata has no ACL property. No path is used.
+        return if error.raw_os_error() == Some(ENOENT) {
+            Ok(false)
+        } else {
+            Err(error)
+        };
+    };
+    let acl = OwnedAcl(acl);
+    let mut entry = ptr::null_mut();
+    // SAFETY: the owned ACL remains live, ACL_FIRST_ENTRY is a valid selector,
+    // and entry is initialized writable storage for the borrowed output pointer.
+    let result = unsafe { acl_get_entry(acl.0.as_ptr(), ACL_FIRST_ENTRY, &raw mut entry) };
+    if result == 0 {
+        return Ok(true);
+    }
+
+    // Capture errno before OwnedAcl::drop calls another C function. Darwin
+    // returns -1/EINVAL when the first entry of a valid ACL does not exist.
+    // Unlike Linux's ACL API, Darwin does not return zero for end-of-list.
+    let error = io::Error::last_os_error();
+    if result == -1 && error.raw_os_error() == Some(EINVAL) {
+        // An existing but empty ACL can still have ACL-level inheritance flags.
+        // Preserve that distinction from a missing ACL property: the editor
+        // must reject replacement rather than discard uninspected policy.
+        Ok(true)
+    } else {
+        Err(error)
+    }
+}
diff --git a/crates/file-metadata/src/lib.rs b/crates/file-metadata/src/lib.rs
new file mode 100644
index 0000000..4f1b48e
--- /dev/null
+++ b/crates/file-metadata/src/lib.rs
@@ -0,0 +1,42 @@
+//! Descriptor-based extended ACL inspection for the local file editor.
+//!
+//! The Darwin implementation is the narrow FFI exception accepted in ADR 0006.
+//! This crate never reopens paths, changes metadata, closes the caller's file
+//! descriptor, or launches a subprocess.
+
+#![deny(unsafe_code)]
+#![deny(unsafe_op_in_unsafe_fn)]
+
+use std::io;
+use std::os::fd::AsFd;
+
+#[cfg(target_os = "macos")]
+#[allow(unsafe_code)]
+mod darwin;
+
+/// Reports whether the pinned filesystem object has an extended ACL.
+///
+/// The result is an observation, not a lock: another process may change metadata
+/// immediately afterward. Explicit and inherited entries count as present, as
+/// does an allocated empty ACL, which may carry ACL-level inheritance policy.
+///
+/// # Errors
+///
+/// Returns the operating system's error if the ACL cannot be inspected. On
+/// platforms other than macOS, returns [`io::ErrorKind::Unsupported`]; callers
+/// must use their platform-specific ACL/xattr inspection instead of treating
+/// unavailable inspection as evidence that no ACL exists.
+pub fn has_extended_acl(fd: impl AsFd) -> io::Result<bool> {
+    #[cfg(target_os = "macos")]
+    {
+        darwin::has_extended_acl(fd.as_fd())
+    }
+    #[cfg(not(target_os = "macos"))]
+    {
+        let _ = fd;
+        Err(io::Error::new(
+            io::ErrorKind::Unsupported,
+            "descriptor ACL inspection is implemented for macOS only",
+        ))
+    }
+}
diff --git a/crates/file-metadata/tests/darwin_acl.rs b/crates/file-metadata/tests/darwin_acl.rs
new file mode 100644
index 0000000..c303aef
--- /dev/null
+++ b/crates/file-metadata/tests/darwin_acl.rs
@@ -0,0 +1,101 @@
+#![cfg(target_os = "macos")]
+
+use std::fs::{self, File};
+use std::io;
+use std::os::unix::fs::PermissionsExt;
+use std::path::Path;
+use std::process::Command;
+
+use cli_master_file_metadata::has_extended_acl;
+use tempfile::TempDir;
+
+fn chmod(path: &Path, arguments: &[&str]) {
+    let output = Command::new("/bin/chmod")
+        .args(arguments)
+        .arg(path)
+        .output()
+        .expect("run chmod for real temporary-file ACL fixture");
+    assert!(
+        output.status.success(),
+        "chmod fixture failed: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+}
+
+fn clean_directory() -> TempDir {
+    let directory = tempfile::tempdir().expect("temporary directory");
+    chmod(directory.path(), &["-N"]);
+    directory
+}
+
+#[test]
+fn ordinary_file_without_acl_remains_editable() {
+    let directory = clean_directory();
+    let path = directory.path().join("ordinary.txt");
+    fs::write(&path, "ordinary text\n").unwrap();
+    let file = File::open(path).unwrap();
+
+    assert!(!has_extended_acl(&file).unwrap());
+    assert!(file.metadata().is_ok(), "inspection must not close the fd");
+}
+
+#[test]
+fn explicit_acl_is_observed_without_modifying_content_or_mode() {
+    let directory = clean_directory();
+    let path = directory.path().join("explicit.txt");
+    fs::write(&path, "keep this content\n").unwrap();
+    chmod(&path, &["+a", "everyone allow read"]);
+    let file = File::open(&path).unwrap();
+    let permissions = file.metadata().unwrap().permissions().mode();
+
+    assert!(has_extended_acl(&file).unwrap());
+    assert_eq!(fs::read(&path).unwrap(), b"keep this content\n");
+    assert_eq!(file.metadata().unwrap().permissions().mode(), permissions);
+    chmod(&path, &["-N"]);
+    assert!(!has_extended_acl(&file).unwrap());
+}
+
+#[test]
+fn inherited_acl_is_detected_on_new_files() {
+    let directory = clean_directory();
+    chmod(
+        directory.path(),
+        &["+a", "everyone allow read,file_inherit,directory_inherit"],
+    );
+    let path = directory.path().join("inherited.txt");
+    fs::write(&path, "inherited policy\n").unwrap();
+    let file = File::open(&path).unwrap();
+
+    assert!(has_extended_acl(&file).unwrap());
+    chmod(&path, &["-N"]);
+    assert!(!has_extended_acl(&file).unwrap());
+}
+
+#[test]
+fn inspection_follows_the_open_descriptor_after_path_replacement() {
+    let directory = clean_directory();
+    let path = directory.path().join("document.txt");
+    fs::write(&path, "original\n").unwrap();
+    chmod(&path, &["+a", "everyone allow read"]);
+    let original = File::open(&path).unwrap();
+
+    fs::rename(&path, directory.path().join("moved.txt")).unwrap();
+    fs::write(&path, "replacement\n").unwrap();
+    let replacement = File::open(&path).unwrap();
+
+    assert!(has_extended_acl(&original).unwrap());
+    assert!(!has_extended_acl(&replacement).unwrap());
+}
+
+#[test]
+fn denied_acl_inspection_is_an_error_instead_of_missing_acl() {
+    let directory = clean_directory();
+    let path = directory.path().join("denied.txt");
+    fs::write(&path, "protected security metadata\n").unwrap();
+    let file = File::open(&path).unwrap();
+    chmod(&path, &["+a", "everyone deny readsecurity"]);
+
+    let result = has_extended_acl(&file);
+    chmod(&path, &["-N"]);
+    assert_eq!(result.unwrap_err().kind(), io::ErrorKind::PermissionDenied);
+}
diff --git a/crates/file-metadata/tests/unsupported.rs b/crates/file-metadata/tests/unsupported.rs
new file mode 100644
index 0000000..585e6cf
--- /dev/null
+++ b/crates/file-metadata/tests/unsupported.rs
@@ -0,0 +1,14 @@
+#![cfg(not(target_os = "macos"))]
+
+use std::io;
+
+use cli_master_file_metadata::has_extended_acl;
+
+#[test]
+fn unavailable_inspection_is_an_error_instead_of_missing_acl() {
+    let file = tempfile::tempfile().unwrap();
+    assert_eq!(
+        has_extended_acl(&file).unwrap_err().kind(),
+        io::ErrorKind::Unsupported
+    );
+}
diff --git a/docs/adr/0006-local-files-and-editor.md b/docs/adr/0006-local-files-and-editor.md
index 681c710..52e2680 100644
--- a/docs/adr/0006-local-files-and-editor.md
+++ b/docs/adr/0006-local-files-and-editor.md
@@ -87,7 +87,10 @@ Responses return `pathBase64` as the exact identifier and `displayName` for
 presentation. Escape control/undecodable bytes in display text; never rebuild
 an operation path from that text. Raw names never become HTML or command
 arguments. Non-UTF-8 names are listable and can identify an editable UTF-8
-file on either supported platform.
+file where the underlying filesystem permits such names. APFS can reject
+invalid UTF-8 filenames with EILSEQ before the service is called; Linux socket
+tests exercise those names and pure contract tests cover their wire identity
+on both platforms.
 
 ### Public operations
 
@@ -133,9 +136,9 @@ use higher-resolution metadata internally and never depend on epoch-ms alone.
 
 Use safe APIs from the existing direct daemon dependency `rustix 1.1.4` with
 feature `fs`. Its local source provides `openat`, `statat`, `fstat`, `renameat`,
-`unlinkat`, directory iteration and `fsync`. No new project `unsafe` block,
-shell command, external file utility or platform-specific path syntax is
-needed. `renameat` is the portable directory-relative replacement operation.
+`unlinkat`, directory iteration and `fsync`. Traversal and publication introduce no project `unsafe` block, shell
+command, external file utility or platform-specific path syntax. Darwin ACL
+inspection has the narrowly isolated exception defined below. `renameat` is the portable directory-relative replacement operation.
 [rustix reference](https://docs.rs/rustix/1.1.4/rustix/fs/fn.renameat.html)
 
 Open the validated root as a directory descriptor, then walk each path
@@ -197,6 +200,17 @@ unsupported result before accepting such a save. They must not be silently
 advertised as preserved. Hard-linked files return `file_metadata_unsupported`
 because replace would otherwise break the link relationship.
 
+The initial macOS implementation preserves one explicitly supported extended
+attribute, `com.apple.provenance`. Real files created on the validation host
+receive this attribute automatically, including the service's temporary files.
+Read its bounded value through the pinned descriptors, copy it when needed,
+and verify that the source and destination attribute sets and bytes agree
+before publication. If the source has no such attribute and the destination
+does, reject the save unless exact absence can be established; do not assume
+that a successful removal call proves absence. Reject every other extended
+attribute, oversized value or inspection/copy mismatch. This is a narrow
+preservation exception, not permission to silently discard unknown metadata.
+
 The lock guarantees revision ordering among daemon writers. External editors
 do not honor it. The final comparison followed by POSIX `renameat` leaves a
 small external-write race: it is **optimistic conflict detection**, not a
@@ -212,6 +226,32 @@ client to re-read before retrying. Do not pretend rollback occurred or send a
 second implicit write. A daemon crash can leave a uniquely named temporary
 file; startup must not sweep unknown files from project directories.
 
+### Narrow Darwin ACL metadata boundary
+
+The current safe `rustix` interface does not provide Darwin ACL inspection
+through a file descriptor. The safe public exacl API takes a pathname, which
+would lose the pinned-object guarantee; `/dev/fd` is not assumed equivalent.
+A normal macOS text file must remain editable while a file with an extended
+ACL must not lose that ACL during atomic replacement.
+
+Add `crates/file-metadata` solely for the safe public function
+`has_extended_acl(fd: impl AsFd) -> io::Result<bool>`. Its private Darwin
+module contains the minimal audited bindings to `acl_get_fd_np`,
+`acl_get_entry` and `acl_free`. Constants and signatures are verified against
+the installed Apple SDK. The borrowed descriptor is never closed, returned
+ACL storage is owned by an RAII guard, errors preserve errno, and callers
+never receive raw pointers. No subprocess or path reopening is permitted in
+this service. Linux continues to inspect ACL/xattrs through safe rustix APIs.
+
+This crate explicitly denies unsafe code except within that private module,
+and denies unsafe operations within unsafe functions unless individually
+marked. It is the sole exception to inheriting the workspace's unsafe-code
+forbid lint; workspace/core/daemon/session policy remains unchanged. All
+other lints retain the workspace's strictness. The exception enables direct
+inspection rather than weakening the file write policy or rejecting every
+ordinary file on macOS. Test the public safe API with real regular files and
+extended ACLs, and review ownership and each unsafe call before publication.
+
 ### Errors, synchronization and S3 reuse
 
 Use existing `ApiError` envelopes. Stable service error codes are
diff --git a/protocol/catalog.json b/protocol/catalog.json
index 2a775f8..a446995 100644
--- a/protocol/catalog.json
+++ b/protocol/catalog.json
@@ -30,6 +30,9 @@
     "worktree.list",
     "worktree.prepare_remove",
     "worktree.remove",
+    "file.list",
+    "file.read",
+    "file.write",
     "diagnostics.get",
     "knowledge.list",
     "knowledge.save",

From 2499b0b54f2f29db45a3597e2a7ffe8a5d542cca Mon Sep 17 00:00:00 2001
From: guicybercode <euguigom@gmail.com>
Date: Sat, 5 Sep 2026 22:39:15 -0300
Subject: [PATCH 19/23] docs(runtime): publish file integration evidence and
 organization ownership

---
 crates/file-metadata/Cargo.toml          |  1 -
 docs/codex/maestri-runtime-report.md     | 99 +++++++++++++++++++-----
 docs/codex/xirp-integration-request.md   | 67 ++++++++++++++++
 docs/codex/xirp-organization-contract.md | 70 +++++++++++++++++
 docs/maestri-runtime-parity.md           | 18 +++--
 5 files changed, 231 insertions(+), 24 deletions(-)
 create mode 100644 docs/codex/xirp-organization-contract.md

diff --git a/crates/file-metadata/Cargo.toml b/crates/file-metadata/Cargo.toml
index 1686f80..93fcc57 100644
--- a/crates/file-metadata/Cargo.toml
+++ b/crates/file-metadata/Cargo.toml
@@ -16,4 +16,3 @@ unsafe_op_in_unsafe_fn = "deny"
 [lints.clippy]
 all = "warn"
 pedantic = "warn"
-
diff --git a/docs/codex/maestri-runtime-report.md b/docs/codex/maestri-runtime-report.md
index 5eec583..5d004be 100644
--- a/docs/codex/maestri-runtime-report.md
+++ b/docs/codex/maestri-runtime-report.md
@@ -6,9 +6,9 @@ Baseline de criação: `0ac8dd7d49eefee16e5efbf389994f551bc584f5`, obtido de
 `origin/refactor/canvas-only-shell`. Integração final pertence à S1 nessa branch.
 
 O objetivo completo permanece na [matriz de runtime](../maestri-runtime-parity.md).
-Esta entrega resolve o primeiro caminho backend. Floors, landing, editor,
-canvas durável, presets, continuidade nativa, comunicação, rotinas e ambientes
-remotos permanecem em desenvolvimento. Integração desktop não foi presumida.
+A integração de worktrees está publicada e a primeira fatia de arquivos/editor
+está publicada com testes locais aprovados. Floors, landing, canvas durável, presets, continuidade nativa,
+comunicação, rotinas e ambientes remotos permanecem em desenvolvimento. Integração desktop não foi presumida.
 
 ## Commits disponíveis
 
@@ -16,8 +16,13 @@ remotos permanecem em desenvolvimento. Integração desktop não foi presumida.
 | --- | --- | --- |
 | `7693468` | Saga separa preparação de início; associação SQLite transacional; subdiretórios; compensação e cancelamento de tokens. | Suite session/storage executada; após ajustes finais, 29 testes de create/prepare/remove passaram. Clippy session/storage sem warnings. |
 | `3c25a85` | Daemon liga new_worktree, snapshot/listagem, preparo/remoção e recovery à saga compartilhando SessionManager e Storage. | 118 testes core/daemon passaram, incluindo 9 fluxos novos pelo socket real; Clippy dos quatro pacotes sem warnings. |
+| `910ed7d`, `1a74bbb` | Integra documentação e persistência knowledge da S3; dispatch bloqueante sai do leitor assíncrono. | Contratos core, 9 testes storage knowledge, 2 socket knowledge, 9 socket worktree e 15 testes IPC frontend passaram. |
+| `b271825` | ADR 0006 define arquivos/editor, revisão e política de salvamento. | Decisão de arquitetura; não representa implementação funcional. |
+| `45d817a` | Preserva o canvas e o navegador nativo publicados pela S1 até `1e75081`. | Typecheck frontend e testes daemon lib/IPC/knowledge/worktree passaram; CI e Packaging Linux/macOS aprovados. |
+| `c98cf25` | Probe retenta ETXTBSY com o limite existente e preserva classificação/errno sem dados sensíveis. | 56 testes agents e Clippy passaram no macOS; duas regressões específicas de ETXTBSY aguardam Linux CI. |
+| `1225931` | Serviço file.list/read/write, salvamento atômico com revisão, metadados preservados e cliente IPC tipado. | 13 contratos file, 8 casos internos de disco/falha, 12 socket file, 5 ACL macOS; 51 testes IPC frontend passaram. |
 
-Ambos usam a identidade Git configurada `guicybercode`, sem trailers
+Os commits usam a identidade Git configurada `guicybercode`, sem trailers
 `Co-authored-by`. Publicados em `origin/feat/maestri-runtime`.
 
 ## Contratos prontos para integração
@@ -35,7 +40,8 @@ Ambos usam a identidade Git configurada `guicybercode`, sem trailers
 Rust wire, `protocol/catalog.json`, `ipc/methods.ts` e `ipc/domain.ts`
 foram sincronizados. Os dois últimos são artefatos aditivos: o baseline havia
 removido esses caminhos citados em AGENTS. Nenhum componente React, estado de
-canvas, estilo ou bridge Tauri foi alterado.
+canvas, estilo ou bridge Tauri foi alterado por S2; as mudanças S1 foram
+preservadas na integração. O cliente IPC ganhou métodos tipados de arquivo.
 
 Erros relevantes: `worktree_confirmation_invalid`, `worktree_in_use`,
 `worktree_dirty`, `worktree_not_active`, `worktree_identity_changed`,
@@ -49,9 +55,13 @@ ou reconexão. A existência dos nomes no catálogo não prova entrega de evento
 ## Verificação executada e limites
 
 PR de integração: [#44](https://github.com/guicybercode/Jig/pull/44), em draft.
-CI e Packaging Linux/macOS iniciados; resultados ainda pendentes.
+CI e Packaging de `45d817a` passaram em Linux/macOS, nos runs
+[CI 34003098853](https://github.com/guicybercode/Jig/actions/runs/34003098853) e
+[Packaging 34003098946](https://github.com/guicybercode/Jig/actions/runs/34003098946).
+Os commits posteriores de probe/arquivos exigem novas execuções; a aprovação
+anterior não comprova esses novos caminhos.
 
-Host local: macOS. Passaram:
+Host local: macOS. Na primeira integração de worktrees, passaram:
 
 - `CARGO_INCREMENTAL=0 cargo test -p cli-master-core -p cli-master-daemon --locked`
   — 118 testes, dos quais 9 novos em `worktree_ipc.rs`.
@@ -64,8 +74,8 @@ Host local: macOS. Passaram:
 Os casos socket exercitam start/stop/restart concorrentes, troca de raiz por
 symlink entre create/start, token após edição externa, sessão sem vínculo
 usando o checkout, saída espontânea e restart com PID canário de outro manager.
-A matriz CI Linux/macOS e o pacote desktop ainda exigem resultado externo;
-não foram chamados de aprovados. O editor/canvas S1 ainda precisa consumir e
+CI e Packaging da integração anterior estão aprovados conforme os runs
+acima; o serviço novo de arquivos aguarda sua própria execução Linux/macOS. O editor/canvas S1 ainda precisa consumir e
 verificar estes contratos. Os IDs M14/M34/M35 continuam parciais no escopo total.
 
 ## Acordo com XIRP/S3
@@ -77,18 +87,71 @@ Resposta publicada em
 - **0004_knowledge_documents.sql reservada para S3**; worktrees não criam migração.
 - Acordados `knowledge.list/save/delete`, kind prompt/context, UUIDv7,
   escopo opcional de projeto, revisão inteira; update/delete exigem revisão,
-  conflito retorna `knowledge_conflict`. Ainda não são contratos publicados.
+  conflito retorna `knowledge_conflict`. Publicados em `1a74bbb`.
 - S3 pode publicar registro aditivo de lib.rs/migração/wire/mirrors/dispatch na
   própria branch junto de implementação/testes; S2 revisa e integra o commit.
 - `knowledge.updated` só pode ser anunciado como funcional com emissão real.
-- S2 possui file service, workspace/floor/canvas e organização/workflow.
-  S3 possui composição de rascunhos/contexto; entrega usa SessionManager/adapters.
+- S2 possui file service, workspace/floor/canvas e revisão dos contratos.
+  S3 possui módulos organização/workflow e composição de rascunhos/contexto;
+  entrega inicial usa SessionManager/adapters, sob responsabilidade S2.
+- **0005_organization.sql reservada para S3**; workspace S2 usa 0006 depois
+  de integrar 0005. `organization.get/save` aprovados como proposta; não
+  anunciados no catálogo sem handlers e testes. Pin/archive nunca alteram PTY.
+- `knowledge.discover/read` aprovados para a próxima entrega S3 com IDs opacos
+  de scan/entry, allowlist conhecida e raízes globais somente leitura. A fatia
+  inicial de arquivo fornece leitura segura sob alvos registrados; adaptar
+  capacidades globais requer integração explícita e ainda não foi concluído.
+
+## Arquivos/editor publicados
+
+`1225931` publica os três métodos sob alvos cadastrados:
+
+| Método | Request → response |
+| --- | --- |
+| `file.list` | `{target,pathBase64,limit?,afterNameBase64?}` → `{entries,nextAfterNameBase64?,observedAtMs}` |
+| `file.read` | `{target,pathBase64}` → `{pathBase64,text,revision,sizeBytes,modifiedAtMs?,observedAtMs}` |
+| `file.write` | `{target,pathBase64,text,expectedRevision}` → `{pathBase64,revision,sizeBytes,modifiedAtMs?,writtenAtMs}` |
+
+`target` identifica projeto, sessão ou worktree; a raiz é resolvida pelo daemon.
+`pathBase64` preserva bytes Unix relativos, sem reconstruir caminhos a partir
+de displayName. Texto é UTF-8 de até 128 KiB, sem NUL, com BOM/CRLF preservados.
+A revisão opaca `v1:` é derivada de conteúdo e identidade/metadados. Listagem
+pagina 100 por padrão/200 no máximo, enumera no máximo 10.000 nomes e limita
+cada resposta a 512 KiB. O cliente expõe `listFiles`, `readFile`, `writeFile`.
+
+O save mantém proprietário/grupo/permissões e verifica metadados por descritor.
+macOS preserva também `com.apple.provenance` com comparação exata; outros
+xattrs, ACLs, flags e hardlinks não suportados são recusados. A exceção FFI
+Darwin está isolada em file-metadata, revisada em SAFETY.md e coberta por 5
+casos reais. Workspace/core/daemon/session continuam com unsafe proibido.
+
+A publicação final usa a mesma proteção de mutação que a remoção de worktree
+ou metadados do alvo. Duas gravações do daemon não confirmam a mesma revisão;
+edições externas observadas geram `file_conflict`, preservando a versão em
+disco. A comparação seguida de rename ainda é otimista diante de um editor
+externo não cooperativo: não há CAS atômico portátil entre processos.
+`file_durability_uncertain` com `writeApplied:true` exige reler antes de tentar
+novamente. O cliente preserva esses metadados e não faz um segundo write.
+
+A execução local final incluiu 97 testes core, 68 daemon, 56 agents e 5 ACL,
+mais 51 testes frontend IPC. Passaram typecheck, Clippy dos quatro pacotes,
+Rustdoc com warnings negados, rustfmt e verificação de versões. Debug info
+foi desativada somente nos comandos de validação para reduzir uso de disco.
+APFS rejeitou a fixture de nome UTF-8 inválido com EILSEQ; os demais nomes Unix
+foram exercitados pelo socket. Esse caso de bytes inválidos é obrigatório no
+socket Linux e também é coberto pelos contratos puros. A nova CI Linux/macOS
+ainda precisa confirmar este incremento; a evidência local é macOS.
+
+M29/M30 continuam parciais no produto: criação/movimentação/exclusão de arquivo,
+watcher, integração de editor S1 e reader global S3 ainda não estão prontos.
+O método interno compartilhável não comprova reúso já concluído pelo scanner.
+Não há evento file.changed anunciado sem transporte. S1 deve manter o buffer
+em erro, reler após conflito/reconexão e consumir o identificador retornado.
 
 ## Próxima etapa
 
-Implementar serviço local `file.list/read/write` com alvos registrados,
-leitura limitada, caminhos Unix preservados, escrita atômica e revisão de
-conteúdo, documentando limites de concorrência externa. S3 reutiliza a leitura
-segura. Em seguida, workspace/floor e canvas durável com revisão e importação
-explícita do localStorage pela S1. A matriz mantém os incrementos posteriores;
-esta ordem não reduz o objetivo aos serviços de arquivos.
+Concluir operações de gerenciamento de arquivos conforme ADR 0006; depois,
+workspace/floor e canvas durável com revisão e importação explícita do
+localStorage pela S1. Organização pin/archive/workflow pertence à S3, com
+migração 0005 reservada, antes da próxima migração S2. A matriz mantém presets,
+continuidade, comunicação, rotinas e ambientes remotos como trabalho restante.
diff --git a/docs/codex/xirp-integration-request.md b/docs/codex/xirp-integration-request.md
index 3f6f624..75d4bc8 100644
--- a/docs/codex/xirp-integration-request.md
+++ b/docs/codex/xirp-integration-request.md
@@ -71,3 +71,70 @@ search and offline editing. Integrate the current
 `origin/refactor/canvas-only-shell` before final frontend integration; preserve
 your own work. S1 is also reviewing the native-browser work already in
 `origin/main` for reuse, so avoid changing CanvasNode or CanvasWorkspace.
+### S3 second method proposal awaiting S2 review
+
+Please review S3 docs/codex/xirp-discovery-contract.md: knowledge.discover
+{projectId?}->{scanId,entries,truncated,issues}; knowledge.read
+{scanId,entryId}->{entry,content}. Narrow bounded known-rule/skill reader only,
+opaque IDs, safe symlinked skill-directory targets, no arbitrary paths, config
+files, scripts or second editor. No migration. Can S3 add these names +shared
+registration after implementation/tests, under the same additive workflow?
+Reply in S3 xirp-coordination-reply.md.
+
+S1 integration inspection found no editable prompt composer yet. Minimal host
+patch is WorkspaceOperations forwarding knowledge client methods +AppShell
+toolbar/Dialog +host-owned {targetSessionId,text} draft. S3 can provide isolated
+textarea/append helper; initial objective launch still needs S2 contract. We
+will leave S1's active merges untouched.
+
+## S3 integration progress and organization ownership — 2026-09-05
+
+S3 has merged current S1 canvas through `6f6af26` in `cfc79ba`; doc agreements
+are preserved. Draft PR #45 contains the saved library. S1 callback revision
+request is being implemented; source ID/revision identify the draft's base
+snapshot, while title/body may include unsaved edits. Actual composer mounting
+is still S1 work.
+
+S2's second-increment acknowledgment received. Rule/skill scanner work is now
+underway in isolated knowledge modules; S3 will publish both approved methods
+with bounded safe handlers and socket tests. Existing spawn_blocking knowledge
+dispatch from S2 will be preserved in the resulting integration.
+
+Organization needs one ownership clarification between the existing replies:
+the original user task and S1 acknowledgment assign S3 the new pin/archive/
+workflow modules, while S2's first acknowledgment retained these contracts.
+To avoid parallel implementation, S3 proposes owning isolated organization
+core/storage/daemon modules and UI, with S2 reviewing the wire contract and
+allocating the next migration after file/workspace work. Please delegate that
+bounded patch or confirm an implementation already underway with its contract.
+Workflow stays separate from process status, archive does not stop sessions,
+metadata deletion never removes working directories. S2 retains initial
+objective delivery through SessionManager/adapters; S3 owns drafting/context.
+
+Concrete organization proposal is now available in `xirp-organization-contract.md`: batched organization.get plus revision-checked organization.save, two FK metadata tables, no lifecycle writes. Awaiting S2 agreement and migration allocation before shared edits. Callback fix published as b7b0b4e.
+
+## S3 CI checkpoint — Linux catalog probe failure
+
+PR45 b7b0b4e: macOS Quality and Packaging passed. Linux Quality run
+34002926329 failed at crates/agents/tests/catalog.rs:54,
+`detect_and_set_enabled_do_not_require_real_clis`: expected ProbeStatus::Success,
+observed Failed {message:"the executable could not be started for a version probe"}.
+Both frontend/Playwright and Rust clippy passed before this test. The exact
+cause is not yet established; this is in the pre-existing adapter probe path.
+S2 owns runtime/adapters. Please inspect or delegate a narrow test/probe fix;
+S3 will not alter that shared runtime without the agreed boundary. Details:
+https://github.com/guicybercode/Jig/actions/runs/34002926329/job/101404942360
+
+S3 read-only follow-up: fixture common::script uses fs::write then chmod0700,
+probe maps all run_bounded errors to one static failure. spawn_with_retry
+currently retries WouldBlock/Interrupted and raw11/35 only. Linux ETXTBSY is
+a hypothesis worth checking under parallel fixture creation/fork; the CI log
+does not expose the underlying errno, so this is not a diagnosed cause.
+
+## S2 organization response — 2026-09-05
+
+S2 accepted S3 organization ownership and the proposed get/save contract in
+S3's xirp-coordination-reply.md. Migration 0005_organization.sql is reserved
+for S3; S2 workspace starts at 0006 after integration. File list/read/write
+requires no migration. Shared registrations accompany functional handlers and
+real SQLite/socket tests; no organization event is advertised yet.
diff --git a/docs/codex/xirp-organization-contract.md b/docs/codex/xirp-organization-contract.md
new file mode 100644
index 0000000..ec048d8
--- /dev/null
+++ b/docs/codex/xirp-organization-contract.md
@@ -0,0 +1,70 @@
+# S3 organization contract proposal
+
+Status: S2 approved ownership and reserved migration 0005_organization.sql
+in xirp-coordination-reply.md. This document records the proposal; no
+organization IPC names or handlers are implemented by this document.
+
+The original user task assigns new organization/context modules to S3 and
+shared contracts to S2. This proposal resolves the earlier replies' ownership
+difference with one bounded patch, independent of runtime/session execution.
+
+## Suggested wire contract
+
+- `organization.get {targets: OrganizationTarget[]}` returns `{entries}` in
+  request order. Between 1 and 100 distinct targets per call. Clients already
+  obtain project/session identities from the existing snapshot/list methods;
+  they can batch those IDs without a second session/project registry.
+- `organization.save {target,expectedRevision,pinned,archived,workflow}` returns
+  one `OrganizationEntry`. A project requires `workflow:null`; a session
+  requires one of `backlog|in_progress|in_review|blocked|done`. No partial patch
+  semantics: the optimistic revision protects the entire organization record.
+- A target is `{kind:"project",id:ProjectId}` or `{kind:"session",id:SessionId}`.
+- An entry has `{target,pinned,archived,workflow,revision,updatedAtMs}`. Existing
+  entities without organization rows return defaults: false/false, null for
+  project or backlog for session, revision 0, updatedAtMs null. No DB row is
+  written by reads. The first explicit save requires expectedRevision 0 and
+  creates revision 1 with epoch-ms updatedAtMs. Subsequent saves require the
+  current positive JS-safe revision and increment it, even for reverting all
+  flags to defaults; rows are not deleted during ordinary edits.
+
+Unknown entities fail with `project_not_found`/`session_not_found` (the batch
+is all-or-error). Stale saves return `organization_conflict`. Exhausted
+revisions fail rather than wrap. Malformed payloads return `invalid_payload`.
+No native process status, PID, worktree state, transcript or text body is
+accepted by this API.
+
+## Persistence and concurrency
+
+Proposed migration number must be allocated by S2. Add two tables,
+`project_organization` and `session_organization`, each keyed by its existing
+entity ID with an ON DELETE CASCADE foreign key. Keep metadata separate from
+the process-owned session row. Use immediate write transactions for compare
+and save, and one read snapshot for a get batch. Database constraints enforce
+booleans, workflow values, revision/timestamp ranges and typed relationships.
+
+Pin and archive preserve files, saved knowledge, PTYs and session status.
+Archiving a running session is permitted and changes only visibility metadata;
+UI makes continued execution apparent. Workflow changes never start, stop or
+signal any process. Deleting the underlying metadata removes its organization
+row through FK only; it does not delete a repository/worktree directory.
+
+## UI and integration
+
+S3 can provide isolated selected-project/session controls and a typed batch
+reader for S1's canvas/palette filters. S1 continues to own selection, sorting,
+archived visibility and canvas mounting. Conflicts preserve the desired flags
+and offer explicit refresh/retry with the newly observed revision.
+
+General metadata transport remains S2's future work; initial controls refresh
+after save/reconnect and provide manual refresh. No unimplemented event name
+will be added. Initial objective delivery remains a separate S2 adapter/runtime
+contract; source-backed editable drafts are S3/S1's composition boundary.
+
+## Required evidence
+
+Real SQLite: defaults, persistence/reopen, concurrent first insert/update,
+revision conflict/exhaustion, batch consistency, invalid/duplicate targets,
+FK cascade and file preservation. Real socket: project/session workflow and
+archive changes leave runtime snapshots/processes unchanged. UI: explicit
+controls, stale response guards, visible running-state warning while archived,
+conflict preservation. S1 mounting and Linux/macOS CI remain separate evidence.
diff --git a/docs/maestri-runtime-parity.md b/docs/maestri-runtime-parity.md
index 472ea02..539956c 100644
--- a/docs/maestri-runtime-parity.md
+++ b/docs/maestri-runtime-parity.md
@@ -11,7 +11,7 @@ mantida por S1. Os IDs M01–M48 e X01–X10 continuam sendo os dela; as descri
 completas, fontes por recurso e critérios visuais não são duplicados aqui.
 Na auditoria, a matriz e `docs/codex/parallel-goals.md` foram lidos na worktree
 principal, `/Users/eguimacs/cli-master`, onde ainda não estavam no baseline
-de S2. Publicar este recorte não substitui integrar esses documentos centrais.
+de S2. Esses documentos foram posteriormente integrados pelo merge `45d817a`.
 
 ## Fontes e interpretação
 
@@ -62,8 +62,16 @@ Os 118 testes core/daemon passaram no macOS, incluindo 9 novos de worktree;
 sagas/storage, Clippy e contratos frontend também foram verificados conforme
 [relatório S2](codex/maestri-runtime-report.md). Isso comprova o incremento de
 runtime M14/M34/M35; **os IDs completos continuam P**, pois floors/landing e
-integração desktop não estão concluídos. Linux/CI/pacote seguem sem resultado.
-Nenhum recurso posterior ganha V com essa execução.
+integração desktop não estão concluídos. CI e Packaging Linux/macOS aprovaram
+`45d817a`, conforme links no relatório. Isso não prova integração visual completa.
+
+`1225931` acrescenta list/read/write real sob alvos registrados e cliente IPC
+com decodificação. No macOS passaram 13 testes de contratos file, 8 de disco/
+falhas, 12 pelo socket e 5 de ACL, além de 51 testes IPC frontend. **M29/M30
+passam de A a P neste incremento**: faltam gerenciamento completo de arquivos,
+watcher, integração de editor S1 e confirmação Linux/macOS na nova CI.
+A limitação APFS a nomes válidos em UTF-8 e o CAS otimista externo estão
+registrados em ADR 0006. O read interno ainda não prova reúso pela S3.
 
 ## Recorte de runtime por ID central
 
@@ -93,8 +101,8 @@ agrupadas mantêm todos os IDs para auditoria sem redefinir seu escopo.
 | M25 — persistência de processo | P: R8 | Distinguir cliente reconectado de daemon novo e attachment tmux verificado. | S1 mostrar capacidade real; persistência após crash exige novo ADR. |
 | M26 — conversa | P metadados: R8; resume A | Adapter persiste e valida identidade nativa; retoma a conversa escolhida. | Nunca reconstruir conversa a partir do PID ou de replay PTY. |
 | M27, M28 — ambientes | A: R3/R7 | Resolver execução, cwd, arquivo e provisionamento no mesmo host; reconexão não duplica agente. | S1 ambiente/override; SSH/Docker/custom usam argv e transporte definido em ADR. |
-| M29 — arquivo | A: R3 | Listar/criar/mover/remover sob raiz registrada, tratar nomes Unix e links sem escapar do escopo. | S1 árvore; S3 reutiliza segurança de I/O. |
-| M30 — editor | A: R3 | Read/write em disco com limite de tamanho e revisão esperada; mudança externa gera conflito. | S1 buffers/edição; proteger conteúdo não salvo. |
+| M29 — arquivo | P: `1225931`, listagem socket macOS | Criar/mover/remover sob raiz registrada; confirmar os novos testes Linux. | S1 árvore; S3 reutiliza segurança de I/O. |
+| M30 — editor | P: `1225931`, read/write socket macOS | Integrar editor real, conflitos/reload e watcher; confirmar nova CI Linux/macOS. | S1 buffers/edição; proteger conteúdo não salvo. |
 | M31 — busca/tabs | A: R3/R4 | Busca cancelável com paginação estável; persistência de tabs/defaults. | S1 abre arquivo/linha; definir indexação e limites após file service. |
 | M32 — Git local | P: R6 | Stage/unstage/commit e descarte revisado no repositório derivado do alvo. | S1 diff real; descarte precisa prova de estado, não um booleano force. |
 | M33 — Git remoto/histórico | A: R6 | Git argv real com exclusão mútua, cancelamento e erros acionáveis. | S1 opções/history; credenciais continuam com Git do usuário. |

From fce39825080696634a35808b7b9be6a0601c4363 Mon Sep 17 00:00:00 2001
From: guicybercode <euguigom@gmail.com>
Date: Sat, 5 Sep 2026 22:46:01 -0300
Subject: [PATCH 20/23] feat(organization): persist project and session
 visibility and workflow

---
 apps/desktop/src/ipc/client.test.ts           |  32 ++
 apps/desktop/src/ipc/client.ts                |  14 +
 apps/desktop/src/ipc/domain.ts                |  27 +
 apps/desktop/src/ipc/methods.ts               |   4 +-
 .../src/ipc/organization-schema.test.ts       |  52 ++
 apps/desktop/src/ipc/organization-schema.ts   |  88 ++++
 apps/desktop/src/test/mockIpc.ts              |   4 +
 crates/core/src/lib.rs                        |   1 +
 crates/core/src/organization/mod.rs           | 398 ++++++++++++++
 crates/core/src/wire/method.rs                |   7 +
 crates/core/src/wire/mod.rs                   |   4 +
 crates/core/tests/organization_contract.rs    |  34 ++
 crates/daemon/src/lib.rs                      |   1 +
 crates/daemon/src/organization/mod.rs         |  58 +++
 crates/daemon/src/server.rs                   |  13 +
 crates/daemon/tests/organization_ipc.rs       | 253 +++++++++
 .../storage/migrations/0005_organization.sql  |  25 +
 crates/storage/src/durability_tests.rs        |   1 +
 crates/storage/src/lib.rs                     |   4 +-
 crates/storage/src/migrate.rs                 |  27 +
 crates/storage/src/organization/mod.rs        | 349 +++++++++++++
 crates/storage/tests/organization.rs          | 492 ++++++++++++++++++
 protocol/catalog.json                         |   4 +-
 protocol/fixtures/organization.json           |  51 ++
 24 files changed, 1940 insertions(+), 3 deletions(-)
 create mode 100644 apps/desktop/src/ipc/organization-schema.test.ts
 create mode 100644 apps/desktop/src/ipc/organization-schema.ts
 create mode 100644 crates/core/src/organization/mod.rs
 create mode 100644 crates/core/tests/organization_contract.rs
 create mode 100644 crates/daemon/src/organization/mod.rs
 create mode 100644 crates/daemon/tests/organization_ipc.rs
 create mode 100644 crates/storage/migrations/0005_organization.sql
 create mode 100644 crates/storage/src/organization/mod.rs
 create mode 100644 crates/storage/tests/organization.rs
 create mode 100644 protocol/fixtures/organization.json

diff --git a/apps/desktop/src/ipc/client.test.ts b/apps/desktop/src/ipc/client.test.ts
index 055bfcb..18706a8 100644
--- a/apps/desktop/src/ipc/client.test.ts
+++ b/apps/desktop/src/ipc/client.test.ts
@@ -12,6 +12,8 @@ vi.mock("@tauri-apps/plugin-opener", () => ({ openPath: transport.openPath }));
 
 import { createTauriIpcClient } from "./client";
 import discoveryFixture from "../../../../protocol/fixtures/knowledge-discovery.json";
+import organizationFixture from "../../../../protocol/fixtures/organization.json";
+import type { OrganizationGetRequest, OrganizationSaveRequest } from "./domain";
 import type { RequestEnvelope } from "./types";
 
 const PROJECT = {
@@ -450,3 +452,33 @@ describe("discovery IPC transport", () => {
     expect(capturedRequests()).toHaveLength(1);
   });
 });
+
+describe("organization IPC transport", () => {
+  beforeEach(() => { transport.invoke.mockReset(); });
+
+  it("batches existing targets and explicitly saves metadata without runtime methods", async () => {
+    installWireResponder({ "organization.get": organizationFixture.response, "organization.save": organizationFixture.saved });
+    const client = createTauriIpcClient();
+    const input: OrganizationGetRequest = { targets: [
+      { kind: "session", id: organizationFixture.request.targets[0].id },
+      { kind: "project", id: organizationFixture.request.targets[1].id },
+    ] };
+    expect(await client.getOrganization(input)).toEqual(organizationFixture.response);
+    const save: OrganizationSaveRequest = { target: input.targets[0], expectedRevision: 1, pinned: true, archived: true, workflow: "in_review" };
+    expect(await client.saveOrganization(save)).toEqual(organizationFixture.saved);
+    expect(capturedRequests().map((request) => ({ method: request.method, payload: request.payload }))).toEqual([
+      { method: "organization.get", payload: input }, { method: "organization.save", payload: save },
+    ]);
+  });
+
+  it("rejects an empty batch before transport and preserves optimistic conflicts", async () => {
+    const client = createTauriIpcClient();
+    await expect(client.getOrganization({ targets: [] })).rejects.toThrow();
+    expect(transport.invoke).not.toHaveBeenCalled();
+    transport.invoke.mockImplementation(async (_command, { request }) => ({
+      kind: "response", version: 1, requestId: request.requestId, status: "error",
+      error: { code: "organization_conflict", message: "Organization changed in another window." },
+    }));
+    await expect(client.saveOrganization({ target: { kind: "project", id: PROJECT.id }, expectedRevision: 0, pinned: true, archived: false, workflow: null })).rejects.toMatchObject({ code: "organization_conflict" });
+  });
+});
diff --git a/apps/desktop/src/ipc/client.ts b/apps/desktop/src/ipc/client.ts
index f604bf6..c7c4577 100644
--- a/apps/desktop/src/ipc/client.ts
+++ b/apps/desktop/src/ipc/client.ts
@@ -1,5 +1,7 @@
 import { decodeKnowledgeEntry, decodeKnowledgePage } from "./knowledge-schema";
 import { decodeKnowledgeDiscoverResponse, decodeKnowledgeReadResponse } from "./discovery-schema";
+import { decodeOrganizationGetResponse, decodeOrganizationSaveResponse, validateOrganizationGet, validateOrganizationSave } from "./organization-schema";
+import type { OrganizationEntry, OrganizationGetRequest, OrganizationGetResponse, OrganizationSaveRequest } from "./domain";
 import type { KnowledgeEntry, KnowledgeListRequest, KnowledgeListResponse, KnowledgeSaveRequest, KnowledgeDeleteRequest, KnowledgeDiscoverRequest, KnowledgeDiscoverResponse, KnowledgeReadRequest, KnowledgeReadResponse } from "./domain";
 import { invoke } from "@tauri-apps/api/core";
 import { listen } from "@tauri-apps/api/event";
@@ -68,6 +70,8 @@ export interface IpcClient {
   deleteKnowledge(input: KnowledgeDeleteRequest): Promise<void>;
   discoverKnowledge(input: KnowledgeDiscoverRequest): Promise<KnowledgeDiscoverResponse>;
   readKnowledge(input: KnowledgeReadRequest): Promise<KnowledgeReadResponse>;
+  getOrganization(input: OrganizationGetRequest): Promise<OrganizationGetResponse>;
+  saveOrganization(input: OrganizationSaveRequest): Promise<OrganizationEntry>;
   initialize(): Promise<BootstrapResult>;
   subscribe(
     handler: IpcEventHandler,
@@ -160,6 +164,16 @@ class TauriIpcClient implements IpcClient {
     return decodeKnowledgeDiscoverResponse(await this.request("knowledge.discover", input));
   }
 
+  async getOrganization(input: OrganizationGetRequest): Promise<OrganizationGetResponse> {
+    validateOrganizationGet(input);
+    return decodeOrganizationGetResponse(await this.request("organization.get", input), input);
+  }
+
+  async saveOrganization(input: OrganizationSaveRequest): Promise<OrganizationEntry> {
+    validateOrganizationSave(input);
+    return decodeOrganizationSaveResponse(await this.request("organization.save", input), input);
+  }
+
   async readKnowledge(input: KnowledgeReadRequest): Promise<KnowledgeReadResponse> {
     const response = decodeKnowledgeReadResponse(await this.request("knowledge.read", input));
     if (response.entry.entryId !== input.entryId) {
diff --git a/apps/desktop/src/ipc/domain.ts b/apps/desktop/src/ipc/domain.ts
index 80325da..49d8eec 100644
--- a/apps/desktop/src/ipc/domain.ts
+++ b/apps/desktop/src/ipc/domain.ts
@@ -97,3 +97,30 @@ export interface KnowledgeReadResponse {
   readonly entry: KnowledgeSourceEntry;
   readonly content: string;
 }
+
+/** Organization metadata targets existing catalog identities only. */
+export type OrganizationTarget = { readonly kind: "project"; readonly id: string } | { readonly kind: "session"; readonly id: string };
+export type OrganizationWorkflow = "backlog" | "in_progress" | "in_review" | "blocked" | "done";
+
+/** Visibility and user-managed workflow, independent of process state. */
+export interface OrganizationEntry {
+  readonly target: OrganizationTarget;
+  readonly pinned: boolean;
+  readonly archived: boolean;
+  readonly workflow: OrganizationWorkflow | null;
+  readonly revision: number;
+  readonly updatedAtMs: number | null;
+}
+
+/** Between one and 100 distinct targets; results retain request order. */
+export interface OrganizationGetRequest { readonly targets: readonly OrganizationTarget[]; }
+export interface OrganizationGetResponse { readonly entries: readonly OrganizationEntry[]; }
+
+/** Explicit replacement of all flags; zero is the revision of unwritten defaults. */
+export interface OrganizationSaveRequest {
+  readonly target: OrganizationTarget;
+  readonly expectedRevision: number;
+  readonly pinned: boolean;
+  readonly archived: boolean;
+  readonly workflow: OrganizationWorkflow | null;
+}
diff --git a/apps/desktop/src/ipc/methods.ts b/apps/desktop/src/ipc/methods.ts
index e7ca201..b733ce9 100644
--- a/apps/desktop/src/ipc/methods.ts
+++ b/apps/desktop/src/ipc/methods.ts
@@ -32,7 +32,9 @@ export const IPC_METHODS = [
   "knowledge.save",
   "knowledge.delete",
   "knowledge.discover",
-  "knowledge.read"
+  "knowledge.read",
+  "organization.get",
+  "organization.save"
 ] as const;
 
 export type IpcMethod = (typeof IPC_METHODS)[number];
diff --git a/apps/desktop/src/ipc/organization-schema.test.ts b/apps/desktop/src/ipc/organization-schema.test.ts
new file mode 100644
index 0000000..1a8e94f
--- /dev/null
+++ b/apps/desktop/src/ipc/organization-schema.test.ts
@@ -0,0 +1,52 @@
+import { describe, expect, it } from "vitest";
+
+import fixture from "../../../../protocol/fixtures/organization.json";
+import type { OrganizationGetRequest, OrganizationSaveRequest } from "./domain";
+import { decodeOrganizationEntry, decodeOrganizationGetResponse, decodeOrganizationSaveResponse, validateOrganizationGet, validateOrganizationSave } from "./organization-schema";
+
+const request: OrganizationGetRequest = { targets: fixture.response.entries.map((entry) => decodeOrganizationEntry(entry).target) };
+
+describe("organization Rust/TypeScript contract", () => {
+  it("decodes the shared defaults in requested order and preserves saved fields", () => {
+    expect(request).toEqual(fixture.request);
+    expect(decodeOrganizationGetResponse(fixture.response, request)).toEqual(fixture.response);
+    expect(decodeOrganizationEntry(fixture.saved)).toEqual(fixture.saved);
+  });
+
+  it("requires exact default flags, workflow and explicit null timestamps at revision zero", () => {
+    for (const patch of [{ pinned: true }, { archived: true }, { workflow: "done" }, { updatedAtMs: 0 }, { updatedAtMs: undefined }, { revision: -1 }]) {
+      expect(() => decodeOrganizationEntry({ ...fixture.response.entries[0], ...patch })).toThrow();
+    }
+    expect(() => decodeOrganizationEntry({ ...fixture.response.entries[1], workflow: "backlog" })).toThrow();
+    expect(() => decodeOrganizationEntry({ ...fixture.response.entries[0], workflow: null })).toThrow();
+    expect(() => decodeOrganizationEntry({ ...fixture.response.entries[1], workflow: undefined })).toThrow();
+  });
+
+  it("rejects unsafe saved numbers and unrecognized variants without echoing payload values", () => {
+    for (const patch of [{ revision: Number.MAX_SAFE_INTEGER + 1 }, { updatedAtMs: null }, { updatedAtMs: -1 }, { updatedAtMs: 0.5 }, { updatedAtMs: Number.MAX_SAFE_INTEGER + 1 }, { pinned: "yes" }, { workflow: "private text" }]) {
+      expect(() => decodeOrganizationEntry({ ...fixture.saved, ...patch })).toThrow();
+    }
+    expect(() => decodeOrganizationEntry({ ...fixture.saved, target: { kind: "private text", id: fixture.saved.target.id } })).toThrow("Invalid organization target kind");
+  });
+
+  it("rejects empty, oversized and duplicate batches, including UUID case aliases", () => {
+    const owner = request.targets[0];
+    expect(() => validateOrganizationGet({ targets: [] })).toThrow();
+    expect(() => validateOrganizationGet({ targets: Array.from({ length: 101 }, () => owner) })).toThrow();
+    expect(() => validateOrganizationGet({ targets: [owner, owner] })).toThrow("Duplicate organization targets");
+    expect(() => validateOrganizationGet({ targets: [owner, { ...owner, id: owner.id.toUpperCase() }] })).toThrow("Duplicate organization targets");
+  });
+
+  it("rejects missing or reordered response targets instead of attaching metadata to another entity", () => {
+    expect(() => decodeOrganizationGetResponse({ entries: [] }, request)).toThrow("Organization response does not match requested targets");
+    expect(() => decodeOrganizationGetResponse({ entries: [...fixture.response.entries].reverse() }, request)).toThrow("Organization response does not match requested targets");
+  });
+
+  it("correlates a saved response with all desired flags, the target and the next revision", () => {
+    const saved = decodeOrganizationEntry(fixture.saved);
+    const input: OrganizationSaveRequest = { target: saved.target, expectedRevision: 1, pinned: saved.pinned, archived: saved.archived, workflow: saved.workflow };
+    expect(decodeOrganizationSaveResponse(fixture.saved, input)).toEqual(fixture.saved);
+    for (const patch of [{ revision: 3 }, { pinned: false }, { archived: false }, { workflow: "done" }]) expect(() => decodeOrganizationSaveResponse({ ...fixture.saved, ...patch }, input)).toThrow();
+    expect(() => validateOrganizationSave({ ...input, target: request.targets[1] })).toThrow();
+  });
+});
diff --git a/apps/desktop/src/ipc/organization-schema.ts b/apps/desktop/src/ipc/organization-schema.ts
new file mode 100644
index 0000000..b993fa0
--- /dev/null
+++ b/apps/desktop/src/ipc/organization-schema.ts
@@ -0,0 +1,88 @@
+import type { OrganizationEntry, OrganizationGetRequest, OrganizationGetResponse, OrganizationSaveRequest, OrganizationTarget, OrganizationWorkflow } from "./domain";
+import { IpcContractError, requireArray, requireBoolean, requireRecord, requireString } from "./schema";
+
+/** Stable identity key shared by batch correlation and draft caches. */
+export function organizationTargetKey(target: OrganizationTarget): string {
+  return `${target.kind}:${target.id.toLowerCase()}`;
+}
+
+/** Validates catalog IDs without attaching the rejected payload to an error. */
+function target(value: unknown): OrganizationTarget {
+  const row = requireRecord(value, "organization target");
+  if (row.kind !== "project" && row.kind !== "session") throw new IpcContractError("Invalid organization target kind");
+  const id = requireString(row.id, "organization target ID");
+  if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(id)) throw new IpcContractError("Invalid organization target ID");
+  return { kind: row.kind, id };
+}
+
+/** Workflow values are user labels rather than native runtime states. */
+export function isOrganizationWorkflow(value: unknown): value is OrganizationWorkflow {
+  return value === "backlog" || value === "in_progress" || value === "in_review" || value === "blocked" || value === "done";
+}
+
+function workflow(value: unknown, owner: OrganizationTarget): OrganizationWorkflow | null {
+  if (owner.kind === "project" && value === null) return null;
+  if (owner.kind === "session" && isOrganizationWorkflow(value)) return value;
+  throw new IpcContractError("Organization workflow does not match its target");
+}
+
+function integer(value: unknown): number {
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) throw new IpcContractError("Invalid organization revision or timestamp");
+  return value;
+}
+
+/** Matches Rust's unwritten defaults and persisted-entry invariants. */
+export function decodeOrganizationEntry(value: unknown): OrganizationEntry {
+  const row = requireRecord(value, "organization entry");
+  const owner = target(row.target);
+  const pinned = requireBoolean(row.pinned, "organization pinned flag");
+  const archived = requireBoolean(row.archived, "organization archived flag");
+  const progress = workflow(row.workflow, owner);
+  const revision = integer(row.revision);
+  const updatedAtMs = row.updatedAtMs === null ? null : integer(row.updatedAtMs);
+  if (revision === 0 ? pinned || archived || updatedAtMs !== null || (owner.kind === "session" && progress !== "backlog") : updatedAtMs === null) {
+    throw new IpcContractError("Invalid organization default or saved entry");
+  }
+  return { target: owner, pinned, archived, workflow: progress, revision, updatedAtMs };
+}
+
+/** Validates the whole batch before sending a read to the daemon. */
+export function validateOrganizationGet(input: OrganizationGetRequest): void {
+  if (input.targets.length < 1 || input.targets.length > 100) throw new IpcContractError("Organization batches require 1 to 100 targets");
+  const targets = input.targets.map(target);
+  if (new Set(targets.map(organizationTargetKey)).size !== targets.length) throw new IpcContractError("Duplicate organization targets");
+}
+
+/** Correlates every response with its requested target in the original order. */
+export function decodeOrganizationGetResponse(value: unknown, input: OrganizationGetRequest): OrganizationGetResponse {
+  validateOrganizationGet(input);
+  const row = requireRecord(value, "organization response");
+  const rawEntries = requireArray(row.entries, "organization entries");
+  if (rawEntries.length !== input.targets.length) {
+    throw new IpcContractError("Organization response does not match requested targets");
+  }
+  const entries = rawEntries.map(decodeOrganizationEntry);
+  if (entries.some((entry, index) => organizationTargetKey(entry.target) !== organizationTargetKey(input.targets[index]))) {
+    throw new IpcContractError("Organization response does not match requested targets");
+  }
+  return { entries };
+}
+
+/** Validates a complete optimistic save before transmitting it. */
+export function validateOrganizationSave(input: OrganizationSaveRequest): void {
+  const owner = target(input.target);
+  integer(input.expectedRevision);
+  requireBoolean(input.pinned, "organization pinned flag");
+  requireBoolean(input.archived, "organization archived flag");
+  workflow(input.workflow, owner);
+}
+
+/** Prevents another target or different desired flags from being reported as saved. */
+export function decodeOrganizationSaveResponse(value: unknown, input: OrganizationSaveRequest): OrganizationEntry {
+  validateOrganizationSave(input);
+  const entry = decodeOrganizationEntry(value);
+  if (organizationTargetKey(entry.target) !== organizationTargetKey(input.target) || entry.revision !== input.expectedRevision + 1 || entry.pinned !== input.pinned || entry.archived !== input.archived || entry.workflow !== input.workflow) {
+    throw new IpcContractError("Organization save response does not match the requested change");
+  }
+  return entry;
+}
diff --git a/apps/desktop/src/test/mockIpc.ts b/apps/desktop/src/test/mockIpc.ts
index a6e6c73..723ed6e 100644
--- a/apps/desktop/src/test/mockIpc.ts
+++ b/apps/desktop/src/test/mockIpc.ts
@@ -29,6 +29,8 @@ export interface MockIpcClient extends IpcClient {
   readonly deleteKnowledge: Mock<IpcClient["deleteKnowledge"]>;
   readonly discoverKnowledge: Mock<IpcClient["discoverKnowledge"]>;
   readonly readKnowledge: Mock<IpcClient["readKnowledge"]>;
+  readonly getOrganization: Mock<IpcClient["getOrganization"]>;
+  readonly saveOrganization: Mock<IpcClient["saveOrganization"]>;
   readonly initialize: Mock<IpcClient["initialize"]>;
   readonly subscribe: Mock<IpcClient["subscribe"]>;
   readonly subscribeTerminal: Mock<IpcClient["subscribeTerminal"]>;
@@ -156,6 +158,8 @@ export function createMockIpcClient(
     deleteKnowledge: vi.fn<IpcClient["deleteKnowledge"]>(handlers.deleteKnowledge ?? (() => rejectUnhandled("deleteKnowledge"))),
     discoverKnowledge: vi.fn<IpcClient["discoverKnowledge"]>(handlers.discoverKnowledge ?? (() => rejectUnhandled("discoverKnowledge"))),
     readKnowledge: vi.fn<IpcClient["readKnowledge"]>(handlers.readKnowledge ?? (() => rejectUnhandled("readKnowledge"))),
+    getOrganization: vi.fn<IpcClient["getOrganization"]>(handlers.getOrganization ?? (() => rejectUnhandled("getOrganization"))),
+    saveOrganization: vi.fn<IpcClient["saveOrganization"]>(handlers.saveOrganization ?? (() => rejectUnhandled("saveOrganization"))),
     openPath: vi.fn<IpcClient["openPath"]>(
       handlers.openPath ?? (() => rejectUnhandled("openPath")),
     ),
diff --git a/crates/core/src/lib.rs b/crates/core/src/lib.rs
index 2cb3f64..fcb952b 100644
--- a/crates/core/src/lib.rs
+++ b/crates/core/src/lib.rs
@@ -11,6 +11,7 @@ mod error;
 mod ids;
 pub mod knowledge;
 mod model;
+pub mod organization;
 mod protocol;
 mod redact;
 pub mod wire;
diff --git a/crates/core/src/organization/mod.rs b/crates/core/src/organization/mod.rs
new file mode 100644
index 0000000..ccbb683
--- /dev/null
+++ b/crates/core/src/organization/mod.rs
@@ -0,0 +1,398 @@
+//! Pure organization metadata, deliberately separate from process lifecycle.
+
+use std::{collections::BTreeSet, error::Error, fmt};
+
+use serde::{Deserialize, Deserializer, Serialize, de};
+
+use crate::{ProjectId, SessionId};
+
+/// Maximum number of distinct entities in one organization read.
+pub const MAX_ORGANIZATION_TARGETS: usize = 100;
+/// Highest organization revision representable exactly by JavaScript.
+pub const MAX_ORGANIZATION_REVISION: u64 = 9_007_199_254_740_991;
+
+/// An existing project or session selected through the established catalog.
+#[derive(Clone, Copy, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(tag = "kind", rename_all = "snake_case", deny_unknown_fields)]
+pub enum OrganizationTarget {
+    /// Organization metadata for a registered project.
+    Project {
+        /// Existing project identifier.
+        id: ProjectId,
+    },
+    /// Organization metadata for a daemon-owned session.
+    Session {
+        /// Existing session identifier.
+        id: SessionId,
+    },
+}
+
+/// User-managed work progress; never a signal about process liveness.
+#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum OrganizationWorkflow {
+    /// Work has not begun.
+    Backlog,
+    /// Work is underway.
+    InProgress,
+    /// Work awaits review.
+    InReview,
+    /// Work is blocked on a dependency.
+    Blocked,
+    /// Work is considered complete by the user.
+    Done,
+}
+
+/// Safe validation failure containing a static explanation only.
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct OrganizationValidationError(&'static str);
+
+impl fmt::Display for OrganizationValidationError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(self.0)
+    }
+}
+
+impl Error for OrganizationValidationError {}
+
+/// Validated, ordered batch containing between one and 100 distinct targets.
+#[derive(Clone, Debug, Eq, PartialEq, Serialize)]
+#[serde(transparent)]
+pub struct OrganizationTargets(Vec<OrganizationTarget>);
+
+impl OrganizationTargets {
+    /// Validates batch size and uniqueness while retaining caller order.
+    ///
+    /// # Errors
+    ///
+    /// Rejects empty, oversized, or duplicate-target batches.
+    pub fn try_new(targets: Vec<OrganizationTarget>) -> Result<Self, OrganizationValidationError> {
+        if targets.is_empty() || targets.len() > MAX_ORGANIZATION_TARGETS {
+            return Err(OrganizationValidationError(
+                "targets must contain between 1 and 100 entries",
+            ));
+        }
+        if targets.iter().copied().collect::<BTreeSet<_>>().len() != targets.len() {
+            return Err(OrganizationValidationError(
+                "targets must not contain duplicates",
+            ));
+        }
+        Ok(Self(targets))
+    }
+
+    /// Returns the validated targets in request order.
+    #[must_use]
+    pub fn as_slice(&self) -> &[OrganizationTarget] {
+        &self.0
+    }
+
+    /// Consumes the batch and returns its ordered targets.
+    #[must_use]
+    pub fn into_inner(self) -> Vec<OrganizationTarget> {
+        self.0
+    }
+}
+
+impl<'de> Deserialize<'de> for OrganizationTargets {
+    fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        let targets = Vec::deserialize(deserializer)
+            .map_err(|_| de::Error::custom("invalid organization targets"))?;
+        Self::try_new(targets).map_err(de::Error::custom)
+    }
+}
+
+/// Reads organization metadata without creating default rows.
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(deny_unknown_fields, rename_all = "camelCase")]
+pub struct OrganizationGetRequest {
+    /// Existing entities in the desired response order.
+    pub targets: OrganizationTargets,
+}
+
+/// Organization metadata in exactly the requested target order.
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(deny_unknown_fields, rename_all = "camelCase")]
+pub struct OrganizationGetResponse {
+    /// One entry per requested existing entity.
+    pub entries: Vec<OrganizationEntry>,
+}
+
+/// Visibility and workflow metadata independent of session process state.
+#[derive(Clone, Debug, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct OrganizationEntry {
+    /// Existing entity that owns the organization metadata.
+    pub target: OrganizationTarget,
+    /// User selected the entity for pinned display.
+    pub pinned: bool,
+    /// User archived the entity; a session may continue executing.
+    pub archived: bool,
+    /// Null for projects; user-managed work progress for sessions.
+    pub workflow: Option<OrganizationWorkflow>,
+    /// Zero for unwritten defaults; positive after an explicit save.
+    pub revision: u64,
+    /// Null for unwritten defaults; otherwise Unix epoch milliseconds.
+    pub updated_at_ms: Option<i64>,
+}
+
+impl OrganizationEntry {
+    /// Returns unwritten defaults for an existing entity.
+    #[must_use]
+    pub const fn defaults(target: OrganizationTarget) -> Self {
+        Self {
+            target,
+            pinned: false,
+            archived: false,
+            workflow: match target {
+                OrganizationTarget::Project { .. } => None,
+                OrganizationTarget::Session { .. } => Some(OrganizationWorkflow::Backlog),
+            },
+            revision: 0,
+            updated_at_ms: None,
+        }
+    }
+
+    /// Checks workflow, revision, timestamp, and unwritten-default consistency.
+    ///
+    /// # Errors
+    ///
+    /// Rejects mismatched target/workflow, unsafe numbers, or non-default revision-zero values.
+    pub fn validate(&self) -> Result<(), OrganizationValidationError> {
+        validate_workflow(self.target, self.workflow)?;
+        validate_revision(self.revision)?;
+        if self.revision == 0 {
+            if self != &Self::defaults(self.target) {
+                return Err(OrganizationValidationError(
+                    "revision zero requires unwritten default values",
+                ));
+            }
+        } else if !self
+            .updated_at_ms
+            .is_some_and(|value| (0..=9_007_199_254_740_991).contains(&value))
+        {
+            return Err(OrganizationValidationError(
+                "saved entries require a non-negative JavaScript-safe updatedAtMs",
+            ));
+        }
+        Ok(())
+    }
+}
+
+impl<'de> Deserialize<'de> for OrganizationEntry {
+    fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        #[derive(Deserialize)]
+        #[serde(deny_unknown_fields, rename_all = "camelCase")]
+        struct Fields {
+            target: OrganizationTarget,
+            pinned: bool,
+            archived: bool,
+            #[serde(deserialize_with = "required_nullable")]
+            workflow: Option<OrganizationWorkflow>,
+            revision: u64,
+            #[serde(deserialize_with = "required_nullable")]
+            updated_at_ms: Option<i64>,
+        }
+        let fields = Fields::deserialize(deserializer)
+            .map_err(|_| de::Error::custom("invalid organization entry"))?;
+        let entry = Self {
+            target: fields.target,
+            pinned: fields.pinned,
+            archived: fields.archived,
+            workflow: fields.workflow,
+            revision: fields.revision,
+            updated_at_ms: fields.updated_at_ms,
+        };
+        entry.validate().map_err(de::Error::custom)?;
+        Ok(entry)
+    }
+}
+
+/// Replaces all organization flags with an optimistic revision check.
+#[derive(Clone, Debug, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct OrganizationSaveRequest {
+    /// Existing project or session whose organization metadata changes.
+    pub target: OrganizationTarget,
+    /// Zero for the first explicit save; otherwise the observed revision.
+    pub expected_revision: u64,
+    /// Complete desired pinned flag.
+    pub pinned: bool,
+    /// Complete desired archived flag.
+    pub archived: bool,
+    /// Explicit null for projects; required workflow for sessions.
+    pub workflow: Option<OrganizationWorkflow>,
+}
+
+impl OrganizationSaveRequest {
+    /// Validates target/workflow consistency and the expected revision range.
+    ///
+    /// # Errors
+    ///
+    /// Rejects project workflow, missing session workflow, or an unsafe revision.
+    pub fn validate(&self) -> Result<(), OrganizationValidationError> {
+        validate_workflow(self.target, self.workflow)?;
+        validate_revision(self.expected_revision)
+    }
+}
+
+impl<'de> Deserialize<'de> for OrganizationSaveRequest {
+    fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        #[derive(Deserialize)]
+        #[serde(deny_unknown_fields, rename_all = "camelCase")]
+        struct Fields {
+            target: OrganizationTarget,
+            expected_revision: u64,
+            pinned: bool,
+            archived: bool,
+            #[serde(deserialize_with = "required_nullable")]
+            workflow: Option<OrganizationWorkflow>,
+        }
+        let fields = Fields::deserialize(deserializer)
+            .map_err(|_| de::Error::custom("invalid organization save request"))?;
+        let request = Self {
+            target: fields.target,
+            expected_revision: fields.expected_revision,
+            pinned: fields.pinned,
+            archived: fields.archived,
+            workflow: fields.workflow,
+        };
+        request.validate().map_err(de::Error::custom)?;
+        Ok(request)
+    }
+}
+
+fn required_nullable<'de, D: Deserializer<'de>, T: Deserialize<'de>>(
+    deserializer: D,
+) -> Result<Option<T>, D::Error> {
+    Option::<T>::deserialize(deserializer)
+}
+
+fn validate_workflow(
+    target: OrganizationTarget,
+    workflow: Option<OrganizationWorkflow>,
+) -> Result<(), OrganizationValidationError> {
+    match (target, workflow) {
+        (OrganizationTarget::Project { .. }, None)
+        | (OrganizationTarget::Session { .. }, Some(_)) => Ok(()),
+        _ => Err(OrganizationValidationError(
+            "projects require null workflow and sessions require a workflow value",
+        )),
+    }
+}
+
+const fn validate_revision(revision: u64) -> Result<(), OrganizationValidationError> {
+    if revision > MAX_ORGANIZATION_REVISION {
+        Err(OrganizationValidationError(
+            "revision must be a JavaScript-safe non-negative integer",
+        ))
+    } else {
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+
+    #[test]
+    fn batches_are_bounded_distinct_typed_and_ordered() {
+        let target = OrganizationTarget::Project {
+            id: ProjectId::new(),
+        };
+        assert!(OrganizationTargets::try_new(vec![]).is_err());
+        assert!(OrganizationTargets::try_new(vec![target, target]).is_err());
+        let targets = (0..100)
+            .map(|_| OrganizationTarget::Session {
+                id: SessionId::new(),
+            })
+            .collect::<Vec<_>>();
+        assert_eq!(
+            OrganizationTargets::try_new(targets.clone())
+                .unwrap()
+                .as_slice(),
+            targets
+        );
+        assert!(OrganizationTargets::try_new([targets, vec![target]].concat()).is_err());
+        assert!(
+            serde_json::from_value::<OrganizationGetRequest>(json!({"targets":[target,target]}))
+                .is_err()
+        );
+        assert!(
+            serde_json::from_value::<OrganizationTarget>(
+                json!({"kind":"project","id":ProjectId::new(),"pid":1})
+            )
+            .is_err()
+        );
+    }
+
+    #[test]
+    fn defaults_require_explicit_null_timestamp_and_matching_workflow() {
+        for target in [
+            OrganizationTarget::Project {
+                id: ProjectId::new(),
+            },
+            OrganizationTarget::Session {
+                id: SessionId::new(),
+            },
+        ] {
+            let defaults = OrganizationEntry::defaults(target);
+            let value = serde_json::to_value(&defaults).unwrap();
+            assert_eq!(value["revision"], 0);
+            assert!(
+                value
+                    .get("updatedAtMs")
+                    .is_some_and(serde_json::Value::is_null)
+            );
+            assert_eq!(
+                serde_json::from_value::<OrganizationEntry>(value.clone()).unwrap(),
+                defaults
+            );
+            let mut invalid = value;
+            invalid["pinned"] = json!(true);
+            assert!(serde_json::from_value::<OrganizationEntry>(invalid).is_err());
+        }
+    }
+
+    #[test]
+    fn saves_require_whole_record_and_correct_target_workflow() {
+        let mut project = json!({"target":{"kind":"project","id":ProjectId::new()},"expectedRevision":0,"pinned":true,"archived":false,"workflow":null});
+        assert!(serde_json::from_value::<OrganizationSaveRequest>(project.clone()).is_ok());
+        project.as_object_mut().unwrap().remove("workflow");
+        assert!(serde_json::from_value::<OrganizationSaveRequest>(project.clone()).is_err());
+        project["workflow"] = json!("done");
+        assert!(serde_json::from_value::<OrganizationSaveRequest>(project.clone()).is_err());
+        project["target"] = json!({"kind":"session","id":SessionId::new()});
+        for workflow in ["backlog", "in_progress", "in_review", "blocked", "done"] {
+            project["workflow"] = json!(workflow);
+            assert!(serde_json::from_value::<OrganizationSaveRequest>(project.clone()).is_ok());
+        }
+        project["workflow"] = serde_json::Value::Null;
+        assert!(serde_json::from_value::<OrganizationSaveRequest>(project).is_err());
+    }
+
+    #[test]
+    fn revisions_and_timestamps_reject_unsafe_or_inconsistent_values() {
+        let target = OrganizationTarget::Project {
+            id: ProjectId::new(),
+        };
+        let mut entry = OrganizationEntry {
+            revision: 1,
+            updated_at_ms: Some(0),
+            ..OrganizationEntry::defaults(target)
+        };
+        assert!(entry.validate().is_ok());
+        for timestamp in [None, Some(-1), Some(9_007_199_254_740_992)] {
+            entry.updated_at_ms = timestamp;
+            assert!(serde_json::from_value::<OrganizationEntry>(json!(entry)).is_err());
+        }
+        for revision in [
+            json!(-1),
+            json!(1.5),
+            json!(MAX_ORGANIZATION_REVISION + 1),
+            json!("1"),
+        ] {
+            assert!(serde_json::from_value::<OrganizationSaveRequest>(json!({"target":target,"expectedRevision":revision,"pinned":false,"archived":false,"workflow":null})).is_err());
+        }
+    }
+}
diff --git a/crates/core/src/wire/method.rs b/crates/core/src/wire/method.rs
index d213d90..ef9bf19 100644
--- a/crates/core/src/wire/method.rs
+++ b/crates/core/src/wire/method.rs
@@ -74,6 +74,11 @@ pub const KNOWLEDGE_DISCOVER: &str = "knowledge.discover";
 /// Read a bounded source selected by an expiring discovery capability.
 pub const KNOWLEDGE_READ: &str = "knowledge.read";
 
+/// Read a bounded batch of project/session organization metadata.
+pub const ORGANIZATION_GET: &str = "organization.get";
+/// Save visibility/workflow metadata after comparing its revision.
+pub const ORGANIZATION_SAVE: &str = "organization.save";
+
 /// Every method implemented by the Beta v1 contract.
 pub const ALL: &[&str] = &[
     SYSTEM_HELLO,
@@ -109,6 +114,8 @@ pub const ALL: &[&str] = &[
     KNOWLEDGE_DELETE,
     KNOWLEDGE_DISCOVER,
     KNOWLEDGE_READ,
+    ORGANIZATION_GET,
+    ORGANIZATION_SAVE,
 ];
 
 /// Returns whether a dotted method belongs to the Beta v1 contract.
diff --git a/crates/core/src/wire/mod.rs b/crates/core/src/wire/mod.rs
index f6d1225..7a3b76f 100644
--- a/crates/core/src/wire/mod.rs
+++ b/crates/core/src/wire/mod.rs
@@ -25,6 +25,10 @@ pub use crate::knowledge::{
     KnowledgeValidationError, MAX_KNOWLEDGE_BODY_BYTES, MAX_KNOWLEDGE_REVISION,
     MAX_KNOWLEDGE_TITLE_BYTES,
 };
+pub use crate::organization::{
+    OrganizationEntry, OrganizationGetRequest, OrganizationGetResponse, OrganizationSaveRequest,
+    OrganizationTarget, OrganizationTargets, OrganizationWorkflow,
+};
 pub use event::{
     AgentChangedEvent, AgentRemovedEvent, DaemonShuttingDownEvent, GitStatusChangedEvent,
     ProjectChangedEvent, ProjectRemovedEvent, SessionChangedEvent, SessionDeletedEvent,
diff --git a/crates/core/tests/organization_contract.rs b/crates/core/tests/organization_contract.rs
new file mode 100644
index 0000000..1904184
--- /dev/null
+++ b/crates/core/tests/organization_contract.rs
@@ -0,0 +1,34 @@
+use cli_master_core::wire::{
+    OrganizationEntry, OrganizationGetRequest, OrganizationGetResponse, method,
+};
+use serde_json::{Value, json};
+
+#[test]
+fn fixture_keeps_request_order_and_explicit_defaults() {
+    let fixture: Value =
+        serde_json::from_str(include_str!("../../../protocol/fixtures/organization.json")).unwrap();
+    let request: OrganizationGetRequest =
+        serde_json::from_value(fixture["request"].clone()).unwrap();
+    let response: OrganizationGetResponse =
+        serde_json::from_value(fixture["response"].clone()).unwrap();
+    assert_eq!(
+        serde_json::to_value(&response).unwrap(),
+        fixture["response"]
+    );
+    for (target, entry) in request.targets.as_slice().iter().zip(&response.entries) {
+        assert_eq!(*target, entry.target);
+        assert_eq!(*entry, OrganizationEntry::defaults(*target));
+    }
+    let saved: OrganizationEntry = serde_json::from_value(fixture["saved"].clone()).unwrap();
+    assert_eq!(serde_json::to_value(saved).unwrap(), fixture["saved"]);
+}
+
+#[test]
+fn catalog_registers_functional_metadata_operations_without_process_aliases() {
+    let catalog: Value =
+        serde_json::from_str(include_str!("../../../protocol/catalog.json")).unwrap();
+    assert_eq!(catalog["methods"], json!(method::ALL));
+    assert!(method::is_supported(method::ORGANIZATION_GET));
+    assert!(method::is_supported(method::ORGANIZATION_SAVE));
+    assert!(!method::is_supported("organization.stop"));
+}
diff --git a/crates/daemon/src/lib.rs b/crates/daemon/src/lib.rs
index 685d628..99e689b 100644
--- a/crates/daemon/src/lib.rs
+++ b/crates/daemon/src/lib.rs
@@ -16,6 +16,7 @@ mod events;
 mod git_inspection;
 mod knowledge;
 mod lock;
+mod organization;
 mod paths;
 mod preflight;
 mod projects;
diff --git a/crates/daemon/src/organization/mod.rs b/crates/daemon/src/organization/mod.rs
new file mode 100644
index 0000000..6794a69
--- /dev/null
+++ b/crates/daemon/src/organization/mod.rs
@@ -0,0 +1,58 @@
+//! Organization metadata has no session/process side effects.
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use cli_master_core::{
+    ApiError,
+    wire::{OrganizationGetRequest, OrganizationSaveRequest, method},
+};
+use cli_master_storage::Storage;
+use serde::{Serialize, de::DeserializeOwned};
+use serde_json::Value;
+
+pub(crate) fn dispatch(method: &str, payload: Value, storage: &Storage) -> Result<Value, ApiError> {
+    match method {
+        method::ORGANIZATION_GET => {
+            let request: OrganizationGetRequest = decode(payload)?;
+            encode(
+                storage
+                    .get_organization(&request)
+                    .map_err(|error| error.to_api_error())?,
+            )
+        }
+        method::ORGANIZATION_SAVE => {
+            let request: OrganizationSaveRequest = decode(payload)?;
+            let now = SystemTime::now()
+                .duration_since(UNIX_EPOCH)
+                .ok()
+                .and_then(|elapsed| i64::try_from(elapsed.as_millis()).ok())
+                .ok_or_else(|| {
+                    ApiError::new("clock_unavailable", "The local clock is unavailable.")
+                })?;
+            encode(
+                storage
+                    .save_organization(&request, now)
+                    .map_err(|error| error.to_api_error())?,
+            )
+        }
+        _ => Err(ApiError::new(
+            "unsupported_method",
+            "Unknown organization operation.",
+        )),
+    }
+}
+
+fn decode<T: DeserializeOwned>(payload: Value) -> Result<T, ApiError> {
+    serde_json::from_value(payload).map_err(|_| {
+        ApiError::new("invalid_payload", "The organization request is invalid.")
+            .with_action("Check the selected entity, flags, workflow and revision.")
+    })
+}
+
+fn encode(value: impl Serialize) -> Result<Value, ApiError> {
+    serde_json::to_value(value).map_err(|_| {
+        ApiError::new(
+            "internal_error",
+            "The organization response could not be encoded.",
+        )
+    })
+}
diff --git a/crates/daemon/src/server.rs b/crates/daemon/src/server.rs
index 5b1b72b..1f585fe 100644
--- a/crates/daemon/src/server.rs
+++ b/crates/daemon/src/server.rs
@@ -581,6 +581,19 @@ async fn dispatch(
                 )),
             }
         }
+        method::ORGANIZATION_GET | method::ORGANIZATION_SAVE => {
+            let state = Arc::clone(state);
+            tokio::task::spawn_blocking(move || {
+                crate::organization::dispatch(&request.method, request.payload, &state.git_storage)
+            })
+            .await
+            .unwrap_or_else(|_| {
+                Err(ApiError::new(
+                    "organization_operation_failed",
+                    "The organization operation could not complete.",
+                ))
+            })
+        }
         method::SYSTEM_HELLO => encode_response(&state.hello),
         method::STATE_SNAPSHOT => state.projects.snapshot().and_then(|projects| {
             let agents = state.sessions.agents()?;
diff --git a/crates/daemon/tests/organization_ipc.rs b/crates/daemon/tests/organization_ipc.rs
new file mode 100644
index 0000000..e41363d
--- /dev/null
+++ b/crates/daemon/tests/organization_ipc.rs
@@ -0,0 +1,253 @@
+//! Real socket/SQLite acceptance for organization without process side effects.
+use std::{path::Path, process::Command, time::Duration};
+
+use cli_master_core::{RequestEnvelope, ResponseEnvelope, ResponsePayload};
+use cli_master_daemon::{Daemon, DaemonConfig, MAX_FRAME_LENGTH};
+use futures_util::{SinkExt, StreamExt};
+use serde_json::{Value, json};
+use tempfile::TempDir;
+use tokio::net::UnixStream;
+use tokio_util::{
+    codec::{Framed, LengthDelimitedCodec},
+    sync::CancellationToken,
+};
+
+type Client = Framed<UnixStream, LengthDelimitedCodec>;
+
+struct Running {
+    config: DaemonConfig,
+    cancellation: CancellationToken,
+    task: tokio::task::JoinHandle<Result<(), cli_master_daemon::DaemonError>>,
+}
+
+impl Running {
+    fn start(root: &Path) -> Self {
+        let config = DaemonConfig::from_paths(root.join("data"), root.join("run"));
+        let daemon = Daemon::bind(config.clone()).unwrap();
+        let cancellation = CancellationToken::new();
+        let token = cancellation.clone();
+        let task = tokio::spawn(async move { daemon.run(token).await });
+        Self {
+            config,
+            cancellation,
+            task,
+        }
+    }
+
+    async fn connect(&self) -> Client {
+        LengthDelimitedCodec::builder()
+            .max_frame_length(MAX_FRAME_LENGTH)
+            .new_framed(
+                UnixStream::connect(self.config.socket_path())
+                    .await
+                    .unwrap(),
+            )
+    }
+
+    async fn stop(self) {
+        self.cancellation.cancel();
+        tokio::time::timeout(Duration::from_secs(5), self.task)
+            .await
+            .unwrap()
+            .unwrap()
+            .unwrap();
+    }
+}
+
+async fn exchange(client: &mut Client, method: &str, payload: Value) -> ResponseEnvelope<Value> {
+    let request = RequestEnvelope::v1(method, payload);
+    client
+        .send(serde_json::to_vec(&request).unwrap().into())
+        .await
+        .unwrap();
+    let bytes = tokio::time::timeout(Duration::from_secs(5), client.next())
+        .await
+        .unwrap()
+        .unwrap()
+        .unwrap();
+    assert!(bytes.len() <= MAX_FRAME_LENGTH);
+    let response: ResponseEnvelope<Value> = serde_json::from_slice(&bytes).unwrap();
+    assert_eq!(response.request_id, request.request_id);
+    response
+}
+
+async fn success(client: &mut Client, method: &str, payload: Value) -> Value {
+    match exchange(client, method, payload).await.payload {
+        ResponsePayload::Success { data } => data,
+        ResponsePayload::Error { error } => panic!("{method}: {}", error.code),
+    }
+}
+
+fn error_code(response: ResponseEnvelope<Value>) -> String {
+    match response.payload {
+        ResponsePayload::Error { error } => error.code,
+        ResponsePayload::Success { .. } => panic!("expected request failure"),
+    }
+}
+
+async fn project(client: &mut Client, root: &Path, name: &str) -> Value {
+    let path = root.join(name);
+    std::fs::create_dir(&path).unwrap();
+    assert!(
+        Command::new("git")
+            .args(["init", "--initial-branch=main"])
+            .current_dir(&path)
+            .output()
+            .unwrap()
+            .status
+            .success()
+    );
+    success(client, "project.add", json!({"path":path, "name":name})).await["id"].clone()
+}
+
+async fn started_session(client: &mut Client, project_id: &Value) -> Value {
+    let agent = success(client, "agent.custom.create", json!({
+        "displayName":"Organization test child", "command":{"executable":"/bin/cat","args":[],"env":{}}
+    })).await;
+    let session = success(client, "session.create", json!({
+        "projectId":project_id,"agentId":agent["id"],"name":"Visible process","isolation":"current"
+    })).await;
+    success(client, "session.start", json!({"sessionId":session["id"]})).await;
+    tokio::time::timeout(Duration::from_secs(5), async {
+        loop {
+            let list = success(client, "session.list", json!({"projectId":project_id})).await;
+            let current = &list["sessions"][0];
+            if current["status"] == "running" {
+                return current.clone();
+            }
+            tokio::time::sleep(Duration::from_millis(10)).await;
+        }
+    })
+    .await
+    .unwrap()
+}
+
+#[tokio::test]
+async fn archive_and_workflow_preserve_the_live_process_and_survive_restart() {
+    let root = TempDir::new().unwrap();
+    let daemon = Running::start(root.path());
+    let mut client = daemon.connect().await;
+    let project_id = project(&mut client, root.path(), "organized").await;
+    let session = started_session(&mut client, &project_id).await;
+    let session_target = json!({"kind":"session","id":session["id"]});
+    let project_target = json!({"kind":"project","id":project_id});
+    let targets = json!([session_target, project_target]);
+    let defaults = success(&mut client, "organization.get", json!({"targets":targets})).await;
+    assert_eq!(defaults["entries"][0]["workflow"], "backlog");
+    assert_eq!(defaults["entries"][0]["target"], session_target);
+    assert_eq!(defaults["entries"][1]["target"], project_target);
+    assert_eq!(defaults["entries"][1]["revision"], 0);
+    assert!(defaults["entries"][1]["updatedAtMs"].is_null());
+    let pinned = success(&mut client, "organization.save", json!({
+        "target":project_target,"expectedRevision":0,"pinned":true,"archived":true,"workflow":null
+    })).await;
+    let mut saved = Value::Null;
+    for (revision, workflow) in ["in_progress", "in_review", "blocked", "done", "backlog"]
+        .iter()
+        .enumerate()
+    {
+        saved = success(&mut client, "organization.save", json!({
+            "target":session_target,"expectedRevision":revision,"pinned":true,"archived":true,"workflow":workflow
+        })).await;
+        assert_eq!(saved["revision"], revision + 1);
+        let live = success(&mut client, "session.list", json!({"projectId":project_id})).await;
+        assert_eq!(live["sessions"][0], session);
+    }
+    let mut second = daemon.connect().await;
+    assert_eq!(error_code(exchange(&mut second, "organization.save", json!({
+        "target":session_target,"expectedRevision":0,"pinned":false,"archived":false,"workflow":"done"
+    })).await), "organization_conflict");
+    let current = success(&mut second, "organization.get", json!({"targets":targets})).await;
+    assert_eq!(current["entries"], json!([saved, pinned]));
+    success(
+        &mut client,
+        "session.stop",
+        json!({"sessionId":session["id"]}),
+    )
+    .await;
+    drop(client);
+    drop(second);
+    daemon.stop().await;
+    let daemon = Running::start(root.path());
+    let mut client = daemon.connect().await;
+    assert_eq!(
+        success(&mut client, "organization.get", json!({"targets":targets})).await,
+        current
+    );
+    success(
+        &mut client,
+        "session.delete",
+        json!({"sessionId":session["id"]}),
+    )
+    .await;
+    assert_eq!(
+        error_code(
+            exchange(
+                &mut client,
+                "organization.get",
+                json!({"targets":[session_target]})
+            )
+            .await
+        ),
+        "session_not_found"
+    );
+    success(
+        &mut client,
+        "project.remove",
+        json!({"projectId":project_id}),
+    )
+    .await;
+    assert_eq!(
+        error_code(
+            exchange(
+                &mut client,
+                "organization.get",
+                json!({"targets":[project_target]})
+            )
+            .await
+        ),
+        "project_not_found"
+    );
+    assert!(root.path().join("organized/.git").is_dir());
+    daemon.stop().await;
+}
+
+#[tokio::test]
+async fn organization_rejects_process_fields_and_invalid_batches_without_echoing_values() {
+    let root = TempDir::new().unwrap();
+    let daemon = Running::start(root.path());
+    let mut client = daemon.connect().await;
+    let id = project(&mut client, root.path(), "validation").await;
+    let target = json!({"kind":"project","id":id});
+    for targets in [
+        json!([]),
+        json!([target, target]),
+        json!([{"kind":"path","id":"private-canary"}]),
+    ] {
+        let response = exchange(&mut client, "organization.get", json!({"targets":targets})).await;
+        assert!(
+            !serde_json::to_string(&response)
+                .unwrap()
+                .contains("private-canary")
+        );
+        assert_eq!(error_code(response), "invalid_payload");
+    }
+    for payload in [
+        json!({"target":target,"expectedRevision":0,"pinned":false,"archived":true,"workflow":"private-canary"}),
+        json!({"target":target,"expectedRevision":0,"pinned":false,"archived":true,"workflow":null,"status":"private-canary"}),
+        json!({"target":target,"expectedRevision":0,"pinned":false,"archived":true}),
+        json!({"target":target,"expectedRevision":-1,"pinned":false,"archived":true,"workflow":null}),
+    ] {
+        let response = exchange(&mut client, "organization.save", payload).await;
+        assert!(
+            !serde_json::to_string(&response)
+                .unwrap()
+                .contains("private-canary")
+        );
+        assert_eq!(error_code(response), "invalid_payload");
+    }
+    let empty = success(&mut client, "organization.get", json!({"targets":[target]})).await;
+    assert_eq!(empty["entries"][0]["revision"], 0);
+    assert_eq!(empty["entries"][0]["archived"], false);
+    daemon.stop().await;
+}
diff --git a/crates/storage/migrations/0005_organization.sql b/crates/storage/migrations/0005_organization.sql
new file mode 100644
index 0000000..99a9eb6
--- /dev/null
+++ b/crates/storage/migrations/0005_organization.sql
@@ -0,0 +1,25 @@
+-- User organization metadata never alters daemon-owned process state.
+CREATE TABLE project_organization (
+    project_id      TEXT PRIMARY KEY NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+    pinned          INTEGER NOT NULL CHECK (typeof(pinned) = 'integer' AND pinned IN (0, 1)),
+    archived        INTEGER NOT NULL CHECK (typeof(archived) = 'integer' AND archived IN (0, 1)),
+    revision        INTEGER NOT NULL CHECK (
+                        typeof(revision) = 'integer' AND revision BETWEEN 1 AND 9007199254740991
+                    ),
+    updated_at_ms   INTEGER NOT NULL CHECK (
+                        typeof(updated_at_ms) = 'integer' AND updated_at_ms BETWEEN 0 AND 9007199254740991
+                    )
+);
+
+CREATE TABLE session_organization (
+    session_id      TEXT PRIMARY KEY NOT NULL REFERENCES sessions(id) ON DELETE CASCADE,
+    pinned          INTEGER NOT NULL CHECK (typeof(pinned) = 'integer' AND pinned IN (0, 1)),
+    archived        INTEGER NOT NULL CHECK (typeof(archived) = 'integer' AND archived IN (0, 1)),
+    workflow        TEXT NOT NULL CHECK (workflow IN ('backlog', 'in_progress', 'in_review', 'blocked', 'done')),
+    revision        INTEGER NOT NULL CHECK (
+                        typeof(revision) = 'integer' AND revision BETWEEN 1 AND 9007199254740991
+                    ),
+    updated_at_ms   INTEGER NOT NULL CHECK (
+                        typeof(updated_at_ms) = 'integer' AND updated_at_ms BETWEEN 0 AND 9007199254740991
+                    )
+);
diff --git a/crates/storage/src/durability_tests.rs b/crates/storage/src/durability_tests.rs
index f29fc29..9fbfc4d 100644
--- a/crates/storage/src/durability_tests.rs
+++ b/crates/storage/src/durability_tests.rs
@@ -36,6 +36,7 @@ fn configured_file_database_uses_full_wal_and_verified_schema() {
             (2, "worktree_dirty_state"),
             (3, "recovery_metadata"),
             (4, "knowledge_documents"),
+            (5, "organization"),
         ]
     );
 
diff --git a/crates/storage/src/lib.rs b/crates/storage/src/lib.rs
index 63572a3..8281ca1 100644
--- a/crates/storage/src/lib.rs
+++ b/crates/storage/src/lib.rs
@@ -11,6 +11,7 @@ mod error;
 pub mod knowledge;
 mod migrate;
 mod models;
+pub mod organization;
 mod paths;
 mod projects;
 mod recovery;
@@ -34,10 +35,11 @@ pub use connection::Storage;
 pub use error::StorageError;
 pub use knowledge::KnowledgeStorageError;
 pub use models::{SessionRuntimeUpdate, StoredAgent, StoredSession, StoredWorktree, WorktreeState};
+pub use organization::OrganizationStorageError;
 pub use recovery::{ReconciliationEvent, ReconciliationReason, RecoveryContext};
 
 /// The newest schema version understood by this crate.
-pub const LATEST_SCHEMA_VERSION: u32 = 4;
+pub const LATEST_SCHEMA_VERSION: u32 = 5;
 
 impl Storage {
     /// Opens and configures a file-backed `SQLite` database.
diff --git a/crates/storage/src/migrate.rs b/crates/storage/src/migrate.rs
index ce4e2c1..427c3ce 100644
--- a/crates/storage/src/migrate.rs
+++ b/crates/storage/src/migrate.rs
@@ -39,9 +39,36 @@ const MIGRATIONS: &[Migration] = &[
         sql: include_str!("../migrations/0004_knowledge_documents.sql"),
         destructive: false,
     },
+    Migration {
+        version: 5,
+        name: "organization",
+        sql: include_str!("../migrations/0005_organization.sql"),
+        destructive: false,
+    },
 ];
 
 const REQUIRED_TABLES: &[(&str, &[&str])] = &[
+    (
+        "project_organization",
+        &[
+            "project_id",
+            "pinned",
+            "archived",
+            "revision",
+            "updated_at_ms",
+        ],
+    ),
+    (
+        "session_organization",
+        &[
+            "session_id",
+            "pinned",
+            "archived",
+            "workflow",
+            "revision",
+            "updated_at_ms",
+        ],
+    ),
     (
         "projects",
         &["id", "name", "path", "created_at", "last_opened_at"],
diff --git a/crates/storage/src/organization/mod.rs b/crates/storage/src/organization/mod.rs
new file mode 100644
index 0000000..c0ede76
--- /dev/null
+++ b/crates/storage/src/organization/mod.rs
@@ -0,0 +1,349 @@
+//! Revisioned organization metadata with snapshot reads and atomic writes.
+
+use std::{collections::BTreeMap, error::Error, fmt};
+
+use cli_master_core::{
+    ApiError,
+    organization::{
+        MAX_ORGANIZATION_REVISION, OrganizationEntry, OrganizationGetRequest,
+        OrganizationGetResponse, OrganizationSaveRequest, OrganizationTarget,
+        OrganizationValidationError, OrganizationWorkflow,
+    },
+};
+use rusqlite::{Connection, Row, TransactionBehavior, params, params_from_iter};
+
+use crate::{Storage, StorageError};
+
+/// Organization repository failure containing no process or user-text details.
+pub enum OrganizationStorageError {
+    /// Caller supplied a target/workflow or revision mismatch.
+    InvalidInput(OrganizationValidationError),
+    /// Clock value cannot be represented safely on the wire.
+    InvalidTimestamp,
+    /// A selected project is no longer registered.
+    ProjectNotFound,
+    /// A selected session no longer exists.
+    SessionNotFound,
+    /// The observed revision is stale.
+    Conflict,
+    /// An existing row cannot advance beyond the JavaScript-safe range.
+    RevisionExhausted,
+    /// Persisted organization metadata violates the typed contract.
+    CorruptData,
+    /// The metadata database could not complete the operation.
+    Storage(StorageError),
+}
+
+impl OrganizationStorageError {
+    /// Returns a stable IPC error without underlying SQL or parameters.
+    #[must_use]
+    pub fn to_api_error(&self) -> ApiError {
+        let (code, action) = match self {
+            Self::InvalidInput(_) | Self::InvalidTimestamp => (
+                "invalid_payload",
+                "Correct the organization values and retry",
+            ),
+            Self::ProjectNotFound => ("project_not_found", "Select a registered project"),
+            Self::SessionNotFound => ("session_not_found", "Select an existing session"),
+            Self::Conflict => (
+                "organization_conflict",
+                "Reload current organization values before saving again",
+            ),
+            Self::RevisionExhausted => (
+                "organization_revision_exhausted",
+                "The organization revision cannot be advanced",
+            ),
+            Self::CorruptData => (
+                "organization_corrupt_data",
+                "Restore a known-good database backup",
+            ),
+            Self::Storage(error) => return error.to_api_error(),
+        };
+        ApiError::new(code, self.to_string()).with_action(action)
+    }
+}
+
+impl fmt::Display for OrganizationStorageError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::InvalidInput(error) => error.fmt(formatter),
+            Self::InvalidTimestamp => {
+                formatter.write_str("Organization timestamp is outside the supported range")
+            }
+            Self::ProjectNotFound => formatter.write_str("The selected project no longer exists"),
+            Self::SessionNotFound => formatter.write_str("The selected session no longer exists"),
+            Self::Conflict => {
+                formatter.write_str("Organization values changed since they were loaded")
+            }
+            Self::RevisionExhausted => {
+                formatter.write_str("The organization revision cannot be advanced")
+            }
+            Self::CorruptData => {
+                formatter.write_str("Stored organization values violate the supported contract")
+            }
+            Self::Storage(error) => fmt::Display::fmt(error, formatter),
+        }
+    }
+}
+
+impl fmt::Debug for OrganizationStorageError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        fmt::Display::fmt(self, formatter)
+    }
+}
+
+impl Error for OrganizationStorageError {}
+
+impl From<StorageError> for OrganizationStorageError {
+    fn from(value: StorageError) -> Self {
+        Self::Storage(value)
+    }
+}
+
+impl From<rusqlite::Error> for OrganizationStorageError {
+    fn from(value: rusqlite::Error) -> Self {
+        Self::Storage(StorageError::Database(value))
+    }
+}
+
+impl From<OrganizationValidationError> for OrganizationStorageError {
+    fn from(value: OrganizationValidationError) -> Self {
+        Self::InvalidInput(value)
+    }
+}
+
+impl Storage {
+    /// Reads one consistent batch in request order without persisting defaults.
+    ///
+    /// At most two set-based queries read the requested project/session groups;
+    /// missing entities fail the complete batch. No process fields are modified.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error for missing entities, corrupt rows, or database failure.
+    pub fn get_organization(
+        &self,
+        request: &OrganizationGetRequest,
+    ) -> Result<OrganizationGetResponse, OrganizationStorageError> {
+        self.with_connection_mut("get organization", |connection| {
+            Ok(get_organization(connection, request))
+        })?
+    }
+
+    /// Replaces complete organization values with an atomic revision comparison.
+    ///
+    /// The first explicit save creates revision one. Clock rollback never
+    /// decreases an existing timestamp. Pin/archive/workflow changes have no
+    /// effect on session status, processes, worktrees, or saved knowledge.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error for invalid input, missing entities, stale/exhausted
+    /// revisions, corrupt rows, or database failure. Failures roll back fully.
+    pub fn save_organization(
+        &self,
+        request: &OrganizationSaveRequest,
+        now: i64,
+    ) -> Result<OrganizationEntry, OrganizationStorageError> {
+        request.validate()?;
+        if !(0..=9_007_199_254_740_991).contains(&now) {
+            return Err(OrganizationStorageError::InvalidTimestamp);
+        }
+        self.with_connection_mut("save organization", |connection| {
+            Ok(save_organization(connection, request, now))
+        })?
+    }
+}
+
+fn get_organization(
+    connection: &mut Connection,
+    request: &OrganizationGetRequest,
+) -> Result<OrganizationGetResponse, OrganizationStorageError> {
+    let transaction = connection.transaction()?;
+    let mut projects = Vec::new();
+    let mut sessions = Vec::new();
+    for target in request.targets.as_slice() {
+        match target {
+            OrganizationTarget::Project { id } => projects.push(id.to_string()),
+            OrganizationTarget::Session { id } => sessions.push(id.to_string()),
+        }
+    }
+    let mut found = read_group(&transaction, Group::Project, &projects)?;
+    found.extend(read_group(&transaction, Group::Session, &sessions)?);
+    let entries = request
+        .targets
+        .as_slice()
+        .iter()
+        .map(|target| found.remove(target).ok_or_else(|| missing(*target)))
+        .collect::<Result<Vec<_>, _>>()?;
+    transaction.commit()?;
+    Ok(OrganizationGetResponse { entries })
+}
+
+fn save_organization(
+    connection: &mut Connection,
+    request: &OrganizationSaveRequest,
+    now: i64,
+) -> Result<OrganizationEntry, OrganizationStorageError> {
+    let transaction = connection.transaction_with_behavior(TransactionBehavior::Immediate)?;
+    let (group, id) = match request.target {
+        OrganizationTarget::Project { id } => (Group::Project, id.to_string()),
+        OrganizationTarget::Session { id } => (Group::Session, id.to_string()),
+    };
+    let current = read_group(&transaction, group, std::slice::from_ref(&id))?
+        .remove(&request.target)
+        .ok_or_else(|| missing(request.target))?;
+    if current.revision != request.expected_revision {
+        return Err(OrganizationStorageError::Conflict);
+    }
+    if current.revision == MAX_ORGANIZATION_REVISION {
+        return Err(OrganizationStorageError::RevisionExhausted);
+    }
+    let entry = OrganizationEntry {
+        target: request.target,
+        pinned: request.pinned,
+        archived: request.archived,
+        workflow: request.workflow,
+        revision: current.revision + 1,
+        updated_at_ms: Some(
+            current
+                .updated_at_ms
+                .map_or(now, |updated| now.max(updated)),
+        ),
+    };
+    entry.validate()?;
+    let revision =
+        i64::try_from(entry.revision).map_err(|_| OrganizationStorageError::RevisionExhausted)?;
+    let previous =
+        i64::try_from(current.revision).map_err(|_| OrganizationStorageError::RevisionExhausted)?;
+    let changed = match (group, current.revision == 0) {
+        (Group::Project, true) => transaction.execute(
+            "INSERT INTO project_organization (project_id, pinned, archived, revision, updated_at_ms) VALUES (?1, ?2, ?3, ?4, ?5)",
+            params![id, entry.pinned, entry.archived, revision, entry.updated_at_ms],
+        )?,
+        (Group::Project, false) => transaction.execute(
+            "UPDATE project_organization SET pinned = ?2, archived = ?3, revision = ?4, updated_at_ms = ?5 WHERE project_id = ?1 AND revision = ?6",
+            params![id, entry.pinned, entry.archived, revision, entry.updated_at_ms, previous],
+        )?,
+        (Group::Session, true) => transaction.execute(
+            "INSERT INTO session_organization (session_id, pinned, archived, workflow, revision, updated_at_ms) VALUES (?1, ?2, ?3, ?4, ?5, ?6)",
+            params![id, entry.pinned, entry.archived, entry.workflow.map(workflow_name), revision, entry.updated_at_ms],
+        )?,
+        (Group::Session, false) => transaction.execute(
+            "UPDATE session_organization SET pinned = ?2, archived = ?3, workflow = ?4, revision = ?5, updated_at_ms = ?6 WHERE session_id = ?1 AND revision = ?7",
+            params![id, entry.pinned, entry.archived, entry.workflow.map(workflow_name), revision, entry.updated_at_ms, previous],
+        )?,
+    };
+    if changed != 1 {
+        return Err(OrganizationStorageError::Conflict);
+    }
+    transaction.commit()?;
+    Ok(entry)
+}
+
+#[derive(Clone, Copy)]
+enum Group {
+    Project,
+    Session,
+}
+
+fn read_group(
+    connection: &Connection,
+    group: Group,
+    ids: &[String],
+) -> Result<BTreeMap<OrganizationTarget, OrganizationEntry>, OrganizationStorageError> {
+    let mut found = BTreeMap::new();
+    if ids.is_empty() {
+        return Ok(found);
+    }
+    // Only generated placeholder punctuation enters SQL; every ID is bound.
+    let placeholders = std::iter::repeat_n("?", ids.len())
+        .collect::<Vec<_>>()
+        .join(",");
+    let sql = match group {
+        Group::Project => format!(
+            "SELECT p.id, COALESCE(o.pinned, 0), COALESCE(o.archived, 0), NULL, COALESCE(o.revision, 0), o.updated_at_ms
+             FROM projects p LEFT JOIN project_organization o ON o.project_id = p.id WHERE p.id IN ({placeholders})"
+        ),
+        Group::Session => format!(
+            "SELECT s.id, COALESCE(o.pinned, 0), COALESCE(o.archived, 0), COALESCE(o.workflow, 'backlog'), COALESCE(o.revision, 0), o.updated_at_ms
+             FROM sessions s LEFT JOIN session_organization o ON o.session_id = s.id WHERE s.id IN ({placeholders})"
+        ),
+    };
+    let mut statement = connection.prepare(&sql)?;
+    let mut rows = statement.query(params_from_iter(ids))?;
+    while let Some(row) = rows.next()? {
+        let entry = decode_entry(row, group)?;
+        found.insert(entry.target, entry);
+    }
+    Ok(found)
+}
+
+fn decode_entry(
+    row: &Row<'_>,
+    group: Group,
+) -> Result<OrganizationEntry, OrganizationStorageError> {
+    let id: String = row.get(0)?;
+    let target = match group {
+        Group::Project => OrganizationTarget::Project {
+            id: id
+                .parse()
+                .map_err(|_| OrganizationStorageError::CorruptData)?,
+        },
+        Group::Session => OrganizationTarget::Session {
+            id: id
+                .parse()
+                .map_err(|_| OrganizationStorageError::CorruptData)?,
+        },
+    };
+    let workflow: Option<String> = row.get(3)?;
+    let revision: i64 = row.get(4)?;
+    let entry = OrganizationEntry {
+        target,
+        pinned: decode_bool(row.get(1)?)?,
+        archived: decode_bool(row.get(2)?)?,
+        workflow: workflow.as_deref().map(decode_workflow).transpose()?,
+        revision: u64::try_from(revision).map_err(|_| OrganizationStorageError::CorruptData)?,
+        updated_at_ms: row.get(5)?,
+    };
+    entry
+        .validate()
+        .map_err(|_| OrganizationStorageError::CorruptData)?;
+    Ok(entry)
+}
+
+fn decode_bool(value: i64) -> Result<bool, OrganizationStorageError> {
+    match value {
+        0 => Ok(false),
+        1 => Ok(true),
+        _ => Err(OrganizationStorageError::CorruptData),
+    }
+}
+
+fn missing(target: OrganizationTarget) -> OrganizationStorageError {
+    match target {
+        OrganizationTarget::Project { .. } => OrganizationStorageError::ProjectNotFound,
+        OrganizationTarget::Session { .. } => OrganizationStorageError::SessionNotFound,
+    }
+}
+
+const fn workflow_name(workflow: OrganizationWorkflow) -> &'static str {
+    match workflow {
+        OrganizationWorkflow::Backlog => "backlog",
+        OrganizationWorkflow::InProgress => "in_progress",
+        OrganizationWorkflow::InReview => "in_review",
+        OrganizationWorkflow::Blocked => "blocked",
+        OrganizationWorkflow::Done => "done",
+    }
+}
+
+fn decode_workflow(value: &str) -> Result<OrganizationWorkflow, OrganizationStorageError> {
+    match value {
+        "backlog" => Ok(OrganizationWorkflow::Backlog),
+        "in_progress" => Ok(OrganizationWorkflow::InProgress),
+        "in_review" => Ok(OrganizationWorkflow::InReview),
+        "blocked" => Ok(OrganizationWorkflow::Blocked),
+        "done" => Ok(OrganizationWorkflow::Done),
+        _ => Err(OrganizationStorageError::CorruptData),
+    }
+}
diff --git a/crates/storage/tests/organization.rs b/crates/storage/tests/organization.rs
new file mode 100644
index 0000000..1d9702b
--- /dev/null
+++ b/crates/storage/tests/organization.rs
@@ -0,0 +1,492 @@
+mod common;
+
+use std::{
+    fs,
+    sync::{Arc, Barrier},
+    thread,
+};
+
+use cli_master_core::{
+    AgentSource, Project, ProjectId, SessionStatus,
+    organization::{
+        MAX_ORGANIZATION_REVISION, OrganizationEntry, OrganizationGetRequest,
+        OrganizationSaveRequest, OrganizationTarget, OrganizationTargets, OrganizationWorkflow,
+    },
+};
+use cli_master_storage::{Storage, StoredSession, organization::OrganizationStorageError};
+use rusqlite::{Connection, TransactionBehavior, params};
+use tempfile::TempDir;
+
+const NOW: i64 = 1_788_600_000_000;
+
+struct Fixture {
+    root: TempDir,
+    storage: Storage,
+    project: Project,
+    session: StoredSession,
+}
+
+impl Fixture {
+    fn new() -> Self {
+        let root = TempDir::new().unwrap();
+        let storage = Storage::open_migrated(root.path().join("organization.db")).unwrap();
+        let project = common::project("Organization", root.path().join("project"));
+        fs::create_dir_all(&project.path).unwrap();
+        fs::write(project.path.join("keep.txt"), b"Repository content").unwrap();
+        storage.insert_project(&project).unwrap();
+        let agent = common::agent(AgentSource::BuiltIn, "Agent");
+        storage.insert_agent(&agent).unwrap();
+        let session = common::session(
+            project.id,
+            agent.id,
+            SessionStatus::Running,
+            Some("organization-daemon"),
+            Some(4_343),
+        );
+        storage.insert_session(&session).unwrap();
+        Self {
+            root,
+            storage,
+            project,
+            session,
+        }
+    }
+
+    fn project_target(&self) -> OrganizationTarget {
+        OrganizationTarget::Project {
+            id: self.project.id,
+        }
+    }
+    fn session_target(&self) -> OrganizationTarget {
+        OrganizationTarget::Session {
+            id: self.session.id,
+        }
+    }
+    fn connection(&self) -> Connection {
+        Connection::open(self.root.path().join("organization.db")).unwrap()
+    }
+}
+
+fn get(targets: Vec<OrganizationTarget>) -> OrganizationGetRequest {
+    OrganizationGetRequest {
+        targets: OrganizationTargets::try_new(targets).unwrap(),
+    }
+}
+
+fn save(entry: &OrganizationEntry, pinned: bool, archived: bool) -> OrganizationSaveRequest {
+    OrganizationSaveRequest {
+        target: entry.target,
+        expected_revision: entry.revision,
+        pinned,
+        archived,
+        workflow: entry.workflow,
+    }
+}
+
+fn count_rows(connection: &Connection) -> i64 {
+    connection.query_row("SELECT (SELECT COUNT(*) FROM project_organization) + (SELECT COUNT(*) FROM session_organization)", [], |row| row.get(0)).unwrap()
+}
+
+#[test]
+fn defaults_preserve_request_order_without_persisting_rows() {
+    let fixture = Fixture::new();
+    let targets = vec![fixture.session_target(), fixture.project_target()];
+    let expected = targets
+        .iter()
+        .copied()
+        .map(OrganizationEntry::defaults)
+        .collect::<Vec<_>>();
+    let raw = fixture.connection();
+    assert_eq!(count_rows(&raw), 0);
+    for _ in 0..3 {
+        assert_eq!(
+            fixture
+                .storage
+                .get_organization(&get(targets.clone()))
+                .unwrap()
+                .entries,
+            expected
+        );
+    }
+    assert_eq!(expected[0].workflow, Some(OrganizationWorkflow::Backlog));
+    assert_eq!(expected[1].workflow, None);
+    assert_eq!(count_rows(&raw), 0);
+}
+
+#[test]
+fn saves_survive_reopen_and_returning_to_defaults_retains_revision() {
+    let fixture = Fixture::new();
+    let project_default = OrganizationEntry::defaults(fixture.project_target());
+    let project = fixture
+        .storage
+        .save_organization(&save(&project_default, true, true), NOW)
+        .unwrap();
+    assert_eq!(project.revision, 1);
+    assert_eq!(project.updated_at_ms, Some(NOW));
+    let mut session_request = save(
+        &OrganizationEntry::defaults(fixture.session_target()),
+        false,
+        true,
+    );
+    session_request.workflow = Some(OrganizationWorkflow::InProgress);
+    let mut session = fixture
+        .storage
+        .save_organization(&session_request, NOW)
+        .unwrap();
+    for workflow in [
+        OrganizationWorkflow::InReview,
+        OrganizationWorkflow::Blocked,
+        OrganizationWorkflow::Done,
+    ] {
+        let mut request = save(&session, true, false);
+        request.workflow = Some(workflow);
+        session = fixture
+            .storage
+            .save_organization(&request, NOW + 1)
+            .unwrap();
+    }
+    let restored = fixture
+        .storage
+        .save_organization(&save(&project, false, false), NOW - 100)
+        .unwrap();
+    assert_eq!(restored.revision, 2);
+    assert_eq!(restored.updated_at_ms, Some(NOW));
+    assert_eq!(count_rows(&fixture.connection()), 2);
+    fixture.storage.close().unwrap();
+    let path = fixture.root.path().join("organization.db");
+    drop(fixture.storage);
+    let reopened = Storage::open_migrated(path).unwrap();
+    assert_eq!(
+        reopened
+            .get_organization(&get(vec![session.target, restored.target]))
+            .unwrap()
+            .entries,
+        vec![session, restored]
+    );
+}
+
+#[test]
+fn archiving_running_session_and_workflow_changes_preserve_native_metadata_and_files() {
+    let fixture = Fixture::new();
+    let original_project = fixture.storage.get_project(fixture.project.id).unwrap();
+    let original_session = fixture.storage.get_session(fixture.session.id).unwrap();
+    let mut request = save(
+        &OrganizationEntry::defaults(fixture.session_target()),
+        true,
+        true,
+    );
+    request.workflow = Some(OrganizationWorkflow::Done);
+    let entry = fixture.storage.save_organization(&request, NOW).unwrap();
+    assert!(entry.archived);
+    assert_eq!(
+        fixture.storage.get_project(fixture.project.id).unwrap(),
+        original_project
+    );
+    assert_eq!(
+        fixture.storage.get_session(fixture.session.id).unwrap(),
+        original_session
+    );
+    assert_eq!(
+        fs::read(fixture.project.path.join("keep.txt")).unwrap(),
+        b"Repository content"
+    );
+}
+
+fn compete(
+    path: &std::path::Path,
+    first: OrganizationSaveRequest,
+    second: OrganizationSaveRequest,
+) -> Vec<Result<OrganizationEntry, OrganizationStorageError>> {
+    let first_storage = Storage::open_migrated(path).unwrap();
+    let second_storage = Storage::open_migrated(path).unwrap();
+    let barrier = Arc::new(Barrier::new(3));
+    let handles = [(first_storage, first), (second_storage, second)]
+        .into_iter()
+        .map(|(storage, request)| {
+            let barrier = Arc::clone(&barrier);
+            thread::spawn(move || {
+                barrier.wait();
+                storage.save_organization(&request, NOW)
+            })
+        })
+        .collect::<Vec<_>>();
+    barrier.wait();
+    handles
+        .into_iter()
+        .map(|handle| handle.join().unwrap())
+        .collect()
+}
+
+#[test]
+fn independent_connections_resolve_first_insert_and_update_races_with_one_winner() {
+    let fixture = Fixture::new();
+    let path = fixture.root.path().join("organization.db");
+    let defaults = OrganizationEntry::defaults(fixture.project_target());
+    for baseline in [
+        defaults.clone(),
+        OrganizationEntry {
+            pinned: true,
+            revision: 1,
+            updated_at_ms: Some(NOW),
+            ..defaults
+        },
+    ] {
+        let outcomes = compete(
+            &path,
+            save(&baseline, true, false),
+            save(&baseline, false, true),
+        );
+        assert_eq!(outcomes.iter().filter(|outcome| outcome.is_ok()).count(), 1);
+        assert_eq!(
+            outcomes
+                .iter()
+                .filter(|outcome| matches!(outcome, Err(OrganizationStorageError::Conflict)))
+                .count(),
+            1
+        );
+        let winner = fixture
+            .storage
+            .get_organization(&get(vec![baseline.target]))
+            .unwrap()
+            .entries
+            .remove(0);
+        assert_eq!(winner.revision, baseline.revision + 1);
+        assert_ne!(winner.pinned, winner.archived);
+        let stale = fixture
+            .storage
+            .save_organization(&save(&baseline, false, false), NOW)
+            .unwrap_err();
+        assert_eq!(stale.to_api_error().code, "organization_conflict");
+        assert_eq!(
+            fixture
+                .storage
+                .get_organization(&get(vec![baseline.target]))
+                .unwrap()
+                .entries,
+            vec![winner]
+        );
+    }
+}
+
+#[test]
+fn mixed_batches_observe_one_snapshot_during_concurrent_atomic_updates() {
+    let fixture = Fixture::new();
+    for target in [fixture.project_target(), fixture.session_target()] {
+        fixture
+            .storage
+            .save_organization(
+                &save(&OrganizationEntry::defaults(target), false, false),
+                NOW,
+            )
+            .unwrap();
+    }
+    let path = fixture.root.path().join("organization.db");
+    let project_id = fixture.project.id.to_string();
+    let session_id = fixture.session.id.to_string();
+    let barrier = Arc::new(Barrier::new(2));
+    let writer_barrier = Arc::clone(&barrier);
+    let writer = thread::spawn(move || {
+        let mut connection = Connection::open(path).unwrap();
+        connection
+            .busy_timeout(std::time::Duration::from_secs(5))
+            .unwrap();
+        writer_barrier.wait();
+        for index in 0..80 {
+            let transaction = connection
+                .transaction_with_behavior(TransactionBehavior::Immediate)
+                .unwrap();
+            transaction.execute("UPDATE project_organization SET pinned = ?1, revision = revision + 1 WHERE project_id = ?2", params![index % 2, project_id]).unwrap();
+            thread::yield_now();
+            transaction.execute("UPDATE session_organization SET pinned = ?1, revision = revision + 1 WHERE session_id = ?2", params![index % 2, session_id]).unwrap();
+            transaction.commit().unwrap();
+        }
+    });
+    barrier.wait();
+    let request = get(vec![fixture.session_target(), fixture.project_target()]);
+    for _ in 0..100 {
+        let entries = fixture.storage.get_organization(&request).unwrap().entries;
+        assert_eq!(entries[0].revision, entries[1].revision);
+        assert_eq!(entries[0].pinned, entries[1].pinned);
+    }
+    writer.join().unwrap();
+}
+
+#[test]
+fn unknown_entities_abort_whole_batches_and_failed_saves_create_nothing() {
+    let fixture = Fixture::new();
+    for target in [
+        OrganizationTarget::Project {
+            id: ProjectId::new(),
+        },
+        OrganizationTarget::Session {
+            id: cli_master_core::SessionId::new(),
+        },
+    ] {
+        let expected = match target {
+            OrganizationTarget::Project { .. } => "project_not_found",
+            OrganizationTarget::Session { .. } => "session_not_found",
+        };
+        let error = fixture
+            .storage
+            .get_organization(&get(vec![
+                fixture.project_target(),
+                target,
+                fixture.session_target(),
+            ]))
+            .unwrap_err();
+        assert_eq!(error.to_api_error().code, expected);
+        let error = fixture
+            .storage
+            .save_organization(&save(&OrganizationEntry::defaults(target), true, true), NOW)
+            .unwrap_err();
+        assert_eq!(error.to_api_error().code, expected);
+    }
+    assert_eq!(count_rows(&fixture.connection()), 0);
+}
+
+#[test]
+fn foreign_keys_remove_only_organization_rows_when_native_metadata_is_removed() {
+    let fixture = Fixture::new();
+    for target in [fixture.project_target(), fixture.session_target()] {
+        fixture
+            .storage
+            .save_organization(&save(&OrganizationEntry::defaults(target), true, true), NOW)
+            .unwrap();
+    }
+    fixture
+        .storage
+        .remove_session_metadata(fixture.session.id)
+        .unwrap();
+    assert_eq!(count_rows(&fixture.connection()), 1);
+    fixture
+        .storage
+        .remove_project_metadata(fixture.project.id)
+        .unwrap();
+    assert_eq!(count_rows(&fixture.connection()), 0);
+    assert_eq!(
+        fs::read(fixture.project.path.join("keep.txt")).unwrap(),
+        b"Repository content"
+    );
+}
+
+#[test]
+fn validation_constraints_and_revision_exhaustion_preserve_previous_values() {
+    let fixture = Fixture::new();
+    let defaults = OrganizationEntry::defaults(fixture.project_target());
+    let mut invalid = save(&defaults, true, false);
+    invalid.workflow = Some(OrganizationWorkflow::Done);
+    assert!(fixture.storage.save_organization(&invalid, NOW).is_err());
+    invalid.workflow = None;
+    for now in [-1, 9_007_199_254_740_992] {
+        assert!(fixture.storage.save_organization(&invalid, now).is_err());
+    }
+    let saved = fixture.storage.save_organization(&invalid, NOW).unwrap();
+    let raw = fixture.connection();
+    for sql in [
+        "UPDATE project_organization SET pinned = 2",
+        "UPDATE project_organization SET archived = 'false'",
+        "UPDATE project_organization SET revision = 0",
+        "UPDATE project_organization SET revision = 9007199254740992",
+        "UPDATE project_organization SET updated_at_ms = -1",
+    ] {
+        assert!(raw.execute(sql, []).is_err());
+    }
+    assert_eq!(
+        fixture
+            .storage
+            .get_organization(&get(vec![saved.target]))
+            .unwrap()
+            .entries,
+        vec![saved.clone()]
+    );
+    raw.execute(
+        "UPDATE project_organization SET revision = ?1",
+        [i64::try_from(MAX_ORGANIZATION_REVISION).unwrap()],
+    )
+    .unwrap();
+    let exhausted = OrganizationEntry {
+        revision: MAX_ORGANIZATION_REVISION,
+        ..saved
+    };
+    assert!(matches!(
+        fixture
+            .storage
+            .save_organization(&save(&exhausted, false, false), NOW + 1),
+        Err(OrganizationStorageError::RevisionExhausted)
+    ));
+    assert_eq!(
+        fixture
+            .storage
+            .get_organization(&get(vec![exhausted.target]))
+            .unwrap()
+            .entries,
+        vec![exhausted]
+    );
+}
+
+#[test]
+fn corrupt_workflow_is_rejected_without_exposing_persisted_values() {
+    let fixture = Fixture::new();
+    fixture
+        .storage
+        .save_organization(
+            &save(
+                &OrganizationEntry::defaults(fixture.session_target()),
+                false,
+                false,
+            ),
+            NOW,
+        )
+        .unwrap();
+    let raw = fixture.connection();
+    raw.execute_batch("PRAGMA ignore_check_constraints = ON")
+        .unwrap();
+    raw.execute(
+        "UPDATE session_organization SET workflow = ?1",
+        ["PRIVATE_CORRUPT_SENTINEL"],
+    )
+    .unwrap();
+    let error = fixture
+        .storage
+        .get_organization(&get(vec![
+            fixture.project_target(),
+            fixture.session_target(),
+        ]))
+        .unwrap_err();
+    assert!(matches!(error, OrganizationStorageError::CorruptData));
+    assert!(
+        !format!("{error:?} {}", error.to_api_error().message).contains("PRIVATE_CORRUPT_SENTINEL")
+    );
+}
+
+#[test]
+fn database_constraints_protect_typed_parents_and_session_workflow() {
+    let fixture = Fixture::new();
+    let raw = fixture.connection();
+    raw.pragma_update(None, "foreign_keys", true).unwrap();
+    let invalid_workflow = raw.execute(
+        "INSERT INTO session_organization (session_id,pinned,archived,workflow,revision,updated_at_ms) VALUES (?1,0,0,'running',1,0)",
+        [fixture.session.id.to_string()],
+    ).unwrap_err();
+    assert_eq!(
+        invalid_workflow.sqlite_error().unwrap().extended_code,
+        rusqlite::ffi::SQLITE_CONSTRAINT_CHECK
+    );
+    let wrong_parent = raw.execute(
+        "INSERT INTO project_organization (project_id,pinned,archived,revision,updated_at_ms) VALUES (?1,0,0,1,0)",
+        [fixture.session.id.to_string()],
+    ).unwrap_err();
+    assert_eq!(
+        wrong_parent.sqlite_error().unwrap().extended_code,
+        rusqlite::ffi::SQLITE_CONSTRAINT_FOREIGNKEY
+    );
+    let wrong_parent = raw.execute(
+        "INSERT INTO session_organization (session_id,pinned,archived,workflow,revision,updated_at_ms) VALUES (?1,0,0,'backlog',1,0)",
+        [fixture.project.id.to_string()],
+    ).unwrap_err();
+    assert_eq!(
+        wrong_parent.sqlite_error().unwrap().extended_code,
+        rusqlite::ffi::SQLITE_CONSTRAINT_FOREIGNKEY
+    );
+    assert_eq!(count_rows(&raw), 0);
+}
diff --git a/protocol/catalog.json b/protocol/catalog.json
index 5aa2882..72f88c2 100644
--- a/protocol/catalog.json
+++ b/protocol/catalog.json
@@ -34,7 +34,9 @@
     "knowledge.save",
     "knowledge.delete",
     "knowledge.discover",
-    "knowledge.read"
+    "knowledge.read",
+    "organization.get",
+    "organization.save"
   ],
   "events": [
     "project.updated",
diff --git a/protocol/fixtures/organization.json b/protocol/fixtures/organization.json
new file mode 100644
index 0000000..bd93eaa
--- /dev/null
+++ b/protocol/fixtures/organization.json
@@ -0,0 +1,51 @@
+{
+  "request": {
+    "targets": [
+      {
+        "kind": "session",
+        "id": "0198b6e0-0001-7000-8000-000000000001"
+      },
+      {
+        "kind": "project",
+        "id": "0198b6e0-0000-7000-8000-000000000001"
+      }
+    ]
+  },
+  "response": {
+    "entries": [
+      {
+        "target": {
+          "kind": "session",
+          "id": "0198b6e0-0001-7000-8000-000000000001"
+        },
+        "pinned": false,
+        "archived": false,
+        "workflow": "backlog",
+        "revision": 0,
+        "updatedAtMs": null
+      },
+      {
+        "target": {
+          "kind": "project",
+          "id": "0198b6e0-0000-7000-8000-000000000001"
+        },
+        "pinned": false,
+        "archived": false,
+        "workflow": null,
+        "revision": 0,
+        "updatedAtMs": null
+      }
+    ]
+  },
+  "saved": {
+    "target": {
+      "kind": "session",
+      "id": "0198b6e0-0001-7000-8000-000000000001"
+    },
+    "pinned": true,
+    "archived": true,
+    "workflow": "in_review",
+    "revision": 2,
+    "updatedAtMs": 1788657000000
+  }
+}

From 3feb82d39295ae60f3f60f42b77a8f7f5dffd8cd Mon Sep 17 00:00:00 2001
From: guicybercode <euguigom@gmail.com>
Date: Sat, 5 Sep 2026 22:47:58 -0300
Subject: [PATCH 21/23] feat(organization): add explicit pin archive and
 workflow controls

---
 .../organization/OrganizationPanel.test.tsx   | 193 ++++++++++++++++++
 .../organization/OrganizationPanel.tsx        | 115 +++++++++++
 .../src/app/features/organization/index.ts    |   2 +
 .../organization/organization-types.ts        |  26 +++
 .../features/organization/organization.css    |  28 +++
 .../features/organization/useOrganization.ts  | 148 ++++++++++++++
 docs/adr/0005-local-knowledge.md              |   6 +-
 .../artifacts/xirp/organization-desktop.png   | Bin 0 -> 57790 bytes
 .../artifacts/xirp/organization-narrow.png    | Bin 0 -> 47622 bytes
 docs/codex/xirp-context-report.md             |  40 ++++
 docs/codex/xirp-coordination-reply.md         |  19 ++
 docs/codex/xirp-native-capability-evidence.md |  62 ++++++
 docs/xirp-local-parity.md                     |   4 +-
 13 files changed, 639 insertions(+), 4 deletions(-)
 create mode 100644 apps/desktop/src/app/features/organization/OrganizationPanel.test.tsx
 create mode 100644 apps/desktop/src/app/features/organization/OrganizationPanel.tsx
 create mode 100644 apps/desktop/src/app/features/organization/index.ts
 create mode 100644 apps/desktop/src/app/features/organization/organization-types.ts
 create mode 100644 apps/desktop/src/app/features/organization/organization.css
 create mode 100644 apps/desktop/src/app/features/organization/useOrganization.ts
 create mode 100644 docs/codex/artifacts/xirp/organization-desktop.png
 create mode 100644 docs/codex/artifacts/xirp/organization-narrow.png
 create mode 100644 docs/codex/xirp-native-capability-evidence.md

diff --git a/apps/desktop/src/app/features/organization/OrganizationPanel.test.tsx b/apps/desktop/src/app/features/organization/OrganizationPanel.test.tsx
new file mode 100644
index 0000000..6818ce2
--- /dev/null
+++ b/apps/desktop/src/app/features/organization/OrganizationPanel.test.tsx
@@ -0,0 +1,193 @@
+import { act, render, screen, waitFor, within } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { describe, expect, it, vi } from "vitest";
+
+import { IpcError } from "../../../ipc/client";
+import type { OrganizationEntry, OrganizationGetResponse, OrganizationTarget } from "../../../ipc/domain";
+import { organizationTargetKey } from "../../../ipc/organization-schema";
+import type { Session } from "../../../ipc/types";
+import { createMockIpcClient } from "../../../test/mockIpc";
+import { OrganizationPanel } from "./OrganizationPanel";
+
+const project = { id: "project-a", name: "Project A" };
+const session: Pick<Session, "id" | "name" | "status"> = { id: "session-a", name: "Session A", status: "running" };
+
+function defaults(target: OrganizationTarget): OrganizationEntry {
+  return { target, pinned: false, archived: false, workflow: target.kind === "project" ? null : "backlog", revision: 0, updatedAtMs: null };
+}
+
+/** Mirrors compare-and-save metadata semantics without any process operations. */
+function organizationClient() {
+  const entries = new Map<string, OrganizationEntry>();
+  const client = createMockIpcClient({ handlers: {
+    getOrganization: async ({ targets }) => ({ entries: targets.map((target) => entries.get(organizationTargetKey(target)) ?? defaults(target)) }),
+    saveOrganization: async (input) => {
+      const key = organizationTargetKey(input.target);
+      const current = entries.get(key) ?? defaults(input.target);
+      if (input.expectedRevision !== current.revision) throw new IpcError({ code: "organization_conflict", message: "Organization changed in another window." });
+      const saved = { target: input.target, pinned: input.pinned, archived: input.archived, workflow: input.workflow, revision: current.revision + 1, updatedAtMs: 100 };
+      entries.set(key, saved);
+      return saved;
+    },
+  } });
+  return { client, entries };
+}
+
+function deferred<T>() {
+  let settle: (value: T) => void = () => { throw new Error("Promise not initialized"); };
+  const promise = new Promise<T>((resolve) => { settle = resolve; });
+  return { promise, resolve: settle };
+}
+
+describe("OrganizationPanel", () => {
+  it("skips empty selection and batches existing project/session defaults without writes", async () => {
+    const { client } = organizationClient();
+    const view = render(<OrganizationPanel client={client} />);
+    expect(screen.getByText("Select a project or session to organize it.")).toBeVisible();
+    expect(client.getOrganization).not.toHaveBeenCalled();
+    view.rerender(<OrganizationPanel client={client} currentProject={project} currentSession={session} />);
+    await waitFor(() => expect(screen.getAllByRole("checkbox", { name: "Pinned" })[0]).toBeEnabled());
+    expect(client.getOrganization).toHaveBeenCalledWith({ targets: [{ kind: "project", id: project.id }, { kind: "session", id: session.id }] });
+    expect(screen.getByRole("combobox", { name: "Workflow" })).toHaveValue("backlog");
+    expect(client.saveOrganization).not.toHaveBeenCalled();
+  });
+
+  it("explicitly saves an archived active session and workflow while showing its unchanged process status", async () => {
+    const user = userEvent.setup();
+    const { client } = organizationClient();
+    const onChanged = vi.fn();
+    render(<OrganizationPanel client={client} currentSession={session} onChanged={onChanged} />);
+    await waitFor(() => expect(screen.getByRole("checkbox", { name: "Archived" })).toBeEnabled());
+    await user.click(screen.getByRole("checkbox", { name: "Pinned" }));
+    await user.click(screen.getByRole("checkbox", { name: "Archived" }));
+    await user.selectOptions(screen.getByRole("combobox", { name: "Workflow" }), "done");
+    expect(screen.getByText(/this session continues running/)).toBeVisible();
+    expect(screen.getByLabelText("Session status: Running")).toBeVisible();
+    expect(client.saveOrganization).not.toHaveBeenCalled();
+    await user.click(screen.getByRole("button", { name: "Save organization" }));
+    expect(await screen.findByText("Organization saved locally.")).toBeVisible();
+    expect(client.saveOrganization).toHaveBeenCalledWith({ target: { kind: "session", id: session.id }, expectedRevision: 0, pinned: true, archived: true, workflow: "done" });
+    expect(onChanged).toHaveBeenCalledWith(expect.objectContaining({ revision: 1, workflow: "done", archived: true }));
+    expect(screen.getByLabelText("Session status: Running")).toBeVisible();
+    expect(client.stopSession).not.toHaveBeenCalled();
+    expect(client.startSession).not.toHaveBeenCalled();
+    expect(client.writeTerminal).not.toHaveBeenCalled();
+  });
+
+  it("saves project flags with null workflow and preserves unsaved choices across project selection", async () => {
+    const user = userEvent.setup();
+    const { client } = organizationClient();
+    const view = render(<OrganizationPanel client={client} currentProject={project} />);
+    await waitFor(() => expect(screen.getByRole("checkbox", { name: "Pinned" })).toBeEnabled());
+    await user.click(screen.getByRole("checkbox", { name: "Pinned" }));
+    view.rerender(<OrganizationPanel client={client} currentProject={{ id: "project-b", name: "Project B" }} />);
+    await waitFor(() => expect(screen.getByRole("checkbox", { name: "Pinned" })).toBeEnabled());
+    expect(screen.getByRole("checkbox", { name: "Pinned" })).not.toBeChecked();
+    view.rerender(<OrganizationPanel client={client} currentProject={project} />);
+    await waitFor(() => expect(screen.getByRole("checkbox", { name: "Pinned" })).toBeEnabled());
+    expect(screen.getByRole("checkbox", { name: "Pinned" })).toBeChecked();
+    expect(screen.queryByRole("combobox")).not.toBeInTheDocument();
+    await user.click(screen.getByRole("button", { name: "Save organization" }));
+    expect(client.saveOrganization).toHaveBeenCalledWith({ target: { kind: "project", id: project.id }, expectedRevision: 0, pinned: true, archived: false, workflow: null });
+  });
+
+  it("preserves workflow drafts across sessions and discards only the selected entity's choices", async () => {
+    const user = userEvent.setup();
+    const { client } = organizationClient();
+    const view = render(<OrganizationPanel client={client} currentSession={session} />);
+    await waitFor(() => expect(screen.getByRole("combobox")).toBeEnabled());
+    await user.selectOptions(screen.getByRole("combobox"), "in_review");
+    view.rerender(<OrganizationPanel client={client} currentSession={{ ...session, id: "session-b", name: "Session B" }} />);
+    await waitFor(() => expect(screen.getByRole("combobox")).toBeEnabled());
+    await user.click(screen.getByRole("checkbox", { name: "Archived" }));
+    view.rerender(<OrganizationPanel client={client} currentSession={session} />);
+    await waitFor(() => expect(screen.getByRole("combobox")).toBeEnabled());
+    expect(screen.getByRole("combobox")).toHaveValue("in_review");
+    await user.click(screen.getByRole("button", { name: "Discard changes" }));
+    expect(screen.getByRole("combobox")).toHaveValue("backlog");
+    expect(client.saveOrganization).not.toHaveBeenCalled();
+  });
+
+  it("retains conflicting desired flags and requires explicit revision refresh before retrying", async () => {
+    const user = userEvent.setup();
+    const { client, entries } = organizationClient();
+    const target: OrganizationTarget = { kind: "session", id: session.id };
+    render(<OrganizationPanel client={client} currentSession={session} />);
+    await waitFor(() => expect(screen.getByRole("checkbox", { name: "Pinned" })).toBeEnabled());
+    await user.click(screen.getByRole("checkbox", { name: "Pinned" }));
+    await user.selectOptions(screen.getByRole("combobox"), "blocked");
+    entries.set(organizationTargetKey(target), { ...defaults(target), archived: true, revision: 1, updatedAtMs: 100 });
+    await user.click(screen.getByRole("button", { name: "Save organization" }));
+    expect(await screen.findByRole("alert")).toHaveTextContent("Your choices are preserved");
+    expect(screen.getByRole("checkbox", { name: "Pinned" })).toBeChecked();
+    expect(screen.getByRole("checkbox", { name: "Archived" })).not.toBeChecked();
+    expect(screen.getByRole("combobox")).toHaveValue("blocked");
+    expect(screen.getByRole("button", { name: "Save organization" })).toBeDisabled();
+    await user.click(screen.getByRole("button", { name: "Refresh revision" }));
+    expect(await screen.findByText(/Latest revision loaded/)).toBeVisible();
+    expect(screen.getByText("Pinned: No. Archived: Yes. Workflow: Backlog.")).toBeVisible();
+    await waitFor(() => expect(screen.getByRole("button", { name: "Save organization" })).toBeEnabled());
+    await user.click(screen.getByRole("button", { name: "Save organization" }));
+    expect(client.saveOrganization).toHaveBeenLastCalledWith({ target, expectedRevision: 1, pinned: true, archived: false, workflow: "blocked" });
+    expect(await screen.findByText("Organization saved locally.")).toBeVisible();
+  });
+
+  it("ignores old batch responses when project selection or connection changes", async () => {
+    const first = deferred<OrganizationGetResponse>();
+    const second = deferred<OrganizationGetResponse>();
+    const { client } = organizationClient();
+    client.getOrganization.mockReturnValueOnce(first.promise).mockReturnValueOnce(second.promise);
+    const view = render(<OrganizationPanel client={client} currentProject={project} connectionKey={1} />);
+    await waitFor(() => expect(client.getOrganization).toHaveBeenCalledTimes(1));
+    view.rerender(<OrganizationPanel client={client} currentProject={{ id: "project-b", name: "Project B" }} connectionKey={1} />);
+    await waitFor(() => expect(client.getOrganization).toHaveBeenCalledTimes(2));
+    view.rerender(<OrganizationPanel client={client} currentProject={{ id: "project-b", name: "Project B" }} connectionKey={2} />);
+    await waitFor(() => expect(screen.getByRole("checkbox", { name: "Pinned" })).toBeEnabled());
+    await act(async () => {
+      first.resolve({ entries: [{ ...defaults({ kind: "project", id: project.id }), pinned: true, revision: 1, updatedAtMs: 100 }] });
+      second.resolve({ entries: [{ ...defaults({ kind: "project", id: "project-b" }), pinned: true, revision: 1, updatedAtMs: 100 }] });
+    });
+    expect(screen.getByRole("checkbox", { name: "Pinned" })).not.toBeChecked();
+  });
+
+  it("ignores a stale save response after reconnect and preserves the desired flags for revalidation", async () => {
+    const user = userEvent.setup();
+    const pendingSave = deferred<OrganizationEntry>();
+    const { client } = organizationClient();
+    const onChanged = vi.fn();
+    client.saveOrganization.mockReturnValueOnce(pendingSave.promise);
+    const view = render(<OrganizationPanel client={client} currentProject={project} connectionKey={1} onChanged={onChanged} />);
+    await waitFor(() => expect(screen.getByRole("checkbox", { name: "Pinned" })).toBeEnabled());
+    await user.click(screen.getByRole("checkbox", { name: "Pinned" }));
+    await user.click(screen.getByRole("button", { name: "Save organization" }));
+    view.rerender(<OrganizationPanel client={client} currentProject={project} connectionKey={2} onChanged={onChanged} />);
+    await waitFor(() => expect(screen.getByRole("checkbox", { name: "Pinned" })).toBeEnabled());
+    await act(async () => pendingSave.resolve({ ...defaults({ kind: "project", id: project.id }), pinned: true, revision: 1, updatedAtMs: 100 }));
+    expect(screen.getByRole("checkbox", { name: "Pinned" })).toBeChecked();
+    expect(screen.queryByText("Organization saved locally.")).not.toBeInTheDocument();
+    expect(onChanged).not.toHaveBeenCalled();
+  });
+
+  it("rejects a batch for another target and leaves controls unavailable", async () => {
+    const { client } = organizationClient();
+    client.getOrganization.mockResolvedValue({ entries: [defaults({ kind: "project", id: "another-project" })] });
+    render(<OrganizationPanel client={client} currentProject={project} />);
+    expect(await screen.findByRole("alert")).toHaveTextContent("invalid response");
+    expect(screen.getByRole("checkbox", { name: "Pinned" })).toBeDisabled();
+  });
+
+  it("prevents duplicate saves while a request is pending", async () => {
+    const user = userEvent.setup();
+    const pendingSave = deferred<OrganizationEntry>();
+    const { client } = organizationClient();
+    client.saveOrganization.mockReturnValueOnce(pendingSave.promise);
+    render(<OrganizationPanel client={client} currentProject={project} />);
+    const card = screen.getByRole("form", { name: project.name });
+    await waitFor(() => expect(within(card).getByRole("checkbox", { name: "Pinned" })).toBeEnabled());
+    await user.click(within(card).getByRole("checkbox", { name: "Pinned" }));
+    await user.dblClick(within(card).getByRole("button", { name: "Save organization" }));
+    expect(client.saveOrganization).toHaveBeenCalledOnce();
+    expect(within(card).getByRole("checkbox", { name: "Pinned" })).toBeDisabled();
+    await act(async () => pendingSave.resolve({ ...defaults({ kind: "project", id: project.id }), pinned: true, revision: 1, updatedAtMs: 100 }));
+  });
+});
diff --git a/apps/desktop/src/app/features/organization/OrganizationPanel.tsx b/apps/desktop/src/app/features/organization/OrganizationPanel.tsx
new file mode 100644
index 0000000..ca98b04
--- /dev/null
+++ b/apps/desktop/src/app/features/organization/OrganizationPanel.tsx
@@ -0,0 +1,115 @@
+import { useId, type FormEvent } from "react";
+
+import type { OrganizationTarget, OrganizationWorkflow } from "../../../ipc/domain";
+import { isOrganizationWorkflow, organizationTargetKey } from "../../../ipc/organization-schema";
+import type { SessionStatus } from "../../../ipc/types";
+import { StatusBadge, getSessionStatusLabel } from "../../components/StatusBadge";
+import { isLiveStatus } from "../../utils";
+import type { OrganizationDraft, OrganizationPanelProps } from "./organization-types";
+import { hasOrganizationChanges, useOrganization } from "./useOrganization";
+import "./organization.css";
+
+/** Explicit organization controls; the host retains canvas selection and runtime ownership. */
+export function OrganizationPanel(props: OrganizationPanelProps) {
+  const organization = useOrganization(props);
+  const id = useId();
+  const selected: { target: OrganizationTarget; name: string; status?: SessionStatus }[] = [];
+  if (props.currentProject) selected.push({ target: { kind: "project", id: props.currentProject.id }, name: props.currentProject.name });
+  if (props.currentSession) selected.push({ target: { kind: "session", id: props.currentSession.id }, name: props.currentSession.name, status: props.currentSession.status });
+
+  return (
+    <section className="organization-panel" aria-labelledby={`${id}-heading`}>
+      <header className="organization-panel__header">
+        <div><h2 id={`${id}-heading`}>Organization</h2><p>Pin, archive and track progress for the current selection.</p></div>
+        <button className="button button--secondary" type="button" disabled={!selected.length || organization.loading} onClick={organization.refresh}>Refresh organization</button>
+      </header>
+      {!selected.length ? <p className="organization-panel__empty">Select a project or session to organize it.</p> : null}
+      {organization.loading ? <p className="organization-panel__notice" role="status">Loading organization…</p> : null}
+      {organization.error ? <p className="organization-panel__error" role="alert">{organization.error}</p> : null}
+      <div className="organization-panel__cards">
+        {selected.map(({ target, name, status }) => {
+          const key = organizationTargetKey(target);
+          return <OrganizationCard
+            key={key}
+            target={target}
+            name={name}
+            status={status}
+            draft={organization.drafts[key]}
+            loading={organization.loading || Boolean(organization.error)}
+            operation={organization.operationFor(target)}
+            onUpdate={(patch) => organization.update(target, patch)}
+            onDiscard={() => organization.discard(target)}
+            onSave={() => void organization.change(target, "saving")}
+            onRefreshRevision={() => void organization.change(target, "refreshing")}
+          />;
+        })}
+      </div>
+    </section>
+  );
+}
+
+interface OrganizationCardProps {
+  readonly target: OrganizationTarget;
+  readonly name: string;
+  readonly status?: SessionStatus;
+  readonly draft?: OrganizationDraft;
+  readonly loading: boolean;
+  readonly operation?: "saving" | "refreshing";
+  readonly onUpdate: (patch: Partial<Pick<OrganizationDraft, "pinned" | "archived" | "workflow">>) => void;
+  readonly onDiscard: () => void;
+  readonly onSave: () => void;
+  readonly onRefreshRevision: () => void;
+}
+
+function OrganizationCard({ target, name, status, draft, loading, operation, onUpdate, onDiscard, onSave, onRefreshRevision }: OrganizationCardProps) {
+  const id = useId();
+  const disabled = loading || Boolean(operation) || !draft;
+  const dirty = draft ? hasOrganizationChanges(draft) : false;
+  const kindLabel = target.kind === "project" ? "Project" : "Session";
+
+  function submit(event: FormEvent<HTMLFormElement>) {
+    event.preventDefault();
+    if (!disabled && dirty && !draft?.needsRebase) onSave();
+  }
+
+  return (
+    <form className="organization-card" aria-labelledby={`${id}-heading`} onSubmit={submit}>
+      <header className="organization-card__header">
+        <div><p>{kindLabel}</p><h3 id={`${id}-heading`}>{name}</h3></div>
+        {dirty ? <span className="organization-card__hint">Unsaved changes</span> : null}
+      </header>
+      {status ? <p className="organization-card__process">Daemon process: <StatusBadge status={status} compact /></p> : null}
+      <fieldset disabled={disabled} className="organization-card__fields">
+        <legend>{kindLabel} organization</legend>
+        <label><input type="checkbox" checked={draft?.pinned ?? false} onChange={(event) => onUpdate({ pinned: event.currentTarget.checked })} />Pinned</label>
+        <label><input type="checkbox" checked={draft?.archived ?? false} onChange={(event) => onUpdate({ archived: event.currentTarget.checked })} />Archived</label>
+        {target.kind === "session" ? <label className="organization-card__workflow" htmlFor={`${id}-workflow`}>
+          <span>Workflow</span>
+          <select id={`${id}-workflow`} value={draft?.workflow ?? "backlog"} onChange={(event) => { if (isOrganizationWorkflow(event.currentTarget.value)) onUpdate({ workflow: event.currentTarget.value }); }}>
+            {workflows.map((workflow) => <option key={workflow} value={workflow}>{workflowLabels[workflow]}</option>)}
+          </select>
+        </label> : null}
+      </fieldset>
+      {target.kind === "session" ? <p className="organization-card__hint">Workflow tracks your work separately from the daemon process.</p> : null}
+      {(draft?.archived || draft?.original.archived) && status && isLiveStatus(status) ? <p className="organization-card__warning">The daemon reports {getSessionStatusLabel(status)}. Archiving changes organization only; this session continues running.</p> : null}
+      {(draft?.archived || draft?.original.archived) && status === "unknown" ? <p className="organization-card__warning">Process status is unknown. Archiving does not stop a session.</p> : null}
+      {draft?.error ? <div className="organization-panel__error" role="alert">
+        <p>{draft.error}</p>
+        {draft.needsRebase ? <p>Your choices are preserved. Refresh the revision, review the latest saved settings, and save again.</p> : null}
+      </div> : null}
+      {draft?.rebased ? <details className="organization-card__saved" open>
+        <summary>Latest saved settings</summary>
+        <p>Pinned: {draft.original.pinned ? "Yes" : "No"}. Archived: {draft.original.archived ? "Yes" : "No"}.{draft.original.workflow ? ` Workflow: ${workflowLabels[draft.original.workflow]}.` : ""}</p>
+      </details> : null}
+      <p className="organization-card__notice" role="status">{operation === "saving" ? "Saving organization…" : operation === "refreshing" ? "Refreshing the saved revision…" : draft?.notice ?? ""}</p>
+      <div className="organization-card__actions">
+        <button className="button button--primary" type="submit" disabled={disabled || !dirty || draft?.needsRebase}>{operation === "saving" ? "Saving…" : "Save organization"}</button>
+        <button className="button button--secondary" type="button" disabled={disabled} onClick={onRefreshRevision}>Refresh revision</button>
+        <button className="button button--quiet" type="button" disabled={disabled || !dirty} onClick={onDiscard}>Discard changes</button>
+      </div>
+    </form>
+  );
+}
+
+const workflows: readonly OrganizationWorkflow[] = ["backlog", "in_progress", "in_review", "blocked", "done"];
+const workflowLabels: Readonly<Record<OrganizationWorkflow, string>> = { backlog: "Backlog", in_progress: "In progress", in_review: "In review", blocked: "Blocked", done: "Done" };
diff --git a/apps/desktop/src/app/features/organization/index.ts b/apps/desktop/src/app/features/organization/index.ts
new file mode 100644
index 0000000..e8f4758
--- /dev/null
+++ b/apps/desktop/src/app/features/organization/index.ts
@@ -0,0 +1,2 @@
+export { OrganizationPanel } from "./OrganizationPanel";
+export type { OrganizationPanelProps } from "./organization-types";
diff --git a/apps/desktop/src/app/features/organization/organization-types.ts b/apps/desktop/src/app/features/organization/organization-types.ts
new file mode 100644
index 0000000..32436b6
--- /dev/null
+++ b/apps/desktop/src/app/features/organization/organization-types.ts
@@ -0,0 +1,26 @@
+import type { IpcClient } from "../../../ipc/client";
+import type { OrganizationEntry } from "../../../ipc/domain";
+import type { Project, Session } from "../../../ipc/types";
+
+/** Host-owned selection and runtime status remain separate from editable organization. */
+export interface OrganizationPanelProps {
+  readonly client: Pick<IpcClient, "getOrganization" | "saveOrganization">;
+  readonly currentProject?: Pick<Project, "id" | "name"> | null;
+  readonly currentSession?: Pick<Session, "id" | "name" | "status"> | null;
+  /** Change on reconnect when the host retains its IPC client object. */
+  readonly connectionKey?: string | number;
+  /** Notifies the host of a confirmed save so canvas sorting/filtering can refresh. */
+  readonly onChanged?: (entry: OrganizationEntry) => void;
+}
+
+/** Retains user choices and their original revision until an explicit refresh or save. */
+export interface OrganizationDraft {
+  readonly original: OrganizationEntry;
+  readonly pinned: boolean;
+  readonly archived: boolean;
+  readonly workflow: OrganizationEntry["workflow"];
+  readonly error?: string;
+  readonly notice?: string;
+  readonly needsRebase?: boolean;
+  readonly rebased?: boolean;
+}
diff --git a/apps/desktop/src/app/features/organization/organization.css b/apps/desktop/src/app/features/organization/organization.css
new file mode 100644
index 0000000..4ed6eed
--- /dev/null
+++ b/apps/desktop/src/app/features/organization/organization.css
@@ -0,0 +1,28 @@
+.organization-panel { min-width: 0; container-type: inline-size; color: var(--color-text); background: var(--color-surface); }
+.organization-panel h2, .organization-panel h3, .organization-panel p { margin: 0; }
+.organization-panel h2 { font-size: 1rem; }
+.organization-panel h3 { font-size: 0.875rem; overflow-wrap: anywhere; }
+.organization-panel__header, .organization-card__header { display: flex; flex-wrap: wrap; align-items: center; justify-content: space-between; gap: var(--space-3); }
+.organization-panel__header { padding: var(--space-4); border-bottom: 1px solid var(--color-border); }
+.organization-panel__header p, .organization-card__header p, .organization-card__hint { color: var(--color-text-muted); font-size: 0.75rem; }
+.organization-panel__header p { margin-top: var(--space-1); }
+.organization-panel__cards { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: var(--space-4); padding: var(--space-4); }
+.organization-panel__cards:has(> :only-child) { grid-template-columns: minmax(0, 1fr); }
+.organization-panel .organization-panel__empty, .organization-panel .organization-panel__notice { margin: var(--space-4); color: var(--color-text-muted); }
+.organization-card { display: flex; flex-direction: column; gap: var(--space-3); min-width: 0; padding: var(--space-4); border: 1px solid var(--color-border); border-radius: var(--radius); background: var(--color-surface-raised); }
+.organization-card__process { display: flex; flex-wrap: wrap; align-items: center; gap: var(--space-2); font-size: 0.8125rem; }
+.organization-card__fields { display: flex; flex-wrap: wrap; gap: var(--space-4); min-width: 0; margin: 0; padding: 0; border: 0; }
+.organization-card__fields legend { padding: 0; margin-bottom: var(--space-2); font-size: 0.8125rem; font-weight: 600; }
+.organization-card__fields label { display: flex; align-items: center; gap: var(--space-2); min-height: var(--control-height); font-size: 0.8125rem; }
+.organization-card__fields input { width: 1rem; height: 1rem; margin: 0; accent-color: var(--color-accent); }
+.organization-card__fields .organization-card__workflow { flex-basis: 100%; display: grid; gap: var(--space-1); }
+.organization-card__workflow select { min-width: 0; width: 100%; min-height: var(--control-height); border: 1px solid var(--color-border-strong); border-radius: var(--radius-small); padding: var(--space-2); color: var(--color-text); background: var(--color-surface); }
+.organization-card__warning, .organization-panel__error { padding: var(--space-3); border-left: 2px solid var(--color-warning); background: var(--color-warning-muted); color: var(--color-warning); font-size: 0.8125rem; overflow-wrap: anywhere; }
+.organization-panel__error { border-color: var(--color-danger); color: var(--color-danger); background: var(--color-danger-muted); }
+.organization-panel > .organization-panel__error { margin: var(--space-4); }
+.organization-card__notice { min-height: 1.25rem; font-size: 0.8125rem; color: var(--color-success); }
+.organization-card__saved { font-size: 0.8125rem; }
+.organization-card__saved summary { min-height: var(--control-height); cursor: pointer; font-weight: 600; }
+.organization-card__actions { display: flex; flex-wrap: wrap; gap: var(--space-2); margin-top: auto; }
+@container (max-width: 42rem) { .organization-panel__cards { grid-template-columns: minmax(0, 1fr); } }
+@container (max-width: 22rem) { .organization-card__actions .button { width: 100%; white-space: normal; } }
diff --git a/apps/desktop/src/app/features/organization/useOrganization.ts b/apps/desktop/src/app/features/organization/useOrganization.ts
new file mode 100644
index 0000000..c549bfd
--- /dev/null
+++ b/apps/desktop/src/app/features/organization/useOrganization.ts
@@ -0,0 +1,148 @@
+import { useEffect, useRef, useState } from "react";
+
+import type { OrganizationEntry, OrganizationTarget } from "../../../ipc/domain";
+import { organizationTargetKey } from "../../../ipc/organization-schema";
+import { IpcContractError } from "../../../ipc/schema";
+import { errorData } from "../../utils";
+import type { OrganizationDraft, OrganizationPanelProps } from "./organization-types";
+
+interface LoadState {
+  readonly client: OrganizationPanelProps["client"];
+  readonly connectionKey: OrganizationPanelProps["connectionKey"];
+  readonly selectionKey: string;
+  readonly refreshIndex: number;
+  readonly error?: string;
+}
+
+interface Operation {
+  readonly client: OrganizationPanelProps["client"];
+  readonly connectionKey: OrganizationPanelProps["connectionKey"];
+  readonly token: number;
+  readonly kind: "saving" | "refreshing";
+}
+
+/** Preserves each entity's desired flags while correlating asynchronous reads and writes. */
+export function useOrganization({ client, currentProject, currentSession, connectionKey, onChanged }: OrganizationPanelProps) {
+  const projectId = currentProject?.id;
+  const sessionId = currentSession?.id;
+  const selectionKey = `${projectId ?? ""}/${sessionId ?? ""}`;
+  const [drafts, setDrafts] = useState<Record<string, OrganizationDraft | undefined>>({});
+  const [load, setLoad] = useState<LoadState>();
+  const [refreshIndex, setRefreshIndex] = useState(0);
+  const [operations, setOperations] = useState<Record<string, Operation | undefined>>({});
+  const pending = useRef(new Map<string, Operation>());
+  const loadEpoch = useRef(0);
+  const connectionEpoch = useRef(0);
+  const writeEpoch = useRef(0);
+  const operationSequence = useRef(0);
+  const isCurrent = load?.client === client && load.connectionKey === connectionKey && load.selectionKey === selectionKey && load.refreshIndex === refreshIndex;
+  const hasTargets = Boolean(projectId || sessionId);
+
+  useEffect(() => {
+    connectionEpoch.current += 1;
+    return () => { connectionEpoch.current += 1; };
+  }, [client, connectionKey]);
+
+  useEffect(() => {
+    const epoch = ++loadEpoch.current;
+    const beforeWrites = writeEpoch.current;
+    const targets: OrganizationTarget[] = [];
+    if (projectId) targets.push({ kind: "project", id: projectId });
+    if (sessionId) targets.push({ kind: "session", id: sessionId });
+    async function read() {
+      if (!targets.length) return;
+      try {
+        const result = await client.getOrganization({ targets });
+        if (epoch !== loadEpoch.current || beforeWrites !== writeEpoch.current) return;
+        if (result.entries.length !== targets.length || result.entries.some((entry, index) => organizationTargetKey(entry.target) !== organizationTargetKey(targets[index]))) throw new IpcContractError("Organization response changed the selected targets");
+        setDrafts((previous) => {
+          const next = { ...previous };
+          for (const entry of result.entries) {
+            const key = organizationTargetKey(entry.target);
+            const existing = previous[key];
+            if (existing && (hasOrganizationChanges(existing) || existing.needsRebase)) continue;
+            next[key] = { ...fromEntry(entry), notice: existing?.original.revision === entry.revision ? existing.notice : undefined };
+          }
+          return next;
+        });
+        setLoad({ client, connectionKey, selectionKey, refreshIndex });
+      } catch (error) {
+        if (epoch === loadEpoch.current && beforeWrites === writeEpoch.current) setLoad({ client, connectionKey, selectionKey, refreshIndex, error: errorData(error).message });
+      }
+    }
+    void read();
+    return () => { loadEpoch.current += 1; };
+  }, [client, connectionKey, projectId, sessionId, selectionKey, refreshIndex]);
+
+  function update(target: OrganizationTarget, patch: Partial<Pick<OrganizationDraft, "pinned" | "archived" | "workflow">>) {
+    const key = organizationTargetKey(target);
+    setDrafts((previous) => {
+      const draft = previous[key];
+      return draft ? { ...previous, [key]: { ...draft, ...patch, notice: undefined } } : previous;
+    });
+  }
+
+  function discard(target: OrganizationTarget) {
+    const key = organizationTargetKey(target);
+    setDrafts((previous) => {
+      const draft = previous[key];
+      return draft ? { ...previous, [key]: fromEntry(draft.original) } : previous;
+    });
+  }
+
+  async function change(target: OrganizationTarget, kind: Operation["kind"]) {
+    const key = organizationTargetKey(target);
+    const draft = drafts[key];
+    const active = pending.current.get(key);
+    if (!draft || (active?.client === client && active.connectionKey === connectionKey)) return;
+    const operation = { client, connectionKey, kind, token: ++operationSequence.current };
+    const transportEpoch = connectionEpoch.current;
+    pending.current.set(key, operation);
+    setOperations((previous) => ({ ...previous, [key]: operation }));
+    setDrafts((previous) => ({ ...previous, [key]: { ...draft, error: undefined, notice: undefined } }));
+    try {
+      const updated = kind === "saving"
+        ? await client.saveOrganization({ target, expectedRevision: draft.original.revision, pinned: draft.pinned, archived: draft.archived, workflow: draft.workflow })
+        : (await client.getOrganization({ targets: [target] })).entries[0];
+      if (connectionEpoch.current !== transportEpoch || pending.current.get(key)?.token !== operation.token) return;
+      if (!updated || organizationTargetKey(updated.target) !== key) throw new IpcContractError("Organization operation returned another target");
+      writeEpoch.current += 1;
+      setDrafts((previous) => ({
+        ...previous,
+        [key]: kind === "saving"
+          ? { ...fromEntry(updated), notice: "Organization saved locally." }
+          : { ...(previous[key] ?? draft), original: updated, needsRebase: false, rebased: true, error: undefined, notice: "Latest revision loaded. Your choices are preserved; review them before saving." },
+      }));
+      setRefreshIndex((value) => value + 1);
+      if (kind === "saving") {
+        try { onChanged?.(updated); }
+        catch { setDrafts((previous) => ({ ...previous, [key]: { ...fromEntry(updated), error: "Organization was saved, but the workspace could not refresh. Refresh the workspace to see the change." } })); }
+      }
+    } catch (error) {
+      if (connectionEpoch.current !== transportEpoch || pending.current.get(key)?.token !== operation.token) return;
+      const detail = errorData(error);
+      setDrafts((previous) => ({ ...previous, [key]: { ...(previous[key] ?? draft), error: detail.message, needsRebase: detail.code === "organization_conflict" || draft.needsRebase } }));
+    } finally {
+      if (pending.current.get(key)?.token === operation.token) {
+        pending.current.delete(key);
+        setOperations((previous) => ({ ...previous, [key]: undefined }));
+      }
+    }
+  }
+
+  function operationFor(target: OrganizationTarget): Operation["kind"] | undefined {
+    const operation = operations[organizationTargetKey(target)];
+    return operation?.client === client && operation.connectionKey === connectionKey ? operation.kind : undefined;
+  }
+
+  return { drafts, loading: hasTargets && !isCurrent, error: isCurrent ? load.error : undefined, refresh: () => setRefreshIndex((value) => value + 1), update, discard, change, operationFor };
+}
+
+function fromEntry(entry: OrganizationEntry): OrganizationDraft {
+  return { original: entry, pinned: entry.pinned, archived: entry.archived, workflow: entry.workflow };
+}
+
+/** Computes unsaved choices without duplicating dirty state. */
+export function hasOrganizationChanges(draft: OrganizationDraft): boolean {
+  return draft.pinned !== draft.original.pinned || draft.archived !== draft.original.archived || draft.workflow !== draft.original.workflow;
+}
diff --git a/docs/adr/0005-local-knowledge.md b/docs/adr/0005-local-knowledge.md
index d6f2349..3f2b309 100644
--- a/docs/adr/0005-local-knowledge.md
+++ b/docs/adr/0005-local-knowledge.md
@@ -1,7 +1,9 @@
 # ADR 0005: Local prompts, reusable context, and organization
 
-Status: accepted for the first prompt/context increment after S2 agreement.
-Organization and filesystem details remain integration dependencies.
+Status: accepted for prompt/context, bounded source discovery and organization
+after S2 acknowledgments. Generic source editing and runtime delivery remain
+integration dependencies. Organization uses migration 0005 and separate
+organization.get/save contracts; see the approved coordination documents.
 
 ## Context
 
diff --git a/docs/codex/artifacts/xirp/organization-desktop.png b/docs/codex/artifacts/xirp/organization-desktop.png
new file mode 100644
index 0000000000000000000000000000000000000000..89c916d64f72d125dc349b7a2d0ce4313c8f559f
GIT binary patch
literal 57790
zcmdSBWl&tv_a#b%kdOcg8X!OtLU0J~?%g!*8r<DIfdB!5H|}o1-9rfO?(S}l+nnS#
z|CyTkG*z$Ot9kj5y4CmG%k6v4*?aA^*6siqDKRuu0#qa<Bs2+eVL2qE$C5}$kC>l6
z1fS4Vz8ye9dWj?<ETG_=xI2fef~`)7a+p?MPblz<j{l{C`R@MyzGb7MlN0%*Zz07K
z2*upnIiiJnuDTfLv(AmipZ5#p82!mScI&;noNn_jMuxs4Bl7s**5IG#yWamC9KL$Y
z@$cxD^2^o#e55T9_UPY{JF)=!zk@@Z|9=cxI(eH@QbIw?LrPDdLhS47`{M88|4M<#
z$jAr_#}bz@$~}De@WuV|##?eGCN36QO--1hf`WpIN^J9j_}{T#0&#F~);2aaR@eXh
z`P0<}fkFbA+#zpyc%qiX@bOiDeEAYs#;8m9Z|pL~bU;vOj#p;phu5ATIuA*^mt?+W
z<fnT-MfrO^_3?v!nYg>Y-fqK-S0qn3e0@doOt#>yI)6_hrM{t}>ZYXJf{*E3po6m}
zCiqlTkj|xlCl$U#4#+A(paY-(opZUoT-Me7_hpb2zWepn)?U6?SZb{=SX)~Q`u_dX
zziVXP5wMOd#w~HVzh1@0#YKI3xPgZA?~Lh7w1ms!jt`eN9sCdeezGX-^Y-5(B3+<*
zzxg+2k@~6azk@HuZ#(}DLTd8<e>&(XqYOk%Exy@{UqIl&3H{~qT7mp^$Vm2pzUgT9
zn3-C&#rbw6*T2Q~t2wOel2C+Y#%b5q&TW_ErHq2Y2Qtd3R2`ooQnATN6{cq8*J94D
zu1_2!#Kpho;ReDR8XDKuR;Q~hTB930R$k%b<Gg-tJeSV#pZn!J9tNxZ4ig{8%vAS}
z!dygF54}c%LOQrF;?EH&8X@y%Ptrh(qWYTngt)kb1ctFntNX8oGmf$Gu{CuX22epk
zLGAkb^WC8&rNF;0WHIqq#NE(IWbwho#ka>#Olb|s$m~uy(Y7Zd!@~{pI|uk=pz={m
z^qs5j=TkjF!PXR1v781GE}C}A6NFq&dtH5fn&pmjS<g3O7rvLVVF!L<foW@p691c4
zJP~%~qT1J+JExmVKhuBq@)zRZkw}MAH74-XI~9s1wtBr>b$8l}e|{Sk5iwnFlv7p3
z3X^`#SCpG;d>x{h!smvJjEqk}us>gZaOZ=<IzH~O9ZSsNDygP+h3H!0;NWmO+xNOz
zl`u3k4Beljp`od=oRQiagpP_UDUF{IacMU=<GjL8%P7<{ny|g9$b0|(_p@iuGTMJ+
zpc0PXi@<n1t~4|>%=zy<^+ZF{e;W;Go6na;O^AnTdE}ClaZ1|6l$2Pz><uLHocATL
zDbRjku5cTe-%Fg9O8n$G3^xf656=({vECn!(+Ug;;c&h<oM9tIG^g9Fh-xO)S6FTQ
zVdd3XUfqn1EzJ<~6%*EKvL$0-DXh$BO&58d`GM?j+*-tgx28SqnD3ANsurTFfWu|*
z;K5f65}qSJ#;3N<6p=z+^-eq8qU=8zGQ<w1>gnm}@5^J@kU55ihMJnRZEbC(6S<>e
zVvO|lJFTT{>-U!-Sctsz@15P<5!>LuGTI*mJZE#)80qQh`T6<Uw>O)w@bJXG!aO~B
z6*Ewu<I<d+9qH)B!V;=EIoV$m5@uy(4;L^pGMba7y-V}u^L`VUhx+`vh_En~B_Agh
zCnaSZl?<Pdpy1SFdzsHNGS=3*y6<7+WMsi_Sp1SvQBmcXPZwK+T+OFzl7qb-K77>r
z`!@y=$M)Wy(2mGlz580eugILhBb2|}`xpJ@B;T6#>qR_6!))c^y7!$r)=n(A^sA}Z
zup?VYz-t2Q_xO<YLsZHFq08uNCo2*T`!BjktiSQu9DChD*<$FELZ61F=9mu(ZV@=3
z1zTz+k?_=<AKoQZnkmV?Ys0Ky*D}k`ry{n}(yX-?5YS3a=5<Hp+MmxiyPX`}s=IR6
zIEhI}ghO!Y)%Z;kQK$Lb)>q+OSX+4kr3`&F_DAWM7INI8uR`MErz1Ns=CpZ8c+Dwr
z=u~QAy(zSk;H%iCXGa;=@QtOjzTm&RiC55Hz$Ti2FU<*SLaFrSs<pnp{`&g*@VCT7
zjewZdRSvQM35f<wrgF}aY^m|FF<E8h^P|%&Oh|2SEU%)R-0$Jvx|@S74e<~NM4i<l
zwE>k(h~iCmfA=~KH4_sVnXj_Z#bMg;@G$&C>H2)@-dz3pnnQ$Oj0uxrds~~6!~Sry
z_5!3zJ2^Bt84<(ClutzkHhd&G>~oC?3G1Yu!$E(S*^uclCiVWmVE@YtMM`-kEHZLz
zbo6^*Ao|m%`qTF-WKz#sRYqAhqBgg;kFzr}GPa8A>Ii)C%>$yNm5!zclDV4if3<9G
z#xDD|6&K4Y$mo+(OnzoRSESbOF4b8v#0Yf~74@TzrY~^6Hb@ti=jTU)ZEm{rv4t)(
zySUV@u441?-9JIwj@eA;K5x1;<9qWMygMWr7Z7BO3{1MLi!QvhR4$xik3hs}^llp-
z_Ex5lF{dLH>hCg7OVf#qQ#B8uXRB^?J-cZ;#wozW#M~H2aJyPPDpY4>7;{)zFI*v)
zk}EUbII}>U<IUuR{XlD9US6KWgy?5wT3deXfA0484<eaTKIT}cbhJ-xCgF3noU2M|
zq$6XbGF|`4@q#=w&AbckE2Ll{wW*}!lgLvh!#+o^lXXN~Ik|MwQsdQ9E6SC6b<ySb
zC7}dnlf=ZtUWFcIzGji2nBhO&I6YJKL<-p+XX}p{7MgIHAAk2p+t#p})z@xxobzoA
z>HM8e_b;H!BrMri9@IG<oUQFlWOPWqVRw#wh(k*YI}>K1q|6gSIg4@H(YK&2YzxAb
z;aodfAxETQZqOxB+J4q9RFA>>B(uoucq44XzyQHwP>hL*;dAM(*xfaM^=j!k9{rJL
zk^Rm(45#{FFn`Q1I6+=so@l0mkW>Gqo1JO$P=;t7kLU4axpGH;zgm2})x4|BQs=8y
zmvi5L&z747lGjW_tzCOCk)HAAu&5}JS0S;nu?|7&*Jt~TOa<~S8jr5d>z(g*!JeTM
zOnoNiuk>PLf}4Y|3TD<JODgs~D2UJH7+%Hz_t!Cc_3|?nJvliS4Nc;bD3{fI!x|5T
zhl0&D`~;uT`6V)KX=$mf>=0ReRupH6mGte^>1LL4@!Z&`LPrQbi&H<%lfN^T8jU3`
zEp2cC)mQkL7x3!j`SJ?Zds5P!ah8qSH!v4WEG&AhI!P=K*K;|ARgG*ur+M!kx}rk0
zDfy=@<6Q#-(h?G~a&o$Ne4f*u0s>#d!em^E<wCxf@qp0yH)Y-Ej2F#RSl{iYC}p&W
zs;Io?qW$pUXJMgY%b>T2{|^izUO};7e{}rbJ6w^|Z+?DzQ`OB@2U^X;;%J;scfZ3k
zI_MI)sOjlD6k=kk&qqy|#*0+v(p{LcvlWkdX#4+W)5rxsZ+6YX7v0?uM6M(ZWH`JD
zLIlYLBF+wta1;X-_3Y#v@6{{f!Djm6kdl(ad-~sblGiu~et&9TgD3oA`=`C#VRts_
z94?C9=z6NsVEr}qbM3}si|K~b(JiJ&D2SNwC>>7$UAg5-vxx*Yvn!Hkw#IW=nVFMz
zj`{jKRYbnN$mNFppKI`>pb$u4Kmg;Rm(R$UXTX;)zvAS{ug`a=Dc>C(4rL&I*o&c{
zP^C5hOXegt`@@&BQ}QThdud@Sh^=y?fu!QpvV$0Uzb8+6qUl&!7<4Yg&n-2JwVEhM
z<<~m*x<+y=XLqV4h~!5I=_UwRjeq^RNAph9CL<@W*S#F(s<v|WxY|5BylZN#-ySR1
z{X4-ILGkef!9D7gW!m+IEIb}3>$I)6M~xOUPIAc|{qr{a4aj+Ui92tv5QK+d<vI(0
z1K6urtA1m3b?{F}QhoM7>{vxDOhdyR0-;jORyA(l<8s8gy$EgwA;EEXbvD<A$#ki2
zrn*5S=R*!ijYSenJMUUW-LKCIg*%MXPS)wo*CwlAGiT6fIwP;i41{2LSs5;^mg&J@
zwtA>mC<$MhawsuRzxA;~sX|A#0kxU>waJLlM{+w)g`{XH9Et#8Xy$QNkJ6tGav6?3
z!L`wQfFa^3?rQALwOk6(2pDPJzWwy!!?*lKkDa6aTa<X`t6h%z2YHeGnr;;(r3vgN
z5E<)F#V7TS2dX93HqUpWBR@*t?yj}*EB*(=exdsQ{rhLn8>Fjoiy4eJ+@sY_#mFZc
zb<HkZp3C}FZ&+-<)z!tPr!TKcV4)#SLGq^jz;1t$`z3Yp!bb1Ihd&*`DdH^y4K8+9
z=Q~2>2a~l4>$YAehI`sOT#n{mhl`%b$iDbYM&-@h0_a2>!(~|()kXc-s)g#!rOrka
z;;(reZ*EaAIzot9oCklIO=xCIB}lE2;Zjjj3LFh&^(ZG!S8a`zcdXOSY>s`{AF!fP
zZ;D6{xjb2yjAy@_zeOQrv&jDavzI2n#AAale_?uP>BcuGrdT7*Hr}`U`Sa)4*sCUc
zlPF}4x_T==f`4?ISzHXh19e4UAVfh`TAGb3XvEpj@MEJe&s3vPN@L?(;uO>E%_G0i
z*GX{rAIH1H@C<AfbYkwqwjO2m>b=jYRMxP6CEv|#hM1+StnAj-R`J|IZhrpR{+JIc
zKzCMpbHAr*pTjT+*gu~{7Y+?E5KUKe*&<$}EmP9y)UdrvZSG58nX8M#N|7mBZtVyK
z`^R{wfrH26Z1-}FS~&-nB-w@QXV;o3Xh92`M@v*0JqC%vWVtOUhPTbrIq5M9ikquv
zJdas>s=%X76G7eO79oEuOw13p&G#+p#-NZu7Q`;1QEdoIj*pK=C*+N=&^bufe8HxY
zt~k?t|8_0aIat0z^ea{);-V|EBQzz1kjw8J6Pa~)dal8xXJ*FeBpa>0U39H-eRb6F
zeBR^o@^Y8v?(RW@W06Lqq18mh`!{|kGe4;G+Cy><LmSntdZKA_q!R?OzJ3+JrZ+G$
zTH)O87Wz+#%tsDtHqvVl4rXU(lV++32ngi*-_g?UO`YHs&Q$5ukgE=9-+w_uLpvQV
z-`UwI$MW>NdqM6~>M*g-v#SA$QIMhcW;klkw>%J&M;_N0GIe^BgYU3sO3HH!ysTv8
zp-dDMxg_YEb^n74DEFNG@)hk9JJxIpEa&%=(;XabV>vlS<Yx^zeow9%aA%46=4;Ic
zCW<{@ob%c)V|t-rZkw9EI43YiLks@#<3%>M_5wXfd09w5p&L?s7KO~yU$8^*Z|7Y4
zAN%r~hqclrm5;~Ak19w>(Rn9!w{DsKjW&mNwCdAE8l~p9b(Js9m+`Ma=$6(Q_;Pp4
z>)|dITHK_CNNo^q+uPjQ9$o<8;%NP9`9xJtPEc4_f2@0Lzc@LC-BVad(_<~41zYf@
zLfPC*HhjSg^Haq2%olSV8xZ4BkB_YuTxB5s$xZH;fwVb`rro3X*sa{2h+o$yV$Xx>
zuzMJyB4cCOZI0nrr`vtWEai-aM|3>PX=oJG)Py+rZM<2+_|+$zFK!tB!&k_tI_$(d
z?GE0J?{TFxHc+$;Wy5xM=;)jd<}hBoP;1avopB_Zdag<JSy%UGMn*ZPSTIQVJnwc{
z^e4X$>9xyVwn1Y+MY?--5s>!`C91Q#>#l;&+zfu>a<zNu;~yGA#HV9vnVpv>Telv|
zkdZs!afKGkXwjZVDmL}|=7t;9&9<yOGBR>NyGA9hWV_?XrF_nSq`3GSPWw+R&>c)d
zJY@m1>FMcr@6w$1=k=^aex;*L)>W>6ppnOj{CQ{G3LX(*+Rqb&;rZ%6g?g@co;>+;
zR8-5!&e}}Rwc{*wbo3KEn%&W?o$?KOT)J4XXOV$Mc(}N{j;pB^6^PW9R@d{rl&Gjm
z>m_%poXNbR+RMb+6ZOf-+W8s*RZ?15Uy7sO$n=nqnwr`Qxnw-AUUqHVRLkvk_fHPf
z)$e;VRVt%}1;sh_9y_>xgnBaX4cZYV007x<P2ZlHIYFV%vu&H)Zy`DoQd0eyUGmo$
zuO&kh*sPQXrw`MFa;=yQ`{`^_Dio=s9d;*m=C06u{Lu%x`~M=BIPz-&#b=p0IgB>|
zOpcHK`Tn;u_<~xfS#7d(Gu2C<Q6UQ8y`tAGHz`wjNowjJtNztBoA~_Ifik?9xHvKj
z3Yiu~>Ky457z|3p<ci%UqFkh<USfR|vZp>%ZKr#kl9U9q!IQ_LG7diGHn@Xu^+m+R
zNiblZ^yD8UUtOY@n&dOyAhQwwUEyD}1$BfJN#DG0YkZ*g4Aj44->tuAW(v3AU}NKq
zTTD7HubSZFZw(HXjEA5X?(R*-<leL3EGf*Y#l1r3f(8q-|N8H&%7u1L2oXr)heIQg
zwjZ;zKStx?{^gwxDK#SH!$CC=8*9~juWc=E?CRQejR~Fu6hDm3P${Vp?b7<H3HW49
zjn#r~oEkL`=}LKww5}ZH$@7K=59or7uhpQk$Y+^P@|uXQ^K%S+@Z5Lz%*>-)j>ZcG
zMi|sks4)8tnn1skyispf$BjtOrVZjE@8_;L)y>7$2|2yh`u#zBA=j($a57YqTAttw
z8)(bITQaiK*~=a>)Yeu~Zaxn~&z5V9WGn7@hDt1vj|o+~7guBSY~<AtCOP}7%_I5w
z5wP-cuyGmhbr5tTZhZ<+``+rEBDMl%=+Pb)@vEh?Rs6rOSjNt}ZrVvsE~4B>5>#xG
zFj%Ae*y)XLPpd!r_T+rP<@pa1u87NOUlHLaj~|a08@1hpQygYIRzA?0i=*o9>~&r}
z%dGU_k%zh?Zp_WiGcz*!ZgAVGLu*xuT>o)iEGPm}5@ls&g+zN8Z#YFqFo=0@U*TFB
zEFACO`g=e0_Pl!_JH!AZV6)zzl~t+Pg~dcgIV=q;k}S{<%MBB8v9p-WhM}I5aGP3c
zZ5%}!Au8nk9qnISxAjca*4DxZ*=+ZR!~3E=uW{YxPL&|Gfx!+ZbV*z?U1_8pNz+xh
zuU^$UZ*5mlVojbo?M_eB8?nJ)Xr`-|LCW6V-XZ8`Rpa+HDV%F0mJ7A_-M26u9oh1a
z!F8NY=_2rIRJgF~-kp-1V7dii2j&iVVzCLr>f__%m_m(u{iRudOX=A6eo8PEVdw5Y
zHpwXspeT}pL75m>-*A_te0#iM%C|tTZMD!yLP%(&YtEgjeXtyZ^f4#%4To!)*Me4?
zm8P_MwruNF1zjFxUN9ls?oi=#htmS>UkTO36{aM-u9h0robMQphSzr9rKL@)sm;|p
z42>_(!WiGbKR#BB>CD~Ch7k<O%VVuvozj>P1)Ya++U=Y*X0EP+q;tAG6s49;E9BvM
zz0YHTDu%-4ujH5ob@s@poUAqSGBm_3^lawk*@;gW!gapvZcI&0mB{ehbyG+$*j0}U
z3#-waxT~nJj}Nc<@$B5_2cPH7s_O~s*zWplz%80#zT;MR<zm<;p+~n5Ze62lswF|*
z1hdl6;Qk@&16PIFOpUD1=xD_)N@#B!OK@R{>7JiUdCth6E7;7NUG@1oJFC^hcZd+Y
z18H4dxd4&DoRIBmJ5zv>HBq;=MvQfJ?Jv7erBfPB>@F`ZK-JW6fs%)4&#Rfqs&?6u
zM!qGXZ1TuOzjb=es{eK@^L)R54&~_RS$1~&?bTVtOFa7W*1t%f-`BcM4Ik9Y1_m5L
zYy`oj8-)f2hCE)Efqsi4*+1^D#!~#M*7~m7S9s9QV`#PbGcHGr=vUX*W#1Y2gPlgq
z<tj|rp~QUUezbf#DchPOMQ}j!@?!gx&{32V&THBGH2-9`t!J>rx?jV@gn4*OMmZym
z${}Ecf#8<xgQ;<@yqVR!v*a5-S45`{25}wo<0m)=LMqO}pJfhvw<2?-llap*mHF<E
zm0E5KI{+5Sks{_ZL>vP4E?OnV4{ckPt|z@{D*dvY@_jn4R)Z@{b}DyC=;Zi#f6j~D
znm;8gX#E)~sw}hkX`U0gRMOsLzsZm{2ll*1gL~8jwngV7l+a<B%0HoYL(yq2{%FMf
zjc6}kxL)ldx7Ir8&x;L6i~2noWe+Z=T+FoDD{DKU6y|o`RB@C-w}=)JlV;Afs?^<j
zIL*6nH9ss9t0|_1VUm%=>sG2h(U1LXP_*9Z{#7fHh1V%Y>KBWviU8sR-VfwCaJr>a
zn23nW@&yC)_na}d0zJq(l19}P(a==35M7Z#2B>|MlWB2!`tJ({(#)((V^P-t+RSsf
z>u{09j=T{aw(SsAY}{BHzJq;5ND8;Q?uvHpI^<}qfrDw&$9`!TC-5a|5NePUJtbvr
z$#)-KLYt#!c1AF^!3pZpEeQRx+wJ7VrJd1ed6~X6Q%0fi0b}C?ypd+!f0!_5*)pcK
z59&n)F(+|l+sf$oY>-akUC7hpvV?WX8}-Lb=pZ5GQg%Zi71st|v<K_+ekvrnjU15x
za>YPj-}U;!_1eAmd@;NySbdx}J}OtHIT;6SP*G7~d!qX4c&xa=QEh7KY;VrziJhO{
zRT(4Wf^M_6o%B+0U3`9Q?4*Ba3TK5?LAEF@Whg#N?__6K;b*-$Ni8WUZS5Ecpfz34
zh6ihPT3u5bJ&dP&dSV`8P`TW<lzY@yA>L)P?wMOO)D#~B2qziGECo0~Dj6Sm9i<fx
zuh&_2zf1s7J`8LFW4$!qNI!d^^Xk>Rcke)nP?c$u;Wx^o#??(P3;7zd28BY0E@B%U
zJ2!fisiDuiRlCHY@^t|*IBDT*$W#_;Tq<g#w2f_V)Ti<a3T)7aoy<GxA424XGDJ?Y
z;ffh89s-^ZEO=0f@`MEhc)5Q><H9u4Ul8I{RaB14C>wbq5+{VZpMkfZY7!{N>0qs^
z-rv=g)h~nom9>92P97*CkQnTRW8L(0?}ra7Xr{5T>EuL36cv5jH<P#=4iPsR=>=^@
z*f>}?FK>8B)y2022x{bE)5+K`{<OE@t!|9u_|`#&klV7b8*mnAuwTf3{N`<e`p8f!
zf##j;zUIA&O%hjC25oEh`rW+!8htv95M}#^CUj>r_BCpjvFJ8V<3y%&PZpb0+Z>%;
zLd=~4yw;;LhTc<22^U)$A|Y|MyMMFRGjZeX&B)aYLI_&gZF%v5@{<c>kGS}_IL0p{
zV}Wjn3rZ1W=4jjf*>Ij``RuB32j^Tlr36I6^u^(^R;8c<3<|jv&1eU)_%}&R0`#s1
zi#vFlGV@|Sdv`%kZ{CEDIXossyP;1MjZmZBGo#Yy*2wC>vOfvG|LFx5Pm#t-Z(>A5
zck<nz$fP8XqvO*rU-&sulM^G-Pf1<mTyZEK{i?@l+z!=J<lpYtG8#PwtoVX!LypZS
z13e019p&JOr)V*h<GMK{d`lmAT<x9c%3<^4sr*4O6`TbPY%<(tRbH6<GmH1APhEVO
zo9O3+x(#Ia*O;6VlVGGa`zj5dJUxK0K})Fa>FJuDk#`?$uzx0xZYjO%Wv>{ZR3)rT
z-QLv9+>}!iHm@C@#7hN@E;iK8s-|Ih7ap_T-P@aq))Q1i@xicW<2q`J(PNmxd7bCh
zZNwvpw(+TJ4n=18;++fu?0b++KMM7MKQhEBk#S~qj2=wLc^<_c;qAo5kyd&0r?8hP
z{Df)8L{E^u<fp&;6J<t+I29(<yLxY!I-dRpU4&hr<sA@U43GrSF^IU68ExKhsodij
z4QOWGwtch7*m`-IUr7jANRpA2W#Hh5E2CxZORiFwU*qAf<DAaRGdX(p411tNPdKP<
zy^57~^TIjql!V(oF(sw>^Bs*1L#Z7e9n;#vyYP^~oSWC2F>HQxBOqK?TP;Y(aff)L
z5lpx?xJmm$0s}`Sw323Lxn*Ug48OE@!-Y9rZ$=xYMxgiT429TM-dFO=iqjgDZJeSG
z6ybuU#tQb#g`^gB0EHZW7pLxt;CN4DVZos~wLe#fO~0yvIZ|0}7ZU>D5eVv8E!6>~
zvRjzhG>|~lwz_!1xzC<o)4dx)s&Ee;CSX#?q$xrNI>VwP(sSU0sns$v{GZ6#Vtzxf
zWQIDj7saA8AVHm%MopU}kh#@5#5xsN3AY(Nv+HXfRNb2;>4I{)!=X*sSvf{B7u_Az
z^G}d2=)=Opvl)*3Lz97$fxDn7R49}|8mO=}2M^CH)n+Lid%3DW5-b3Ue(0OH?3D>@
z%Aw6czPDk=m|6bD>xS8(v&rKuY@o*Bbl=TPYtl*>N9WU2y1k0Vqt{%STl*<R6iF_f
zk}$@QmT}>9z@s1ox0<hzIN}8wkIXkAA6qLDZItWiH5M~nU11a4?H6qVmZ3d0!SrkH
zx+}{j;+i)V@BO%xaIx?rqr%hDs;&t!&J^Y4Gp^l;IjYJs+@BYc2LG5M{F9fT&kXS6
zaylryLSM7y{&`Ofz_W?0vW$2bqe)gV<%EnfbR$_p+(uJeTt#0WUQ`qU&&;ff9#11p
z?6Kv&KT&90E^ypDv;oiwj(UNZ;(Gfj*T~5zuwxUpHP}=Lv=tD<3YEd!ym63(5%aky
zP0W@nH9Pzl7a%Dk^Q8_V9d|4t0Rj2rI2}GbIyN>kJlyPl%2c37K$2p8nctK9N+{63
zUcvL=u9bK$5pZ<lR<o?Oe_jSU)H)d)=EQK%dt7X7Hus9amE(p#Hpo-Efb9}ELjyL;
zWgdmybu0nl9*=cqr5<&l#cVS7$oMce4h}6nmD|n{$SW8qL=TWWiGl<6_RP0hkpB7!
z#?Arz9;h$+f>5KOM9(b;)VvZ92?BymGvnNt<es7|7$_KU3ht;VXg)DAX68teF`KH~
z-#udE%<kv4Ffbw{A}Y6UBX}Un4~5zZ7kD9B`o~=lzP2W(@XEjZUB8|q$&7gM{JD06
zc~op}Zet@YnmSY=m3{lpN9;Lnu}Y(^#F4FCIp=_OgIa@qRLwVM9%#_({Q(bC6H_^i
z>Vs)@6&Z22URhE<+>|WoVq!v8E4QQW#y^xgxa;c$_tX3+7ib6v05a9nA2IKf@YrtV
zjciczV*;j`F_({vhM3iUac9Dc(x1Pu@idiNuFD*U>`me{r{#2=e3;uFikn1ZK<U!R
z2EBH(3v}qA2qnBiLRy+$_BY(;><-aRt6dwN9UP3t<(Rv9whVu5K3;LOT}dd4P9pe9
za0|79j?@o>*JEAK($Z2uM<>)$6Y>G^1hFF`JG*R90H7I#q=BBvbOQ<oNe=B`uB=bW
zN2DGNVV6siKtZ5y5@KO-+1waw>1_3h44EVU%Ryikn>?J$&CJXkwihc5uIU07R##Uy
zJ&Hf??en=yCj7_d0hjpaa-a{FEzNFT`&bV2Xye?1m?n`2M2Fe$K5w0r1!k0fRHU{^
za#F;xKH5i>5i~SZBBR$#Me-SjklC`dMfI<il$Do5HMs5?xyi*ECKcb~OxC!#rOfkC
zh=r%5XwL_hu-9ggSjc(p^Vye|T1o|cjJKKUZl>ViC*5T<%9MQS=C-p8D~*{}mXS+_
zB<pk*XtXHZ&NuFwPb;n6ZrW~D`_0>^8I*Qg%y-i)=Md4^ttiYIZdvrhPxC0Ot_QtR
z0{LFNICp2gkz)b5HTduZV{}--;Nm$W#~2<Vq4tfDqO<X=lFhePYkJ(`-moiWg1noy
zsWnZ~7WsMc#)dKM;_jD;7WX+m)61={`O=SOPYJ8@3-UySMOiI|V{eZV8Ka0TVnSY0
zkuW{ARctzz-Vs;0kfppGS6GQ8Jt~(bm5%%0AL<6t`pepC=@+OMkl>Hv61SlcDLRid
zZUqT7S5CC=z6Cf3HkNx)v6;D<Dr2#K%|J-bVO?Ln_`jX(=w}vqJ$l(q8g*eJ`}YLW
zlmBw$;Q!y~$hmuAdvo*XKNh14(j%iVJz%}~_uRh*4h>w9ati(uJV;3YS2&FB!=j^;
zBjV#DBh_VOeu33O_Vn4afPjGRuI}zmai-=cTsi<1<hLY!;u8ovskSP$0fwS7#^H3x
zdxQ<Z@u`>;Z-J)+HqhDG-LIr5YncE1?-i!Gc}bsAUg>`cYSKV{{lI_>`PnlY_u7X@
z3dDO%WFI~l-*;i-w6(V}jd>@1LgGIi?UahWf7`hv4u$5l`lF(jfx=QD#@ky1z~DXE
zII7=LuaOof6y3;sV}MGYnVAidfB^F2(CkCjA9?wa*nb03MHQ_6GXQMtz`($N1O5n$
zl-t?<F9WPs9)x&%KTLdxj&!(VtgRMIn4v@d0!fB6zZz>D`u~Ch=>Nz|^px??4F?z3
z^X!<GiVA33i!oW**#;Y{pPFBA83C`Fx1`i*UwnP+9Uub-wXyUvcpK}X--GV$ix3FJ
zH3l(0{&qQ&((p<SeLSlr1sPcvSYpcj{DZa6m4(}c?QCt~aBLKeO=@cDRt05I(e_4^
z&=+Wkk{o2D#YazV^Fy1S=D>)h7k=jD<xOZ<YS+1Ybf$XpB|(*x9M=&Nk~lmrR}Doj
zMDC{#kxD4mY_De904b3W|9WV|jE>D}!DFyk8Y8<7aCnA_9vfi#?qN@DO_ADY(F@H(
z-*CZ3&PjL;17qp6Z@-CrBmY5!pAu%hchv`~dRiE4gN~?zndSK8gw1@u)OubrKQS!K
zxo=HW-1ytqCd(A9xlQV5<=1a8v-9(Z>y4CQXu*42=UG`<2XkJTS+F41!aaPXFML{-
zmUMfsO>(+<_lEO4fa1dib6c!GCnn3u1eMa}d}TQR_=bk#zEHqS34zPq9Cvih&BYmp
z3uk}?a)^!nvZA^?P0UlE<tlgvw=YG67C!GVvRq}pFqiF6z~w|tMMYKNWC{!ZyRx)>
z&1_9Y-QB%^{9uOZ8yPfuo>a+;<>>gJ0N<J1s-C{S_&ZpJ-)RUjS5i`>yuzOkA3rk8
zo-~IhahsW%mVMrTK}*{Qh>%iWv5=JUk&z75cvchpi%rU_kIA1b;T7=F%~w7^*E9g6
ztPZf@(QJ=TIUVM9)MEfh{rmTC`-XsS6BM_*<x0AwnSn&s@N5981${$_`J%$ZHB0RU
z&Wn=R{nKl{hH3K;-f)bN!`|H9`54*SqT+lcBV*e2tofnoB&(qz=&temCw?Ri?e=_)
zL(BuDFZZ7Sc!>!Q-@0Ba2rXXl5tFu@Z<=UO)vIdI@o@!QMnnW=Y3Y$KGIB_v8bn;2
z*=$-xON;J3cLbZ8xrU&CXH!xk%UGt5_tL9y1P=irUP?;JM3n=zgoFez7x<&^gB<vl
zit7Dains5nsAxX?jg1qj4{nXUt~Za$qs#!cXPYR;_JYl|wBl1v(x<g{lZoxM6{s%<
zN3E)=>eSR!_Q!Ut_Tbg%)mPofl$|}&DV$%=1{w^hCmp!hCx`l{#<Nv>tF7Qfe|J$c
zYEHpz1o?m#6(!X$o=y(BR4^gS=jUW(O$)MbS?Q!CBm$IG|9W~52>a${0>X1z){v%z
zsT{;!0z4KQFD3P7W^aOsw6Z^VGi8GhQpeF95vi?06GaQ$Zg<DuN=bdZh4|cWR{Mf2
z%C-hyowu9qCB7-vaLBqXED8ycS4Yt!ZFN<0AbtP7YJZZNoO+}zi-kyGnMHlQNL@@U
zC_-d+&cIkuLz0_~tr~J33jWH%GXben@UlWkn7o_ry9-itbHje~lyyR2FnO7<`)fsH
z4hz~o{E?3UxB;sPB}d#j9G!W%I`7LDq>X3$W~fMqkJc>Slj?yLlV+lbvnE9}P0VfU
zon2X3L1770`BG;Ce3LC5p(lWYYjnF`8Vtvxj-gFQ%7bp8CvjGtU_9lv+m8q=i)d;h
zR<B*wWJ5w4MP=9AyBF7lv5+$LbevPe{QdmIL_~HrjZd^dRREP9xY*tpu%_SQa7XBS
zdN#$^sYyBZ=M2p6(f}+8PtpEm{g8^16W$5tIwm%EbE_OrP_T6}2Qa$!wOlHCdXEOA
z=XY6HQySfi>*v!05~>e|n2}kdqaA!7`vwN0QqI^NG$jD~G@vxxyMdeN^KzxeQ4#PY
znIh}k-i1;;V{+g8Vh6xxgS)1%urq(N*07wMi_7J1fdZqxb@K^c(O^rP_wV0Dnw&Bo
zRKS(BICT<Jq}42-UFYF;o@%OKY&LQOIN%|Mg~Vxgu)V#wK^pve>qf%i2$7VeAt(2L
z7_}sX!k8!-VrV8-zgK?-<R=*gCg-;s{db@m17u>8#|H79RlWTdfB9?tZ9cE9yR$hr
zNR)h{p1Hot#flMs&#c47=%0h&he*GyNW+qoyAJ`qta4_AMKv(MH^_f~?|k~)gKOA{
ziYqBTzRqAKc@4U8qSe>kkBf(O?I|^lF~z~L%x9>BV>4tU_5^8>kB0rjP4(V4lVYHy
ze4wM#x-$9$bbt>ZK0x3yeal?x(;V{Rqze5!nt=y(558y*-6Kj4pK?yh+En)T_5ub4
zD5bq#TBnY`)#CGCc(r`LbfUmr%G{fBnw+jPIZ`IOyUgmrq(AM0IJ{g!Lc$i~5+x&R
zWAvh^75>&54WFDE?pMvdsaJac`@zM1KuCycxuxAv#EjGaLW4)><({0}FrB93r3p)*
zwe`WpG&0zSN(dOY$F#7GyUjze5Rh&b-gaIVeyjQGQ$eEWx%Cf4Mt=P0p-;MA6N{<w
zSe_7<j?PkV@6YEkMURpFAyDY~?s(heWSFVv)vn!jf8%I{y&mc9orfEU@LILooF>1G
ztCD!G(a$%>RfU9Zk4Er-(*w-Y^vu-pKAzY0{w+vUAZJ!PR?yG+-`w0#Pgq`DxQD|d
ztW8%YO9XhTZpM?`inZJ*s5&tS29*^RYwbxW^fV0b^Va*+op|QmAmZOE&1SCJpiWgO
z+D%t;jpq~`WLe2kA|TjO&S)qo*aL0AiG(}vl^YkK>n9mn_S<KFzuX;lS$UaOZS&T2
zR_mXmjGLQ>w>LhyheInljErT}(R3g=VTrtYac;y)%<DQ^Eggz%XY>>mwU);vyC^#z
z4u69e!(ZIq)<OR9Bj5`?u6Fm9jy!vFbz1#i*t*@&e4>ce@&I2iM|vIvMgj)+mu-Yu
z*Vc2Vj=<LnIB?hVUB}COsJS^ej;N?`9tHJ40uxMKedj7T!Qd>d;jY>Bw*5S40XTxi
z&<Q1>K%~kL++Mm2ny9n4<g=R=j`ut~eAbHQcJt7CeISn4WO)<FMN@7ff-L{tVsihI
zx~C5QRaQ~9s;unrWaDO16bR=cME@gL>$5xM;lwdmq<?KnuBd?5#+m3VFlPw>M)&aS
zR<QW$;$p1WNPvulhp*aVCHH4$W>L28NO~>CxuTVoc1~5uC@(TC(2_*5Jc9;LMm7M6
zr*B{Y@Jo*58*iOpvH#)%#J2FL;E^$A)0yEFaCopodF<vS<F$;|eWORyAg0M*f!*Rw
zGky3nKJ>XAsn8>Q{J1lz!p53r-NZ<tG<hvGwL0&H8$=$~>e|}tT-?N>e=f3Sb=e_4
z!Jyx|(gvAXUXtRac|RPbLX?Z@iZsdvl*Kyo3Vlk$-}OmRCIOHmrw|q&-+jmK=5uul
z)GC{j>eI7R07!URZ(q^6*35<(u%EvcFEldfvOeYxXdtmuR+Ob0D(&r+49s&L@{Ny2
zb&7r*sPEj^-7}!4oMunby~}qS6>~kGdK0>UhmMMVdw3Md##YtU->+k(s6CKxDJ=YF
zoXBlW-$1RZVm(P4MbY;y%HKujNi8DcTQOSkk1~5z^?{dne)gx7%PFNf5Ok2nyw2}h
z(@4pc=+v>_U>@Jyb{wsU${q5jJrp5OfQhM7)6&xNzWXYOeum<`6F*@x)DR~!=T-6Z
zExp(S46dX^xnuWFAWMNAiumyYGCeqQ<Nffft?SwbiA)`aft<WNTG02wk(F6$K14_H
zYcn$w*$*qTS$aqDfREGUblMy(P4ePjjI)bTfJafJ>!of36$!1gxA*F=&dT-|h^TEY
zWpotIR5ZICJdhXSb#>jJti9eE*^msbbJ<~KA$<M1_hvz1_JmwI*<ztIh`2e2=~o9p
zO7;#80I{g6sB~IqAoDf<LiO}rU*B^BxrOq5S;bH44-}x=LA(oBmVrSPKMp)jH8F{^
z%UkM#I$$8ID69CK5+D1T&+CYak1wT+?tH(#(c?TBHTcJi6dtdr7_qiXAem7$vdd%X
zP16q2z{gapJ*f}4D=@ovgiNYf`v53iJzKq8A*a`>cPsI2Z+`-^+>`=F;he*SI<r6v
z=4qrL5tbe)vWtu3H9yPS$P?(itF!q+(@f7y!d>L|?@!sR#?9Bd4f3fHE7sd#385+M
zJf5?$U6CKLQ`+{9MkwWT*i1(c|CF}2^-Ns>G!{z2liJ*HJnw<xetBG}I+87heqfZp
z|EFtYw7SLT32^E%A|bhFN;iLPnjP7}?+;gg#>7-U4>;Yu?Op{<Il1>lS1?KO&!*pF
zVg|nY`1`*gHnv)b$m2NQ=X1Uo>;q`Cv-8X4eQxRoT@f2Dof;&ePGUv$@B3cxL*Md3
zTx_-Vj05*34lXwOn?W&E)x3u8|CtoY?CL;LWQb5Dic~IM_^DE<r6Jf`R&-fC$zEmX
zbEO2#>wBX^0UoACGw(mH&j2zRl#D<_=BoEpnC$NV$jz<WwtWh;jH)WyO)tI^X%9Ci
zF308Fz%fFg6z{65$;(ktuz#b>YT$*79?cx4J)+DEe~Gs<)Y!AdgoiKnQLMZ&WA04z
z8h9ruJPEnOM%YM&Za3)XC|_f}e3{CQVv=Yo6ejO+FyENMZldPs=m?w(y?uQYi)lg{
z9#`o0wT`M%Qqg(15Y#!Z!_=8j`mJJ5Pwb^n&7XmRY1HsQi|23GkoNZWtcbcg6EpMd
z-q8whsIB2)BS7OsUiy5atK-(JgoZ}q*W*U#7LLV6^R4CnBu+-8W=T;s*X>LjfNBA>
z4Mat4I9|@Nno?miBBu~nVfMlu!@fVl+GZ}nXES_^)@q!7QJiIFYHU7V5`PY-I^UaX
zO#KxXLEBLJa*TwthOZ6!`?nzT+;mHk@B)AVAAb;b75sAi;@Z<hMNM6AJN5hcO2+X1
zk&pMt$cUTcf#3*S7;Mya#Z;6+yo2+gydz4i4p2Kk9Vt7iCv65yh2p|`;mnp0hvn|(
z>CX5I5?1~5{yoso0B$~8dky9L?shziKaZ$1BlGf(L01R0PFhx@9$`*M`3BwMoXTP4
zb;3I#G1ls;o#D!B;3&4Uvs+ogsyp3Gii(02qZ2c_Zxr#E_i;JxhY;}eXJ<XCw7b6(
zsyf`QJyE#aojQTW6q>JXB9>MF-brQMoUZKo^K8Y0k6ZV`+VyI2iL|N#(G>Co4NjQj
z0hTeQx<A$62=Jx=W7jF+r`WTvYkknx49{DX^W8Df2$7P!KUJS%$nEvjj)s+vE;*Z0
zL|cG-%X;kR)X5t)F4?~3af{Rg^s2=8xh6fltjwPl>cOvBqS2#E*DBze_2-Uz^98EU
z)z$X<)T^nDfjw(%bQkz;Os+ssVs6ymLOshm!usfRFy-Gw3HXOI682HA#h2<_{sEEM
zhy9`j&Ko4SxKipr@4vhYmzAv$09-c2cXX+Ag*<A%ea;OdH<5LE@f~SM3cKcIFzzdS
z39JglxW)89EX&4BwbhFoi4T9;g2dSQ@@U?*h_Z8IpJ0btcMA;(Ze=vWx$~UoQ<QSu
zNw8Pf4(6R^>hunxE$UOa-G<UUW|oVO-@hS-D8BoBDFSN!fU`O6=BuGUU+z3yeC;-R
zK`V`s&y&-*ZPU?`2OfB$!or_sNzy@(m1=#0=3G3CH@28YI^TRhSYd+2p{jaCkj!ND
zAWHtWbmgPpw{I^t7eG_QC5Sc&tX4Rfm<mdAy64EKfq`<fK^p+ha2w74PF-A7I&%~d
zXer<5_d2^lZskxUrTp}1^H*ByL{YuWc+K19FAtD%6+si3%ZS1Lj`3h>e!k!}=Q*2I
zo|LmQI}EJK?X9hkA8pUR21o>eY0W@0F`?x1x(7v%RFc1?!hM%~zm@LA#l<l5o?Fk(
zYhP66E08#vl9RQxwDz}{HVpgYh1{H7O~$sH(TO=DUZ#B3kv(7O2(2K`dCVJiFk9)i
zaOcBpURGL~o!pzyocsHE{8;WI5?;^rt(ao1Aw=Uf2C&95F)}7MJ4-;}F)=e02Gm5`
zppPd{y?Vc3Vt>T2SD#G~nd|;XZ!hJD;UL@GrYtF-HGp$!k|7<QiGA=<*30V9-_mZq
zKc|?S8rriMwiukiO2Y136G3Q!h<zrV%<E)2lkIY1h%FbA^2ztXA{VHA><p#w8B6F5
z!YIf@wmv?&8vu!t1sTPESU`Y-LzOJ6d4NQ5L)TNF+Oi+`S?X%$6WMiUff|E_g=Hj}
z@|&wd6y;utMmxPAL%uj!5qMJ8?6|q-hhCM1CZ}v(_fFTfAxz{c{e}EDGYvAgo^Ktd
z-P&V^neNXv`Ie=O{=R#JvgJIV_UIZUKtP++IqtaJTu9VMSD9a9VlIag&lWEJPywt#
zJjg;O^kQNzQpwBu7;4kDo<zW{rFrcrRpIY`dj<19+nb%^$Z+re6=Ph|;Ig%eiTs4O
zsfm+wn%Np4?c0kZtTBBr#|)S9k87u4!@?CzB;3ZoZd~j(gEGX5c`Mw`kIz^K*=p=B
z1A(K@_r%D!!)<N564<pt&%n=+Jd?=wU>FQGUE!FyQV$<a`{M5k6>I4>Pr+?;!&tlI
za7w#9Y>DK=B_!P0*pL=Lj{>~KkB=cFd}NfAHv7F2z@6HoTtuhdw0#(^*O%bY%wlnr
zbdR@x#C0X5T4VgI?VX+Bfay#XOB85T3K^!s{x&!fDW4ZC`VOtH?5>!_Vwzn}e=<W^
zn+l)B_ClJCV9jEaJt;bRy`i>TSXdYsp87jGGY?o^z4{^jWns|9=tZd~`L1xjgkXf-
zHY?G?%p`|^-mT(PdL%+KGrSl=toG2x{pIxZbaTBq?{g{-4i?kNL*SyvMh4YR$+=xm
zUk?D0BHG`oEf<c?jx2#weP<jUmcUFm=d7ibjB&2D3-;qWj;qV{p{2q?wu9Nt`J*q>
zzPd>Bh!Vh3Ar6#Vn)-**aDtPy>zmUeCT0~x>mBdeO)|Y*fO8Sjb9{6u7>DJ`X}L?$
z-TL_PldG#MnWT@fZZunC$E%&i!N8?tZ(ThLEL_KynHll~H_lQKO*_YqnQ}3w`7vQf
z$EtzkM&Khi22{*MalM>`tEigGp1Mu*LyEA}&j&pd#V4S2HUotR3Gb@i2qU(*^R+eS
zXG23#?f1+AggW@;-7_-@6M|bwd|3&b^f>5*oZm0;uNaR{&NCV!8+kT<KM@jo1PPJN
z#d?j67zq{)O1)C3b(ld%^o^Bep&_S#w+56kXqPcfpKWYt&;V)O+4*sCnA|aFL@;XR
zEhtp4rUMp0fN|W9S4}pgh>(%*c}XKfZccaStXkV?b(WTNb-hy5@(T*=w*SapIc8>P
z+tXMd!?&Q(g*0=vmRca&rKNT8zEPWU+MaxO-*Nd26Eork5`Q71**XIB;taog=XXNA
z5^X=4=j}nXRzbN1%kw!rJY=()H#IX+Ra3#XD)e@trKO?77c70e7D93IYmV=^=f&X=
zpjgmGrqJO5Xok*Q7H7%=Wo5Rub{swF2$3z-^*(K8o8wU~r-OC<jZb_+?;a4{qoSjy
zS)~A0`x?--hK2`x&Sllf85$5rCG_e?x_q3!ww}=@Ihjo#JKg~cSJb8G%Di7S|97F1
zi}%KDUUfs8x16?{zhZ|-72#3f;u`y@?gu`8$3?0Sk#bqz(B$z_LxTXvVF?oB&U)~R
z^9vH9RM-2v*6A_oSna{-Apr=)bm}+?yA%|_p>ApOH8#{dJRU>8UF>rsLMG?x91<Gi
znHU&kB_-YW6XQTf+5w;Y8&31pBrd0kpKAS32HCTers=E?WN2szA0fdU$>h{ujh&%9
zmxLX?NU3LxY;0yj4O53Yt*n;Q4Mqodj#3uX^Aiq>$)%0}flS*u67p6Eo8b&VOaG{c
zIth9U0<T~8Eo~d-`99D0fPgd)TV$S}>Jy3RvW;H%r8+)O;C-Kqi%N6N4E4?bSW97C
zch9SIwXV#?m2Uvf)yx3+a$O)cHCoM(cV9z7&RT@TVo_y3oGh>PFd6lmnwkzW)MUd5
z7wSBeA#wm5%K#dY69`<MVc~HS)Z#ok?A1+$@-11zvzC*E8kLS+!)wZPNq|(%`@A)p
z{k2I;#`<Yi&d;ATkr5G~<BoDUPrd_=_KRxLcr*)v_yPJIB@;L=LDFya3(fwCZgKMD
zw7|=O8VSiqvcFiR!kX6u8RX*<w*lTB<)8awIea4Q1O(d_(-rGuHa3k6?yIlQ7(CW@
zyP2u!=%l(_Q4KfEy8cYoTtIhE`G9YR%jOty5fC}`)Suhys0=!>FXR`}U~@9QGqL|-
zW2c;sa0w9R>CJW<w3)?{@tZ>#Tpn#8A+3#Wl>?jg{#gBe(=7_1+|`P#Qj!7EVdlNt
z0<mQ1tLQwig`}EHPeohigD}Ek285-Pp^<Wl6+c9U#E7VQx{vM;)T{9<J2ACoP_K+z
zO)^_tNz&6>1!ind6c^{G3ohXsK-+^;DlD!;T%O}D)Zg=KY9@u)$@U7ZaXIc!15^JI
zR!(e+$xx!51DZp&4QW69B(updJ1c9nVC5nWf9-#90fw^$mK0iL)#X`}db2eWptD1z
zF468ok=uEor;NC=SdLZ7d=)DzXx{KDTtJMV+aJsa-}T2cSzU)D>9xc3y)?e|5h*qd
zMMOp>)t_$e&fd;mK1XOqN5n%^--6@{7`TbIoq4<#7JHgpRl`FcIrSa3j-v(#KV8*v
zx?O#6BVkffP+%rX)FVkwPNABztuE4Z_6pjWsAi+}4r#ZTtC}k^fPyNpDzORL{)6}x
z0DKD_2%hO&+1BQ9Pd-fx#AZ0cVq<TmRZEvk_hQgSPs}Umw#xFhJ)znX7&*(`w=e-L
zj?T#aJUQ6HT<WxN2RJR%GY2@l1fZBtqEIMsL8RNu<MhrnT%J>(CNNv}-d^)mrS(c6
zdt`VVUpaW0<QB+YZ2~eB?3d|gD~#)mfte~xTVsQR>$RP<)(%_SvKTtm$p%&V!0*wt
zn!*woRPGm@7K6X;dIw}UgSPGJM!#XLGMi3*;prc1*g8kInyzW-$_s98zF#8k_~t8O
z*dIGyU=*6dT5sEiIjuoQSA;=Qr>J4K`dz1D$kxsdgP4;5AAfB&>!ce8Iu%1TZwz;u
zF0n+j2p%&Vr&Vu)NJ&`^6z#zY0GaO@%<t+-)vEnILl*}7k<T2I;+6Wf30+<j^pAi@
z{N%}1^M?N_=tTzk7P7FP)KpG60bsv&9U%}c$)upE@eS8sA0myWE`}X0G+-6|D&E~O
zb?1wNC(=;9YpG}T^G`4P^G8@wactSQ0t$NnK%capsg!_#0PxQu$6(ynP1dj*kY#n>
zRER%=8)LqF`E%+N`GQH&iu`9*UiTrM#t+#?n=i46MD#pkmgCZwH)}Lq*h=VbJu-l4
z7HCHG+EWu_7oHI@p7a7LDm8#cwRYNK;a$eV#Jp-2WfxWy@y)~ah1|dSfW&X`f211z
ze>f=BTtr0V+(YX^6y>V@v1c$kq*L7R&H^HLY)Ig@P9SQyExJde2ABqe|NL}@fivDV
z%lYyX>N(Dj+fN$f9X`oUC`TxLzO#6?CE>~N?rx~1x*_>zv)yO;luI;+9dPCSw|~qP
z<Z5S}w|o8#Nwb8MoZlsV8h_7pEHRo1Cnc%Dl5en5yu-S~n;yVOlm68ckg&@ayA4HD
zFXvj7?<U?SVq#~mo`tB;l9H9LPAh>8@*3z_;0>Q4rcP2*7s2E=G;n7J_9rzDW|^JC
z;R@Nf-TnRGHv<O1ijCDSw;meqlFw!W)0HB?@x}wE@GI+FteUQP&;E8`KH>fweXtPu
z0bL;EADYN+Vmh(k2r%)~>~u)`4(OtaO40Ndl2cLnp7)-FWWnVG&&9=s>7E#@AwZS^
z5j;B(Vy_hu^jBx|b4t@{V)**V!VLDUm0-Fo$LLQ?=u#8VPVtJm@_0eEymDKfT!N1>
zgWpa7#LMWY0%#o5=$fi`aL7iHcVJl1wVJP+%Z8bO{*!fWAf~ylkJ@B!L+m||(k}rH
zsr=^ezp-Y6PAdV00-qM+VGoGa>sr&+?z11)wb#~9@>5Gn3bQPt*41X5&SHh0AM~@o
zfBW_q(k~JWpg}!*hB_qPC`;O38A@wW2uS_w-OJ~ww&*|;x$KStbQGwj2gchCTW)H#
zo80G0&CWqFJT^AQRbj>FI%*xiHhC0@N2kT@v=0CI(;NcXt~({1n_Cd?5eLDG%VgQv
zkz{Xq*>!0d2Q-I0dUOl!SW!_~>vX@Qy)!-nHM>`Hy6#UZOkl%37~Y$4>QAm;Bzb9U
zsARMm)&jU-1(iBJ6bvGVMjKLUYO~qNAq*1U2snJYAz)<P0q<{jw6KVXiHT`2K2w=|
z2f6|~NQgHLH|u=~M0_?7MMZ<n#jix16*-BDfW@h|-{-dZT>}UJ=d&A*VvO!?D(s7>
zDYdQsfp{KzCMG@5U8kV3uB6Mw=QjS6h|9^qXv5xNpIhff#r^98q&RK|QBzZ@EI2SD
zP%zC8k2|*9aM(Zf`?_6saPnKOUg~JadU+T#l(!bKyQ3a&shZQ(spO%cj~z5nwsRLy
zUaW!N@06bUHE@6Qtd(F#ow2!{>BdYzz*EuZjflx5XS^RqbAzdwW$WLm$tf87@tzLV
z&6pGXq6H0&?!o+R5~rj2)G#Y2r(thR0BDQ0Ga4|TOl_&!<3cCm6&;h4V;|f6jMK+%
za?A`$YNLVVp&X}Tuz<m;52fOE->kAeVk9$YBMZU<4h-o;W)>Qn*`FaM9q4;oV`qDb
zu4kKC4H(kN+zDJ>;s1@fw~ng1eb;?aUJMWvr4dk+2I(#(1*A(_Kw{F3v_VLVba$6@
zhalbEARyh{aBlpqb<Wyr>@&_jd+mM3;jeeRDg);H&gZ$~x;|HR^<<LAp1Zp{bkrA{
zQ)m4b72qQPdPWHgt4JULbRkn^#9MVPzNtpje0&mNd4@7|mr;r|p&?jH-D<CS(|045
z&FQsjF89Zb;okE07VA*T>F(;Hqt?mjN_pOWpIk<PP5Yd~(PnGdAGM^Uq{BGZW(m<J
zJDD0%7CPEZ!f#pVR>ueR4$wS~&iB1<ApKUYHk{2Re9;qMxiM2U(KF+=m{Xz1Wr`=h
z?Tx`O#PFLp^^U=QBFf0jjCAMgG_Q`c+xsD?5}m2flYf}D_G9y=qoLjH<}Q26Ue}JB
z8OBg^v8@s-!mMbJW%iqps2&LkhO{)Os9-;;o+9R#l#r;gJ|foB^+dP*10Vh_7_N2q
z<?P|UfW`X8bVaTvZ+4zWY)y5IhPuWW3knU#^Zn%XCFruFSxv>I0W#un5QVm2YBpU-
z2i9gpBNrwnCYQj9<Gj9|RB5KSSTMPyR1D8lxutGZ*cC^+Fg7L5c(ElfQLBxOq256M
z?C?evT-Vfn@s{%xG_4(5qqU(?z;bBHQ#3C9EId^i&*#|tPZNWRN+j4;VI(4_{)$Xa
zPL6OmH}Tv%BcnBI$W3-#$mKU(I8I-L6U}GvGY@C#R@&@*-c>aoXfCMk=65;F`J7w)
zq0jk|uI@M=%)T5?_c@!S;80=o^t|O{x3N5!nw`ExF;3NI8O&-t0(<0FQc9%;J)62M
zemdE*m1oD^12E*GQ)SUAG~^@ecX6r9(X7goZ#jg|Y*1L3YL(;A9xgqYX+_U!@CVXt
zeiMf$PH~rrtT<-Pq*_yyvf7D=(+>nu!Pfs3^4ZbyW#HP|QB(j30CyocXS2Veu{cxS
zP}K2o^5pmLZvcrXYmrvZ*HV&~pD3_C0`DLbbCGF|8m&5mw4B`MRr&8mUE>GEdm$kq
z>%%2zWYY-E((NH*ds|ypuI<4JdC@E}#K{368^23)TgHITn|L<iw{MRRjF0@I%UsV6
zB}GNO0-RM;ExI41Z9Vf+IxPOR%QhdrT(8;1y&FgDV8wVD{}i2f>T0=j&g_bVQBD1A
zapos%$=5z&ojf(<lx)>MGTyZ<<equvD+MW5FPt2ouSK`CnBEIOi+4H9pO)m-baYbF
zl(Tb=e#J849~k(euEJC~eQcr3p0-3X-5xLTX@2F-;*D-^YmMey`zd7^g^0M=9jfze
zm)Nu-F8@SlS#kaGsI{sZ(u*iU)(2P*zC8?&8q<D05zIw!OPP0*5ecdF&$$nPMNYZ(
zR`)%8!(epx29ICAb2+G5`C#8>4E+30PK}`*;$vlExwkm!zp<t3e|Z_xC>2s=I8%Ve
zyL`sV#>U3XO!I_6MpVs90Mjvams#-E{ggZDpD&MZ|FgVoSd?zmJ5uCX$rT#1DQ#mD
z0=B;iT9?qQY&ZTOUS8f<EBXM_aaN=L&rGiszH7<U*QR78HN-tlOH6#_2BS3zdY87s
zP$1Pzl$qk-;^vo^Fez4t4wf5C7#kG=2MP&EJTX~7DJ)D=laEDmMeEU{WG8zwlc~ZT
znAvR2xFs}{5rdM|G?L$~bnSo!>%23v>f0>w*PX*dDoV;~hk3{JfY@fg*e8^fAGW&b
zP^p!2R3!vWvzSerX<^?_6W(n;R=m^fADu20uV;`luO8Byw!5R-lA~S{cIeb}CW!6q
z?5tV+!S-<9+r`O_@5Ax(vA6s^gQEzCi^}X8myQW`4cILmZcbe7F05&A+r@A@eQyXw
z@x>`Bl8$E-eJga_o@zZ&Y68vHBKW{FErw%G3atu9@-<Y;-)(yOtBoFTIc?tbFfB9J
zth1TzROWYs^V)EU(`7M+v&ewY<@|@%%=Fozr5SfvP-KPWfRg<YJGMz<KI2dF)zj+q
zo(hA^(BH({1)UDe)<s&!b+|ZK{jzfD@1@>YscXwVHK-WFFUZ`vx1{zY9`&NmgLaKi
zQRwxb(E*8=3ai3%9f9XUP2mR-tJt&ld-J-~Z@S+|cD_#ZPU%!&*E;G(R|~XUx4*df
z5~v-+Za=W`<wikbwquV;hWSqKnV$IK3_DdS%V2oMOW2x5#%MjIdYWjYv@{tR%p&R4
z)t)W#>Gp+xfDhYZz;CLDy>q|t+(t$Qh7#+d+49zUYc+Q84-Ra2`5pR{X;JX@^-eAu
zMR_$e*h(5Kq`%P=JTY2IUNR`<b7=(GAS<H3+{P_~uqUq0&(~L3Ru*IFtHQUXn0GFJ
zmUjT)u`fB9qau%5oMmHRKp;3-;}p0!G~BNvL2U*%iCbkTRB+;IYTTqu-^mwyq8r2T
z@bUX+6G5uX279%|TyB@M{Y<TV;?SNL##|47BEqoVM0_qEAtxyis!{#HV|31lh``e`
z343vE;(Pn{?eCQphj%k(T<$3u860}MDbHF0?h~_o)K5tkwlR@-{W`;RV%X-%$`Fk`
zMLHWiMpZgKBA}ErbmMmDPtk3WhQ*3|J0UwlXrsuM5>aQ<rsLw$ZJE*Ji(71EC~>=@
ze_&wR?f7@?68?dZnApnp&kGe5&f=NF?GI%JBX+0FLHWx0PV7rwfy8}|;LY#riwEbd
zt*tG_=1ikSz)wr)hoD7Ea4O5&PY|FIYg>{gDQJQB=6!!zSoUdu0F*ZGRRR%mI@nXp
zMbbr5i%}vQIjWoGPJVPjSlA@*x+>76pCO}d-Kl$cK)4(=7G+V}fl(Qou1vV5=6dg7
zWuW+xWbgcDdOF+>DnNlDYv5OqX&G+ztW6!hEcuia0x*rLI){nM62To*mYk8kzOkyU
zdQoX<t`{6SgQGi-I1Fxba1?`>?AUnfmUNGFw$c@=W9RW8OZN`7sj1|t(^)r>IZ6E7
zMzPrjh+WFV)Z9+m6|rzRxwt|$dw&1?0@}e_FxH1v1MFJ*XWx|aP<U{9_x<}UfTHTh
zk8g!6Au3#Qp(OPVzyX5N2+XS>{YX(fJ|D~eJlwu^E?xEzsa{(4X3RqlmYvn1wV#3_
z9L094!^u5ffh1^XoVS(oG^~LkVP1t1yV92{N<S{@;Uy|l0SdtA9Gr&_(^xPzeDTbX
z8Z81_|3N_+=p&oHxVOJ=o9P~_B=ar(j#sRbl2Ug&b>u?Ys3+-TyYZJ=^v|D%#D;|j
z!@ds{6&-!#DhQ$cEj+y&STR<(Sw9cmGr(4lg@uO~5gtC0DZy@sy}aCC_EyUC{jY6p
z9NV>i%^Jb<JYavMvLTwmlcia+sAIguVcCy$D)(;U1mUimrv2Ihds^N&SR{3=n8ECA
zl8~TOlV0;r#D<rA^R$elmvWp|tJrVc^Sz9)2nK^jAK$M#0e0RN66N&X*o<WNKY63N
zfs>3hY28<Wj+x$zuCu+1T62t^YxK<kSk+&WFR_DvVYE_j9?nfK3_>b8x+ySWbA5hW
zeY5HH?W3)@vUfW_W|KjOLrX^&M!Ogz)K?^WWIh8M&^n97bqA32rApuoGqR>yaZ!&|
zDZ`6BsiQlBTNlVol$|{9oDMaD(;<(`v;Nsewp=3dBQK0~B7Vo?%^D{gb&G+t17NV|
z)J@$+e|$WCvEip;y)2`bA2$VvDQYjr*E5R1IY__V$SdD{F;ujxN|V3GKP8TYgpG!A
zH+5cUZ?SVOCWlq`&<DF?oU<e`!Gjm(fqBX+?~IHZ7Ue#Cxbf1V*tQs<{00+~waMaP
zH>1g71rsHv5I#1WlDD7FaDP9o?5Eu!pwRR&GOpV);YUV-K689r6-aB0jEvV@jaMvO
zhQhPxq4I2t)3MQHn+#M>pB5O-@{BLJo$fod6=Lh?%mGi%5MeABI5;>6Mv(v__MH=E
zb~cmjhzidjH=7>^feiY7x>xC1(<ypaF5iFnl@E>%Ba3$mtBJ^}=7|O$;!c@wIDOF9
zsH@1bYFD_dUvpTxl^gGN@XjdYi^E=rxmlZ!gz)obcM733%8MGsI+5EWLk#-x@qn6u
zyG)~lHlEd*i`OT7bfP3h6i_%sNxF69_}%_ZbIWVuK4<a~z-LI8CQi;TYxsO~TAQCq
z`y9_v#?@26V-Ed=R%rzBeyW;IAN&?6qTqG^{8_-^BJr26S4$O0l(Moi;BoHTX>h$b
zWtgPVe4)i7I`b7vSB3)G*@j_$`@{D;*gL2Daj}b%>(dpnu*e@4x49f_OU5=&or_J^
z{Z{R96X^jeGNsRJF|ovFRBEMWBpeCx6%{IWc5F@mw2S)`QzTl}wNxF^RoHVOhT2_$
zS_E6_ehi;}?kfAOi6W;KY23uz)YR<cBH$Yq=!zKV=@D_*MAUG*>4B&d`Z>vXHac$Z
zwcm-2hjx0Ck0KpQ?6-c>sj+?a`MNn-Q6-z~$)paHGC&wcGC7dub}tt^;<8(2Fj;<L
zi+%u|l>cMK5GCjNv|JpVMczvLi6VRcCfQ^WjIzSQlsvgRSoqi_&P}TTfPi(vfa?Kl
zOV<kxr!h7r3Xke(gCi^Z=(Z@T)2W$!C@4%g|JYro@*B)dG?d>E<{&eB+Vza|IZvVD
z%+QFv3+kDi^hk~i?-{b$Qg=;l-(<$CcP5nb*3D)3&*`a_uy;xdJ}Ej!c_8iCw;r*Q
zXNbB`z;*npd+Rv`MMtz|`G-i~HUAqIXV_O_x7mJE<-!oE(f1#5O5)j&w9Len)ynUM
zf;Ml0NFTfKPCfl{YgaQgG*r(>3MDsm<YZ3mE>eO{k$#U}`Q2;(`+a;K!`64*(|#CV
zWvD-#|Dx*empjOzh4oRplG#k2DOAw)KLz2FPeuK<+R&BEO~Feiv0@J=j?X$^&a2dP
z0t(Q8%*RlJJ2;@Uut|mZ6qJ?4b7%{!a6t#FUj5#o>M#bt3af)-l@7>iwN6W=oO?K>
zRwfcEG0>LY+TUtCd_P?+EE-7E)6<iDYmA0-f|IjL?Z-Bdtpo%bz-|gw^(4GZSKe$h
z-qVZ>%D#1DrQ8G-3?fl(yYup}G)I(IQrx~_Yi3*0?XP9Oeb<$sOi}5z6+l_z7(-C<
zj;;h8sP%n`)f{(e&k0Bt@(`vv)|PlPh^|Rn(<)`3we|9T)bd0%Gw*0a(-e8ZBjeLf
zeF{pdUuwMznNFkLYH@+qyVha*5f9_TY?gOUUa`%%Nj`l+*GJElA?aoehD+`L0O*t}
zk+%Xa5!kMPjfufUO+&S^dO7T|3v7@&r=zDZ$yb(cY44X45cmwc@~1za&R%(dJerG%
znYn{!@OwxMXtR10WcBsKA|fcaNMqu6_s?0JHqQZsDC;g*vF4NS)wV>f;e|upuoL*~
zJ67Huw7WZbquPA|vEn}Q!6Im|J`D~Jr_q#~zCj*$Uz;y_i)5NxhjmX28;h{CS<n9E
zn~aRF5j83UDnz0ZK31g@5shfLc8|5Bt1yta4YH@D-u@f=^PHQ2)ujI1DJ3-(wkf)R
z>G})CZ2My*#BuK^?(9v80=bsLG_Og!x?v>3ZM-0yGVw#&2lvL1cmevnL^BN<$${XW
ze00QE?1?m!!VoWyql@ON+8+rIwsuo=rRmxGN?y7nBk`115rAc-i<zNUtH=>W9<6JQ
z;{`R<;;$l_PPd4!FyzJTF6y|ODONNQ2xlEk?SRN3vqu>?n1hf{vs0Zi6%kQdJbvc;
zXdpQ9>PLC;FGeq1*s0NOae3T8qP+Fjsq<3In%nOLZ&Tu_5D_}Eyscoj7CJH+0%dU~
z>|5L)T%z;Py*o)Qi?wJLVFXAao_`0J?Y%Es&Nug;!O&*c8>9U6a2h&AcRx4&g5>99
z=4smR^ALl{pX8%&l!wE=LH}!K3h}odF|h{GC=yc1|5hIDe{W<QvkDR%XTYKYBN)Z@
z9y&T18QIy<R?D_8zjf}lT`2+Q)i-%bmSI2!k}$n*l{T)dtd!Hc#M`-wG)9L%M=J4s
zf;{v+G<0QsT|F{N!JnGhdA3L0`1+4BG{DL#|L&cPq~hWIJKMXv7^tWi=;$=Gw0}Zj
zm~#pMoyDu)C1->qgzS-7**{D4!D$9Pw|^!nF760)bY#&!U*DFw>h7SwRfORdjD2)r
zCkRH?)9s!4*s3E0uBw8<ufcE7)JnxM#b)vvr8L6eadmx?j*}DK$&3qNu+-&?_SEi=
zK*>eMN(T$4hT{T3uX{Qix|^@DvB?&%>RVcl)|B}HmKf=#=<4da^x_&OxHXlj`s-kS
z3=QNOX_8S`^qsA(_t5UsQ&K*_%F$nri-`EJvRmT)sF@i_hOl=wF>^q_xw)x8nuut9
zBv*}wjH>ON2?oF8uNX^254d7tV{1%KsMVrzG^(uR_JNu4{X2Y|IZp2)ox>4b2QDg$
z)sQy81N3UY7MJlOX8zfqWR@&~j@udEv0bu6uSr0F2dj9PGeJMgP?sh}G{9SB$AGlm
zl5m6T*%OQ1Uzi$1u^_>geQ`9`1dN%B^Q52gFdgHQ&sNB9#KN7bwpCM-3PZO7JwoDb
zWTbjri~2==p_eZcKsE@&8n?YL>lefQdNk&f)xwX^a9(i20kX_Ezp<`HuUW{$#pQ_#
zlbm}5Oy|I0liJ`u*yR4bTC!&H42x=GvLszTJdcRW_F6r)b&if2?|F|12IFQhjEjuC
z^3K*%S2x?=nn@S*IxO3oT)^&ckK=G~{QX;7qv{|f9gIg%$r&wxGSs>ZAYi*n6wjDl
z=Kf^TnXKQwkB>=A+-=cwx;7CXd?VSP4Z38_FECszw^>1zoUC<82T_$>?s#Wp*|#V?
zEq{OiSSH)b5>pygop&<WQq9O8-IUGDHi5Va*A}Zu?@KW;#CF0BXg$k*Fc@gn*q&i*
zJT}>QOfD6*yU?Lr$^gA#oZQn5wvo${xLv$^NBbJ%%q+&*6D3ac;{%1P23>LN+H>#i
zqV&^iBqf|g#|MbHoc-u{VDq}64@{wz>7x4^CP(X2TBq+Tz|^V1*!7y5Y<x+EGqjx7
zRh-+v$*VMbB<K3u)wD0Z=W{vbu{ow3M_Ai0a#Kla{Iqf)N=xvd#&Y|ig`cYC>+QWV
zW&fnHLb_8jOJrj2ct@Tk=zGH$Z@-k)Y*MP}gzai?p9AR8U=dc`T~%Hl0J1f%YMq6s
z<Kus>odS1Xb-PJuYinCr{HUxXXykRGe)jAOcaRO>=zz1Q&f!MR$9LJ#<a_T3ZMvg_
zn~LhBJ#}xsB|xRZ$kfr1E0l!C=GWB41{fmllZ-E2F4CQKi3^^rFzef|^zY1GOkgR*
zaJht?l=ZPM!%z<j>5a+E#)CEX4-25D{aj=q#cz2|$s5b38}Q@ncBsTssp;5<`Nb{}
z+!PMwRZT{)SXOr&bYx|<v%F3GUOib2?JJ^TxOu#5gV9Nq(}i)S!l`F?*t0g8-DI4}
z?b2jqP5IAzy`@f#)>4?=n4q9EMdvAp)2dn=Z_D07GP(;y4hacgrz4Wyx96KRw*lfz
zG|pXMP{8MM7=saj7mb&zUckf6ZNGjjW@)*jAa&dOvtUE1`P3Vyz_k&Lp13NYm$JgJ
zTu(0*bQ~pxWfR2?6H7gs3c+^dvXi49N!=Oe$wh>Pdt!NmlQMxe`Gb21Bx*l?e1%T;
zaBD<VP%!p0dXIFxk9~eMei2g<qM2^Oj>SYKa4|KR844&#G08{<vwJ8S6jE_X%2Xz8
zZEcZErsPB?sx?*>8WIy<yaMD#m98IyJW!Xp@60bVIu5q}`t@F08xsZPgh?$pD3plT
zila+MPfzT?!`=P6JcmEP0D$l6Iu`;Rl!!kbTY?)uutJ#)x@K)%N8()ISm7!ztoyLS
zv~^5?RPTl^rF?cIo3IPYtJ70Bq-vdxYQKGBa2W~9m|vd+qs3Qp$HVmk`>jiae0p#3
z*RQRh4_S$ZUw7Eiu`*w?f}69%($ZF=z$7y)ja)H;!IhTG8W!2Fyr|*xcXqHL=mAA|
z@7(B@&sU^AyiqJ>DG3ShjCG3)clzt=-#vSVe3+`q>jX2GZ?nxHS#h?Q*?aTmjbFeZ
zF<&`94UJdsKy7R=%(Geg%A~hW&~S0hBgcyi%r0BIat#7ErQ><C4fMnWKf$c`U}GTN
zwZ>6Fd(jU8#|0(%8!(c(kM1OU85Up9WD2lJcmI7Bp!4fTY}FwXl8nUqc!B9fbJul)
zC|eHZB7a-op=>3YUjjGoZ4gsP;z^$=V(XE$M^-z+bk92c_?Y9yCsOM5$xL0qmS%du
zG8h%fCxZ0)d}r>AQrR7M8TWerpH=_}5^mUq9S$}5E=J=K%HN7Bd?_8zXD(CcN@f7)
z&0|WlkFR!a5f!LjjSyH{GdmIxWA1EDIYlMJPCqI;yLaSQczTda+4N^)qp|8+;pYW{
z<+Z*q<jbwNP1LZchaqWtx?bsUqF@z_6M?N5S}w%Q!Qsxt&zvSr#PD&C842W)A+M4c
zzPs2S|9A?t*Ysut5n^SZ^%wYWj=+C&B-`wX;n~#GbQcY6U}V;3K|)+BK|pJw`YzXg
ztJJ^_r;mke2o3a0iwg^0?(Tis62ih#Xg1s5YbM^pWUDrgIG^=YJiFhe|B{5wd^#*T
zyv$}yJPM3;y!NvVNho`x;b5j1^@g_|9Uc9&&>%i5Gjm5@S?-VNgN2xw$%p>j+}v6f
zR-vC`oQ^gDUC!BbKF*4JYFB4<;6(bBO#)O~M33MqhWQEI;K<1J)t_)N+k9Y5bz^s|
zV{P14*~e5VSF^}vBFuhkM*dH4;=s&NRr)>73ysS6eXFc%p8j}}S8E&VCQDtBxtW;-
z?=E95ZexH<SM-%;t$aEL*3$Oj-RDm}7G<-{5$n#q!6VSLw@l@wJ5!KU484?lc5i8#
z0>9}@X~(ac$jZis<znb;XYi#~Jh~O7dqQWAZTMQT1TN;Rvpg==xyxEBYFJ0o;||b&
z8_MGmEMFCu^q(W&#NRwf;^#82r}+b5Nt(2`vKksSovFx3=eXBz!HyYE{W%kKDmhK1
zxzVGvw*x^pXh3g1JwUlRvRX&U!b1Cu*&5VTu*JE@{-@kxw*Rw(wfH2Sq_Q$QIl1TO
zN2phLoA{2fYhI_twzm191&n<Fr~uUBZHW;|sLkr=&%wczU)XJ6*I;BU2pQDT6+Y~=
zMasZl<}Y9KpMd>tSLZ5=X}>%17SFVor)6Gm^1112!-$TO4l@13!Q0p%3g&S+bOv3V
zu!jeCsX395inpuF#Rc*UjatXkPEK%(9A1Xe5)ql65)xr|E%sB9Cj!}-LLuinbCiXa
zEff}qs>Qy^ldNi&rzK~wE=-q-WHEfOR2jQSr^*z1c-hzjd!#@TcF&`d-QZ#IDF-!h
zU2gE4u`u}*nGX*2-95%!x_)M7qaM4?1E9Lr<@Tsa&sfpYh(*3~V*Zsh$XT6Y(`sCt
zp<!=1&j$02$xOGm2+n$!vr^vMtdx{Lo0n-qtXxuJn7_L<oG7~iNI}BoJeb-sLOoFX
z_3P^iw%qXiw|d69UDMK~iZo|nC={`*D*}5bhhygl0_k2#AqjcinM-7>CHR;V@mcxZ
z_^A4sX&TzkXkPp2MlUlyzS{jOc2cH7;XVC*xwYYdklTC~+YA@Hmb*5fil^7AO`;XQ
zx*^Ch5_abfi`nFBctc?%$p0h(L|9HoL<un#^CIYmnhu;}a}ot51&Qx>$LrW+{#cy<
zLimWNmf2;zIilv&Jv)@Ld0=#T?g2N++JxH!qBiZ0qKdml?LDHRO(s*S9%mx`pAzwz
zmwIcvnk$=N(CYYJUq5st3bwYOD6OhGgIn77sud4KpNoqN7IN1U(MHig={PRQpy$yX
zAo`>G);7xy+Hm#q5BM&b%#+CGYnQ5xk-bAI1v+ExipI>$%&;^%+uy_|By2gC0AT@T
zYb3W5PQLp?4qysu*jH$qP9+H~OmUZWMV9>t)m1y)Txu3}p{@wY>yEvRj_+!5MSO@j
zvoobKXSUexg^>|~1Fa@YJnu8Tvr;<i#TOh7t2ust`@K)U1QK)qM0#oZ^2+0AYpUkm
z>>PrbgZokY5tsc6j|;()V-pa4`d<X}Gl4)X&GI}WsL|9UC)0VdoH2Xkd?+!QdBZx2
z)tF0f_a9c)5-B2XB5qe_5PKIJB!ozL!N``rskQapS{Uq9&4{^7Qi_Xh^5b|xxTF-h
zsc0qQ!x-?G&tkrruKkr{B+Jf0G`o$3_{)zvDL8PuLDjcDx+5P<F7=LjqkHP?uDXrF
zSGtN1mv0<$Wgj}txfftH`o%Mh&38#?a+-F2xqa9fU-tntq#)IV^bPeoGjwDmne03N
zf&ZByUUYnN8_szJMA$RYfB-`Fyzik$TQmGtf9@=@C+UWPR|GUpWbN{DatoIZF@@rn
zxg}}OU}D4iAee&edLtZ83HM*J>{ldzTHpwvc)4GB#xei|P)9%~DK5`!#~ASzRG>}y
z8t-Mt!}>X@eJ}7fgK)DlGcsh7^ev0`QUsq49p}#a7~I3STVuDul?p3Glb0(CaW!YC
zXuj%IRzWVIb}ryGNgc^{1gxn2u-S?VWvjNi1~h`g|86LKMV=nD%-s))kg>6obk@wM
z_mbx~?L%dFo{*BtSDq`AK3<$rGX_;mnrBFW#p@Nr2S`R}!g)+ub5n(><^A?{vy<+U
z!jYLWCH8UHJsGK)v%tRwv&6x{0X)Q1IOFBB^wZg_<!jmHCA&#gQ5%pDvE}{-L-YWH
zG>+Sz4<6Bs2CZ)_EG#Jnu2+{Ac&<AJd8|kZ(*RH%v;#>P@z%75hbK)orJ9N=B^4E{
zNb8UyAL9Tf<;VbI4ijj@gHO6q1SF&TzkpsR>i?U#nEzgT{y&;dlM&h-%N-vXiI0V)
z@QO%KP*6;)?egM`(fR40&5OXQ`zil;T^6UseA4_Prh72K4ZpD4^J|2P%$bZkqy_Q6
zZ~YcO4E8xtxM40SFf}}dKK@zjjgS0cPp&5?6X3bz;^tO{VlTP<p4KtKJ^8&EIXQ(|
zTRZs6?p=>D2KfLG&8j%Y|D+!J2(V?bu;jq%McMWI*UCu#ROHo{kxldKWCNq9^3MV-
zjZRLL>T;%U>%N0V{{OM(M>4v3&Hp`4K3E<ryQ+T*89I-dOj2@V=e>i|$96&4@GIr{
zzdHGoz3?~w4<F!|)w!jYCw&fy%8H3I)6)l}|JGzGcP^{EFqrtZcP{0U7@j?2rsb(l
zNcfnU2j)SE@O*e#SZ|DgqpO~z>;G)Xf%YW(SqDrSVK}ygtVZSUF4fZxe`u8`q{fj+
z9>?%4xpkE=6@i?#zqcNM?F>{@Vh|W`!U_pAn`0&L{2ZIVBnMmON5TK~y*9622bD7c
zlg)c;<EqFakbe(vvkEL;I7RO-L(Ib#U$tsc;&<zc^2z0yI%zoY%x5Y(Xi`E`)raeU
zHiCFfOd66Nmb$bC+xs$gm(0!%N&e(YiRhpHYLf><@_k|^QXZa|*|>v|va2Ui3IA_<
z?^pjIW#C=EZy&e7K=b9x7dQ~`Hpk@g@$o0UQy><gC!T$&;e>f-X9tEhDGig8>h$zm
za9hJVK9Gc4e<7;`0PG5`+r60fM`gDUw|Jcm<IkeYyf8>~%l|t~DC;evm~|z3-E_qq
z+FabObZ@`qh_grO*ovE3c&N<a-s$VkGzGbTo>tvYn)J|A>=<6_Q}21vm6d&bYk-sF
zt8<l^b~F>Rn?w9gXs+GVLUW4uyhfgulA@yK*@z=`TSwQ~Azc``iD}N%Bryd=dan(<
z<S>UaF*T)Zp7??2I6o=U$kz%A4vl5De>%}!j9&yMAoEI1jY7kpvyGyloF@1iD|Kmz
zmB9nh*Pw|<?agmuSQKBsE)T8I@aF37*6{Q9XJHw1I$Ym5-eE3<<gWLi)PQr}bfOe!
zAub0#*5NmCl}GRg(hU(HNH>I0`XQ{u?j1=XH#c7sT0vxEwltVll8n5E#uCkLTC<YR
zRpT`JLX9#pY0~vd>J{ef=k;}NU5bU26s1DU|Ina4!o<e}bFEXRa!;H;0V{Z&l1JAs
zyzWcj(ksZxWy!bf!v-3F!rE&PS@d4EEHBGPe1@;arOugdnyCb#J9QouP1soBxTL~M
zBQb8qZa%d#kuH7Vc<|@XdxP$X!_@<0pSx5PB6ka*E25#Mj*5=<$7A%n9%`3ge?~41
zLkbeN$zk9PB3TeqVRwXw)V>r}QSoLE3Jq<NqM>X>yL<P7Qn|amy|bg^{@uHT+^*k~
zNYg#a%Rd~N=>kan)X}kec>mxa%f`O^;jXpyp0$;byGPgUeb$v}#kT@6s3bjVF@H$j
zo{0S4^emLs+7w_7W@TZ4Lt!)>Ug7GoP%H;RAx;X4GNJkI?r!Bg^^LLQvl^$PD%%YK
zvXQ)sKTAtm6{ozILeXSAJfvXGl9vZLNC;g@R|A}k53WzzZPEFu4<AqTfUF%-GFoc;
zNRQJe+!%oX?9U>vzfXX^>#OzKJ%oZHwp@-c-$;e|Tkvi2KXyKPwV-wf9lfKqQ@z+C
z4oE(Y=$tRq%ZuMlKYsPoEoLS$I~$m1f<NzixZOLt2X+@8yD%S4uF-szs!eba05dj6
zwdAunm+d<2HJO}8`CY3);>SZyUJB=)KlYe!ETA<0ky3_JK7$b>R~6)zAG;1=@9K(v
z<QNKrPv_n9{rxfPC<uS5uwEkGGk)k?TaG~x6x&+SXnP!NK&)o3gs_7FE)d5Fdh4{5
zmtO3@t<cH*{{4H^S@gpp7FJfuo0ApB_nSE3!wmbftUq*d5E3<Bil}jJqE;g`rV<mQ
zhSlBW<cY7WY|Qc|q$VV{_@#dn6BSka&s8@(D1R|cMxB$K%uQs^Cpch5yJ7*K)Px(z
zcv9j*22DPCG|IWD4Im;vSeXhw(QCW$Y2@slkHgXIQ>4e3|2_+t^~;)Ct%R+{=f~o?
z+v1d;1`57BIw-ZdE?ZrWm&e)*a&@B*n?*!Gccx99o^8DZCYXM$zjdqA!8)VGwoLcb
z(Bg~7JRbnlk^vD2ho)-8ypFJgA1%8|fVvb^&8$LCcxwuAsfKZ`sdD5ZicwA1ybrBw
zq>L8M<A;}ob`7EdkBQjL)X8YJX6oGjv|@Ie!>10w?PSlM$tUrUkttpqkn`r1y0R49
zMwi&%NP<)T;cUhy`N`n#!PtKmB(Ty_Q$gk{-w6^?`v0(sf&IwFGf3E5Rn3gAPBHpE
z$(-g&;d5JDl;aN+VBPDt6w6ua#6xMwsi<V1VPa4b%{~}c0_#+Q{%rI0oqq-c+pWop
zy^y54S=+eJp@pYvNQBGZkO8sYGId+-v!I)5FzMs0PH4?CuWisTbAPcXN-V6D*(bq#
z8HxY@|5X#LDE>DE|6T7zB;n`~djEV2A)>EuXo$Ckkdl&u7&NkID@#k4wOQH9Nw6Jh
zt+7>upE%8aV;VlkjqobceY)Nx8O4Ls9QoEgDnNq8$8lOuSExz*IFF_W5?6FZu%>^9
zM7qO<mNN<O1~{c)Bxwj=#>N8!zTtV-xG8x5B(CepkK^gDE=~a-1I5|;fO5X3ua8fy
zom&SVM9NGLH%FbI-1zj#$Y{0E3%ze>=o;%*`d7nW5(r)KK$`#9KqsgvA!<-001pVv
zG>3|T_FFl*YQ64(fm`J}!KSKQ_wc!P0oSme4emOvvyoHS^0JwlshvM(5&s8F)Q5)~
z+;9)X@fzHy8O#$ja8z}!2;m;D)m0A9n*wXjj}L8Dsx~m84vcddvtEMD2qFw-grz0j
z-BX~X07A_1#=oAf_qwJ4KZzrsu08lsSiIg_%j<OU23i}qAi)6&`A+0-qQ=ww8*8}P
zn*)eS-mh4}vL_30JO7PDZxn<Z{mlXKgQfnuEdh|;Vy#-D6B$rCe2^U;6ElvZwLI-|
z2CDWN<CXwx18IFdJ-WBWZ(%#8tb8`bEhVj4;}{wic6r_;5#@R{o9yEQ<Y_#3-0O(0
zE1ir`lN_~br=GiXn$^w-gOUE;-j_g(<#;|gKjj6)agc<S*EuBT=Z}<0n<EeiaMJ=3
zqx$OiQ*QHlfaBY2rsU*+$NrbarrI|?vxYyKyj74j^DzzzDA)y{-a(an#-ibz81g5Q
z(>kiQ7B1lSxhAy9$v7FNmf_(=IKKB+_i*#cr3rePRf&nWTz5j?^2uQPTkO-wDm<g5
z6_D-9R?gp0ElqidYO7i6d=g-tM?g^t)S2Otf%&14fdO>XQ&;rB>KNypw8M4Y?Uexo
zqD|gg)ZbtQNI;O6pWeZz2>%@v1iQSFf&$m0OF>!Lpzt!~89rzY8-X~-GhJhjFovhO
zzV61~=0FK}-c^;;38Rg`lZcb6TwKT=fuGJaCwf4hh-hP3Cwx*!v}JiY#0B>gUyYOL
zc)4r$BubOHghtfYuRqe#Zsm7@xq5Jr#nhC}l#WjO=}%EJX;23wa)IyFb$8#v#3UwC
z1wh6~m+03QL_%p{3BnR0E5v{QkOnu}?(7!>XMxWZ75Kd1m1~26J}3wiR^UPFw&mbA
z3VV4s9%CccaetZ3rFk8`P{T&ELV>(_o2ojo)o7`E>be>V3QDvRUo@F12;R8cqzck2
z#BecaXOZCDzq<AJ1y*A<pZ3#vh)O-04i7T=sv4{DaESj4@Pf0Oo*U0Mca_><fa))X
z1>x+A(?w%wIzHG2B#Vx){H%oT$uVZYcaN8B{pqdDt#hj%?jjtuQX>TT)jPG#6U6Xv
z7bGOAmHw)LM4BstPy71{o^?VZO;J&JiU=J3tCz?w=MQfJQTq<Y-K+c!cOX3g=`J!V
zxJQ@~8yRVvM7}2WM_3xTsNC`4c&b$@!o+B-xlr}4%DVwO0o21j_`mRu{g;Ap2gTu%
zkLPo8J6VnY_6<xr+n8iz!bM!<APzA)H>kaQ{P*2CgdEGJgVIl*TziN$z<3Hj5Z^;w
zlC8C~&_gSYSZ>npOyYlQPcd5RU(P`0C20M*ZPrDaq*PwMtltYR%aydgl_m8JR@51$
zway3Z?D_DxZG&NBARjV@6aaa8eTTtEX^xf^>9=`tcq6OV(7%@SaHRaN*|Q(3eE0yC
zYhp?8PGp1427Z9sf29WJCg;D}sHmtQa1fT8`y<ocW;;nJFuMSY&o=!lcuYU$(`l9N
zUrtSI=4(FYwE3MKKLa6fdwYA(BDf9pCAZAa&H0A+4#3mGAoJ+@0IZL1=<VIEudUhQ
zuf96&3y#CV#x@<RtZ`}Sw#!wee_PJM%<P*xoF|yBR%QljrP<!fjj-H_514&j(PfTD
zD>DtvW{c|;A-LeD%UbIkvtDB}ffT{lChCvX1Rm}0=i3rOVfm|`{%^RG+XGI{F-IjO
zh*s^}&zo`r?Q@0OR$NDTH!K9YBH80}A7Ntyd8#H^6k}t&Vyfw&+1TEm+IjB~(!tni
zRavgOa|x{q3nBjoZk4Q#Oj9+W9s>0I)fX?hn_k2$ucSey`k06a?^y3&r9UkUBxf-(
zS!NyQ7a<oBW<7?EV})dFrH3J%K_MXt>CZ&($tx)(iNbKz%uHH!d|Yk;)J*IdTJf5(
z%uY)4X<h$%<lz;}l9!d`1MfD_D=2@g@V|Qy3PXne=@sBR?LS1W`#Z2WSApp~9Jo+!
z!KtQS?{D$-b9J?!pUvynucs;(_Z5Us&YpZBH@qY82nzm=o*vkrogtpX^hlu_%w-w3
zY;6x9U<*(tehq}4PUj1Q-pLT7d2jHazvcezyBK#*&c}>r&mExT2bG{~Ump|%3UNV^
zkx@|)mZ>rAhlM+osmo>c%L2S=o`!}Q@qD(`=2x#^yoNO^GurqP{U<9t#q~>+$Pl9R
zh>*}}?Jzbdx%nP3%eSt24lb_s@sjWc!uC~@iPB_9l7${|fmI+>I-V038(VS!_G);1
zItswXgipUQ<quBl)#H_5iU+fUwC~}F{MaKI%@=$rE+z(B@ps2R5*s}+v^#J+qpRM{
z>a+}-BE}~>O_mOGv03^PU8;bs!gq0si-iR-fbitv@s}bau?ncEMSqI=`=L4>lN?!F
zsCiCGT8NlGb$(%KX{lK;l77E><?ejTPFjmUkz`=XpZ8#Ty*{HG|31(pk`dXv2bi<h
zv;C(~tXzNnPp2+_hL6@u)8v#CJX{h;4&SC9@93)y_+<2N<%|l^BdwWy_&ZmpyG{84
znRk(g{x;%9@s3J3KYu=j>p+O_Hq!C^jWNS394svLx;Pa0E5_G%$#p}$xjNam7km_&
z{Q~R)@NGyS9Wv!H#>Rr7R?EwhzonL{ckP*}Y19CWe2|VQt{(#U`mY_Q@D2W_!^bh-
z!@s_K9T^!36#vwY`MHNY{0>Wti=d)+JHu%?p8yVH{{VBuc+POHfJ3~0e?K!*b#>iy
zax%s%_PR^X^VOwzph6*?i~TLXHuh%c(`(KGx8p8Lv^yF_rN>s>-G2#7C;__mviLfd
zf!%D1P8M>3>x{QPnHLnGc%T5(t?q0aW?^t6hzbcY)%`x4x((i-H>QVLY94-moh{N@
z3NneEJt7Ejn1Xm^@92JOSDUU8mW%#!aHG`K>C*Q42@O7e3Afa(4C;T~2zZ3}?jBx6
zL2u-k#L(~D)6q&w`IMMgoA8dc?svm8Qonl#6D77G4{!~PZlWtTJ~Oue+Tg~-#2nA#
z(tTbS5;6!0ti)4Q8QIxPtUi3q)lh6_y)v9_K)L58Cea}yCzsPtd)HeGb=L~s<#Q$<
zcGpI!w{PC8UpPtg@@fDChu)k7fmo?e_!dT&OI7M{vg%)28de);<}A<vOfx`B&Mx6*
zBqqL~c@`WUU1iyU0V&ObqEg_I>2r^Fd$*@A3E9U|aeU$N@g(@zE`aJYF_|>B4<z>|
z^z;ywd90^nA|zqsw0nNu)FB;L)A_n5;bD~CKv*mbJzd|0zt_aP!NHn}TnY2i3rOXp
zq^A6FQEhk8d=>~0h|hw8jRb5NV5FQ+Ncg5!wpDYrJXUPkC>`$-5X&K{0x_Wsa2b=5
zlCpG!=ertoYbCJ=eE5)(>CK4kSbg>`AwNAQMX096VkIgywc^LO2dq|`4WZEa_R)eE
zq?+y#(cZ?fcTraqn|}Nzw?&A?(Zh@Ma6YG#+7BycX8Pg-#d8osU^@7Nk8TbUou>J;
zq~dFOn+vc_NlRlPe5SSaH7qGwemPH+93|NL>Q72;Y?3^9|1Mz(Oy^_P;pS7dB$)Vm
zMn<%xwCYJjfkz|~IX8z+s(ShuMFV0h9nN0V$ODJ=;lr5i?@V;?b0rA_wR*+SShj68
znS#pN>hOHQ>4-QrB@I;NX`8Zb@W3wnr(wT=Fi1wmB!R5R$WUS5?#@mYT)m*Ff1d@g
zG0_&pf`9XHojV3f`{wzYw6w~kq?@LDK<S;Xxq^`{L|LO@aTdk<Lv0PGLsqt>4xV{@
z{(WM;g2J2*yXfz(RYyeP(me@wF!otaetSMZMnhu_$s!WU>eFu9SRiME@FJCE<Oh!*
zIxcNCuH}{e^A8GDRpHg|g7hBE_O`YxYnmUFvMW~ecJQ#Ru@kcmcY!jcu*lj_UcGje
zfB;8db|j`$EHXNS1JotbF<fp}p9o!^te6`0Ro}J!GR|W+*EzJt&hK=xytdlw)b9F6
zJcsY>(B%M)!+Mjn2Ig2<z|606I3qTdc63AFoc72$ZWtEHbJpPYXjZ2LdIbd7?OgU&
zdU<$M@wz&$_|Vi~?vFu@LA9e**y-P#w^D%?PQvTj?BMIqX>RHI>V{&K#Y$HA5iTet
zP*5D~s=!?9iGu~a$_<#&g`M=xISozR?P!0^c#abJw>2`%5&Xg*wS9CyEhsWB4+rJp
ze#osL@@7x0n8%!U<1lcat&a3380L0dw}Ff#^sk8hNAce{bXSFZK9AaEd`m(haFbUM
zOg<0Tn23mu?22U#_4KUP>-)XZr4|^}==lbZ`+KvmbbMWsc51O7ixY8FPk26-PG5#^
z+Qs=fcvL?y1B@*(uL4n3ntS{Hx~Oy!pgF;ul9@d4<0mrI;r|)IDS|yW&-qEEitV}+
z42IM$t1ifW@@LK0wB8t~B20}iR9MA*z~a`uFZM`uz=8oZhsyq*^ZOw+?#~#hr~u3=
zFIZ!9wK4=0nrT}m7B&$7Ea5D=ov!N{CWzL|33Gr^nUjIRz3B6eSBT7&MD5uaI+6z&
zd3nURByOAMp@$o)^6{X^L@=moayKa_9;=CIOVc<_U`yaeMB&wZSm?GG(1Jdy#gBl^
zr1c5v6XY+SGrxU)M6iglI%CkDQh-In=e83y`+k~~%01<~*dr0y(ZwZ_`r(vU=U=r2
zAuB9wx*KcAkC^eTs<_Xz9t4j4`jrCDxb4cM>teAti=_6Oom%|mHAmN7opgRD2SU7M
zoC$JqUD5l{{w3P2Mnr`i+h|x<ga!w58=wBt<gL`SufXoU$mqTOaoD%C9+0QRJQm4E
zdc%HVP}j>X%%P=zjO1h9Z%YjGsObAGDxF_y`Z!aM>-*XH!rCqy=6#fRxb#&v)|(v0
zi|@zzs;!5JD|r*IFgkF0at#ocJMFgJUMV?4>1Baz3BprcdrO^PeWf`ZPS3x+x=52E
z5PgMP@&>zIoqK#8*o!Ux_<iZh_9M~uMTJGa_TIy>Vbe(tdnkMQuf@eRAjE6-a_ekG
zB-wBS6l>2sG2$5P6kfh#Ad*iIfH1lhL2iS^!C{QU^d9w;WnUao?fa$=PU)o!9-&O@
zxfcKK`PZNZ26bN`9@_KKkb7^jx3}fXmk-cwV8&qhR$8zCJQFQSbW{on#h&mC2yqzH
z3n6bp!Q5-9HA@odPFS|t%Q)X1J3heT@gjsX5xE|Egr;!eOr&(SfNN14-)3*^hQX$T
zPzdRryZ#BXsyaG_dK%1J;*w~oVNJgNzY$a{KX7m`^@~{CcR6i@B1tK!0k%rIzzzy*
z%2<I4EXM=icz&XEc4p?#ps>xp+@hLTbZ%t<fw{;cTrYI|*FW)iyV?>Horo7mDNC4K
zR{uHCabQsWd3r!s?NY}O)7cpAc(5ub7I{G*2<}c(MlkKnd0?^2VSFOLiHr=rJ0eGH
zKzlYw#M2SWT;*-V0Hv0=_;-;Z;LH{6XnNa;=LlGWTb+suQB0=BJ#If+iwR}HKt!Ao
z1WSw-8*Vmg5cRiri)d(s2FL+0s=1>jT-?UCn8J@xY~mC3+NzOg%dbLKqIFY*X8UpI
zba(M9At7Oue^8b+(%g}SAs}mUKTW2*e>#(Of;KQ!c&fhsiTI@K5oOV<f>%3|bkwAz
zl-o725942qw-&QzNVXTr;xx4^ol(D4QOTgBF*Y)kafAr3TUa>55UTaWy?LQJER*%L
zvzNl_h%+T_AgbSoJ;Pjh%o~*rb1gfbpH;#f)#Y2I-O6i5H%xh<g)g`E3n0paq))_u
z)x-KqG^Fe_M3|91TaeH{;7P;~BN)GudO+1fPWF0bXm>b3&N;+CahQ@00F>%;{&~h`
zQbB|s;Zs$1yBBjkab~B$vwD>#uO`aMitR%!dXLc1@Lhc#UoNg~ASt7Gi-)`C($YfT
zL`ckc0rS(}pIi_J9p{EW<B`k0fu}&VZM5}w<y!7&`3C|KUtjM?0z$2Fn^2fyd!DkG
z`1t$EQ?o^+^*s&kt@mxfBS7A1hk9Y9ud717sbj8Gze9?KhDy%SeKz0>3O2Zh6LM1#
zFkchoLP6n#;iOOW_mJbbCrO`10N6a^cKjMs!f5qqKq5mAdtqxTt*>G;@R92aEn94y
zhu?#*h#3ZpvIsFT3v637IaMN|S^}U0UF}zp;r3zf3}e{w@o6EB-)dfUY$T?<Ul9P<
z&+@W43$>(_)W%fyP9`(%!$*XzZEgL{DP=EDS}GV>q+swS^;Md7O3GW2GEZwJZeIy*
z=O1|vu~I}aln;|F>3G%6EU42{QsAvTpFSZW^tyEva**T=104W9-vVRaVakmcO=V=m
zNu3+&kIA?wljpjKCJp3k=_!`t)dU5Um3?=gWA*fw$KT{kbFP-gCBp&wmf_itg<_c*
zde?OpdSBrnzYI!>{nS7jNqK%6LzTsrOd%$weiW3Lvy{*>@3&Y!+tXO8C=dr`5#CRw
z5I=W=t(nsNfXvld#)ES1A&ySEhlhJ+G<FVAetf@Ne?<i++3@G1v9w&F4f(VnogeXL
zEL?WI?U!eMg^v}OeZPNGE8WsZL)cQ@Nx3f#EQ%hjYVjR@y=<;xYl!4|anYyqJMiBQ
zBC$MBenm!E<S`^Rc7}{4=x*3xMaK0Tl9MfL1((ao4~!NaN+dk{38d)pnxlloM7}2K
z1v&{a*|>n)SBBJ~raq((2#(}U1c?$pE-kFFi&NPoOcnZ_bP&`*NNcs*mF0PP(5{sg
zOM8keNBRV+59EbZb5&G0taFq*m30^A!0;J^i09*MKp;>xdLj4k>SH~WsePkC{o>UX
zHpL}O{R33D;OtHMBjRw8USKP=dGyF<*UHVxn!!g}K~d3AAvZTy7<phaX7XeG6IEkJ
zSfxKbX+aM`q(~)8qaMyZdMHsWql4`;FfbI!g?OC$+ib?=1C*$+#qIl64B9K3Z?!^_
zjwBAouO|G-AqyJ%_IO@nRFq0wdMyK=SRLh`b}yvVBz$#*!O<IOC9~@;hl*t#cCi@d
zA+inhFcusGX~z_Qt@+05+sIdm?WAQX{?-K+KSNBQ{3g)rDR)xy(<KPE^U>8J#dBN{
zLz-0~g9>(^tz1+hBdrRpJUmeNO~Wq9VL9yOo`zQOoKg<!Q8c$x)Q19OoRn)E)>rQn
zk$88}z<5ZMkUvdsswY9d_M5ykh01>$Zb7ceCtflMyW<zR1(-{jl~G0_`eA|eOV!Tp
zLr^Y+m*0yL7WK^}*R#5AA|PPm^0OcCi6g^Bb&Ebz^l1Lj#wPld_P&oW(7qXJE3<_q
zTz7X*P!)wngwIimr-Ya>Q&1=?ym_M};yLcTw)4sV%bPd%czF4XIDJ~AHDfqz!*X-7
zk|vYYmLkk8=_^LCd*5A5yRf6$zVY)1#;C*$eU&CJ8mcQTUFX=EHbAO9L=qD*SuT@X
z|4iMMUNoSzwS&^sY2c<Ha!reLTv1S{chC*Jo3Ic>oVFE(t40x!NgdKyV}Hny5S5Ne
zQw#$*nz5Nuy$0^1NAuuxklk;n$^SSp0XofgsOD1Y>Eo+#nww(`!=_nPR1gH~{j<*9
zdU&aGZA@iFAt~=gMD)3i#IcQ9_JY}+G@xYH;@Z|qLV?h^=~^v*Cx9SwZp#;sQKc^(
z9#c`QcC=c!t^K^^9x597t^C*>b<<sQnp_9JFM94IavHA7zWFVC<({sN<UnL6Wk2Oj
z;`OxSmDQ2o;|{KKE~W9tYliY^sZ3qaV8GlNrDm&`H6We~068>S2os&-KP%Q*Vwvgi
zQ-}zQwmAEy{`1U*4N}P{OVit-X!!m;7(xHDo&?lJFu2V1yXQYSHM6qnT33eWKL!4Z
zLiRoAr-}J&>MQobS0Y~cr$Y7>868=uycC|Gs2i~3L3PRZ;oS@qO>wd5E5Qs_H&dPR
zL<R2j;Ti6C?_a9iY&WrJKd==PXml8v-o6eN>m2i)sci}*;?4O0$-(~##Qaw3NlIp7
zA5_3`7hY&+s8n185c!(VSHfds;U>-{`&jRN#?^T$x4$vxynt@<9O5w!83~lh<3&#4
zsHgd<sR%RuO8qH)6%`d432S)o!>XXe;NDE}fVxvvOFGary(W0RoA<WiFEPnJefoTl
zx$K0U`D!K~?6nBIt<jqJM_yPs`)dQis2drLj5A8PQ<U|042_IN#}0I9qDL}|TnE?)
zwpP~=+$EMN52JCq?i2CujCFWTqd=|Nk49(BEg>e>A6@G@&$fC$SK{9i8m#jAF}2Mx
zWn;?AITr3x3H^!vsfZ7G4;%oGZf7N=3`^M1Y8iCT^x;YqfjB){jhzvQXKl}sfhR#W
zsvy**gKpyJ4jLM(`EZ2DiGu$nT5&O=z-*pP^#VeH3s|W>sq9=o60AltSIgeaF!KgE
z=QB_AocBegZ2K$zYE@>;E<DQvu#t<AFTx$-*&BC3_Hck*#h}cRbIh{aMHVYzhNY_f
zX`T9_DEOhyFTb>OMYCd3hVCQt{a+Cg10<pc)NTLm&NzPjuKc@ahdtJ+S^m6=B5%vN
zT5cnnncONVxVfY4$4>d%t*w5!4V$X6uHJKEpM6N_V0+m=R8f=`wk)`E2?HQh)Vp`X
zhh8hn%Ihs!P=C4kd>o4`>FdoGn$a*YSQ%?n5mobTE+NDD#odz0qi44C&|Dmf7zgdn
zPl7GLu~9!682Ug-oQzjBKEJZd$Hqg(Cc835^|Li@rxi?uqK$PARj|?;hUle3hr17&
zO;Pz(xyJ{bo@&kp%7l*5I$_Fsf4Q?C^k{A_RE9i#JDxCQU({Fpn7bkK+D2I9>9)3_
z<@E*>W!ptjJ{EYJp$tQp{(ZapwC2SWn%-vNWk&FhLF9Ux^8KZL7s@GrBQLVl3vqdt
zWm?{b7mTiYmiZ&}6$w7i9;d}@sOuPqaQ+GmlrDE3@(}5U!3l$+GHHEAR=n$U`=n5l
zL3(SR&^zLb(|?}@Xs^6~mYs!(AwN~}=xVHIJ#5S*(pdF0xc=_Ql}hfuC>m!B|381T
z=xcTK6w82Fi#>BYhmC;O$dL8cT-|FWrBbz#7g^Nec=%UIrKUs$=(F|$*Y3l5Wx(Cz
zyZ+KV+mDu2dZi)h@kxt(r|2JymtBAV9ENqy|4O3!FU<V@#b5g$`A#K0KA1ZD_6LdY
zpl-}xxQk$tvHh#8xL!^CSCokGd;HgT>OR-1!}_{HX8HLfWC<R*;MzV35>3s!m#f|9
zQBP*VNwl=|5@=VbEUQi9qJ!H8GjNYEZlBh^Gg5HXlv2pRl^4d(+&Ow-PN|`3dH;&!
zf<pVo)-*47&$%`#+OBzwMqCVDn}V{O^Kq9ojjs<X{%_n?*svh+@9jD6{vOBiB;5G3
zpx4ow*<b8{oF3qUd+K60z?NYylg_z^Mk-jN)8Il_y!`VVA9dF{KVG#zbBokcY%E^M
zuBxD8;G(iPM^08-)=D5HNVvmQx71s#m4Wps=TiX@DUVE9;AU1i*qx-Lva{N(DY@o#
z`h|>`QA`{}btt5IT?JkSM|`E<|7m725_l4fh4qKxm*=9so&qAz98-&DN(26$-~gw}
z%HT~D34w;Bd)p}2L(%%4RaWb?+mbwW_6&nt8wqW<@s45qin0~2WjJA~ulM<Je`~37
zx~qgCDKF>dpG`(A3p?T;ewlY!homgwbyezPNyO3uAI7f2WaE|S)zw?lq`Ag4BE2k1
zGRE<<DO0vq*%3w(t^)>S=YOvEx#tyyMg7w2c-X5~N|FP`N6U0R)RhW&M5``G?VexX
zNz=JxAJ!})R#n0xXpXbbF0!L*g<V-Qjni|qf8i`HElgJIhmTZEVBLy%J8Dl@sH*U$
zuzI-kg~?Rqnu55^`!tG@HBM1+k(J?-A<i*4P7e_?PJD`#z`3)qEgGp(bEr^hw%w?_
zr!JK%EB_)roUM4}<j=6C7{Xy~xRIb_T|UWt&?;N%QO4&_DtnuPSJdV!#aLy8+#F-r
z))Que!>?br$vP-xjMUH&W)^0pd25^%ETYF|^iFNOSAX+P-?4D3<t$l0p0~>2CibS<
zMC^Cvkg7ZTE|zBv;~^=AWQx2?H)x9Qt%jCmrY<P1vag9xcvaodlE3fO!_i%9W7T4~
z#@6UZxBh}CDpPl`_v}JLJRow&d?0PYhEup}cldO*;KWm(ZnbP#b5UL4)9K;%DchlG
z5^9^bZ0s4mUOO(~LVVamZmY#i!RT8y%gkCbuOnQ}3|DacC-|$JzU?X(mrHNHpeG^r
z_r)0OFR~&omRo4K{d;~b`+mMDRJ@2yhStOmEY172_Xy)g8Lf5;)fz~36qa}P)!+7d
z#WjxXol2{5T&gj+xK__hC896)B9h|7<UN`H3AEy^Vfl5H>r)xzKhTPMbU#q*?e4GE
zT`udh^Qimz`Ql<Uy@ZkzDIbg<ez%fb|3BJ$%b>WrZd;fbNl1VM2?-j4dvJ#&1gCM=
z0KwfI5+D#fxYKy!PNPjH5Zq~8gS&Sl4GnkaIrrRKx9a_Izp7L9-M8xegJ$<;%UWyB
zIo6nCpzC);!f;BPx5Z#i1@^R^(l68J+$mbaaa~z%o+ez%vSZ%+q5e##Ge8gs0^8ZA
zN|8_atLq@9gl0EjW(Svj?OFe$wR_<u-VY~HvY^Nfw`@~*=Zh%e;0t(;VwdCt#-go}
z+eRUju8+^WyI?I3i>Mc3J}L7dyO#Q7ldtR0Z#s4!c}=PC-Bh#pMuu`Sz5JGoQ45;u
zY$P|ej-Y=A>Q;|mdIbVf>HRt{TdIRJ#Kljtz1P6h@(Zs8hMP12Jj)vr^1jnT7KC;;
zAHKk5YaU)WYA>-$*20geUSB*s%%}Yb(qH3p>P6)@RwbX~YmMkSo8-gKYn`63pOdvL
zppaa{Q&aS;ZG0wOVZcnz>+mgVr%B$wBR0G>auO^#<>JD{L6If<?eelImKw~3AcU~O
z*Qd?;P-+n_HDhvR&+GS2mk<6hJrq9EQU5gto?k?GAfd%92QN4!lktX48mETIm&9`I
zJI>T+s!u<Y9;wtxtP^>|0-Tzn6FbW4W0>HaR>dsD(OE9h*uMcJ*5XVdJLk5&oN`bX
zH@B!b5CjS`Am!b8$@8a7#vbn*VQaFb5C=ynBD5|TxJi#~ctX;LZwK}e7VX{0x{Hjx
z$de5@#qR<w9wzZgew+55I!nzDaSOQ-aVcQmmlfK)`(?RStdQ*GLrenObu}^}ETVGC
zZk)R3oX$^i76k}jEpSV??3(I@0-3CGeQU<Rv`oOxyUOQeR84!|AEA48sc~DrN&ep6
zziCU*(ux`=i#P|jeB+p?cFw5Yhz)UH5GI+bPTyS{8g&lW<(_I(AwsWBW{u~k5KypJ
za(`{(up$z38O+0;6lEt*>3Sgs_mI)3#hV}(Fg`>GUollx?iA)t1M&$IMEe8Us4uxI
zE?0tI=at0onfb@b`zkZpI<_>Gc2~I}U;Q-!`OcW!V%B#puCcMP!uL```G*oAjd@lE
zbVp3I8UIRNS^M|MKpONXh9%uDQ)+N&&wk2(U<MWsto(yy^}BqY^{q906J=_{v6{gv
zJkVl9OSg)(WnazQy{^N;^N71uI7v@#b^b=yKf{tix^hlEJ*9j$yl;gD(&g^LTh%qW
zEiDo9>iW$&b`ClZP$O6|E4BCiyxv=Z&GCYM(|%@6bLDaP^E+wEVbN}6?OqLzb&az%
zPeu5eA>8o24WFI#h|Fk_y}XsqI{g`ju7H>a$vR%Y^E=>)Nu%`E_RH3|v^%IMywody
z&!2{k9JH(^OIB|v-dD~QiNZ+#sC6aoMjI54J@?~$yp5BjX#6y4Lof<ofBSqUiWJhv
zY#lO4jy>j`3bc}aTF4B^vNiKVm?t>?NK$*A+ZiFJ{5Wd%Td-sV&Xet*?k4)$@BIyF
z<`#n><jf1Hm09+iXCSc_hq10Es8#Xtq+&-Zj!Ku5Mt{P|W03CI75ehI-UXtbT~zDK
zxeFV{JK;2E|I=c2xmkQPF-JpD(Fg*g3o|#cYBqGS!146t2>UK8fXa}JLi{{O=uK@z
zOKf2Z&WCbN*KStbUpPOU{GD@3yF<O6$LL1b8Kr)EkmaW25TnNvn?z1VxGW$0Ijms!
zCEr_{k)&DM8GH4QN78+VbX_5|zE8I21H$qnbDN{RfPf)?-qbo&WR<G=Sw6GciaT&I
z?f0}YbN-)vgGxblnZuSe&CD$-(X#8pQ&;$6>%=ErVJ9X*v?DgUHQVwO0{(g;)~isB
z&-{QJYA3x#$`5Qo5kv+mKtH73Li*<QJCkJ`2w`SG{GL)`FJ$~y@)!pvD%B$k8dlUu
zWOsetx_6QCi5YN_B>r^2hzoRT4#|7D{FN%>Va1O)jogGnwV0VKhYBt8rX!;u#Kb>C
z>JGLrHBD*UFo^!Q6k4U-7$G7I6`|wgS_eyyteONSj^lbNX^i8V=G}ccw2=D7KFffT
zc!Q1c^+)OAdR#K~c~YN{m(Pg^a*baIgW_Euf$^AujDxY%-w3Bud?k+SG3T#&E6K$#
zk!bx5wtiYOqUkW4q>3{89>o!vXsJ}5tmp_F#x_H_66~*S!*G5^y5R&#?T@xcYeB9>
zHyf84*oA{kgSn>TRUauNH4I1@5m3y@@~`Z$t2N^K6r54HYQnJ-=Dp?XzB0G%rmaRX
zhcX3AAwHHbOjNitOd2O=y*l0_&oNkskeO7Q8ASDOy3Y^pw^0!R|23a?eXvu{=sBk>
z>AO?(PyZy(9sWb~#iV^7<%s2CuFAv3xj`CC-YwDCNR6`#w;Dm-c1Ld(SN9p*72Lo3
z^iU1-B$q#VUm<(=G<2$gt}8SwT#ml$n=bG6fVvYxg)*<|_3$cSLbc_R_L590*6YDP
zFPDczZ7)cU#m2<=_MCti&H)>^RWq|^mzB!7NXq$iIDgX{J*4J2r3q^d_`Q1htt|30
z=fRx%FN5(Fle=pPJTop&!fMj|^<6*FB|o`k`X}MODJ;s>gBYe$tKlc=z1K;{TRF+1
zr}Kr|?4#l%)On+>VwON1d60(lYB&E`-BiZ$Sgmmd#qc-{bqIt9IWVN4p**^b3-$Li
zh$DP6BM^$$Wnods#Aw4(vLhMndBO|?FlOdmjO%myq%&mp0nFDCxiy&+0fn(RxiAZ<
zE9tyW`yPD+^Ke`Jp33mbUSImj`b6(w@hqsCSwdni;|&h!UX9a-DsW3eo$3P=lUrVP
znT;~!)m1`Z#;}6}pB-=ZM_xK!%<o3WMMPO7QTUq_a1QNDx_5VdvwXbftr2!YYL9nj
z&5@L&TVRS~wOjeAVqXi!X#tqUhhgJg#&emx)77~U?sXOigbMvfgYGi37EZbyt)o|r
zhw=K(VM69PcN~}?za0;qrF7`|uvt!T)y?K%by)<O2|6ZVRr8IUe(2+ficyQUs;W;D
z3Esp5rA4{Y%j}ZxZ9mIXQ~4BAjtdDG08%A?9I(wNjo%;6P`#Cvj}~q7`>4=(D9$`?
z^_&tpdU$G@7X9?{`f?u^D#F39_dzvF$`mLts0<B?KijNx+KhxmM<cR-gh0+K?IyYH
zReM`fHJlA7m!<)MFUWCex&Xs#**?;=`tOg<khj;t%lVJ)F2Y;&A#JAHeBUIkUY9>3
z?h<rj6r^6+N}}d@2AKhsli$C8pLr|Nbd#xWVfsvCJc_BDsGXwmp{IDB2!R?xVOKCb
zTrOjtcVloBv3af}D<8HB``EFbe{r;uXeE5*+bHb1vkZj68R@BCHl7Y9P8+xxhAo-d
zd-p*IJ-D5$-r}}3v5n=z=|qQVT{#lO;@0onN6h2$^5bYv>BH^=L)~s+w<_;UCRWC5
zk+`}HF5LN!d*UG%u;Ndn>vlr5XuEl;Op|~Jde%P+v4cTO(n!ScJ2SCfHeLKYVpmbv
zz{37ov4Lr4!2IV{U>=A|jxv2y=yc$UO-`4*lb-ODLEUH7o%v9jURm?KC>;|s4R6lH
z9?_8+@}kG=p`8LwFYxpR7n|-_Q~c#4VckecWVGc$o3jklQnM5~xLWW`C)@@iw6Y@~
zQap$Io2V!%hSW5_SG&4HB(B_~7L&Sprj+xZA*w)ujUsNPgBhXgC3I%sy1vyKb*jsi
zu{!VeP+_`5-Qa<IgY~4@906oLLxI>$0_x;Nw+{r31%Z|~t0S%e9Kp9>{xWqg$v$4H
z*L^7sBJ`hFz<#%(s2DhU7a<ULH=m+^R=%H^WNrP7w7NKO>1Ax3Mvaa5##sS8l2v!i
z$xnK-xEqQ`NSw@9Z(CqUcy7b~)kSG}yBo-iqwvnFZN~(es6~VlT!?X^px_13*OmDN
z+1DOozjhbwNT<fC0}R7}$j3ii@u||BX{a?v%|w4I2Nz>?4Kj6_HEBIfV>VyR-mfQo
zV##CV#Hg*md8ePz^)c#PS%rT`<kPm-!MB@<-KTa@K-opL#25HRogxT3#GH?qwV@Sc
zF_TZoX1|n132@imw3`eCX^pLHnW`OIWOIQ(%T-0{Ii?22H>Uhl^dk{%Y)fS0IK3TL
zT4-sd7G?AAm_GzB4q;yC@$Q>gk6L5)UI0;njXYFFj-`fUG$2$6HD{}{Hf=iHys}M-
z<1tK?a)ustLO1I1?2I(;@?cw2|0|;EU!tzRj-$+l!}R0Im%m;Ol#3A!TrX8I+!Ddx
zG`T)lbmJ9C-Ik3T!<n!wS8!!bjsA(qj=$ukOKP+A&D<`f8hHnnx-JMvi{}y%$H0c(
zM1O$3PwN?yN&JyyQS#mSNdit$@e(#0H8<NarnG-h57(UIOHN%-Y$~r0$EU?q8F*my
zu@+5(CS4^JB~X!QsjljeoLqDbeS-7v_4-d7JoU?9EW=n0;_xk;;}nRkiDRCsU&}`0
zpu)p0+OrI#z`ZD!vQUt4iOqatYo`W&xiIXo;Od<p;WHv;3SU*f@RbsDz}YRel1!}}
zs<eS{a!lRq;vY^bmKh_(PxZnNUU}7Es3!e;YU9O%O?d7=0pd&L09GECN+?$7v&ziB
zdRd!UR=KxuqvYftnvalP%g4ypXyc$BWsV(tnz=(b6LR-C-erLFUtO)vhm+?8zPi>X
zuJaAqcL?3N;ghe>tQv*p57MJG&=NPmyzK;kw$dTypOQVyGRprcywxu+cW`{b`7_}*
zprmAaX_KkeL8An}{sEUD`Clw#oT#mL?Wh{-(88M@6d?K@NhRG|c=Yr9adi$3^Xx1d
z#o}c+6CejfGWC??;QS2edrTVXu2$FKlB<`XPR<?5ZL4Ez(!xF1)R%{;89VR)c6a?5
zHnBDCzP`iwAjf7t#bZ*<E<e}!BmPFi6((KrqrwXQrFOf+|F^CYIox?>N&vEQ5NU+c
z(QyL(4F3TW8Rk}1y}s?5S?>*t9dJk{qVhkT@5{~oup!>Dw7Xpz+MPPPE#4@4C!6OV
zo?d{@71CBp_pX{`jKkhj{OcaYD?j%L9E^VM2SAGbgRP~#Cidyv`sV^fE>oY$jfNp*
z1LL(R1fjMXze<w=oT>&mmC1iZ8LdliF?Hq92~KNe!w1h*j*St~T({V66sI|A_}sV9
z@1KVE%Em+ZM6J>=dh!@)C<B)IKYY}qCLnrFarXzdwI=+Ca~NsWD;<je2a>pM_;cM#
ze(2!=Kn{YgX+;)e3H<UVwp+*hH1r%TlD{5{`rWRm9!*Wbr0m0^kP%@Qs+C?-EBjRX
zQ~dM;=NmJLluE-<X)Z}}{|dEfG_|_=6_3wYvhx7l*63#p_&U_Zm1LcMA+AHNl+$%e
z>x(zNWgZ72;?Ss<^F13yksq0<JKo+pUk+UaAK=cp=K+aVmtz1eknbh>gQ*a%u)?8z
z??GZB0``TAhVPZhF+-`1zYDz615v#T>+2nPPNQFSy)}n|G;83>uZVZt4*R6S4b^!;
zd$TdT4qNJmHXiI{faQR`im~yRsoKX8m6!g$&nOOdMJy#<iyHd33y4ldn(DPwbr+ja
zRZ?tM$}|v<D7%ff)4#{E3WI!&fQry^tB!^TggP{wc_%+U)?mG4lU0~SN37W@%0ZDP
zJ0S*##U`c-`JsZi^w=xOcq*e+Bo5C#OxyhicN(k^cFh^N=EwU@ZpOP%QFF1jCShUj
zsKo^6g2jm5yY)&+a-Y*RS8v@wQ2KJ1({f#-_h7~=tcxheW>NsVZTedRmT{TQ?B7}S
z2=H`E#LiYviO*Ebk*8qkeq}>xWjO_NaWXj8VI+F~Jn`t<yIl-(u~U+h$_w)K_F27|
z0MX4-aqi})xo6_}y?C1LAIWxkbmIKKL5%kg^ineZR;otIKRnEbgMnq6ZGLC8Y~nS5
zaLLteczYK|8|OXH6Gg|&$x0jzAZeLJS{&kn6ZYy7&jHNLfA`uN2V8ViKPMah-Mqq2
z#Hu%H>(Np+M`fRF1`ZQe(OKcA#$Q<Fk}X*-7L`8cmiB(OyH)M&fye}b@OuDjTpU17
zx`*Pe=9Q|Yy~+hq84J_UO0#%HgyuqWf=aGX>UNlV78p$S>Ljf2{{TCRMA&%QIrt+C
zyzT8Zb>&z=pY!Q~{3ay#fvyS0+(2ocG(Iuw8nG`M8*;U(hCGN&4=8R;>fgm4yxLhl
zX2&Ee>h8$#E-WY}PiFxW8<>Ss0|K0mD~3wvyT}*H)RG?d{2r*6Q2WW*?z?yI8XnrO
zo8LZxFx|ag{>x#-5|;;|Ur=8B^7@0rq(dhsAb?8QzuXYIii<YBSBq^&m%pY9B_n=*
z9gEB0NveCEf6UTBp(h>U549ZsS~%wpmhC_iL_B-(obXvb&BYs@Ur7KMqEL+e%4@>B
z99t^Xi=<Lv=4qcZZPz#AwN2ideNoT89D?%ojn8AALc%nX62pP2e`DHquM@Su1CXnH
z+$N#u2#K=wzG{VcPv(!hSgSrQp9RwJD7HOj`_|d?mH#Mp83*!k@G=?HkQ&-Qs4mtE
z!qbeoL%*63aM5d)lWKcFe))NoKYknmZ0w9md{hYR!gP{B_RW{9avSq)7o_$R$DiKy
zHGI3CO~+jNil=Uyj+uR71lmv*=xzC>Td9G;%6bW0BTF!LqHx)_i(TNMUa!FP6_IZS
zuLM&iW{pA@EUg5Iy;}y!>Ml>VsS`cnaML;W;0h;G>p=izlxyR}I+|N{<pmaa3n$Jy
z&T?t3M-n<9adx2}fD4|6F#}LGKDd7$&^V%d^<Xg)mG0rzQXP*yB1UxpfTAqS?43!c
zX(eCk%DDcPvLD!p0>aFxL@xgTAR7O0CD&U!MX!4lc_E!F$d_#gL!EHGf!YFr-_58I
zAoYbyUICBVUS~S3{72kNtBC}cgLuDCCnE7ZgE<L({X+i;d!Qiu=UKjCXa1qPDrz<t
z8G)m$%KwL$xtR1mTC7sRh7L$(RD*lw^og1hwYd4lIJWxxL8p73bJTQ98<4s9+DFCC
z$u|i5o@;FqE3ZT@LM|?6aps<4+O7~M;TLu$#>1trA>Us={A2XxH4x@5Qgg#8*M$HB
zN2|I)$Kh9|l|L?-NNaaUc~7pc0hX3KMHd%uH?USw&ZHJ|P?3u^yKUv#9Wsvo^3jmh
z2pGx75KZ_V`??;FJeAb&+j+arZeAIn`R3sVo#&hHS%3*l`5bxNSKX9rLU2aGkYJyo
z1)oj-APW-bWY0L~VWE*!_@Jwz!SUvIyjDuwv*Mz%?(t{u-y7>ba8Dy~P<GfIx8eS5
z-K!7koU7$xn_|VKs2%yzus2BTTr&oMmt|?L=2(Bu+qZ!(qo2b>3H4TyH$7(3#_z?V
z?5UQf?KI&ay3GQolDWam<E6l;o!J_?FehUGrI4FSNYskJLsclG_db3u-S9Lg2(uDb
zQ>ckYw~_?V+PHnX{#G`|&9O~U!3h~yG)38EG?hh{dqZs>bVFOorx5Z>;&7QnCcopo
zA%E-lb5(6|%nx4PCFVEW2N^H^+^(Ms3!Z+Kc5{8!1*Nkqejri%;`y(v8?az9n~LTp
zroZ29M_6;@ds(ZuZNB&e2L-w!%a@nFjq>kh4DHXZNJwTr+~eM@%0B<vmO<D%7H1mc
zK=qvPK<}7Yt7biIA{X@*h_L!f94;QhUe;6EPLE$fMYz^Z=NK%2wH*+}0a*QF{6N8V
z`mhk@@0#)aS(W8@j@y(~Vn!_XIZ&Qi&G@sXqdy6F3<{-z!FuT6B4ANi5U3UTdEU8Z
z#?NA}W+<!IU9}u-wqIbD_~gXdCu&+<WdEHh5}VE2P>4(Z<Ht7~;w`fM{zN|=HH~MN
zpFAuShrz(P5di)Tq~9ODC4qzt1OzahK{OxkwyT%xlz!zIsmwmMcEC9eQ4Dj+3FSjV
zetrqr!*uTxym+2RoD)W7q4k+Ojr|StXyM#b8kad7(rVlJV}xGv1cG!(_w)iH@46*&
zc>y&J7_?=kE7yj5@r!c|u@dE@DC!eUS``j3*o?5k3ezD+_B$n(i7W``K~+tD@`gVr
zn+^P{CU=EV2FO2XO{mDvtL;!Nt#l~qPpqG};D2e>1?=d-Sp{gX`S*ggBLC=X*PxXh
z*DZ2_&Utt?4Lnp{3F=s-zo;V>J`W5p<kWKpLQdh?Jyuc=##*tc)^EWdQvj|z^T3cy
z`5)DbGUR6`xz%fKj@a}}YDQZ9mE6}mw24GiGq-ie*0wk=)&m%$nN?&co?XS3T@?2@
zyb19!%xKJi%F)hh$WBjf(0VIwur3GHr^)>QGkMd-Q?ozlxK#7MQu>tr&0DLSpWP?H
zJf-SzZ((CLkVXjnbv$qj0ryondzmNBPa07xi`1uRJ1?M%PSjwqXTGpihgsYg5^LW{
zbHZh`zHpu0ICiH?i41_F{{YR^2{T`D)cpycKW1u@OS*MUWSMb}`jMpJ<dTUzxRmsw
zE6?WO0I}&=k@?>yYJU{Kg5&<9oWUj2&m=6QWEQ|12ieU|G{ZyQ@%&6YURcpcNctx>
z>&4QTRYC~Rs`5YkPrq<&rSq^DSOR%A)^+6fl>1`LShwu|fA*rh+ppcT#KR1l0`a%+
zpY;*=;lHT=?!W9ze**Rv9(w9ed_6lB=1zN6uaa!5alU9e>jwHyEWmF5=a(RgpI>BW
zXoG8J7C53@RjEan4w6AhKL+jjW<W_vwlz$_&tBgTdct?WchIE)U8mQB+2oH7$SeuF
zut`E$sr#X{R5x(xn5@x(iA?T>44*}p0~j!*B0v1o`}B$E1F&I*g_Za0FBpRL^4nk5
z0M<{&V1Oxvg(XG(H-W)=i$e`W7_2WUkN#;d`hVrC=!*LK!KLx>`FV1j5VogxIqkJ<
zZEbz^GZ5Qb#x)@!A)<i9nTR?-xiwqfkylb86Sp52XNo5vB=kv%q_ECLI(NSc4n*N<
zq%Rc-`_fL2SQ<ZbWT2;wdX>l*5Ir}A7*eF0ANJOH{4gjdDJjXZaiV6H70D9XzmD`2
zvF9H=VF@dkk+%LZF+S-fnuV;ZOL_TXHTxOPx9c1F^5lfI{DU+bp~kk0O*0y)rvZmP
z2SWorRgS1cEp>7MN0|uBL4ka;@NXy-IypXBD}npnMOYDJAQwKo?W#NVh%STh_A0WJ
z?&YS_)tD-9cR7yJ0aaBumZMb<54PDil^>tO7uDP41irp|hoP{x5GJ2e5d9Pag=(?|
zppLgW1vha_gb!%k1WVs1C9LJW=kv5Qu#EDA8P-oXr%Nq_0+$5e?jjRtJR@VXW;=?d
zk=|RZt!x3HpTRxldj)>o#}}Bv$@)BN#H37nSVWXl6YEnvT@qcIiceL}9UBLQIRpm*
zu;O6e5JEr{^4EO=#ajf|RNU0blx~&ddKJ@o>|GCE-;8g+7{u72f+Kc%`+suU9}{-z
zY<U1K*rKkDRV`ZS>Gw*O*q)NJ-EO@5+3Y?}OzGw`{{ow;p*!za#(`l00VSiTRy(O8
zB*yBK)uj!acBAtnK|dm#kYYS+hVo=e_MM`#vfL}jcb3)XjyHacFHIu-|Kq@^=uZ+f
zrUF6nlk)glvMP`96S7#Ap-{fiRnivb;kUXsx=&tIkn0lv9o_$T!+H6|7>1f0PeWZZ
zOT?|YqGGZ6%x<v;pabAet~b5mZt~vQ-HoXi_JQW}-;RxsBdNqMw>K%#?SK$LS-<1T
z@7_>28r7d6>j9|G95!Dq#E2h%_8`1II3J$(zM=qx;wH1lCnrlXdu~SW!v9S8&lLg6
z{rnDId4*6dd8=Krxfn{8nzz}r8PV@P_?pV8j_g)f_$5B@TBixoN!|<}Slh`VfMOR+
zPEMYj;9Nm$;x}T3VHdkg*Ne^Q@Q7ita|nsNT)#K>@hL|uV0Nnb#6diAP2WvJLt}T+
z!PZ*n9F@={ICHu=3@e12GIZ@9bY#v?u#0#WIRaL9fM$SSmMmPSeutN0P3T4eB<ppt
z%mLqAINVt_qP$v;@yEd7O^1v4=s4d=v!ap;@0&}KjiFRgn@NRTITxW!Kx|3Wci$YC
zo`9NsKd(%ScpVk2b#EeCe062jIRr10*Cs?Pc_M~P!!+*}5QyyvS%=Uvz}J6EcE^<J
zytQ6?^yFSXomhqMMU~?fe`wdlcmY^w{i#uhQS+vyottj*bs{~RQ#C3zwJjVc23|bO
zz0I%QKAD~W>2wu*UA8)$pP$c}C(Q=ib=N}5mx>rF-TG#l0amJjFk_)YDvztoq@H4{
z&ADOXPO}a-YwO@M=L#Xz>W*cN=dm!bU;tip^`_kwG}19qRQ!|8<_7$=9K7F_mhum(
zTU*J6*N}Gfn7!CaUoUi|m9CBW)#Yl8FKQPsRwEZSSMVSNJl7r9zCT~OndC2fKd^c%
za@w+leEX|q$*sY^>=&E3xCfxYGMfv$C(9qSFQ1mI{#<s{CnO_A8)+C;ke*85#B|-i
z8^y%L>m`VLQ<q<ZvzwOaj*fKOZnsx5)s@q?%j~w^IaNTvN<8|*W3>{jQ(MS#1hiRO
z0^YJ;-~G9F7!bp}T;Q>2e<ui=dUHp0^DB1d1bx4Z(i9l*Pt#-ol}*{e>&^%L7?iT`
z>h1%yLi53l*tED-ul~u|*=D_^CYeM@0djxTL?Y0jjesakyzK$R`IuQseZ|1o5;!;~
z9G-bQJEVi<xw%}_)P|LcFU5z#$1g(1?`Lp%t)x2~3{wiZZVYU9S`1MNI99dgP>YKX
z?;d9WqKiXx4MOCKgI<6u;sh@*bNY>6-<mA*Pc&}2dQXl-Egrc@nLotIw0run#c6fp
z6Qk=X=n0W7;CZ#w^s<4qRn|{kvRerd#F2q5JPtc1WQe5FRCe4!Zd1&8SOo&g6gwai
zeQ~%c{Q_}YS()!HbU&U!Q9#qR6<Ps+0$K%QHMQu`9u*qEyS{>|VGeW2;kzBh58b|)
zot!*76u;>$?bqTNpBe^>ACei}mNeHa1`NZ{J>J`y4Q!X)w^tNy?S2@tCG=LP`1PL4
zaD82!$nAWsZut^s^AHey5FFiX!9exIuTqt)9`p0^VgQCO4C)PfJtAU?j&$%l-PK(<
z)0>(c_rIW_T7p>&2R~k=@<Conggo75OvGdGSOCI=$AZ_M_Gm~{x}pDeC!kSTA?bY)
zTS+10d(mV8R_Qhd^rn0kuWr6QakyC_q11KW9P?O!ArWBon&c8@8xnAtzJxiLvG50H
zWT<OFxB`skK1cSuVNj=VbWg`lK;4poi}Fuxn0J)75S8zdsT#c!6dl_vSTDN!HAI@v
zZn0$Faj%hcwo}MK9iZ#R5K*4;^V40$6@t<M1^!n$u54c^gx!-9lXsmIKgXnOICokK
z?#;jQQVn{illrQ*GQB|aJM0qllK((kCH5?E&fY-ZXsOC&%6^~8%Bom!MuJ24E$$%^
zrD!307cJNUP^6a#g;v%>`ReZhzJwGco0+_(fG9xz?s2YgCTw^ph0kqxkzeE9Qz|jr
zll(AEWWv<GusfKIDGcRVsF2xex_K~~CpGIw2Z&vZ=zG?+Rfvg-f*jJ)(sCK(`}^Dv
z7fb2CYtE!_=1ojk!wl*L$w_;|N{f&A&?pO4$pRLl$j9IIldVJWtmI_vqr#l{c?+_{
zR;}zSSbLsyb>fM-{?5w&Jipc0j85RDBgHNrq$HL3?!nK0)mOS=W6kcFm(<ueyI1zk
z_k%(eT}3lr6KhTCgqay%K7=kgVI1!jfu0dq(^pgPvz@u7z-0LyIxWWWl(aOzKR>$E
z?jAewHqHE+7LaC4P*#gqRV^GWH1Yh}_iS!NJ2~|^;Zt-U%SxUFr^ZtjOBX@z7zzgk
zPz8ne;$(^&Qd>d33a~Y@moe|zpIptasR`cE4RChWFwFNZ9_l}a&|8p;&v3>c;84jZ
z6b%f^v$NSLfSz=DssCAv<4T;_kydXHswL3mwVYzEHCMdts2whCOXGJqs|vhc5<krd
zKhJ@~v^ebM>)hs`z~IC0?epDS(UbZ(9A%5VGV=Gj1ZE!vp1ez=X>Yl1ZAozwtmXp>
z!o0lP@#MhJJJfw9H<xf2evwQ@GN9!~g7Z!6@{jbmjHlUU9|96ypD_Nq$?_LZYpvbY
z(AZebz(AzrVWSt|Nqu%Y`_|C=asp63yYvn7U~d{^A1DTThqTIs^i)gSBXs2=>~*$W
zg(l0F8ttws=o;7zo2)_dZw35j6Fh(gqCmr8*2vJm{-~!q_~Jq`;ze7l?PbOcw?m_U
z)<)jO3?Nt0*Uxft>P*6+n?fP_u4uc)x6{U3b=T=2V;5<fv*ZLCnkXm%xqWq~)lh{f
zX4>Q3$2mFOJDXf?rwPR)iGIaxeO8tV^1ltiB}08SmkQCnPSnuw)>qZl)G`96CeDnn
z0RqV|_md_U^Mb;HA`LB7)!9pfYyaD{sVTtYa43Tlq)|@FZ_TVT8s3=G_WrTObXDM9
zMvk>lv5=-)<=Qj6Z}=3<<E5GaNMqO_=1kYoDp*_Za<CMjJV@^Yr7I{PPShamikT=I
z->41EAxlpKHrQjW+3im9AEQ$RjP<jdX0{!H+;6?QT(6<HQ_$gHPupRy5TwTo9#2RJ
zG>-kE{sZg)Zb1AqI&ebOTSXlX`qkQcdj-AKrQ`3kRK4F-gljy*+>F98R{`QTzaK81
z^BeiCvFJhDj{h)-motc82i&}8(`9=`(IEAdYI4m%b!rvg|DuxHLIDmW1|{B@iy-iP
zomYPce!ykWd8^Uw&Fbw%@y%`+1K4{5f7l;m6LWo3EgeHlaRs?OUx@bbT`7jVU~POK
z3S9Kk#SQ#A+r_x<1<xr%mhbGctJuYH%ub5O=$pX|L5Z*KQwIy0YoBU$<Q>lTc4uc<
zF%B9UZXSmfd=2!LcDSVjRF~61ESeSQX=$<RpO|ye+x7@BW?q8g@McX-Y4^wN&wJ-q
z5oqA<rbz|PHu8Uda+@t8QXw)wd2;e%vF<0??nL*LRE1LA1`1^{l%a7%$!{JRUE^RI
zkx@|I;pin<&`eNglp*G44)`-`UTr|mKvGg&fRjDo%r#X$mwgZ7u3hlR?4*K@iG9-k
zCPav{BAvHm-wEF4?k6D;gc&PFbh1O_7YJwH^4ZUtxWN%KS9`xCLftN=oV0`;0AB#&
zSI-u6C|-;6Tm0^M-g3S-!803+YBh;*uTI!{uYRgu>u#XtQcEy8TTiA=K#@K{I$duQ
zV^Gj4DmXhUa#L8CKvX~yAm=R5m8h(?X=gbukNavH7r@LD6N@2Ap`r)j&mVY?A-1$4
zjEtpX(&Gt&c66+4pSCQl=Y=!~QEW3PHKnJqgsk&2(7XF5|L8X0bN1|6l@)c7;;z*2
zBP-w3GpP76rN;mHyR*E$pWoX_y$Z|ct8&atHZDR$2FMbrR9%Yb@aG*9&*X)@nA_OL
zm~9ngp%!y%^6EFT%$1Kif2*%=GM#Q+RxwE3p;y%naB-F`_K%b6*EQ8gS5<tHLF{%g
z14*Aq`A03mvUjJ)JeP#IcVxXdsGCJy2lD6Ig)^89_eZF!>+7BBadq{htcoYGatJ8v
z607`3QwWm%OGk6nO(hi(qSbqe>+uXq*CY4NyE;2XPxrv%A)^dvun|Tx3Y>1=YRGn9
z0~+9Ol}bN(7!Ofg@V^o!S!{imxO}o+iv0YRsH~*K+wGFMK5b(lix{urW}_iMz`M?J
zC}S6BBlEQbO~nD#-By!0tY~qpz=KW2XyW!7-Eiid1bB={1+H8R_B9V*FAIw1om_7;
z3~S?c`z*m+_fk}BrtFl}YjZ6!xBLLtiClgSF&!AThVsdOVgcsmuze;cyQOOR^2}G<
zg%#SDX@%7s63SGF+5lfM7VcBgL&K8S$bR5HFg@N!rAD{xoSe&t;;!(MX_m^0ah0DR
z;HI>jB`w=s4}{(KRfh!q^$keya3cpYxuv^7sP<WkYU|hxQN3JxEqQt6d#rQrd+KI6
zKO8p(UhNkEQ97DJn9>qY!N@U4s0uNLn3z;?JDO57=@)W=ezeO2p4@wbrX6&7Nf|q{
zkbO*OPpg;9Sf0iAeR0Ps-g%*bMg5jaEw;BP&aJQg>)z)rNxGw@&Ag%Q?Rh06A@~tU
zAZ*N+gqO+ax)ie&Egs}#de@HA<Wh-xnqJ|#{bbd4gqbI%rFjoOyy*(p{9W>KoLzmd
zcW_XHI9oe0H8IxDA8tDQ4V=AWJh0XC`FZR{@kEU4$lp4o&fWcBmKSh}0F)%RdY7)x
z&Vg*M!FAif+xOP*{N~6gAph|=$Hh1TuKWq{TxFO_$W<FIem069fTW><z7Z9YOzR+l
zA6<I6&^&QjXhsG20$vbTdysmO2?rv)Z-q+f(CfrxVR-$<HGaS?wWu<BA>hxushYt|
z?kj0=5s&%(LYao`AI1J+iN2^bUM8kqes=8<FFeuK79wKe{YBWOywUYF=3E-RHZJFX
z9mX*6N3(w}ylnRYzTW}2clJ?}Z>OA_YKg2J?tPypWezcf(87%^(Z{p1b^Vrz8n8N|
zy17Kxxa;7Hf}-q+bfrRLwclNeq`DY&x4wHjzv}rV-9)$kh?@1~%MvnZkJ?@R`PD&^
z@Uf-JeVS}zSYt{`(ftgF+#i;!FmYooi&Np0V)egWEdi&~eS1i4Zd3>$ql$ac+PbG<
zcV^v?DQ1w79xux6Etd6W(57^1R_z6a@PVr!gAGxSvqCy)sf2@-Y;l^{@|IqAqX7Z}
znutN275)m}nYRs)lgp1<oP43T^vn(u%JX(5V)Cn<qDB1hrjon{{pd3g$WT!&PKo;0
z;i;g+@^mx03t8tFDZD!H7&nrUi#NZ(`Vk!zp*gj8THkES6%p-&0X^0Py%sZcsqK~k
z*hOtmrSe!x6cF{rAJe6CMzh}WunNx2I-g6ryJ+NlFQEsXMv2j>OJhf5EKf!fLdv%2
zcr-4X2E!gZp#uDjJYHv0^^4IBJAWq1R31`!h2t)rW+V5Jv{Yq=hmTlGk4kT;NU)pl
zVs&R|&d8g+wX&>T>$&W#F1<glQl0pccv0}f0J<_#R^8T}A*D&_233tjYlrLodsKB`
z_49aU9^A;e4$_j9o!qdkn=7$TlFS`49K*A2WDya=?gP?JTU`&PcE2WBcu9W4)*}ku
z6SV1B4~*MeyehmqA$k~4nf7Mq$85b#Wr)dMGEbNDm0d)6Pp62RgY8_-%J%f}k(QXl
zu$*5pX*h7X_NGb!Qxpxjui^^sfT?cREac46-aVGHg9;xuf+|a>k>ecxW=g<xu!k+M
zHO%MB2{;|I-C}+t<V<$_)UKqjYP)xvP?-_-EpD;jzP{^e+DWiTAROONws09eUM2nN
z2kgY{*UffA52tgS;*^i(w*t~9c2J&x245WnlrFSBkP3J*iiCDpE&blEpQxORXDS+>
z0DF8diBimFe|R;Vzec-$pEqkyJn`e+Lw5!bpd%TthZa1HC#cDDyJe(K8_GQfnx6E(
zgr=FC1qEBe&9_V#n2SP0z1LF2V$Cfjb;GGC<cG4DRANq=?lzpca(WJb)56!e3c66f
z&7yzqg=iE24>vd==rR82;%>J`DxXR#E48Su*&-b3b1?^K1J5;?v(6zSQcmAS%%7v>
z512{gLk4k-(iNP@V`345WDs{c`Q1AlaNLhpd)O38iQa47qSg<AO8?53&j2JG-7+ta
z&Qd+JXbX1J9ohhc^(i-fqgwO*xH$)p7Sq6AaP|($#f9)_o}KfpGeibpRBt72)sP}w
zQ^BWIp8PJ`EIYcgj}o1kkuZMQd)?Yv6TAKppSa|leKh$cs4vgjnnoItf5s9g+zxeb
zfL)zUeH<3Ewy|?@Yi5#(JDeXfp{m+nydx_QlL>IQvxA`l!>reg`>t)y*{g3%eZ*C%
z$|o?2B$;AurY7ZFY=#=I#g>}lJVdH;qi8iAaY*_|2*3C)^aQB#Z#Hi3^(U1ddBQrL
zoDf&<1;Rv`h8Y>^1Qi=-e@map>RM~~E1Hk?W=mzA*66LQ>eV~u($JEsJAKnNwb@ON
zi&q^=;$vW7Iu)2L`-CK4t%<I^$%y`O-l}F1G|FwY-}>BdWIiQrcG6!XKq0%+|CzH-
zZY8u%X_CN_>Y3_|l?({C)0<**NtC7#mbhUZCSut#?Omp%WYZ(l&nje0@{US6M=>>j
z!tcQFiCuKo<c%JYm}f;DfI^lpRfa$aD6bP8C0*+TS-A5~<KyY0InsDdJGur*5t=w@
z;ttV)Af3A2*hDvbxhU{7{`ejAY+C&p6LUEE!P&m%o*Jh7Y#E)A;le`Kq9*PTdQuZ!
zSEqjU;?b-#k3Hg8Rho=O(7PdJt17NQ0}AL6CobJ24>c%ML6l^}#xF_vv^+IAQkqNm
zwD$Ea)XtMO3fXomI~gmLwVO?Q?a+Gw1UNk5oyzA{ldGr@+5h48&6>Ue;CeWFNBvc?
zR|1fFfop1Tu4rFGS(fguPj*I(?*LPL_?N_{P>A$X7HzmOVtd5|Q%TC=P0u+y0mLkd
z>ct47SQDj@Ee8cfxoEMY(tC5G>qSWfc8`)0l1k+ToJo4ZT^>X7>s*Jk_$TD;z-uL6
zwMwU$nVETzJXT}D09JmL8uW0&RoDr@Q9_>fiugd0?Rsb^s`}{O%GZYn@XJCnKpprP
z5d1?!HjNt3gU*Zk5Y=ZD!iN__4e*((%cm^gGq6wd0{r%(={5}#iXWZ#8;KO$%jXM`
z4mg^&5W5;l0_~Q|k4wZZ)*~y1eGg7qG|O07SX!<QTG%}`Fc={48EkOxi&_I{kh_SW
zC*w<UF><Si`QU&TQKU#fp*>B|Mc2%%eil8~a5x@2X5nBp`h>e|OEfU;-dAK@0*Z_u
zaGkdK$-vHcHbGq4zTd%-Nk=PnA|-(&XDIFe84JP$o)w!V`6W+;<G}J3HfJa3_FZ=v
zRW!r&d4WwVFKH`COJN}dQtDQaxBcKYR~-UX0fF{MbKlg56A%zK3x8YiH1>#W50VlW
z0f81nq%ijh2=>0Krh*|_q2yw@RVta>bz<JpNwn%(T9Gd|loWAV7S0^QGgY0>s2snw
zllYPN1Ug1`zp{^RE0#7Di)Nq56c*~5-jg3`44*8JGZ9}}lP~L~Omi-z<!pYOnZ?z+
zQ@;`Hi7N^K1YMG*t;B=!IL<oKF+OCZL~hJdc;bgt<bJHzU$XxW_oIzL2kltl?hRLe
z!|G)Nk0r0}I6Wm2unx?8K|a8%;I;U01t2swY%pB-c4TC_DBybk5DWk`$b08Yc|xaf
z|C=>QVV?Lr21lt}#X9<yPk(xnlCr$f>eXWr&8#1Cj(XJ~V~8=KmB9x*jSVL2JDm|P
zn7?cf2cQq~G|$Jsni)BiDeB?2x!q`f0l?41om#N}QD8u-xC7ML01zpIQndWVjGS6`
zH;3y-;EnW~J15>S(v|r}D;FoHYUY}IvHiznp&t)Di=gTP&L6atVI+V$>DC3Hglp?&
z3Mie*+xfNNONhQG;c&NIDyF7D3Ei%*Yb}c0ItTdth4h%5$%T9y%jy(-45r$FcEwT$
zPs9crV5j2mcG(xL7~zQ2EMbmDGrRB4*r0UP;*GpmIjN1eMyL~2jH6mY^)z;i;{aEv
zIVxClSD|?lagz)>AxVM?NBqk{%X!ewnA$D488iM{ziumu#L)M6Vx5I27!~E<?{i!(
zU(%u<=zFJL01(X#K!a}!I4fX2OV@MotI!x<<f`{g`qIsi&(itV6>bZ21#sb`3_$!X
z^x%v#Jm1NW!uxi+WvRb^Fq6{{{or=`v}MlhW@h--XTKT6q6IsPFuM7R{|U4AQfQN6
z5XV-4_fM%N+)&@w-1f?^S9t4D{z86ZBds7^@6Z{kt}M`l{?+>SCdfiwZd_lx$r_c@
z@hw)~O?OVW1K6<ol4J-%b!wT(IoC+>F8R8^-8EotQ!W#<{QNCVf>oy7iu;e|poakN
zXD2UT)e_@aEWGghc(tUYB)QTT6ub8hvLGiMF_!k?oB!@=>(M5>NNn_^+U9Z8YcsQt
zLLe9=VH<g&Lq?7x=Ep#|@g=CYEva$3xoqIa6rl}%h|SZ%WlNXlG{3ML#XJ`$Hx#;Z
zXP&(NW`B<OHy@9H?p%qB3-8vl(n;nkap>7K*;H2gYYx5GJTYzw?#R;8UEP$6o#vFJ
zq`tuGaN`Gbt5OX@v-hN3c`7H?pEfP<F3eA^<Pvo-hvKUVqQdSTAEQ+WS-I?29WCvD
zHBLvb(Q~rJKF0<M-q&Ik_}{4B0nk=Cff#@nY4!o2i})q7Qk{m0LErJuWa(cZV(eKI
z+I_!8q*O?Cm4TO6!vOqEI@&rPbIcG>JPDVAPLPgbC2Jm#&AGdtXUgobPR8linlAtf
zrMxat&)qW3uN$l7KpY%CsI_7QP&>{b;1_OFm1?`6@QaI+G%ZF-Sqy6z`=Xv~>^h#F
zc7s)E=c<+~55<hH1qyg^XSdF~Kzja19aL1Jy7?81e%FAEe91sZo`>zua^Z5L_sia<
zW_4q>R<Ez_t8Tme+e)DbPG9X`b;YsqVnDuCV}+PpXE9W3(~@>p89j~;PzepywIbcG
z2di{?bl{%4AIxL=SXjy|HB;Z-v<fTR1U`7OaX4LVvtGhWic7`o{IT1sAd|^y;UxN-
zb-~0Gzd|NgaeiG{)lm^~)GMHa(E8en$Et5le(Sx6(@CAK8(OE{Itnvj*T7E6@9wH&
zRoouKKUo^5UI%^-G0(kGhYSIB_e)I|N%CyhSgKbS01_P>t*0c4K|;h)y#d!l4LqKh
z9xZqwsZRHTL%=RsF%y&MFf~2>28ojBO(%!A@9n(+i2Hs5Q~d3rM_a+>?ed`*GBFf>
z#(&t-9iF9m93&05K*@SYs`e(&`_FL)c%BjB`_C^oR^383Jz^3rw;9@y1))^ezaisJ
zK<PI?C3aTCD_|L{EY5k55{azaMnK$Q)IRV1+t9;&b~CwHdEee%HK(2x8y#wUBD$jV
zCMy=Q$txrd-MB40MGlJ97+7GedeGeL*BorTyf52i7;>F20?8_tYTVM%tceN8XoEx1
zx6Z%6(+9XL$I^s8iLr)yBN7tq;gXxG9?i$A-8(dlKRsKsisKnzt+q`tq574&F#t>7
zTWC=#RS4C)vW6LV;3WJ8whOc4Vko&wb}=uP#K?80q$3ho`lO#W+&(;3(D_d+AhNP#
zG9`?X0n9dfibHl#xG{}x?m8<XPc4M<d27|V1eqUfyptLYOPk-TE%8BFgX~l<y*#oH
zQnGCa7%c=cv~?24wwnX-DjXS0k5WQ(KFBRt$fptdp;EU=m!ivUzN<ATYZh`zsmfNi
zEsad3q?P?*#3Vq$m)uC@oXXZWf8<9#C9n`F6qVu8(z_C=J~(Bd`{uGBk(+o+N9>OU
z?6*SYE_!0~(4&yrO1CEeo7N}vDI!+wv3cD$N8OvmpH@~^{zAeAR5zH=1H?~M<?Z=-
zNw5Zp4dx<iYrD51d8kZz(W?|7=5_MBbw1;ry!@1h`strVpT+a*CmfjLCKAB<8vt+*
zN~R3qpVD-=X*}u|OTvY`@l#q3n@zVmhpcO(D0!X7@*e}+o9c$m>lFNY4rae_PwN#?
zIXwBbTS?z;M{msD1Mnomu^A6{lrQqCkgSr5m)Ti319;u#OI2QjySsIin*&V;aim&}
zs^qx1L8ToVC&XZ;U4hZs<Z;GVoY!Ndcj)NWcN+IG$gf}8-_>$q9>6}9yby&QeAcjV
zQHX2_^`{>MU1?9HjThSHDQ?XJjjoYTCxrVAbt-h&nlPGI8o2EO<U=fOD{bD=>U0Km
zv}a8GlXNd`;)qDV6hb_wxg5pG>ozgIz0J0yC8_~l-dEf0u<@<)2KVO1_QD{Ow=ehX
zWiZwx+iXh)gj*Nhl0#=Vn}_0O>m2@Pxf}*NcoSr#d5`Z08aN17JSZq1SP$P8F=HGr
zVLM~nEH<0C^gWIk8#+Lp?HF#tmbQsZbpw9^_QF=^+|}*|+nK`X7@#<bemp+)2j$H^
z?U$C8ZVFpmJX90i6G+bAx+wN93O>K>hZh+14Ysvcq-ZwC2T_vfBMICE4PZAWBbv$m
zqq93(H}V!fS$ZS8b~5r40<yMwMyNkCPNw9VdS|~rTut<#_(~`%NBCz;iiR97;%?UC
zUPun}90?pRhq9vy5|18W%hHv3{y5RpIaamm(KTfX+vjWv!aFZX7Mdy;{gv^_!CG;`
z&Ee9FAl9Ku=6i$pdpqKZpRgufsrm|Qb+eZsIItrmE_%C(zj)dfJ!Hw^EmnIHgSebR
zYqmH`m`Z%`{jka4qp7AA@9Je_X0xkDmyv!txm4zDXG{wLd*(HZ9X2H(WJD+r^*|$t
z`MTlcM2(_=spPd&el%OC+0x3wWYeI>rAU@NS>OV1lgQNgE8d;-rg557TKzqosI5Wb
zil6V?m%@=rhm=$S<#;tL`1(lgmxP1}H@Suut>YUu!f4`!nexSLjN&G$>tG(X>A3uy
zI2+grFd!D3*)(g9@E>cu)BMcKaf~s1H@Cwzd8{m;e|qF}-ekN{J~D$~1MfahN?yrZ
z%tdds7KIkFbcKU=Sv$Fr5t|&?5r$+h0Kbt4&$9?3Yc}=<r`Azi%i5w)jpm`##C4WD
z(~paNeaumtF;R=?dWk8elCJ2(YoEb9@N?%yDfKW`!@8>0)(;XwK=Nj_ZB-4kkGk{n
z9nkXq>XlV&I%miSre0YR{h(l*Z&FqvM3gp)k@J^7i~Vij@D|}$STEJ-m9kR6V2>Tw
zYH#L{&t@BIYx-fQijHo;*$sKZO_tUM?>d6QVq!SHAKIPMV%JWGNR?s~{je&CdwXS*
z0~Be{g#Vg;)b_M4#$>)C!k>u)J7Y3pQqiN*JRhQ^uCBY~u})09y}e+_PPH0c4Nt?p
zC)qFF<;Ujc(?m%4!MI|UDzeUSo}>km1VVkWzV`%Eu_-sb>{w@zGnbs_(0mn$i+n{5
zi2>B~0V>avAb?QN6e_$4SmQOHl62)Q0lUqf^V6IQFjBJJ{pHf)QT)2=Rg=nsIX1LZ
z)FbG9wx?phl3pxr#V){v{O42dJp{0!cf*NQi0!A}rgO04nk_5GJ&4=8#`b7<^X~mh
zYHs#!20z3ve^MU%?sfK~*##aoh=P!&dYwH+s>=l()r?>NGlqgCjjw*L(l<IL0=Moy
zaGKvu6c9<_p?V}tXq$iFiQt<V)&b9<>>RfoUIJ$UL?w7`fu|%mB0RcO@skK-30X*R
z<_VNDgMf9Wo!!*f6kY23etmhvtD$<-x359qyqugNF8Sls8vlzLI~Mc<7%9&qo`;r6
zxCHhdk=Xagm3Nys@^f;GhZixSc*L6OaV}^HZ|}5bd^bnX-m%Rna7A()9vO?fbIEq+
zIRto<{Ob1essU@-KZLpP@eY0m|5l;lvQODOL)F!m5-h?jmVj(EF;U}1MVp~!dx_7)
zIG%JHVbbX&I<;fnnR&UfazwDhuQb@jrG~Zkne!X8yYB-m*9iw;EQ}CScXurSt;qj1
zgf+z{N$bu{?aNgUuo^{j9JP5%+`{zP84}-O>9@6Mv`f8N`{)VFN=kb11k2G&_bywB
zO1b<R%JZIjJC@@NTJtek*bl;30La;LfMQ`KLq?bKNhg{=%J#N(b<zL*%KtoM`IOGu
zva-2(@-7w<pxw9u*2C87y99KXz9qq>B{r;B?~G7Q1bhV4n;B&TPy3evgP${gUMFh-
zETkbL`Po%EuuDmysFlyYA5RS^8?G}}7LApC04`$0Mk}9y58p%UipA~)3WW<u#1ntD
zcE-a(#$g+`8Y(%fj+wbrF>j7fOqCMgsjEJ|_s+qfSZ?}laK@?S>ZdELFJE&d>ik);
zu-Nhc^-TM};RuE!xS|o;wl+4kf8PsIX3(5Bi*5DgMeO`RiZbKpze4L<v1x<WB6?k%
zZ`VBMIe~Hb0{HL?W%0}&^_o7RZ(HzK4bBtbqjxdmwwkLmT+v^tyO$j=2v+-9dj2vG
z-!=60CpxZ7ctRshKlQ|3TucMpxtbd1gLl9mvGm_Xt;wj(SVzS~)GK^8?}-h*5C}yG
zdGC1w&V+AY(gJ>sSbyvkK_<MBWTa#hGMZ{SxaR%J(IFv1{rbAGZm642AB*biC+-5r
zEmmYGLgpw|omxPm^5sFx|2&qTb5URUBmeRvkKCpH?b(ySZTx%DJ^%ZH|2~2LN4dEF
z{c`^M<@{aZ|DE~d|2|__Nt$RKxY~Z%kMGt0UiH5td;kA<+P74IN6KyXXF*rsW9+}T
abq_0vt+d39mBZ=pfwGc{A1gk53j7~F_7-gb

literal 0
HcmV?d00001

diff --git a/docs/codex/artifacts/xirp/organization-narrow.png b/docs/codex/artifacts/xirp/organization-narrow.png
new file mode 100644
index 0000000000000000000000000000000000000000..1ba9ffa1bf9330ef2e065c0af0a6ebf7305d3161
GIT binary patch
literal 47622
zcmce;WmKJAlqQ%22@nVtg1fs*AVBco?!ny&?gV#t5AN>4-QC^YCAiG_s=9irr@Cuq
zb+4NH2i6N*UO8v)$My}9krF|G!-9MB<_&`AcR{%~Z{9k-c?01K^9~%D;o4<?^9JdS
zs34z$Q|fUV)Q{!w*u6eYO-%~F{(LJ0Uz?gV%TE-`Pr=J_nu1nld1YnC)nRHWq6?0;
zvFiM#sqI9cDM^BVci^!#CM_^OhlCN0&sZfk*H5*P?c(x=m61)mft;P4or_#VO)Qu&
z&@{;N+qtxzG`EIi9ubmJ(OX?N3~vID_cQzkFy41zk%LH(9ke-2kbKr33gP*XmWc*o
zXiZEG($h6nRaL=(IE+k%q+5I*cwDx@R@D%mXJ|IdMf1&^LfMIl<D#&Xmof`=tGzOA
zKQ`yf>o1o95jgS`8MJE!K@cp(+8%2!K9RgG!;riA93Gp~8^nFz-@<w$3&-8xT}*9L
zGXH3GI~Z?WS^iRee3H`Y_V<t0Ye!HJ@9R1u$!<qifVYq|Jv}0#^e*~*quK2)?Gh6c
z6NY!e4NS)1Q;UJRi_3%Wh2C7bI<rl8g$7q$t<@YE8{5rki|a7G_2#w--^1a|k>9Mx
z<1VAaQ;y+?dacQv$?202ENqbZi+a9emw$xi@^q!yZ8|pF3&IvD8Cji3dF#Q!S9eTK
z^X>4oriEz7vsG+n2XFW4_=3F-9})B2r0PAHyWu3;A?2rqEJd!pu?$S_0vnj5!R_5$
zqR&3vzrCKJlCJhf7OGuE(l{N4$K=W_aWUu#2?@XNZEr9Caj&;b<Mgf_kIn27aevre
zuF!!X6%yL-X@&}kjJVt)m-q++gTYdfk(|ugoFnOJg^Y@-s4S0)jLi2IO;Pd7moFrE
z+#Z}(9lE@pub)S7pP!!gMz!uXcc{1f`uZLp9!_|j_77{1CMV?@zcj-0DSYuY4;@(J
zWngBO7ZsJ2l$4At90|CGa=G5$eOlOg2vd(Cmvp+gwEyvAxg=={G9F4IKhBeenT4UE
zw${rEDrC1SAYx(RONK`4_RbEg#iIUh=s|^UI<F^XIYD_=md*Y;58HUP-jbn^kkE96
z)vMRj)05BRZBkOw-TiyJvx&#~O4RTXocRX>{TzJW=KQj<UL-+9!F~l{VI{1!q$Jh-
znvxb7LSs|YMRp69=Z6td)IO~y4-El<l~xnf4mDid6Bqj<9?y$+OtF!P{k?Y8Rn_Je
z=KA{jmTQeiyQfNRn$NSP>TKpRZN@tb3k#>GYmxKUw`<-K%IuCf?@}zM{;-O|%laWR
zMTkl(E32x)%Fe8>Bk|?cM<Bk#fr(;h`xb$xA;2$i#_M!_yl_RA#uXI&^6DsEW@*{-
z_;J4Cr>%^2MQm&i!P@xv`t}8Ji|b!s4cq&{nZhYUI`s>qiDYm_3%=pubdM$rS<ZV>
zxVA4B5#ap5y7&XLChyEvYt~V?P-XEL-^R}5CayDcSPPT<RO>=|^`XXc28A&e&GQL%
z;1`6V^~^|0y}X=UJdGxU@%o!PzIv-QKFsZ|%IN6mbY82v=H@5zy|FHlP~m>Vks@A5
zVI@;jtgmEWR8{3s^<ICqo5+)QWa!@Msocd!{uUt$GW9yw*cbmykHex5>2Kn4bE@1o
zdKy#Byjf^%x>#dEOJV!mJA#PMTWK=Sqt0&ipi?_JIf;Q4ASzdFi15MoYJVT2gNhB>
z?%+}}aHvZpLN(|u2A@{5{uj6iOlBqu3XCtcrnCB_(4(Ksi|;>tM#P%NHxw_|<bGXk
zw%^P#S@~oC)84+x`N*Nk!9pdDB#<iNyfC!2^=0%#9h8uFBE5Zm$`TSKqFcg8vt>FW
zwkn;SofkS&FjcXYyLc;2{08S56rSH+TcxDVeq*(^wt|&<d3zNh{rwxycGue4>vm!F
z2XtD$hUsEuWo_v&TrN&>_S>O^a`5}I=F|Nf75;P@tyPxK!m-`skHI@bpmN{^!kp14
zS!=$7fRL03)$wOoj!90Y0-KYPQk4RqZ@It!yMe(@)<`={Y{7mTkroAPexWfbWCtZn
z$c!`*HMM-UKkJp2?6?vYjCo9S@5BdD`0>d}U6`z7zPI1K2^#zq{0U$z3F8Q1yw$&h
z`nvvE4)ee6FrjNb2@DL3%gbhNMn+qP=eHZ)atj(Rqp`HJ#TFx7-Ja&g4PG*0;%uWc
zkARQ(1|DHO;_=dHY%zp^uaFzn2L2H^xajD8d8DMITn@&sdxJZhn+DuSn0Qs2o4OKT
zemcH79N!J-2)v&w(+Ihj3=9q)1h4+s#}NiUtOzk18ygJoJ82}IIGr^G_ow~L?woCG
zc1z8+pYr13w!PPd2FuMNx0ZJdJLE)6hqEVK7K=46VN?)`-0qhc@*Z%k9tY8W@O)3o
zFd2O$WK{lTa^;#UO0+5ETJ^%Jss}wo%KZWO6QJ-fIi7YBsx?_c*nIu^m0UV)wZyr&
z_4z&SSG(Air~OJ)iul;>tHgD7TD9g9`;?C>t~U#fX3`!WJnFj-f3XDu!c3Q^f3C0V
z&}+2_k3PSTP%72*>DDrv8%bs^mx(!DZsc<7-p~6;D;$RTx_w~FR&DJ15$CHnZtc<d
z{bue^44HHqv*TO!%f-Lg=RR1hKlf*vcn7PKn2pB#<ZU;%59&_15b-!SPgh*~ecyU>
zI-V^AupA1ion!LYNQl;=S$uT}gRa;K;TAXF!sm7NFXD9AJ(0DxfyrtHjqDRi2BO{j
z17Ba?-@hZdU2p79rwdh?1J2I_f1;8F`1y@xa5aIJp<Zuc)Fh)zRIXyFiN}`8WbZ%K
zbZfgedN@}<)*&F`aIzZmE&`8Rwb{-u`OjfhZU`vX<kCrapFWve7%UX(y)QW#Z`C-{
z<o-~%u~3bEg-+)+PpjJeO+v!_Cbbd&zI>l<8joTKT*|ebeQ!9X{o_pw==ws!!kLLF
zO^;PO)JO9RrK*4Plamjhph6~WwncnJT0O3AhLq=!y8?Q9ddgKAIjN~XaO2wd_Fb)J
zEVXJZiK3FPPgRQ`>K`5*B`By*^y<y&JhjBy#n1QRb9v~l|MKAET$I5~pw|KmiPCpW
zZ*XMD-rnA4ATl-8?snCEo|xFb9;M{jY=jCsW$}9|mnR_)kH=hiX<Z%LN|U3ly={}n
zR_{C`F%;=D#5>-mhT&Ak7TGR;6}P{Kf8&bh@}-g>$M{7>e@^+^qoAOS;NVy;H^)UK
z>6qwD{O0r7BA1#e*IKJg66m=3{ifS^s`sz8ky@>}&RWUN3D@o6T)A=qH!7KwqO8(t
ztHp<+liAv0y^vXRFEv&(kNc;$uz}xQTowV42+aJg$NW^UYN=8$EGQ@_C#MUFJQ95k
zUxn6j77s7pSMzRTYU-gKar8I^^%S;JG1I3jbb7Hb;?^ZJ!y`XEw7t1KUr;uCkOc3M
zdEy3!hdXa;4w?y31O%QzI}F3-QmdHl?~jzcySv+18h(0g@*0tl+z`_@dga|dI63jL
zT5h>LUg;}mLw){2OS{rHH}`GrjoL2>6^g*b_*FbBe0&H9_nVoyaVT61i|tPq(oRl^
zWo2~gwC@@g7uVLlrA9|rd33FT{Sh1<u48LsW4qv+=MSCi3)<SpE>~GcwTTvb(CeI>
z?iQHI7wYX2<kTx;J>qLvoWrJP3~tj0k-DV`-KcyBKTDbwSLaI;Xbg^{xbU=gb#;#1
zYrts8M$8SoYOVH<zgbIRE9;_A>_7+$gV$(n=*-|p3=ldWxUY`NBsBZM;D%p19xgLx
zlu&N&d_7jMzYmRYh;D(He6hJ>X6J!`@K+lzlWMT2pVw_0gY#x}g$s+-G!R3k5jqi>
zyV3ECr*39$O3zlTywrHh(<vTia}Ig1A@q(nR<5^WRZ~ptu)G$V0JSeXga0Yl{wN;m
z!*4B242<K2CVUUn9}JL|<WieZg6ehV$k^B+^F<*;=y#NQeUcJlyMDoc|Jq-;@11IN
z^T5qc{jsMGEqU#sf9=aCCXgsqtEE{?&lCvQ-qr_&z-`sLC-5%?B~{gZQWB=KvvY;K
zwmL4|m=8msv(-vnw#E`$l}#0gZ@HF+cwuQy@9Q}Ya(B7B!I_$&A(=Xx)pEmyRp<+W
z<z&8N`9ihfCz>}=oE27c-a_Icp*SfiDIq_L4aCuj@h>L&`}eE&Ml*P9rDSD)-dFV~
z#mD!H80T4KtVZDR1_i5WS#vZRMVwa1NTu=E?hb>sQQ8x-TW_*bW$b!5Q)+wMpXqvg
zmY;8Axme@T(Meju&Z2+5UN3dVc%5BTw3zRRc<qp9{@brY@^r=X7h;#=Z0c$=MPXeu
z)@xU_AW~cScQLV^uTa=npAAfOl*%NVo82Wt5ir8}oK*PuG!?F!X6l><E=3~n+MHez
z!*YI2*VHsG|A2z><Hzpg=hLE9BMgP&vw-5mP!tmKqkNl)htK1N!=#UtMeF6ox8ib*
z$MAbCT4?QkHDgt{l%{ztFCS%X-1Hs4QBZ;I-FwJa!Q1Jn8GS16qBAeO_V1CsNPqug
zv%g2cA&A5vAg5M8_U{pc@A7<8KmR000=<8@zuIs?eoV~Gt-;IdDd_2saPRp;RaQ2t
zkVEXB=YalI98$JYp`1f&ji-ey9N)~izwxc&r#rH_a*c<(i7%j5jrX_bIapv~V)_#l
zy`2#^K*G`Sz(3bjtFhMq2LtHE|92Y2PbGi^S^po{)&Jq)kn_Ufh3Y+k(*VpCqtr7s
zrJ|<hvR;3aS0uw7kz9ZUh{*41N@{9EY_{V7Qm~Y~Iu)~r6vwj3is1Qg3`4K4Yb;m(
z#O0C%XIfK2HM_h0&{zR)1p(o6d3gzW4|ayj<808zFR%tcsqBf(fct71A2~h_fKguR
zk2a63=Kw^%VmMgUdJnx0R25AC*+9D+LQ+I0l*iQ4Y73@XE_QtN@(CD8{Ng$vIPo#O
zG(3Z&XBRZG-kv^Yob}U}lbxYCiTlF#Y-qq{H2&Ol%QEk5--jrlTH^UJ$;(f9d;8dm
zyJI^ZbocaVG~2}y7SYYHKbRRBa=I^0vz4mv?(J=T=5|=lSp@L2SlMx+^Ijrucc*wR
zkBp3`wKcabuPjtWRrPeWF^w=VI@1xBiHL|O42#WtGUuY{_N$}zeK4=p>YuRgte&CK
zRBm>MWx>AP(geCk;;&!dC9SnO!(*~tF5iDR;j}wl@*D?kWL}Iwk;~!qbh*~GZ*-;J
zVvW-2jQiSb{(K@Vg>y8W8Gl1P55*dA7cYoM`{VhI(G^#32^^Y|M$ni61xndyOS1vH
zi&m}nXgarV)%`tWKumJHP$4PLzi9zX&WG1zHzNTbvC(jFhR<=wULXPpykgiKUx@hp
zhT_Ycoi3PA98Z^VIgAtaLfEc8(+JldFBTLOm`oY5*&BOtKRm>B$r1Y^%VFZdP~Sa1
znwgm~x<T-;vc_cu^4jh$cS2o_W^m!6qT0T6Lg^bC7!W3-;%8XjZ#D*P^*uKpmdD0^
z+Q#Q_njbiLesOpGh`W4refkW}AJaoC`HPw5Tv-|(cY}|n`{gv|uA`5~%jHb*&B>y}
z!ScmoZHl)W4$VjF)8nMR2;7d%Vb!Z{(r$XKuTAz>y(#sU8h_mUXdO--Mkr&*HQO9S
z<>jBtYmcI0(&BJ2G5vgf+^5K;)5%Ckh|=QYJwVrg|K2t5*k3XQoi5dNYtevIsK@yV
zz54HPBCE2H(BIiG>Y;cVPP=^=0R@wy^1*ME={)W?cLU7x#4-62=%}bx6V2z;3xDj7
zOf4<*va<nBD9@MHsz?F=V5>J=Nk+zasjfCEY9occS>^)N3&WAry!_(g;%sJ<%{x#I
znV+o78yoL`y*vX5wN!65^+!=0T=MAJZx3z`v5z-5gqehZ#ds^ayWIMB6_k`f{(Ra#
zZgxA+Wo2dM5DfTuY$nt8Ry|MP(E%*b>FM$PwemA|#4&HyY^le*Fn|C%&xttb%`Hr~
znpc1x;MwNkP**1=7F=yK;&gRGD~PE?DAAcK{<)~AXtqFy+jJVnzhF{ftpVQr^S-#9
zT}?wnLuu*AAa6Vxf?PpyF)Yf#!GXD&kdUf`#Bqk3edvL{(H<luWLO4=kYb#&fSnyY
z*DeYYlCilyNx{hce8G>OKj`ir&q`Gn7S7?Kq$DIbU0<G}g+9zHj-#`A{ba|*#igXA
zbdVJn7q4hcE?W03FfuemE5afE0f5@UO7Y(FBchAlS#WBxayjw5+x?)UJWM_*2L}lu
zA)m6c`gxH}>Su7qGS~H_S3}>w2X3{t*bk8{?|s-kIymsKw@0P%_X}WdLknHV&&&M>
zgGxz-Z`|Hr?a|YzF-R+1Ymt>^X6gtELQcPZ7&=euK0Y>gh?z8*sk%>Yo7D+@>Jr&g
zELI}Qx6KcakN-?8@^mDc@%#6BU?2s&c%|+LbaNmTe2)Q@e>|<)@k&!hts~NiYFC6R
zi~0C^$WX!_y(ZDg?y1M^srzod&DJh$!&e{ZkNc~o)I6SLKR#yk4;*M@>YhIkbif!2
z7_YCx<A2EuB_25^U8*yA?i*ALoai4IB+3^G*)<x|fcdaBP<*vF29qmL4G(|)*UtXt
zbO|xDgJTZJJD6Ew0#x#h!x`-AYQlArO;R@_YD9vZ`r`!tMxQWBel)&A*3~c5tS-}9
zTOB@w*b<b%#6b7PNn}XltP?N``Mg@ISA1oZ@VRuc&UC6{dDwis-9usloas<VLixoA
zorCdOo%ETePr%2$FvbzBuXg*|9AX&LOLg{FTYY0VIO;lXMWFk`%jP1Bii+w|d5>36
zh<~WIvDn->G1E1dDU*z+)2Q=!eqj2nS)tu=I8&VXiUeuQ#59SFK^GeV1Jju?Ja*X>
zjwK+3@|CK+G+g?-jI0t}Y*K1!XaiX2gdDxR1b5_r^3%)6<dI=ifAmgI$7Xk;z2nUB
z_2r*<(u%^^y~V99DS?;g`xJ*EqYxfM6%^?#QB_sNZn;b$F8V2ECjh$W&CFFn5S0)3
z0sP353=_*0ge=N7V_d}HLdbV6m<_+(LE`^k*z|uTQ~xi2Z=pK{GJ1M?T3TXeW@av~
z0HFK&`1&@)*2I>C))W*_5G(v6Q36UxMkX#MR#Z^1p2G|&Yte4O%FWG9$f&9+DyyL2
zi;U+h@o8#uijXll7><Nd&>mv$YndA*WnoQ?op1pXQ``VxA#rg!Fj;@zMNkqm`yf;K
z4iohcjH02FQ~MXRu0M#-Yx}|-R{pPHP)KB$zOwV>)fFlVijOz{=H?~<9vFmxvYhRn
zGy%zZm|li34yg^f%76+PGbxE)t2I0*$N(Mf({>6MTNgWVO<+)vXkbW4VC)&+%<}TG
z;~DRvu^A>d_Ol(S;EtC<9?Hh)3j)eijR~;@ZE3^Z-CTKEDsK~uqn)<z=YGiIPdh~P
z^t=oV-{s`IS8n#G2&oWrnBoHG=bcPUD2W9Ga_nnrGwBZw)-p(M5n-;+&m|-!V`36Y
zRlBeZ0AAv5X~xA(rlO?GY%iX(0($gPjV0{Z=2ZSzl&mahG0@NtK=4Cb6jxHZAvfCV
zFEExxmbIWAart}P-QAs?m9^%6r_wbzIJSnLt`=}(5fdH53%DOPc79QjxwiKD%Sg6p
zHuT})VgLQ{B`FUfpPJa<`1qT@U4wVK8wW>wT63d-ax1G4A^8FPqpO9NuF2Etak5k=
zT%6A1sak>Qz*alaoK*|tR$iAUc&K;p-gOZZaXFfw?VNNe5dodce5<mL>lP0K8*}r?
z*Wb^qpm?Upq_n7L5Gf8Kcu0YWg=PBprwDvrp$JJSsflqJkv;(rH@BxINBrrT>0}m5
z3R=?V-I1o68WvjGk=X6n$Z-aLavW7cLLKuqmzzyAP90Fcc6ak4{maWN{cbLg??0F;
zPAv|0b`JA0obME~_YV(@@LAAlwSE&B9vK<8%HZ|HL<7XsqA)M-W?_eVc6XbA>lVmA
z6l*!M0=T#qj*b!SzX@mz4Gpv2u=I2;ODHML&dhMLvBg_pTwW#pvp~VUsKD>na#8ye
z9j#kgEBgKWY(<@L9uW871Uez(VyB&atDRhL&!gj_>S`E5LPNdh83l8_%#*}?(=06P
zs61bP-JbF4%8II1%KAL)Z&OiGK|I{*+*NCCZ*Tub=X1QizE)6F1aQ}ErUV%e*{h<m
zGU_dS<b0wE7Z*0IByB7rV#N6sB8BlN2`Oop+qbtLKG^z~e*|!n2(P=WRJQAne=S;9
zb&)O*c#mdlYpZJX?-)(k>#g8<1t+UT*gd516xx@T*y-q2=l7eqrha>9U??RgC)b}X
z3v`X!ba-Uam{)=>ch}(L<QE(qtU^=AW_<LBh>!N^6C`WGsuS!_MjF#2<AwR@U377{
zkFb8enYHk;umo|1f`Ng7iwleMi_=oyCE#FTFRrgWZk`m&(^s?wIXqu*@IFVSUpyPx
z1pZ)n`URCrY*$@T0V5;?6)0<M4RfjSqqQ?x`%XvU#qr}ZoI_W4x1byKg=+&rhvB;(
zPofcPZVb&k)r|}{C_Z8xe7^TOra|ZA_`lx3DuH6LsV)_Mt8skHdvO6Pb;bi=d6lNl
zK`mNtPH%DXMJR`A(iv~IA7flbf;5%9^FQa>z9kcxFgG;?G?z|tT3TFg25PRMp{b=c
z-U^{BLp3$5jg6==t!CXJY%B~8t|niiPsn&W1_oX@&d%u)^XwM7#syl(bo1{D3k#1o
z9a*Cir0+zGRkVdSxR{vKlttbL1@=?0@e(mz4xuY!r>H5#H?RCdGANlDxHX$y5K?l(
zHBK^$0UKl%-0=s+#0!bWJo1mdIkJwZn3VTaW=RPNDP>$tN<hk2w_IOe5=TU7K4;(H
z+S=M5E6d1@-;Png3=RfgUfPtMp4!+jS+^od0}IDuVp+BVR{hOq-)3(&P0RHBgoNN=
zCd(H;MPXS{W#zu9sSm5~ms$AwMn^`rJoktgd>iQG4cAdyT>g?V6IXkza9W38r1uai
z%UJ+vR&G)*3RxBzISPjNx#EIh79$G<0F5By`HGh&$FnuhyKcIo!lK0`cHz#!$*)vQ
zC{a?^+|2SZi9paNLrP$`S}Qaw7#bL0bjv7K9NH~kYj(Zcr}TyON`XeeLR;>+eP^`>
z1gT(T9hT{t6gG<==6X2C*pK(`i9UL#!+#Oz$J_x$65t)AJii4+yX&G)pzvkijd)yK
zvZna_j__-AuB_$5w=kW#KEL#MI2LMaZSlyu5X|KVdn2e2hQBKdX_bDCOmnrBtQUG`
zk%WjyO<FpjaB_V#H8mA(hJpp30QzT?d~d*%_T4uFBwJbo`n#iqPmRBx-=V^8VBGMb
z<vX5jR1xy~W)eB5+ua2xyVu1oTEq0<SsjFxU;6s{1O5|hhWh$zJ!3!J<xjGN(6>5?
zT!<(&4l$uCAa^G+U3E3KLSC%v@?``NU(FtH*FbywUD(fKm2^K@FI~!sS&)jF_OSh0
z$9gbB?vbw#Ppho_$<ObdSU~ZW-Wje6g%`M`vP8!+=mJP>(Ennb{s(FwQqf|q%nuJy
z3~V@M>*s8A27bTD!cg!UZ)uGopo*-yhQ~B90gaU{E-HR>a8zn@#Gd~%f^17WYXmhf
zHMO{~aKGjzjs8zeSy^OKA*e*=%AY^^Z}FtP@6gsMHt0f*v=kKj^S*s<-KUqTY;LCE
z0e)@gn=nS?|IyO@4`=q@oL)DonCR%so#K>$d`EM0908;mXjWE5GwKiODQf)eR+*87
z@FcqrVO(Tny)CZxb27?CFj<R8xTserDdc6Zrz@PW3F81(v<EXXGFqPQw<8I%LewiF
zh}a_|BPY;Xe!S_t4#psStR=z8#bPZ1_Dh+HIxuaWnZbQnU<&Ms%obEIvVQ)cAsF48
z_@9_1gxCXRN+jgukIw>5PJ*gzuyAlMW+x9O%!Z^SBus7XG5ONyG-@dL_+!?;ic{2&
z>Q2@;Tc``$z5PPSrIH7c6rtpj28XgmBDm}iMm^N(ESGXjs;QOB<5~w|3#ZC8+AMX=
zN$6h0>8H*wFI!#ys+p=`b-e{^8X#3UxoA?fcC{~Gl7H47e#4VDFxq%>wm)3#_`c9|
z*4`;3ZVI}miH@xKKx!%uz15i)#KTxRYfNFcimKXbvqx?0JL-6PgFq_C1*SM$d1jy-
z9$xRSS}aZvsJOkpK(wNw#_ZCoQ27~S{hJoBJ>QHroNBS;2!sv+e@=%}f5m#sHIuna
zc{Q~MpsYkT081@EN<*n!HAK<U@)UT+rqkUX?Y{}@EmsVWq@|@_^>&JYS<Yg4_=cC1
zhUQ1b5s(^PuMd5mghCPwjb4vtSk6}4M0WPZw2pbLt;bf~LoDQ!l$37qS`uhqeO9)&
z`lRQ#Pg@@GdA|@}JoSj{`}_J=NqSe-nf}!R;#Ys_7qiiZ3)F?uR`)9m-k(g1zgoZ>
z6|Ar7SRi0C78MFy?NBTAc6T!g8u%#)8^e73*iqk_j>mcK8x*tFY_C?Kz1sfv`39e(
z!M%@8Q85mP+}XdvBu@(E|3RnSedOO<98Q;4O3e~>M{tRWh<d{_V958&XNpZ{3m6?=
zI+e>cv!6Ny0>-o&8uTwZ+t@A6uWr?AUBa{@fX{_F-j*SGvY1f*qs8e!uA?_6KR5d_
z%+sn&xqft=4<f`OIwvQm(eHjly`F%5ejDTrA}e~sunlsq>Lj<C^eRSy9_DZ|&jaKp
zYUQ$YPIu@eP-}HIzE%pbm`*4D)X~ui`8-^%Tz|TjQeVN}b?Uwpo_4ZWXR=bX(+G?e
zjn-kLIJC<|Dz5#?29xZzFP<-<>HeCB_(;F5Qx~d}S$3cGPkTZV66my&7~QF+^)I3g
zz!qb0gG{kfX`7v$g$@F$ZeLH&$x4g7wDj2M=qYfaDqL`Ij<d6}fzNJZYjZfiu+rw*
zv|ct*e>7J<S7(8(LUFp*ie|BN_fxMo4A;juqs_BY@^GS*I+P3)OWc$%U!5O@D^;1%
z40gO(1w}+c0vUiVX6*KlB{cJTy}&H^`}SnPz{qH++9;yDtSnGMC;xbnF<S%ymkHxt
zfUa}~PX>brj(~#LcLOS}Dkdg4I5^NbI&P!7-sj}zw%qZ?cZIp{m92c&2RJREQ;3Rf
z)6Cqwn{2*xUAH2nf*v5z$V5(OIT`Kok}p>>u)c=7!v~UB?7Bn7CT1Jz@&W?<{9mb=
zi;Z{4dV8U$=@&@~5&;bnE&;q6;@vwVi43Ize_rLXJH4Gl!Y<+VbFYqC{Rw^z4crbj
zD=U1rE&^Tjk&)rwOz+kt)kEgK9)A}RAqN5&Ar&<M_-R0%uQ5IaIfE*P73k|qK8W`i
zm{>%fL%Wh`T=q07(e@Hzod9UBN#m_3%ga+ImgnZ$AMfiV!dGyxnJ=?gJV@lT(<j-;
z$;Et27)`sQ(jy=ze}9%YzStXvwbE$MO+vDLP`$^|{?y#O(&X^T)K<kf5lYK=o%7(}
zkpB{czu<R6sP(V;0AO9wKw-e_+dxA@H#wYn#dyD=9geBoB73TUcA}P(lMAc>B{Fk~
zn55Zu4sRRSE+S{G&jMYYhqIMa)8h&X3ZKwuZxv<5V%A&z{QYsixRkg*)=j>8gnccE
zZheN9%3%BeE$RdPm+@C=PL6_k3Niza&Gj8{sjSy9_~!}YkUy@=NTe~r5>tY#4l+7A
zugl#p5G{zzB!0NT59G`02|<6UfM#Z%!d<F!a&ppLHk#ZvVKtk@;Wj0?6bZwiqas?&
zKYIhu42rM$az#8PZ!Qb0EFm#*SATy$-pU`eML4B_?EzHYCO4C*I)U=lXNK>*w!Jl-
z7OSnSR8*$tkvcN-9`29BDO@Rpz6epVu_Sp!FbE-4H4N1MHzv^ET3bS=PaQ&XW6+LG
zNC|P0Y^)2G{vH_<=Vy*K>>CuDmIf}b{|SqCA?MEN#nwd*lxc=WZ|^5*3{}PGwpoj0
zb|V)Mi9&>V2|6vzFCI{U+}?y^MEa2T^a*Q6CkoJ549wkx`vJ1Tf>_P<xt)mrNf_!s
zbk2}S?q9$2^007GyO0F!q2_p9-u?@<R#8`Vd)yrW$9lTDh6X3S0W+2`02<%@<NIc(
z`(zrdtUq36c*?E7s86$?1wFs2A+)*K?bb5wM{9#dtBuC~>Xs-{+dCXm6~=~_i4Pc=
z{C8Px96cXz!Y*`Rypf=dLxcXmMGH3MlbV~GYidG=hllyk6i5S$!v4DwFh1f*qfZr+
zkdTp>NCRk7Ru=!+4q*{mLup=qJ~;^)H8myR77U#}kwLm@E}SI7va((z{sorn$$fG3
zq@;22@uM(k{CP~E2|O*_z-A@?AISiyKn4KWmIY}SmyH18Rn8XImrb-T?u&~HtF%>c
zHu1UVO}F^&&rg`%6z@R)jJm!K1z7;t&j$JicD1#j@D1^((a{k`WsE(&&&kV!f`r7v
z#H666e6FbQ{Ps;#Gd-ygRsiW0;P^{j?cYYGrqS{7cvx7_%!FKAO(s*lpa3Eq&KSV(
zI|1s^+&?gIU~ESG7Gh&$$q^V(@k*Z$O-;+S+D1kPOeUH!m7JYjADtd^4RWX{DHazN
zKrJC)W~RQHB2OsTH_p+4oGCT}`pQRvt>R*J85x*a;LQLFSy@Pxl8WkKB_M*eq~z)8
zS@yTUW8J_2<!FY6uHF_Pm3H<uAr=_$I96J1fLsYdL8+%KE-tFADR1w2K5gS*d?F$y
zR&2Ax1>vpj%%U+mtxZ&voZK9E1O#)_Id2({t8-t=+1l#o%NbU7_BkN%I+P|;q^6`?
zUBrkx3HsLL<b+wANRQI(8s^O^#jBuUeA?bQNlA?@$;%5)D+1aOGZWQd&kpsIn5rr!
zpsgQlnf(jgWPS*9Xmcaq>@XA_92A<EeE&xLn+)3jfi{IbCOY2bd6(A3+{5E#%80%T
zkYd2Lt14h%;9Xujk~R*aBJvaJ{rptB9{x^FO=`Bdgbk-Ir^ar70s`{%%*@Eh2oj>p
z#ipXZ{-@wfY=OAoIuaI^PaRkwcL@FWNbI}VSJxLNQc^z+G#nHvGAcs@ll1iXmxnOa
zF8Q!!bb4pP9I`O1!+qnXCf9E?6^ThnLC-EuE_~?v1_l}$D|&i*n3~pmF<`5CrI!U2
z27ycvMNC|rpWFUu3j0}X+$U^y(_fq!Jf2bMQEx?EUY^j@CW{PgH8j%3GTOR(Cx&dP
zi1mkH-owE)E1#3RPGzW0GT(V^Jh`cGkKp3Y4+Hpc*Ko&aZ@z%t6kSF1xW%agSt9#u
z6cZ2c?cagHK|}UJ*)FW$?(@zTSkZw2Hnv*RnUaok@`dyBbE;_+a|%kzgYg<hZ^1vD
zoNv9nzBI1kJ1HwGcX>p$<GH&(BWXlOMV&5WW4DDlSMW8rxNmK4hJ}UBUyf7$LtVbY
z@bi6ER8$1*66no`7aIJ=gInZd3(+qgZ?kl>YIWW-5;@dOBI5CchXzhhP7dyzsr}$D
z2~VTtftRHu1oeOX{-QLeK!suIn-=dN%VO8m(#VQ{Cg18Hij<Ekzb=XrSg#cZDj6Tz
z(H`y&<R#31jPhPxZZkWZ^ULyS%0RD`Fuzk!Q~*znkx^AsGdxT{z_LQRg9;O{dHuMU
z7y~Dwo|recR(LNjZwpj?c~$v5yxMC+LrZ>JJ2*%g8h%y~;M;H=f`WZ>Mo-UvwmZTF
zB@Odb^6>Yt;g4sN?VeXoY;0xbTNbJPUCqLek%KUA_mea=dA=7Ez7#KIi?I5>%8${p
zvEikiY>5~NT70^r$Ll^vQio;?2_2S@M6d^Vhnb0KvEBmWt+(x4tK9wY?QLgV9#FqD
zX!JQN+lzEtu>Gx$1^c?SBhFnCHv<DhpDugQdXXPZ_d*iNm`I6fX`w2A{a$xMZt~h9
zQ_0QCi%(5mZj=w;Px+>_u@4&G!^2}2X>3da>L17N%I^UpqK7FbqWI88{FR7_jI(!g
z5{E~q;~mUz7bmC1>9W$?(#(<q3^YurEq)~>tU72Sg1gb7Ax9gR^2{L5Lk3ivt4kZ3
zDu8r1c0V<VgsOD)@x_7|NtTKu?Eb-l_VCdZxe+n3089HA{cpVh2hu?J=IXC6j+Sa_
z$q5nkSHz}j>VyhzuN!(895B~#mmsT<mdex6=;?FskAXl^^|K4w_;5(s3Q5*~+PJ6~
z6frSTF($zsA5a)k@bH2n8hji6BvZM)Wh;_H5`gdljhtOd>fZT&Ji#B~uyXZ%R%W>t
z7a<c|_M2>}<9>GG-$>tDUe_zDs-i(aq&YFm^%E+p*{=54^=a2q{TZR$yxzo{iozgK
z7d3y7vlMnC5T2)`qB%gatEpwcLmcp-)3yt`N1mOH=YZV*ofDg5aiRu<E~9*3W=1yQ
zlJ{FCT5W%VLPCgxyFZ%q9T50gTCR=T*nVK9_$Z*j18z)oVlV*<&ERB~+g4zMgk<QD
zqbkVVY-tW6L4DI^WoE`c70!GDgbW!OrmxMC1fwd7rVD|Wi%XrKKkJ$agB)}n-N84T
zBSb`520@A6M5?N)K?&n`e*N`kp8n%UN$oZmIDLKX{OI$1I7`0^GWZzu!IIAZxvmg8
z?(<PqK^No2PDF^AbZA%pNk;b@CaJ#;9JNNFy%<-M8=o%}LOTOnZwf=GV#T*g5h`NZ
z5s<5v!^}d_F)jdDdk`CDXrSY}Lng;3!W@tpi2DGqj2Zt)g3K57f8iYHxNemBVhH2^
zL#qFq>JAKe@XB;`C+AZjFgd{FzjceOC=9K!Q*v;Svw>4(`A5!oL-Fjy?XX(&gCYzW
z0)ak|QfW^O3JXE~bL)iCUH(P{)=~AxD}V(z>Tnw&FPoo+hK2@*rhL>P330|TP(eQY
zKR}{?6%+o`!%w4H;=w^dyStNCQNYUq`J$d~k3D_lHhF^_l3b?hDv(HTAfaX!7dv!p
zwZC#K3eAe<H>HyNEP%8eog815Q_%m!<54_FLD3!=5+bb)v;zNz2B)7te?mby@7`Xd
z7*$SAPHSUC?I$+W)Li2PPap|Gd9C{LpyA?D6H(<AW{y57dAwqv`jSz8`9ewgg_$kg
zy8}{|uwDEc4RrYAS*@-LRnK>}QOJK36h&kg&HsuRXS`S@lc?wb=m;Pk-Pq_1{#9FO
zVq!sTY;2ZyRu<8SZVy9Llq?ka(dxfx0nYc%aB!E0rc`aW?jIp#4f;Xr93B*tloTEN
zzBlIj$aOz*^}??U*8cR2f`LJfD2SqFeX{~8x2&?VLE;mzA9m|6xfG$p<p3HA4n_f?
z6!wB5imozIDJeq_{5Dks{T+~0CTI|pQX*q4{8J=hsFW9*0||aF;k%fqq2bGDLc`1G
zKD}@(1$Y`ii0Q~~T-W#n$A<nNV*~%`^Z!p{Fm29d%^76ip%632+#3KlsP&J>(Aby}
zc*xKoqzbHu(e$?A3?^cENlE+t-!Fg@4v$4AC%b@hCyz?}C0ROzpn<Pn0b01Puo@j2
zVc*O|$G-=dGb@d^*5BGRhsUyh|7I}S{RE!r=szCT;Gh^VHl}8D(3>1iBje+H^SHmZ
zfPhnKWTLT|e6i6j9l(VEiU6nh<_a-3A>nK#ySTBDQt<F5?GZmsLr_RCg==vuCME@>
z4`)d~?EUsnoS!eAvxI_%IyyLXI9fz@?Kow#TAInT4*|AGVNsEt@f=nh10-MUd$8@k
zi;4oxsP?u!3K2gIIT=teWd#L6j~_pt8b2sEIUF#!_JXWDkBk3spL7N_1x4A9)&is3
zQA9j$gFCV9ovnK7)nUq*J`WoQU~>o>y1BjULLA58aTy#Qw!83N_<OjB_r(S7Cw_sP
zot?Ra-Epd_yy;w#^VJQvKS7`kk=w)?p%3(Qsovw=K?v`hIfwNfMku;JJ$|j(3<EQ(
z*L%p2u9;_SCT8a9$*C#ONNH$?$t5vH#s;7({1sy3jHEJhN}gWl$OVOZws&^xOeZ9S
zh4W;)9#qg!a0bgv7bazaKhx1FE2vL$Obq_zC4t+7mZ)gZEG_OuP;j`H56GkBif)N?
z(b~K`^@P#WVKVUFbxEHr)&6nYf$r`fZ~v{a6c5m99UChEId$f1**OK{C8|?-Vc2j*
zVZq@_^75!OL}j5k5D?sn;!Km1{e1jtVpu$}z-ksi5==s7iu2k*!NPi*4{IWc@OKn<
z36H}K$HbkR8%CtQEDi3nQe*-?qqz*Q==!8b-y`C`+V-GOD9q8}aygowoou-R$r{0)
zRZow&j-it-$gMgM>J&&3Oae&V^u*>rF+~UDjYi)?LRW^+Y5hPzxQ=3AXa9M>+1slM
zmTr^778^?a>9Ppcpj?xKB%^HQ)6>^^u3P-C$Y^M_4D3ErzAB-=4S^*%U1N7^mHz!b
zG&D#@VV|3k!EB-<GpR%K#dJVC;_<kk=x8?x$piy^h54(xaJ@Zsp9R-#P;l@!CI63j
zzlO19<InR?ms=2R^UUVL=evie?{>`cZ}E9`AmR8S@Ttx+_Ab_u!f<%@j~m5-Disrn
zgwOIjqB-@4q0rYm5u_QM|4zMiGju4q{#A{axbGN8gpLM^P6&@!fHi$=fy_rSekI5+
z;~$O1M9aN9)%KAEkQ8D5owQC6+otEOPr#{uT*QweZ!UE}#1HBW+J|Sg=>Ipy>T6%t
z47V|{m0!AK*Wma{D9`8S@N=P6Zw`b(lHhhgX1ri_ZZ2aZbW;80cp(IcqMKK1EdB+$
zAUJ)E&CpP1!F@AT5Y%-ZrB|la*75Y|;^HSGQ0glyC7?DA4_jZ`GlAQ|gf{s69#Pif
zn>IlgW^T>XLs*J@-Ux^NLuh{fp63)sRxn`+p8Tz)2Ea`q377HJ{g2Z@aO(2%YKsfg
zP7a7uYBbr!@4jv)Qv@lOudciHT;^(UI)YmJ1XJ8M-Qqeo5JOg`Rc|=mAEn}Ux6hd3
zd3)Nzs7F4}ZuSLC9=%7zV|>zrzdqqD0P{tF-kM{6YS-1)9>4#9{vIC7Wp}tSx(-x!
zTn207GaiVlYTJqi*D)S*r_(2>oa}79$aFS$L&`AVMW-@5@(s<N$k?3xK>!x@ULIfV
zIgfTMtGzL!>F^!MYggRQ4~=TL{<%Gdz(#oVvyv0r@htffX4>X<AI$O<Hz$EsYoIKd
z!^CuK^%)4<S65fJC%hci=M3-r;z4{0l|#^IG+n?M=k5~Cv(9*C6r^&zS>HoJZG|G>
zu+Xs3z?1)@a`g-P^hwhg9?IRN^!JHkbDB?AZsiYpO!D&!M76JO)Ql!G(=#ze6BbeM
z<0nww$&+=f?$W9p@13n>HD+gIyn=L{R<j!*Gr5I@8%IZb*QeZrkni6UM<pd0=<8#k
zqenb7+%-hkp#gO~A>r!s=H}vJBhL96awmh^)2pWGkv(T-dRp8R<ALhWTFWCMuvDt5
zt3k+>%XPFl6-ToVXu&5yD%aD~HJd5A2N!XHO6Ka~Oz7DMZq6+(64;6LR>AQ!Dh=B)
zS9{TibCZ+&5UISLd=Gz9*uQrr3=9p4OG>)mAF|$nfLD#lRXivS0RbY@C8}2=>iL+}
zhSlV6y+bY^5%K=GocyV&QLvOM`@IPAt-zFUc5w;AWflX|MnJ0tSk*DzU?(;%7OwU!
zx&G>tUk1;YrRlO0{Pnh<Q)||FgHDsZ;VIY0_d^aAK(b$kN#^-E36^*kO!1)G%kkyi
zKy{Z$IFR|^Lq>3pFIuc#--11Vx>kQvuJ|7DxJU9Yn6T<U8*jyJU2Am@up%edWH(zY
zlgxw@U#!#Vg1&Qjy`d!~h2j>Gm%jqrisIm91mZpno0X!_k0BQ1FZ@4Z+8y_IP$$q~
zU>&wO-7n6J&@wU}0LdBj;=Qpno(9h`Fi(Jn7KfzSLxylTr&aIpH%Y#)-g1>i_fCe-
zEW~f+Z@pD>P*ZA}#yG=15VqOjDYjWm=V3zn!qZ~o;=Z^(bbGlsCD5rtZf%ZlWP4-j
z|I09#<Jss4$ahzNK`I1;DSR-yqe&}u7G~S#iw$LbJ}%!S(phx69@@Z-OZJwWE!U{F
zIvWMy?QdF<KJvF+G0;PRhyf+rwd3gv$A<B0>;S6jQb2(VjM)$9bUy-a-R^Nd2%QY0
zrmMZdrGG}k6w5468yeJW&B4IW%WP0Slhr-@)y>J$=aSM`3oyA7=-$}m+V0T438o6Q
zgYNDgz~o>!69QIj0n>cy#>no1_r~kHsn$YwnQ>=!_S?{F`0eQ;RRN7Oc2@jOQSZR$
z?Ch=(^zx5*oG8ec&L>#(Icd?!Kjfa-*w{c&WPbo)3cU364|`)8062hf2u`bxclz<}
zsM)XDT2@YG6b@MGMBwOHdSfltSdP^3y@985Bev~6CmfFG9~`{Ayz$<dX>KI`41^$U
zyiOpCUp;P!cG1b;`Ki~R%vbO|8;%_RByV2}BrGE8G#wgF;zsrV<qth}<KGA%O>|t^
zNZI7XgaI$DI?LH|A+bwZR+jEmo}~4aZ__mxUUBDc0Wk`+e{P1^ToHopn>5VXnDlfy
zqTl<<qoWxsZO&O46$licl_Ya=NEU=dMPdEf5rhntK3i#lQX<6e6~Y2ytWCG428K^g
zn%LI^U~uo@@%=Y$9Uc~|4VA9NhnVUi_STj+W<<o?F_h=1wzC%<t5CL%1O1;~;ffLy
zRg|K{$+1thq{=W5C%l{5y<X3AHqPwt)?a?=iGZ96uhSjOMkb$t|A$Q_K{NrCGdxyP
z6?T(l<LyA?Kq!LN`Bn|}e?JXJnEZ>$yuznNz`=a&W91ksxpY^^0i%sm=Aziz=d}Ch
zfC$|z-M>e30r@_oz>Mn(41~du$*rj{9Kkw|;BkNWQ7?tNJhlKMUYa~>xZ7;PqwQWH
zzu|UwesP^-ORL6FXT17!lh)KQu-4!J<v!W|4ZjjQPl156T(b@Qb!b`HM_md8?AbQ=
zz4X+Q(4?fo<YX+Y_H*KKnA-I>6DTxl>Z+NS(Nx>)T^D1Dp0w&OeLEq0pFWAXrr{m3
zFtS}<A^!3*)RV`qO#k)k+xPIeIMU)@xv4BHKnAk!U*}`allHr1(cM;=XXV(lKR(9D
z8YEnvSbKSPDK0A7d?)nUtqZ2{CNhvkzB(Tc1FQ1!8aGgzO1(<4IKJU}ER}og2{n&W
zkaCI5bQ%dlF+<}A)^vGD4>ZD2WxWgAgA5AjdYyP+u%ykSD-V;|sOirizW(FmV-{8b
zBP!6zBvPyFmu{d!;)zU)OG{~i9Wuf9a)Zl-T*dA1L~=!(d~PHnqIWpA<tK%t32=+I
zQdS52+J(vK{;yG9oz7TV^?LeOANF@M)kgJlR4gnEAShez)586(*K7_<BSN^`9DAL8
zx%zCr)T+1aI{?Tn!yDD3!t0p$$jI?hk#f2fmvnANyvoDw9Flpy&!0cT%c3D$#_`qb
zXXm)yoci4Jm~NlLZuJQZ3zez2A$PUIT)b4eVXC9l8^AAr6VYx5V{OI8in-=XcNxmK
z1e`;!FLZPjxMC*iEiU$8s<=426bb_F=i0;Hqm!kk6!+JTS=yBKDEF)LuTJ~MhK9YD
z1|dL6gb`J%bc3~g?037q8;I<HNWy>X^Kr*na`V0M(M)NV6zqJ%#x1nfVne1z6Wi+Q
zD$GN0i1=_iYqs<mep|rRSlp2H9{^swHZmv0!|_<(kt4iKhIk(V#0LAL#U1eD1;yM9
z78OnG+0u>$l@`O5U|uDV&plafMCe5pP!RI95gx^VM-0YS9<?mhX)a)4fjK9XzwSfR
z>E3lG-XXD10G$cfN^v;HHw~?Klj|Glkp}c?d)8Vxx60^Wg`^;TQQ0T{$<J`R#EGG%
z<B6uN%A&G>0{yiY?dQ)6ew40ra_rJ`x&Rf}eDM9MS~kF0=AS|f7RToa|2GAJ|CA8^
zyJ7TyWtA|`*yf(Z>6)ts&bV1AO-5j{4`db4fYFglJqz4on9mb4KtAew`Z$`}l$xCU
z(4{L9o;LivCu9aGi$EChk8x7SNwu|e^0<**T@reoKc)rdt~edd^YilHlz09ITIUmu
zj4X>zuk``p!`$>V#(a4~eEjZiX;W_mZe~G2U@h?C<rU>Ez~c<apKE!HKt(~durU35
zyz1vZ69ts!TfDEL;*v+pg&LJ3P7hBrz<5(tUHE&n2nPGoR}P2J=awAtf%4*TFugij
z=P<#xzi*7b<Pi%p<d^3c%ovgyT#ld#n+*388XGmBPlx`S7GQ3^Jafbj@lHS@6yfpj
zK}Rd(<o#8G>n(n+kv?cc*~$@R*NY}u(K7a%OfXSy_lKtD=3lKw?XLIOt(>ixeC3?(
z?`TumZ3nk2_shTtJXo*Wsx5!&sN+ZLOEr!<cg!eCii@vCx<X0=<_1P2fa*M^(Xd!6
z9<abnM*Ms}!CV5op+@Timk7(W-Qo1ZJ$#jE4R7cc_eaa=^URpuh>MHAjxM)eBZzPx
z`M53ASb2ep|CoHpZ$VM`yn!60T()w&Qhn6CFa_bm-`PbB;Dv101ga4YE$!!#jNJTu
z*TZ3<Sl@;p&2H|?iO3=7!=r<P54#({RonS3CgjP=%5peA1Gt;jWP?{g0-_BQb2Xoh
zO>l74<?unwyfQ8V=JZ&ri5_UPE`QB^d<3H8`$l_5p0QCtoE+$@hli$-`JlrkCMCB^
z?2nh#QhU<seycDmp`on^Io06GtlwjPg**D=_S0gn4p?3O{{D*v$Uc&i67x@B)E<}%
z*sLY=WMt4IRCNeFb!%N+#g@2Sw#@R*&W+&Dt6W2a!$(F2e%cuW<Hx5CD!|uJ-*6X%
z@ppGSFM;BS#o55S_|L_BqX;|n7GQ&#@~-b28X7P%G9cD5lV>I&(I2|u77K<ONoKVe
z^ejD0C_iN&ML~@jr&S#SNiLk157+%OD-gjxIEhr&-&76;zLAd(3lfpBDW#qDyt%es
zAhP=5S2>l{h?SzGpwC_L$_~F8)7)$>WocPyK~eV{6ci-(It?<Q1Fdh^si-)as2;{x
zvFD!vd<L<?yC3eZj=YW=aN+Ni<oa$-`t^vYU^^WNO$&;J`nn5>JUq#D>?CL;BBJ5C
z{_Zd45^oZ(^0elUX?EB7LqFt?re?6{)Ko_4$jMDEBB*1$ETQXU5-@GPjM#QFtbQo^
z`}dkaV&#tml}bugG)gEGTi9r7e7useqcK`46S2Umne)|MU<kUc|Hi~83xP@kLts*M
z<>~3_%F8>uDk#cM&P}DU>e*y=0tDJaPDFIsnQIo2!E-cTh9H0x_h#cNv7}@eIaX3y
z+Q`XDRm$mQla(e4oGM=9>pE-=^o0V4<o*p9d4TCJy3|U2=soahNAWJcJgkjLOr&TU
zTwd<p3BkthyFYw5SqxkH4ooFChx_2P&R;H1*UpR<)hwPjPiXvY^AnXZMw-oT^5(^2
zrUJ6&=B7|k0h%oyN2ODb;>u;!^h>jolVYNxeviH9xqIVLs9?wmIZBpXIwK%6r?k|-
zxFADBZ%;6n@6J5w#zLK(grr03m#5e0>~f{avx~hLmARp5=uhy08@wIrUgHGqZ+lD(
z*YsC<OMyRtfIW>G+r21nL|0?660PA|IsPYZt1j(PP)G;_>;4f1B<A^Oli8P=E$SN@
zRJMfwPP{=D&RIXjIZhE26n?EeJzH-6Auq4@{;{{G4lXl8cS**4AZSa({ps!t2}`rl
zZJ8?~PA}dD90E4y`ttoyBy)p$;9R>d5Ler8i&(Ki7PbP7pBd!YKK?rqzO&><O1l6f
z_}~!_xaFFyt*sda#Y`+-n$Q9`7lLIXzK>71{%abZ4YZ+Tn3zf4Ux3|VV?)SIYSHPh
zMnXc8C`T!dt<CQKvbk8*2%*44^VRKkwac?ig@i*tlv-3=w9;pXhJ)6*(Kv-f014{+
z-x>OySOmU?#s$R*l?+G5pSA-~2!2O)Gd!t8<mj7BlJy4MBO93bL`P?}dA5Tx91It{
zfsEYZ>Ofsk1Vkgh!L1qwgLziIr-X3^!CdHMCYSB;oE&|@WLB2xp6`4xguV*GFfzWR
z*#+%LzSjTy0_T6|XQ2D_L;@Pz{ybA}y=H~nn!e#tSqM9PCM+qnpw?I8AD&cOr~0Ti
zg7J?rO$c|zIBx&qhrs5q^m&oY9m~FEoJ}c4S;vFDlJY_m`R(e)OT9)$X<L)0e4C#=
zf*F%9!#65{r;ytE+fI)!Y(Hb7&3BR~pvC5<aWejV@5?8n<7}HynzP}{hlQ6tD3r5u
zC-#UEN_bULR9I!b92+EK^plB_U*s~a^-kTaDptqHniQZCaC@&5TIs*4{fHMD$xxyy
zZJ{`V;E2c|xFZZk4>&mH$Hwq8z@UMD0Ra!Bn_o7|JfAU%zkyTrDjgx-C?A+Y2|{jd
z7@j_;29*%dznJJ~K=qTqaL}l6M64oQQfmvEbmWHhk(ujyP)jebZSU^XmY&FzmA)ME
zIxctg+#2H2-SuK*$q~j*tbySuFvN-itHLs*RFcYV^a6lcu)8vi>}LjJ4fVAmZ5lGp
zFQ@(0A@pC@h*yS-I`%(5vwTwcU|Dt5alve5NkB+OWtyeK(b5(8&|90N)kQkb%+8+Q
zOqESlZk}uQ(7z?QgmnYlQsmQy(89uj)3l{DUQdUg_uf5VE+2gG2bj5=sFbgNe*Y0R
zc%{+Sas9VWIPK!FdIg39lFdJ%I41M$!YLyVHJqz;9Ro8Ar>oWFs#i+5oc1lQw|Gs8
zy1J8KieC0Nka@fp=Ml!z+Q!QS_P~c4Xf(Q%%EZjSW4BtdTxw<J0dxOjdu^FF!wa^a
zr5X`%*lZ3U&i!o{4C+@N&028LY21jYsc|-aNv_x4hz7Gl_J@;tXRQ#&b>@aw@fMGW
zI5tN&xOMvAvvTmMmGx}h*q&QR0aQ=2TI2kCz>f5u$++KInVr3kL=77gQ+3e94)L~f
znh}|XU$+<Uhuz7PPs22%Tbbwo#oJp)W&LjJ-ioBObeEuXcS)<Xv~+iOOE*ZzLrXW(
z-Q6V((nxp5xqs`o)*gGGcds+fc*ncn|CE6~#P_-HIj?zLpXnAXW`Mo$Sz5?&zhaBl
zeGC%^L(|4dL|KO8+<f?e$xddcQtGyHn&TGxs0+B?vZ9_qMgojJ5BCPohoguDfoaa^
z`Dg^V2S7mj0*o^aTAxpJyYfa5aYkEg4}ZpFuQ%U@MJLC{Z*6a<Lm<xk+cl$UJW&LK
zpA;1@o|YFedZRQO_84oe$CB9Li0474#9_VQa=u*}n?G7X(Ae16)Ax?ld;P}NyX=k@
zC`&r-a_!5@k2A%b#xg{!P40bwU;@65kcYUqYV%nuHtUsx(b9c<e0<O<xIf+<jvg+K
zrE|Y*QLQ$hZo2(%GK?_E_S^J|ieH+YF4xz^&N(fXhKXkZ4hUGYj+PpoP9IEV8Lh$S
z8OV1=qv@R1M+ZByB*?p~&c|9>s%-4^mK%BW08R3lJBWC#HDRIGx2J22q5DByp`!ly
z^pCLmr!Ywlwn|f_sy{c%ev?&`kJ-M<A}#k88H8!wi&wQnQ|R~GWNRcu;ZnE)H^lZf
zYwpkG{mr+xrv;Da6+ajty>whn0(?F=dW$aR&w-Hp@2cMV$J(>bi~?<y`>XoVu|wWF
z&U#<Z9$5EztnpjU2CtM<oGn`2Rmb1Z5@B51Xa^RQC<ZW70SChOak;nH3`v~&cWf{)
zFaRASiHL|QD{HXwA92O;A0V0D?0TOt0|Uw}fCw2H7zBe4YI=T8KwkOzlLhpSG9cF%
z5g}qS-_v6_unq&_j35;<l_!Iaiw^Vxkj3oPTBx<OG%&c?j!?+D%B&MX0ofCvgXYO3
z+kqS?N1K<QTY<KwrnHn4Qq4#@f7jfcoPvn{pGh&<bUr_Bzcerc(Q0+51ThKl*krxB
z$Dg)FBO*Fq>*~9;HwIp&wfAmUyH~rX`qK%~(dnT326<C#;<>uTjuipmJOELtw{M}H
zq{oPtosZ^1^|;y-$4CJ2sWc8_7jMm4{)3^`8Bwk<*R2PG(_(c=xXMaKw^$F-bhYlN
z=v&d9t#eT_b_#YH>cF)YMNYWnmFSnWZZe5zv0Qf#<krQ*4&}iw@IL*)YRPK~bXmT8
zz)VIk{bXAh^07OglK*ylI@fC7wiH(5{^EpHu)gWf=*x_Pb|p{aS@yEa{zFH-h3C~~
zB#~i?a4@9*f~AKCvdzG$_+cGDf`D%j5dk?mI=V+rF$m@GyX)ni<3;0;N?Ap~`PrGT
zpU8JPx$njs0eX7tOa^mxOFymS1L*yNqaq_~Nee6tEP@F+O0%=+T>5@AHoCdFea*W1
zpq(jXvCuvDo|N>vH2BF?A@s}X=u}ijuU)^6kDo|tZ*K?QB#;d40IAmMYTQ-~V8B~$
z*uS12aS0&eJwtJt?ngg84FO@q#6%TP9Zvb5Zd9yA9;#pcLqAvrwTnn(S{i-VtU}-`
z;SCB%>0XpQB{f53_AC-N_57FD*XGj=fn{p$5TnIoB13xv%3L`1EmLj&*soS(S^<Nz
z%+*d61yS8T?{+G%g)+u`jvn!y#Gx|WwbNPsPe?ClHb~Imaf~{ex%s?xe=Wt+s#IIg
z!WJ>xPAb-Z08l1+dV29lTxA<tj!1>qcd&QS(G%a_UbRfG>7s+kmel+=YG{ZrR@iuj
z4L|>~FwEPx-2g<=NkOhk<fGts%HrwC59Dfpi_8#<w*;d&7cjRK5=W~oN+w7!D}++?
zxYF=6WY7$hl>Al)1x6@WH>8oTo~<7I2S5s%dT6n})KN-Tjg9^JiPbj``_jtO>q~(Y
z#*;`L%!K^poS@O6NL?cD5eerE3)<$+=GHoI;<4lF?{9Y4MZOBtJZE?y*oJs3f1+e9
z44_HGd@eiw@+L;==~~ZpKG}kbkS(|>vqGi5t;XtBi(U315k9xi-z(S(=^1LYANZ}|
zQ1RsewJ7l2IQ7hoViw}A3yFZ29%7xz#KS=YqOR`RM+zA}kb%EgAvqG(mK_^!*8zUh
zIUJ7yFf*w!n@^=C*!{TZeBi&Q+w}?#mED=nXdJq9p=#&F1x%0A!JJaLmS&RRcj6m2
z5RvbdS^I@d!o9toTYLgn<5&%77%7k;`(WTz?+Z*tFB3mNnA8V~mb4g@ZVKSrh~#5p
zVS!v92KwVuUr(*gkI$wRHMPmk^=&$~8pS@ZC+%Pmb!<KMg#v0jU6tci_GU8uYGdwJ
zB$^8%@?v;eNg7+jKSg@~x%DZO`})ho<InQpRC&2|eS;tuNAqu*F`MU<1z`Tg$*MNo
z9!`t0=H_nTadPSkL=kccSi6UTZ<0#olh)E2{gvmm(ThCaNwiRh{Q7mEv5zX_K^Ukq
z5>D4rmYZtzKkkCUWw+gOu{N2lvP3X>;@2-=m^YotBibx+J>LdoDw?mbw%ADYHOJ$4
zrslN8^xoDw=gx<7p*|JhPVS8Si*g6haC2bfP_fxRq0h}dUr?bRbk%RMTDI&f7ABj{
zgB&&1oA>M6lV_%aQ!NL-+vU`_T-Ua_a;ZPrD>7cU12(pgX8+OxlG4jKri*f5XUCbF
z4zHvtf`#@mVmU}W?2c+UWeXumvp(IJ_ygFW&Jk!7d!Ctf@<KSPV6Q&XS@d|0tukI+
zv9M6?<D~gs$VF9)mrYl^iNCJ4+D%2(kN|(~Jv7SNS)QoL3+{tpp!EKeFDQ0<^zNS{
z!T=~*QhIu1&hzYIU`0fGsXK_^`x6X0d_N4M`Y-}$K_}d`m5APNn|NZ3fi;C{Bqy4V
z4ejd}y8-n{Nu*|7P_b~_Fw5izm`{lyV9`M+KS6?9TFQyc%cJ`vH1*B-P>xYv$EwdA
z6V{;Pj>H6L01lhF<nX;sPSNhuMQ&wj^n*Ru*C?-zi422d{<FbX>F^VWC|hVeZXk()
z;UFq(dQwI<9d;}iNuC9-m_wdP9&p@d5yF2K3emMsA~|(_7Q^LUVKrkvABrP}eKIxM
zS1Y-7dA<o7ih1*8q?F*wYR+dw+rw)r&nxV&jMdnXG7~WBn=6+a_(wDbvRgXP%QiRj
zfMPiBi(Zkbi^;*=!4hG33L?~+M25DRj_Q!|YA6{E^9AJKHEe?7k3eKRG6PU`>z<-B
zVJCe?BCLFt91fGL{B&y1`!KxG+3k%`h;-_$e4P}Zk{-w;p)q)z;ai1?7KZ0+B5x$#
zOR}5~LW@CsRO{Nq$6QDDCv~<#*y?|hRLvk~t&UPOL*c1wPwCB3Bm(enqkp`m1ARt7
zp}yS4%5YZ{-%5SZy@spzD#cRW<S>JkvdC<SN}7`;EW086nvY`Od)O5UVfF)42AFJN
z&~y9`B(BBY8*fU<$~r$i+#a>S0qf}Pvschsc?BTEfQp)>QzU@x<{=<Vv+?rd$Bzc^
zz6Abb2>>7m5zu#1bYN?mD>6KH+<&6Eq9@-HQ&#49_bv#X*sH7q$ilQws#`j%IquFY
z=0&-=xq#r--E9JE;!Eo<Yd9`~iyn>9hYI3?OAYSc%Xbkt3>q{S_y-yKfIb#3cWRFu
z$OJG967rv-m6DH^8`rzgppD_@iRb{ZX=<oAGR<<C$8mak8jQ)RO*ihof}p9n^=bpJ
z!`%D7XQt;TCkCtlAXphZ>_o)#T;s%lwAt^me_;ihf`}9@hvWGjP`q0VaNFZZrSQc|
z>z@xO<a3&@6j?tD!J!fvvZ4|REC9+`pKSW&!E(9&&Qa6#0qtHnR?`}YcUG){qzL#l
zACFBC;P3#<krDM;O`rmUL1sll&F5B+TON<iq+V$v`Df4**xB1l&X;F)$RT6Czd=Ba
zdS6=$+J)9fSH_1H+YRi{H4kE5r#B(pqARrGpauIKP-D5;pr3CAhQxrr!C>-mxz7nO
zXi>1`5B8w!q7y+g6t_5C4|QeKwzDfrNil2S0B$iAd4^S5g`V#2bTBX6E>-yW(L~0I
zfupXbur$9oOsPME-Ce87=!!xD$=S(?+iBfkmLY9x(;$B=72^$lt?sh+uV2bwDDLB@
z1K4DBtE9A&VE{TQ(YILl{M~bk3b-2I$)rX`gb}b+2sXawd8aI$#s~802fwqrVq(5r
z?#;NKfibi(<L{Eoy?K5Xn!SY@0^r&MAxxMNT2m2ilC~-1QBS)kr03DfWIz9$?)uYM
zaFT)WLZmc<b^|^J2B+>reQK&j|M$>PARbNu)C}kiObrZ73{BN0y<m{Rh=GlT&0;Q7
zh={i-C@TH^`}asB9MB{0ze2#PWH&!d8IJ+~Ib4MJ7MC@sMhV#Ma7Tv$i%!7HE}hTT
zV+5ZaaBmQHK&vrovC-!0a<w=Aie0<W1B}fIy;>TP$oPQt@hEz&sQ6u<1`4QGPFAap
zUK^{|M}qZU8+o9UhSs|*iU*qIt~;of6{w^!(a|U5R7Bw10VBl2Cn?DUJ=((n09XnE
z<DuZ?GH^YzW(-JZ=wFrK*&E@YWCCU;`G3&TY-m9|wQRMX*=hKr6a51wz&nZ~6Lg{g
z^D`xn6CNiatJ_<FkAz$<(Bj>9HRfj16}@^kAN%{Fny*(RKYikNKl`@E%kJdF!SoYk
z?wcGB&$=E{a0%A@x-*KOe3PpjhgJ`o>cUD(_4}^89~u_s=03`?hP8RWu*gtj%}2#&
zdl6=PYFm+|r{4ylKlucTlHftx@VWc?${)boPtcjqf)*FC|LnVQJ~MN<S3`i7s8l>_
zvDkRKkuSU32!`(%aTnLueb;A(lE34_aoLrD$~ZBh+tJ+6*vJ!xJ?e+>3Qkl^t-*dL
z5-r8IyapHsy6Tc|uj>*a$thY*UKG6d?x{+WvDcw?ioVC-?d)qw>nWm7LBWAeOdM(b
z!y8*VJVGsAh$Jx9@$jzZ+c#1Kgp~{`PEJ`lSL%Di2Ak72u;Df|z-sEPsxA*W0IrrC
ztdIGpRK8MAD>b-JO~^VTSWV8p?-9rpl7W4efb*Em-sJT)914^GiJ-@8q}RPP^)fGg
zgl5aNXsQvcp8Amx5PZxlbT_s^U<kzbkvcqGKX_YPX8;3oDvzhKtSl-+pbiG$ws`~v
z1whU(p|W4(haVQ?D)b`L-<YSZv;@6^F$6<{;q5lhegEBo3sZ$aq_rL^d`{EeIJ|m&
z^QW(Zww?6=n3PahOOE;iq@5}vjB!M|T%w8m=RBX#@qKT&{ps$C0mOB4cLD_0_}nhK
zmmdkF+@PHyY*zkCrRsGcpt0)x8?7}egKH*FGk>;xwLS7foby$xYds>xo0mAB<mCqz
z`|<%n7j)6U!d|Xjj#8_n{DrO_2hQD{i_yDu`CFO$!3}l4(Ecy_p~+?ztGO%@UQl8O
zAmUJXEPDU`UQ%MgAxOa*w#JVfhfR!KX*lGRH%yurmK5jHO8n3_#=vkxYNP(e5=_uR
z2MKygK&cxYx^HuQWyr?F1gtA3fQAB?xNhs4)E~Lcc>qd{)SwpWA;r_(2>>A-dP}%f
zMddI$0+Lx>7$wDrDQRf%0|%~%n#QBiURKuawD{O``r8)Imh@yI_;N+yv!`-6f|!W%
zj!aq<F>kH&>dRoL@RUd*Ud*Mi<m7>b5nvQ}aK8zj0OJcl0202*qZ^^!2;AKaLOpDA
zJ?AK?Fjb&x^SnL+kYI9hv_dN2YYTwbU(5{v{1LO^Hn{sLJ<!~Z>={ydHNRK}XUe9t
z5tFmnPEMm9YayQ5vY;NUw%Dvqf;$n6Tc%4DoF5z60VR_K==Pta#L)gLYb_~*oPhzQ
zixyXv8dp}ggNqhcc|7s85wN0*z^0J*3(Y}Mf~dgjcslrAXMoTkla=D8_7nlISitV7
zF_~!ATIM-Pa=SicWMHtpJcDtfA4apat<3Jbw2%8j0Gk!c?_>cLue;GFI@A82Sugv?
zNs70aO|RG1vXgCUUT>WQX0uHvf04hdd#B{|c~wqUWv8o8Rw62`{e!HkDp$A3MqrI^
z4Uh$-dgMX0dcYh+t4VifW7=M-V!w+ddOA7Pm(!_e3~ZD>{Ay-q1_WmLkA_~T&7=V4
zc*6uOKl49{R0YUIZuct<aO-4bXj2;k-iM)~Ash-}yCT9mi2$;o4I2g1O%P>n1d>B<
zgrezU3|a7JzrV84fKuu@SD`CN=L(t!%rbmo1@VxV?*lt?SU}Xhf2A)jJsqHl>wd<G
zGGiJQK?}y=s?j1civ_S?Qw2Zc{tK9PaJaFtw+F($B)GVWCtJq<JA+M;ZGCW%-N~|+
z-&ty<7M#@x2*?rP;Rb^P;I3ZrzLBdh`u^Q<pA(zUXA7i#J+9MRkmMbK2eR;k+vSm<
z%}E8A-J=pPFLYGSoMPn9JycYT*Wb7VzFJytYw@^EDU=iK?kTA)#Zi$@n4bR5G0iwc
z_3z1S_V&pclne|Yky;F1rLa|B%E%~hDqq@is?iY4WvwOvFR@6o*a(c!ap+UW;8F7=
zar$S=LPR%jhnP8!6AWV$%e5dWNx)qL_`f)w(n_u%MzGXUMaZ~FSwuE7n}AMAPCi+n
z+eIaf-{wAM50_AW1601nk91#~4?rOW{(lFH6}LY>1v|T3t@EF+M)dnDq5%ZkWH!ql
z;Ks`|T6&eC3KuHvok18C^rWqp_cC-pZ^z4ZyCgWR_PE?fJ&+=pu|kb9i1(Ix$f6G(
zD0Mb!S*#rYEx?T+4Dgc>u^CJ!iZt^X_^*z5Nx4#|tK<Hv<0`EM9Oeps>u9}zk2HSv
z5&7Q!3Bv0go!MzPq@vaAf)~Q;e1t;CHe4wNaYe-b@zu#vQE|HZ4=aSH8iaiw2iIUQ
zI^heEQ2ntU9v?wzf!q2Lu)haoyEC}$t=4>9fdLEfZ@9gEt^?;wO6WxG*EcX2wD~w~
zAL<2F9^+$Td>=qp&dc4h+GahL<>wAA20#FR-*qg>YCLkdP&4%d&Uw5Tw3l5E_(hiL
z$qef4d0S>POzDELvpK=<$L0}}e~O8Zk7>8M%>ZI6z+Y=MIVpUP^6Pmyn#O;AQ%Ru;
z(%$Ly{x@4;#=!FBa{jASGO@g(r%bbr+wiP=f0n`2tmv<**Y0Q4Prw@fZc|}>w>dE7
z?=KqojIspmK)hUYA_klm3(YobO9ZnFwA3`CkhY{!<KB`68k(XyD-E?;gNZB=3Eb?@
z3Z6=^pHDCTRDoi+gE*PburVpgC2Tt~V9;Uz7ohz}Nk{;~g_dkatIl8XQxJ46&CDDJ
zo-vR<<+OImTHoii8cyMs2Hrar3FFD`)9a&E<C`@td;9a3kN3dUS7$w&=UALD%$PY>
zk$#(kh0ouF&zMS|Rc6#;=@(q@q9vZ!chS)BX~3`qI;~CU(ak1~@Zb<s_a2^)FvWKl
zN610)fFZtqGcfOZJJ|!yDw|*wqPf{juUEBFL05+$=v7#lHPNQMYE7IDV=kU{B~2jc
zb>_b&W}^iFEWNHxj`vp2UXKSBmho|z#$zd`+lT7GEG5E8{*sAwAPfjdF>ccZ=m6SP
z*lLS6M>n1b`~e{7pso%9B{D634qCGvK?pu43FW`EfQt)<ztz01YETRH4pmjzLqYlW
z%BE%)4HlE}@B|XsBf!J6aj?9ZHnOl#EMxvDylH5(WoQ%{GGunSpF2?+TTso$;t9an
zjG35%o5yW+Mux^+w4yw~1$c0KE{W~Q8JWpw0kvVp!@~mt$_LpA2?;v(>`EO7@?*op
zG>WbOJOFS$lT9jP_tzu<Z-B)O68aJqw`cLkd1x|{HZ~stI-{(t7S!O7kf}~ICH&B*
zS_3aU1O(fqx;m?Q|9g)P4^R{UV32Q5#fi-}&d1yJJpr$;BmC+;m{_VI2)rKTM-x*&
zXTLGu1Cu3X7!C+)GCv4-0|U7j;x-_*59P44v4sZ*f8+V!jn^8Rl$JJP^@XSOD~I;^
zEKhi}_swpz+05rnhok8U0PNlj_U0GE!^8vup#WWK<&ybtIPw8m^-?|KKgGhpgr@2W
zC7av)hB+({8Q;V9_6#r(a+a5tk5^j89`H?xwXF21cDmn@rk$KgpOigrEj;v&sN1;0
zA`_0csH=E9X*3WDM8{4w3HSWI6!JwM4jgaq_zMP&Cy}xyS!+3U7ZqQO_9HqrUQ8wo
zdt@xV2@Sh9Rt4-5K>r+MgonEeQUnLfbtJ-mwq+tgQ7oeIAi=7a1Q77m;T905v;#<u
zXs|<nrV!HDdnVNeI~elrevK9*O@LWR)}~r!Y<IkIL85VG)Q~SjW|o1D_pv4G_d%E{
z)aR|PHCY3T5_r6wz*%Nl%t16fG7O7+&=(g0I$w}e#$P?q15m2_iz9ZIU7Ho$sfQks
zAe6u#{z5I5>YRdJ55pamSiSi`RUZYv#Q*S*|JUgD=E)ib29?x%{WZ_~s|aHL&|6fY
zZvaD1<g+Gx8~ly*Vc>x-Bc+;J<<`xbgc<8)VCY*H#c%3F8Q(LrOEliIa&zO^+6JSD
z*o6P*%@r)_;=r%}7pH+bMDM4^kH<D>qMrrb-vDJU@LAG4@^xZlNr_azN2K>O%rACA
z-{$d<8ceMEyn;*RcSjNbT$6GuWW3aGH}U{5C5FN`y-7vkPH{x>we+SeaKbKG4QKxc
z0Li}zVg3K~VRS?PP!Kr<Lzxaev#(!ubiV5_gLwYfSX;P~=HEzGv2#I>n|i0^Kv1ER
zw%E_611lp)UTA;lSL~e{G9S;>y}i9XSpPG%(|Eay{6`muM9_=He6*QG`SPKM)|oR(
zI2oKV8&p!DshXIb?OP8BO9cKO5DfBq2^t!pnF17BYpd76I)u|22;qRQVvGYoLz_CQ
zaknrY9-d$(AQ6dcWMa~e1}%>cpfEtgVY5)pxO4!lTFqq*i75Q1yAcAX!=NY<Kos)z
zZ@RBTz{p<!26>B{U5TiSpXR`jcs;vtd5%M8H8+=)Ndm24GM#h^pr<X4_oGX$VHHIH
z7NSa5udOP(SbKZ`2>1K7L;&0RstH6X_W_c9zg0}4PX|L=+q<?Fcmvy=^}(-{!hq)0
z0fgi6WDVmDKqFNYYBuQyp;#cnjLHDj!td@<Pfzcibn;4`^w7PtbtH+P(fpYpfa1!L
zQc{BJlVAkG*<`=p7#Ikv4svT}Hz5iD^f6PY(1&ukSo*c0^Mm&BLVOtbO#1pMe)sDZ
zuSchyt3%_l)Q_^V+SLYyfYF+j^#uCpgl5-sP*-gMQ0+%=yQh+@EMVj80Vyg8T&28$
zKH28h$GuB)i9VyeJgRK+?5CGLBmz9MrTXtEC^jyR0DegR*~@clYYUJ(91bV{baY7^
z)Ls%y?=R$5H8!RsCE<1<66Z@LvDL^Pr;EU%c4h-iC|Fw&T=1SosPVUqE^uu9?*p`r
z-#X7vj}j%o=RPt`jiFX4a&m*y!r}Xmc*O_h?jA}~TKGXO4)Z`llM$eH2%arbYF+m-
z#a2c~XEsMiXJxEjb4C7)vFj*uI-Y;t8d7=Xm05=g2B1){`~cs3UJT375C-P9z5Rpx
zeI9_xbS3+4{A$x~%lr*Um0%2EwyiUU27QVO+W$<`*j_+|6x{(+xejuqgjwsA&WNAZ
z3%FrmJhKMV$*{Ht1~olFcK4TuRX~RWNLVaFBF0dFHYh8L%#=aOct=UOzrX)y|4&F*
zh=AAG@WSA0Lwt^cXW*<aC@?WMrv+~aZ?w<xwiVWP58c#BOb2>D#F2q#T~ANn{4c$u
zD-gNW%hB`n3~MsD|4fhhIgSomDm{{D0SHd|+a(P^Y0N#S1mI8iE5dKB9~S;O`~VZu
z&92n>T2HveH^D%bYa(E`03~eaU*DK;Axi`Sr|<hrm8vlCMsPf^0KD>kCu@GqWod$0
ztEHPdKmDOoU`$SCsr(e%n>)>+e+P1WTUg#DG`YhM4OQ{+@e9toOFtdefi&=sp#sst
z;aVp5iDpioGyw=^aGHxBy%Bmq{O`_ULV*New(xzyq+q*w;#0s3O{Vx?sM!y^d4Fl;
zg78Wv2O*@vB*LEmm$66Syab^|M(t%jz7~D`4G==*C@3rhc4koG6rI3z)Qf{S-W#x9
z1OSIOR$3Z?cl$5eWN>82?bQgztT&)u_)D4qK!#2acyKuZni0^meHM!Xe>4KMatMbL
z7?i?KNDbN&{C_C^fE_9Rpr~C^N)OnJcv-^z7I@uy{qp2Rto2U;4CJ5mrT#r_^8cAl
zRZ=$e_4BK$s=|9B+(=2mV#VSWLK75<S4s|v&8MQG8tm@}UaGaGh94V~lwshH;0%0H
z_dhGOHr$ND8X{S0+PK)BS@XLGUrgRuQd(>*0D(|$_ebkbOfbXPSGZiv*@`C>4$@Gx
zPft5MukdH23VJ>r`1SzGHc)OIcc*(Q#r6S*DK9s-s%OFZz~lZZ&1%`b#$ws&JfRfo
z695-Gt$MwJ%<+z<^O7Whu+@^y-SE640SCwx(9!Uuj0i!6na^4RavwQGwIX8tOMnip
z<=_B`X>xG#AA!p2c(Lk!vd11^fdMGmV8}lpV70;dxqr<MU?4&AU|ap&JA+pDXRpIM
zWXS}&X7Jtw?u(N7b6gOs1tFBZKYw6hU{LXR2&s?+KI%-2k7okMc=-62h~6Y5BqU!E
z;qUdf=f5&&pP4u~gxz{V4X;o}bVor%LC5x@03Aq{HvlreHxO$K7B0xSjJNv$b9#l-
z$`bb_0Y}*h&c++)u)x5(Ke2rP)&ygS$7KR<2a-d!%jrC>gvGd7x%h?Qby2cFGybcT
zedQ;0^X3)E9Rm3RV1Uei0g{5Z^4K<oPaE5tL`Lm^eTTJmXLok6DC*Wi*SEl?x~4{!
zke9__4t^K0tBpOK&r4K6#1Gx5C~Ocs{q34xn{9mlacan@y3_-J@R`EYBzT)3BV9-?
zpmhS5C%4=5$3W6241ijeP2>9o^e<am=8s4YLFjfxb{eo89|4FGG;xQ#&Jt00oDTgu
zzhHgB0Jea57x5qk^!u~r+Ok4ISvjBOZot$KexCFZGz*&r0I~}9Y1tseZCwoL=gSb5
zL%r!zv{X0h9iG2Qh>a~)&mZka?~*_w>D^}h%0wa}S^Bk33{WF4BQ4cG7v_Lr;Yr0E
zGHwzC0#3TizR=u@apY5y%<}RvMXaKd!KFsq(i|lq6@vu}V{3q5K;Q5DxK8&`Hib**
zdpeUBod9r#!>|7pLXF+K=cTe0Fl3YkIXywR|BIa7-@9zc?gM<l2*5!Kq%3E!G@f^1
z!sW;eX!I=&PXQ6`uaBXkGSW&S{sR?TSyQ-mOmecmW&YD7cn`MBRpS=Se4J`)0NJL0
zodu|8%T11Ux9d)~gO_u2TmYz#Y!j!`^ZO2`@zb<F<6W4-fzB!}2{@5-zx^NSaQ`o=
zFtL84$|5vyAOq4@=(dDJAMpGR4Gu<zMuvok8+ma8ofg1x!kH)>g5)M^<m2L|6;(K+
z{t``Y&;k8sG^6cc-dVMx-l=OFlrB|&=H}`thm^tP{8$ka++P5xJH{Fe4-K7fF!nZ3
zRJ77M0{bjT($bQ(H-=Q|zJHh7#;LbI)-_SZr5IMM75OMF?SA*5L=6+#!Vww+s3n$t
zTHv%V8MgTQ<+hEeggQD(;=12`drP7%=!9hj$;<1_&K7hP?I0sF%IgL4aZGfA5e-y<
zludz+x#$c9JN@DOdEzi5@V3S!C(joft5{k}ga1u042Kbbpf@+C&tyu832@4@OBBmM
zoF_-X(~g;iMe&QGgQI<7V&e5BqRFok>h7&ei1Xc@Td#N^NL2!>Z?oNDUSeW7@R4Nu
z0+PkA-jPKyQBf3P0V|!%ApgWV>kV;aFoKdz<$=V;V&G$Y9rmUb6ztZ?kbr0j0VW|7
zSrrp!7jXukyX#SBt}&xleqIha90X_suNL*903j62xH?B`IYQF}+&?KRiz|r*SnkZ2
zbAlsu{cnM+F7nV%LiX_i3atNn{!=B{b?4aT;RsN-m`CSALPEckvB6tluDfe$|DqwR
zJ{lG-=<C-cit{cBV+?%?M|Sq=tB0QA8uM8+91Iak<1uZ(tVHGj-#S`q@=0*Ne%~0I
znQDgSQqwcM`$51$l#;e)TZ`MFV%NeOQ^K2oFyKI_>0&tIcRAQTvfUfL<tY978?*8<
zmCsWPY`hRt<0dD!+ev>V4Pjf)FnecBB8Y+U11JH;qgsugJ3=2#l5%q!{Oet^+yp%C
zG<MPCwx2CgqPTz)zm)g-B$0)c9f0Zo@LEK$?l9=#fYKE9&aI!@VH4US2z+F@?U{?2
zdH^`VM@0VGV{{tS`!X-*`c35WzqEiHRn;Ui49cm=sY-J$0T7`M7`6ZM<?N^>C?-~6
z#q%boxEPRreeJ#Wh6CJDiGgJ<^MzS^X;=%#sAhc(1d?CcgMrTJJO(CS^V4Mm90W$k
zWi4=P2-(EQ$m|-SFy#zjQ3qmTnP#)cV{BDeb#--QEjC97%x@Ajm+O@u=A2ex!J&D1
zc}Ki97q?-v;AUEQfYR{0KLra2#bCI>0>ajMq{dM14`^>zR-Wov!jUe=V=IH(vI82Z
zr`Jv<6o8lreE(%Cvse8S3ZUnxCr7sr35kHPd$Je=m%=6QmhHayj^$7#L$okmQJXGk
z%+oDg!N_HDyyA_^uQ!)-`eULzz0Jc<Qd>(X-7#Q^pD)XnyP@HuyQ?c`s^K{f7IO7R
z@Dsp0hM33Y1vcyC)M~5yYJ)-(x(FO#-+||-+Ph6FY<uht7MA<j0nF>}?vuDmPl)pQ
z&gl2(=mw9=z)Tv4-?S>$7yFB^#IfB15~Ef-U0L&`h{M9T$jId7kRD%#S#TkA_=5Fm
znnZ`$hkXkN2XsOu(61p$ah+qsw`Vgm)7|i;Z$2W8kIP+OBL61JjMBFI@>xfY>3I15
z#>^Zv0o|$m&J7~>zf7u1O2AUO#Lq?fzsWEk6oj3>vN@|Zctqz0%olUYAg#W5I9Z#j
zXQmKGB7lOqzC4$pnqE7d!V!VJf^Zn}b>D3j*CCBvAq50d7!T$!k4rOJlhkgis9eia
z1lCxrl<c|&mV^_rD{9H0cpEBUY}D7^*yEHr9Zu?Ag%5lbk$7D@(mgl66-Enr+S@bI
z(^LJOS`b0P`$b6T<s|@IVm3CGX|<&#C$k%GZwj<Dg2jEjN#2FOq1tWNkfhSNw%5Ae
z-82m+v*)_k$-Ey{d<6#b!^2X51c;Yj0!?bEt9!Juk(eGG4T$ny0ryf`R#wH>BjYNz
z`YOuGuMxH%lWlvPEmp<BZi9ym_dfv3Wn27bvf<U_ILaJ~o?bS%wqdRVAi7N)rEKgo
zwmwb=<5&ACoPj$v$*|CYzZXEzsz7s!2dt{&6&sm^X+*p7rB&AuPOVXRL5IIoMyA`J
z%&yOJ1gM{OOz(B1bxMO0ol8^XxFum+Z?*Uv*_^A5>x3)*TqGk>1R@9G>oK!pc)lZW
z*2l$R&6oYcpo6gf;_$$%!Sh_l<ys3>eKDn<y7rMW>qlt>E12M_GGTNQ;dW!#YHP15
zm!{m`oHcsN*%TxfqC=M}m*Vdl0ZTuBqvP4dg%M1h9De{x7O4#nh<n&lsn?mU#6Jgp
z5G}EUD8DZ(&DCAaspNgO`G6?lenVAH;B2zm3lI%<NXQp}%n)(@trOH!Yv=$%nlM6C
zL2t2=y@U5oRQSsmQAKEPLsf(C2O#$HI|`}=q+Zz7OTU4?-QC@FIEbC|wRl*V&(gRQ
zQBuAY6>FVU*xl>=)I0wnt%42A0KvAFM>G&|FfAzF-`h1YHT_kt0@r9^u7D_xjAWTt
zMBza(4?og=(9MKarf*73Eopy#j#K`dF|^?I(;V0jY6eqgq><R~Lxf1w5&y0q6$z;~
zU!ra__c%-&@(QA?q7dNIe!{x~{*7>#6xg1iTX27KQ(W*~O*JV&E52md83RFu9@uC{
zGsy5heOf(Koi53GYMI|9-W9gEn~WzoiHVDAyH-_)q<}=PdhN0N7sYQGbJez8zD))C
z#$oRI`w5XpN9pyul4jl^^l|a@DW)bSXvD+_i0D+#s{)s6A9{LbeA1#~Lj-;91jV`B
zaGGc5lIpWBF?sxbk#<)Jygzf%v74(p9?hYAfj@tlvCrumfPP<5Q~20&`kYE=^7=sF
zEf`EPXt%&*VD7MzF{5)P2}{TyxH7;?k<DRRdDsqo>wzTS9#@g+n-sw5zxIVHhx<Gj
z7yf(CH$NdcKIFV>TR(r5uX(PzJ<^Zq)914z{(6mQao*&jNU$uCE(1WxJBNG8t)}bi
zHmv+0Z?J81si>Y-qrM?T@Jda5w(*9r=?<6i!=W(+s>W3_vMU)bSv(iggp|I1^DPq2
zR_IkGSNUqIf}~=pzDiTlVOY~Qokj1v3)gl3iNVjG>jx*0T}G7UBO>mf!?c-FMzw<Z
z-5okw(RlC#9MHPjKCFd-)Ecn>A|D+*1`=(Da<E=bUQQ+knA~h!X??l3wKX;}tVo_$
z6T~I=`2cu$nL8BQFub(1tcYt)gzU;d{doJp8W~mw#fW4^ps;z#{?|h;9tb;?FZB)G
zZD)nTrTm17loL=ui<G8{<UTzR!ASU=2SPtk*Sp*ANOh&b+M?xsOH>(jWe5fU+3rU5
zSs5vW>B=e}N~j6Orzmy8ip(C-9#F}twGq4{!Fj82h(5SuNH;94)#_#5qk{J$*Jb}=
zWhuNa_(as~Ya{RTV{C;optvJHRU*Fjg&=+IOc1)@+*swT^gix?=oy*~W^cFi0u=jV
z^LpD34Y%vHAAtOF!SL=KCn*zJf@_u~nE?}J=r4qP%`cx{+p109KKZfIieh6^F)(P)
zH(g8_mq%vsbz%RSmJ51?g^u@_LQ?y|`tJx*2Q?R>SkR%RrMZyjZ}<x4XuU;L%hyOq
zLaTvn9u7{rUeMuvaHts-(fZID=>qNppCJLs2vRS*rK80i@N^4>pNuMlNMA_v*gasP
z;Elqh_Gmm+wm$>$26@wuWXbdFY2#h($$4UVRx|g*4<^o?WtkHd1;x0a?)FU~w8nx=
z9QX7s14HJdw3tCe$t+?(XtuCGj3!c53NZVIx_>otUJPj>J-QdMS<sykaJ@@?*Hl<2
zb1Ya9sxg8-XzV>AHIkYt(3xb6GvNv%4hDUgx{XnP(?#mrK79;E#UF>8XdQmz0Bx(y
zXx#>U49G-FZF5i~gef3=RI1h#vSzM!?^N2x***+?{R!r2s7@*Z`4yBO%qh;x;P({7
z=y-UnUI)Rxx527yuJ=}3MVFH-Uuw*M1&6Owqc1sj2Ra|~0u(5mt1zaB95Fj82@jeP
zjz5yt+R&`bu6uLw{8C9KS(oqP@sGYS_v?eNpYJa(9MJPstB$PeQ^8UOCP64YxBXGi
z+B%(l_*Q%Zyvj?!<uU6!dfb&Sc%9#pga4Y?cT}(pxf?7i@VGDY<Rj}JA{sB}WFeaP
z9o(<vZHcKX>fq=|NCa0AV6LiGx>}7TtZ$JM^%27kt%loWlS{AVhL$u=-66jx-Iz<@
z=12KzJ=S4IWwq5-z2%O8yjG65Z^RT1v=4{s;J68plk$cyju-cLPg%Xo=3i)b-QqOX
zjoA5o{QUWi0=j>onA(%RMjSd49x&Q4Exj<L#tpv3Is+lO=WufUE<KVpAypwX-Uk&g
zqr8i#6aeAVAD0X(^SyOCTE`0a#55C`xT4s7PeVner9rs`ql9JN69@AiQ${SyDs@Og
zZYROA$^Ci{)*FpOCW{EcBR1y!6(7#skDUDc#2g9$wh(#SbU+;Y0-oH;j$G`ael_5q
zYW#AjD}KS?Q)FTG+rTvm5wAPlwiu2$hP8RYKP+rbIU?>4o7}#lo^Fn`3xU}qH>R5J
z2g?-$yi}`$!cM8<22fM5SLFY^>58*SM@);*ql7J6%B7tJ13Isx+-VEd2%Ri#No68%
z>2O$0XI@O8=^7j)t!<sD(LmpP<8O4HnU*W&y9z!LrcrPl2SoBB^4Dz}TjxyT)irFm
z+2sGmx`=+%aOUMn!y(Ifd~iVc4-k|<JT({Ga=C1e)ArKVwBlO&Weh0|HxTUD;E06a
z(S@-S8{7`_iWfQSxrvF>e~2R)-e4pyH+u?FGZ%i^fCW1)^uzc)pY}%7-^t5QY)7I5
z<Vm~$Q?M2HlehHjrS|zwzQaHvJ6>wZh)dP8GUBW7Cb?o}LX|BCkzD{cU09gjn{NpV
z4(<p2jH|+->#cu45J)wB5z#yxoPoTbFE#JuapL&c-QBCz;zY~zUR72FC)ur$2gnGJ
zx<j+6#-8P-C@?YPsW!KKI@TV~lCfoG1^_$lwhsp_-m5F1x&VG%AR=#|jW4t*(~pge
zv^Z?_a-uSd!Q3j-6Yc-1G`z8w(`<E{T3!Z0o;*#6vIUqB{+E<-7FbG}k>Pzm`WQ9J
zkWJ1-c6G4H4*FlvAid|O_@O+4-{R&F|2-3)r~^ybXb3aKFLDjSp)Zb1#Ba9?Dpa8k
zGAV@fQiN|bn)MDX5_K~6MzWXZs0PcqdOPK`P7F1Z@Azpg^ICUR<4S;QU}B(He&@%#
zF|cN&*`$L`O|1bm8%$zUX|ztTwdR~h;Nb)zom}f<;>0qIosr-1iOv_@c#@Kc7XOS7
z2bRYN7|r?pl_4g|hd=a(Kl7TBLQ4fIg@OZ0BUQvc$Tn0~sRjf|Fj0=x^+NH&2ZqGw
z2KWLJZ&}(n{dw}kI{3PD8EU>z@za{-35@^DrTEM<#~B(NE+r|+=%B%FKK;#YaA*Jo
zzHcExoV>Xr9iMhW(|nMPWI!w$3kwTa#PX%nNhv6>u!ta#*jKM)l$BvE194CDjcNG0
zv}Bw(!YSrVz!+5o?pop=&-XV{R$c7Yv+IL~mKGUr5a(CLNe^?n6BB6G<}BKu3dLBw
z<zGM97sj*vQTxPtDMUD5`u%%COdv7VU2=v_HlKt0d(8U;l8$QYp3(N+q2b{-QiFv(
z-h?ZHq+I{Z_YVIf-+PnIdLUGKcXi}-)QMGqYEc$>xES3hY7=CmrJgIJr~22cGI_jt
zN|r+PMDmQM*43&Z8O>FWV;P-RiR;ceKDXZ7+|J9-rKYA46Myo)8rCz`@q-nr`tn6V
z_hltP=*jky0?6nFXet*xftO-0(8kFC4>$Pz@q68sh%|8k?aS{Zf;pZIF6~>)wz@u;
zVfjd6kz{<UiOTTu*4L;!FM70LsL77A&1=nWzrHojZcYS2jR3l^7$cpkY9<LTgyiu-
z$NjqYiK)LMwkrK6I}BW)J02C8z`G(R{~?nufT}zB>lX{#v@sEz;PVS75#It;;3K9s
zMd5i#Ia1fFXOg*^?OHXm=oA(f#%`rZ()ubC{DkqteJ6Lm(0*<(+Pj|>nyKWqdvE~F
zD}a820C*Vod+_vut$3vNTYJb%gDITmgQK4WEOx)y?=Tu08t!awIUX;dOVjXl5x?oz
zt}%M$6oma#0mjS8HsI^Tl9gxxMTz~^KfZ6_^HQv3zIX5H#uY^<N3>N2HOwgG%aZTF
zu0_9<l}06dwhxWdoa)%TuLxMOk^)j9<lmZ77y43$jaI;^Qys77!yBPX=YOFD<4UhU
z5*aO(0}pc;&Y*P6LAt`A=Wfi*r9aO9(gHpUaw=q8L}{g~A0S!u7-4&&T2D}&=50J&
zQ<H~~)qfMm_7b#Qtj#`>R@4P%D?t`P7F~GZg8xsPR=|Cv#vRJ(*|F#M1k7CeKYJYT
z)_g4fM|NQY?b9HKlJcE6&R|?jf{NmVotLMYn)FzA5%W3Xji-AWuwCVUVhnsQ{8`Vz
z?duze@|T(DxEMp4NR?|;Qvy}UjExRFS=L}tc;bFlkP0WON5jDAsGQuSXrp+VQ`#Nl
z)!m)wYWES25*6DxJNb?JrF`;IYKi%~M8~5x(XYy<K>-;{OMliKq_yPf1sMg&IHpUK
zt6px@eja$wge4?w5$qcSD*}%SCJz<_j$LpeiPxymZY?A%j)Ec&P_7LP8CvPqi~3G#
zim=o6yHl?1EN{QO$(B99hwC|JF@aG)S5)Nh_7-Q47&6GoCtMYv8ozHzC^KBGgeb8i
zMdK0gIvt+{qIu)+>qAgHv3K!j7^>sj@~8Z0A><<b^kzIo`$?6_-1EuKjAf3GE^v?I
z*~;g{UCLD`!j(0aYD<ld*MI6~@^icEj`?L}gbuG7W|Hx!FCmxv<IZHSH+Oafo6qX@
z`xfWb{%o@oHK9Dcs>v$a&rg`GIet92B35(V$}5$aHvd&Fw<u>HHX19}-rZ<Bwq`E5
zz<YJJx$TthDc_aVSHaF=_qiVx(V@lLmEyJe-d8RsT<srLyaqh{+~`DWkc60%!*f4o
z`?1t{euQNA=RI&~cxK$Tu4*lFKdb0@)TiXh*9p;HN?Azq%$yD4J4G~ZJe<h>R<E|%
zEYUwG!dUF%uw?CQPT1)2t3n>$YxHb{J0D*tlZFtp#w$8X^6b${;G}%ztTdmjnk$ui
zVd?H*NqcWB?Bicw!SE`Pwfk5kt}ubCt#vx@emJ?9n5MvFnQNqpGmok#eU2Mtd#w4A
zahz7>h%hldM$RTS=ca$E>D@2WN&BZj6%OR4R#%6(5$AgcPG$~^vzYzZM9r`$6t~CU
za?~}H-2rY*ElCx-liyAktx~_Pon7ta<f=%F@H|}&gq)B%W4d^FLZa@&)}~OUzuM8$
zvL3Ey&4V3T1Fw;9ViMkP9!4#eHp(<P*_j%-*=11(j~tC&2g>k{7p}&9xq3PnJ$llw
zlhJl%%ou2MF+u5y$|79kC^A|`dB0RNG%YEyEoAi__3-{;FD71kh})ZghPi~>@D|x1
zGR+w~jhmAbcs)Lyq+?s(ju-Tx^(#~7<2U}<IbCSaK{@{LlO-182XyiG(b3V(8Zz#y
zkstb+a14D~-~U`}DpE_Nr4Ys@M}M7EKFJ?FNM6cRd%h*mT4X<j3HU4-X&k)znOzAF
z5~yhtt0MQyVp`9}<vW3$2ftRadGd74F$Fcf_H0&pcBoV4SdcH|#<kgZZK_}ktsBRT
zeb*li6=FSG54Xe&9gh`XEmaC3*HUn^yt0(&@MS8Vm(r4N5jywzc}Bw{UQ>NpqDTH%
zaTPY@m_%UqmC8i@I;*&qThRX(skW3xw(HKoiL%+R{ckk_N9Cc!ip6D9><+^@2Ah)e
zybhuwv#Bb#zXj1Vgty+8WEn0LZ0Qgt21tkTNV_+BHV<KQ)LKBt3Tb^3L262j6N;?&
zuTH8r@X{ittFPb9TuMD~L-7of;Z?0>PG^uEJxX&kI*yAtCyI&HOQ|Ioh<j~;EzK{9
zOM#q%eDZLYH1e<}kFz}3cbJ=ANnb*o8ien-@XKmEgv^U`W?Eku)fnS-C_eYYqN!p5
zj#UE$o9pLoh;3HLDLM>iNaTsi6bCw;nF&NZ;Fc7f1jBBBm_%2|Dw|x73Hw5NKTeBa
zKj(!!Gcy7;9!JF6quUB}y&q81>}|&|P;cpr(FoSYWQ&2J7-3=fvn-hbmg1Z!wY$nJ
zharYtsM&51SY|e%D*zKEDLvJFy*LEs7u2jhWDI2N4tp<?H0wr7St>1%L|#RH%3>)>
z0cK~eI^t2(AgPt&lA^x2*C?UV?OlWG5E?`7y=?Uk!7pDX&@n&o&@2a$dC^`p4?Cl!
zRQ|MNwYckegIKU1bmNUp*V`BPGsOH|g2`SAYHB^A=kaY?i$yZYFJ-!Md_$#W{~IPT
zB}=;OMV)U_VqK&>OLZETaX+0!4OFvyuA`$9O0vt!i%c=!{3d_@9hab}$m*g?Q+3)Z
z5;f)eZY`QZJ&<w!4xK}$1FE7(2aXJ#`0Vg0KH`T_hR#iAXxi&R1H(KPtcXZ2<eLiD
z2JURVX7k0>p-(be5#Z|uzY3br5XULfHd%N=^0ZX6067@F&}SN*nYVMtRkO4CAA?{$
z9`By0AQ@@#WE90nAwu7}Zb!CQeks5C<+#u;{;jpW%+==7n&KSRkZ_86qmr+s0pqT-
z_+gOh)l_2vVYDK&UUQp3*Vj4r3@z=SKh2e@Wo$ns3DD>Y@p+?FMo~b5D0>6+?Ij@z
z07RS1mZy|x%4Kcwh`+GSR07qUikohJ4wZnZFrm6o3j{DB)xG5@g`F#D+M8j_qnD@5
z9Z07cBDKTLHY&%0Mne$_L(E0KGP`rO&9y=izA!dp$NYNBH5-yFtO_$V()b)C{wU!O
zPAx_m%bbUYu^YHdKTDQb1gHw=YT`xnpClPb)GBO+SaTea%urIQAz<6b!E&DbZ0XQK
z$K|)aKIO8KJVBezQHZf}9&u{OZ%GJoRjB80X;D$kE?JdGda%?~ghQ_2kd~+Yba-TR
zkJU_pOeBxgW`vM8yvg3SRISvgV&bbK#LHm_9y*-Pyl$MMWI&PaP0S>P5%J^Mk+@5R
z`ys66y1rl6D_31d`0FtD`}mm)#c5>R^|rsTCx7n~1B}|invlf0@(|nGr_JY%Cdw%V
z4BJ_3|5u^(q`{@|?fq<>?*--6E8BmAK1e7?*DFHUU7LBrY<n+g*L2rTEF;=4;=BuP
z=gf7p5{o=KI^``z`EXq9QYu}yIn5qfi*OEQpQoFBp>0@}#qj>gs>nzQq;{7jV2u;^
z>wqG{;JwwS|Aa&Z+s1T5X+EmG#-wF7EG$(;Q_$&p-S)B4T|$<&HYhQ7G3*2lWBMEe
z@U+Au-%3_`dZE`lwjPxW@Ch30e1+TaG_m3jIv&GT!V5v?`Dj>#-jzobr&6*$wk@I@
zIL7tn;GUX;rlM8f+f$#{e;9YY4z$A&Oyyhsimyo70=F+ub%O_A{`XtS{<cJXxy&F1
zdpnUfo@E*}pl>}MZq_v>9za1<DSLz?`N!NlB?e!iW?*Qf!F4;zzg}+JI3x<8)$wW!
zz-+e#$=Ip4pK_6r<o%1vS&lO@mRpJlc-<xEL*P$uu5N`U9{lINPv^|V)Y5n!$|`)(
zFXCuu;I5SSQTwxXFP6I>v^ZMc_MAe;$`8Z-p)~2)zk0g6PF99V6uqdmZ}Z_UCa?^q
zj4v(pW=87Il+dI>G#30Z&L`GLrmeT#tCSS{g=L=BIW@>;NEu$i;Otb=FwE|31~--X
zn1HLzRA%HO_RpxpDh2*uMXPH)Ew9q<87nQ9HYR39v;~(2Kg!k?{F$@t|J+e^<vdzy
z>*X#cqm?VN8t}`>GRZs7kBzC+-Q#|@kk+bdEZ)n-i=%(6;ky6QcYr)CJvBJwBB*Nn
z>a;99#ByjfHi8bHrMXb66I|=WzaO<k7KdAxcU4ePq%}Npb^HKab!a8&#j&&V=rb14
z_K$4c@z!fT+Qnb}bjN)0+AGT+Sl9K1ht0VhNE$;Q5nTRYSS7Gn7W^(*f7|Tpa<N>c
zKs``-Whve(2B$u4WwlrU`Hj@yPs46Q*#6X6kTX@|=^B)!a2*yVd8j>Gr}L_pu`#D0
zTj}EDIQ@D5F|6v=)m5O3k&3=0B?i;|Pk-~kP#Nn(hQl&fOXt`|O?awZS}*_SRcj%Q
z)Up;=7if-XAGH>lM{M&GV?FvmZ@pJH4`-}LQDJ2kdKk3$TUBQ(lz$|M@U`(J#4Awq
z;K;`3hq_BK>001BO^mave3>|PavwE%Vx7@n-^`r_7w*l)Hp*DJY@jr6aL>U(`2M@L
zG4%cWL-w-fd2`}f(}n$qCp<vT8Wx-qDl)?lk^Jc1)N<3B$f+`10%3un3fq)5cAXf^
zn<-(Ba=b8KX{m@@a~{Ru?WHN)8__z?0VU;_)v?UowWu1BwNc<t4%iI1#AhcHPNTI|
znMk7Ew0Txa&UazdJACm^=`wX=<$+7XUoYjvW&Rwrnj(!U-FEmxa%Bka9!s)U1sZCq
zW`iB=pWJB3$)P^!87I5BK4<2Y%`7=G!pbh3KOD7wIKHM#V+a(a#Co8D!79ZoCa%b6
zMDcWtFc;Aa<p<~I&M)U(?It1PxHu)bE}swY=Zj<xQ(kPCEQIp<Q5|)zBED7~^n&?d
zX`QY%U%3k0#Tm(}96Ys#(7d!JmG9KPiIr{>YZF(t+B+%3IxJ;7AqH|@cDG)SjWNwc
z6_v2S-#2h+)>uvxnJ)G&Lm%;c{~lvH>y84_f@cD44WaIFjkVO+?omrRt4^5e;*w);
zuC<mH4;RA+M+PFpUel?%F6Xr@3oIGkVAPBHdlakHiDb19B>k!^o5I$tQ@dv-d&-#l
zvc8cGrAP6q5lMrpIP<lBtJuzf*rLW&FTmABsN0|<$4uJIxyv|-OLbpo6eW75e_kpe
zsKXtEn25_DP{owr(_Ung$keM%R%gMC6)omBp;$`brOZk|)Sc3(lG;#0f3=SB83^Ci
zT$Dhc{>;votl$mCH0ymg_slw7G*%GNPj_|F(+&2$ch7x-M;vvF#U#Ny*k7_d`OGcG
zF0C2n)Uw^!+;r9T=v#hl&0)$uJol3s|6tD6H?BnZ`&fRA%+D7Oo+IYmjl8Q83;X*D
zntmxXdv_nB((SWn`yHh&f6%x~?XogquL$z`p&pqESdFnxKI!p8nc|6E;WQq+P1<ET
zpxX6^I{v_9{*FOyvkJrcb%puT<DWy#dhcxBnW9;Frn<Zr9mj8MM|8E-)J#Kc*9sI)
z^!I%+B!0%#F_)7NKAoI-xS9FJRTFlpDAh{M?-X{Y@iB7VcL}~yy}fO)l@|gP>*r*f
zsyI^-7~}Z0+rYK@+-L8oBA(|5d96;{urLI0rALIJRGW_H=1frzJ?tAF6`TxCz*L+;
zGZ=gd(vI7OC!u85>=>h(sR@UfLQQC0-DT2Fec6$nl4q+}9~B^tnCDL|3Nx*UT}Jya
zEx>Z}ez|H2Sslsl-X#e64f6xZ57wC&@K`Zvftysi1ivy&E*bn#*HE=9kgVM6$GZDq
ztCn9lalujzvS|7>$G}RxAh}M&o&Kgi8u!u?1P<rqF0h@npB|_;yc(J7xdj_r9VcUo
znLOm|X4n?LIB8Du#aF;oBbPvGNK^_usKL=@yC6sOYX3vVwFO+4e7liP=7%hq!}MwQ
z?#8dkJXw+?i###Z1ajw9?)laG{HWVqvV^Tgf#^q^zPE;%4F^rOUcp6qWUmpi(G`8G
zG!l?Y558*i)*yMCYe&uU2bLNYaVq`N@0>Y4@<6Th1Lb>F#*xS@ywNb-$B4#5V$J2w
zQ3cogr6SM}CD`KFq^$7qgwhVo{gf&%>|TCD_Q8Q38s<n-<DH9A`xrZHw93c8R47@x
z6@Kny%_WZwsLv_+Z=xmh``*nPfARGYAbxUxUy}3Jvz}lo0;wkUdDU!d218!*&N(u1
zn}F1{0lvy$fVS{Q9o)Sa%848B*DvlU??Zm+YHz6At<ln$O9Z%8k<q*yw_>N?=$ow*
zG0qB+wLa48+7awts6}3g8t3Y|PXErtQmm4Itjjr5wt9Mz{wYsc8oF1d;5jh~UNG-Y
z-p~?nHp<yXx8oLPlN8r>e|S)M4QsseID1F}$KvZWRAOdry5sYydh$=77kx7uVdH6^
zGj3{0arb(A@OK|y>Pu<D(hK%Q)jnzHhtm_N{W7ccvclk^3nuCxEKc~j8nay}nu%#O
zw8Gv3%vx`|bN^RwXB`z+(B^3p2o@6DlHjh5lOQ3u2Re;A1b25y2yO}P?!n!i;O-jS
zA-LOCW@mT4J@d`1oH_gNZTfa|ySwgNRqyY4>R;SrFAA&5ww$4G_p@2h%7mZ<Gq*X1
zgdK^JUawR!nX~hpsXCkQ(Z2OSq;`-gI*4b3d;U~YQ%$M&*A7o2Ja$f22as)!$6ih=
z59je34UT(9FMHZqK7ww)?_>k;=rs<Pga)&m=FD%MZl})MT;%1a+P~mi;>yhC%~zsx
zG|ARH9&VqMJwxt7(V~EQq!GSr`KA>LjR^9va)<tY&x0uE6WXZrws&cdh_~)hjvG-|
zdFGiwQbR?Q3w;YdEnDU`I?V#3$J|Kihv@(ebcFAO&6;(dTH~1PVWoD>I>H>cG={Pe
zDM^2HisvbsWgBFf8_A^6bo2JvzO6@u_7;EYw+dr}FuMeDr&4PEh|W6v!~r8;x=56O
z9AyV90ncJfbBpQ=|E$`hZHX4aN4`(T<Dqn!j4^C-RMMk_qF!%T40p!;$ba6fcSU`N
zKxhkgu3Z|d3m3gTV7LvsAi4lMS;1#um5G;AhW0VA%2^$B&RR~Jg)QTN`GDzeoN_=X
zGLe4&-88AxE4+1jih?XFJ>@a;HjOWCbi8ueL4FTj>~aQ<hOS^n9koutL?j)e&N_(_
zg7QJ@m<DgXRZT=ie0at$AGs%nOiEa|JH*5DOklGmH5co*DrY==B`vZuZeJVGMoVM9
z0{wq)`TOV1buqgqABQ6hrPqyL4w9Vgjms*%eLTL4#+9bxOZE8zhLvYDMvNxaB4L{&
zcVq(Gi~7FUgsV1>V`5zQB*WUOWeO3ek~q?eO7R$8v0y;Rj@@B1_O)31GvM`-cQI=j
zzpEv<v(~!iyVDE@uUGbup^x&CLo`sv|Jl8!z*%*|&rkHXf9-DV9Ukh*{;Narv!aGa
z=bUGbwp~3K!<WM!=Q;nRBqv|5{8FV-Oos8&G}ksjXc&_3$<CuQpI5Mbsyr`R`z$nc
zkm!25u!}xC+}lH+){pxWqj~a|uwBZ+0^$B;@5E1(+rpbzCvIjE&7<YMoFh{1idQf9
z;j2WY@zk#`Hi#HaIb*|NhBUQ}p0+!|4Q>>|O#`Mp0fEv!NcG9T`B7qi?JPzLwA3*&
zQ>TAcxjLQ=sidrYyva8>OidXYkl-pe2J+*GlmzFEnfBMYv0m;DWb916GZEa!qGeTe
z9<_GoovZ6UdEX&J1;zxM8~P+mTnWj9pZiy*PJ&Fg&<C77-5}=t*acnW85zTe`^Pq3
z2BwQXD+1FE1~vtVVen~E-iGcTPOwjEcr=kK*V@_1a@G8VCV{z*ataD#XE!%lGYP>K
ze&dnY%pa$l-z~Mc>o=!vspE3;8*nyxZ=J5T&GrUDFCkWqcAm2KwI#(+rVIQP>(FB-
z!N_)aP3*M}@SQj5O>O^3(2LEq1R=)4itx;Eqo?ly*qG=l160|eo+IX^$~^f)x_+xO
z!YaUsJs|T;jelxq{QGUyLTlyk3?>r9k2A+74{btrIc<!tHdaeBE=F5LUV&x_$;xFj
zJB-0hs^%N}_K^eV)U_dr7u^R+nz@?1by3OB%Sm$`WpQw^Qy;pM+afRDw$!yZ%Vy8y
z(*P2ISQ8MQ6e}rBchi-ZTPRvTNFlskwhBvdc*B_~ee2Sw>kQkX7Q~-<ioBGD_PX<3
zg;P*S(rSpnp%c*^(hUo5ui?&C#mHGQ)ue_wyHsj(B;8h0R;Sko&?>G+V`M&S5L8*1
z;ld;i=JdLco=&Ls+{Ha16Cy;JYB1#m<}(&&M<rLwkB;s#7=_V8@G({Ueb`ZYxfP7n
z`a99F9BovL37g3@nQfeV4y|en2hS~|LAA4e3YJPIZG(18ak>WHg{phd!Q}9YWO1;l
znCaS&HX9gk*bV$IK7-AKvk(i@36r(s4XEVSJ1R1s);&!yS=SL+R+y+b+<Vx0Kt~7o
zgR^9rUYz-mvD{JpK6V<qV-opLv2v;`0M}|!{{og#!Cu)ur|sh6b2Dy6>knJzbFR+G
zIZe-tIm=9+VlR({U+?6jaPC%`&D(`#1Syq`tKzAbNA*d^FMm?fQXIL)#o;V};FnXh
z_xWDF`)CxeZ&dsZCO<Y2nLVw9^DNuTFiByo)h1ejk!^v2o5t*Pb!uNvPa{vZ!%~1R
zb)Y5pkkN|W^R0)`>=q@}1N^p2{9&HSEA;qsbfT_~jbq<$6$+f8FCO_B5<D74uR2AM
z7MqTyH!@Gfhj^66>|;cwV?MbM($q5Mw5fGjTO&l83vuWQ-=9rH8a&~ZlDm6&{!kcl
zNbY+>mA$c5>;*NZFCj@8CYjPGi{ki~YZ2WY7nGb-rh?(c-{h9@eg65Csv+mTZcy;u
z?SQ+T=a*Kp{g?LiKCfqp75D$X+(YR}xs0_cj)5Y79142zU1$ot+`+QnlhU7kyysb9
zB~#B`g|PdC(_sLE@GH#kY(961<heYQ`->F0WwO7fp%M9;)13`p5@K6b(_$5=gh-t3
zhqKKvAwMQ)nSz0OPF62r@KdI|@vO^V9d>{QTyDp<Jg}EIhs*e71$~P<c528Jt_42K
zqlGmw9xJDUQSHP(I@Z9uUyqRMe7O#ueQL-uK<B6IH|9|F7Y2Rr&MBYrC^=eiK};si
zI_pW)_^WoEY+al_j|+*bKEw5|&U|*=Vf2Ql#cT7F_co1Psk+GGmE-*iS!~%RYF5@e
z$rb1KEe%V>l8_4nY6N_Rd(}dz1aP&+U|1M^OeVzIQw(1narz)U$p&Rq(j|>&D9qAN
zF!4kjpA&tq%Sq`h78Uu`_twqE&=u8D*&d5=Mz7KMq~%mvV4ZDBgDi@TCcm`}huj#i
zpigv`%5P;*Lv`*=)Hd9&i?12*w7+8RqQUvnXH=>CInVX$F4PtDTMnW1aYhVM|8{~A
z$&eAjQSA&hI90;;YskDbCLY}nkAq2B2w;^1s(Ez?zE>*$*^LbEpWom9qr)Hyhb!*P
zPGiW9Ac*`z|G&<G_0JHo|3?n@|5_^T|N4^T`t+y0kki#foYVmG!=pl<3BJEw`hB(;
zcsvn!JXjuyebb!bdOk?HpW>@x*DeGkfDuQ{dw$m~70vx)i$ux-)I<v%S4;xqRrF37
z^PRK~H5UKtUZ*??^<f1mm}Cf9fT^&89<%v%!%+V8@7zDliC29TYr9X0#0W56Mql5G
z@llEa#PS}kgPR#4cxjT_BF938V7b(slZx+MwFvr_P4O%h1#GY#%%{=UucE3>9m%m8
zy3IIPB8S2PL*F{`9B<6;*E;`w*H}O4gI<O@h`qEaO!u2V7_kVSx1?$<E=h;<Dp>k_
zFbEUa_@#%)3DcqKGHWl~kBf5$5_>50?^9=wQEa&XP`9{P)masMt9qr^N`Uh2n$KlW
zhcm~P0)c3foBZ_>3(hf-=NS&AA11DE4<J?~FKeD=WT>*1tssTzmccaNZKnQ)_Ja3$
z{CzdKo98aQAuIOdbrwX#K}>|QcZcGk#GuD6%AG>efd1)49f2sJ7OY}ztv875Z_H`*
z`Hzv+?`2(-8*I_Ut{1WYu~sP^X`Y@iBV#P5tB)zMS4}k_;Q2lOhaz>Fy|vq4I5=_I
zX+rd5p1^LZK;9W0E&HHBZUl?e96&~WsZvi*@iq!m?Szf(WPCin@g%f5NJ8q>P-4p2
z1MKd;TR;;9>O!iXgO$#i)uM6m>PZ1t?ZvD88l5_yprD~n)({r#$K}8+AHuqPlZ`o4
zu_UQ^CEKZ(mQVlsG&1!LHs1GSE640vk-t68)K7AK66hPGs)Sz;KJlQe;;0}er}&sG
zPIykN$#HXWq+Lx-L5lG#BnA>CuXqt(CodzY<+Y1&?dn)Zmya^6E%xS}qA^78#MYHo
zzMD&cn|ot?YeW-Chp}gVmS7+m&*37%bn7Am3oB(USNiqtUI+=3azFjxIL*q=b6TB|
zo1*;UKjoZ-_B3HJtn7o5GBVC5e0N8Z)DSs49qlUSgN_U0F+z4B5h*Otf>Sm=6KmL_
zWxB}gBAdcgoTgLnY0zfqL&BGGv~MsvXWg@@KArwWs$mNC#hyz@O2%jfgSw=ptyEbk
zet1;r`$~p~6<89<ubj|N&Gn)wJh6Xv03#Q^+<+dFPJ4k;L2;m_5Vp4<IQIc^Uhuk}
z`^128@Ws}kjKeKnr6;?7kMpd%q--dT5k4KDQ2JBT!Wlp<EmJplLMwN)8P@ma{QkVd
zaXT%ZT7H<z^uw78-nkKoPT&mXabvyMm7TmO3Vpm!pOgF_YXK@gGEftfi5y;C9DB;m
zU8Xbj$QC8qiK@W&UQ~mNFsF9oLfq(>)r}IZuJtV>tC@)XGpJb)T=W!EX<co^Q&i)#
zJzTqULr49}iykst&LWo=u=Nel_Aewt9+s>t;F7<CwQIWb<m<1gn8XMyhnuI>vZqHP
zx_N<V0D%u7Cl7j>aPMX$+MV_!=*8|%7-1VmG~(Y&vEm<=-k<MiZpLE8gU5dN)cfIg
z*vFJV8>e*^-0J}n5&;s@3=<{ri<0iw)Po(;qs^Fq=E3z24hUQ^d<id7>^OLIFP<hy
zi?05m>T`qlW=LiFlN+y@W{T}l6&#q-*sBHfV^T+p^_}4DR*9ae%80RX-)szzV|pv!
zynu^<wkrVvhWVmld9AQG<DU)wt|i3*pSlIy+bxO99njGVqK37Lz8@$Wk6}DRxb<!6
zz=K&%YIKb;>YR5CwCXV8sjJ^b;v?GS8X@|lnld*Xy9CU&-nc!ouJ%Z3u~NWOiMt^<
zodDBi2G$39fQTA=4!AORBQ_@36f@Kb_pXV>nmcoLKk`CC9-?eeLtjbcc{!z}(V+?G
zq;ng*sgM6OE=Kr7aOZb(A5#LEw$U9eQ!{OVlw@1-*W{-)-isKVYrO0%0h$BLG&3?<
zo;{Zm6<IlkZNEa6F$7<amVqWQ-~8y*ND5<==Z9M-GxX$GOM2zMWVjHAd#oQq@}4WJ
zl$4&$1%3LoHhyIrLqv3YPfMPGF^d@;F+dfa|K>-Z0=dqqk)I!Rvu)qe`S+vq*ohJO
zgNctCP{AfS^vRbN9{9|1j*d{%3Ako7_4g0Gc1^u&IzzM^KhdZCR(6C4n&Fj-Wu0%z
zXEaNnQC4!yiqcsyxf}WVO1^%L&)C)Fy6i&L<ni4{@4nvr{QzyU4F%?>z-IRs!PPYo
zRs%5&)n5Jcu}Z5H-P`X`MO@)*Tq$Jq+<@$fT*t#@EhBVEETkO8#vyM$$FevLp<zX-
zF}PwZeW@=K!ijW_8#Np#CvkIxnHa#((=Ff{lyvsx%fJZBy1w`?(u}XpQd&weOYOMc
zvS2E(Vd(4I@hEghfG4k{Z;u&`;ypv=_?+h1FUqPGC-W2=A1gvS6xkOD2Jz(-)TWJk
z;k7}w+e7!ZN{wxqg*|x@rr$Pvg@xf>6KkI!ZIN)L6#3^>%AeI>VV0Zlc8Q}I%9inz
zb~x`e7M4mpW*3B$*j>BUm$V%BQ5n8g%67M5s+C;$MiYQQp`ZBc61Hr2J){m&%hwk#
zV%%!TwO&`>wzgb+eQFn*!GcD<hWmWn;||qSUht{174mE~5_CSR=Fk~ll2jn|60JWH
zU+vqC>fus25$<3V;g!^hgE=V@@}=7T&1(__W2r(W2xN7ePE29K{61AaGS!$5nvVh4
zba76=JR_>A78h-X4YAV3{``#uk3Amei`654*OjB?XdOV)1hNEW6+0@4C}_>Kq+qm>
zG9Si=-`%k(l2e3YEB3Kd&q#Y}X-OVKJ2@-GUk)LoiESeV`#m?*{m@-CJd)(oc{snh
zxoM<4a3`5P>DS_*rRDNkd!wyv+QTvN+G(1W=pQ%Ih+*0A4^PEngEqHvve*o$A^hL2
zN42C>gH;&2j6?8-eNTO7Dtv<2{H#<0uUD!!vMc9KPWqZqpx2-kG>FFhvaQzbyZ)f;
zDO&}`!-o$(WC5w(fOd(A=CIO%(ODu$4@{>u|4v6kjxd~Je6qxgJ?M29;u9q0IZI4H
z7C?_u>~;2(G6Tzn-}`_l`VE<Ue8OF9Xu~t3RrN9xcuXMl<%vu!naO(c;PhgXKT2i(
zLqz@=^0&UD;k7ztx~nNdb`2S=ua^rnCNH3at(@N(v^BH@jrOe>iQU@WOj}~oG4A}N
zkyqK^iPoK#WE=OAF8U}I+tdbcX8r_p&|oh$_J;)<A!p2yrvJ>CseM8zCZu`rReH|u
z(%u9m{Ndt6CR-d?q3eUDo~K;&3*|K<qQF_cPfe;XIKN%9d)}SWc;{t&(8fz%mCa#q
zNDOLDz_8a{A^4my0mhXrj@T~)y7Lrn98r53a>Xh6QS})ZolQU|iyYj4jTPrG{qB6u
z?Kfm@mq0qyEVl<4UWh%y!{O^tJ%i2dADR`M3Zr<^pG>uf?X5;W2)eFXhPsf+3rAc0
zrK~FveK&t2s;o^`kO7yE!LAw!uN(>Ao>yot4rGyCpwgGyXoI%<lOYQ^rx|&ncrX8B
z`3>M)0KNo5Q-dAjyj)yipl1A*knpoA+P6rS$;E}t8LNa8L^6NG?Q#DBS@O$2lbS%t
z_P4UMml>$BN~wKlaN48P5c<o3VCd@XtgXw02T4`51trcmlOVgO(Omm(hTG5wiOg*e
z`AzmK&ceS+WfgUGS63HyA>SXfYyrQ1WQr&lS>Hd`6p8pxlc;2`dyADQX=rZmg`J&6
zRJl-4Q6J0>Zh#UHu!`7PS|fAi@EO&xNQQfpa*Hi3i{`7n_Rfm4o&vN~%3Bk9VFld3
zBJuCU{C_60d2dZ->n$R41_94X>4qAX^RdP8zCN%ly!HwrOS!$V;Q=s-6O|l(@PH!;
zLd)4%Qc3P4W`MFunDO%iG0ebd<<7-ncdkuhw&Ac9$iGa1bJj!`M1+7A8)9|%75-*8
zg)=h06U4ZFH+oh@J!Oc27zEHG%(6uj!Pv*^9d-f8$6{`xR|Tli;G2PoaTB7lKGTRh
zkOVZG09PjL$K&|NPZ9W#Os3OeYHBw?xcH;iWzW(7qbA@z2LqGcpEVj8(}_;c)-*DJ
z2r}H0laqV=yzz6B35X7N;RFD!OrvzKL|fDCZ1>w8$iy2OZQ+<tHe4P;fwK`GxC<64
zoR;(wfkJSyN&L{D|51ng`sx^)tIqB40hn7Q_`Hs>;>ps}%_DURi`4Fw#l#TVjDUR7
z@=nCDz-oyPK#)SXbRghF^tDbZ>K$Ssrn@7+gc;4sT80KyC5r|S#Bah!MJ2iZFZpy=
z*SW2d@fhQ{fi)PI9W0m1q!kqn07Qyb=QGT0H>x)x0_*q~<wr^~uagttZn)TW16o1Z
z8cjROjoJCn1Wwa|<d&n!f@xZ>qmh+Ud}e0V#-l^o*LQdKN<~@}Gi&J`;)rL5MzDs9
z4F+Y1R=q+g>yF7zp8MKT;@)HtJ4njwB~sGSnON$2o=!3Kyx?*<IwGSiv{@4)+-bBJ
zzxqQ^$S&~s1ps{HQn}9iq6>0ArV1L0fTozYa{CwnU1+GGqB4{5>=c~s_HvV{aHQ02
zsrs`~L$!rkjj79@J74Ko2)l@ZFJDgIOIJqAxoxYVRDsOg^w=9D1X6yZi$dy97lC-U
z<JFDqeq}?MR8&sYM*aA}Kvp!8w$0a5C4f&RxVm3=3Rp32PKOiY<A9^k;Jm|DNQ{JZ
z3!Gw5X!t@>5}?Ig9{y&oH9I>1>a;40c|^RR+Zrp;c`na|IGfMiq$^v8+UAk2_Is$A
zy*rC;-G(paQr_E{Pssp)r_KvNpdlv*Bq!uoO8_V(bS~g=frhyaXpXb9vlsibYXt=i
z<ggjK2FHPIsIWhpUu*izc<wMw2uU|aG}fp1zOcfO5O44HJ#MQbkM*M`CMG5zD70by
zd8y8f8w;4Xx3jIogF>%fy?$MW;>b`-uur}p{N)QAWzNSG92^1;vmri(r|I$U>|7(e
zLTA|2=G3mHCPsezz!>fupjWF4EVF6r3+6(h&&kN}#$<r^xc~B{m2f;4_vgxRGyoCT
zx%QM|vbgJ5GpSa}0|;5^)cics5=+30s2w|dUP!Cc_|z&VIxpbtNXlkUt0`!KpFA&M
zESZchj807G1F!4$=WmEFS=cy49%2R)d7O4tN-6i^qI}ZH4rN{Bh!>S%Fow92>}-eq
zZQVGu(zjgZ3mg_VGP&H4c-v2(B0t0qC125hCIyO*!<>=1uFzMDbq@TLlz+9YZ(9Lt
zbg{t^$J9>6IPRIY@iNcO&aTi2flyvrZHV=k8UN~PF2-jB$lJDvh=@Qk@HNsKj%gsW
zY>oP^6w#RhG_41ef^ji@o`SN`Zkl)<qJAt6VDZ3!u{%{ZJ~5)8pn!wRbg2lHid=5?
z_45PP(n62hYL-q^%V%J-qUGzj(SWz$Sel>*nhpaU9qzm#Ldf?w{0~z*L<`)07+ewt
zKJagGV7W5w5`8Na;(w{U#P3NV5CQ#dz%WMA`(b>%>MKy#21M80)l49kL2wz*;i3k7
zS%5DTcn3nQ!9f8RJG^imGAJl0uel2i`sC<jg%kjgm4%J1T)f88x7u5g&E=$Xm|1(S
z@?fOENdRqZIEl5$I<dwoG$`m5pFROjwf55c)6F46WL@EZ+FzvQ+;n_+5R5-$fc&0-
zrLTWbv@u6R{TB^oPj8=4HL78|NZ-(q(x;nA?u-Zh$kny$;hpHK9453#2HKuSpKwL0
zYqP~17rUHTGwgq?beM}V;LCLS<kF$Uc&e&|e&M>F@u}t!edt<UH+v`IcVhqhg)Gq?
z;t%pLSZG+FE^<b__Z~^p7fgD9St%@H{F~SU$5vNX3=B-#ka591vzn{w?j9bvtYq<C
zKo|d(BTK`>OGDLo6bi_y8e&>n%^<bQti1q;$;|eL$CLruPr|SY3I3J)0G!@QdVtdc
z@SK9k@Elzt|E!Mscgs`3NBJ`E(Zxi3Vgd4H?k^@s>so?E$X9-jZC^5{E+^3RnPovc
zHDn2Nkguc~ukei{9Gf8*yQl9x!-@S%CHEQFNmD@+MAn3mg3=h-@;_)-|GN%C;o{;F
z4jtX60i*rM9LUcTy?2aQNdfZ6iY<u0xJXR)(RHwL@^26DR*=Dph#1J;ay>L@mgWHq
zl!eLf24!wmR#rwJ^AhwU_!Af`cXu>e7p7@JWKl$d_i(ktt~OZ<g$JaN7x^+9zov4O
zGX2i6A|n<TTHZB1#)Zefv$yub#0>w<-@t}I#s{WQS`!M2;G+mPUMPLYXU7M=VH@+Q
ziJ6|G&U`yCFntzB@BWDoS!%R#jg5;d%+4RpwsT{LVe5lHJur;T4-3eP_>`4bZjTmK
zWMzqb{5aHv^j)*L7CgMOYkavoi@Vh9`2bAc7PIZgi??#LKqSAOw;cy?6o`m^fGRgt
zTFqFkdsNU#4F`w9Eh!?Xz+(NI$KwkP&@hjtYnquA9F`#U4fnU$9!wd<LQqjr`5T<L
zxY<Pw<>ik;=P%pa$=5g5b?_XFm&AaSr*|A5!~^XQ7IpyBc6RpN`QD_-bTt(M2Lr?H
z?zwu3)_dD>HX`222G3Ka@vcyHjv8_Pw|B}VKs%cmigwQHV4Pb}@J+^wWNF@sxV1z9
zs#IQMwLcQInN$)YuOar<cr0!!5aF3Go4XhN`>*(gVCx9T)vJ>&4$3n9dwY9R_&kXD
zxda4&<a>>nSgT0=9an|bN$>UPMgh0{)#RSjuy$iL@NQZiTIQ|H1hV&tlmL__05CQO
zhJO_v7ptqQ1N06cmlk!J93QW9d$bviad)`)(+TzV)=1S_%*xJsN%RgA8@s>wW_1??
zJcF7t9$>i;Qlx`-w)>UH6l`hQRso|Ru9U3VOe(<1^x_s^Dxy8c#rpcBfQ$Pj8micX
zuk`fqrblB~f4%Ovo0`Ml;_;Pd3hQ2{M?4-E8Pzd{kIhYhmvu?P6BCsb(na##^^+jf
zbG0@cm~9su9k^-V`jF9+==UQd?cT-4bai&&4aj`_sC$Ly^E2oq4%#s@5D<{}W2CfL
zlc${9k%?&#AQmZgFiXV*m6T%q{fEW3h5-g>pSnn$r`mKUKtx5wSwTUj`vL?%OuqhV
zTxg^j*1|IlJT<~sRgF*ohD0iXuyS?POT|m$ulbC(Kt1-O1gI~Y9bCWP)6>%zt5knk
z>8{ZI*66zC6JUE^?=W*>eGh;;Ak>fP<IVW$)pkRD-SkhB#R{Zhs)^CjzZ?y9tSM~A
z>1Gcz<d_Way9>=*GGDyS9C=o10qsvxKc#aofbdc$Knf*4#2QZAZ$;8itW5^N(%t<&
zwaNMX=$QS5!zAz;r!xYJUSmYUk~C@~@dTU^B?}7yea8ca7>1CNva%8OsCxl|5?VuE
zZmxPIRi3u2Vsxl5K)SRCVi$tjmOeIpU*DDAjSl$0n}NR<W^d2fAgN{PnSSy^!kuCl
zL7ADCS6x^$RI}h%uHZ|m7u=irsy*(<M;{T<j$v<Yzt2mRE=V$U^$zA_9ILDLlFB^W
za^whUCFGP}ebSq?+T73PJw04W_pxx^fKj3X@F5Zi2u)3oTun6G`P30vgD0XCV6e4Q
z{NmP&`1cOpIet9kkl~aT=6VWTPk;Z^c4kzpXM*<ubET2!X<N5Q2tNx7%E~|Cbjto&
z@E9o*Ru}iDR?#ST=Y+ALq9QN$+}u3-@PN_K25x7i-_l^Gn=+6}Np}C7qbC&P<V($f
zH882Jh&#C%CQFzRAxIB%5p>2C1QbCW;Ha`U>^77|Lpytp*V;Nh4k-G|af$H&kVY;;
z!9-D1n1!Ieb{x5dOboo0$qm-C0}}-F@a$wX-1vSWu{FaqTaaIWFe#>vY>4?>$r)&p
z6C-Z{VlBhKbgI<R;k4HAUI|zp1D>=z9+?ac(8(N=cLetzHCL1aaIJQWNB3QT64M*2
z-_121Tkk=6eP!u=r^acP)L{M0Fj)2=AtmKK%M#+*0f>%U@2|)6RC8gxf?;P)TP5im
zWD{nb{QX~!kIuTprKI|LM&ORaGMr3!6V<e|-V=DX50VT?Fa2IrR8;sO;JJ^iPyF5$
z70*9E&<5fe2TviNJEXBt{TY&lAgnC!pWznu;|IYz^X1v+%0o#_Svfg#jddMB=!zO`
zGEw^8uW}??yV)@!JX{b>1yE<RgiFgg{MC_i0aQzwXs$}vQ=}hn5EMLV-)wE!z=6eD
z7v86=JytVcxHBGiC+8b3iS-%_75g`VKDMVsz5CBjMJzfofAkLw|0xh)2MxOZ{}%N9
zhvgPqi}txOG$<Sz8c<nuEYe1OAGHKK5of*L@w9<62k3h;!#zL3AHHh-h=`zvK)R!z
z5XfH@L{sUV?4Hk`oymlRrSsWiT=XBM!>7Z%pIYB6E8;dHre*cg(H&L&9QHlNZu&=*
z_YWqDGg2Oyf*!#GMY||_KRN5NKNfr+E$fF*pUOk10Mp27q5ksZ{57FT{&w8k5N=#o
z!`$s~a=xs*v{sC00<h+RrE8=<KO#>ux&c5ZXtsdCH^won2nQaq{krlqLaY#(%va%`
z-m67>6#T^AAbbCglm)ar2ngz>D;r=>Vqe6bUE$T|Ci#xV^!9%n8JRZ^+<o?l#}Fk5
zzXBt~3_sk8XMB}WPnH$S_sih_k=wc9^sp}l3>Vzof9neAk^Y%!q(^4Y+&&3ONkanz
zRsfZgG*pVQw<#IC9==MZ&&<k;ONeO$z(y*Qe8M29meXj(7MKAJ&bn?7;OMY{zZcff
z_)A^%Zsa??y&4=}F*eO(CnslRJvQ0d!O0{G2=czvT01-2-gbsUp#Z3}S#xsR9Y@O1
z+e;@Y*~=P#Ov!-&C2N)bz=#+&c37pSLjOyGYe=Nb%9R>91NFo3|J8n@!VClrh(ULv
z%MqZQc{4RO$||B*SgU~SjV6fEj()@D$^jEpi0hM(3K-W1D>IxQv||c==rhwu@d<H(
z1BL7^4U#F&jw|Au4<=&)-i_w=XeciPk-0}le-Nmi8RvNC^;{c(A0=pW&dA81LzBU1
zM|Nc{d1P}bXBz{Y_qGa^-rl}|0Jdh&C%{(?W^a_-2+(Um0Z}ViNm<ch(MM5;AwAB&
zfD1DOGb1C$%U#yjH#WePSI}cI4#lLBL<tOXh(fT=02deI>GrI)H)-vE@J;&vb@%}Z
o4({>M{Rxy04h|0SZwUnt2OovE60K4Z4UWJ`ihdL+7Si$lZ$FW;L;wH)

literal 0
HcmV?d00001

diff --git a/docs/codex/xirp-context-report.md b/docs/codex/xirp-context-report.md
index cc7b0f7..bf0eb5a 100644
--- a/docs/codex/xirp-context-report.md
+++ b/docs/codex/xirp-context-report.md
@@ -157,3 +157,43 @@ of canvas integration: [desktop](artifacts/xirp/knowledge-inspector-desktop.png)
 Both had no horizontal viewport overflow. Temporary preview files/server removed.
 S1 mounting, real desktop smoke and this new increment's Linux/macOS CI remain
 separate integration evidence.
+
+
+## Organization increment
+
+Backend+typed IPC published as `fce3982`. Migration 0005 adds project/session
+organization tables with cascading metadata FKs. organization.get reads up to
+100 distinct registered targets in request order, without persisting defaults.
+organization.save compares the whole record's revision and atomically saves
+pin/archive flags plus session workflow. Revision 0 means unwritten defaults;
+returning to default flags after a save retains the row and positive revision.
+
+OrganizationPanel receives client(getOrganization/saveOrganization), optional
+currentProject{id,name}, currentSession{id,name,status}, connectionKey and
+onChanged(entry). It preserves per-target drafts and requires explicit Save.
+Conflicts preserve choices; Refresh revision displays the latest saved values
+before another save. Current daemon status remains visible even when workflow
+is Done or archive is selected. S1 should keep the panel mounted while hidden
+and refresh canvas sorting/filtering through onChanged.
+
+Verification: all 199 core/storage/daemon tests passed, including 10 real SQLite
+organization tests and 2 socket tests. The socket acceptance starts /bin/cat
+through SessionManager, changes archive/pin and every workflow value, and
+checks the live session DTO stays unchanged. Restart preserves organization;
+explicit stop/delete remain separate actions and repository files survive.
+Core/storage/daemon all-target clippy, formatting and whitespace passed.
+Independent QA found no concrete backend or UI correctness defect; the batch
+snapshot stress test remains probabilistic, while production reads explicitly
+share one transaction.
+
+Frontend focused 26 tests (panel 9, decoder 6, client 11), typecheck and targeted
+ESLint passed. Isolated Chromium fixtures at 1100px/375px showed visible keyboard
+focus and no horizontal overflow: [desktop](artifacts/xirp/organization-desktop.png),
+[narrow](artifacts/xirp/organization-narrow.png). Temporary preview files/server
+removed. Real canvas mounting/filtering and Linux/macOS CI remain integration
+work; these screenshots are not native desktop acceptance.
+
+Native initial-objective/options/continuity evidence is recorded in
+[xirp-native-capability-evidence.md](xirp-native-capability-evidence.md) and sent
+to S2. Installed flags do not prove successful resume/fork; actual adapter/start
+wiring and trustworthy conversation IDs remain required.
diff --git a/docs/codex/xirp-coordination-reply.md b/docs/codex/xirp-coordination-reply.md
index eae3025..c2fd5d8 100644
--- a/docs/codex/xirp-coordination-reply.md
+++ b/docs/codex/xirp-coordination-reply.md
@@ -96,3 +96,22 @@ S2 has merged S1 through `1e75081` and pushed `45d817a`; frontend work remains
 preserved. S2 will inspect the Linux catalog probe failure and coordinate a
 narrow fix with evidence. The local file editor is now being compiled and
 validated before its next push; its contract remains ADR 0006.
+
+## S2 file service published and reconciled — 2026-09-05
+
+S2 pushed file service `1225931`, documentation `2499b0b`, and reconciled S1
+through dd84a49 in merge **968b393**, on origin/feat/maestri-runtime (PR44).
+`file.list/read/write` have real socket handlers plus IpcClient
+listFiles/readFile/writeFile and Rust/JSON/TS mirrors. ADR0006 and the runtime
+report give exact byte-base64 paths, target IDs, revisions and limits.
+The existing read adapter is internal to daemon::files; global S3 capabilities
+still need an explicit adapter before claiming scanner reuse. No file event
+is advertised; reader/editor refresh remains explicit.
+
+The merge retains S1's stronger probe deadline handling from645047b and
+sanitized diagnostics, alongside S2's Linux ETXTBSY regressions. I adjusted
+only two AppShell test fixtures to answer S1's new listWorktrees refresh
+(including an empty list after removal), preserving UI implementation.
+After merge, 97 core/68daemon/63agents tests and all278frontend tests passed,
+as did Clippy/typecheck/build. New head CI Linux/macOS is pending; preceding
+45d817a passed both CI and Packaging matrices. No coauthor trailers.
diff --git a/docs/codex/xirp-native-capability-evidence.md b/docs/codex/xirp-native-capability-evidence.md
new file mode 100644
index 0000000..ec26965
--- /dev/null
+++ b/docs/codex/xirp-native-capability-evidence.md
@@ -0,0 +1,62 @@
+# Native initial objective and continuity evidence
+
+Checked 2026-09-05 by reading the local adapters and running only the installed
+CLI --help/--version commands. No agent conversation, login or private
+configuration/transcript read was performed. This is interface evidence, not
+proof of a successful native resume or fork.
+
+| Capability | codex-cli 0.153.4 | Claude Code 2.1.261 |
+| --- | --- | --- |
+| Initial objective | `codex [OPTIONS] [PROMPT]` | `claude [options] [prompt]` |
+| Explicit resume | `codex resume [OPTIONS] [SESSION_ID] [PROMPT]` | `claude --resume <ID> [prompt]` |
+| Explicit fork | `codex fork [OPTIONS] [SESSION_ID] [PROMPT]` | `claude --resume <ID> --fork-session [prompt]` |
+| Predetermined conversation ID | No option identified in installed help | `--session-id <uuid>` advertised; creation not exercised |
+| Model override | `--model <MODEL>` | `--model <model>` |
+| Approval/permission modes | `--ask-for-approval on-request|never` | `--permission-mode manual|acceptEdits|plan|auto|dontAsk|bypassPermissions` |
+| Sandbox | `--sandbox read-only|workspace-write|danger-full-access` | No equivalent flag identified in installed help |
+| Effort | No dedicated flag identified; generic --config exists | `--effort low|medium|high|xhigh|max` |
+
+The [official Codex command reference](https://learn.chatgpt.com/docs/developer-commands?surface=cli)
+confirms positional objectives, resume/fork and model/sandbox overrides. It
+also describes untrusted approval mode, absent from this installed help's
+accepted values; documentation alone must not populate the version-specific
+picker. The reference supports explicit --cd when choosing a different cwd.
+
+The [official Claude CLI reference](https://code.claude.com/docs/en/cli-reference)
+confirms the corresponding flags and explains manual as an alias of default
+since 2.1.200. Its additional ultracode effort is absent from installed help.
+Model availability and permissions were not exercised. --print changes the
+execution mode and is not an appropriate shortcut for obtaining interactive
+conversation IDs.
+
+## Current repository gaps and S2 integration boundary
+
+- Codex/Claude still use the generic BuiltInAdapter. Its internal capabilities
+  describe interactive/PTY/version-probe/extra-args support, without typed
+  objective, native identity, model or permission capabilities.
+- The active daemon SessionRegistry::start_id builds through
+  StoredAgent::command_for_cwd directly. Merely extending AgentAdapter's builder
+  does not affect this execution path. Spawn remains SessionManager-owned.
+- CommandSpec.startup_input exists with a 4096-byte bound, but no code in
+  crates/session reads it in this branch. Storing a value there does not deliver
+  an initial objective. Session/create/start wire and stored-session metadata
+  also lack objective, per-session options and native conversation identity.
+- AgentRecord/AgentDetection wire do not expose verified capability versions.
+  Display names and adapter keys must not be used to infer CLI behavior.
+
+S2 should define a typed new/resume/fork launch intent and bounded objective,
+route the actual start path through the native adapter, and retain structured
+argv. A prompt beginning with '-' requires verified argument termination so
+text cannot become options. Deterministic child-argv tests can prove local
+transport and redaction; they do not prove a vendor accepted the objective.
+
+NativeConversationId must remain distinct from the local UUIDv7 SessionId.
+Avoid binding by PID, PTY, display name or a changing 'last conversation'.
+Claude permits requesting a creation UUID, but successful creation/association
+still needs observation. This review did not establish Codex ID acquisition.
+Only expose resume/fork once both identity and native support are trustworthy.
+
+The [Claude session documentation](https://code.claude.com/docs/en/sessions)
+explains that simultaneous resumes of one ID interleave transcript messages.
+Managed resume therefore needs exclusivity; fork needs another native identity
+as well as another local session. Real continuation acceptance remains open.
diff --git a/docs/xirp-local-parity.md b/docs/xirp-local-parity.md
index 7c2e802..0e53639 100644
--- a/docs/xirp-local-parity.md
+++ b/docs/xirp-local-parity.md
@@ -8,14 +8,14 @@ added to this implementation's scope.
 
 | ID | Requirement and source | Owner / integration | Evidence / remaining work |
 | --- | --- | --- | --- |
-| X01 | Local project pin, rename, remove registration, non-Git folders, discover child repositories. [Projects](https://backstage.spotify.com/docs/xirp/projects) | S2 project base, S3 organization UI, S1 canvas | Baseline real daemon tests register both Git projects and plain folders; pin/archive metadata and child discovery remain pending. Project archive is a user-requested extension. |
+| X01 | Local project pin, rename, remove registration, non-Git folders, discover child repositories. [Projects](https://backstage.spotify.com/docs/xirp/projects) | S2 project base, S3 organization UI, S1 canvas | Baseline real daemon tests register both Git projects and plain folders; pin/archive metadata now persists via organization.get/save (`fce3982`); isolated controls and runtime-preservation tests pass, while canvas filtering and child discovery remain pending. Project archive is a user-requested extension. |
 | X02 | Initial objective delivered to agent, attachments, checkout/worktree and agent-specific options. [Sessions](https://backstage.spotify.com/docs/xirp/sessions) | S2 execution/contracts, S3 draft/context selection, S1 composer | Goal delivery requires verified runtime path, not metadata only. Attachments/options pending runtime contract. |
 | X03 | Resume/fork, agent switch preserving supported history, linked shell. [Sessions](https://backstage.spotify.com/docs/xirp/sessions), [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S2 adapters/runtime, S1 canvas | Current adapter capabilities do not expose verified conversation IDs, fork or usage. Await trusted native contracts and runtime integration. Local context reuse is a separate feature. |
 | X04 | Working/idle/needs-input attention separate from process lifecycle. [Sessions](https://backstage.spotify.com/docs/xirp/sessions) | S2 event source, S3 indicators, S1 canvas | PTY silence is not proof of approval/input need. Explicit hooks or native signals required. |
 | X05 | Local preferences, shortcuts, supported native settings, diagnostics. [Settings](https://backstage.spotify.com/docs/xirp/settings) | S2 settings/runtime, S3 rules/skills, S1 UI | Existing diagnostics/custom-agent creation are baseline only; do not expose unsupported options. Credentials excluded from editors. |
 | X06 | Global/project rules and skills, including symlinked skill directories. [Projects](https://backstage.spotify.com/docs/xirp/projects), [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S3 discovery, S2 file boundary | Known root/global/admin locations now have bounded metadata discovery and explicit UTF-8 reads, with origins/scopes/precedence caveats and skill-link target capture (`4a367d0`). Socket, core and isolated inspector tests pass on macOS. Nested project/session ancestry, native activation, source editing, S1 mounting and Linux evidence remain open. |
 | X07a | Saved global/project prompts, searchable picker and insertion. [Changelog v0.19.1](https://backstage.spotify.com/docs/xirp/changelog) | S3 knowledge, S2 shared registration, S1 canvas insertion | Persisted CRUD and paginated search verified through real SQLite and daemon socket; isolated panel CRUD/draft tests and responsive Chromium preview passed; canvas and Linux evidence pending. See S3 report. |
-| X07b | Session archive and workflow: backlog/in_progress/in_review/blocked/done. [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S3 organization modules/controls, S2 contract review, S1 filtering | Workflow must not mutate lifecycle. Session pin is a user-requested extension. |
+| X07b | Session archive and workflow: backlog/in_progress/in_review/blocked/done. [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S3 organization modules/controls, S2 contract review, S1 filtering | Workflow and pin/archive persist separately from lifecycle (`fce3982`); real live-process socket test and isolated controls pass. Canvas filtering/mounting remains pending. Session pin is a user-requested extension. |
 | X07c | Tokens/spend per session/day. [Changelog v0.18.0](https://backstage.spotify.com/docs/xirp/changelog) | S2 verified native data, S3 presentation | Source documents feature existence, not a collector/format/pricing algorithm. Currently unavailable, not zero. No proxy or PTY-based estimates. |
 | X07d | PR review, Doctor, cleanup. [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S2 runtime/Git, S1 UI | Existing Git status/diagnostics/removal-token safety are baseline; review and expanded cleanup require their real contracts. |
 | X08 | Agent-specific options, including Cursor. [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S2 adapter registry, S1 UI | No flags invented from agent display name; support requires installed-version tests and authoritative CLI sources. |

From 8f5ff867d93e9f1f1086adc059b3c281b584deae Mon Sep 17 00:00:00 2001
From: guicybercode <euguigom@gmail.com>
Date: Sat, 5 Sep 2026 23:09:51 -0300
Subject: [PATCH 22/23] feat(knowledge): discover scoped rules and skills in
 project subdirectories

---
 crates/core/src/knowledge/discovery.rs        |   2 +-
 crates/daemon/src/knowledge/discovery/mod.rs  | 333 +++++++++++-----
 .../src/knowledge/discovery/project_tests.rs  | 363 ++++++++++++++++++
 .../daemon/src/knowledge/discovery/tests.rs   |   7 +-
 crates/daemon/src/knowledge/socket_tests.rs   |  94 +++++
 docs/codex/xirp-context-report.md             |  36 ++
 docs/codex/xirp-discovery-contract.md         |  37 +-
 docs/xirp-local-parity.md                     |   6 +-
 8 files changed, 761 insertions(+), 117 deletions(-)
 create mode 100644 crates/daemon/src/knowledge/discovery/project_tests.rs

diff --git a/crates/core/src/knowledge/discovery.rs b/crates/core/src/knowledge/discovery.rs
index fda7d7d..5d630f0 100644
--- a/crates/core/src/knowledge/discovery.rs
+++ b/crates/core/src/knowledge/discovery.rs
@@ -126,7 +126,7 @@ pub struct KnowledgeSourceEntry {
     pub source_path: String,
     /// Filesystem name, not parsed or executed frontmatter.
     pub name: String,
-    /// Relative project scope ("." here), or empty for global/admin sources.
+    /// Relative project scope ("." or a nested path), or empty for global/admin sources.
     pub scope_directory: String,
     /// Static documented precedence caveat; never an effective/active assertion.
     pub precedence_hint: String,
diff --git a/crates/daemon/src/knowledge/discovery/mod.rs b/crates/daemon/src/knowledge/discovery/mod.rs
index ccffd61..a823e45 100644
--- a/crates/daemon/src/knowledge/discovery/mod.rs
+++ b/crates/daemon/src/knowledge/discovery/mod.rs
@@ -31,6 +31,20 @@ const SCAN_TTL: Duration = Duration::from_secs(300);
 const MAX_ENTRY_JSON_BYTES: usize = 448 * 1_024;
 const MAX_ISSUE_JSON_BYTES: usize = 32 * 1_024;
 const MAX_ISSUES: usize = 32;
+// Provider directories are excluded from ordinary project traversal; only
+// explicit source specifications enter them. Other names are an explicit
+// dependency/VCS policy; build, dist and target may hold project instructions.
+const PRUNED_PROJECT_DIRECTORIES: &[&str] = &[
+    ".git",
+    "node_modules",
+    "vendor",
+    ".venv",
+    "venv",
+    ".codex",
+    ".agents",
+    ".claude",
+    ".cursor",
+];
 
 /// Daemon-selected roots; IPC callers cannot override any of these paths.
 #[derive(Clone, Debug)]
@@ -85,7 +99,7 @@ impl DiscoveryService {
         }
     }
 
-    /// Inventories known globals and project-root locations, without reading text.
+    /// Inventories known globals and bounded project scopes, without reading text.
     pub(crate) fn discover(
         &mut self,
         project: Option<&Project>,
@@ -100,16 +114,7 @@ impl DiscoveryService {
         let mut scanner = Scanner::new(scan_id);
         scanner.issue("activation_not_evaluated", None,
             "Discovery reports known source locations, not whether a native CLI loaded them. Imports, config overrides, frontmatter activation and plugins are not evaluated.");
-        if project.is_some() {
-            scanner.issue("project_root_scope", None,
-                "This inventory covers the registered project root. Rules or skills from a session's other working-directory ancestors are not evaluated.");
-        }
-        for spec in source_specs(&self.roots, project) {
-            if scanner.full() || scanner.remaining_nodes == 0 {
-                break;
-            }
-            scanner.scan_source(&spec);
-        }
+        scanner.scan_inventory(&self.roots, project);
         let now = Instant::now();
         self.scans
             .retain(|scan| now.duration_since(scan.created) < SCAN_TTL);
@@ -228,6 +233,7 @@ enum Shape {
 
 struct SourceSpec {
     base: PathBuf,
+    scope_directory: String,
     directory: &'static str,
     provider: KnowledgeProvider,
     scope: KnowledgeSourceScope,
@@ -266,9 +272,9 @@ impl SourceSpec {
     }
 }
 
-fn source_specs(roots: &DiscoveryRoots, project: Option<&Project>) -> Vec<SourceSpec> {
-    use KnowledgeProvider::{Claude, Codex, Cursor};
-    use KnowledgeSourceScope::{Admin, Global, Project as ProjectScope};
+fn global_source_specs(roots: &DiscoveryRoots) -> Vec<SourceSpec> {
+    use KnowledgeProvider::{Claude, Codex};
+    use KnowledgeSourceScope::{Admin, Global};
     let mut specs = Vec::new();
     let codex_home = roots
         .codex_home
@@ -278,6 +284,7 @@ fn source_specs(roots: &DiscoveryRoots, project: Option<&Project>) -> Vec<Source
         for leaf in ["AGENTS.override.md", "AGENTS.md"] {
             specs.push(SourceSpec {
                 base: base.clone(),
+                scope_directory: String::new(),
                 directory: "",
                 provider: Codex,
                 scope: Global,
@@ -288,6 +295,7 @@ fn source_specs(roots: &DiscoveryRoots, project: Option<&Project>) -> Vec<Source
     if let Some(home) = &roots.home {
         specs.push(SourceSpec {
             base: home.clone(),
+            scope_directory: String::new(),
             directory: ".claude",
             provider: Claude,
             scope: Global,
@@ -295,75 +303,87 @@ fn source_specs(roots: &DiscoveryRoots, project: Option<&Project>) -> Vec<Source
         });
         specs.push(SourceSpec {
             base: home.clone(),
+            scope_directory: String::new(),
             directory: ".claude/rules",
             provider: Claude,
             scope: Global,
             shape: Shape::Rules("md"),
         });
-        add_skills(&mut specs, home, Global);
+        add_skills(&mut specs, home, Global, "");
     }
     specs.push(SourceSpec {
         base: roots.admin_skills.clone(),
+        scope_directory: String::new(),
         directory: "",
         provider: Codex,
         scope: Admin,
         shape: Shape::Skills { recursive: false },
     });
-    if let Some(project) = project {
-        for leaf in ["AGENTS.override.md", "AGENTS.md"] {
-            specs.push(SourceSpec {
-                base: project.path.clone(),
-                directory: "",
-                provider: Codex,
-                scope: ProjectScope,
-                shape: Shape::Exact(leaf),
-            });
-        }
-        for (directory, leaf) in [
-            ("", "CLAUDE.md"),
-            (".claude", "CLAUDE.md"),
-            ("", "CLAUDE.local.md"),
-        ] {
-            specs.push(SourceSpec {
-                base: project.path.clone(),
-                directory,
-                provider: Claude,
-                scope: ProjectScope,
-                shape: Shape::Exact(leaf),
-            });
-        }
-        specs.push(SourceSpec {
-            base: project.path.clone(),
-            directory: ".claude/rules",
-            provider: Claude,
-            scope: ProjectScope,
-            shape: Shape::Rules("md"),
-        });
+    specs
+}
+
+fn project_source_specs(base: &Path, scope_directory: &str) -> Vec<SourceSpec> {
+    use KnowledgeProvider::{Claude, Codex, Cursor};
+    use KnowledgeSourceScope::Project as ProjectScope;
+    let mut specs = Vec::new();
+    for leaf in ["AGENTS.override.md", "AGENTS.md"] {
         specs.push(SourceSpec {
-            base: project.path.clone(),
-            directory: ".cursor/rules",
-            provider: Cursor,
+            base: base.to_path_buf(),
+            scope_directory: scope_directory.to_owned(),
+            directory: "",
+            provider: Codex,
             scope: ProjectScope,
-            shape: Shape::Rules("mdc"),
+            shape: Shape::Exact(leaf),
         });
+    }
+    for (directory, leaf) in [
+        ("", "CLAUDE.md"),
+        (".claude", "CLAUDE.md"),
+        ("", "CLAUDE.local.md"),
+    ] {
         specs.push(SourceSpec {
-            base: project.path.clone(),
-            directory: "",
-            provider: Cursor,
+            base: base.to_path_buf(),
+            scope_directory: scope_directory.to_owned(),
+            directory,
+            provider: Claude,
             scope: ProjectScope,
-            shape: Shape::Exact("AGENTS.md"),
+            shape: Shape::Exact(leaf),
         });
-        add_skills(&mut specs, &project.path, ProjectScope);
     }
-    specs.sort_by_key(|spec| match spec.scope {
-        ProjectScope => 0,
-        Global => 1,
-        Admin => 2,
+    specs.push(SourceSpec {
+        base: base.to_path_buf(),
+        scope_directory: scope_directory.to_owned(),
+        directory: ".claude/rules",
+        provider: Claude,
+        scope: ProjectScope,
+        shape: Shape::Rules("md"),
+    });
+    specs.push(SourceSpec {
+        base: base.to_path_buf(),
+        scope_directory: scope_directory.to_owned(),
+        directory: ".cursor/rules",
+        provider: Cursor,
+        scope: ProjectScope,
+        shape: Shape::Rules("mdc"),
     });
+    specs.push(SourceSpec {
+        base: base.to_path_buf(),
+        scope_directory: scope_directory.to_owned(),
+        directory: "",
+        provider: Cursor,
+        scope: ProjectScope,
+        shape: Shape::Exact("AGENTS.md"),
+    });
+    add_skills(&mut specs, base, ProjectScope, scope_directory);
     specs
 }
 
-fn add_skills(specs: &mut Vec<SourceSpec>, base: &Path, scope: KnowledgeSourceScope) {
+fn add_skills(
+    specs: &mut Vec<SourceSpec>,
+    base: &Path,
+    scope: KnowledgeSourceScope,
+    scope_directory: &str,
+) {
     for (provider, directory, recursive) in [
         (KnowledgeProvider::Codex, ".agents/skills", false),
         (KnowledgeProvider::Claude, ".claude/skills", false),
@@ -372,6 +392,7 @@ fn add_skills(specs: &mut Vec<SourceSpec>, base: &Path, scope: KnowledgeSourceSc
     ] {
         specs.push(SourceSpec {
             base: base.to_path_buf(),
+            scope_directory: scope_directory.to_owned(),
             directory,
             provider,
             scope,
@@ -404,6 +425,110 @@ impl Scanner {
         }
     }
 
+    fn scan_inventory(&mut self, roots: &DiscoveryRoots, project: Option<&Project>) {
+        if project.is_some() {
+            self.issue("project_subtree_scope", None,
+                "Discovery inventories known configurations in the registered project subtree. Session working-directory ancestors, repository boundaries and native activation are not evaluated.");
+            self.issue("project_scan_policy", None,
+                "Project-root sources are scanned before globals and then descendants, sharing all limits. Descendant traversal skips .git, node_modules, vendor, .venv, venv and .codex; .agents, .claude and .cursor use only their known rules and skills readers.");
+        }
+        // Resolve daemon-selected root aliases once. Nested scopes must keep
+        // their opened capability; reopening absolute paths could follow a link
+        // that replaced an ordinary directory after enumeration.
+        let project_directory = project.and_then(|project| self.open_base(&project.path));
+        if let (Some(project), Some(directory)) = (project, &project_directory) {
+            self.scan_project_scope(directory, &project.path, Path::new(""), 0);
+        }
+        for spec in global_source_specs(roots) {
+            if self.full() {
+                break;
+            }
+            self.scan_source(&spec);
+        }
+        // A large descendant tree cannot consume the budget before globals.
+        if let (Some(project), Some(directory)) = (project, &project_directory) {
+            if !self.full() && self.remaining_nodes > 0 {
+                self.walk_project(directory, &project.path, Path::new(""), 0);
+            }
+        }
+    }
+
+    fn scan_project_scope(
+        &mut self,
+        directory: &Directory,
+        logical: &Path,
+        relative: &Path,
+        depth: usize,
+    ) {
+        let Some(relative) = relative.to_str() else {
+            self.issue("non_utf8_path", None, "A project scope with a non-UTF-8 path was skipped; path bytes were not converted lossily.");
+            return;
+        };
+        let scope = if relative.is_empty() { "." } else { relative };
+        // Exact allowlisted probes remain possible for directory entries already
+        // collected at the enumeration limit, just like rule/skill candidates.
+        for spec in project_source_specs(logical, scope) {
+            if self.full() {
+                break;
+            }
+            self.scan_source_at(directory, &spec, depth);
+        }
+    }
+
+    fn walk_project(
+        &mut self,
+        directory: &Directory,
+        logical: &Path,
+        relative: &Path,
+        depth: usize,
+    ) {
+        for name in self.names(directory, logical) {
+            if self.full() {
+                break;
+            }
+            if PRUNED_PROJECT_DIRECTORIES
+                .iter()
+                .any(|pruned| name == OsStr::new(pruned))
+            {
+                continue;
+            }
+            let path = logical.join(&name);
+            match directory.open_child(&name, false) {
+                Ok((child, _)) => {
+                    if depth >= MAX_DEPTH {
+                        self.depth_limit(&path);
+                        continue;
+                    }
+                    let scope = relative.join(&name);
+                    self.scan_project_scope(&child, &path, &scope, depth + 1);
+                    if !self.full() && self.remaining_nodes > 0 {
+                        self.walk_project(&child, &path, &scope, depth + 1);
+                    }
+                }
+                Err(SafeError::NonRegular | SafeError::Missing) => (),
+                Err(SafeError::Symlink) => self.issue(
+                    "directory_symlink_skipped",
+                    Some(&path),
+                    "Project-directory symlinks are not followed; only known skill-directory links are supported.",
+                ),
+                Err(_) => self.issue(
+                    "directory_unavailable",
+                    Some(&path),
+                    "The project directory could not be opened safely.",
+                ),
+            }
+        }
+    }
+
+    fn depth_limit(&mut self, path: &Path) {
+        self.response.truncated = true;
+        self.issue(
+            "depth_limit",
+            Some(path),
+            "The cumulative source-directory depth limit was reached.",
+        );
+    }
+
     fn full(&mut self) -> bool {
         if self.response.entries.len() >= MAX_ENTRIES || self.entry_bytes >= MAX_ENTRY_JSON_BYTES {
             self.response.truncated = true;
@@ -431,28 +556,44 @@ impl Scanner {
         }
     }
 
-    fn scan_source(&mut self, spec: &SourceSpec) {
-        let logical = spec.base.join(spec.directory);
-        let (mut directory, _) = match Directory::open_absolute(&spec.base, true) {
-            Ok(value) => value,
-            Err(SafeError::Missing) => return,
+    fn open_base(&mut self, path: &Path) -> Option<Directory> {
+        match Directory::open_absolute(path, true) {
+            Ok((directory, _)) => Some(directory),
+            Err(SafeError::Missing) => None,
             Err(_) => {
                 self.issue(
                     "source_unavailable",
-                    Some(&logical),
+                    Some(path),
                     "The configured source directory could not be opened safely.",
                 );
-                return;
+                None
             }
-        };
+        }
+    }
+
+    fn scan_source(&mut self, spec: &SourceSpec) {
+        if let Some(directory) = self.open_base(&spec.base) {
+            self.scan_source_at(&directory, spec, 0);
+        }
+    }
+
+    fn scan_source_at(&mut self, base: &Directory, spec: &SourceSpec, mut depth: usize) {
+        let logical = spec.base.join(spec.directory);
+        let mut opened = None;
         let mut linked = false;
         for component in Path::new(spec.directory).components() {
+            let directory = opened.as_ref().unwrap_or(base);
             match directory.open_child(
                 component.as_os_str(),
                 spec.kind() == KnowledgeSourceKind::Skill,
             ) {
                 Ok((child, via_link)) => {
-                    directory = child;
+                    if depth >= MAX_DEPTH {
+                        self.depth_limit(&logical);
+                        return;
+                    }
+                    depth += 1;
+                    opened = Some(child);
                     linked |= via_link;
                 }
                 Err(SafeError::Missing) => return,
@@ -462,20 +603,22 @@ impl Scanner {
                 }
             }
         }
+        let directory = opened.as_ref().unwrap_or(base);
         match spec.shape {
             Shape::Exact(leaf) => self.add_candidate(
-                &directory,
+                directory,
                 OsStr::new(leaf),
                 spec,
                 &logical.join(leaf),
                 linked,
             ),
-            Shape::Rules(extension) => {
-                self.walk_rules(&directory, spec, &logical, extension, 0, linked);
+            Shape::Rules(extension) if self.remaining_nodes > 0 => {
+                self.walk_rules(directory, spec, &logical, extension, depth, linked);
             }
-            Shape::Skills { recursive } => {
-                self.walk_skills(&directory, spec, &logical, recursive, 0, linked, &[]);
+            Shape::Skills { recursive } if self.remaining_nodes > 0 => {
+                self.walk_skills(directory, spec, &logical, recursive, depth, linked, &[]);
             }
+            Shape::Rules(_) | Shape::Skills { .. } => (),
         }
     }
 
@@ -523,12 +666,7 @@ impl Scanner {
                         continue;
                     }
                     if depth >= MAX_DEPTH {
-                        self.response.truncated = true;
-                        self.issue(
-                            "depth_limit",
-                            Some(&path),
-                            "The rule-directory depth limit was reached.",
-                        );
+                        self.depth_limit(&path);
                     } else {
                         self.walk_rules(&child, spec, &path, extension, depth + 1, linked);
                     }
@@ -580,6 +718,10 @@ impl Scanner {
                         );
                         continue;
                     }
+                    if depth >= MAX_DEPTH {
+                        self.depth_limit(&path);
+                        continue;
+                    }
                     self.add_candidate(
                         &child,
                         OsStr::new("SKILL.md"),
@@ -588,24 +730,15 @@ impl Scanner {
                         linked || via_link,
                     );
                     if recursive && self.remaining_nodes > 0 {
-                        if depth >= MAX_DEPTH {
-                            self.response.truncated = true;
-                            self.issue(
-                                "depth_limit",
-                                Some(&path),
-                                "The skill-directory depth limit was reached.",
-                            );
-                        } else {
-                            self.walk_skills(
-                                &child,
-                                spec,
-                                &path,
-                                true,
-                                depth + 1,
-                                linked || via_link,
-                                &ancestors,
-                            );
-                        }
+                        self.walk_skills(
+                            &child,
+                            spec,
+                            &path,
+                            true,
+                            depth + 1,
+                            linked || via_link,
+                            &ancestors,
+                        );
                     }
                 }
                 Err(SafeError::NonRegular | SafeError::Missing) => (),
@@ -661,11 +794,7 @@ impl Scanner {
             scope: spec.scope,
             source_path: path.to_owned(),
             name: name.to_owned(),
-            scope_directory: if spec.scope == KnowledgeSourceScope::Project {
-                ".".to_owned()
-            } else {
-                String::new()
-            },
+            scope_directory: spec.scope_directory.clone(),
             precedence_hint: spec.precedence().to_owned(),
             via_symlink: linked,
             availability: candidate.availability,
diff --git a/crates/daemon/src/knowledge/discovery/project_tests.rs b/crates/daemon/src/knowledge/discovery/project_tests.rs
new file mode 100644
index 0000000..eb0eb5c
--- /dev/null
+++ b/crates/daemon/src/knowledge/discovery/project_tests.rs
@@ -0,0 +1,363 @@
+use super::*;
+
+#[test]
+fn nested_formats_keep_owner_scope_and_provider_identity() {
+    let mut fixture = Fixture::new();
+    write(fixture.project.path.join("AGENTS.md"), b"Root instructions");
+    let nested = fixture.project.path.join("packages/api");
+    for relative in [
+        "AGENTS.md",
+        "AGENTS.override.md",
+        "CLAUDE.md",
+        "CLAUDE.local.md",
+        ".claude/CLAUDE.md",
+        ".claude/rules/security/request.md",
+        ".cursor/rules/nested/request.mdc",
+        ".agents/skills/shared/SKILL.md",
+        ".claude/skills/local/SKILL.md",
+        ".cursor/skills/group/nested/SKILL.md",
+    ] {
+        write(nested.join(relative), b"Nested source\n@private.txt");
+    }
+    for relative in [
+        ".cursor/rules/ignored.md",
+        ".claude/settings.json",
+        ".claude/skills/local/AGENTS.md",
+        "private.txt",
+    ] {
+        write(nested.join(relative), b"PRIVATE_CONFIG_SENTINEL");
+    }
+
+    let scan = fixture.service.discover(Some(&fixture.project)).unwrap();
+    assert!(!scan.truncated);
+    assert_eq!(scan.entries.len(), 14);
+    assert_eq!(
+        scan.entries
+            .iter()
+            .filter(|entry| entry.scope_directory == ".")
+            .count(),
+        2
+    );
+    let nested_entries = scan
+        .entries
+        .iter()
+        .filter(|entry| entry.scope_directory != ".");
+    for entry in nested_entries {
+        assert_eq!(entry.scope, KnowledgeSourceScope::Project);
+        assert_eq!(entry.scope_directory, "packages/api");
+        assert!(!entry.via_symlink);
+        let read = fixture
+            .service
+            .read(&KnowledgeReadRequest {
+                scan_id: scan.scan_id,
+                entry_id: entry.entry_id,
+            })
+            .unwrap();
+        assert_eq!(read.entry, *entry);
+        assert_eq!(read.content, "Nested source\n@private.txt");
+    }
+    let shared = scan
+        .entries
+        .iter()
+        .filter(|entry| entry.name == "shared")
+        .collect::<Vec<_>>();
+    assert_eq!(shared.len(), 2);
+    assert_ne!(shared[0].entry_id, shared[1].entry_id);
+    assert_ne!(shared[0].provider, shared[1].provider);
+    assert_eq!(shared[0].source_path, shared[1].source_path);
+}
+
+#[test]
+fn pruning_is_exact_and_does_not_hide_build_or_registered_roots() {
+    let mut fixture = Fixture::new();
+    // The explicitly registered root remains eligible even with a pruned name.
+    fixture.project.path = fixture.project.path.join("vendor");
+    write(fixture.project.path.join("CLAUDE.md"), b"Selected root");
+    for name in [".git", "node_modules", "vendor", ".venv", "venv", ".codex"] {
+        write(
+            fixture.project.path.join(name).join("cache/AGENTS.md"),
+            b"Pruned",
+        );
+    }
+    for name in ["vendor-tools", "build", "dist", "target"] {
+        write(
+            fixture.project.path.join(name).join("CLAUDE.md"),
+            b"Valid scope",
+        );
+    }
+    for name in [".agents", ".claude", ".cursor"] {
+        write(
+            fixture
+                .project
+                .path
+                .join(name)
+                .join("skills/tool/AGENTS.md"),
+            b"Not a project scope",
+        );
+    }
+    write(
+        fixture.project.path.join(".agents/skills/tool/SKILL.md"),
+        b"Known skill",
+    );
+
+    let scan = fixture.service.discover(Some(&fixture.project)).unwrap();
+    assert!(!scan.truncated);
+    assert_eq!(scan.entries.len(), 7);
+    assert!(scan.entries.iter().all(|entry| entry.name != "AGENTS.md"));
+    for scope in [".", "vendor-tools", "build", "dist", "target"] {
+        assert!(
+            scan.entries
+                .iter()
+                .any(|entry| entry.scope_directory == scope)
+        );
+    }
+    assert_eq!(
+        scan.entries
+            .iter()
+            .filter(|entry| entry.name == "tool")
+            .count(),
+        2
+    );
+    assert!(
+        scan.issues
+            .iter()
+            .any(|issue| issue.code == "project_scan_policy")
+    );
+}
+
+#[test]
+fn nested_directory_links_are_skipped_except_known_skill_locations() {
+    let mut fixture = Fixture::new();
+    let outside = fixture.root.path().join("outside");
+    write(outside.join("CLAUDE.md"), b"Outside instructions");
+    write(outside.join("SKILL.md"), b"Allowed linked skill");
+    let nested = fixture.project.path.join("packages/api");
+    fs::create_dir_all(nested.join(".claude/skills")).unwrap();
+    symlink(&outside, nested.join("escape")).unwrap();
+    symlink(&outside, nested.join(".claude/skills/linked")).unwrap();
+    symlink(outside.join("CLAUDE.md"), nested.join("CLAUDE.md")).unwrap();
+
+    let scan = fixture.service.discover(Some(&fixture.project)).unwrap();
+    assert_eq!(scan.entries.len(), 2);
+    assert!(
+        scan.entries
+            .iter()
+            .all(|entry| entry.scope_directory == "packages/api")
+    );
+    let linked = select(&scan, "/linked/SKILL.md", KnowledgeProvider::Claude);
+    let read = fixture.service.read(&linked).unwrap();
+    assert!(read.entry.via_symlink);
+    assert_eq!(read.content, "Allowed linked skill");
+    let leaf = select(&scan, "/CLAUDE.md", KnowledgeProvider::Claude);
+    assert_eq!(
+        fixture.service.read(&leaf).unwrap_err().code,
+        "knowledge_source_symlink"
+    );
+    assert!(
+        scan.issues
+            .iter()
+            .any(|issue| issue.code == "directory_symlink_skipped")
+    );
+}
+
+#[test]
+fn pinned_nested_scope_never_reopens_a_replacement_directory_link() {
+    let fixture = Fixture::new();
+    let nested = fixture.project.path.join("nested");
+    write(nested.join("CLAUDE.md"), b"Original pinned directory");
+    write(nested.join(".claude/CLAUDE.md"), b"Original pinned child");
+    let outside = fixture.root.path().join("outside");
+    write(outside.join("AGENTS.md"), b"OUTSIDE_SENTINEL");
+    write(
+        outside.join(".claude/rules/outside.md"),
+        b"OUTSIDE_SENTINEL",
+    );
+    let (root, _) = Directory::open_absolute(&fixture.project.path, true).unwrap();
+    let (pinned, _) = root.open_child(OsStr::new("nested"), false).unwrap();
+    fs::rename(&nested, fixture.root.path().join("moved")).unwrap();
+    symlink(&outside, &nested).unwrap();
+
+    let mut scanner = Scanner::new(KnowledgeScanId::new());
+    scanner.scan_project_scope(&pinned, &nested, Path::new("nested"), 1);
+    assert_eq!(scanner.response.entries.len(), 2);
+    assert!(
+        scanner
+            .response
+            .entries
+            .iter()
+            .all(|entry| entry.name == "CLAUDE.md")
+    );
+    assert!(
+        scanner
+            .saved
+            .values()
+            .all(|source| source.entry.provider == KnowledgeProvider::Claude)
+    );
+}
+
+#[test]
+fn nested_parent_replacement_invalidates_existing_read_capability() {
+    let mut fixture = Fixture::new();
+    let nested = fixture.project.path.join("packages/api");
+    write(nested.join("CLAUDE.md"), b"Original");
+    let scan = fixture.service.discover(Some(&fixture.project)).unwrap();
+    let request = select(&scan, "/api/CLAUDE.md", KnowledgeProvider::Claude);
+    fs::rename(&nested, fixture.root.path().join("moved")).unwrap();
+    write(nested.join("CLAUDE.md"), b"Replacement");
+    assert_eq!(
+        fixture.service.read(&request).unwrap_err().code,
+        "knowledge_source_changed"
+    );
+
+    let fresh = fixture.service.discover(Some(&fixture.project)).unwrap();
+    let read = fixture
+        .service
+        .read(&select(&fresh, "/api/CLAUDE.md", KnowledgeProvider::Claude))
+        .unwrap();
+    assert_eq!(read.content, "Replacement");
+    assert_eq!(read.entry.scope_directory, "packages/api");
+}
+
+#[test]
+fn depth_is_cumulative_across_project_rules_and_skill_directories() {
+    let mut fixture = Fixture::new();
+    let mut scopes = vec![fixture.project.path.clone()];
+    for depth in 1..=MAX_DEPTH + 1 {
+        scopes.push(scopes[depth - 1].join("nested"));
+    }
+    for (depth, path, content) in [
+        (16, "CLAUDE.md", "Allowed deepest scope"),
+        (17, "CLAUDE.md", "Beyond project depth"),
+        (14, ".claude/rules/allowed.md", "Allowed deepest rule"),
+        (14, ".claude/rules/group/denied.md", "Beyond rule depth"),
+        (
+            13,
+            ".claude/skills/allowed/SKILL.md",
+            "Allowed deepest skill",
+        ),
+        (14, ".claude/skills/denied/SKILL.md", "Beyond skill depth"),
+        (
+            12,
+            ".cursor/skills/group/allowed/SKILL.md",
+            "Allowed recursive skill",
+        ),
+        (
+            12,
+            ".cursor/skills/group/deeper/denied/SKILL.md",
+            "Beyond recursive depth",
+        ),
+    ] {
+        write(scopes[depth].join(path), content.as_bytes());
+    }
+    let scan = fixture.service.discover(Some(&fixture.project)).unwrap();
+    assert!(scan.truncated);
+    assert!(scan.issues.iter().any(|issue| issue.code == "depth_limit"));
+    assert_eq!(scan.entries.len(), 4);
+    for entry in &scan.entries {
+        let read = fixture
+            .service
+            .read(&KnowledgeReadRequest {
+                scan_id: scan.scan_id,
+                entry_id: entry.entry_id,
+            })
+            .unwrap();
+        assert!(read.content.starts_with("Allowed"));
+    }
+}
+
+#[test]
+fn enumeration_budget_is_shared_and_keeps_already_collected_scope_candidates() {
+    let fixture = Fixture::new();
+    for name in ["first", "second"] {
+        write(
+            fixture.project.path.join(name).join("CLAUDE.md"),
+            b"Collected scope",
+        );
+        write(
+            fixture.project.path.join(name).join("deeper/CLAUDE.md"),
+            b"Not enumerated",
+        );
+    }
+    write(fixture.home().join(".codex/AGENTS.md"), b"Global");
+    let mut scanner = Scanner::new(KnowledgeScanId::new());
+    scanner.remaining_nodes = 2;
+    scanner.scan_inventory(&fixture.service.roots, Some(&fixture.project));
+    assert_eq!(scanner.remaining_nodes, 0);
+    assert!(scanner.response.truncated);
+    assert_eq!(scanner.response.entries.len(), 3);
+    assert_eq!(
+        scanner.response.entries[0].scope,
+        KnowledgeSourceScope::Global
+    );
+    assert!(
+        scanner.response.entries[1..]
+            .iter()
+            .all(|entry| { matches!(entry.scope_directory.as_str(), "first" | "second") })
+    );
+    assert!(
+        scanner
+            .response
+            .issues
+            .iter()
+            .any(|issue| issue.code == "scan_limit")
+    );
+}
+
+#[test]
+fn root_and_globals_precede_descendants_under_the_shared_entry_limit() {
+    let mut fixture = Fixture::new();
+    write(fixture.project.path.join("CLAUDE.md"), b"Root");
+    write(fixture.home().join(".codex/AGENTS.md"), b"Global");
+    for index in 0..MAX_ENTRIES + 4 {
+        write(
+            fixture
+                .project
+                .path
+                .join(format!("scopes/scope-{index:04}/CLAUDE.md")),
+            b"Nested",
+        );
+    }
+    let scan = fixture.service.discover(Some(&fixture.project)).unwrap();
+    assert_eq!(scan.entries.len(), MAX_ENTRIES);
+    assert!(scan.truncated);
+    assert_eq!(scan.entries[0].scope_directory, ".");
+    assert_eq!(scan.entries[1].scope, KnowledgeSourceScope::Global);
+    assert!(
+        scan.entries[2..]
+            .iter()
+            .all(|entry| entry.scope_directory.starts_with("scopes/"))
+    );
+    assert!(serde_json::to_vec(&scan).unwrap().len() < 512 * 1_024);
+}
+
+#[test]
+fn subtree_inventory_does_not_infer_ancestors_or_walk_the_global_home() {
+    let mut fixture = Fixture::new();
+    write(
+        fixture.root.path().join("CLAUDE.md"),
+        b"Ancestor is outside this inventory",
+    );
+    write(
+        fixture.home().join("arbitrary/CLAUDE.md"),
+        b"Home is not a project subtree",
+    );
+    write(fixture.home().join(".claude/CLAUDE.md"), b"Known global");
+    write(
+        fixture.project.path.join("nested/CLAUDE.md"),
+        b"Nested project",
+    );
+    let globals = fixture.service.discover(None).unwrap();
+    assert_eq!(globals.entries.len(), 1);
+    assert_eq!(globals.entries[0].scope, KnowledgeSourceScope::Global);
+    let project = fixture.service.discover(Some(&fixture.project)).unwrap();
+    assert_eq!(project.entries.len(), 2);
+    assert!(project.issues.iter().any(|issue| {
+        issue.code == "project_subtree_scope" && issue.message.contains("ancestors")
+    }));
+    assert!(
+        project
+            .entries
+            .iter()
+            .any(|entry| entry.scope_directory == "nested")
+    );
+}
diff --git a/crates/daemon/src/knowledge/discovery/tests.rs b/crates/daemon/src/knowledge/discovery/tests.rs
index 74a14fd..e5cf82a 100644
--- a/crates/daemon/src/knowledge/discovery/tests.rs
+++ b/crates/daemon/src/knowledge/discovery/tests.rs
@@ -5,6 +5,9 @@ use tempfile::TempDir;
 
 use super::*;
 
+#[path = "project_tests.rs"]
+mod project_tests;
+
 struct Fixture {
     root: TempDir,
     project: Project,
@@ -89,7 +92,6 @@ fn discovers_exact_provider_locations_without_configs_or_imports() {
         ".env",
         ".claude/settings.json",
         ".codex/auth.json",
-        "nested/AGENTS.md",
     ] {
         write(fixture.project.path.join(path), b"PRIVATE_CONFIG_SENTINEL");
     }
@@ -105,7 +107,7 @@ fn discovers_exact_provider_locations_without_configs_or_imports() {
     assert!(
         scan.issues
             .iter()
-            .any(|issue| issue.code == "project_root_scope")
+            .any(|issue| issue.code == "project_subtree_scope")
     );
     assert_eq!(
         fixture.service.scan_project_id(scan.scan_id).unwrap(),
@@ -449,6 +451,7 @@ fn enumeration_limit_preserves_candidates_already_collected() {
         scanner.remaining_nodes = 2;
         scanner.scan_source(&SourceSpec {
             base: fixture.project.path.clone(),
+            scope_directory: ".".to_owned(),
             directory,
             provider,
             scope: KnowledgeSourceScope::Project,
diff --git a/crates/daemon/src/knowledge/socket_tests.rs b/crates/daemon/src/knowledge/socket_tests.rs
index a456d2c..d80b200 100644
--- a/crates/daemon/src/knowledge/socket_tests.rs
+++ b/crates/daemon/src/knowledge/socket_tests.rs
@@ -208,6 +208,100 @@ async fn discovery_and_explicit_read_use_scoped_capabilities_without_session_eff
     assert_scan_expired_after_restart(root.path(), &global).await;
 }
 
+#[tokio::test]
+async fn nested_sources_keep_their_scope_and_reject_replaced_parent_directories() {
+    let root = TempDir::new().unwrap();
+    write(root.path(), "project/AGENTS.md", "Root instructions");
+    write(
+        root.path(),
+        "project/packages/api service/AGENTS.md",
+        "Nested private instructions",
+    );
+    write(
+        root.path(),
+        "project/packages/api service/.claude/skills/review/SKILL.md",
+        "Review this package only.",
+    );
+    write(
+        root.path(),
+        "project/node_modules/dependency/AGENTS.md",
+        "Excluded dependency instructions",
+    );
+    let daemon = Running::start(root.path());
+    let mut client = daemon.connect().await;
+    let project = success(
+        &mut client,
+        "project.add",
+        json!({"path":root.path().join("project")}),
+    )
+    .await;
+    let scan = success(
+        &mut client,
+        "knowledge.discover",
+        json!({"projectId":project["id"]}),
+    )
+    .await;
+    assert_eq!(scan["truncated"], false);
+    let serialized = serde_json::to_string(&scan).unwrap();
+    assert!(!serialized.contains("Nested private instructions"));
+    assert!(!serialized.contains("node_modules/dependency"));
+    assert_eq!(source(&scan, "project/AGENTS.md")["scopeDirectory"], ".");
+    let nested = source(&scan, "packages/api service/AGENTS.md");
+    assert_eq!(nested["scope"], "project");
+    assert_eq!(nested["scopeDirectory"], "packages/api service");
+    let skill = source(&scan, "api service/.claude/skills/review/SKILL.md");
+    assert_eq!(skill["scopeDirectory"], "packages/api service");
+    let read = success(
+        &mut client,
+        "knowledge.read",
+        json!({"scanId":scan["scanId"],"entryId":nested["entryId"]}),
+    )
+    .await;
+    assert_eq!(read["entry"], nested);
+    assert_eq!(read["content"], "Nested private instructions");
+
+    // Keep the old directory alive so inode reuse cannot make replacement
+    // indistinguishable from the captured directory capability.
+    fs::rename(
+        root.path().join("project/packages/api service"),
+        root.path().join("original-package"),
+    )
+    .unwrap();
+    write(
+        root.path(),
+        "project/packages/api service/AGENTS.md",
+        "Replacement instructions",
+    );
+    assert_eq!(
+        error_code(
+            exchange(
+                &mut client,
+                "knowledge.read",
+                json!({"scanId":scan["scanId"],"entryId":nested["entryId"]}),
+            )
+            .await
+        ),
+        "knowledge_source_changed"
+    );
+    let refreshed = success(
+        &mut client,
+        "knowledge.discover",
+        json!({"projectId":project["id"]}),
+    )
+    .await;
+    let replacement = source(&refreshed, "packages/api service/AGENTS.md");
+    let reread = success(
+        &mut client,
+        "knowledge.read",
+        json!({"scanId":refreshed["scanId"],"entryId":replacement["entryId"]}),
+    )
+    .await;
+    assert_eq!(reread["content"], "Replacement instructions");
+    assert_eq!(replacement["scopeDirectory"], "packages/api service");
+    drop(client);
+    daemon.stop().await;
+}
+
 async fn assert_scan_expired_after_restart(root: &Path, global: &Value) {
     let daemon = Running::start(root);
     let mut client = daemon.connect().await;
diff --git a/docs/codex/xirp-context-report.md b/docs/codex/xirp-context-report.md
index f758028..855377a 100644
--- a/docs/codex/xirp-context-report.md
+++ b/docs/codex/xirp-context-report.md
@@ -221,3 +221,39 @@ backend suite or native/Linux acceptance. No test assertion was weakened.
 Canvas library insertion now has real host consumption as an explicit editable
 text snapshot; it does not implicitly send/start or retain a live source link.
 Discovery inspector and organization mounting/filtering remain S1 follow-ups.
+
+## Cross-platform reconciliation evidence
+
+At published `41f679c`, [CI Linux/macOS](https://github.com/guicybercode/Jig/actions/runs/34005300527)
+and [Packaging Linux/macOS](https://github.com/guicybercode/Jig/actions/runs/34005300530)
+passed. Both CI jobs ran frontend checks, Chromium E2E, formatting, Clippy,
+workspace Rust tests and documentation. This covers the already published
+knowledge/discovery/organization implementation and the reconciled composer.
+It does not cover subsequent uncommitted nested discovery, native interactive
+acceptance, or prove the independently reproduced process-cache race absent.
+S1's inspector mounting is separately published in `9329d01`; its merge into
+this branch follows the isolated nested scanner increment.
+
+## Nested project source discovery
+
+The existing scanner now inventories supported rule/skill locations in the
+registered project's descendants. Root sources precede globals/admin sources,
+which precede nested traversal. Relative scope identifies each configuration
+owner, including names containing spaces. Ordinary directory links are skipped;
+known skill links retain the existing captured-target semantics. Exact provider,
+VCS and dependency pruning is visible, and all phases share response, entry,
+node and cumulative directory-depth limits. No IPC fields, methods, migration,
+Git operation or file-service adapter changed.
+
+Validation on macOS: all **31 knowledge daemon tests** pass, including **9 new
+scanner regressions and 1 new real-socket regression**. Tests cover nested
+formats/provider identity, exact pruning, root/global priority, cumulative
+depth, shared enumeration limits, pinned-directory replacement races and old
+capability rejection after replacing a nested parent. Existing safe-reader and
+scan-expiry tests remain green. All-target daemon Clippy, formatting and diff
+checks pass. Independent review found no remaining concrete defect.
+
+Sources above the registered project and effective session-cwd ancestry remain
+unevaluated. Native activation, editing and bundled/plugin sources remain open
+as described in the discovery contract. Earlier cross-platform results at
+`41f679c` are not evidence for this new scanner increment; its CI follows push.
diff --git a/docs/codex/xirp-discovery-contract.md b/docs/codex/xirp-discovery-contract.md
index f1e920c..faefb57 100644
--- a/docs/codex/xirp-discovery-contract.md
+++ b/docs/codex/xirp-discovery-contract.md
@@ -20,8 +20,11 @@ Methods:
   specific safe errors; refresh obtains a new scan.
 
 Inventory limits: four scans cached for five minutes, 512 candidates, 10,000
-visited filesystem entries, depth 16. The selected project is inventoried before
-globals. Entry JSON is capped at 448 KiB; at most 32 issues use up to 32 KiB. Read limit: 64 KiB; JSON envelope remains
+enumerated filesystem entries, depth 16. Sources at the selected project root
+are inventoried first, then global/admin sources, then project descendants.
+This keeps a large descendant tree from starving known global roots; all phases
+share the same bounds. Fixed allowlisted metadata probes add bounded work per
+visited project directory; the entry budget is not a literal syscall count. Entry JSON is capped at 448 KiB; at most 32 issues use up to 32 KiB. Read limit: 64 KiB; JSON envelope remains
 under 1 MiB even for worst-case escaping. Truncation/issues must remain visible.
 No content enters logs, Debug, error details, SQLite or telemetry.
 
@@ -44,11 +47,27 @@ A fresh scan follows the new target. Source replacement/content edits conflict;
 daemon restart, cache eviction and five-minute expiry invalidate scans.
 Removing the registered project invalidates reads from its scan.
 
-This increment inventories root configuration locations and recursively grouped
-rules/skills within those locations. It does not walk every project subfolder,
-evaluate session-cwd ancestors, import rules, parse activation conditions, read
-native overrides, or enumerate bundled/plugin sources. These limits are visible
-as inventory issues and remain open parity work, not claims of native loading.
+The project inventory includes supported configuration locations in nested
+project directories. `scopeDirectory` is relative to the registered project:
+`.` identifies its root and `packages/api` identifies a nested configuration
+owner. Grouped rules and skills retain their owning directory's scope. Paths
+are display metadata; reads still require the existing opaque capabilities.
+
+General project traversal opens children relative to pinned directory
+descriptors and never follows ordinary directory symlinks. Exact directory
+names `.git`, `node_modules`, `vendor`, `.venv` and `venv` are pruned, as are
+`.agents`, `.claude`, `.cursor` and `.codex`. Allowlisted rules/skills in the
+first three already have dedicated walkers; `.codex` is not a documented
+project-scoped source location. Explicit global CODEX_HOME sources still work. Pruning does not exclude an explicitly registered project
+root with one of those names. Build directories with other names and nested
+repositories remain inside the bounded inventory; `.gitignore` is not parsed.
+The pruning policy and scan limitations are visible as issues.
+
+The depth limit includes the project-relative path and provider configuration
+directories; entering a rule/skill root does not restart that budget. Sources
+above the registered project, effective session-cwd ancestry, imports,
+activation conditions, native overrides and bundled/plugin sources remain
+unevaluated. Inventory does not prove which CLI loaded a source.
 
 No native credential/config files, support scripts, imports, or transcript
 files are read. Editing waits for S2's common file contract. Root will publish
@@ -59,5 +78,5 @@ composition change and existing generic transport.
 S1: isolated `KnowledgeSourceInspector` receives client, optional currentProject
 and optional connectionKey (daemon instance or reconnect generation), with
 refresh/list/preview. Pass the connection key to invalidate scans on reconnect. Keep it inside the canvas surface.
-The current library also needs a host-controlled editable composer draft;
-S1's existing terminal-card draft is configuration, not prompt text.
+S1 has mounted the saved library and an editable prompt composer in `1150de6`;
+source inspection is a separate read-only panel and never inserts or sends text.
diff --git a/docs/xirp-local-parity.md b/docs/xirp-local-parity.md
index 9655086..b96a2f7 100644
--- a/docs/xirp-local-parity.md
+++ b/docs/xirp-local-parity.md
@@ -13,9 +13,9 @@ added to this implementation's scope.
 | X03 | Resume/fork, agent switch preserving supported history, linked shell. [Sessions](https://backstage.spotify.com/docs/xirp/sessions), [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S2 adapters/runtime, S1 canvas | Current adapter capabilities do not expose verified conversation IDs, fork or usage. Await trusted native contracts and runtime integration. Local context reuse is a separate feature. |
 | X04 | Working/idle/needs-input attention separate from process lifecycle. [Sessions](https://backstage.spotify.com/docs/xirp/sessions) | S2 event source, S3 indicators, S1 canvas | PTY silence is not proof of approval/input need. Explicit hooks or native signals required. |
 | X05 | Local preferences, shortcuts, supported native settings, diagnostics. [Settings](https://backstage.spotify.com/docs/xirp/settings) | S2 settings/runtime, S3 rules/skills, S1 UI | Existing diagnostics/custom-agent creation are baseline only; do not expose unsupported options. Credentials excluded from editors. |
-| X06 | Global/project rules and skills, including symlinked skill directories. [Projects](https://backstage.spotify.com/docs/xirp/projects), [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S3 discovery, S2 file boundary | Known root/global/admin locations now have bounded metadata discovery and explicit UTF-8 reads, with origins/scopes/precedence caveats and skill-link target capture (`4a367d0`). Socket, core and isolated inspector tests pass on macOS. Nested project/session ancestry, native activation, source editing, S1 mounting and Linux evidence remain open. |
-| X07a | Saved global/project prompts, searchable picker and insertion. [Changelog v0.19.1](https://backstage.spotify.com/docs/xirp/changelog) | S3 knowledge, S2 shared registration, S1 canvas insertion | Persisted CRUD and paginated search verified through real SQLite and daemon socket; isolated panel CRUD/draft tests and responsive Chromium preview passed; canvas library/composer insertion is integrated through S1 `1150de6` and passes Chromium E2E; current Linux evidence pending. See S3 report. |
-| X07b | Session archive and workflow: backlog/in_progress/in_review/blocked/done. [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S3 organization modules/controls, S2 contract review, S1 filtering | Workflow and pin/archive persist separately from lifecycle (`fce3982`); real live-process socket test and isolated controls pass. Canvas filtering/mounting remains pending. Session pin is a user-requested extension. |
+| X06 | Global/project rules and skills, including symlinked skill directories. [Projects](https://backstage.spotify.com/docs/xirp/projects), [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S3 discovery, S2 file boundary | Known root/global/admin locations now have bounded metadata discovery and explicit UTF-8 reads, with origins/scopes/precedence caveats and skill-link target capture (`4a367d0`). Socket, core and isolated inspector checks pass in Linux/macOS CI at `41f679c`. S1 mounted the inspector in `9329d01`; reconciliation follows. Nested project subtree inventory now passes 31 focused macOS daemon tests, including scope/limit/replacement regressions; its new CI is pending. Sources above the registered project, session-cwd ancestry, native activation and source editing remain open. |
+| X07a | Saved global/project prompts, searchable picker and insertion. [Changelog v0.19.1](https://backstage.spotify.com/docs/xirp/changelog) | S3 knowledge, S2 shared registration, S1 canvas insertion | Persisted CRUD and paginated search verified through real SQLite and daemon socket; isolated panel CRUD/draft tests and responsive Chromium preview passed; canvas library/composer insertion is integrated through S1 `1150de6` and passes Chromium E2E; Linux/macOS CI and Packaging pass at `41f679c`. See S3 report. |
+| X07b | Session archive and workflow: backlog/in_progress/in_review/blocked/done. [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S3 organization modules/controls, S2 contract review, S1 filtering | Workflow and pin/archive persist separately from lifecycle (`fce3982`); real live-process socket tests and isolated controls pass in Linux/macOS CI at `41f679c`. Canvas filtering/mounting remains pending. Session pin is a user-requested extension. |
 | X07c | Tokens/spend per session/day. [Changelog v0.18.0](https://backstage.spotify.com/docs/xirp/changelog) | S2 verified native data, S3 presentation | Source documents feature existence, not a collector/format/pricing algorithm. Currently unavailable, not zero. No proxy or PTY-based estimates. |
 | X07d | PR review, Doctor, cleanup. [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S2 runtime/Git, S1 UI | Existing Git status/diagnostics/removal-token safety are baseline; review and expanded cleanup require their real contracts. |
 | X08 | Agent-specific options, including Cursor. [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S2 adapter registry, S1 UI | No flags invented from agent display name; support requires installed-version tests and authoritative CLI sources. |

From 955d958240c0b1adbe3d2ec50ab79360e0ef2dde Mon Sep 17 00:00:00 2001
From: guicybercode <euguigom@gmail.com>
Date: Sat, 5 Sep 2026 23:14:02 -0300
Subject: [PATCH 23/23] docs(xirp): record integrated source inspection and
 runtime review patch

---
 .../proposals/pty-process-cache-ordering.md   |  65 ++++
 .../pty-process-cache-ordering.patch          | 324 ++++++++++++++++++
 docs/codex/xirp-context-report.md             |  22 ++
 docs/desktop/knowledge-sources.md             |  23 +-
 docs/xirp-local-parity.md                     |   2 +-
 5 files changed, 428 insertions(+), 8 deletions(-)
 create mode 100644 docs/codex/proposals/pty-process-cache-ordering.md
 create mode 100644 docs/codex/proposals/pty-process-cache-ordering.patch

diff --git a/docs/codex/proposals/pty-process-cache-ordering.md b/docs/codex/proposals/pty-process-cache-ordering.md
new file mode 100644
index 0000000..f7a4e4a
--- /dev/null
+++ b/docs/codex/proposals/pty-process-cache-ordering.md
@@ -0,0 +1,65 @@
+# PTY process snapshot ordering proposal
+
+Prepared for S2 review on 2026-09-05. The adjacent patch changes only
+`crates/session/src/runtime/process_tree.rs`; it has **not** been applied to
+the runtime. No session or process lifecycle test was weakened.
+
+Concurrent process scans can publish in completion order instead of observation
+order. A late snapshot taken before a session started can permanently prune its
+live root from `ProcessTree::known`. Subsequent fresh scans cannot reconstruct
+ancestry after that identity has been discarded. A temporary harness reproduced
+this against the unchanged source. The earlier manager-drop test left a live
+orphaned shell, but its precise execution was not traced; attribution to this
+race remains unconfirmed.
+
+The proposal records scan start and completion times. Cache publication never
+replaces a later-started scan with an earlier-started one. Each process tree
+accepts cached scans only if collection began after its previous applied scan
+finished. The completion boundary also rejects overlapping scans, whose records
+need not be atomic or observed in start order. Rejected cache entries trigger a
+fresh scan using the remaining original timeout. Collection remains outside the
+cache mutex; PID birth, ancestry, zombie and tracking-limit checks are retained.
+
+The strict boundary also rejects reusing the exact snapshot already applied
+to that tree, so more refreshes may collect a new OS snapshot. Collection
+complexity remains the existing process-snapshot cost; no new per-process scan
+is added. S2 should assess cache hit rate and supervisor CPU with many sessions
+as part of integration; accepting the same proven snapshot could be a separate
+optimization with an unambiguous snapshot identity.
+
+## Validation
+
+The patch applied to a temporary copy with `patch -p1`; `git apply --check`
+also passed against the current source. The actual runtime file was compared
+byte-for-byte afterward and remained unchanged. Temporary sources and binaries
+were removed. No PTY sessions or native agent processes were started for these
+checks.
+
+On macOS, a standalone module included the patched file and linked the already
+compiled `nix` and `parking_lot` dependencies from `target/debug/deps`:
+
+- `rustfmt --edition 2024`: passed.
+- `rustc --edition=2024 --test -D warnings` and the resulting test binary:
+  **11 passed**, zero failures; seven new tests and four existing tests.
+- `clippy-driver` with the same compile arguments, `-W clippy::all` and
+  `-W clippy::pedantic`: passed with warnings denied.
+- A temporary mutation replacing the completion boundary with scan start
+  failed the overlap regression as expected: only one of two proven processes
+  remained. The mutation was discarded.
+
+New tests cover delayed pre-spawn cache publication, previously observed
+descendants that escape/reparent, overlapping observations, monotonic cache
+publication, current cached absence, forced lifecycle scans, and exhaustion of
+the original timeout. Existing tests retain PID-reuse, zombie, ancestry, and
+Linux stat-parser coverage. Cache tests use private local caches and synthetic
+records, avoiding shared global-cache interference.
+
+This validates the module proposal, not full runtime integration. After S2
+applies it, run the session crate tests and lifecycle acceptance on Linux and
+macOS, with bounded repetition of the previously failing manager-drop test.
+
+Source SHA-256 before applying:
+`0d19016919fc39d0bf7ff121ecb5e92dd27bd15f6e839a51c8aa854e1e71d7f7`.
+
+Validated patched-source SHA-256:
+`1b7a551a8c63f8f74e472b87f0e48c9efd17f9677e4ccde080c25b95ed0c89a0`.
diff --git a/docs/codex/proposals/pty-process-cache-ordering.patch b/docs/codex/proposals/pty-process-cache-ordering.patch
new file mode 100644
index 0000000..12b60c0
--- /dev/null
+++ b/docs/codex/proposals/pty-process-cache-ordering.patch
@@ -0,0 +1,324 @@
+--- a/crates/session/src/runtime/process_tree.rs
++++ b/crates/session/src/runtime/process_tree.rs
+@@ -12,6 +12,7 @@
+ 
+ #[derive(Clone)]
+ struct CachedSnapshot {
++    scan_started_at: Instant,
+     captured_at: Instant,
+     records: Arc<[ProcessRecord]>,
+ }
+@@ -40,6 +41,7 @@
+ 
+ pub(super) struct ProcessTree {
+     known: BTreeMap<i32, ProcessIdentity>,
++    last_snapshot_completed_at: Instant,
+     scan_timeout: Duration,
+     max_tracked_processes: usize,
+ }
+@@ -50,10 +52,11 @@
+         scan_timeout: Duration,
+         max_tracked_processes: usize,
+     ) -> io::Result<Self> {
+-        let records = process_snapshot(scan_timeout, true)?;
++        let records = process_snapshot(scan_timeout, true, None)?;
+         let root_pid = root_pid.as_raw();
+         let mut tree = Self {
+             known: BTreeMap::new(),
++            last_snapshot_completed_at: records.captured_at,
+             scan_timeout,
+             max_tracked_processes,
+         };
+@@ -69,12 +72,25 @@
+     }
+ 
+     pub fn refresh(&mut self) -> io::Result<Vec<TrackedProcess>> {
+-        let snapshot = process_snapshot(self.scan_timeout, false)?;
+-        self.absorb(&snapshot.records)
++        let snapshot = process_snapshot(
++            self.scan_timeout,
++            false,
++            Some(self.last_snapshot_completed_at),
++        )?;
++        self.absorb_snapshot(&snapshot)
+     }
+ 
+     pub fn refresh_fresh(&mut self) -> io::Result<Vec<TrackedProcess>> {
+-        let snapshot = process_snapshot(self.scan_timeout, true)?;
++        let snapshot = process_snapshot(self.scan_timeout, true, None)?;
++        self.absorb_snapshot(&snapshot)
++    }
++
++    fn absorb_snapshot(&mut self, snapshot: &CachedSnapshot) -> io::Result<Vec<TrackedProcess>> {
++        // Scans are not atomic: even a later-started overlapping scan can
++        // contain older observations. Accept cached scans only when they began
++        // after the snapshot already absorbed here finished collecting records.
++        // Advance this bound before absorb, which may mutate then fail on limits.
++        self.last_snapshot_completed_at = snapshot.captured_at;
+         self.absorb(&snapshot.records)
+     }
+ 
+@@ -144,15 +160,30 @@
+     fn with_root_for_test(root: ProcessRecord, max_tracked_processes: usize) -> Self {
+         Self {
+             known: BTreeMap::from([(root.identity.pid, root.identity)]),
++            last_snapshot_completed_at: Instant::now(),
+             scan_timeout: Duration::from_secs(1),
+             max_tracked_processes,
+         }
+     }
+ }
+ 
+-fn process_snapshot(timeout: Duration, force: bool) -> io::Result<CachedSnapshot> {
++fn process_snapshot(
++    timeout: Duration,
++    force: bool,
++    not_before: Option<Instant>,
++) -> io::Result<CachedSnapshot> {
++    let cache = PROCESS_SNAPSHOT_CACHE.get_or_init(|| Mutex::new(None));
++    process_snapshot_with(timeout, force, not_before, cache, scan_processes_uncached)
++}
++
++fn process_snapshot_with(
++    timeout: Duration,
++    force: bool,
++    not_before: Option<Instant>,
++    cache: &Mutex<Option<CachedSnapshot>>,
++    scan: impl FnOnce(Duration) -> io::Result<Vec<ProcessRecord>>,
++) -> io::Result<CachedSnapshot> {
+     let started = Instant::now();
+-    let cache = PROCESS_SNAPSHOT_CACHE.get_or_init(|| Mutex::new(None));
+     if !force {
+         let Some(cached) = cache.try_lock_for(timeout) else {
+             return Err(io::Error::new(
+@@ -160,10 +191,11 @@
+                 "process-tree snapshot cache lock exceeded its deadline",
+             ));
+         };
+-        if let Some(snapshot) = cached.as_ref() {
+-            if snapshot.captured_at.elapsed() <= SNAPSHOT_CACHE_TTL {
+-                return Ok(snapshot.clone());
+-            }
++        if let Some(snapshot) = cached.as_ref().filter(|snapshot| {
++            snapshot.captured_at.elapsed() <= SNAPSHOT_CACHE_TTL
++                && not_before.is_none_or(|minimum| snapshot.scan_started_at >= minimum)
++        }) {
++            return Ok(snapshot.clone());
+         }
+     }
+     let remaining = timeout.saturating_sub(started.elapsed());
+@@ -173,8 +205,10 @@
+             "process-tree snapshot exceeded its deadline",
+         ));
+     }
+-    let records = Arc::from(scan_processes_uncached(remaining)?);
++    let scan_started_at = Instant::now();
++    let records = Arc::from(scan(remaining)?);
+     let snapshot = CachedSnapshot {
++        scan_started_at,
+         captured_at: Instant::now(),
+         records,
+     };
+@@ -184,9 +218,20 @@
+     // itself is already complete and identity-checked.
+     let remaining = timeout.saturating_sub(started.elapsed());
+     if let Some(mut cache) = cache.try_lock_for(remaining) {
++        publish_snapshot(&mut cache, &snapshot);
++    }
++    Ok(snapshot)
++}
++
++fn publish_snapshot(cache: &mut Option<CachedSnapshot>, snapshot: &CachedSnapshot) {
++    // Concurrent scans can finish in a different order than they started.
++    // Completion time is useful for TTL, but cannot order their observations.
++    if cache
++        .as_ref()
++        .is_none_or(|current| snapshot.scan_started_at >= current.scan_started_at)
++    {
+         *cache = Some(snapshot.clone());
+     }
+-    Ok(snapshot)
+ }
+ 
+ #[cfg(target_os = "linux")]
+@@ -365,6 +410,180 @@
+         }
+     }
+ 
++    fn snapshot(scan_started_at: Instant, records: Vec<ProcessRecord>) -> CachedSnapshot {
++        CachedSnapshot {
++            scan_started_at,
++            captured_at: Instant::now(),
++            records: Arc::from(records),
++        }
++    }
++
++    #[test]
++    fn delayed_pre_spawn_cache_cannot_prune_a_new_live_root() {
++        let root = record(100, 1, 100, "root");
++        let mut tree = ProcessTree::with_root_for_test(root.clone(), 8);
++        let older = tree
++            .last_snapshot_completed_at
++            .checked_sub(Duration::from_millis(1))
++            .unwrap();
++        let cache = Mutex::new(Some(snapshot(older, Vec::new())));
++        let refreshed = process_snapshot_with(
++            tree.scan_timeout,
++            false,
++            Some(tree.last_snapshot_completed_at),
++            &cache,
++            |_| {
++                assert!(
++                    cache.try_lock().is_some(),
++                    "scan must not hold the cache lock"
++                );
++                Ok(vec![root])
++            },
++        )
++        .expect("an old cached scan should cause a fresh scan");
++
++        let tracked = tree.absorb_snapshot(&refreshed).unwrap();
++
++        assert_eq!(tracked.len(), 1);
++        assert_eq!(tracked[0].pid, Pid::from_raw(100));
++        assert!(tree.known.contains_key(&100));
++    }
++
++    #[test]
++    fn cached_snapshot_before_a_new_descendant_does_not_forget_its_identity() {
++        let root = record(100, 1, 100, "root");
++        let child = record(101, 100, 101, "child");
++        let mut tree = ProcessTree::with_root_for_test(root.clone(), 8);
++        let now = Instant::now();
++        let initial = snapshot(
++            now.checked_sub(Duration::from_millis(2)).unwrap(),
++            vec![root.clone()],
++        );
++        let observed = snapshot(
++            now.checked_sub(Duration::from_millis(1)).unwrap(),
++            vec![root.clone(), child.clone()],
++        );
++        let observed_completed_at = observed.captured_at;
++        tree.absorb_snapshot(&observed).unwrap();
++        assert_eq!(tree.last_snapshot_completed_at, observed_completed_at);
++        let cache = Mutex::new(Some(initial));
++        // The descendant has since escaped and been reparented. Losing its
++        // previously proven birth identity would make recovery impossible.
++        let escaped = record(101, 1, 101, "child");
++        let refreshed = process_snapshot_with(
++            tree.scan_timeout,
++            false,
++            Some(tree.last_snapshot_completed_at),
++            &cache,
++            |_| Ok(vec![root, escaped]),
++        )
++        .unwrap();
++
++        let tracked = tree.absorb_snapshot(&refreshed).unwrap();
++
++        assert_eq!(tracked.len(), 2);
++        assert!(tree.known.contains_key(&child.identity.pid));
++    }
++
++    #[test]
++    fn overlapping_later_started_cache_cannot_forget_an_observed_descendant() {
++        let root = record(100, 1, 100, "root");
++        let child = record(101, 100, 101, "child");
++        let now = Instant::now();
++        let mut tree = ProcessTree::with_root_for_test(root.clone(), 8);
++        let observed = CachedSnapshot {
++            scan_started_at: now.checked_sub(Duration::from_millis(2)).unwrap(),
++            captured_at: now,
++            records: Arc::from(vec![root.clone(), child]),
++        };
++        tree.absorb_snapshot(&observed).unwrap();
++        // B started after A, but read the process list before A observed this
++        // child. B finished late; completion and start order alone are unsafe.
++        let overlapping = snapshot(
++            now.checked_sub(Duration::from_millis(1)).unwrap(),
++            vec![root.clone()],
++        );
++        let cache = Mutex::new(Some(overlapping));
++        let refreshed = process_snapshot_with(
++            tree.scan_timeout,
++            false,
++            Some(tree.last_snapshot_completed_at),
++            &cache,
++            |_| Ok(vec![root, record(101, 1, 101, "child")]),
++        )
++        .unwrap();
++
++        let tracked = tree.absorb_snapshot(&refreshed).unwrap();
++
++        assert_eq!(tracked.len(), 2);
++        assert!(tree.known.contains_key(&101));
++    }
++
++    #[test]
++    fn late_publication_cannot_replace_a_scan_started_later() {
++        let now = Instant::now();
++        let newer = snapshot(now, vec![record(100, 1, 100, "root")]);
++        let older = snapshot(
++            now.checked_sub(Duration::from_millis(1)).unwrap(),
++            Vec::new(),
++        );
++        let mut cache = Some(newer);
++
++        publish_snapshot(&mut cache, &older);
++
++        let retained = cache.unwrap();
++        assert_eq!(retained.scan_started_at, now);
++        assert_eq!(retained.records.len(), 1);
++    }
++
++    #[test]
++    fn current_cached_absence_still_prunes_a_terminated_identity() {
++        let root = record(100, 1, 100, "root");
++        let mut tree = ProcessTree::with_root_for_test(root, 8);
++        let cache = Mutex::new(Some(snapshot(Instant::now(), Vec::new())));
++        let refreshed = process_snapshot_with(
++            tree.scan_timeout,
++            false,
++            Some(tree.last_snapshot_completed_at),
++            &cache,
++            |_| panic!("a current cached snapshot should not need another scan"),
++        )
++        .unwrap();
++
++        assert!(tree.absorb_snapshot(&refreshed).unwrap().is_empty());
++        assert!(tree.known.is_empty());
++    }
++
++    #[test]
++    fn forced_lifecycle_scan_bypasses_an_eligible_cached_snapshot() {
++        let now = Instant::now();
++        let cache = Mutex::new(Some(snapshot(now, Vec::new())));
++        let refreshed =
++            process_snapshot_with(Duration::from_secs(1), true, Some(now), &cache, |_| {
++                Ok(vec![record(100, 1, 100, "root")])
++            })
++            .unwrap();
++
++        assert_eq!(refreshed.records.len(), 1);
++    }
++
++    #[test]
++    fn rejected_cache_does_not_restart_an_exhausted_scan_budget() {
++        let now = Instant::now();
++        let cache = Mutex::new(Some(snapshot(
++            now.checked_sub(Duration::from_millis(1)).unwrap(),
++            Vec::new(),
++        )));
++        let result = process_snapshot_with(Duration::ZERO, false, Some(now), &cache, |_| {
++            panic!("an exhausted original budget must not start a scan")
++        });
++
++        let Err(error) = result else {
++            panic!("an old cache cannot satisfy an exhausted request");
++        };
++        assert_eq!(error.kind(), io::ErrorKind::TimedOut);
++    }
++
+     #[test]
+     fn only_proven_descendants_are_retained_across_group_changes() {
+         let root = record(100, 1, 100, "root");
diff --git a/docs/codex/xirp-context-report.md b/docs/codex/xirp-context-report.md
index 855377a..b26fe51 100644
--- a/docs/codex/xirp-context-report.md
+++ b/docs/codex/xirp-context-report.md
@@ -257,3 +257,25 @@ Sources above the registered project and effective session-cwd ancestry remain
 unevaluated. Native activation, editing and bundled/plugin sources remain open
 as described in the discovery contract. Earlier cross-platform results at
 `41f679c` are not evidence for this new scanner increment; its CI follows push.
+
+## Integrated source inspector
+
+Nested source discovery is published in `8f5ff86`. Merge `a76edd7` reconciles
+S1 through `35558c2`, including inspector mounting `9329d01`; source inspection
+is now available alongside the saved library in the canvas. The existing
+source component and decoder already render/search project-relative scopes.
+
+Combined frontend validation on macOS: **300 tests across 30 files**, TypeScript
+and production build pass. **13 Chromium E2E** pass, including the inspector
+at 360 px, keyboard focus and retained saved-library edits while switching tabs.
+The inspector E2E runs with the daemon disconnected; real source reads remain
+covered by the daemon/socket tests. These layers do not establish packaged
+WebKit or native CLI activation acceptance.
+
+The runtime investigation now has a concrete S2 review artifact:
+[process-cache ordering proposal](proposals/pty-process-cache-ordering.md) and
+[patch](proposals/pty-process-cache-ordering.patch). The patched module passes
+11 standalone tests (7 new), formatting and Clippy on macOS; the unchanged
+runtime still awaits S2 application and full lifecycle validation. The proposal
+retains identity checks and deadlines, orders cache publication and rejects
+overlapping older observations. No runtime file changed in this handoff.
diff --git a/docs/desktop/knowledge-sources.md b/docs/desktop/knowledge-sources.md
index 09519b9..924b92a 100644
--- a/docs/desktop/knowledge-sources.md
+++ b/docs/desktop/knowledge-sources.md
@@ -3,7 +3,8 @@
 Open **Prompts and context** from the canvas toolbar or command palette, then
 choose **Rules & skills**. Opening the saved library alone does not scan sources.
 The inspector inventories supported global/administrator locations and the
-selected registered project's root configuration locations.
+selected registered project's supported root and nested configuration locations.
+The preview shows the owning project-relative directory for each source.
 
 Select an entry to request a read-only text preview. File contents are never
 rendered as HTML, executed, saved, inserted into a prompt or sent to a terminal
@@ -25,8 +26,9 @@ scan/entry IDs for reading. It cannot submit a filesystem path. The daemon
 keeps at most four scans, expiring after five minutes, and checks that a
 project remains registered before reading its sources.
 
-Inventory is bounded to 512 candidates, 10,000 visited entries and depth 16;
-project locations are checked before large global libraries. Source metadata
+Inventory is bounded to 512 candidates, 10,000 enumerated entries and cumulative
+directory depth 16. The selected root is checked first, followed by global/admin
+locations and then project descendants. Source metadata
 and issue lists have separate serialized byte limits. Preview is bounded to
 64 KiB of UTF-8 text; truncation, unsupported scope and unavailable files are
 visible, not represented as a complete or successful empty inventory.
@@ -38,10 +40,17 @@ opening and identity checks detect replaced parents, changed files and edits
 that restore the old mtime. A changed source requires rescan; the inspector is
 not an arbitrary file reader or editor.
 
-This increment does not enumerate every project subfolder or bundled plugin,
-evaluate native activation conditions, process imports, or inspect transcripts,
-credentials and agent configuration files. Rule editing and broader source
-coverage remain separate parity work. Offline discovery fails visibly and
+Nested traversal skips exact VCS/dependency directory names (`.git`,
+`node_modules`, `vendor`, `.venv`, `venv`) and provider configuration trees
+(`.agents`, `.claude`, `.cursor`, `.codex`). The supported rule/skill locations
+inside the first three provider trees are scanned by their dedicated readers.
+A registered root with a normally skipped basename is still eligible. Ordinary
+directory links are skipped; the displayed scan policy explains these limits.
+
+Sources above the registered project, effective session-cwd ancestry and bundled
+plugins are not inventoried. Discovery does not evaluate native activation,
+process imports, or inspect transcripts, credentials and agent configuration
+files. Rule editing and broader source coverage remain separate parity work. Offline discovery fails visibly and
 does not fabricate a source list.
 
 ## Verification boundary
diff --git a/docs/xirp-local-parity.md b/docs/xirp-local-parity.md
index b96a2f7..df3eefc 100644
--- a/docs/xirp-local-parity.md
+++ b/docs/xirp-local-parity.md
@@ -13,7 +13,7 @@ added to this implementation's scope.
 | X03 | Resume/fork, agent switch preserving supported history, linked shell. [Sessions](https://backstage.spotify.com/docs/xirp/sessions), [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S2 adapters/runtime, S1 canvas | Current adapter capabilities do not expose verified conversation IDs, fork or usage. Await trusted native contracts and runtime integration. Local context reuse is a separate feature. |
 | X04 | Working/idle/needs-input attention separate from process lifecycle. [Sessions](https://backstage.spotify.com/docs/xirp/sessions) | S2 event source, S3 indicators, S1 canvas | PTY silence is not proof of approval/input need. Explicit hooks or native signals required. |
 | X05 | Local preferences, shortcuts, supported native settings, diagnostics. [Settings](https://backstage.spotify.com/docs/xirp/settings) | S2 settings/runtime, S3 rules/skills, S1 UI | Existing diagnostics/custom-agent creation are baseline only; do not expose unsupported options. Credentials excluded from editors. |
-| X06 | Global/project rules and skills, including symlinked skill directories. [Projects](https://backstage.spotify.com/docs/xirp/projects), [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S3 discovery, S2 file boundary | Known root/global/admin locations now have bounded metadata discovery and explicit UTF-8 reads, with origins/scopes/precedence caveats and skill-link target capture (`4a367d0`). Socket, core and isolated inspector checks pass in Linux/macOS CI at `41f679c`. S1 mounted the inspector in `9329d01`; reconciliation follows. Nested project subtree inventory now passes 31 focused macOS daemon tests, including scope/limit/replacement regressions; its new CI is pending. Sources above the registered project, session-cwd ancestry, native activation and source editing remain open. |
+| X06 | Global/project rules and skills, including symlinked skill directories. [Projects](https://backstage.spotify.com/docs/xirp/projects), [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S3 discovery, S2 file boundary | Known root/global/admin locations now have bounded metadata discovery and explicit UTF-8 reads, with origins/scopes/precedence caveats and skill-link target capture (`4a367d0`). Socket, core and isolated inspector checks pass in Linux/macOS CI at `41f679c`. S1 inspector mounting `9329d01` is reconciled into this branch. Nested project subtree inventory (`8f5ff86`) passes 31 focused macOS daemon tests, including scope/limit/replacement regressions; its new CI is pending. Sources above the registered project, session-cwd ancestry, native activation and source editing remain open. |
 | X07a | Saved global/project prompts, searchable picker and insertion. [Changelog v0.19.1](https://backstage.spotify.com/docs/xirp/changelog) | S3 knowledge, S2 shared registration, S1 canvas insertion | Persisted CRUD and paginated search verified through real SQLite and daemon socket; isolated panel CRUD/draft tests and responsive Chromium preview passed; canvas library/composer insertion is integrated through S1 `1150de6` and passes Chromium E2E; Linux/macOS CI and Packaging pass at `41f679c`. See S3 report. |
 | X07b | Session archive and workflow: backlog/in_progress/in_review/blocked/done. [Changelog](https://backstage.spotify.com/docs/xirp/changelog) | S3 organization modules/controls, S2 contract review, S1 filtering | Workflow and pin/archive persist separately from lifecycle (`fce3982`); real live-process socket tests and isolated controls pass in Linux/macOS CI at `41f679c`. Canvas filtering/mounting remains pending. Session pin is a user-requested extension. |
 | X07c | Tokens/spend per session/day. [Changelog v0.18.0](https://backstage.spotify.com/docs/xirp/changelog) | S2 verified native data, S3 presentation | Source documents feature existence, not a collector/format/pricing algorithm. Currently unavailable, not zero. No proxy or PTY-based estimates. |