From 2e955a2538ed185b41f82b92f160debbb95b6e75 Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Mon, 5 Oct 2026 19:38:47 +0800
Subject: [PATCH 01/35] feat(desktop): automatically render and archive chat
 images

Resolve assistant Markdown images through a session-scoped Host service,
save bounded replay copies without rewriting message text, and provide
lazy previews, zoom and retry through independent UI capabilities.

Share archived image payloads across deliveries and conversation copies,
reuse Read filesystem boundaries, and retain PublishImage for explicit
publication before temporary sources are removed.

Generated-by: Codex (GPT-6)
---
 .../check-renderer-architecture.test.mjs      |  10 +-
 .../scripts/vite-renderer-entry-contract.ts   |   9 +-
 .../main/runtime-host-artifacts-ipc-main.ts   |   1 +
 apps/desktop/src/main/runtime-host-client.ts  |   4 +
 apps/desktop/src/preload/bridge-contract.d.ts |   1 +
 apps/desktop/src/preload/preload.ts           |   1 +
 .../src/renderer/chat-message-surface.tsx     |   1 +
 .../features/conversation/staging-services.ts |   1 +
 .../ui/staged-quote-chat-view.tsx             |   6 +-
 .../src/renderer/features/workbar/ports.ts    |   1 +
 .../tools/side-chat/quote-companion-panel.tsx |   2 +-
 .../src/renderer/features/workhub/ports.ts    |   1 +
 .../features/workhub/ui/workhub-root.tsx      |   2 +-
 apps/desktop/src/renderer/index.html          |   3 +-
 .../desktop/create-workhub-services.ts        |   1 +
 package-lock.json                             |   3 +
 packages/core/package.json                    |   1 +
 packages/core/src/artifacts.ts                |   3 +
 packages/core/src/image-delivery.ts           |  81 ++++
 .../core/src/interaction-permission-review.ts |   8 +-
 packages/core/src/permission.ts               |   1 +
 packages/runtime-host/package.json            |   1 +
 .../src/__tests__/chat-image-delivery.test.ts | 348 ++++++++++++++++++
 .../src/__tests__/execution-artifacts.test.ts |  93 +++++
 .../__tests__/execution-composition.test.ts   |  98 +++++
 .../runtime-host/src/protocol/artifact.ts     |   2 +
 .../src/protocol/image-delivery.ts            |  98 +++++
 packages/runtime-host/src/protocol/index.ts   |   5 +-
 .../runtime-host/src/protocol/operations.ts   |   1 +
 .../src/server/artifact-coordinator.ts        |   9 +
 .../src/server/chat-image-delivery.ts         | 339 +++++++++++++++++
 .../src/server/chat-image-markdown.ts         |  38 ++
 .../src/server/chat-image-source.ts           | 157 ++++++++
 .../src/server/execution-artifacts.ts         |  46 ++-
 .../src/server/execution-composition.ts       |  87 +++++
 .../src/server/root-turn-coordinator.ts       |  18 +
 packages/runtime/package.json                 |   1 +
 .../builtin-tools-file-worker.test.ts         |  62 ++++
 .../src/__tests__/tool-availability.test.ts   |   6 +-
 packages/runtime/src/builtin-tools.ts         |  68 +++-
 packages/runtime/src/image-file-reader.ts     |  44 +++
 .../src/system-prompt/main-session-prompt.ts  |   3 +
 packages/runtime/src/tool-availability.ts     |   1 +
 .../storage/src/artifact-image-storage.ts     |  74 ++++
 .../storage/src/artifact-metadata-codec.ts    |   3 +
 packages/storage/src/artifact-store.ts        |  85 ++++-
 packages/storage/src/artifact-stores.ts       |   8 +
 .../storage/src/sqlite-artifact-metadata.ts   |  22 ++
 .../storage/src/sqlite-artifact-schema.ts     |   7 +-
 packages/ui/package.json                      |   5 +-
 .../scripts/markdown-images.browser.test.mjs  | 192 ++++++++++
 .../src/__tests__/attachment-image.test.tsx   |  32 +-
 .../ui/src/__tests__/markdown-body.test.ts    |  31 +-
 packages/ui/src/attachment-image.tsx          |  59 ++-
 packages/ui/src/chat-turn.tsx                 |  13 +-
 packages/ui/src/chat-view.tsx                 |   4 +
 packages/ui/src/image-delivery.tsx            |  74 ++++
 packages/ui/src/markdown-body.tsx             | 116 +++---
 packages/ui/src/markdown-image.tsx            |  94 +++++
 packages/ui/src/markdown.tsx                  |   2 +
 packages/ui/src/shared-ui-copy.ts             |  36 ++
 packages/ui/src/styles.css                    |  45 +++
 62 files changed, 2444 insertions(+), 124 deletions(-)
 create mode 100644 packages/core/src/image-delivery.ts
 create mode 100644 packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
 create mode 100644 packages/runtime-host/src/protocol/image-delivery.ts
 create mode 100644 packages/runtime-host/src/server/chat-image-delivery.ts
 create mode 100644 packages/runtime-host/src/server/chat-image-markdown.ts
 create mode 100644 packages/runtime-host/src/server/chat-image-source.ts
 create mode 100644 packages/runtime/src/image-file-reader.ts
 create mode 100644 packages/storage/src/artifact-image-storage.ts
 create mode 100644 packages/ui/scripts/markdown-images.browser.test.mjs
 create mode 100644 packages/ui/src/image-delivery.tsx
 create mode 100644 packages/ui/src/markdown-image.tsx

diff --git a/apps/desktop/scripts/check-renderer-architecture.test.mjs b/apps/desktop/scripts/check-renderer-architecture.test.mjs
index 2fe7328ae7..b1236071e2 100644
--- a/apps/desktop/scripts/check-renderer-architecture.test.mjs
+++ b/apps/desktop/scripts/check-renderer-architecture.test.mjs
@@ -314,9 +314,10 @@ function canonicalRendererEntryHtml(
       <head>
         <meta charset="UTF-8" />
         <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+        <meta name="referrer" content="no-referrer" />
         <meta
           http-equiv="Content-Security-Policy"
-          content="default-src 'self'; ${policy}; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; connect-src 'self'"
+          content="default-src 'self'; ${policy}; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; connect-src 'self'"
         />
         <title>Maka</title>
         <style>body { margin: 0; }</style>
@@ -1778,6 +1779,13 @@ describe('renderer architecture checker fixtures', () => {
     );
   });
 
+  it('rejects an HTML transform that changes the no-referrer policy', () => {
+    assert.throws(
+      () => assertRendererEntryHtml(canonicalRendererEntryHtml().replace('content="no-referrer"', 'content="unsafe-url"')),
+      /renderer entry HTML contract forbids transformed executable or navigation surfaces/u,
+    );
+  });
+
   it('rejects executable HTML injected around the canonical module entry', () => {
     assert.doesNotThrow(() => assertRendererEntryHtml(canonicalRendererEntryHtml()));
     const emittedHtml = canonicalRendererEntryHtml().replace(
diff --git a/apps/desktop/scripts/vite-renderer-entry-contract.ts b/apps/desktop/scripts/vite-renderer-entry-contract.ts
index a3327fd28b..4e9ed2c98a 100644
--- a/apps/desktop/scripts/vite-renderer-entry-contract.ts
+++ b/apps/desktop/scripts/vite-renderer-entry-contract.ts
@@ -40,7 +40,7 @@ const ALLOWED_HTML_TAGS = new Set([
   'title',
 ]);
 const CONTENT_SECURITY_POLICY =
-  "default-src 'self'; script-src 'self' maka-client-plugin:; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; connect-src 'self'";
+  "default-src 'self'; script-src 'self' maka-client-plugin:; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; connect-src 'self'";
 
 function normalizePath(path: string): string {
   return path.split(sep).join('/');
@@ -88,8 +88,13 @@ export function assertRendererEntryHtml(html: string, expectedScriptSource?: str
       htmlAttribute(attributes, 'http-equiv')?.toLowerCase() === 'content-security-policy' &&
       htmlAttribute(attributes, 'content')?.trim().replace(/\s+/gu, ' ') === CONTENT_SECURITY_POLICY,
   );
+  const referrerMetas = metas.filter(
+    (attributes) => htmlAttribute(attributes, 'name')?.toLowerCase() === 'referrer' &&
+      htmlAttribute(attributes, 'content') === 'no-referrer',
+  );
   const validMetas =
-    metas.length === 3 &&
+    metas.length === 4 &&
+    referrerMetas.length === 1 &&
     charsetMetas.length === 1 &&
     viewportMetas.length === 1 &&
     policyMetas.length === 1;
diff --git a/apps/desktop/src/main/runtime-host-artifacts-ipc-main.ts b/apps/desktop/src/main/runtime-host-artifacts-ipc-main.ts
index 2f52baf456..faa7b7161b 100644
--- a/apps/desktop/src/main/runtime-host-artifacts-ipc-main.ts
+++ b/apps/desktop/src/main/runtime-host-artifacts-ipc-main.ts
@@ -89,6 +89,7 @@ export function registerRuntimeHostArtifactsIpc(
       return result;
     },
   );
+  deps.ipcMain.handle('attachments:resolveImage', (_event, sessionId: string, request: import('@maka/core/image-delivery').ImageDeliveryRequest) => deps.client.resolveImageDelivery(sessionId, request));
   registerRuntimeHostAttachmentPreviewIpc(deps);
   const materializePresentationArtifact = async (
     sessionId: string,
diff --git a/apps/desktop/src/main/runtime-host-client.ts b/apps/desktop/src/main/runtime-host-client.ts
index f7471d228d..7272fe6d27 100644
--- a/apps/desktop/src/main/runtime-host-client.ts
+++ b/apps/desktop/src/main/runtime-host-client.ts
@@ -867,6 +867,10 @@ export class DesktopRuntimeHostClient {
     return result.project;
   }
 
+  resolveImageDelivery(sessionId: string, request: import('@maka/core/image-delivery').ImageDeliveryRequest): Promise<import('@maka/core/image-delivery').ImageDeliveryResult> {
+    return this.request('artifact.image.resolve', { sessionId, ...request });
+  }
+
   async listArtifacts(sessionId: string): Promise<ArtifactProjection[]> {
     for (let attempt = 0; attempt < MAX_OPTIMISTIC_ATTEMPTS; attempt += 1) {
       const first = await this.request("artifact.query", {
diff --git a/apps/desktop/src/preload/bridge-contract.d.ts b/apps/desktop/src/preload/bridge-contract.d.ts
index 5287b9e34f..2b29352396 100644
--- a/apps/desktop/src/preload/bridge-contract.d.ts
+++ b/apps/desktop/src/preload/bridge-contract.d.ts
@@ -1745,6 +1745,7 @@ export interface MakaBridge {
       | { ok: true; base64: string; mimeType: string }
       | { ok: false; reason: string }
     >;
+    resolveImage(sessionId: string, request: import('@maka/core/image-delivery').ImageDeliveryRequest): Promise<import('@maka/core/image-delivery').ImageDeliveryResult>;
     readBytes(sessionId: string, artifactId: string): Promise<ArtifactBinaryReadResult>;
   };
   search: {
diff --git a/apps/desktop/src/preload/preload.ts b/apps/desktop/src/preload/preload.ts
index aba743dc2c..be090c0163 100644
--- a/apps/desktop/src/preload/preload.ts
+++ b/apps/desktop/src/preload/preload.ts
@@ -3422,6 +3422,7 @@ const makaBridge = {
     },
   },
   attachments: {
+    resolveImage: (sessionId, request) => invokeSessionRuntimeHost('attachments:resolveImage', sessionId, request),
     pickDirectory: () => invokeWhenReady('directories:pick'),
     // The renderer hands over the dropped or pasted File objects, never paths:
     // only a File backed by something the user dropped or pasted has a path,
diff --git a/apps/desktop/src/renderer/chat-message-surface.tsx b/apps/desktop/src/renderer/chat-message-surface.tsx
index eb4e3c5801..163e62d214 100644
--- a/apps/desktop/src/renderer/chat-message-surface.tsx
+++ b/apps/desktop/src/renderer/chat-message-surface.tsx
@@ -58,6 +58,7 @@ interface ChatMessageSurfaceProps extends Omit<
   | 'pendingQuotes'
   | 'onQuoteAnnotationSubmit'
   | 'onReadAttachmentBytes'
+  | 'onResolveImageDelivery'
 > {
   /**
    * #1985: the live projection and the shell-run records are the only session
diff --git a/apps/desktop/src/renderer/features/conversation/staging-services.ts b/apps/desktop/src/renderer/features/conversation/staging-services.ts
index 98002392b8..d8bfc67874 100644
--- a/apps/desktop/src/renderer/features/conversation/staging-services.ts
+++ b/apps/desktop/src/renderer/features/conversation/staging-services.ts
@@ -23,6 +23,7 @@ import type { ArtifactBinaryReadResult } from '@maka/core/artifacts';
 
 /** One attachment port: the Composer stages through it and the transcript reads image bytes through it. */
 export interface ComposerStagingServices extends ComposerAttachmentService {
+  resolveImage?: (sessionId: string, request: import('@maka/core/image-delivery').ImageDeliveryRequest) => Promise<import('@maka/core/image-delivery').ImageDeliveryResult>;
   readBytes(sessionId: string, artifactId: string): Promise<ArtifactBinaryReadResult>;
 }
 const context = createServicesContext<ComposerStagingServices>('ComposerStagingServicesProvider');
diff --git a/apps/desktop/src/renderer/features/conversation/ui/staged-quote-chat-view.tsx b/apps/desktop/src/renderer/features/conversation/ui/staged-quote-chat-view.tsx
index 12c55d2a56..b81e97d929 100644
--- a/apps/desktop/src/renderer/features/conversation/ui/staged-quote-chat-view.tsx
+++ b/apps/desktop/src/renderer/features/conversation/ui/staged-quote-chat-view.tsx
@@ -24,8 +24,8 @@ import { useComposerStagingServices } from '../staging-services.js';
 
 /** Transcript attachment reads come from the injected attachment port, never from the caller. */
 export function StagedQuoteChatView(props: Omit<ComponentProps<typeof PlanChatView>,
-  'handleRef' | 'pendingQuotes' | 'onQuoteAnnotationSubmit' | 'onReadAttachmentBytes'>) {
+  'handleRef' | 'pendingQuotes' | 'onQuoteAnnotationSubmit' | 'onReadAttachmentBytes' | 'onResolveImageDelivery'>) {
   const staging = useComposerStaging();
-  const { readBytes } = useComposerStagingServices();
-  return <PlanChatView {...props} {...staging.chatViewQuoteProps} onReadAttachmentBytes={readBytes} />;
+  const { readBytes, resolveImage } = useComposerStagingServices();
+  return <PlanChatView {...props} {...staging.chatViewQuoteProps} onReadAttachmentBytes={readBytes} onResolveImageDelivery={resolveImage} />;
 }
diff --git a/apps/desktop/src/renderer/features/workbar/ports.ts b/apps/desktop/src/renderer/features/workbar/ports.ts
index f74b022e46..8e8ed1af9b 100644
--- a/apps/desktop/src/renderer/features/workbar/ports.ts
+++ b/apps/desktop/src/renderer/features/workbar/ports.ts
@@ -165,6 +165,7 @@ export interface WorkbarArtifactsService {
 }
 
 export interface WorkbarAttachmentsService {
+  resolveImage?: (sessionId: string, request: import('@maka/core/image-delivery').ImageDeliveryRequest) => Promise<import('@maka/core/image-delivery').ImageDeliveryResult>;
   readBytes(sessionId: string, artifactId: string): Promise<ArtifactBinaryReadResult>;
   pickFiles(): Promise<
     | {
diff --git a/apps/desktop/src/renderer/features/workbar/tools/side-chat/quote-companion-panel.tsx b/apps/desktop/src/renderer/features/workbar/tools/side-chat/quote-companion-panel.tsx
index 29b7a10230..2e278a21bf 100644
--- a/apps/desktop/src/renderer/features/workbar/tools/side-chat/quote-companion-panel.tsx
+++ b/apps/desktop/src/renderer/features/workbar/tools/side-chat/quote-companion-panel.tsx
@@ -404,7 +404,7 @@ export function QuoteCompanionPanel(props: {
           liveTurns={companion.liveTurns}
           activeTurn={companion.activeTurn}
           activeSession={companion.companionSession}
-          onReadAttachmentBytes={attachments.readBytes}
+          onReadAttachmentBytes={attachments.readBytes} onResolveImageDelivery={attachments.resolveImage}
           deriveTurnPresentation={deriveTurnPresentation}
           onEditUserMessage={(turnId) => {
             const message = companion.messages.find(
diff --git a/apps/desktop/src/renderer/features/workhub/ports.ts b/apps/desktop/src/renderer/features/workhub/ports.ts
index 59a81bcf96..93f1774831 100644
--- a/apps/desktop/src/renderer/features/workhub/ports.ts
+++ b/apps/desktop/src/renderer/features/workhub/ports.ts
@@ -56,6 +56,7 @@ export interface WorkHubServices extends WorkHubWorkspaceServices {
     model: string;
   }): Promise<void>;
   readonly attachments: ComposerAttachmentService;
+  resolveImageDelivery?: (sessionId: string, request: import('@maka/core/image-delivery').ImageDeliveryRequest) => Promise<import('@maka/core/image-delivery').ImageDeliveryResult>;
   readAttachmentBytes(sessionId: string, artifactId: string): Promise<ArtifactBinaryReadResult>;
   prepareAttachments(sessionId: string, items: Array<{ approvalId: string; name: string; mimeType?: string } | { file: File }>): Promise<AttachmentRef[]>;
   listActiveInteractions(sessionId: string): Promise<import('@maka/core/events').ActiveInteractionRequestEvent[]>;
diff --git a/apps/desktop/src/renderer/features/workhub/ui/workhub-root.tsx b/apps/desktop/src/renderer/features/workhub/ui/workhub-root.tsx
index e6eb0d74ea..f87510db54 100644
--- a/apps/desktop/src/renderer/features/workhub/ui/workhub-root.tsx
+++ b/apps/desktop/src/renderer/features/workhub/ui/workhub-root.tsx
@@ -408,7 +408,7 @@ export function WorkHubRoot() {
         <div ref={history} className="workHubHistory" aria-hidden={!showConversation} inert={!showConversation}>
         <WorkHubConversation
           workLinks={links}
-          onReadAttachmentBytes={services.readAttachmentBytes}
+          onReadAttachmentBytes={services.readAttachmentBytes} onResolveImageDelivery={services.resolveImageDelivery}
           onOpenWork={(id) => call(services.presentation.openSession(id))}
           scrollBehavior="auto"
           onNew={() => composer.current?.focus()}
diff --git a/apps/desktop/src/renderer/index.html b/apps/desktop/src/renderer/index.html
index 19950c7a2d..aa66e09e36 100644
--- a/apps/desktop/src/renderer/index.html
+++ b/apps/desktop/src/renderer/index.html
@@ -21,10 +21,11 @@
 <html lang="en">
   <head>
     <meta charset="UTF-8" />
+    <meta name="referrer" content="no-referrer" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <meta
       http-equiv="Content-Security-Policy"
-      content="default-src 'self'; script-src 'self' maka-client-plugin:; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; connect-src 'self'"
+      content="default-src 'self'; script-src 'self' maka-client-plugin:; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; connect-src 'self'"
     />
     <title>Maka</title>
     <style>
diff --git a/apps/desktop/src/renderer/platform/desktop/create-workhub-services.ts b/apps/desktop/src/renderer/platform/desktop/create-workhub-services.ts
index 8d0a349fcf..de3e8b0d53 100644
--- a/apps/desktop/src/renderer/platform/desktop/create-workhub-services.ts
+++ b/apps/desktop/src/renderer/platform/desktop/create-workhub-services.ts
@@ -93,6 +93,7 @@ export function createDesktopWorkHubServices(
       bridge.connections.setDefaultModel({ slug: llmConnectionSlug, model }),
     attachments: bridge.attachments,
     readAttachmentBytes: bridge.attachments.readBytes,
+    resolveImageDelivery: bridge.attachments.resolveImage,
     prepareAttachments: async (sessionId, items) => {
       const result = await bridge.workHub.prepareAttachments(sessionId, items);
       if (!result.ok) throw new AttachmentIngestBlockedError(result.code);
diff --git a/package-lock.json b/package-lock.json
index fc228a1b70..8d545bd5e7 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -17420,6 +17420,7 @@
         "@maka/core": "0.1.0",
         "@maka/runtime": "0.1.0",
         "@maka/storage": "0.1.0",
+        "marked": "^18.0.11",
         "systeminformation": "^5.33.13",
         "ws": "^8.21.3",
         "yaml": "^2.9.1",
@@ -17516,8 +17517,10 @@
         "virtua": "0.52.7"
       },
       "devDependencies": {
+        "@playwright/test": "^1.63.0",
         "@types/react": "^19.3.0",
         "@types/react-dom": "^19.3.0",
+        "esbuild": "^0.28.2",
         "linkedom": "^0.18.13"
       }
     },
diff --git a/packages/core/package.json b/packages/core/package.json
index 85bda2bad2..7547f7a881 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -64,6 +64,7 @@
     "./context-offload": "./dist/context-offload.js",
     "./tool-result-archive-evidence": "./dist/tool-result-archive-evidence.js",
     "./attachments": "./dist/attachments.js",
+    "./image-delivery": "./dist/image-delivery.js",
     "./artifacts": "./dist/artifacts.js",
     "./pet": "./dist/pet.js",
     "./skill-invocation": "./dist/skill-invocation.js",
diff --git a/packages/core/src/artifacts.ts b/packages/core/src/artifacts.ts
index 171a8b0c66..1cd87adc5c 100644
--- a/packages/core/src/artifacts.ts
+++ b/packages/core/src/artifacts.ts
@@ -117,6 +117,8 @@ export function isArtifactTurnKey(value: unknown): value is string {
   );
 }
 
+import type { ImageDeliveryMetadata } from './image-delivery.js';
+
 export interface ArtifactDescriptor {
   id: string;
   sessionId: string;
@@ -129,6 +131,7 @@ export interface ArtifactDescriptor {
   mimeType?: string;
   source: ArtifactSource;
   summary?: string;
+  imageDelivery?: ImageDeliveryMetadata;
 }
 
 export interface ArtifactRecord extends ArtifactDescriptor {
diff --git a/packages/core/src/image-delivery.ts b/packages/core/src/image-delivery.ts
new file mode 100644
index 0000000000..a949ab0b4a
--- /dev/null
+++ b/packages/core/src/image-delivery.ts
@@ -0,0 +1,81 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/** Client-safe delivery contract. No filesystem or networking capabilities live here. */
+export const IMAGE_DELIVERY_FAILURES = [
+  'not_found',
+  'not_allowed',
+  'too_large',
+  'unsupported_mime',
+  'quota_exceeded',
+  'download_failed',
+  'read_failed',
+  'queue_full',
+] as const;
+export type ImageDeliveryFailure = (typeof IMAGE_DELIVERY_FAILURES)[number];
+export interface ImageDeliveryRequest {
+  readonly turnId: string;
+  readonly messageId: string;
+  readonly source: string;
+  readonly retry?: boolean;
+}
+export type ImageDeliveryResult =
+  | { readonly status: 'pending' }
+  | { readonly status: 'ready'; readonly artifactId: string }
+  | { readonly status: 'failed'; readonly reason: ImageDeliveryFailure }
+  | { readonly status: 'unavailable' };
+/** Stored with its Artifact, so session copy/export carries both provenance and bytes. */
+export interface ImageDeliveryMetadata {
+  readonly messageId: string;
+  readonly source: string;
+  readonly status: 'pending' | 'ready' | 'failed';
+  readonly reason?: ImageDeliveryFailure;
+  readonly contentSha256?: string;
+}
+export interface ImageArchiveLimits {
+  readonly sessionBytes: number;
+  readonly workspaceBytes: number;
+}
+export const DEFAULT_IMAGE_ARCHIVE_LIMITS: ImageArchiveLimits = Object.freeze({
+  sessionBytes: 100 * 1024 * 1024,
+  workspaceBytes: 1024 * 1024 * 1024,
+});
+export function isImageDeliveryMetadata(value: unknown): value is ImageDeliveryMetadata {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
+  const v = value as Record<string, unknown>;
+  return (
+    Object.keys(v).every((k) =>
+      ['messageId', 'source', 'status', 'reason', 'contentSha256'].includes(k),
+    ) &&
+    typeof v.messageId === 'string' &&
+    v.messageId.length > 0 &&
+    v.messageId.length <= 512 &&
+    typeof v.source === 'string' &&
+    v.source.length > 0 &&
+    v.source.length <= 4096 &&
+    ['pending', 'ready', 'failed'].includes(String(v.status)) &&
+    (v.reason === undefined ||
+      IMAGE_DELIVERY_FAILURES.includes(v.reason as ImageDeliveryFailure)) &&
+    (v.contentSha256 === undefined ||
+      (typeof v.contentSha256 === 'string' && /^[a-f0-9]{64}$/.test(v.contentSha256))) &&
+    (v.status === 'failed' ? v.reason !== undefined : v.reason === undefined) &&
+    (v.status === 'ready' ? v.contentSha256 !== undefined : v.contentSha256 === undefined) &&
+    !/[\x00-\x1f\x7f]/.test(v.source as string)
+  );
+}
diff --git a/packages/core/src/interaction-permission-review.ts b/packages/core/src/interaction-permission-review.ts
index fc12008c16..de208488f8 100644
--- a/packages/core/src/interaction-permission-review.ts
+++ b/packages/core/src/interaction-permission-review.ts
@@ -523,6 +523,7 @@ function projectToolReview(
       };
     }
     case 'Read':
+    case 'PublishImage':
     case 'Write':
     case 'Edit': {
       const path = projectionStringFrom(
@@ -533,7 +534,12 @@ function projectToolReview(
       );
       return {
         kind: 'path',
-        operation: toolName === 'Read' ? 'read' : toolName === 'Write' ? 'write' : 'edit',
+        operation:
+          toolName === 'Read' || toolName === 'PublishImage'
+            ? 'read'
+            : toolName === 'Write'
+              ? 'write'
+              : 'edit',
         path: safeText(path, INTERACTION_PERMISSION_PATH_MAX_BYTES),
       };
     }
diff --git a/packages/core/src/permission.ts b/packages/core/src/permission.ts
index 96b23e99a0..d64264ce1b 100644
--- a/packages/core/src/permission.ts
+++ b/packages/core/src/permission.ts
@@ -128,6 +128,7 @@ export interface ToolExecutionFacts {
 export const BUILTIN_TOOL_CATEGORY: Record<string, ToolCategory> = {
   // read
   Read: 'read',
+  PublishImage: 'read',
   search_files: 'read',
   Grep: 'read',
   Glob: 'read',
diff --git a/packages/runtime-host/package.json b/packages/runtime-host/package.json
index c55c2b5a47..c70c508db2 100644
--- a/packages/runtime-host/package.json
+++ b/packages/runtime-host/package.json
@@ -38,6 +38,7 @@
     "@maka/core": "0.1.0",
     "@maka/runtime": "0.1.0",
     "@maka/storage": "0.1.0",
+    "marked": "^18.0.11",
     "systeminformation": "^5.33.13",
     "ws": "^8.21.3",
     "yaml": "^2.9.1",
diff --git a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
new file mode 100644
index 0000000000..5437d9b46f
--- /dev/null
+++ b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
@@ -0,0 +1,348 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { mkdtemp, readFile, writeFile, rm, stat } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createServer } from 'node:http';
+import { openInteractiveArtifactStoreForWrite } from '@maka/storage/artifact-stores';
+import { resolveStorageRoot, tryAcquireInteractiveRootOwner } from '@maka/storage/root-authority';
+import { ChatImageDeliveryService } from '../server/chat-image-delivery.js';
+import { chatImageSources } from '../server/chat-image-markdown.js';
+import { checkedChatImage, downloadChatImage } from '../server/chat-image-source.js';
+import { IMAGE_DELIVERY_OPERATION_SPECS } from '../protocol/image-delivery.js';
+import { SessionAdmissionGate } from '../server/session-admission-gate.js';
+const PNG = Buffer.from(
+  'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8DwHwAFBQIAX8jx0gAAAABJRU5ErkJggg==',
+  'base64',
+);
+const REQUEST = {
+  sessionId: 'session-1',
+  turnId: 'turn-1',
+  messageId: 'message-1',
+  source: '/tmp/image.png',
+};
+async function fixture(limits?: { sessionBytes: number; workspaceBytes: number }) {
+  const root = await mkdtemp(join(tmpdir(), 'maka-image-delivery-'));
+  const owner = await tryAcquireInteractiveRootOwner(
+    await resolveStorageRoot({ path: root, kind: 'interactive' }),
+  );
+  assert.ok(owner);
+  const store = await openInteractiveArtifactStoreForWrite(owner.lease);
+  const authority = { store, close: () => store.close() };
+  const errors: unknown[] = [];
+  let reads = 0;
+  let leases = 0;
+  const messages = new Map<string, string>();
+  let present = true;
+  const service = new ChatImageDeliveryService({
+    artifacts: authority.store,
+    admission: new SessionAdmissionGate(),
+    limits,
+    isPresent: async () => present,
+    readMessage: async (i) => messages.get(i.messageId),
+    readLocalImage: async (_sessionId, path) => {
+      reads++;
+      return checkedChatImage(await readFile(path));
+    },
+    acquireResidency: () => {
+      leases++;
+      return {
+        release: () => {
+          leases--;
+        },
+      };
+    },
+    persistenceFailed: (error) => errors.push(error),
+  });
+  return {
+    root,
+    owner,
+    authority,
+    service,
+    messages,
+    errors,
+    get reads() {
+      return reads;
+    },
+    get leases() {
+      return leases;
+    },
+    removeSession: () => {
+      present = false;
+    },
+    async close() {
+      await service.close();
+      authority.close();
+      await owner.close();
+      await rm(owner.controlDirectory, { recursive: true, force: true });
+      await rm(root, { recursive: true, force: true });
+    },
+  };
+}
+function observe(
+  service: ChatImageDeliveryService,
+  source: string,
+  sessionId = REQUEST.sessionId,
+  messageId = REQUEST.messageId,
+) {
+  service.observe(sessionId, {
+    id: 'text-event',
+    type: 'text_complete',
+    turnId: REQUEST.turnId,
+    ts: 1,
+    messageId,
+    text: `![Screenshot](<${source}>)`,
+  });
+}
+test('parses real Markdown image nodes, including references and balanced destinations, without scanning code or HTML', () => {
+  const text = [
+    '![one](</tmp/a (1).png>)',
+    '![two][pic]',
+    '',
+    '[pic]: https://example.com/a.png',
+    '`![code](/tmp/secret.png)`',
+    '```md',
+    '![fenced](/tmp/secret2.png)',
+    '```',
+    '<img src="/tmp/html.png">',
+    '![incomplete](https://example.com/',
+  ].join('\n');
+  assert.deepEqual(chatImageSources(text), ['/tmp/a (1).png', 'https://example.com/a.png']);
+});
+test('automatically saves a local delivery without any UI request; deletion and Host restart do not break replay', async () => {
+  const f = await fixture();
+  try {
+    const source = join(f.root, 'original.png');
+    await writeFile(source, PNG);
+    observe(f.service, source);
+    await f.service.waitForIdle();
+    assert.equal(f.reads, 1);
+    assert.equal(f.leases, 0);
+    assert.deepEqual(f.errors, []);
+    await rm(source);
+    const input = { ...REQUEST, source };
+    const result = await f.service.resolve(input);
+    assert.equal(result.status, 'ready');
+    if (result.status !== 'ready') return;
+    f.authority.close();
+    const reopenedStore = await openInteractiveArtifactStoreForWrite(f.owner.lease);
+    const reopened = { store: reopenedStore, close: () => reopenedStore.close() };
+    try {
+      const record = await reopened.store.findImageDelivery(
+        input.sessionId,
+        input.turnId,
+        input.messageId,
+        source,
+      );
+      assert.equal(record?.imageDelivery?.status, 'ready');
+      const bytes = await reopened.store.readBinaryInSession(input.sessionId, result.artifactId);
+      assert.equal(bytes.ok, true);
+      if (bytes.ok) assert.equal(bytes.base64, PNG.toString('base64'));
+    } finally {
+      reopened.close();
+    }
+  } finally {
+    await f.close();
+  }
+});
+test('remote delivery is downloaded once, remains replayable after the origin server disappears, and sends no credentials/referrer', async () => {
+  const f = await fixture();
+  let requests = 0;
+  const server = createServer((req, res) => {
+    requests++;
+    assert.equal(req.headers.referer, undefined);
+    assert.equal(req.headers.cookie, undefined);
+    assert.equal(req.headers.authorization, undefined);
+    res.setHeader('Content-Type', 'image/png');
+    res.end(PNG);
+  });
+  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+  const source = `http://127.0.0.1:${(server.address() as import('node:net').AddressInfo).port}/image.png`;
+  try {
+    observe(f.service, source);
+    await f.service.waitForIdle();
+    assert.deepEqual(f.errors, []);
+    assert.equal((await f.service.resolve({ ...REQUEST, source })).status, 'ready');
+    assert.equal(requests, 1);
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+    assert.equal((await f.service.resolve({ ...REQUEST, source })).status, 'ready');
+    assert.equal(requests, 1);
+  } finally {
+    server.close();
+    await f.close();
+  }
+});
+test('a supplied path is never a read grant; sources inside code cannot trigger archival', async () => {
+  const f = await fixture();
+  try {
+    f.messages.set(REQUEST.messageId, '`![secret](/tmp/image.png)`');
+    assert.deepEqual(await f.service.resolve(REQUEST), { status: 'unavailable' });
+    f.messages.set(REQUEST.messageId, 'plain text');
+    assert.deepEqual(await f.service.resolve(REQUEST), { status: 'unavailable' });
+    assert.equal(f.reads, 0);
+  } finally {
+    await f.close();
+  }
+});
+test('transient failure is persisted and is retried only on an explicit request', async () => {
+  const f = await fixture();
+  try {
+    const source = join(f.root, 'later.png');
+    observe(f.service, source);
+    await f.service.waitForIdle();
+    assert.deepEqual(await f.service.resolve({ ...REQUEST, source }), {
+      status: 'failed',
+      reason: 'not_found',
+    });
+    await writeFile(source, PNG);
+    assert.equal((await f.service.resolve({ ...REQUEST, source })).status, 'failed');
+    assert.equal(f.reads, 1);
+    assert.equal((await f.service.resolve({ ...REQUEST, source, retry: true })).status, 'pending');
+    await f.service.waitForIdle();
+    assert.equal((await f.service.resolve({ ...REQUEST, source })).status, 'ready');
+    assert.equal(f.reads, 2);
+  } finally {
+    await f.close();
+  }
+});
+test('quota admission is atomic under concurrent jobs and identical content shares bytes across sessions', async () => {
+  const f = await fixture({ sessionBytes: PNG.length, workspaceBytes: PNG.length });
+  try {
+    const source = join(f.root, 'same.png');
+    await writeFile(source, PNG);
+    observe(f.service, source);
+    observe(f.service, source, 'session-2');
+    await f.service.waitForIdle();
+    const a = await f.service.resolve({ ...REQUEST, source });
+    const b = await f.service.resolve({ ...REQUEST, sessionId: 'session-2', source });
+    assert.equal(a.status, 'ready');
+    assert.equal(b.status, 'ready');
+    if (a.status !== 'ready' || b.status !== 'ready') return;
+    const ra = (await f.authority.store.getInSession('session-1', a.artifactId)).record!;
+    const rb = (await f.authority.store.getInSession('session-2', b.artifactId)).record!;
+    assert.equal(
+      (await stat(join(f.root, 'artifacts', ra.relativePath))).ino,
+      (await stat(join(f.root, 'artifacts', rb.relativePath))).ino,
+    );
+    const different = join(f.root, 'different.png');
+    await writeFile(different, Buffer.concat([PNG, Buffer.from('different')]));
+    observe(f.service, different, 'session-1', 'message-2');
+    await f.service.waitForIdle();
+    assert.deepEqual(
+      await f.service.resolve({ ...REQUEST, source: different, messageId: 'message-2' }),
+      { status: 'failed', reason: 'quota_exceeded' },
+    );
+    await f.authority.store.purgeSessionArtifacts('session-1');
+    assert.equal((await f.authority.store.readBinaryInSession('session-2', b.artifactId)).ok, true);
+    assert.deepEqual(f.errors, []);
+  } finally {
+    await f.close();
+  }
+});
+test('copying a conversation carries delivery provenance and saved bytes; it does not read the original source', async () => {
+  const f = await fixture();
+  try {
+    const source = join(f.root, 'original.png');
+    await writeFile(source, PNG);
+    observe(f.service, source);
+    await f.service.waitForIdle();
+    await rm(source);
+    await f.authority.store.copyConversationArtifacts({
+      sourceSessionId: 'session-1',
+      targetSessionId: 'session-copy',
+      turnIds: ['turn-1'],
+    });
+    const original = await f.service.resolve({ ...REQUEST, source });
+    const copied = await f.service.resolve({ ...REQUEST, sessionId: 'session-copy', source });
+    assert.equal(copied.status, 'ready');
+    if (copied.status === 'ready' && original.status === 'ready') {
+      const sourceRecord = (await f.authority.store.getInSession('session-1', original.artifactId))
+        .record!;
+      const targetRecord = (await f.authority.store.getInSession('session-copy', copied.artifactId))
+        .record!;
+      assert.equal(
+        (await stat(join(f.root, 'artifacts', sourceRecord.relativePath))).ino,
+        (await stat(join(f.root, 'artifacts', targetRecord.relativePath))).ino,
+      );
+      await f.authority.store.purgeSessionArtifacts('session-1');
+      assert.equal(
+        (await f.authority.store.readBinaryInSession('session-copy', copied.artifactId)).ok,
+        true,
+      );
+    }
+    assert.equal(f.reads, 1);
+  } finally {
+    await f.close();
+  }
+});
+test('source readers reject oversized payloads, unsafe MIME and redirects to private networks', async () => {
+  assert.throws(() => checkedChatImage(Buffer.alloc(2 * 1024 * 1024 + 1)), /too_large/);
+  assert.throws(() => checkedChatImage(Buffer.from('<svg/>')), /unsupported_mime/);
+  const server = createServer((_req, res) => {
+    res.writeHead(302, { location: 'http://169.254.169.254/latest/meta-data/' });
+    res.end();
+  });
+  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+  try {
+    const source = `http://127.0.0.1:${(server.address() as import('node:net').AddressInfo).port}/redirect`;
+    await assert.rejects(downloadChatImage(source, AbortSignal.timeout(2000)), /not_allowed/);
+  } finally {
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+  }
+});
+test('resolver codec rejects excess fields and noncanonical artifact identities', () => {
+  const spec = IMAGE_DELIVERY_OPERATION_SPECS['artifact.image.resolve'];
+  assert.deepEqual(spec.decodeInput(REQUEST), REQUEST);
+  assert.throws(() => spec.decodeInput({ ...REQUEST, arbitraryRead: true }));
+  assert.throws(() => spec.decodeOutput({ status: 'ready', artifactId: '../private' }));
+});
+
+test('completed turns release unfinished stream slots without archiving partial messages', async () => {
+  const f = await fixture();
+  try {
+    for (let i = 0; i < 40; i++) {
+      f.service.observe('session-1', {
+        type: 'text_delta',
+        id: `delta-${i}`,
+        turnId: `turn-${i}`,
+        ts: 1,
+        messageId: `partial-${i}`,
+        text: '![partial](/tmp/missing.png)',
+      });
+      f.service.observe('session-1', {
+        type: 'complete',
+        id: `complete-${i}`,
+        turnId: `turn-${i}`,
+        ts: 2,
+        stopReason: 'end_turn',
+      });
+    }
+    const source = join(f.root, 'final.png');
+    await writeFile(source, PNG);
+    observe(f.service, source);
+    await f.service.waitForIdle();
+    assert.equal(f.reads, 1);
+    assert.equal((await f.service.resolve({ ...REQUEST, source })).status, 'ready');
+  } finally {
+    await f.close();
+  }
+});
diff --git a/packages/runtime-host/src/__tests__/execution-artifacts.test.ts b/packages/runtime-host/src/__tests__/execution-artifacts.test.ts
index b253ed0974..dc60f3bc48 100644
--- a/packages/runtime-host/src/__tests__/execution-artifacts.test.ts
+++ b/packages/runtime-host/src/__tests__/execution-artifacts.test.ts
@@ -39,6 +39,9 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { test } from 'node:test';
 import { MAX_ATTACHMENT_BYTES } from '@maka/core/attachments';
+import { parseAttachmentResourceRef } from '@maka/core/attachments';
+import { ARTIFACT_IMAGE_PREVIEW_MAX_BYTES } from '@maka/core/artifacts';
+import { buildBuiltinTools } from '@maka/runtime/builtin-tools';
 import {
   openInteractiveArtifactStoreForWrite,
   createReadImageSnapshotPlanner,
@@ -54,6 +57,96 @@ import { createHostExecutionArtifactServices } from '../server/execution-artifac
 import { restoreArtifactV1Shape } from './fixtures/artifact-v1.js';
 import { SessionAdmissionGate } from '../server/session-admission-gate.js';
 
+test('PublishImage delivers a temporary screenshot as a durable, session-scoped Markdown image', async () => {
+  const base = await mkdtemp(join(tmpdir(), 'maka-publish-image-'));
+  const owner = await tryAcquireInteractiveRootOwner(
+    await resolveStorageRoot({ path: join(base, 'state'), kind: 'interactive' }),
+  );
+  assert.ok(owner);
+  let store = await openInteractiveArtifactStoreForWrite(owner.lease);
+  try {
+    const png = Buffer.from(
+      'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8DwHwAFBQIAX8jx0gAAAABJRU5ErkJggg==',
+      'base64',
+    );
+    const screenshot = join(base, 'screenshot.png');
+    await writeFile(screenshot, png);
+    const services = createHostExecutionArtifactServices({
+      artifacts: store,
+      sessionAdmission: new SessionAdmissionGate(),
+      sessions: { probeSessionRemoval: async () => ({ kind: 'present' }) },
+      requestDrain: () => assert.fail('successful publication must not drain'),
+    });
+    const quotaServices = createHostExecutionArtifactServices({
+      artifacts: store,
+      sessionAdmission: new SessionAdmissionGate(),
+      sessions: { probeSessionRemoval: async () => ({ kind: 'present' }) },
+      imageArchiveLimits: { sessionBytes: 0, workspaceBytes: 0 },
+      requestDrain: () => assert.fail('quota rejection must not drain'),
+    });
+    await assert.rejects(
+      quotaServices.publishImage({
+        sessionId: 'session',
+        turnId: 'turn',
+        toolCallId: 'quota-call',
+        name: 'image.png',
+        mimeType: 'image/png',
+        bytes: png,
+      }),
+      /quota exceeded/,
+    );
+    const tool = buildBuiltinTools({ publishImage: services.publishImage }).find(
+      (tool) => tool.name === 'PublishImage',
+    );
+    assert.ok(tool);
+    const context = {
+      sessionId: 'session',
+      turnId: 'turn',
+      toolCallId: 'publish-call',
+      cwd: join(base, 'state'),
+      permissionMode: 'bypass' as const,
+      executionBoundary: { kind: 'bypass' as const, revision: 0 },
+      abortSignal: new AbortController().signal,
+      emitOutput() {},
+    };
+    const result = (await tool.impl({ path: screenshot }, context)) as {
+      published: boolean;
+      resource: string;
+      markdown: string;
+    };
+    assert.equal(result.published, true);
+    const ref = parseAttachmentResourceRef(result.resource);
+    assert.ok(ref);
+    assert.equal(result.markdown, `![screenshot.png](${result.resource})`);
+    const projection = encodeDurableToolResultOutput({ type: 'json', value: result }, 'session');
+    assert.deepEqual(durableProjectionToToolResultOutput(projection), {
+      type: 'json',
+      value: result,
+    });
+    await rm(screenshot);
+    store.close();
+    store = await openInteractiveArtifactStoreForWrite(owner.lease);
+    const bytes = await store.readBinaryInSession('session', ref.artifactId);
+    assert.equal(bytes.ok, true);
+    if (bytes.ok) assert.equal(bytes.base64, png.toString('base64'));
+    assert.equal((await store.readBinaryInSession('other', ref.artifactId)).ok, false);
+    await assert.rejects(
+      services.publishImage({
+        ...context,
+        name: 'oversized.png',
+        mimeType: 'image/png',
+        bytes: new Uint8Array(ARTIFACT_IMAGE_PREVIEW_MAX_BYTES + 1),
+      }),
+      /at most 2 MiB/,
+    );
+  } finally {
+    store.close();
+    await owner.close();
+    await rm(base, { recursive: true, force: true });
+    await rm(owner.controlDirectory, { recursive: true, force: true });
+  }
+});
+
 for (const scenario of ['text', 'large raw MCP image', 'executor-sized Bash'] as const) {
   test(`production archives survive reopen (${scenario})`, async () => {
     const largeImage = scenario === 'large raw MCP image';
diff --git a/packages/runtime-host/src/__tests__/execution-composition.test.ts b/packages/runtime-host/src/__tests__/execution-composition.test.ts
index 501ae0b66b..29c935adfb 100644
--- a/packages/runtime-host/src/__tests__/execution-composition.test.ts
+++ b/packages/runtime-host/src/__tests__/execution-composition.test.ts
@@ -4629,3 +4629,101 @@ async function actWorkHub(
     await desktop.close();
   }
 }
+
+test('production Host automatically archives assistant Markdown images and serves them after source deletion', async () => {
+  await withCompositionRoot(async ({ root, owner }) => {
+    const source = join(root, 'delivery.png');
+    const png = Buffer.from(
+      'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8DwHwAFBQIAX8jx0gAAAABJRU5ErkJggg==',
+      'base64',
+    );
+    await writeFile(source, png);
+    const captured = await createCapturedExecutionComposition(owner, {
+      primaryBackendFactory: (context) =>
+        new (class extends FakeBackend {
+          override async *send(input: BackendSendInput): AsyncIterable<SessionEvent> {
+            yield {
+              type: 'text_complete',
+              id: 'delivery-text-event',
+              turnId: input.turnId,
+              ts: Date.now(),
+              messageId: 'delivered-message',
+              text: `![Screenshot](<${source}>)`,
+            };
+            yield {
+              type: 'complete',
+              id: 'delivery-complete-event',
+              turnId: input.turnId,
+              ts: Date.now(),
+              stopReason: 'end_turn',
+            };
+          }
+        })(context),
+      context: {
+        retainUntilProcessExit: () => undefined,
+        requestDrain: () => assert.fail('image delivery must not drain Host'),
+      },
+    });
+    try {
+      const session = await captured.manager.createSession({
+        cwd: root,
+        llmConnectionId: FAKE_CONNECTION_ID,
+        llmConnectionSlug: 'fake',
+        model: 'fake-model',
+        permissionMode: 'bypass',
+      });
+      const context = {
+        hostEpoch: 'execution-composition-test',
+        connectionId: 'image-client',
+        principal: 'local_os_user',
+        acquireResidency: () => ({ release() {} }),
+      };
+      const started = await captured.composition.handlers['turn.start'](
+        {
+          sessionId: session.id,
+          turnId: 'image-delivery-turn',
+          content: { text: 'deliver screenshot' },
+        },
+        context,
+      );
+      assert.equal(started.ok, true, JSON.stringify(started));
+      const request = {
+        sessionId: session.id,
+        turnId: 'image-delivery-turn',
+        messageId: 'delivered-message',
+        source,
+      };
+      let artifactId: string | undefined;
+      await waitFor(async () => {
+        const result = await captured.composition.handlers['artifact.image.resolve'](
+          request,
+          context,
+        );
+        assert.equal(result.ok, true, JSON.stringify(result));
+        if (result.ok && result.result.status === 'ready') artifactId = result.result.artifactId;
+        return !!artifactId;
+      }, 5000);
+      await rm(source);
+      const replay = await captured.composition.handlers['artifact.image.resolve'](
+        request,
+        context,
+      );
+      assert.deepEqual(replay, { ok: true, result: { status: 'ready', artifactId } });
+      const binary = await captured.composition.handlers['artifact.query'](
+        { sessionId: session.id, kind: 'read_binary', artifactId: artifactId! },
+        context,
+      );
+      assert.equal(binary.ok, true, JSON.stringify(binary));
+      if (binary.ok && binary.result.kind === 'binary' && binary.result.preview.ok)
+        assert.equal(binary.result.preview.base64, png.toString('base64'));
+      const forged = await captured.composition.handlers['artifact.image.resolve'](
+        { ...request, source: '/tmp/private.png' },
+        context,
+      );
+      assert.deepEqual(forged, { ok: true, result: { status: 'unavailable' } });
+    } finally {
+      captured.composition.beginDrain();
+      await captured.composition.close();
+    }
+  });
+});
diff --git a/packages/runtime-host/src/protocol/artifact.ts b/packages/runtime-host/src/protocol/artifact.ts
index 08e45820c0..a5f2c254ce 100644
--- a/packages/runtime-host/src/protocol/artifact.ts
+++ b/packages/runtime-host/src/protocol/artifact.ts
@@ -17,6 +17,7 @@
  * under the License.
  */
 
+import { IMAGE_DELIVERY_OPERATION_SPECS } from './image-delivery.js';
 import {
   ARTIFACT_KINDS,
   ARTIFACT_SOURCES,
@@ -184,6 +185,7 @@ export type ArtifactIngestResult =
   | { readonly kind: 'upload_aborted'; readonly uploadId: string };
 
 export const ARTIFACT_OPERATION_SPECS = {
+  ...IMAGE_DELIVERY_OPERATION_SPECS,
   'artifact.ingest': defineOperation<
     ArtifactIngestInput,
     ArtifactIngestResult,
diff --git a/packages/runtime-host/src/protocol/image-delivery.ts b/packages/runtime-host/src/protocol/image-delivery.ts
new file mode 100644
index 0000000000..7ac1d5a01e
--- /dev/null
+++ b/packages/runtime-host/src/protocol/image-delivery.ts
@@ -0,0 +1,98 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import {
+  IMAGE_DELIVERY_FAILURES,
+  type ImageDeliveryRequest,
+  type ImageDeliveryResult,
+} from '@maka/core/image-delivery';
+import { isCanonicalArtifactEntityId } from '@maka/core/artifacts';
+import { requireExactRecord, requireEntityId, requireRecord } from './codec.js';
+import { invalidProtocolFrame } from './errors.js';
+import { defineOperation } from './operation-spec.js';
+export interface ResolveImageDeliveryInput extends ImageDeliveryRequest {
+  readonly sessionId: string;
+}
+export const IMAGE_DELIVERY_OPERATION_SPECS = {
+  'artifact.image.resolve': defineOperation<
+    ResolveImageDeliveryInput,
+    ImageDeliveryResult,
+    | 'host_not_ready'
+    | 'host_draining'
+    | 'operation_unavailable'
+    | 'invalid_request'
+    | 'not_found'
+    | 'internal_failure'
+  >({
+    mode: 'command',
+    availability: 'ready',
+    errors: [
+      'host_not_ready',
+      'host_draining',
+      'operation_unavailable',
+      'invalid_request',
+      'not_found',
+      'internal_failure',
+    ],
+    decodeInput(value) {
+      const v = requireExactRecord(value, 'image delivery request', [
+        'sessionId',
+        'turnId',
+        'messageId',
+        'source',
+        ...(Object.hasOwn(requireRecord(value, 'image delivery request'), 'retry')
+          ? ['retry']
+          : []),
+      ]);
+      const text = (s: unknown, max: number) => {
+        if (typeof s !== 'string' || !s.length || s.length > max || /[\u0000-\u001f\u007f]/.test(s))
+          throw invalidProtocolFrame('Invalid image delivery identity');
+        return s;
+      };
+      if (v.retry !== undefined && typeof v.retry !== 'boolean')
+        throw invalidProtocolFrame('Invalid image retry flag');
+      return {
+        sessionId: requireEntityId(v.sessionId, 'sessionId'),
+        turnId: text(v.turnId, 512),
+        messageId: text(v.messageId, 512),
+        source: text(v.source, 4096),
+        ...(v.retry === true ? { retry: true } : {}),
+      };
+    },
+    decodeOutput(value) {
+      const v = requireRecord(value, 'image delivery result');
+      if (v.status === 'pending' || v.status === 'unavailable') {
+        requireExactRecord(v, 'image delivery status', ['status']);
+        return { status: v.status };
+      }
+      if (v.status === 'ready' && isCanonicalArtifactEntityId(v.artifactId)) {
+        requireExactRecord(v, 'image delivery ready', ['status', 'artifactId']);
+        return { status: 'ready', artifactId: v.artifactId };
+      }
+      if (v.status === 'failed' && IMAGE_DELIVERY_FAILURES.includes(v.reason as never)) {
+        requireExactRecord(v, 'image delivery failure', ['status', 'reason']);
+        return {
+          status: 'failed',
+          reason: v.reason as Extract<ImageDeliveryResult, { status: 'failed' }>['reason'],
+        };
+      }
+      throw invalidProtocolFrame('Invalid image delivery result');
+    },
+  }),
+} as const;
diff --git a/packages/runtime-host/src/protocol/index.ts b/packages/runtime-host/src/protocol/index.ts
index a2b5157ce9..ac80e7aad1 100644
--- a/packages/runtime-host/src/protocol/index.ts
+++ b/packages/runtime-host/src/protocol/index.ts
@@ -106,7 +106,10 @@ export const RUNTIME_HOST_REGISTRATION_SCHEMA_VERSION = 1 as const;
 export const RUNTIME_HOST_PROTOCOL_VERSION = 0 as const;
 // Increment when the same protocol version no longer guarantees safe Client-Host
 // interoperability. Mismatches are rejected before domain commands are admitted.
-export const RUNTIME_HOST_COMPATIBILITY_EPOCH = 220 as const;
+export const RUNTIME_HOST_COMPATIBILITY_EPOCH = 221 as const;
+// 221: Epoch-220 peers do not support `artifact.image.resolve` or its image
+// delivery result shapes. Older Hosts reject the unknown operation and close
+// the connection, so mixed peers must fail admission.
 // 220: Client Capability results require a tri-state outcome; session tool
 // continuity and trace steps carry interrupted results. Older peers cannot
 // decode the changed strict shapes.
diff --git a/packages/runtime-host/src/protocol/operations.ts b/packages/runtime-host/src/protocol/operations.ts
index fba841c427..1f500dfca4 100644
--- a/packages/runtime-host/src/protocol/operations.ts
+++ b/packages/runtime-host/src/protocol/operations.ts
@@ -262,6 +262,7 @@ export const REMOTE_OWNER_OPERATION_GRANTS = Object.freeze([
   'agent.graph.stop',
   'artifact.delete',
   'artifact.ingest',
+  'artifact.image.resolve',
   'artifact.query',
   'client.capability.replace',
   'client.capability.unregister',
diff --git a/packages/runtime-host/src/server/artifact-coordinator.ts b/packages/runtime-host/src/server/artifact-coordinator.ts
index 78bfe7de68..472b9fa4f8 100644
--- a/packages/runtime-host/src/server/artifact-coordinator.ts
+++ b/packages/runtime-host/src/server/artifact-coordinator.ts
@@ -17,6 +17,7 @@
  * under the License.
  */
 
+import type { ChatImageDeliveryService } from './chat-image-delivery.js';
 import { JsonArrayPageBudget } from './json-array-page-budget.js';
 
 import { createHash } from 'node:crypto';
@@ -63,6 +64,13 @@ interface ArtifactUploadMetadata {
 /** Session-scoped Host projection and deletion authority for Artifacts. */
 export class HostArtifactCoordinator {
   readonly handlers: ArtifactOperationHandlerMap = {
+    'artifact.image.resolve': async (input, context) => {
+      if (context.principalKind === 'session_guest' || !this.imageDelivery)
+        return { ok: true, result: { status: 'unavailable' } };
+      if ((await this.#sessions.probeSessionRemoval(input.sessionId)).kind !== 'present')
+        return { ok: false, error: { code: 'not_found', message: 'Session was not found' } };
+      return { ok: true, result: await this.imageDelivery.resolve(input) };
+    },
     'artifact.ingest': (input, context) =>
       this.#sessionAdmission.run(input.sessionId, () => this.#ingest(input, context)),
     'artifact.query': (input, context) =>
@@ -89,6 +97,7 @@ export class HostArtifactCoordinator {
     now: () => number = Date.now,
     sessionAccessAuthority?: Pick<RuntimeHostAccessAuthority, 'activeSessionGrant'>,
     onArtifactDeleted?: (sessionId: string, artifactId: string) => void,
+    private readonly imageDelivery?: ChatImageDeliveryService,
   ) {
     this.#store = authenticateInteractiveArtifactStoreWriter(store);
     this.#requestDrain = requestDrain;
diff --git a/packages/runtime-host/src/server/chat-image-delivery.ts b/packages/runtime-host/src/server/chat-image-delivery.ts
new file mode 100644
index 0000000000..0fe5c2bd92
--- /dev/null
+++ b/packages/runtime-host/src/server/chat-image-delivery.ts
@@ -0,0 +1,339 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { createHash } from 'node:crypto';
+import type { CompleteEvent, TextCompleteEvent, TextDeltaEvent } from '@maka/core/events';
+import { foldAssistantDelta } from '@maka/core/events';
+import {
+  DEFAULT_IMAGE_ARCHIVE_LIMITS,
+  type ImageArchiveLimits,
+  type ImageDeliveryRequest,
+  type ImageDeliveryResult,
+  type ImageDeliveryFailure,
+} from '@maka/core/image-delivery';
+import {
+  ImageArchiveQuotaError,
+  type InteractiveArtifactStoreWriter,
+} from '@maka/storage/artifact-stores';
+import type { SessionAdmissionGate } from './session-admission-gate.js';
+import { chatImageSources } from './chat-image-markdown.js';
+import {
+  checkedChatImage,
+  downloadChatImage,
+  ImageSourceError,
+  localImagePath,
+  type ChatImageBytes,
+} from './chat-image-source.js';
+
+interface DeliveryIdentity extends ImageDeliveryRequest {
+  readonly sessionId: string;
+}
+interface DeliveryJob {
+  readonly identity: DeliveryIdentity;
+  readonly done: Promise<void>;
+  run(): Promise<void>;
+  cancel(): void;
+}
+export interface ChatImageDeliveryPorts {
+  readonly artifacts: Pick<
+    InteractiveArtifactStoreWriter,
+    'create' | 'findImageDelivery' | 'deleteOwnedArtifactInSession'
+  >;
+  readonly admission: SessionAdmissionGate;
+  isPresent(sessionId: string): Promise<boolean>;
+  readMessage(identity: DeliveryIdentity): Promise<string | undefined>;
+  readLocalImage(sessionId: string, path: string, signal: AbortSignal): Promise<ChatImageBytes>;
+  acquireResidency(): { release(): void };
+  persistenceFailed(error: unknown): void;
+  readonly limits?: ImageArchiveLimits;
+  readonly download?: typeof downloadChatImage;
+}
+/** Host owns capture and persistence; clients can only resolve sources already in an assistant message. */
+export class ChatImageDeliveryService {
+  readonly #jobs = new Map<string, DeliveryJob>();
+  readonly #queue: DeliveryJob[] = [];
+  readonly #streams = new Map<
+    string,
+    { turnId: string; text: string; seen: Set<string>; timer?: ReturnType<typeof setTimeout> }
+  >();
+  readonly #abort = new AbortController();
+  #running = 0;
+  #closed = false;
+  constructor(private readonly ports: ChatImageDeliveryPorts) {}
+
+  observe(sessionId: string, event: TextDeltaEvent | TextCompleteEvent | CompleteEvent): void {
+    if (this.#closed) return;
+    if (event.type === 'complete') {
+      for (const [key, stream] of this.#streams) {
+        if (key.startsWith(`${sessionId}\0`) && stream.turnId === event.turnId) {
+          clearTimeout(stream.timer);
+          this.#streams.delete(key);
+        }
+      }
+      return;
+    }
+    const key = `${sessionId}\0${event.messageId}`;
+    let stream = this.#streams.get(key);
+    if (!stream) {
+      if (this.#streams.size >= 32) return;
+      stream = { turnId: event.turnId, text: '', seen: new Set() };
+      this.#streams.set(key, stream);
+    }
+    if (event.type === 'text_complete') stream.text = event.text;
+    else {
+      const folded = foldAssistantDelta(stream.text.length, event);
+      if (!folded) return;
+      stream.text += folded.tail;
+    }
+    if (stream.text.length > 1024 * 1024) {
+      clearTimeout(stream.timer);
+      this.#streams.delete(key);
+      return;
+    }
+    const capture = () => {
+      stream!.timer = undefined;
+      for (const source of chatImageSources(stream!.text)) {
+        if (stream!.seen.has(source)) continue;
+        stream!.seen.add(source);
+        this.#enqueue({ sessionId, turnId: event.turnId, messageId: event.messageId, source });
+      }
+    };
+    if (event.type === 'text_complete') {
+      clearTimeout(stream.timer);
+      capture();
+      this.#streams.delete(key);
+    } else if (!stream.timer)
+      stream.timer = setTimeout(() => {
+        try {
+          capture();
+        } catch (error) {
+          if (!this.#closed) this.ports.persistenceFailed(error);
+        }
+      }, 250);
+  }
+
+  async resolve(identity: DeliveryIdentity): Promise<ImageDeliveryResult> {
+    if (this.#closed) return { status: 'unavailable' };
+    const record = await this.ports.artifacts.findImageDelivery(
+      identity.sessionId,
+      identity.turnId,
+      identity.messageId,
+      identity.source,
+    );
+    const metadata = record?.imageDelivery;
+    if (metadata?.status === 'ready') return { status: 'ready', artifactId: record!.id };
+    if (metadata?.status === 'failed' && !identity.retry)
+      return { status: 'failed', reason: metadata.reason! };
+    if (this.#jobs.has(deliveryKey(identity))) return { status: 'pending' };
+    // A client-provided path is never a read grant. Legacy/restarted deliveries
+    // must be found in canonical assistant text before any source is opened.
+    if (!metadata) {
+      const text = await this.ports.readMessage(identity);
+      if (text === undefined || !chatImageSources(text).includes(identity.source))
+        return { status: 'unavailable' };
+    }
+    if (metadata?.status === 'failed') {
+      await this.ports.admission.runOrJoin(identity.sessionId, () =>
+        this.ports.artifacts.deleteOwnedArtifactInSession(
+          identity.sessionId,
+          record!.id,
+          'tool_result_projection',
+        ),
+      );
+    }
+    return this.#enqueue(identity)
+      ? { status: 'pending' }
+      : { status: 'failed', reason: 'queue_full' };
+  }
+
+  #enqueue(identity: DeliveryIdentity): boolean {
+    const key = deliveryKey(identity);
+    if (this.#jobs.has(key)) return true;
+    if (this.#closed || this.#jobs.size >= 128) return false;
+    let settle!: () => void;
+    const done = new Promise<void>((resolve) => {
+      settle = resolve;
+    });
+    const residency = this.ports.acquireResidency();
+    const finish = () => {
+      this.#jobs.delete(key);
+      residency.release();
+      settle();
+    };
+    const job: DeliveryJob = {
+      identity,
+      done,
+      cancel: finish,
+      run: async () => {
+        try {
+          await this.#capture(identity);
+        } catch (error) {
+          if (!this.#abort.signal.aborted) this.ports.persistenceFailed(error);
+        } finally {
+          finish();
+        }
+      },
+    };
+    this.#jobs.set(key, job);
+    this.#queue.push(job);
+    this.#pump();
+    return true;
+  }
+  #pump(): void {
+    while (!this.#closed && this.#running < 2 && this.#queue.length) {
+      const job = this.#queue.shift()!;
+      this.#running++;
+      void job.run().finally(() => {
+        this.#running--;
+        this.#pump();
+      });
+    }
+  }
+  async #capture(identity: DeliveryIdentity): Promise<void> {
+    const { sessionId, turnId, messageId, source } = identity;
+    const existing = await this.ports.artifacts.findImageDelivery(
+      sessionId,
+      turnId,
+      messageId,
+      source,
+    );
+    if (existing?.imageDelivery?.status !== 'pending' && existing) return;
+    const metadata = { messageId, source };
+    const base = {
+      sessionId,
+      turnId,
+      name: 'chat-image',
+      source: 'tool_result_projection' as const,
+    };
+    const publish = async (input: Parameters<InteractiveArtifactStoreWriter['create']>[0]) =>
+      this.ports.admission.runOrJoin(sessionId, async () => {
+        if (this.#abort.signal.aborted || !(await this.ports.isPresent(sessionId))) return;
+        await this.ports.artifacts.create(input);
+      });
+    await publish({
+      ...base,
+      id: `chat_image_request_${deliveryKey(identity)}`,
+      kind: 'file',
+      content: '',
+      imageDelivery: { ...metadata, status: 'pending' },
+    });
+    if (this.#abort.signal.aborted || !(await this.ports.isPresent(sessionId))) return;
+    const signal = AbortSignal.any([this.#abort.signal, AbortSignal.timeout(10_000)]);
+    let image: ChatImageBytes;
+    try {
+      const path = localImagePath(source);
+      if (path !== undefined)
+        image = checkedChatImage((await this.ports.readLocalImage(sessionId, path, signal)).bytes);
+      else {
+        try {
+          image = await (this.ports.download ?? downloadChatImage)(source, signal);
+        } catch (error) {
+          if (
+            signal.aborted ||
+            (error instanceof ImageSourceError && error.reason !== 'download_failed')
+          )
+            throw error;
+          image = await (this.ports.download ?? downloadChatImage)(source, signal);
+        }
+      }
+    } catch (error) {
+      if (this.#abort.signal.aborted) return;
+      await publish({
+        ...base,
+        id: `chat_image_result_${deliveryKey(identity)}`,
+        kind: 'file',
+        content: '',
+        imageDelivery: { ...metadata, status: 'failed', reason: failureReason(error, source) },
+      });
+      return;
+    }
+    if (this.#abort.signal.aborted) return;
+    if (signal.aborted) {
+      await publish({
+        ...base,
+        id: `chat_image_result_${deliveryKey(identity)}`,
+        kind: 'file',
+        content: '',
+        imageDelivery: {
+          ...metadata,
+          status: 'failed',
+          reason: failureReason(signal.reason, source),
+        },
+      });
+      return;
+    }
+    try {
+      await publish({
+        ...base,
+        id: `chat_image_result_${deliveryKey(identity)}`,
+        kind: 'image',
+        content: image.bytes,
+        mimeType: image.mimeType,
+        imageDelivery: {
+          ...metadata,
+          status: 'ready',
+          contentSha256: createHash('sha256').update(image.bytes).digest('hex'),
+        },
+        imageArchiveLimits: this.ports.limits ?? DEFAULT_IMAGE_ARCHIVE_LIMITS,
+      });
+    } catch (error) {
+      if (!(error instanceof ImageArchiveQuotaError)) throw error;
+      await publish({
+        ...base,
+        id: `chat_image_result_${deliveryKey(identity)}`,
+        kind: 'file',
+        content: '',
+        imageDelivery: { ...metadata, status: 'failed', reason: 'quota_exceeded' },
+      });
+    }
+  }
+  beginDrain(): void {
+    this.#closed = true;
+    this.#abort.abort();
+    for (const stream of this.#streams.values()) clearTimeout(stream.timer);
+    this.#streams.clear();
+    for (const job of this.#queue.splice(0)) job.cancel();
+  }
+  async close(): Promise<void> {
+    this.beginDrain();
+    await this.waitForIdle();
+  }
+  async waitForIdle(): Promise<void> {
+    await Promise.all([...this.#jobs.values()].map((job) => job.done));
+  }
+}
+function deliveryKey(i: DeliveryIdentity): string {
+  return createHash('sha256')
+    .update(JSON.stringify([i.sessionId, i.turnId, i.messageId, i.source]))
+    .digest('hex');
+}
+function failureReason(error: unknown, source: string): ImageDeliveryFailure {
+  if (error instanceof ImageSourceError) return error.reason;
+  const code = (error as NodeJS.ErrnoException | undefined)?.code;
+  if (error instanceof Error && /supported raster|requires a PNG|not.*image/i.test(error.message))
+    return 'unsupported_mime';
+  if (code === 'ENOENT' || code === 'ENOTDIR') return 'not_found';
+  if (
+    code === 'EACCES' ||
+    code === 'EPERM' ||
+    (error instanceof Error && /sandbox|outside|permission/i.test(error.message))
+  )
+    return 'not_allowed';
+  return /^https?:/i.test(source) ? 'download_failed' : 'read_failed';
+}
diff --git a/packages/runtime-host/src/server/chat-image-markdown.ts b/packages/runtime-host/src/server/chat-image-markdown.ts
new file mode 100644
index 0000000000..0675689f67
--- /dev/null
+++ b/packages/runtime-host/src/server/chat-image-markdown.ts
@@ -0,0 +1,38 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { Marked } from 'marked';
+const parser = new Marked({ gfm: true });
+/** Parse actual Markdown nodes, excluding code, HTML and incomplete destinations. */
+export function chatImageSources(text: string): string[] {
+  if (!text.includes('![') || text.length > 1024 * 1024) return [];
+  const sources = new Set<string>();
+  parser.walkTokens(parser.lexer(text), (token) => {
+    if (token.type !== 'image') return;
+    const source = token.href;
+    if (
+      source.length > 0 &&
+      source.length <= 4096 &&
+      !/[\u0000-\u001f\u007f]/.test(source) &&
+      !source.startsWith('maka:')
+    )
+      sources.add(source);
+  });
+  return [...sources].slice(0, 64);
+}
diff --git a/packages/runtime-host/src/server/chat-image-source.ts b/packages/runtime-host/src/server/chat-image-source.ts
new file mode 100644
index 0000000000..ce271573cc
--- /dev/null
+++ b/packages/runtime-host/src/server/chat-image-source.ts
@@ -0,0 +1,157 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { lookup } from 'node:dns/promises';
+import { request as httpRequest } from 'node:http';
+import { request as httpsRequest } from 'node:https';
+import { isIP } from 'node:net';
+import { fileURLToPath } from 'node:url';
+import { sniffAttachmentMimeType } from '@maka/core/attachments';
+import {
+  ARTIFACT_IMAGE_PREVIEW_MAX_BYTES,
+  normalizeArtifactImagePreviewMime,
+} from '@maka/core/artifacts';
+import type { ImageDeliveryFailure } from '@maka/core/image-delivery';
+export class ImageSourceError extends Error {
+  constructor(readonly reason: ImageDeliveryFailure) {
+    super(reason);
+  }
+}
+export interface ChatImageBytes {
+  readonly bytes: Uint8Array;
+  readonly mimeType: string;
+}
+export function checkedChatImage(bytes: Uint8Array): ChatImageBytes {
+  if (bytes.byteLength > ARTIFACT_IMAGE_PREVIEW_MAX_BYTES) throw new ImageSourceError('too_large');
+  const mimeType = sniffAttachmentMimeType(bytes);
+  if (
+    !mimeType ||
+    !normalizeArtifactImagePreviewMime(mimeType) ||
+    !['image/png', 'image/jpeg', 'image/webp', 'image/gif'].includes(mimeType)
+  )
+    throw new ImageSourceError('unsupported_mime');
+  return { bytes, mimeType };
+}
+export function localImagePath(source: string): string | undefined {
+  if (/^https?:/i.test(source)) return undefined;
+  if (source.startsWith('file:')) {
+    try {
+      return fileURLToPath(source);
+    } catch {
+      throw new ImageSourceError('not_allowed');
+    }
+  }
+  if (/^[a-z][a-z0-9+.-]*:/i.test(source) && !/^[a-z]:[\\/]/i.test(source))
+    throw new ImageSourceError('not_allowed');
+  return source;
+}
+/** Pin DNS at connection time and check each redirect; never send cookies, auth or referer. */
+export async function downloadChatImage(
+  source: string,
+  signal: AbortSignal,
+): Promise<ChatImageBytes> {
+  let url = new URL(source);
+  for (let redirect = 0; redirect <= 3; redirect++) {
+    signal.throwIfAborted();
+    if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password)
+      throw new ImageSourceError('not_allowed');
+    const host = url.hostname.replace(/^\[|\]$/g, '');
+    // Literal loopback supports images served by this execution Host. Other private
+    // networks and DNS names resolving to them are never automatically fetched.
+    const literalLoopback = host === '127.0.0.1' || host === '::1';
+    const addresses = isIP(host)
+      ? [{ address: host, family: isIP(host) }]
+      : await abortableLookup(host, signal);
+    if (!addresses.length || (!literalLoopback && addresses.some((a) => !publicAddress(a.address))))
+      throw new ImageSourceError('not_allowed');
+    const target = addresses[0]!;
+    const response = await new Promise<import('node:http').IncomingMessage>((resolve, reject) => {
+      const req = (url.protocol === 'https:' ? httpsRequest : httpRequest)(
+        url,
+        {
+          signal,
+          headers: { accept: 'image/png,image/jpeg,image/webp,image/gif' },
+          lookup: (_host, options, callback) =>
+            options.all ? callback(null, [target]) : callback(null, target.address, target.family),
+        },
+        resolve,
+      );
+      req.on('error', reject);
+      req.end();
+    });
+    if ([301, 302, 303, 307, 308].includes(response.statusCode ?? 0) && response.headers.location) {
+      response.destroy();
+      const next = new URL(response.headers.location, url);
+      if (url.protocol === 'https:' && next.protocol !== 'https:')
+        throw new ImageSourceError('not_allowed');
+      url = next;
+      continue;
+    }
+    if (response.statusCode !== 200) {
+      response.destroy();
+      throw new ImageSourceError('download_failed');
+    }
+    const length = Number(response.headers['content-length']);
+    if (length > ARTIFACT_IMAGE_PREVIEW_MAX_BYTES) {
+      response.destroy();
+      throw new ImageSourceError('too_large');
+    }
+    const chunks: Buffer[] = [];
+    let size = 0;
+    for await (const chunk of response) {
+      size += chunk.length;
+      if (size > ARTIFACT_IMAGE_PREVIEW_MAX_BYTES) {
+        response.destroy();
+        throw new ImageSourceError('too_large');
+      }
+      chunks.push(Buffer.from(chunk));
+    }
+    return checkedChatImage(Buffer.concat(chunks, size));
+  }
+  throw new ImageSourceError('download_failed');
+}
+function publicAddress(address: string): boolean {
+  if (isIP(address) === 4) {
+    const [a = 0, b = 0] = address.split('.').map(Number);
+    return (
+      a > 0 &&
+      a !== 10 &&
+      a !== 127 &&
+      a < 224 &&
+      !(a === 169 && b === 254) &&
+      !(a === 172 && b >= 16 && b <= 31) &&
+      !(a === 192 && b === 168) &&
+      !(a === 100 && b >= 64 && b <= 127) &&
+      !(a === 198 && (b === 18 || b === 19))
+    );
+  }
+  // Only global-unicast IPv6 is eligible. Mapped IPv4/ULA/link-local are excluded.
+  return /^[23][0-9a-f]{3}:/i.test(address);
+}
+
+function abortableLookup(host: string, signal: AbortSignal) {
+  signal.throwIfAborted();
+  return new Promise<import('node:dns').LookupAddress[]>((resolve, reject) => {
+    const abort = () => reject(signal.reason);
+    signal.addEventListener('abort', abort, { once: true });
+    void lookup(host, { all: true })
+      .then(resolve, reject)
+      .finally(() => signal.removeEventListener('abort', abort));
+  });
+}
diff --git a/packages/runtime-host/src/server/execution-artifacts.ts b/packages/runtime-host/src/server/execution-artifacts.ts
index 9e63f59e94..9dc11f953e 100644
--- a/packages/runtime-host/src/server/execution-artifacts.ts
+++ b/packages/runtime-host/src/server/execution-artifacts.ts
@@ -17,10 +17,16 @@
  * under the License.
  */
 
+import { DEFAULT_IMAGE_ARCHIVE_LIMITS } from '@maka/core/image-delivery';
 import { createHash } from 'node:crypto';
 import { open, realpath, stat } from 'node:fs/promises';
 import { isAbsolute, resolve } from 'node:path';
 import { MAX_ATTACHMENT_BYTES } from '@maka/core/attachments';
+import {
+  ARTIFACT_IMAGE_PREVIEW_MAX_BYTES,
+  normalizeArtifactImagePreviewMime,
+} from '@maka/core/artifacts';
+import type { BuildBuiltinToolsOptions } from '@maka/runtime/builtin-tools';
 import {
   createToolResultArchiveCapability,
   type ToolResultArchiveCapability,
@@ -35,13 +41,17 @@ import type { ToolResultArchiveEvidenceReader } from '@maka/core/tool-result-arc
 import { type ToolArtifactRecorderInput } from '@maka/runtime/tool-artifacts';
 import type { ToolResultArchiveReaderInput } from '@maka/runtime/context-budget';
 import { type ToolResultArchiveResourceReadInput } from '@maka/runtime/tool-result-archive-resource';
-import type { InteractiveArtifactStoreWriter } from '@maka/storage/artifact-stores';
+import {
+  ImageArchiveQuotaError,
+  type InteractiveArtifactStoreWriter,
+} from '@maka/storage/artifact-stores';
 import type { SessionManagerDeps } from '@maka/runtime/session-manager';
 import type { SessionAdmissionGate } from './session-admission-gate.js';
 import type { SessionPresenceReader } from './session-presence.js';
 
 export interface HostExecutionArtifactServices {
   recordToolArtifacts(event: ToolArtifactRecorderInput): Promise<void>;
+  publishImage: NonNullable<BuildBuiltinToolsOptions['publishImage']>;
   publishChildWorkspacePatch: NonNullable<SessionManagerDeps['publishChildWorkspacePatch']>;
   /**
    * New archives use the Session ledger. Legacy Artifact refs are retained as
@@ -56,12 +66,13 @@ export function createHostExecutionArtifactServices(input: {
   sessionAdmission: SessionAdmissionGate;
   sessions: SessionPresenceReader;
   archiveEvidence?: ToolResultArchiveEvidenceReader;
+  imageArchiveLimits?: import('@maka/core/image-delivery').ImageArchiveLimits;
 }): HostExecutionArtifactServices {
   const runWrite = async <T>(operation: () => Promise<T>): Promise<T> => {
     try {
       return await operation();
     } catch (error) {
-      input.requestDrain();
+      if (!(error instanceof ImageArchiveQuotaError)) input.requestDrain();
       throw error;
     }
   };
@@ -118,6 +129,37 @@ export function createHostExecutionArtifactServices(input: {
   };
   const services: HostExecutionArtifactServices = {
     recordToolArtifacts,
+    publishImage: async (image) => {
+      const mimeType = normalizeArtifactImagePreviewMime(image.mimeType);
+      if (!mimeType || image.bytes.byteLength > ARTIFACT_IMAGE_PREVIEW_MAX_BYTES)
+        throw new Error(
+          'Image cannot be displayed in chat; use a PNG/JPEG/GIF/WebP of at most 2 MiB.',
+        );
+      const id = `published_image_${createHash('sha256')
+        .update(JSON.stringify([image.sessionId, image.turnId, image.toolCallId]))
+        .digest('hex')}`;
+      const artifact = await publish({
+        id,
+        sessionId: image.sessionId,
+        turnId: image.turnId,
+        name: image.name,
+        kind: 'image',
+        content: image.bytes,
+        mimeType,
+        source: 'tool_result_projection',
+        summary: 'Published chat image',
+        imageDelivery: {
+          messageId: image.toolCallId,
+          source: `published:${image.toolCallId}`,
+          status: 'ready',
+          contentSha256: createHash('sha256').update(image.bytes).digest('hex'),
+        },
+        imageArchiveLimits: input.imageArchiveLimits ?? DEFAULT_IMAGE_ARCHIVE_LIMITS,
+      });
+      if (!artifact)
+        throw new Error('The session was removed before the image could be published.');
+      return { kind: 'session_file', sessionId: image.sessionId, relativePath: artifact.id };
+    },
     publishChildWorkspacePatch: async ({ sessionId, turnId, binding, patch }) => {
       const artifact = await publish({
         id: subagentWritebackArtifactId(sessionId, turnId),
diff --git a/packages/runtime-host/src/server/execution-composition.ts b/packages/runtime-host/src/server/execution-composition.ts
index 2771c1605c..431f906414 100644
--- a/packages/runtime-host/src/server/execution-composition.ts
+++ b/packages/runtime-host/src/server/execution-composition.ts
@@ -17,6 +17,9 @@
  * under the License.
  */
 
+import { createImageFileReader } from '@maka/runtime/image-file-reader';
+import { ChatImageDeliveryService } from './chat-image-delivery.js';
+import { checkedChatImage } from './chat-image-source.js';
 import { createWorkHubResultRuntime } from './workhub-result-runtime.js';
 import { createWorkHubInspectionTool } from './workhub-inspection-tool.js';
 import { copyWorkHubAttachmentsToTarget } from './workhub-message-attachments.js';
@@ -312,6 +315,7 @@ export interface CreateExecutionRuntimeHostCompositionOptions {
   readonly bootstrapRuntimePolicy?: boolean;
   readonly skillHomeDirectory?: string;
   readonly projectDirectoryRoots?: readonly PublishedProjectDirectoryRoot[];
+  readonly imageArchiveLimits?: import('@maka/core/image-delivery').ImageArchiveLimits;
 }
 
 export interface ExecutionRuntimeHostCompositionDependencies {
@@ -363,6 +367,7 @@ export async function createExecutionRuntimeHostComposition(
   let sessionEffects: HostSessionEffectCoordinator | undefined;
   let promptSuggestions: HostPromptSuggestionCoordinator | undefined;
   let memoryExtraction: HostMemoryExtractionCoordinator | undefined;
+  let imageDelivery: ChatImageDeliveryService | undefined;
   let unsubscribeTranscriptChanges: (() => void) | undefined;
   let unsubscribeRuntimeEventCommits: (() => void) | undefined;
   let transcriptReader: SessionTranscriptReader | undefined;
@@ -565,18 +570,95 @@ export async function createExecutionRuntimeHostComposition(
     });
     archiveEvidence = await openToolResultArchiveEvidenceReader(context.owner.lease);
     const executionArtifacts = createHostExecutionArtifactServices({
+      ...(options.imageArchiveLimits ? { imageArchiveLimits: options.imageArchiveLimits } : {}),
       archiveEvidence,
       artifacts: openedArtifactStore,
       requestDrain: context.requestDrain,
       sessionAdmission,
       sessions: stores.sessionStore,
     });
+    const localImageReader = createImageFileReader({
+      ...(filesystemWorker ? { filesystemWorker } : {}),
+    });
+    imageDelivery = new ChatImageDeliveryService({
+      artifacts: openedArtifactStore,
+      ...(options.imageArchiveLimits ? { limits: options.imageArchiveLimits } : {}),
+      admission: sessionAdmission,
+      isPresent: async (sessionId) =>
+        (await stores.sessionStore.probeSessionRemoval(sessionId)).kind === 'present',
+      acquireResidency: () => context.acquireResidency('chat-image-delivery'),
+      persistenceFailed: (error) => {
+        console.warn('[runtime-host] Image delivery persistence failed', error);
+        context.requestDrain();
+      },
+      readLocalImage: async (sessionId, path, abortSignal) => {
+        const [header, boundary] = await Promise.all([
+          stores.sessionStore.readHeaderSnapshot(sessionId),
+          stores.sessionStore.readExecutionBoundary(sessionId),
+        ]);
+        const result = await localImageReader({
+          path,
+          cwd: header.cwd,
+          permissionMode: header.permissionMode,
+          executionBoundary: boundary,
+          abortSignal,
+        });
+        return checkedChatImage(result.bytes);
+      },
+      readMessage: async (identity) => {
+        await requireSessionManager(manager).ensureTranscriptLedgerForRead(identity.sessionId);
+        const [turn] = await stores.runtimeEventStore.readTranscriptTurns(identity.sessionId, {
+          turnId: identity.turnId,
+        });
+        if (!turn) return undefined;
+        for (
+          let position = turn.firstOrdinal, runs = 0;
+          position <= turn.lastOrdinal && runs < 16;
+          runs++
+        ) {
+          const found = await stores.runtimeEventStore.readTranscriptRun(
+            identity.sessionId,
+            {
+              direction: 'newer',
+              throughOrdinal: turn.lastOrdinal,
+              position,
+              maxEvents: 4096,
+              maxBytes: 16 * 1024 * 1024,
+              maxRecordBytes: 8 * 1024 * 1024,
+            },
+            (run, events) => {
+              let text: string | undefined;
+              for (const { event } of events) {
+                if (
+                  event.partial ||
+                  event.turnId !== identity.turnId ||
+                  event.role !== 'model' ||
+                  event.content?.kind !== 'text'
+                )
+                  continue;
+                if (
+                  (event.refs?.storedMessageId ?? event.refs?.providerEventId ?? event.id) ===
+                  identity.messageId
+                )
+                  text = event.content.text;
+              }
+              return { text, next: run.lastOrdinal + 1 };
+            },
+          );
+          if (!found) break;
+          if (found.text !== undefined) return found.text;
+          position = found.next;
+        }
+        return undefined;
+      },
+    });
     // Shared with recall's material fetch, so a file brought in from another
     // Session is answered by the same reader that answers one stored here.
     const attachmentResources = createArtifactAttachmentResourceReader({
       artifactStore: openedArtifactStore,
     });
     const builtinTools = {
+      publishImage: executionArtifacts.publishImage,
       shellRuns: runtimeResources,
       runtimeResources,
       attachmentResources,
@@ -1778,6 +1860,7 @@ export async function createExecutionRuntimeHostComposition(
       Date.now,
       context.sessionAccessAuthority,
       (sessionId, artifactId) => hostChanges.publishArtifactDeleted(sessionId, artifactId),
+      imageDelivery,
     );
     rootCoordinator = new RootTurnCoordinator(
       manager,
@@ -1828,6 +1911,7 @@ export async function createExecutionRuntimeHostComposition(
       // Fresh WorkHub Turns use the coordinating Agent directly. Persisted
       // routing decisions remain readable for recovery of historical Turns.
       undefined,
+      (sessionId, event) => imageDelivery?.observe(sessionId, event),
     );
     const coordinator = rootCoordinator;
     const pluginModel = createHostPluginModel({
@@ -3144,6 +3228,7 @@ export async function createExecutionRuntimeHostComposition(
           () => workspaceExecution?.beginDrain(),
           () => runtimeResources?.beginDrain(),
           () => messages.beginDrain(),
+          () => imageDelivery?.beginDrain(),
           () => interactions.beginDrain(),
           () => sessionEffects?.beginDrain(),
           () => promptSuggestions?.beginDrain(),
@@ -3156,6 +3241,7 @@ export async function createExecutionRuntimeHostComposition(
             await rootCloseTask;
           },
           () => workHubResults?.coordinator.close(),
+          () => imageDelivery?.close(),
           () => runtimeResources?.close(),
           () => workspaceExecution?.close(),
           () => sessionEffects?.close(),
@@ -3338,6 +3424,7 @@ export async function createExecutionRuntimeHostComposition(
     }
     goalExecutions?.beginDrain();
     try {
+      await imageDelivery?.close();
       await workspaceExecution?.close();
     } catch (closeError) {
       errors.push(closeError);
diff --git a/packages/runtime-host/src/server/root-turn-coordinator.ts b/packages/runtime-host/src/server/root-turn-coordinator.ts
index 3ad565a90b..782b013711 100644
--- a/packages/runtime-host/src/server/root-turn-coordinator.ts
+++ b/packages/runtime-host/src/server/root-turn-coordinator.ts
@@ -387,6 +387,13 @@ export class RootTurnCoordinator implements HostedExecutionAuthority {
     private readonly prepareWorkHubRoutingDecision?: (
       input: HostWorkHubRoutingDecisionPreparation,
     ) => Promise<WorkHubRoutingDecision | undefined>,
+    private readonly observeAssistantText?: (
+      sessionId: string,
+      event:
+        | import('@maka/core/events').TextDeltaEvent
+        | import('@maka/core/events').TextCompleteEvent
+        | import('@maka/core/events').CompleteEvent,
+    ) => void,
   ) {
     this.stores = authenticateExecutionStoresWriter(stores, 'interactive');
     this.executionProjection = new HostedExecutionProjectionReader(this.stores);
@@ -3227,6 +3234,17 @@ export class RootTurnCoordinator implements HostedExecutionAuthority {
               // Presentation observers do not participate in execution authority.
             }
           }
+          if (
+            event.type === 'text_delta' ||
+            event.type === 'text_complete' ||
+            event.type === 'complete'
+          ) {
+            try {
+              this.observeAssistantText?.(input.sessionId, event);
+            } catch {
+              // Image presentation must never interrupt canonical execution.
+            }
+          }
           if (isRuntimeSessionForwardedEvent(event)) {
             await this.continuity.acceptRuntimeEvent(input.sessionId, active.runId, event);
           } else if (isInteractionAnswerAck(event)) {
diff --git a/packages/runtime/package.json b/packages/runtime/package.json
index 0367cf3a1d..3c4841a2df 100644
--- a/packages/runtime/package.json
+++ b/packages/runtime/package.json
@@ -11,6 +11,7 @@
     "./ai-sdk-backend": "./dist/ai-sdk-backend.js",
     "./mcp-tools": "./dist/mcp-tools.js",
     "./read-page": "./dist/read-page.js",
+    "./image-file-reader": "./dist/image-file-reader.js",
     "./builtin-tools": "./dist/builtin-tools.js",
     "./shell-tools": "./dist/shell-tools.js",
     "./shell-run-manager": "./dist/shell-run-manager.js",
diff --git a/packages/runtime/src/__tests__/builtin-tools-file-worker.test.ts b/packages/runtime/src/__tests__/builtin-tools-file-worker.test.ts
index 23ffb57840..cd8793c884 100644
--- a/packages/runtime/src/__tests__/builtin-tools-file-worker.test.ts
+++ b/packages/runtime/src/__tests__/builtin-tools-file-worker.test.ts
@@ -26,6 +26,7 @@ import { createManagedExecutionBoundary } from '@maka/core/sandbox-boundary';
 import { createWorkspaceWritePermissionProfile } from '@maka/core/permission-profile';
 import { createReadOnlyPermissionProfile } from '@maka/core/permission-profile';
 
+import { createImageFileReader } from '../image-file-reader.js';
 import { buildBuiltinTools } from '../builtin-tools.js';
 import { createBoundaryFilesystemExecutor } from '../filesystem-executor.js';
 import { createLocalWorkspaceExecutor } from '../workspace-executor.js';
@@ -41,6 +42,42 @@ afterEach(async () => {
 });
 
 describe('builtin file tools use the sandboxed worker', () => {
+  test('PublishImage never publishes when the image read is refused or invalid', async () => {
+    const cwd = await temporaryDirectory('maka-publish-image-admission-');
+    let published = 0;
+    const tools = buildBuiltinTools({
+      publishImage: async () => {
+        published++;
+        return { kind: 'session_file', sessionId: 'session-1', relativePath: 'image-1' };
+      },
+    });
+    // The same managed boundary as Read: no fallback to an unsandboxed host read.
+    await assert.rejects(
+      runTool(tools, 'PublishImage', { path: 'private.png' }, cwd),
+      /worker|sandbox/i,
+    );
+    assert.equal(published, 0);
+    await writeFile(join(cwd, 'text.txt'), 'not an image');
+    const tool = tools.find((tool) => tool.name === 'PublishImage')!;
+    await assert.rejects(
+      async () =>
+        tool.impl(
+          { path: 'text.txt' },
+          {
+            sessionId: 'session-1',
+            turnId: 'turn-1',
+            toolCallId: 'publish',
+            cwd,
+            permissionMode: 'bypass',
+            executionBoundary: { kind: 'bypass', revision: 0 },
+            abortSignal: new AbortController().signal,
+            emitOutput() {},
+          },
+        ),
+      /requires a PNG/,
+    );
+    assert.equal(published, 0);
+  });
   test('direct Read rejects invalid coordinates before selecting any backend', async () => {
     const cwd = await temporaryDirectory('maka-read-coordinates-');
     await writeFile(join(cwd, 'sample.txt'), 'one\ntwo\nthree');
@@ -613,3 +650,28 @@ async function temporaryDirectory(prefix: string): Promise<string> {
   cleanup.push(path);
   return await realpath(path);
 }
+
+test('chat image reader uses the managed Read boundary and never falls back to host filesystem', async () => {
+  const cwd = await temporaryDirectory('maka-delivery-reader-');
+  const executionBoundary = createManagedExecutionBoundary(createReadOnlyPermissionProfile(), 0);
+  await assert.rejects(
+    createImageFileReader()({ path: 'private.png', cwd, executionBoundary }),
+    /worker|sandbox/i,
+  );
+  let calls = 0;
+  const reader = createImageFileReader({
+    filesystemWorker: {
+      execute: async (input) => {
+        calls++;
+        assert.deepEqual(input.executionBoundary, executionBoundary);
+        assert.deepEqual(input.operation, { kind: 'read', path: 'private.png' });
+        throw new Error('sandbox permission refused');
+      },
+    },
+  });
+  await assert.rejects(
+    reader({ path: 'private.png', cwd, executionBoundary }),
+    /permission refused/,
+  );
+  assert.equal(calls, 1);
+});
diff --git a/packages/runtime/src/__tests__/tool-availability.test.ts b/packages/runtime/src/__tests__/tool-availability.test.ts
index 433ba95708..d7240b362e 100644
--- a/packages/runtime/src/__tests__/tool-availability.test.ts
+++ b/packages/runtime/src/__tests__/tool-availability.test.ts
@@ -124,13 +124,15 @@ describe('ToolAvailabilityRuntime — search activation', () => {
 
   test('a group cannot defer the fixed direct baseline', () => {
     const plan = new ToolAvailabilityRuntime(
-      [tool('Read'), tool('browser_click')],
-      { groups: [{ id: 'bad-source', toolNames: ['Read', 'browser_click'] }] },
+      [tool('Read'), tool('PublishImage'), tool('browser_click')],
+      { groups: [{ id: 'bad-source', toolNames: ['Read', 'PublishImage', 'browser_click'] }] },
       invalid,
     ).prepare(new Map());
     assert.ok(plan.activeTools.includes('Read'));
+    assert.ok(plan.activeTools.includes('PublishImage'));
     assert.ok(!plan.activeTools.includes('browser_click'));
     assert.doesNotMatch(searchTool(plan).description, /- Read/);
+    assert.doesNotMatch(searchTool(plan).description, /- PublishImage/);
   });
 
   test('skill discovery tools stay direct while search is enabled', () => {
diff --git a/packages/runtime/src/builtin-tools.ts b/packages/runtime/src/builtin-tools.ts
index df4d176468..3ec9a9de73 100644
--- a/packages/runtime/src/builtin-tools.ts
+++ b/packages/runtime/src/builtin-tools.ts
@@ -43,7 +43,11 @@ import {
 import { tmpdir } from 'node:os';
 import { basename, dirname, isAbsolute } from 'node:path';
 import { compilePermissionProfile } from '@maka/core/permission-profile-compiler';
-import { parseAttachmentResourceRef } from '@maka/core/attachments';
+import { formatAttachmentResourceRef, parseAttachmentResourceRef } from '@maka/core/attachments';
+import {
+  ARTIFACT_IMAGE_PREVIEW_MAX_BYTES,
+  normalizeArtifactImagePreviewMime,
+} from '@maka/core/artifacts';
 import { type SandboxBoundaryExpansion } from '@maka/core/sandbox-boundary';
 import { isStorageRef, type StorageRef, type ToolResultContent } from '@maka/core/events';
 import { type PermissionProfile } from '@maka/core/permission-profile';
@@ -205,6 +209,15 @@ export interface BuildBuiltinToolsOptions {
     mimeType: string;
   }) => Promise<Extract<StorageRef, { kind: 'session_context' }>>;
   releaseImageSnapshot?: (input: { sessionId: string; refId: string }) => Promise<void>;
+  /** Publish bytes already admitted by the filesystem read boundary. */
+  publishImage?: (input: {
+    sessionId: string;
+    turnId: string;
+    toolCallId: string;
+    name: string;
+    bytes: Uint8Array;
+    mimeType: string;
+  }) => Promise<Extract<StorageRef, { kind: 'session_file' }>>;
 }
 
 export function buildBuiltinTools(options: BuildBuiltinToolsOptions = {}): MakaTool[] {
@@ -295,6 +308,59 @@ export function buildBuiltinTools(options: BuildBuiltinToolsOptions = {}): MakaT
   const tools: MakaTool[] = [
     ...bashTools,
     ...backgroundTools,
+    ...(options.publishImage
+      ? [
+          {
+            name: 'PublishImage',
+            activityKind: 'read' as const,
+            description:
+              'Publish a local PNG/JPEG/GIF/WebP image as a durable attachment in the current chat. ' +
+              'Use this after generating a screenshot or image to show it to the user. ' +
+              'Returns a resource URL and ready-to-use Markdown. Use this to save a copy before deleting or replacing the source; ordinary image Markdown is captured automatically by the Host. ' +
+              'Images must be at most 2 MiB; resize larger images first. File access uses the same permissions as Read.',
+            parameters: z.object({
+              path: z
+                .string()
+                .describe('Local image path; relative paths resolve from the session cwd.'),
+            }),
+            executionFacts,
+            impl: async ({ path }: { path: string }, ctx: MakaToolContext) => {
+              const result = await filesystem.execute({
+                operation: { kind: 'read', path },
+                ...filesystemCall(ctx),
+              });
+              if (
+                result.kind !== 'read_image' ||
+                !normalizeArtifactImagePreviewMime(result.mimeType)
+              )
+                throw new Error('PublishImage requires a PNG, JPEG, GIF, or WebP image.');
+              if (result.bytes.byteLength > ARTIFACT_IMAGE_PREVIEW_MAX_BYTES)
+                throw new Error(
+                  'Image exceeds the 2 MiB chat preview limit; resize it before publishing.',
+                );
+              ctx.abortSignal.throwIfAborted();
+              const ref = await options.publishImage!({
+                sessionId: ctx.sessionId,
+                turnId: ctx.turnId,
+                toolCallId: ctx.toolCallId,
+                name: basename(path),
+                bytes: result.bytes,
+                mimeType: result.mimeType,
+              });
+              const resource =
+                ref.sessionId === ctx.sessionId ? formatAttachmentResourceRef(ref) : null;
+              if (!resource)
+                throw new Error('Image publication did not return a valid session attachment.');
+              const name = basename(path).replace(/[\[\]\\\r\n]/g, '_');
+              return {
+                published: true,
+                resource,
+                markdown: `![${name}](${resource})`,
+              };
+            },
+          } satisfies MakaTool,
+        ]
+      : []),
     {
       name: 'Read',
       activityKind: 'read',
diff --git a/packages/runtime/src/image-file-reader.ts b/packages/runtime/src/image-file-reader.ts
new file mode 100644
index 0000000000..e283c0f506
--- /dev/null
+++ b/packages/runtime/src/image-file-reader.ts
@@ -0,0 +1,44 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import type { BuildBuiltinToolsOptions } from './builtin-tools.js';
+import {
+  createBoundaryFilesystemExecutor,
+  type FilesystemExecuteInput,
+} from './filesystem-executor.js';
+import { createLocalWorkspaceExecutor } from './workspace-executor.js';
+/** The same filesystem boundary as Read, without model snapshots or tool execution. */
+export function createImageFileReader(
+  options: Pick<
+    BuildBuiltinToolsOptions,
+    'executor' | 'filesystemWorker' | 'permissionProfile'
+  > = {},
+) {
+  const filesystem = createBoundaryFilesystemExecutor({
+    workspace: options.executor ?? createLocalWorkspaceExecutor(),
+    ...(options.filesystemWorker ? { worker: options.filesystemWorker } : {}),
+    ...(options.permissionProfile ? { permissionProfile: options.permissionProfile } : {}),
+  });
+  return async (input: Omit<FilesystemExecuteInput, 'operation'> & { path: string }) => {
+    const { path, ...context } = input;
+    const result = await filesystem.execute({ ...context, operation: { kind: 'read', path } });
+    if (result.kind !== 'read_image') throw new Error('Not a supported raster image');
+    return { bytes: result.bytes, mimeType: result.mimeType };
+  };
+}
diff --git a/packages/runtime/src/system-prompt/main-session-prompt.ts b/packages/runtime/src/system-prompt/main-session-prompt.ts
index d7fc83a0d4..eab9df35ad 100644
--- a/packages/runtime/src/system-prompt/main-session-prompt.ts
+++ b/packages/runtime/src/system-prompt/main-session-prompt.ts
@@ -52,6 +52,9 @@ Keep simple answers simple; do not add headings or lists to simple answers.
 Use short headings and flat lists to organize longer answers.
 Use fenced code blocks for multiline code and backticks for inline commands, paths, identifiers, and literal values.
 Prefer descriptive link text for external sources when it is available.
+To deliver a generated screenshot or local image, include a Markdown image with its absolute path. The Host automatically saves supported images referenced in assistant messages as session attachments; HTTP/HTTPS images can also be embedded directly. Reading an image for your own inspection does not deliver it.
+If you need to delete or replace the source file immediately, use PublishImage when available first and include its returned Markdown. Keep source files available until capture finishes. Images above the automatic save limit may be displayed without a saved copy.
+Only claim an image was saved after publication succeeds. Saving does not confirm that the client displayed it.
 Follow a more specific format requested by the user or task.`;
 }
 
diff --git a/packages/runtime/src/tool-availability.ts b/packages/runtime/src/tool-availability.ts
index 182a854d03..12d9803c9c 100644
--- a/packages/runtime/src/tool-availability.ts
+++ b/packages/runtime/src/tool-availability.ts
@@ -39,6 +39,7 @@ export const TOOL_SEARCH_MAX_SCHEMA_CHARS = 64 * 1024;
 const DIRECT_TOOL_NAMES: ReadonlySet<string> = new Set([
   'Bash',
   'Read',
+  'PublishImage',
   'Write',
   'Edit',
   'Glob',
diff --git a/packages/storage/src/artifact-image-storage.ts b/packages/storage/src/artifact-image-storage.ts
new file mode 100644
index 0000000000..a24ec5540d
--- /dev/null
+++ b/packages/storage/src/artifact-image-storage.ts
@@ -0,0 +1,74 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import type { ArtifactRecord } from '@maka/core/artifacts';
+import type { ImageArchiveLimits, ImageDeliveryMetadata } from '@maka/core/image-delivery';
+
+export class ImageArchiveQuotaError extends Error {
+  readonly name = 'ImageArchiveQuotaError';
+  constructor() {
+    super('Image archive quota exceeded');
+  }
+}
+
+/** Pure policy, evaluated by ArtifactStore while holding its writer lock.
+ * Budgets count unique archived content; the store shares payloads with hard links. */
+export function planImageArchive(
+  records: readonly ArtifactRecord[],
+  input: {
+    sessionId: string;
+    content: string | Uint8Array;
+    imageDelivery?: ImageDeliveryMetadata;
+    imageArchiveLimits?: ImageArchiveLimits;
+  },
+) {
+  const digest =
+    input.imageDelivery?.status === 'ready' ? input.imageDelivery.contentSha256 : undefined;
+  const size = Buffer.byteLength(input.content);
+  const limits = input.imageArchiveLimits;
+  if (digest && limits) {
+    if (
+      ![limits.sessionBytes, limits.workspaceBytes].every((v) => Number.isSafeInteger(v) && v >= 0)
+    )
+      throw new Error('Invalid image archive limits');
+    const unique = new Map<string, number>();
+    const sessionUnique = new Map<string, number>();
+    for (const record of records) {
+      const hash = record.imageDelivery?.contentSha256;
+      if (record.imageDelivery?.status !== 'ready' || !hash) continue;
+      unique.set(hash, record.sizeBytes);
+      if (record.sessionId === input.sessionId) sessionUnique.set(hash, record.sizeBytes);
+    }
+    const sum = (values: Map<string, number>) => [...values.values()].reduce((a, b) => a + b, 0);
+    if (
+      sum(unique) + (unique.has(digest) ? 0 : size) > limits.workspaceBytes ||
+      sum(sessionUnique) + (sessionUnique.has(digest) ? 0 : size) > limits.sessionBytes
+    )
+      throw new ImageArchiveQuotaError();
+  }
+  const sameContent = digest
+    ? records.find(
+        (r) =>
+          r.imageDelivery?.status === 'ready' &&
+          r.imageDelivery.contentSha256 === digest &&
+          r.sizeBytes === size,
+      )
+    : undefined;
+  return { digest, sameContent };
+}
diff --git a/packages/storage/src/artifact-metadata-codec.ts b/packages/storage/src/artifact-metadata-codec.ts
index adabf324a5..c559baba2e 100644
--- a/packages/storage/src/artifact-metadata-codec.ts
+++ b/packages/storage/src/artifact-metadata-codec.ts
@@ -17,6 +17,7 @@
  * under the License.
  */
 
+import { isImageDeliveryMetadata } from '@maka/core/image-delivery';
 import { isAbsolute } from 'node:path';
 import {
   ARTIFACT_KINDS,
@@ -42,6 +43,7 @@ const ARTIFACT_RECORD_KEYS = new Set([
   'mimeType',
   'source',
   'summary',
+  'imageDelivery',
   'deepResearchRole',
 ]);
 
@@ -111,6 +113,7 @@ function decodeArtifactRecord(value: unknown, index: number): ArtifactRecord {
     value.sizeBytes < 0 ||
     !isOptionalNonEmptyString(value.mimeType) ||
     !isOptionalNonEmptyString(value.summary) ||
+    (value.imageDelivery !== undefined && !isImageDeliveryMetadata(value.imageDelivery)) ||
     typeof value.source !== 'string'
   ) {
     throw invalidMetadataRecord(index);
diff --git a/packages/storage/src/artifact-store.ts b/packages/storage/src/artifact-store.ts
index 151a2b7a2a..13806e7616 100644
--- a/packages/storage/src/artifact-store.ts
+++ b/packages/storage/src/artifact-store.ts
@@ -17,6 +17,12 @@
  * under the License.
  */
 
+import { planImageArchive } from './artifact-image-storage.js';
+import {
+  isImageDeliveryMetadata,
+  type ImageDeliveryMetadata,
+  type ImageArchiveLimits,
+} from '@maka/core/image-delivery';
 import { createHash, randomUUID } from 'node:crypto';
 import { isDeepStrictEqual } from 'node:util';
 import { type BigIntStats, constants as fsConstants } from 'node:fs';
@@ -24,6 +30,7 @@ import {
   access,
   copyFile,
   lstat,
+  link,
   mkdir,
   open,
   readFile,
@@ -104,6 +111,8 @@ export interface CreateArtifactInput {
   summary?: string;
   now?: number;
   id?: string;
+  imageDelivery?: ImageDeliveryMetadata;
+  imageArchiveLimits?: ImageArchiveLimits;
 }
 
 export type ArtifactListRevision = `sha256:${string}`;
@@ -189,6 +198,12 @@ export interface ArtifactUpgradeCleanupResult {
 
 export interface ArtifactAuthorityStore extends DurableArtifactAttachmentReader {
   create(input: CreateArtifactInput): Promise<ArtifactRecord>;
+  findImageDelivery(
+    sessionId: string,
+    turnId: string,
+    messageId: string,
+    source: string,
+  ): Promise<ArtifactRecord | undefined>;
   close(): void;
   copyConversationArtifacts(
     input: ConversationArtifactCopyInput,
@@ -269,11 +284,36 @@ class SqliteArtifactStore implements ArtifactAuthorityStore {
     this.metadataRepository.close();
   }
 
+  async findImageDelivery(
+    sessionId: string,
+    turnId: string,
+    messageId: string,
+    source: string,
+  ): Promise<ArtifactRecord | undefined> {
+    return this.enqueue(async () =>
+      this.metadataRepository.findImageDelivery(sessionId, turnId, messageId, source),
+    );
+  }
+
   async create(input: CreateArtifactInput): Promise<ArtifactRecord> {
     const acceptedInput: CreateArtifactInput = Object.freeze({
       ...input,
+      ...(input.imageDelivery ? { imageDelivery: Object.freeze({ ...input.imageDelivery }) } : {}),
+      ...(input.imageArchiveLimits
+        ? { imageArchiveLimits: Object.freeze({ ...input.imageArchiveLimits }) }
+        : {}),
       content: typeof input.content === 'string' ? input.content : new Uint8Array(input.content),
     });
+    if (
+      acceptedInput.imageDelivery !== undefined &&
+      !isImageDeliveryMetadata(acceptedInput.imageDelivery)
+    )
+      throw new Error('Invalid image delivery metadata');
+    if (
+      acceptedInput.imageDelivery?.status === 'ready' &&
+      acceptedInput.imageDelivery.contentSha256 !== sha256(Buffer.from(acceptedInput.content))
+    )
+      throw new Error('Image delivery digest does not match its bytes');
     const id = acceptedInput.id ?? randomUUID();
     if (!ARTIFACT_KIND_SET.has(acceptedInput.kind)) throw new Error('Invalid Artifact kind');
     if (!ARTIFACT_SOURCE_SET.has(acceptedInput.source)) {
@@ -301,6 +341,7 @@ class SqliteArtifactStore implements ArtifactAuthorityStore {
           relativePath,
         });
       }
+      const { digest, sameContent } = planImageArchive(this.records, acceptedInput);
       return this.publishNewArtifactUnlocked(
         {
           id,
@@ -313,8 +354,20 @@ class SqliteArtifactStore implements ArtifactAuthorityStore {
           ...(acceptedInput.mimeType ? { mimeType: acceptedInput.mimeType } : {}),
           source: acceptedInput.source,
           ...(acceptedInput.summary ? { summary: acceptedInput.summary } : {}),
+          ...(acceptedInput.imageDelivery ? { imageDelivery: acceptedInput.imageDelivery } : {}),
+        },
+        async (targetPath) => {
+          if (sameContent) {
+            const source = await this.prepareRecordRead(sameContent, sameContent.sizeBytes);
+            if (
+              source.ok &&
+              (await hashPreparedArtifact(source)) === digest &&
+              (await tryLinkImagePayload(source.path, targetPath))
+            )
+              return;
+          }
+          await writeFile(targetPath, acceptedInput.content, { flag: 'wx' });
         },
-        (targetPath) => writeFile(targetPath, acceptedInput.content, { flag: 'wx' }),
       );
     });
   }
@@ -444,7 +497,18 @@ class SqliteArtifactStore implements ArtifactAuthorityStore {
       }
       return this.publishNewArtifactUnlocked(
         expected,
-        (targetPath) => copyFile(prepared.path, targetPath, fsConstants.COPYFILE_EXCL),
+        async (targetPath) => {
+          if (source.imageDelivery?.status === 'ready') {
+            const current = await this.prepareRecordRead(source, source.sizeBytes);
+            if (
+              !current.ok ||
+              (await hashPreparedArtifact(current)) !== source.imageDelivery.contentSha256
+            )
+              throw artifactReplayConflict(source.id);
+            if (await tryLinkImagePayload(current.path, targetPath)) return;
+          }
+          await copyFile(prepared.path, targetPath, fsConstants.COPYFILE_EXCL);
+        },
         source.sizeBytes,
       );
     });
@@ -600,6 +664,7 @@ class SqliteArtifactStore implements ArtifactAuthorityStore {
       existing.mimeType !== optionalCanonicalText(input.mimeType) ||
       existing.source !== input.source ||
       existing.summary !== optionalCanonicalText(input.summary) ||
+      !isDeepStrictEqual(existing.imageDelivery, input.imageDelivery) ||
       (input.now !== undefined && existing.createdAt !== input.now)
     ) {
       throw artifactReplayConflict(canonical.id);
@@ -1331,3 +1396,19 @@ function sniffAllowedBinaryMime(bytes: Uint8Array): string | null {
     return 'image/svg+xml';
   return null;
 }
+
+async function tryLinkImagePayload(source: string, target: string): Promise<boolean> {
+  try {
+    await link(source, target);
+    return true;
+  } catch (error) {
+    // Filesystems without hard links retain the regular write/copy fallback.
+    if (
+      !['ENOTSUP', 'EPERM', 'EXDEV', 'EACCES'].includes(
+        String((error as NodeJS.ErrnoException).code),
+      )
+    )
+      throw error;
+    return false;
+  }
+}
diff --git a/packages/storage/src/artifact-stores.ts b/packages/storage/src/artifact-stores.ts
index bf950c22e7..86874feed7 100644
--- a/packages/storage/src/artifact-stores.ts
+++ b/packages/storage/src/artifact-stores.ts
@@ -28,6 +28,7 @@ import {
   type DurableArtifactAttachmentReader,
 } from './artifact-store.js';
 
+export { ImageArchiveQuotaError } from './artifact-image-storage.js';
 export { sanitizeArtifactName } from './artifact-store.js';
 import {
   assertStorageRootLease,
@@ -57,6 +58,7 @@ export interface InteractiveArtifactStoreWriter extends DurableArtifactAttachmen
   readonly access: 'write';
   readonly [writerBrand]: true;
   create(input: CreateArtifactInput): Promise<ArtifactRecord>;
+  findImageDelivery: ArtifactAuthorityStore['findImageDelivery'];
   /**
    * Narrow system delete for one Session-owned artifact of a declared source.
    *
@@ -136,6 +138,8 @@ function createWriterFacade(
     kind: 'interactive',
     access: 'write',
     [writerBrand]: true,
+    findImageDelivery: (sessionId, turnId, messageId, source) =>
+      run(() => store.findImageDelivery(sessionId, turnId, messageId, source)),
     listPage: (sessionId, options) => run(() => store.listPage(sessionId, options)),
     listTurnArtifacts: (sessionId, turnId) => run(() => store.listTurnArtifacts(sessionId, turnId)),
     getInSession: (sessionId, artifactId) => run(() => store.getInSession(sessionId, artifactId)),
@@ -189,6 +193,10 @@ function createWriterFacade(
 function snapshotCreateInput(input: CreateArtifactInput): CreateArtifactInput {
   return Object.freeze({
     ...input,
+    ...(input.imageDelivery ? { imageDelivery: Object.freeze({ ...input.imageDelivery }) } : {}),
+    ...(input.imageArchiveLimits
+      ? { imageArchiveLimits: Object.freeze({ ...input.imageArchiveLimits }) }
+      : {}),
     content: typeof input.content === 'string' ? input.content : new Uint8Array(input.content),
   });
 }
diff --git a/packages/storage/src/sqlite-artifact-metadata.ts b/packages/storage/src/sqlite-artifact-metadata.ts
index df4094ef66..c29e65abeb 100644
--- a/packages/storage/src/sqlite-artifact-metadata.ts
+++ b/packages/storage/src/sqlite-artifact-metadata.ts
@@ -42,6 +42,28 @@ class SqliteArtifactMetadataRepository {
     this.#lease = acquireOperationalStateDatabase(resolve(workspaceRoot));
   }
 
+  findImageDelivery(
+    sessionId: string,
+    turnId: string,
+    messageId: string,
+    source: string,
+  ): ArtifactRecord | undefined {
+    this.assertOpen();
+    const rows = this.#lease.database
+      .prepare(`
+      SELECT record_json FROM artifact_records
+      WHERE session_id = ? AND json_valid(record_json)
+        AND json_type(record_json, '$.imageDelivery') = 'object'
+        AND json_extract(record_json, '$.turnId') = ?
+        AND json_extract(record_json, '$.imageDelivery.messageId') = ?
+        AND json_extract(record_json, '$.imageDelivery.source') = ?
+      ORDER BY CASE json_extract(record_json, '$.imageDelivery.status') WHEN 'pending' THEN 1 ELSE 0 END,
+        created_at DESC, artifact_id DESC LIMIT 1
+    `)
+      .all(sessionId, turnId, messageId, source) as Array<{ record_json: string }>;
+    return decodeRows(rows)[0];
+  }
+
   readAll(): ArtifactRecord[] {
     this.assertOpen();
     const rows = this.#lease.database
diff --git a/packages/storage/src/sqlite-artifact-schema.ts b/packages/storage/src/sqlite-artifact-schema.ts
index 84a880ed8b..9d90a4eb44 100644
--- a/packages/storage/src/sqlite-artifact-schema.ts
+++ b/packages/storage/src/sqlite-artifact-schema.ts
@@ -23,7 +23,7 @@ import {
   isSafeRelativeArtifactPath,
 } from './artifact-metadata-codec.js';
 
-export const SQLITE_ARTIFACT_SCHEMA_VERSION = 3;
+export const SQLITE_ARTIFACT_SCHEMA_VERSION = 4;
 
 export function migrateSqliteArtifactDatabase(db: DatabaseSync): void {
   const columns = db.prepare('PRAGMA table_info(artifact_records)').all() as Array<{
@@ -79,6 +79,11 @@ export function migrateSqliteArtifactDatabase(db: DatabaseSync): void {
     CREATE UNIQUE INDEX IF NOT EXISTS artifact_records_relative_path
       ON artifact_records(relative_path);
 
+    CREATE INDEX IF NOT EXISTS artifact_image_delivery_lookup
+      ON artifact_records(session_id, json_extract(record_json, '$.turnId'),
+        json_extract(record_json, '$.imageDelivery.messageId'), json_extract(record_json, '$.imageDelivery.source'))
+      WHERE json_valid(record_json) AND json_type(record_json, '$.imageDelivery') = 'object';
+
     CREATE TABLE IF NOT EXISTS artifact_upgrade_orphan_paths (
       relative_path TEXT PRIMARY KEY
     );
diff --git a/packages/ui/package.json b/packages/ui/package.json
index d94cfb3849..8de5e24cdb 100644
--- a/packages/ui/package.json
+++ b/packages/ui/package.json
@@ -24,7 +24,8 @@
     "build": "tsc -p tsconfig.json",
     "benchmark:redaction": "npm run build && node scripts/benchmark-streaming-redaction.mjs",
     "typecheck": "tsc -p tsconfig.json --noEmit",
-    "test:dist": "node --test \"dist/**/*.test.js\""
+    "test:dist": "node --test \"dist/**/*.test.js\"",
+    "test:images:browser": "npm run build && node --test scripts/markdown-images.browser.test.mjs"
   },
   "dependencies": {
     "@astryxdesign/core": "0.6.3",
@@ -38,8 +39,10 @@
     "virtua": "0.52.7"
   },
   "devDependencies": {
+    "@playwright/test": "^1.63.0",
     "@types/react": "^19.3.0",
     "@types/react-dom": "^19.3.0",
+    "esbuild": "^0.28.2",
     "linkedom": "^0.18.13"
   }
 }
diff --git a/packages/ui/scripts/markdown-images.browser.test.mjs b/packages/ui/scripts/markdown-images.browser.test.mjs
new file mode 100644
index 0000000000..abfca5e050
--- /dev/null
+++ b/packages/ui/scripts/markdown-images.browser.test.mjs
@@ -0,0 +1,192 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+// Chromium owns image requests and CSP enforcement; fake DOM tests cannot
+// detect an allowed Markdown URL that the desktop policy blocks.
+// Run after building @maka/ui: node --test packages/ui/scripts/markdown-images.browser.test.mjs
+import assert from 'node:assert/strict';
+import { before, after, test } from 'node:test';
+import { createServer } from 'node:http';
+import { readFile } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+import { build } from 'esbuild';
+import { chromium } from '@playwright/test';
+
+const root = fileURLToPath(new URL('../../../', import.meta.url));
+const png = Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8DwHwAFBQIAX8jx0gAAAABJRU5ErkJggg==', 'base64');
+let appServer, imageServer, browser, appUrl, imageUrl;
+let requests = [], failedOnce = false;
+
+before(async () => {
+  imageServer = createServer((req, res) => {
+    requests.push({ path: req.url, referer: req.headers.referer });
+    if (req.url === '/retry.png' && !failedOnce) {
+      failedOnce = true;
+      res.writeHead(404).end();
+    } else {
+      res.setHeader('Content-Type', 'image/png');
+      res.end(png);
+    }
+  });
+  await new Promise(resolve => imageServer.listen(0, '127.0.0.1', resolve));
+  imageUrl = `http://127.0.0.1:${imageServer.address().port}`;
+  const bundle = await build({
+    stdin: { contents: `
+      import React from 'react';
+      import {createRoot} from 'react-dom/client';
+      import {Theme} from '@astryxdesign/core';
+      import {makaTheme} from './apps/desktop/src/renderer/astryx-theme/maka.js';
+      import {MarkdownBody} from './packages/ui/dist/markdown-body.js';
+      import {LocaleProvider} from './packages/ui/dist/locale-context.js';
+      import {ImageDeliveryProvider} from './packages/ui/dist/image-delivery.js';
+      import {SessionAttachmentProvider} from './packages/ui/dist/attachment-image.js';
+      import './apps/desktop/src/renderer/styles.css';
+      const mode=new URLSearchParams(location.search).get('case') || 'remote';
+      let reads=0; window.imageReads=0; window.deliveryQueries=0;
+      const text=mode==='attachment' ? '![Screenshot](maka://runtime/attachments/image-1)' :
+        mode==='local' || mode==='local-saved' ? '![Screenshot](/tmp/private.png)' :
+        '![Screenshot](${imageUrl}/'+(mode==='retry' ? 'retry.png' : 'image.png')+')';
+      createRoot(document.getElementById('root')).render(
+        React.createElement(Theme,{theme:makaTheme,mode:'light'},
+          React.createElement(LocaleProvider,{locale:'en'},
+            React.createElement(SessionAttachmentProvider,{sessionId:'session',readBytes:async()=>{
+              reads++; window.imageReads=reads; return mode==='attachment' && reads===1 ? {ok:false,reason:'read_failed'} :
+                {ok:true,base64:'${png.toString('base64')}',mimeType:'image/png'};
+            }},React.createElement(ImageDeliveryProvider,{sessionId:'session',resolve:mode.endsWith('saved') || mode==='saving' ? async()=>{
+              window.deliveryQueries++;
+              await new Promise(resolve=>setTimeout(resolve,100));
+              return mode==='saving' && window.deliveryQueries===1 ? {status:'pending'} : {status:'ready',artifactId:'saved-image'};
+            } : undefined},
+              React.createElement('div',{style:mode==='offscreen' ? {paddingTop:'2500px'} : {}},
+                React.createElement(MarkdownBody,{text,imageIdentity:{turnId:'turn',messageId:'message'}})))))));
+    `, resolveDir: root, loader: 'js' },
+    bundle: true, write: false, outdir: '/virtual', format: 'iife',
+    loader: { '.woff2': 'dataurl', '.woff': 'dataurl', '.ttf': 'dataurl', '.svg': 'dataurl' },
+    define: { 'process.env.NODE_ENV': '"production"' },
+  });
+  const js = bundle.outputFiles.find(file => file.path.endsWith('.js')).text;
+  const css = bundle.outputFiles.find(file => file.path.endsWith('.css')).text;
+  const index = await readFile(new URL('../../../apps/desktop/src/renderer/index.html', import.meta.url), 'utf8');
+  const csp = index.match(/http-equiv="Content-Security-Policy"\s+content="([^"]+)"/)[1];
+  appServer = createServer((req, res) => {
+    if (req.url === '/app.js') { res.setHeader('Content-Type', 'text/javascript'); res.end(js); }
+    else if (req.url === '/app.css') { res.setHeader('Content-Type', 'text/css'); res.end(css); }
+    else {
+      res.setHeader('Content-Type', 'text/html');
+      res.end(`<!doctype html><html><head><meta name="referrer" content="no-referrer"><meta http-equiv="Content-Security-Policy" content="${csp}"><link rel="stylesheet" href="/app.css"></head><body><main id="root"></main><script src="/app.js"></script></body></html>`);
+    }
+  });
+  await new Promise(resolve => appServer.listen(0, '127.0.0.1', resolve));
+  appUrl = `http://127.0.0.1:${appServer.address().port}`;
+  browser = await chromium.launch({ headless: true });
+});
+
+after(async () => {
+  await browser?.close();
+  for (const server of [appServer, imageServer]) if (server) await new Promise(resolve => server.close(resolve));
+});
+
+async function pageFor(scenario) {
+  const page = await browser.newPage({ viewport: { width: 720, height: 600 } });
+  page.setDefaultTimeout(5000);
+  await page.goto(`${appUrl}/?case=${scenario}`);
+  return page;
+}
+
+async function loaded(page) {
+  await page.waitForFunction(() => [...document.images].some(image => image.naturalWidth === 1));
+}
+
+test('remote image loads automatically under the actual desktop CSP, without sending a referrer', async () => {
+  requests = [];
+  const page = await pageFor('remote');
+  try {
+    assert.equal(await page.getByRole('button', { name: 'Load image', exact: true }).count(), 0);
+    await loaded(page);
+    assert.deepEqual(requests, [{ path: '/image.png', referer: undefined }]);
+    assert.equal(await page.getByRole('status').count(), 0);
+  } finally { await page.close(); }
+});
+
+test('failed remote image has a working retry control instead of a broken image icon', async () => {
+  failedOnce = false;
+  const page = await pageFor('retry');
+  try {
+    await page.getByText('Could not load the image. Try again.').waitFor();
+    assert.equal(await page.locator('img').count(), 0);
+    await page.getByRole('button', { name: 'Retry', exact: true }).click();
+    await loaded(page);
+  } finally { await page.close(); }
+});
+
+test('attachment read failure recovers in place, and local paths explain how to provide an image', async () => {
+  const page = await pageFor('attachment');
+  try {
+    await page.getByRole('button', { name: 'Retry', exact: true }).click();
+    await loaded(page);
+    assert.match(await page.locator('img').getAttribute('src'), /^data:image\/png;base64,/);
+    await page.goto(`${appUrl}/?case=local`);
+    await page.getByText('This image address cannot be displayed. Send the image as a chat attachment.').waitFor();
+    assert.equal(await page.locator('img').count(), 0);
+    assert.equal(await page.getByRole('button', { name: 'Load image' }).count(), 0);
+  } finally { await page.close(); }
+});
+
+for (const scenario of ['remote-saved', 'local-saved']) {
+  test(`${scenario}: saved mapping avoids the original source and the image supports zoom`, async () => {
+    requests = [];
+    const page = await pageFor(scenario);
+    try {
+      await loaded(page);
+      assert.deepEqual(requests, []);
+      assert.equal(await page.evaluate(() => window.imageReads), 1);
+      assert.equal(await page.locator('img').count(), 1);
+      assert.match(await page.locator('img').getAttribute('src'), /^data:image\/png;base64,/);
+      await page.getByRole('button', { name: 'Enlarge image: Screenshot', exact: true }).click();
+      await page.waitForFunction(() => document.images.length > 1);
+    } finally { await page.close(); }
+  });
+}
+test('offscreen image performs no image request until it approaches the viewport', async () => {
+  requests = [];
+  const page = await pageFor('offscreen');
+  try {
+    // Let React effects and the initial IntersectionObserver callback complete.
+    await page.getByText('Loading image…').waitFor();
+    assert.deepEqual(requests, []);
+    assert.equal(await page.locator('img').count(), 0);
+    await page.locator('[data-maka-image-state]').scrollIntoViewIfNeeded();
+    await loaded(page);
+    assert.deepEqual(requests, [{ path: '/image.png', referer: undefined }]);
+  } finally { await page.close(); }
+});
+
+test('a new remote image previews during archival and switches to saved bytes after background completion', async () => {
+  requests = [];
+  const page = await pageFor('saving');
+  try {
+    await loaded(page);
+    await page.getByText('Saving image…').waitFor();
+    assert.equal(requests.length, 1);
+    await page.waitForFunction(() => [...document.images].some(img=>img.src.startsWith('data:image/png;') && img.naturalWidth===1));
+    assert.equal(await page.getByRole('status').count(), 0);
+    assert.equal(await page.evaluate(() => window.deliveryQueries), 2);
+    assert.equal(requests.length, 1);
+  } finally { await page.close(); }
+});
diff --git a/packages/ui/src/__tests__/attachment-image.test.tsx b/packages/ui/src/__tests__/attachment-image.test.tsx
index df3208c456..1203e69db4 100644
--- a/packages/ui/src/__tests__/attachment-image.test.tsx
+++ b/packages/ui/src/__tests__/attachment-image.test.tsx
@@ -72,9 +72,11 @@ async function renderAttachmentMarkdown(text: string, readBytes: ReadAttachmentB
   const { container, root } = domRoot();
   await act(async () => {
     root.render(
-      <SessionAttachmentProvider sessionId="session-1" readBytes={readBytes}>
+      <LocaleProvider locale="en">
+        <SessionAttachmentProvider sessionId="session-1" readBytes={readBytes}>
         <MarkdownBody text={text} />
-      </SessionAttachmentProvider>,
+      </SessionAttachmentProvider>
+      </LocaleProvider>,
     );
   });
   return { container, root };
@@ -169,7 +171,7 @@ test('renders a session attachment referenced by assistant Markdown', async () =
   assert.deepEqual(readRef, { sessionId: 'session-1', artifactId: 'attachment-123' });
 });
 
-test('keeps unreadable assistant attachments as named placeholders', async () => {
+test('explains unreadable assistant attachments and offers retry', async () => {
   const cases: Array<[string, ReadAttachmentBytes]> = [
     ['missing', async () => ({ ok: false, reason: 'not_found' })],
     ['document', async () => ({ ok: true, base64: 'cGRm', mimeType: 'application/pdf' })],
@@ -188,7 +190,9 @@ test('keeps unreadable assistant attachments as named placeholders', async () =>
       readBytes,
     );
     assert.equal(container.querySelector('img'), null);
-    assert.ok(container.textContent.includes(`[${name}]`));
+    assert.ok(container.textContent.includes(name));
+    assert.ok(container.textContent.includes("Could not load the image"));
+    assert.equal(container.querySelector("button")?.textContent, "Retry");
   }
 });
 
@@ -218,14 +222,10 @@ test('retries an attachment image after a transient read failure', async () => {
       ? { ok: false, reason: 'read_failed' }
       : { ok: true, base64: 'cmVjb3ZlcmVk', mimeType: 'image/png' };
   };
-  const { container, root } = await renderAttachmentMarkdown(markdown, readBytes);
+  const { container } = await renderAttachmentMarkdown(markdown, readBytes);
   assert.equal(container.querySelector('img'), null);
   await act(async () => {
-    root.render(
-      <SessionAttachmentProvider sessionId="session-1" readBytes={readBytes}>
-        <MarkdownBody key="retry" text={markdown} />
-      </SessionAttachmentProvider>,
-    );
+    container.querySelector('button')!.click();
   });
 
   const image = container.querySelector('img[alt="preview"]');
@@ -244,22 +244,26 @@ test('renders an attachment when a streaming Markdown image becomes complete', a
   });
   await act(async () => {
     root.render(
-      <SessionAttachmentProvider sessionId="session-1" readBytes={readBytes}>
+      <LocaleProvider locale="en">
+        <SessionAttachmentProvider sessionId="session-1" readBytes={readBytes}>
         <MarkdownBody
           text="![preview](maka://runtime/attachments/attachment-"
           streaming
           settledText=""
         />
-      </SessionAttachmentProvider>,
+      </SessionAttachmentProvider>
+      </LocaleProvider>,
     );
   });
   assert.equal(container.querySelector('img'), null);
 
   await act(async () => {
     root.render(
-      <SessionAttachmentProvider sessionId="session-1" readBytes={readBytes}>
+      <LocaleProvider locale="en">
+        <SessionAttachmentProvider sessionId="session-1" readBytes={readBytes}>
         <MarkdownBody text={markdown} streaming settledText={markdown} />
-      </SessionAttachmentProvider>,
+      </SessionAttachmentProvider>
+      </LocaleProvider>,
     );
   });
 
diff --git a/packages/ui/src/__tests__/markdown-body.test.ts b/packages/ui/src/__tests__/markdown-body.test.ts
index eca7a03013..edd696513a 100644
--- a/packages/ui/src/__tests__/markdown-body.test.ts
+++ b/packages/ui/src/__tests__/markdown-body.test.ts
@@ -436,7 +436,7 @@ it('keeps non-allowlisted external schemes inert', () => {
 });
 
 it('never loads non-allowlisted Markdown image sources', () => {
-  const markup = renderToStaticMarkup(createElement(MarkdownBody, {
+  const markup = renderImageMarkdown({
     text: [
       '![standalone](file:///Users/example/.ssh/id_rsa)',
       '',
@@ -448,7 +448,7 @@ it('never loads non-allowlisted Markdown image sources', () => {
       '',
       '[avatar]: file:///Users/example/private.png',
     ].join('\n'),
-  }));
+  });
 
   assert.doesNotMatch(markup, /<img\b/);
   assert.doesNotMatch(markup, /\bsrc="(?:file|custom):/);
@@ -464,9 +464,9 @@ it('does not treat navigation and communication schemes as image resources', ()
     'maka://runtime/attachments/not-an-artifact',
     'mailto:user@example.com',
   ]) {
-    const markup = renderToStaticMarkup(createElement(MarkdownBody, {
+    const markup = renderImageMarkdown({
       text: `![not-an-image](${src})`,
-    }));
+    });
 
     assert.doesNotMatch(markup, /<img\b/, src);
     assert.doesNotMatch(markup, /\bsrc=/, src);
@@ -474,15 +474,32 @@ it('does not treat navigation and communication schemes as image resources', ()
 });
 
 it('shows an attachment placeholder when no session reader is installed', () => {
-  const markup = renderToStaticMarkup(createElement(MarkdownBody, {
+  const markup = renderImageMarkdown({
     text: '![preview](maka://runtime/attachments/attachment-123)',
-  }));
+  });
 
-  assert.match(markup, />\[preview\]</);
+  assert.match(markup, />preview</);
+  assert.match(markup, /This image attachment is unavailable here/);
   assert.doesNotMatch(markup, /maka:\/\/runtime\/attachments/);
   assert.doesNotMatch(markup, /<img\b/);
 });
 
+function renderImageMarkdown(props: { text: string }) {
+  return renderToStaticMarkup(createElement(LocaleProvider, {
+    locale: 'en',
+    children: createElement(MarkdownBody, props),
+  }));
+}
+
+it('renders remote images automatically with lazy decoding and no referrer', () => {
+  const markup = renderImageMarkdown({ text: '![preview](https://example.com/image.png)' });
+  assert.match(markup, /<img\b/);
+  assert.match(markup, /src="https:\/\/example\.com\/image\.png"/);
+  assert.match(markup, /loading="lazy"/);
+  assert.match(markup, /referrerPolicy="no-referrer"|referrerpolicy="no-referrer"/);
+  assert.doesNotMatch(markup, /Load image|rel="preload"/);
+});
+
 it('defers Mermaid fences beyond the per-Markdown automatic diagram budget', () => {
   const fence = (index: number) => [
     '```mermaid',
diff --git a/packages/ui/src/attachment-image.tsx b/packages/ui/src/attachment-image.tsx
index 19b88e9a64..66511959f6 100644
--- a/packages/ui/src/attachment-image.tsx
+++ b/packages/ui/src/attachment-image.tsx
@@ -19,6 +19,7 @@
 
 import {
   createContext,
+  useCallback,
   useContext,
   useEffect,
   useMemo,
@@ -37,6 +38,7 @@ export type ReadAttachmentBytes = (
 type SessionAttachmentContextValue = {
   sessionId: string;
   loadImage: (sessionId: string, artifactId: string) => Promise<string | undefined>;
+  invalidate(sessionId: string, artifactId: string): void;
 };
 
 const SessionAttachmentContext = createContext<SessionAttachmentContextValue | undefined>(undefined);
@@ -52,10 +54,19 @@ export function SessionAttachmentProvider(props: {
       const readBytes = props.readBytes;
       if (!readBytes) return undefined;
       const pending = new Map<string, Promise<string | undefined>>();
+      const ready = new Map<string, string>();
+      let cachedBytes = 0;
       return {
         sessionId: props.sessionId,
+        invalidate(sessionId: string, artifactId: string) {
+          const key = `${sessionId}\0${artifactId}`;
+          const cached = ready.get(key);
+          if (cached) { cachedBytes -= cached.length * 2; ready.delete(key); }
+        },
         loadImage(sessionId: string, artifactId: string) {
           const key = `${sessionId}\0${artifactId}`;
+          const cached = ready.get(key);
+          if (cached) { ready.delete(key); ready.set(key, cached); return Promise.resolve(cached); }
           const existing = pending.get(key);
           if (existing) return existing;
           const loaded = readBytes(sessionId, artifactId)
@@ -67,6 +78,14 @@ export function SessionAttachmentProvider(props: {
             })
             .catch(() => undefined);
           pending.set(key, loaded);
+          void loaded.then(src => {
+            if (!src) return;
+            ready.set(key, src); cachedBytes += src.length * 2;
+            while (cachedBytes > 32 * 1024 * 1024 && ready.size) {
+              const oldest = ready.keys().next().value!;
+              cachedBytes -= ready.get(oldest)!.length * 2; ready.delete(oldest);
+            }
+          });
           void loaded.finally(() => {
             if (pending.get(key) === loaded) pending.delete(key);
           });
@@ -88,24 +107,48 @@ export function useAttachmentImageSource(ref: {
   artifactId: string;
   sessionId?: string;
 } | undefined): string | undefined {
+  return useAttachmentImage(ref).src;
+}
+
+export function useAttachmentImage(ref: {
+  artifactId: string;
+  sessionId?: string;
+} | undefined) {
   const context = useContext(SessionAttachmentContext);
   const artifactId = ref?.artifactId;
   const sessionId = ref?.sessionId ?? context?.sessionId;
   const loadImage = context?.loadImage;
-  const [src, setSrc] = useState<string | undefined>(undefined);
+  const [attempt, setAttempt] = useState(0);
+  const retry = useCallback(() => {
+    if (artifactId && sessionId) context?.invalidate(sessionId, artifactId);
+    setAttempt((value) => value + 1);
+  }, [artifactId, sessionId, context]);
+  const request = useMemo(
+    () => artifactId && sessionId && loadImage
+      ? { artifactId, sessionId, loadImage, attempt }
+      : undefined,
+    [artifactId, sessionId, loadImage, attempt],
+  );
+  const [result, setResult] = useState<{
+    request: typeof request;
+    status: 'loading' | 'ready' | 'failed';
+    src?: string;
+  }>();
 
   useEffect(() => {
-    setSrc(undefined);
-    if (!artifactId || !sessionId || !loadImage) return;
+    if (!request) return;
+    setResult({ request, status: 'loading' });
     let cancelled = false;
-    loadImage(sessionId, artifactId)
+    request.loadImage(request.sessionId, request.artifactId)
       .then((loaded) => {
-        if (!cancelled) setSrc(loaded);
-      })
+        if (!cancelled) setResult({ request, status: loaded ? 'ready' : 'failed', src: loaded });
+      });
     return () => {
       cancelled = true;
     };
-  }, [artifactId, loadImage, sessionId]);
+  }, [request]);
 
-  return src;
+  if (!request) return { status: 'unavailable' as const, src: undefined, retry };
+  if (result?.request !== request) return { status: 'loading' as const, src: undefined, retry };
+  return { status: result.status, src: result.src, retry };
 }
diff --git a/packages/ui/src/chat-turn.tsx b/packages/ui/src/chat-turn.tsx
index cbbf1cf738..902de62a67 100644
--- a/packages/ui/src/chat-turn.tsx
+++ b/packages/ui/src/chat-turn.tsx
@@ -768,6 +768,7 @@ export const TurnView = memo(function TurnView(props: {
                     key={`processing-${item.id}`}
                     activityObserved={props.activityObserved}
                     entries={item.children}
+                    turnId={turn.turnId}
                     running={!!props.liveStreaming}
                     statusRow={
                       index === activityProcessIndex && hasLiveStatus
@@ -783,6 +784,7 @@ export const TurnView = memo(function TurnView(props: {
                     key={timelineEntryKey(item, index)}
                     activityObserved={props.activityObserved}
                     item={item}
+                    turnId={turn.turnId}
                     onStreamingSettled={props.liveStreaming?.onStreamingSettled}
                     onOpenLinkedSession={props.onOpenLinkedSession}
                     initialLiveContent={props.liveStreaming?.initialLiveContent}
@@ -1303,7 +1305,7 @@ export function ModelProviderRetryIndicator(props: { retry: LiveProviderRetry })
  */
 type AssistantAnswerPhase = 'historical' | 'streaming' | 'settled';
 
-type AssistantAnswerBubbleProps =
+type AssistantAnswerBubbleProps = { imageIdentity?: { turnId: string; messageId: string } } & (
   | { text: string; phase: 'historical'; interrupted?: true }
   | {
       text: string;
@@ -1314,7 +1316,7 @@ type AssistantAnswerBubbleProps =
       truncated?: boolean;
       /** Called once when this answer's stream closes. */
       onSettled?: () => void;
-    };
+    });
 
 /**
  * The assistant's answer, in every state it can be in.
@@ -1361,6 +1363,7 @@ const AssistantAnswerBubble = memo(function AssistantAnswerBubble(props: Assista
     >
       <Markdown
         text={props.text}
+        imageIdentity={props.imageIdentity}
         streaming={props.phase === 'streaming'}
         settledText={settledText}
         // Names the surface, and not exclusively: the desktop Artifact
@@ -1414,6 +1417,7 @@ function timelineEntryKey(item: TurnTimelineItem, index: number): string {
 
 /** Render one timeline entry: reasoning disclosure / answer bubble / tool group. */
 const TurnTimelineEntry = memo(function TurnTimelineEntry(props: {
+  turnId?: string;
   activityObserved?: boolean;
   item: Exclude<TurnTimelineItem, { kind: 'user' }>;
   onStreamingSettled?: (messageId?: string) => void;
@@ -1441,9 +1445,10 @@ const TurnTimelineEntry = memo(function TurnTimelineEntry(props: {
     );
   }
   // Same component either way — a type swap here would remount the answer.
-  if (item.live !== true) return <AssistantAnswerBubble text={item.text} interrupted={item.interrupted} phase="historical" />;
+  if (item.live !== true) return <AssistantAnswerBubble imageIdentity={props.turnId ? { turnId: props.turnId, messageId: item.messageId } : undefined} text={item.text} interrupted={item.interrupted} phase="historical" />;
   return (
     <AssistantAnswerBubble
+      imageIdentity={props.turnId ? { turnId: props.turnId, messageId: item.messageId } : undefined}
       text={item.text}
       interrupted={item.interrupted}
       phase={item.complete === true ? 'settled' : 'streaming'}
@@ -1465,6 +1470,7 @@ const TurnTimelineEntry = memo(function TurnTimelineEntry(props: {
  * owns no chrome — keep the plain process label.
  */
 const ProcessingBlock = memo(function ProcessingBlock(props: {
+  turnId?: string;
   activityObserved?: boolean;
   entries: FoldedTimelineChild[];
   running: boolean;
@@ -1484,6 +1490,7 @@ const ProcessingBlock = memo(function ProcessingBlock(props: {
             key={timelineEntryKey(entry, index)}
             activityObserved={open && props.activityObserved !== false}
             item={entry}
+            turnId={props.turnId}
             onStreamingSettled={props.onStreamingSettled}
             onOpenLinkedSession={props.onOpenLinkedSession}
             initialLiveContent={props.initialLiveContent}
diff --git a/packages/ui/src/chat-view.tsx b/packages/ui/src/chat-view.tsx
index 4622341dd0..12013363b7 100644
--- a/packages/ui/src/chat-view.tsx
+++ b/packages/ui/src/chat-view.tsx
@@ -17,6 +17,7 @@
  * under the License.
  */
 
+import { ImageDeliveryProvider } from './image-delivery.js';
 import {
   Fragment,
   useCallback,
@@ -297,6 +298,7 @@ export function ChatView(props: {
    * host-agnostic with no direct host-global access.
    */
   onReadAttachmentBytes?: ReadAttachmentBytes;
+  onResolveImageDelivery?: import('./image-delivery.js').ResolveImageDelivery;
   /**
    * Open a linked subagent child session in the main chat column (option A).
    * Threaded into linked subagent rows inside ToolTrow.
@@ -907,6 +909,7 @@ export function ChatView(props: {
 
   return (
     <MakaClientSessionScope sessionId={props.activeSession.id}>
+      <ImageDeliveryProvider sessionId={props.activeSession.id} resolve={props.onResolveImageDelivery}>
       <SessionAttachmentProvider
         sessionId={props.activeSession.id}
         readBytes={props.onReadAttachmentBytes}
@@ -1156,6 +1159,7 @@ export function ChatView(props: {
       </div>
       </section>
       </SessionAttachmentProvider>
+      </ImageDeliveryProvider>
     </MakaClientSessionScope>
   );
 }
diff --git a/packages/ui/src/image-delivery.tsx b/packages/ui/src/image-delivery.tsx
new file mode 100644
index 0000000000..22d31eab2a
--- /dev/null
+++ b/packages/ui/src/image-delivery.tsx
@@ -0,0 +1,74 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { createContext, useCallback, useContext, useEffect, useMemo, useState, type ReactNode } from 'react';
+import type { ImageDeliveryRequest, ImageDeliveryResult } from '@maka/core/image-delivery';
+export type ResolveImageDelivery = (sessionId: string, request: ImageDeliveryRequest) => Promise<ImageDeliveryResult>;
+export const ImageMessageScope = createContext<{ turnId: string; messageId: string } | undefined>(undefined);
+const DeliveryContext = createContext<{ resolve(request: ImageDeliveryRequest): Promise<ImageDeliveryResult> } | undefined>(undefined);
+export function ImageDeliveryProvider(props: { sessionId: string; resolve?: ResolveImageDelivery; children: ReactNode }) {
+  const value = useMemo(() => {
+    if (!props.resolve) return undefined;
+    const resolve = props.resolve;
+    const pending = new Map<string, Promise<ImageDeliveryResult>>();
+    const ready = new Map<string, ImageDeliveryResult>();
+    return { resolve(request: ImageDeliveryRequest) {
+      const key = JSON.stringify([request.turnId, request.messageId, request.source]);
+      const cached = ready.get(key); if (cached) return Promise.resolve(cached);
+      const running = pending.get(key); if (running) return running;
+      const job = resolve(props.sessionId, request).catch((): ImageDeliveryResult => ({ status: 'failed', reason: 'read_failed' }));
+      pending.set(key, job);
+      void job.then(result => {
+        pending.delete(key);
+        if (result.status === 'ready') {
+          ready.set(key, result); if (ready.size > 128) ready.delete(ready.keys().next().value!);
+        }
+      });
+      return job;
+    }};
+  }, [props.resolve, props.sessionId]);
+  return <DeliveryContext.Provider value={value}>{props.children}</DeliveryContext.Provider>;
+}
+export function useImageDelivery(source: string, enabled: boolean) {
+  const scope = useContext(ImageMessageScope);
+  const context = useContext(DeliveryContext);
+  const [attempt, setAttempt] = useState(0);
+  const identity = useMemo(() => context && scope?.turnId && scope.messageId && enabled
+    ? { context, turnId: scope.turnId, messageId: scope.messageId, source, attempt } : undefined,
+    [context, scope?.turnId, scope?.messageId, source, attempt, enabled]);
+  const [settled, setSettled] = useState<{ identity: typeof identity; result: ImageDeliveryResult }>();
+  const retry = useCallback(() => setAttempt(a => a + 1), []);
+  useEffect(() => {
+    if (!identity) return;
+    let cancelled = false; let timer: ReturnType<typeof setTimeout> | undefined; let delay = 500;
+    const query = async (retry: boolean) => {
+      const result = await identity.context.resolve({ turnId: identity.turnId, messageId: identity.messageId, source: identity.source, ...(retry ? { retry: true } : {}) });
+      if (cancelled) return;
+      setSettled({ identity, result });
+      if (result.status === 'pending') {
+        timer = setTimeout(() => { void query(false); }, delay); delay = Math.min(5000, delay * 2);
+      }
+    };
+    void query(attempt > 0);
+    return () => { cancelled = true; clearTimeout(timer); };
+  }, [identity, attempt]);
+  const result: ImageDeliveryResult = !identity ? { status: 'unavailable' }
+    : settled?.identity === identity ? settled.result : { status: 'pending' };
+  return { ...result, retry, available: !!identity, checked: settled?.identity === identity };
+}
diff --git a/packages/ui/src/markdown-body.tsx b/packages/ui/src/markdown-body.tsx
index af17e36ee6..7520309577 100644
--- a/packages/ui/src/markdown-body.tsx
+++ b/packages/ui/src/markdown-body.tsx
@@ -29,6 +29,8 @@
  * product-specific trust boundaries around that renderer.
  */
 
+import { MarkdownImage } from './markdown-image.js';
+import { ImageMessageScope } from './image-delivery.js';
 import { useCallback, useContext, useRef, type ReactNode } from 'react';
 import {
   Markdown as AstryxMarkdown,
@@ -51,8 +53,6 @@ import {
   MarkdownMath,
   prepareMarkdownMath,
 } from './markdown-math.js';
-import { parseAttachmentResourceRef } from '@maka/core/attachments';
-import { useAttachmentImageSource } from './attachment-image.js';
 
 const BASE_MARKDOWN_COMPONENTS = {
   link: MarkdownLink,
@@ -144,6 +144,7 @@ const MARKDOWN_COMPONENTS = {
 
 export function MarkdownBody(props: {
   text: string;
+  imageIdentity?: { turnId: string; messageId: string };
   streaming?: boolean;
   settledText?: string;
   density?: 'default' | 'compact';
@@ -162,46 +163,48 @@ export function MarkdownBody(props: {
     : MARKDOWN_COMPONENTS[density];
 
   return (
-    <div
-      data-maka-contract="markdown"
-      data-maka-script={hasHanProse(props.text) ? 'han' : undefined}
-      // Migration-only identity wrapper. `display: contents` gives the
-      // contract harness a stable declared subtree without adding a layout
-      // box or interfering with Astryx's document root.
-      style={{ display: 'contents' }}
-    >
-      <AstryxMarkdown
-        autolink="gfm"
-        // Markdown holds no reading measure; the container it lands in does.
-        //
-        // Astryx caps prose at 680px by default but renders a supplied
-        // `components.code` bare — no spacing, no width, no alignment. Maka
-        // always supplies one, so any container that leans on the default gets
-        // prose at 680 and code blocks at whatever the container is: two right
-        // edges, which is the defect this whole change exists to remove. One
-        // authority per column, and it is the container.
-        contentWidth="100%"
-        // Chosen by the caller, and defaulting to document rhythm.
-        //
-        // The transcript passes `compact`: Astryx's default heading spacing
-        // assumes a page with a handful of sections, while an agent turn
-        // emits headings every few lines, so the default margins push each
-        // one into its own visual slab. That is the same argument that
-        // flattens transcript heading SIZES in styles/chat-message.css — and
-        // that rule is scoped to `.maka-turn` precisely because the other
-        // caller, the Daily Review panel, renders a report, which is a
-        // document. Hardcoding `compact` here contradicted that scoping: the
-        // review kept full heading sizes but got transcript block spacing,
-        // the one combination neither half of the argument asks for.
-        density={density}
-        components={components}
-        isStreaming={props.streaming}
-        settledText={props.settledText}
-        transformSource={transformMathSource}
+    <ImageMessageScope.Provider value={props.imageIdentity}>
+      <div
+        data-maka-contract="markdown"
+        data-maka-script={hasHanProse(props.text) ? 'han' : undefined}
+        // Migration-only identity wrapper. `display: contents` gives the
+        // contract harness a stable declared subtree without adding a layout
+        // box or interfering with Astryx's document root.
+        style={{ display: 'contents' }}
       >
-        {budgetedText}
-      </AstryxMarkdown>
-    </div>
+        <AstryxMarkdown
+          autolink="gfm"
+          // Markdown holds no reading measure; the container it lands in does.
+          //
+          // Astryx caps prose at 680px by default but renders a supplied
+          // `components.code` bare — no spacing, no width, no alignment. Maka
+          // always supplies one, so any container that leans on the default gets
+          // prose at 680 and code blocks at whatever the container is: two right
+          // edges, which is the defect this whole change exists to remove. One
+          // authority per column, and it is the container.
+          contentWidth="100%"
+          // Chosen by the caller, and defaulting to document rhythm.
+          //
+          // The transcript passes `compact`: Astryx's default heading spacing
+          // assumes a page with a handful of sections, while an agent turn
+          // emits headings every few lines, so the default margins push each
+          // one into its own visual slab. That is the same argument that
+          // flattens transcript heading SIZES in styles/chat-message.css — and
+          // that rule is scoped to `.maka-turn` precisely because the other
+          // caller, the Daily Review panel, renders a report, which is a
+          // document. Hardcoding `compact` here contradicted that scoping: the
+          // review kept full heading sizes but got transcript block spacing,
+          // the one combination neither half of the argument asks for.
+          density={density}
+          components={components}
+          isStreaming={props.streaming}
+          settledText={props.settledText}
+          transformSource={transformMathSource}
+        >
+          {budgetedText}
+        </AstryxMarkdown>
+      </div>
+    </ImageMessageScope.Provider>
   );
 }
 
@@ -271,37 +274,6 @@ function MarkdownCode(props: {
   );
 }
 
-function MarkdownImage(props: { src: string; alt: string }) {
-  const attachment = parseAttachmentResourceRef(props.src);
-  const attachmentSrc = useAttachmentImageSource(
-    attachment ? { artifactId: attachment.artifactId } : undefined,
-  );
-  if (attachment) {
-    if (!attachmentSrc) return <span>[{props.alt}]</span>;
-    return (
-      <img
-        className="maka-markdown-attachment-image"
-        src={attachmentSrc}
-        alt={props.alt}
-      />
-    );
-  }
-  if (!isSafeMarkdownImageUrl(props.src)) return <span>[{props.alt}]</span>;
-  // Remote images can be badges or sentence-level icons, so preserve Maka's
-  // existing inline presentation. Session attachments above are content
-  // previews and deliberately own a block presentation instead.
-  return <img src={props.src} alt={props.alt} style={{ display: 'inline-block' }} />;
-}
-
-function isSafeMarkdownImageUrl(url: string): boolean {
-  try {
-    const protocol = new URL(url).protocol;
-    return protocol === 'http:' || protocol === 'https:';
-  } catch {
-    return false;
-  }
-}
-
 /**
  * Route internal Markdown navigation through Maka's typed allowlist. Invalid
  * internal destinations never fall through to the operating system, and
diff --git a/packages/ui/src/markdown-image.tsx b/packages/ui/src/markdown-image.tsx
new file mode 100644
index 0000000000..46121a69ff
--- /dev/null
+++ b/packages/ui/src/markdown-image.tsx
@@ -0,0 +1,94 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { useEffect, useRef, useState } from 'react';
+import { useLightbox } from '@astryxdesign/core';
+import { Link } from '@astryxdesign/core/Link';
+import { parseAttachmentResourceRef } from '@maka/core/attachments';
+import { useAttachmentImage } from './attachment-image.js';
+import { useImageDelivery } from './image-delivery.js';
+import { getSharedUiCopy } from './shared-ui-copy.js';
+import { useUiLocale } from './locale-context.js';
+
+/** Presentation only: Host resolves local addresses and archives; UI receives artifact identities. */
+export function MarkdownImage(props: { src: string; alt: string }) {
+  return <ImageResource key={props.src} {...props} />;
+}
+function ImageResource(props: { src: string; alt: string }) {
+  const copy = getSharedUiCopy(useUiLocale()).markdown;
+  const anchor = useRef<HTMLSpanElement>(null);
+  const [visible, setVisible] = useState(typeof IntersectionObserver === 'undefined');
+  useEffect(() => {
+    if (visible || !anchor.current) return;
+    const observer = new IntersectionObserver(entries => {
+      if (entries.some(entry => entry.isIntersecting)) { setVisible(true); observer.disconnect(); }
+    }, { rootMargin: '300px' });
+    observer.observe(anchor.current); return () => observer.disconnect();
+  }, [visible]);
+  const explicit = parseAttachmentResourceRef(props.src);
+  const delivery = useImageDelivery(props.src, visible && !explicit);
+  const artifactId = explicit?.artifactId ?? (delivery.status === 'ready' ? delivery.artifactId : undefined);
+  const image = useAttachmentImage(visible && artifactId ? { artifactId } : undefined);
+  const [failedSource, setFailedSource] = useState<string>();
+  const [attempt, setAttempt] = useState(0);
+  const remote = isWebImage(props.src);
+  const source = artifactId ? image.src : visible && remote && (!delivery.available || delivery.checked) ? props.src : undefined;
+  const failed = !!source && failedSource === source || !!artifactId && image.status === 'failed';
+  const retry = () => {
+    setFailedSource(undefined); setAttempt(a => a + 1);
+    if (artifactId) image.retry(); else delivery.retry();
+  };
+  const sourceActions = <span className="maka-markdown-image-actions">
+    <button type="button" onClick={retry}>{copy.imageRetry}</button>
+    {remote && <Link href={props.src} isExternalLink type="inherit" hasUnderline>{copy.imageOpen}</Link>}
+  </span>;
+  let message: string | undefined;
+  if (failed) message = copy.imageLoadFailed;
+  else if (!source) message = !visible ? copy.imageLoading
+    : explicit && image.status === 'unavailable' ? copy.imageUnavailable
+    : delivery.status === 'failed' ? copy.imageArchiveFailure(delivery.reason)
+    : delivery.status === 'pending' || artifactId ? copy.imageLoading : copy.imageUnsupported;
+  return <span ref={anchor} className="maka-markdown-image-resource" data-maka-image-state={message ? failed ? 'failed' : 'loading' : 'ready'}>
+    {message ? <span className="maka-markdown-image-placeholder">
+      {props.alt && <span className="maka-markdown-image-caption">{props.alt}</span>}
+      <span role="status">{message}</span>
+      {(failed || delivery.status === 'failed') && sourceActions}
+    </span> : source && <DisplayImage key={`${source}\0${attempt}`} src={source} alt={props.alt} onError={() => setFailedSource(source)} />}
+    {!explicit && delivery.status === 'pending' && remote && source && <span className="maka-markdown-image-saving" role="status">{copy.imageSaving}</span>}
+    {!explicit && delivery.status === 'failed' && remote && source && !failed && <span className="maka-markdown-image-saving" role="status">
+      {copy.imageArchiveFailure(delivery.reason)} {sourceActions}
+    </span>}
+  </span>;
+}
+function DisplayImage(props: { src: string; alt: string; onError(): void }) {
+  const copy = getSharedUiCopy(useUiLocale()).markdown;
+  const [loaded, setLoaded] = useState(false);
+  const lightbox = useLightbox({ media: { src: props.src, alt: props.alt }, hasZoom: true });
+  return <>
+    {!loaded && <span className="maka-markdown-image-loading" role="status">{copy.imageLoading}</span>}
+    <button type="button" className="maka-markdown-image-preview" aria-label={copy.imageExpand(props.alt)} onClick={() => lightbox.open()}>
+      <img src={props.src} alt={props.alt} loading="lazy" decoding="async" referrerPolicy="no-referrer"
+        className="maka-markdown-attachment-image" onLoad={() => setLoaded(true)} onError={props.onError} />
+    </button>
+    {lightbox.isOpen && lightbox.element}
+  </>;
+}
+function isWebImage(source: string): boolean {
+  try { return ['http:', 'https:'].includes(new URL(source).protocol); } catch { return false; }
+}
diff --git a/packages/ui/src/markdown.tsx b/packages/ui/src/markdown.tsx
index 529795332f..3cb73d1f1e 100644
--- a/packages/ui/src/markdown.tsx
+++ b/packages/ui/src/markdown.tsx
@@ -55,6 +55,7 @@ const MarkdownBody = lazy(() => import('./markdown-body.js').then((m) => ({ defa
 
 export function Markdown(props: {
   text: string;
+  imageIdentity?: { turnId: string; messageId: string };
   streaming?: boolean;
   settledText?: string;
   /** Block rhythm. Transcript turns pass `compact`; documents leave it. */
@@ -78,6 +79,7 @@ export function Markdown(props: {
     >
       <MarkdownBody
         text={safeText}
+        imageIdentity={props.imageIdentity}
         streaming={streaming}
         settledText={safeSettledText}
         density={props.density}
diff --git a/packages/ui/src/shared-ui-copy.ts b/packages/ui/src/shared-ui-copy.ts
index 74d2aed636..5f85e840e9 100644
--- a/packages/ui/src/shared-ui-copy.ts
+++ b/packages/ui/src/shared-ui-copy.ts
@@ -30,6 +30,15 @@ export interface SharedUiCopy {
   markdown: {
     invalidInternalLink: string;
     unsafeLink: string;
+    imageLoading: string;
+    imageSaving: string;
+    imageExpand: (alt: string) => string;
+    imageArchiveFailure: (reason: import('@maka/core/image-delivery').ImageDeliveryFailure) => string;
+    imageUnavailable: string;
+    imageLoadFailed: string;
+    imageUnsupported: string;
+    imageRetry: string;
+    imageOpen: string;
     taskList: string;
     table: string;
     checkbox: string;
@@ -125,6 +134,15 @@ const SHARED_UI_COPY = {
     markdown: {
       invalidInternalLink: '内部链接无效',
       unsafeLink: '链接不安全',
+      imageLoading: '正在加载图片…',
+      imageSaving: '正在保存图片…',
+      imageExpand: (alt) => alt ? `放大图片：${alt}` : '放大图片',
+      imageArchiveFailure: (reason) => reason === 'quota_exceeded' ? '图片未保存：存储配额已满。' : reason === 'too_large' ? '图片未保存：超过 2 MiB 自动保存上限。' : reason === 'not_allowed' ? '图片未保存：当前权限不允许读取。' : '图片未保存，原文件或链接失效后可能无法查看。',
+      imageUnavailable: '当前无法读取图片附件。',
+      imageLoadFailed: '图片加载失败，请重试。',
+      imageUnsupported: '此图片地址无法直接显示，请将图片作为会话附件发送。',
+      imageRetry: '重试',
+      imageOpen: '在浏览器中打开',
       taskList: '任务列表',
       table: '表格',
       checkbox: '复选框',
@@ -205,6 +223,15 @@ const SHARED_UI_COPY = {
     markdown: {
       invalidInternalLink: '內部連結無效',
       unsafeLink: '連結不安全',
+      imageLoading: '正在載入圖片…',
+      imageSaving: '正在儲存圖片…',
+      imageExpand: (alt) => alt ? `放大圖片：${alt}` : '放大圖片',
+      imageArchiveFailure: (reason) => reason === 'quota_exceeded' ? '圖片未儲存：儲存配額已滿。' : reason === 'too_large' ? '圖片未儲存：超過 2 MiB 自動儲存上限。' : reason === 'not_allowed' ? '圖片未儲存：目前權限不允許讀取。' : '圖片未儲存，原檔案或連結失效後可能無法查看。',
+      imageUnavailable: '目前無法讀取圖片附件。',
+      imageLoadFailed: '圖片載入失敗，請重試。',
+      imageUnsupported: '此圖片位址無法直接顯示，請將圖片作為對話附件傳送。',
+      imageRetry: '重試',
+      imageOpen: '在瀏覽器中開啟',
       taskList: '任務列表',
       table: '表格',
       checkbox: '核取方塊',
@@ -285,6 +312,15 @@ const SHARED_UI_COPY = {
     markdown: {
       invalidInternalLink: 'Invalid internal link',
       unsafeLink: 'Unsafe link',
+      imageLoading: 'Loading image…',
+      imageSaving: 'Saving image…',
+      imageExpand: (alt) => alt ? `Enlarge image: ${alt}` : 'Enlarge image',
+      imageArchiveFailure: (reason) => reason === 'quota_exceeded' ? 'Image not saved: storage quota reached.' : reason === 'too_large' ? 'Image not saved: exceeds the 2 MiB automatic save limit.' : reason === 'not_allowed' ? 'Image not saved: current permissions do not allow reading it.' : 'Image not saved. It may become unavailable if the original file or link expires.',
+      imageUnavailable: 'This image attachment is unavailable here.',
+      imageLoadFailed: 'Could not load the image. Try again.',
+      imageUnsupported: 'This image address cannot be displayed. Send the image as a chat attachment.',
+      imageRetry: 'Retry',
+      imageOpen: 'Open in browser',
       taskList: 'Task list',
       table: 'Table',
       checkbox: 'Checkbox',
diff --git a/packages/ui/src/styles.css b/packages/ui/src/styles.css
index 662cae92ee..1255608664 100644
--- a/packages/ui/src/styles.css
+++ b/packages/ui/src/styles.css
@@ -625,6 +625,51 @@
   margin-block: var(--space-3) var(--space-4);
 }
 
+.maka-markdown-image-placeholder {
+  display: inline-flex;
+  flex-direction: column;
+  gap: var(--space-2);
+  max-width: 100%;
+  padding: var(--space-3);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-surface);
+  color: var(--muted-foreground);
+  overflow-wrap: anywhere;
+}
+.maka-markdown-image-caption { color: var(--foreground); }
+.maka-markdown-image-actions {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: var(--space-3);
+}
+.maka-markdown-image-actions button {
+  align-self: start;
+  border: 1px solid var(--border);
+  border-radius: var(--radius-control);
+  padding: var(--space-1) var(--space-2);
+  background: var(--background);
+  color: var(--foreground);
+  font: inherit;
+  cursor: pointer;
+}
+
+.maka-markdown-image-resource { display: inline-block; position: relative; max-width: 100%; }
+.maka-markdown-image-preview {
+  display: inline-block;
+  max-width: 100%;
+  padding: 0;
+  border: 0;
+  border-radius: var(--radius-control);
+  background: transparent;
+  cursor: zoom-in;
+  overflow: hidden;
+}
+.maka-markdown-image-preview:focus-visible { outline: 2px solid var(--ring); outline-offset: 2px; }
+.maka-markdown-image-preview img { margin: 0; max-height: 480px; object-fit: contain; }
+.maka-markdown-image-loading { display: block; color: var(--muted-foreground); font-size: var(--maka-font-size-sm); }
+.maka-markdown-image-saving { display: block; color: var(--muted-foreground); font-size: var(--maka-font-size-sm); margin-block-start: var(--space-1); }
+
 /* Markdown code renderers are custom components so Mermaid can be loaded only
    for settled Mermaid fences. Astryx skips its own spacing wrapper when
    `components.code` is set, so the custom block sits directly in the document

From 640c6b30eab2926dac21bcda3aed3fb958b58345 Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Mon, 5 Oct 2026 23:38:11 +0800
Subject: [PATCH 02/35] fix(ci): use Astryx image controls and update
 dependency notices

Generated-by: Codex (GPT-6)
---
 .../licenses/npm/THIRD_PARTY_NOTICES.txt      | 53 +++++++++++++++++++
 docs/astryx-surface-file-inventory.paths      |  2 +
 .../scripts/markdown-images.browser.test.mjs  |  8 ++-
 packages/ui/src/markdown-image.tsx            | 14 ++---
 packages/ui/src/styles.css                    | 22 ++------
 5 files changed, 74 insertions(+), 25 deletions(-)

diff --git a/apps/desktop/resources/licenses/npm/THIRD_PARTY_NOTICES.txt b/apps/desktop/resources/licenses/npm/THIRD_PARTY_NOTICES.txt
index 7e62f8d604..dbe751bc9b 100644
--- a/apps/desktop/resources/licenses/npm/THIRD_PARTY_NOTICES.txt
+++ b/apps/desktop/resources/licenses/npm/THIRD_PARTY_NOTICES.txt
@@ -12696,6 +12696,59 @@ This software is provided by the copyright holders and contributors “as is”
 
 ================================================================================
 
+Package: marked@18.0.11
+Declared license: MIT
+Selected license: MIT
+Repository: git+https://github.com/markedjs/marked.git
+
+--- LICENSE ---
+# License information
+
+## Contribution License Agreement
+
+If you contribute code to this project, you are implicitly allowing your code
+to be distributed under the MIT license. You are also implicitly verifying that
+all code is your original work. `</legalese>`
+
+## Marked
+
+Copyright (c) 2018+, MarkedJS (https://github.com/markedjs/)
+Copyright (c) 2011-2018, Christopher Jeffrey (https://github.com/chjj/)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+
+## Markdown
+
+Copyright © 2004, John Gruber
+http://daringfireball.net/
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+
+* Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+* Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+* Neither the name “Markdown” nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+
+This software is provided by the copyright holders and contributors “as is” and any express or implied warranties, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose are disclaimed. In no event shall the copyright owner or contributors be liable for any direct, indirect, incidental, special, exemplary, or consequential damages (including, but not limited to, procurement of substitute goods or services; loss of use, data, or profits; or business interruption) however caused and on any theory of liability, whether in contract, strict liability, or tort (including negligence or otherwise) arising in any way out of the use of this software, even if advised of the possibility of such damage.
+
+================================================================================
+
 Package: math-intrinsics@1.1.0
 Declared license: MIT
 Selected license: MIT
diff --git a/docs/astryx-surface-file-inventory.paths b/docs/astryx-surface-file-inventory.paths
index 6fab66f4bd..ebae26ff53 100644
--- a/docs/astryx-surface-file-inventory.paths
+++ b/docs/astryx-surface-file-inventory.paths
@@ -278,11 +278,13 @@ packages/ui/src/directory-reference-chip.tsx
 packages/ui/src/executor-model-picker.tsx
 packages/ui/src/form-interaction-prompt.tsx
 packages/ui/src/icons.tsx
+packages/ui/src/image-delivery.tsx
 packages/ui/src/inline-reference.tsx
 packages/ui/src/inline-rename-input.tsx
 packages/ui/src/locale-context.tsx
 packages/ui/src/maka-wordmark.tsx
 packages/ui/src/markdown-body.tsx
+packages/ui/src/markdown-image.tsx
 packages/ui/src/markdown-math.tsx
 packages/ui/src/markdown.tsx
 packages/ui/src/mermaid-diagram.tsx
diff --git a/packages/ui/scripts/markdown-images.browser.test.mjs b/packages/ui/scripts/markdown-images.browser.test.mjs
index abfca5e050..fd6f964a6b 100644
--- a/packages/ui/scripts/markdown-images.browser.test.mjs
+++ b/packages/ui/scripts/markdown-images.browser.test.mjs
@@ -120,7 +120,9 @@ test('remote image loads automatically under the actual desktop CSP, without sen
     assert.equal(await page.getByRole('button', { name: 'Load image', exact: true }).count(), 0);
     await loaded(page);
     assert.deepEqual(requests, [{ path: '/image.png', referer: undefined }]);
-    assert.equal(await page.getByRole('status').count(), 0);
+    // Astryx Button keeps an empty live region for asynchronous actions.
+    await page.getByText('Loading image…', { exact: true }).waitFor({ state: 'hidden' });
+    assert.equal(await page.getByRole('status').filter({ hasText: /\S/ }).count(), 0);
   } finally { await page.close(); }
 });
 
@@ -185,7 +187,9 @@ test('a new remote image previews during archival and switches to saved bytes af
     await page.getByText('Saving image…').waitFor();
     assert.equal(requests.length, 1);
     await page.waitForFunction(() => [...document.images].some(img=>img.src.startsWith('data:image/png;') && img.naturalWidth===1));
-    assert.equal(await page.getByRole('status').count(), 0);
+    await page.getByText('Loading image…', { exact: true }).waitFor({ state: 'hidden' });
+    await page.getByText('Saving image…', { exact: true }).waitFor({ state: 'hidden' });
+    assert.equal(await page.getByRole('status').filter({ hasText: /\S/ }).count(), 0);
     assert.equal(await page.evaluate(() => window.deliveryQueries), 2);
     assert.equal(requests.length, 1);
   } finally { await page.close(); }
diff --git a/packages/ui/src/markdown-image.tsx b/packages/ui/src/markdown-image.tsx
index 46121a69ff..a7a8911ae6 100644
--- a/packages/ui/src/markdown-image.tsx
+++ b/packages/ui/src/markdown-image.tsx
@@ -18,7 +18,7 @@
  */
 
 import { useEffect, useRef, useState } from 'react';
-import { useLightbox } from '@astryxdesign/core';
+import { Button, useLightbox } from '@astryxdesign/core';
 import { Link } from '@astryxdesign/core/Link';
 import { parseAttachmentResourceRef } from '@maka/core/attachments';
 import { useAttachmentImage } from './attachment-image.js';
@@ -55,7 +55,7 @@ function ImageResource(props: { src: string; alt: string }) {
     if (artifactId) image.retry(); else delivery.retry();
   };
   const sourceActions = <span className="maka-markdown-image-actions">
-    <button type="button" onClick={retry}>{copy.imageRetry}</button>
+    <Button variant="ghost" size="sm" label={copy.imageRetry} onClick={retry} />
     {remote && <Link href={props.src} isExternalLink type="inherit" hasUnderline>{copy.imageOpen}</Link>}
   </span>;
   let message: string | undefined;
@@ -82,10 +82,12 @@ function DisplayImage(props: { src: string; alt: string; onError(): void }) {
   const lightbox = useLightbox({ media: { src: props.src, alt: props.alt }, hasZoom: true });
   return <>
     {!loaded && <span className="maka-markdown-image-loading" role="status">{copy.imageLoading}</span>}
-    <button type="button" className="maka-markdown-image-preview" aria-label={copy.imageExpand(props.alt)} onClick={() => lightbox.open()}>
-      <img src={props.src} alt={props.alt} loading="lazy" decoding="async" referrerPolicy="no-referrer"
-        className="maka-markdown-attachment-image" onLoad={() => setLoaded(true)} onError={props.onError} />
-    </button>
+    <span className="maka-markdown-image-preview">
+      <Button variant="ghost" label={copy.imageExpand(props.alt)} onClick={() => lightbox.open()}>
+        <img src={props.src} alt={props.alt} loading="lazy" decoding="async" referrerPolicy="no-referrer"
+          className="maka-markdown-attachment-image" onLoad={() => setLoaded(true)} onError={props.onError} />
+      </Button>
+    </span>
     {lightbox.isOpen && lightbox.element}
   </>;
 }
diff --git a/packages/ui/src/styles.css b/packages/ui/src/styles.css
index 1255608664..9e10a5cfb1 100644
--- a/packages/ui/src/styles.css
+++ b/packages/ui/src/styles.css
@@ -643,29 +643,17 @@
   align-items: center;
   gap: var(--space-3);
 }
-.maka-markdown-image-actions button {
-  align-self: start;
-  border: 1px solid var(--border);
-  border-radius: var(--radius-control);
-  padding: var(--space-1) var(--space-2);
-  background: var(--background);
-  color: var(--foreground);
-  font: inherit;
-  cursor: pointer;
-}
-
 .maka-markdown-image-resource { display: inline-block; position: relative; max-width: 100%; }
 .maka-markdown-image-preview {
   display: inline-block;
   max-width: 100%;
+}
+/* Keep the image's natural dimensions; Astryx owns interaction and focus styling. */
+.maka-markdown-image-preview .astryx-button {
+  max-width: 100%;
+  height: auto;
   padding: 0;
-  border: 0;
-  border-radius: var(--radius-control);
-  background: transparent;
-  cursor: zoom-in;
-  overflow: hidden;
 }
-.maka-markdown-image-preview:focus-visible { outline: 2px solid var(--ring); outline-offset: 2px; }
 .maka-markdown-image-preview img { margin: 0; max-height: 480px; object-fit: contain; }
 .maka-markdown-image-loading { display: block; color: var(--muted-foreground); font-size: var(--maka-font-size-sm); }
 .maka-markdown-image-saving { display: block; color: var(--muted-foreground); font-size: var(--maka-font-size-sm); margin-block-start: var(--space-1); }

From ac93c347ae3fb919873fd8a074108bc5f1e4962e Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Tue, 6 Oct 2026 00:03:36 +0800
Subject: [PATCH 03/35] fix(chat): recover streamed images and bound local
 capture

Reuse existing image controls and filesystem permissions, separate chat image validation from model input limits, and honor capture deadlines and Host drain. Add regression coverage for streaming, wide images, FIFOs and cancellation.

Generated-by: Codex (GPT-6)
---
 .../src/__tests__/chat-image-delivery.test.ts | 50 ++++++++++-
 .../src/server/chat-image-delivery.ts         | 10 ++-
 .../builtin-tools-file-worker.test.ts         |  8 +-
 .../runtime/src/__tests__/image-file.test.ts  | 89 +++++++++++++++++++
 packages/runtime/src/builtin-tools.ts         |  2 +-
 packages/runtime/src/filesystem-executor.ts   |  2 +
 .../src/filesystem-worker/operations.ts       |  4 +-
 .../runtime/src/filesystem-worker/protocol.ts |  8 +-
 packages/runtime/src/image-file-reader.ts     |  5 +-
 packages/runtime/src/image-file.ts            | 43 +++++++--
 packages/runtime/src/workspace-executor.ts    |  6 +-
 .../scripts/markdown-images.browser.test.mjs  | 50 ++++++++---
 packages/ui/src/image-delivery.tsx            | 12 +--
 packages/ui/src/markdown-body.tsx             |  2 +-
 packages/ui/src/markdown-image.tsx            | 10 ++-
 packages/ui/src/styles.css                    | 12 +--
 16 files changed, 264 insertions(+), 49 deletions(-)

diff --git a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
index 5437d9b46f..dcc1bc2d94 100644
--- a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
+++ b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
@@ -25,7 +25,10 @@ import { join } from 'node:path';
 import { createServer } from 'node:http';
 import { openInteractiveArtifactStoreForWrite } from '@maka/storage/artifact-stores';
 import { resolveStorageRoot, tryAcquireInteractiveRootOwner } from '@maka/storage/root-authority';
-import { ChatImageDeliveryService } from '../server/chat-image-delivery.js';
+import {
+  ChatImageDeliveryService,
+  type ChatImageDeliveryPorts,
+} from '../server/chat-image-delivery.js';
 import { chatImageSources } from '../server/chat-image-markdown.js';
 import { checkedChatImage, downloadChatImage } from '../server/chat-image-source.js';
 import { IMAGE_DELIVERY_OPERATION_SPECS } from '../protocol/image-delivery.js';
@@ -40,7 +43,10 @@ const REQUEST = {
   messageId: 'message-1',
   source: '/tmp/image.png',
 };
-async function fixture(limits?: { sessionBytes: number; workspaceBytes: number }) {
+async function fixture(
+  limits?: { sessionBytes: number; workspaceBytes: number },
+  readLocalImage?: ChatImageDeliveryPorts['readLocalImage'],
+) {
   const root = await mkdtemp(join(tmpdir(), 'maka-image-delivery-'));
   const owner = await tryAcquireInteractiveRootOwner(
     await resolveStorageRoot({ path: root, kind: 'interactive' }),
@@ -59,8 +65,9 @@ async function fixture(limits?: { sessionBytes: number; workspaceBytes: number }
     limits,
     isPresent: async () => present,
     readMessage: async (i) => messages.get(i.messageId),
-    readLocalImage: async (_sessionId, path) => {
+    readLocalImage: async (sessionId, path, signal) => {
       reads++;
+      if (readLocalImage) return readLocalImage(sessionId, path, signal);
       return checkedChatImage(await readFile(path));
     },
     acquireResidency: () => {
@@ -98,6 +105,43 @@ async function fixture(limits?: { sessionBytes: number; workspaceBytes: number }
     },
   };
 }
+
+test('Host drain releases both capture slots even when a source reader ignores cancellation', {
+  timeout: 2000,
+}, async () => {
+  const f = await fixture(undefined, () => new Promise(() => {}));
+  try {
+    observe(f.service, '/tmp/blocked-1.png');
+    observe(f.service, '/tmp/blocked-2.png', 'session-1', 'message-2');
+    while (f.reads < 2) await new Promise((resolve) => setImmediate(resolve));
+    await f.service.close();
+    assert.equal(f.leases, 0);
+    assert.deepEqual(f.errors, []);
+  } finally {
+    await f.close();
+  }
+});
+test('a stalled local source expires within its read budget and can be retried', {
+  timeout: 15000,
+}, async () => {
+  let reads = 0;
+  const f = await fixture(undefined, async () => {
+    if (++reads === 1) return new Promise(() => {});
+    return checkedChatImage(PNG);
+  });
+  try {
+    observe(f.service, REQUEST.source);
+    await f.service.waitForIdle();
+    assert.deepEqual(await f.service.resolve(REQUEST), { status: 'failed', reason: 'read_failed' });
+    assert.equal(f.leases, 0);
+    assert.equal((await f.service.resolve({ ...REQUEST, retry: true })).status, 'pending');
+    await f.service.waitForIdle();
+    assert.equal((await f.service.resolve(REQUEST)).status, 'ready');
+    assert.deepEqual(f.errors, []);
+  } finally {
+    await f.close();
+  }
+});
 function observe(
   service: ChatImageDeliveryService,
   source: string,
diff --git a/packages/runtime-host/src/server/chat-image-delivery.ts b/packages/runtime-host/src/server/chat-image-delivery.ts
index 0fe5c2bd92..44fafa879a 100644
--- a/packages/runtime-host/src/server/chat-image-delivery.ts
+++ b/packages/runtime-host/src/server/chat-image-delivery.ts
@@ -33,6 +33,7 @@ import {
 } from '@maka/storage/artifact-stores';
 import type { SessionAdmissionGate } from './session-admission-gate.js';
 import { chatImageSources } from './chat-image-markdown.js';
+import { abortable } from '../client/wait-for-ready.js';
 import {
   checkedChatImage,
   downloadChatImage,
@@ -239,7 +240,9 @@ export class ChatImageDeliveryService {
     try {
       const path = localImagePath(source);
       if (path !== undefined)
-        image = checkedChatImage((await this.ports.readLocalImage(sessionId, path, signal)).bytes);
+        image = checkedChatImage(
+          (await abortable(() => this.ports.readLocalImage(sessionId, path, signal), signal)).bytes,
+        );
       else {
         try {
           image = await (this.ports.download ?? downloadChatImage)(source, signal);
@@ -326,6 +329,11 @@ function deliveryKey(i: DeliveryIdentity): string {
 function failureReason(error: unknown, source: string): ImageDeliveryFailure {
   if (error instanceof ImageSourceError) return error.reason;
   const code = (error as NodeJS.ErrnoException | undefined)?.code;
+  if (
+    code === 'ERR_IMAGE_TOO_LARGE' ||
+    (error instanceof Error && /exceeds.*(?:MiB|MB)/i.test(error.message))
+  )
+    return 'too_large';
   if (error instanceof Error && /supported raster|requires a PNG|not.*image/i.test(error.message))
     return 'unsupported_mime';
   if (code === 'ENOENT' || code === 'ENOTDIR') return 'not_found';
diff --git a/packages/runtime/src/__tests__/builtin-tools-file-worker.test.ts b/packages/runtime/src/__tests__/builtin-tools-file-worker.test.ts
index cd8793c884..b7d34f4e57 100644
--- a/packages/runtime/src/__tests__/builtin-tools-file-worker.test.ts
+++ b/packages/runtime/src/__tests__/builtin-tools-file-worker.test.ts
@@ -74,7 +74,7 @@ describe('builtin file tools use the sandboxed worker', () => {
             emitOutput() {},
           },
         ),
-      /requires a PNG/,
+      /not a supported.*PNG/,
     );
     assert.equal(published, 0);
   });
@@ -664,7 +664,11 @@ test('chat image reader uses the managed Read boundary and never falls back to h
       execute: async (input) => {
         calls++;
         assert.deepEqual(input.executionBoundary, executionBoundary);
-        assert.deepEqual(input.operation, { kind: 'read', path: 'private.png' });
+        assert.deepEqual(input.operation, {
+          kind: 'read',
+          path: 'private.png',
+          imagePurpose: 'chat',
+        });
         throw new Error('sandbox permission refused');
       },
     },
diff --git a/packages/runtime/src/__tests__/image-file.test.ts b/packages/runtime/src/__tests__/image-file.test.ts
index c8e2636ca3..1efe9cc674 100644
--- a/packages/runtime/src/__tests__/image-file.test.ts
+++ b/packages/runtime/src/__tests__/image-file.test.ts
@@ -18,6 +18,7 @@
  */
 
 import { test } from 'node:test';
+import { execFileSync } from 'node:child_process';
 import assert from 'node:assert/strict';
 import { mkdtemp, realpath, rm, writeFile, truncate } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
@@ -26,11 +27,99 @@ import { readWorkspaceFile, validateImageBytes } from '../image-file.js';
 import { LocalWorkspaceExecutor } from '../workspace-executor.js';
 import { executeFilesystemOperation } from '../filesystem-worker/operations.js';
 import { MAX_READ_IMAGE_BYTES } from '@maka/core/attachments';
+import { ARTIFACT_IMAGE_PREVIEW_MAX_BYTES } from '@maka/core/artifacts';
+import { createImageFileReader } from '../image-file-reader.js';
+import { buildBuiltinTools } from '../builtin-tools.js';
 
 const ONE_PIXEL_PNG = Buffer.from(
   'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8DwHwAFBQIAX8jx0gAAAABJRU5ErkJggg==',
   'base64',
 );
+// Valid 2560x1 PNG, wider than the model input limit but within chat's byte budget.
+const WIDE_PNG = Buffer.from(
+  'iVBORw0KGgoAAAANSUhEUgAACgAAAAABCAYAAAASePczAAAAIUlEQVR4nO3BAQ0AAADCoPdPbQ43oAAAAAAAAAAAAIA7AygBAAEQnI5pAAAAAElFTkSuQmCC',
+  'base64',
+);
+
+for (const route of ['workspace', 'worker'] as const) {
+  test(`${route} chat reads admit wide screenshots without relaxing ordinary Read`, async (t) => {
+    const cwd = await realpath(await mkdtemp(join(tmpdir(), 'maka-chat-image-policy-')));
+    t.after(() => rm(cwd, { recursive: true, force: true }));
+    const path = join(cwd, 'wide.png');
+    const read = (imagePurpose?: 'chat') =>
+      route === 'workspace'
+        ? new LocalWorkspaceExecutor().readFile({
+            cwd,
+            path,
+            ...(imagePurpose ? { imagePurpose } : {}),
+          })
+        : executeFilesystemOperation(
+            { kind: 'read', cwd, path, ...(imagePurpose ? { imagePurpose } : {}) },
+            {
+              filesystem: { entries: [{ path: cwd, access: 'read', scope: 'subtree' }] },
+            },
+          );
+    await writeFile(path, WIDE_PNG);
+    await assert.rejects(read(), /dimensions.*model input limit/i);
+    const result = await read('chat');
+    if ('base64' in result) assert.deepEqual(Buffer.from(result.base64, 'base64'), WIDE_PNG);
+    else {
+      assert.ok('bytes' in result && result.bytes instanceof Uint8Array);
+      assert.deepEqual(Buffer.from(result.bytes), WIDE_PNG);
+    }
+    await truncate(path, ARTIFACT_IMAGE_PREVIEW_MAX_BYTES + 1);
+    await assert.rejects(read('chat'), /2 MiB/);
+    await writeFile(path, 'not an image');
+    await assert.rejects(read('chat'), /not a supported/i);
+  });
+}
+
+test('PublishImage saves a wide screenshot through the same chat read policy', async (t) => {
+  const cwd = await mkdtemp(join(tmpdir(), 'maka-publish-wide-'));
+  t.after(() => rm(cwd, { recursive: true, force: true }));
+  await writeFile(join(cwd, 'wide.png'), WIDE_PNG);
+  let published = false;
+  const tool = buildBuiltinTools({
+    publishImage: async ({ bytes }) => {
+      assert.deepEqual(Buffer.from(bytes), WIDE_PNG);
+      published = true;
+      return { kind: 'session_file', sessionId: 'session', relativePath: 'saved-image' };
+    },
+  }).find((tool) => tool.name === 'PublishImage')!;
+  await tool.impl(
+    { path: 'wide.png' },
+    {
+      sessionId: 'session',
+      turnId: 'turn',
+      toolCallId: 'publish',
+      cwd,
+      permissionMode: 'bypass',
+      executionBoundary: { kind: 'bypass', revision: 0 },
+      abortSignal: new AbortController().signal,
+      emitOutput() {},
+    },
+  );
+  assert.equal(published, true);
+});
+
+test('chat reads reject FIFOs without waiting for a writer', {
+  skip: process.platform === 'win32',
+  timeout: 1000,
+}, async (t) => {
+  const cwd = await mkdtemp(join(tmpdir(), 'maka-image-fifo-'));
+  t.after(() => rm(cwd, { recursive: true, force: true }));
+  const path = join(cwd, 'blocked.png');
+  execFileSync('mkfifo', [path]);
+  await assert.rejects(createImageFileReader()({ path, cwd }), /not a file/i);
+});
+
+test('chat reads honor cancellation before opening the source', async () => {
+  const abortSignal = AbortSignal.abort(new Error('capture cancelled'));
+  await assert.rejects(
+    readWorkspaceFile('/missing.png', { imagePurpose: 'chat', abortSignal }),
+    /capture cancelled/,
+  );
+});
 
 for (const route of ['workspace', 'worker']) {
   for (const name of ['image.png', 'image', 'image.bin']) {
diff --git a/packages/runtime/src/builtin-tools.ts b/packages/runtime/src/builtin-tools.ts
index 3ec9a9de73..7fc6492405 100644
--- a/packages/runtime/src/builtin-tools.ts
+++ b/packages/runtime/src/builtin-tools.ts
@@ -326,7 +326,7 @@ export function buildBuiltinTools(options: BuildBuiltinToolsOptions = {}): MakaT
             executionFacts,
             impl: async ({ path }: { path: string }, ctx: MakaToolContext) => {
               const result = await filesystem.execute({
-                operation: { kind: 'read', path },
+                operation: { kind: 'read', path, imagePurpose: 'chat' },
                 ...filesystemCall(ctx),
               });
               if (
diff --git a/packages/runtime/src/filesystem-executor.ts b/packages/runtime/src/filesystem-executor.ts
index 4875f97f2b..99921db8dc 100644
--- a/packages/runtime/src/filesystem-executor.ts
+++ b/packages/runtime/src/filesystem-executor.ts
@@ -394,6 +394,8 @@ function createWorkspaceFilesystemExecutor(
           const result = await workspace.readFile({
             cwd,
             path,
+            ...(operation.imagePurpose ? { imagePurpose: operation.imagePurpose } : {}),
+            ...(abortSignal ? { abortSignal } : {}),
           });
           if ('bytes' in result) {
             return { kind: 'read_image', bytes: result.bytes, mimeType: result.mimeType };
diff --git a/packages/runtime/src/filesystem-worker/operations.ts b/packages/runtime/src/filesystem-worker/operations.ts
index bc2dcfbfe2..eedd55ab8b 100644
--- a/packages/runtime/src/filesystem-worker/operations.ts
+++ b/packages/runtime/src/filesystem-worker/operations.ts
@@ -124,7 +124,9 @@ export async function executeFilesystemOperation(
         'read',
         operationBoundary,
       );
-      const file = await readWorkspaceFile(path).catch((error: unknown) => {
+      const file = await readWorkspaceFile(path, {
+        ...(operation.imagePurpose ? { imagePurpose: operation.imagePurpose } : {}),
+      }).catch((error: unknown) => {
         throw operationError(
           'filesystem_error',
           error instanceof Error ? error.message : 'File could not be read.',
diff --git a/packages/runtime/src/filesystem-worker/protocol.ts b/packages/runtime/src/filesystem-worker/protocol.ts
index efacffe3bc..3c3a07a61e 100644
--- a/packages/runtime/src/filesystem-worker/protocol.ts
+++ b/packages/runtime/src/filesystem-worker/protocol.ts
@@ -22,10 +22,9 @@ import { readContinuationSchema, readPageSchema } from '../read-page.js';
 import { validateSandboxBoundaryExpansion } from '@maka/core/sandbox-boundary';
 import { GREP_MAX_LINES, GREP_MAX_LINES_PER_FILE, GREP_MAX_MATCH_BYTES } from '../grep-search.js';
 
-// v10 adds bounded Read pages to v9's exact Grep counts; v11 adds Glob's
-// truncation flag to v10's result contract. Older workers cannot satisfy the
-// combined result contract and must be rejected at the handshake.
-export const FILESYSTEM_WORKER_PROTOCOL_VERSION = 11 as const;
+// v12 adds chat image reads with a bounded payload and no model dimension limit.
+// Older workers cannot satisfy this read policy and must be rejected at the handshake.
+export const FILESYSTEM_WORKER_PROTOCOL_VERSION = 12 as const;
 
 /** The single authority on which operation kinds are writes. Shared by the
  * client (permission/identity decisions) and the worker (operation guards) so
@@ -107,6 +106,7 @@ export const FilesystemWorkerOperationSchema = z.union([
       kind: z.literal('read'),
       cwd,
       path,
+      imagePurpose: z.literal('chat').optional(),
       offset: z.number().int().nonnegative().optional(),
       limit: z.number().int().positive().optional(),
       continuation: readContinuationSchema.optional(),
diff --git a/packages/runtime/src/image-file-reader.ts b/packages/runtime/src/image-file-reader.ts
index e283c0f506..c219de848c 100644
--- a/packages/runtime/src/image-file-reader.ts
+++ b/packages/runtime/src/image-file-reader.ts
@@ -37,7 +37,10 @@ export function createImageFileReader(
   });
   return async (input: Omit<FilesystemExecuteInput, 'operation'> & { path: string }) => {
     const { path, ...context } = input;
-    const result = await filesystem.execute({ ...context, operation: { kind: 'read', path } });
+    const result = await filesystem.execute({
+      ...context,
+      operation: { kind: 'read', path, imagePurpose: 'chat' },
+    });
     if (result.kind !== 'read_image') throw new Error('Not a supported raster image');
     return { bytes: result.bytes, mimeType: result.mimeType };
   };
diff --git a/packages/runtime/src/image-file.ts b/packages/runtime/src/image-file.ts
index 38f56809d4..3714892891 100644
--- a/packages/runtime/src/image-file.ts
+++ b/packages/runtime/src/image-file.ts
@@ -17,6 +17,7 @@
  * under the License.
  */
 
+import { constants } from 'node:fs';
 import { open } from 'node:fs/promises';
 import { extname } from 'node:path';
 import { imageDimensionsFromData } from 'image-dimensions';
@@ -27,6 +28,12 @@ import {
   READ_IMAGE_TOO_LARGE_MESSAGE,
   sniffAttachmentMimeType,
 } from '@maka/core/attachments';
+import { ARTIFACT_IMAGE_PREVIEW_MAX_BYTES } from '@maka/core/artifacts';
+
+export interface WorkspaceFileReadOptions {
+  imagePurpose?: 'chat';
+  abortSignal?: AbortSignal;
+}
 
 const IMAGE_EXTENSIONS = new Set(['.png', '.jpg', '.jpeg', '.gif', '.webp']);
 export type ImageMimeType = 'image/png' | 'image/jpeg' | 'image/gif' | 'image/webp';
@@ -38,9 +45,22 @@ export function isSupportedImagePath(path: string): boolean {
 /** Classify a bounded prefix before decoding text or allocating an image body. */
 export async function readWorkspaceFile(
   path: string,
+  options: WorkspaceFileReadOptions = {},
 ): Promise<{ content: string } | { bytes: Uint8Array; mimeType: ImageMimeType }> {
-  const file = await open(path, 'r');
+  options.abortSignal?.throwIfAborted();
+  // Chat capture must never block opening a FIFO or read an unbounded text file.
+  const file = await open(
+    path,
+    options.imagePurpose === 'chat' ? constants.O_RDONLY | constants.O_NONBLOCK : 'r',
+  );
   try {
+    options.abortSignal?.throwIfAborted();
+    if (options.imagePurpose === 'chat') {
+      const size = await file.stat();
+      if (!size.isFile()) throw new Error('Image path is not a file.');
+      if (size.size > ARTIFACT_IMAGE_PREVIEW_MAX_BYTES) throw imageTooLargeError('chat');
+      return validateImageBytes(await file.readFile({ signal: options.abortSignal }), 'chat');
+    }
     const prefix = Buffer.alloc(ATTACHMENT_MIME_SNIFF_BYTES);
     // A positioned read leaves the descriptor's offset at zero for readFile.
     const { bytesRead } = await file.read(prefix, 0, prefix.length, 0);
@@ -56,11 +76,15 @@ export async function readWorkspaceFile(
   }
 }
 
-export function validateImageBytes(bytes: Uint8Array): {
+export function validateImageBytes(
+  bytes: Uint8Array,
+  purpose: 'model' | 'chat' = 'model',
+): {
   bytes: Uint8Array;
   mimeType: ImageMimeType;
 } {
-  if (bytes.length > MAX_READ_IMAGE_BYTES) throw imageTooLargeError();
+  if (bytes.length > (purpose === 'chat' ? ARTIFACT_IMAGE_PREVIEW_MAX_BYTES : MAX_READ_IMAGE_BYTES))
+    throw imageTooLargeError(purpose);
   const mimeType = sniffImageMime(bytes);
   if (!mimeType) throw new Error('Image content is not a supported PNG, JPEG, GIF, or WebP file.');
   const dimensions = imageDimensionsFromData(bytes);
@@ -75,7 +99,7 @@ export function validateImageBytes(bytes: Uint8Array): {
   ) {
     throw new Error('Image dimensions could not be read; verify the image file is valid.');
   }
-  if (Math.max(dimensions.width, dimensions.height) > MAX_MODEL_IMAGE_EDGE) {
+  if (purpose === 'model' && Math.max(dimensions.width, dimensions.height) > MAX_MODEL_IMAGE_EDGE) {
     throw new Error(
       `Image dimensions ${dimensions.width}x${dimensions.height} exceed the ${MAX_MODEL_IMAGE_EDGE}px model input limit; downscale it and try again.`,
     );
@@ -83,8 +107,15 @@ export function validateImageBytes(bytes: Uint8Array): {
   return { bytes, mimeType };
 }
 
-function imageTooLargeError(): Error {
-  return new Error(READ_IMAGE_TOO_LARGE_MESSAGE);
+function imageTooLargeError(purpose: 'model' | 'chat' = 'model'): Error {
+  return Object.assign(
+    new Error(
+      purpose === 'chat'
+        ? 'Image exceeds the 2 MiB chat preview limit; resize it before publishing.'
+        : READ_IMAGE_TOO_LARGE_MESSAGE,
+    ),
+    { code: 'ERR_IMAGE_TOO_LARGE' },
+  );
 }
 
 function sniffImageMime(bytes: Uint8Array): ImageMimeType | undefined {
diff --git a/packages/runtime/src/workspace-executor.ts b/packages/runtime/src/workspace-executor.ts
index 28a4a07fce..5a3f549583 100644
--- a/packages/runtime/src/workspace-executor.ts
+++ b/packages/runtime/src/workspace-executor.ts
@@ -44,7 +44,7 @@ import { runProcessWithBoundedTail, runShellWithBoundedTail } from './shell-exec
 import type { ChildFdInput } from './child-fd-input.js';
 import type { ShellPlan } from './shell-detect.js';
 import { isSupportedImagePath, readWorkspaceFile } from './image-file.js';
-import type { ImageMimeType } from './image-file.js';
+import type { ImageMimeType, WorkspaceFileReadOptions } from './image-file.js';
 import { readTextLineWindow } from './text-line-window.js';
 import { searchFiles, type GrepResult } from './grep-search.js';
 import { defaultRipgrepCandidates, resolveRipgrepExecutable } from './ripgrep-executable.js';
@@ -85,7 +85,7 @@ export interface WorkspaceExecResult {
   aborted: boolean;
 }
 
-export interface WorkspaceReadFileInput {
+export interface WorkspaceReadFileInput extends WorkspaceFileReadOptions {
   cwd: string;
   path: string;
   offset?: number;
@@ -337,7 +337,7 @@ export class LocalWorkspaceExecutor implements WorkspaceExecutor {
   }
 
   async readFile(input: WorkspaceReadFileInput): Promise<WorkspaceReadFileResult> {
-    const file = await readWorkspaceFile(input.path);
+    const file = await readWorkspaceFile(input.path, input);
     if ('bytes' in file) return file;
     return { content: readTextLineWindow(file.content, input.offset, input.limit) };
   }
diff --git a/packages/ui/scripts/markdown-images.browser.test.mjs b/packages/ui/scripts/markdown-images.browser.test.mjs
index fd6f964a6b..c46675e6ec 100644
--- a/packages/ui/scripts/markdown-images.browser.test.mjs
+++ b/packages/ui/scripts/markdown-images.browser.test.mjs
@@ -58,23 +58,31 @@ before(async () => {
       import {SessionAttachmentProvider} from './packages/ui/dist/attachment-image.js';
       import './apps/desktop/src/renderer/styles.css';
       const mode=new URLSearchParams(location.search).get('case') || 'remote';
-      let reads=0; window.imageReads=0; window.deliveryQueries=0;
+      let reads=0; window.imageReads=0; window.deliveryQueries=0; window.deliveryReady=false;
+      const race=mode.endsWith('-race');
       const text=mode==='attachment' ? '![Screenshot](maka://runtime/attachments/image-1)' :
-        mode==='local' || mode==='local-saved' ? '![Screenshot](/tmp/private.png)' :
+        mode==='local' || mode==='local-saved' || race ? '![Screenshot](/tmp/private.png)' :
         '![Screenshot](${imageUrl}/'+(mode==='retry' ? 'retry.png' : 'image.png')+')';
-      createRoot(document.getElementById('root')).render(
+      const root=createRoot(document.getElementById('root'));
+      const readBytes=async()=>{
+        reads++; window.imageReads=reads; return mode==='attachment' && reads===1 ? {ok:false,reason:'read_failed'} :
+          {ok:true,base64:'${png.toString('base64')}',mimeType:'image/png'};
+      };
+      const resolveDelivery=mode.endsWith('saved') || mode==='saving' || race ? async()=>{
+        window.deliveryQueries++;
+        if(race) return window.deliveryReady ? {status:'ready',artifactId:'saved-image'} : {status:'unavailable'};
+        await new Promise(resolve=>setTimeout(resolve,100));
+        return mode==='saving' && window.deliveryQueries===1 ? {status:'pending'} : {status:'ready',artifactId:'saved-image'};
+      } : undefined;
+      const render=(streaming=race)=>root.render(
         React.createElement(Theme,{theme:makaTheme,mode:'light'},
           React.createElement(LocaleProvider,{locale:'en'},
-            React.createElement(SessionAttachmentProvider,{sessionId:'session',readBytes:async()=>{
-              reads++; window.imageReads=reads; return mode==='attachment' && reads===1 ? {ok:false,reason:'read_failed'} :
-                {ok:true,base64:'${png.toString('base64')}',mimeType:'image/png'};
-            }},React.createElement(ImageDeliveryProvider,{sessionId:'session',resolve:mode.endsWith('saved') || mode==='saving' ? async()=>{
-              window.deliveryQueries++;
-              await new Promise(resolve=>setTimeout(resolve,100));
-              return mode==='saving' && window.deliveryQueries===1 ? {status:'pending'} : {status:'ready',artifactId:'saved-image'};
-            } : undefined},
+            React.createElement(SessionAttachmentProvider,{sessionId:'session',readBytes},
+              React.createElement(ImageDeliveryProvider,{sessionId:'session',resolve:resolveDelivery},
               React.createElement('div',{style:mode==='offscreen' ? {paddingTop:'2500px'} : {}},
-                React.createElement(MarkdownBody,{text,imageIdentity:{turnId:'turn',messageId:'message'}})))))));
+                React.createElement(MarkdownBody,{text,streaming,settledText:race ? text : undefined,imageIdentity:{turnId:'turn',messageId:'message'}})))))));
+      window.finishStream=()=>render(false);
+      render();
     `, resolveDir: root, loader: 'js' },
     bundle: true, write: false, outdir: '/virtual', format: 'iife',
     loader: { '.woff2': 'dataurl', '.woff': 'dataurl', '.ttf': 'dataurl', '.svg': 'dataurl' },
@@ -194,3 +202,21 @@ test('a new remote image previews during archival and switches to saved bytes af
     assert.equal(requests.length, 1);
   } finally { await page.close(); }
 });
+
+for (const scenario of ['streaming-race', 'settled-race']) {
+  test(`${scenario}: an unavailable live source recovers in place once Host archival completes`, async () => {
+    const page = await pageFor(scenario);
+    try {
+      await page.waitForFunction(() => window.deliveryQueries === 1);
+      if (scenario === 'settled-race') {
+        await page.evaluate(() => window.finishStream());
+        await page.waitForFunction(() => window.deliveryQueries >= 2);
+      }
+      await page.evaluate(() => { window.deliveryReady = true; });
+      await loaded(page);
+      assert.equal(await page.evaluate(() => window.imageReads), 1);
+      assert.match(await page.locator('img').getAttribute('src'), /^data:image\/png;base64,/);
+      assert.equal(await page.locator('img').count(), 1);
+    } finally { await page.close(); }
+  });
+}
diff --git a/packages/ui/src/image-delivery.tsx b/packages/ui/src/image-delivery.tsx
index 22d31eab2a..3c92daeb97 100644
--- a/packages/ui/src/image-delivery.tsx
+++ b/packages/ui/src/image-delivery.tsx
@@ -20,7 +20,7 @@
 import { createContext, useCallback, useContext, useEffect, useMemo, useState, type ReactNode } from 'react';
 import type { ImageDeliveryRequest, ImageDeliveryResult } from '@maka/core/image-delivery';
 export type ResolveImageDelivery = (sessionId: string, request: ImageDeliveryRequest) => Promise<ImageDeliveryResult>;
-export const ImageMessageScope = createContext<{ turnId: string; messageId: string } | undefined>(undefined);
+export const ImageMessageScope = createContext<{ turnId: string; messageId: string; streaming?: boolean } | undefined>(undefined);
 const DeliveryContext = createContext<{ resolve(request: ImageDeliveryRequest): Promise<ImageDeliveryResult> } | undefined>(undefined);
 export function ImageDeliveryProvider(props: { sessionId: string; resolve?: ResolveImageDelivery; children: ReactNode }) {
   const value = useMemo(() => {
@@ -50,18 +50,20 @@ export function useImageDelivery(source: string, enabled: boolean) {
   const context = useContext(DeliveryContext);
   const [attempt, setAttempt] = useState(0);
   const identity = useMemo(() => context && scope?.turnId && scope.messageId && enabled
-    ? { context, turnId: scope.turnId, messageId: scope.messageId, source, attempt } : undefined,
-    [context, scope?.turnId, scope?.messageId, source, attempt, enabled]);
+    ? { context, turnId: scope.turnId, messageId: scope.messageId, streaming: scope.streaming === true, source, attempt } : undefined,
+    [context, scope?.turnId, scope?.messageId, scope?.streaming, source, attempt, enabled]);
   const [settled, setSettled] = useState<{ identity: typeof identity; result: ImageDeliveryResult }>();
   const retry = useCallback(() => setAttempt(a => a + 1), []);
   useEffect(() => {
     if (!identity) return;
-    let cancelled = false; let timer: ReturnType<typeof setTimeout> | undefined; let delay = 500;
+    let cancelled = false; let timer: ReturnType<typeof setTimeout> | undefined; let delay = 500; let unavailableRetries = 0;
     const query = async (retry: boolean) => {
       const result = await identity.context.resolve({ turnId: identity.turnId, messageId: identity.messageId, source: identity.source, ...(retry ? { retry: true } : {}) });
       if (cancelled) return;
       setSettled({ identity, result });
-      if (result.status === 'pending') {
+      // Canonical text can lag the displayed stream. Retry briefly after settlement,
+      // but do not poll permanently unsupported sources forever.
+      if (result.status === 'pending' || result.status === 'unavailable' && (identity.streaming || unavailableRetries++ < 3)) {
         timer = setTimeout(() => { void query(false); }, delay); delay = Math.min(5000, delay * 2);
       }
     };
diff --git a/packages/ui/src/markdown-body.tsx b/packages/ui/src/markdown-body.tsx
index 7520309577..f864e2c3cb 100644
--- a/packages/ui/src/markdown-body.tsx
+++ b/packages/ui/src/markdown-body.tsx
@@ -163,7 +163,7 @@ export function MarkdownBody(props: {
     : MARKDOWN_COMPONENTS[density];
 
   return (
-    <ImageMessageScope.Provider value={props.imageIdentity}>
+    <ImageMessageScope.Provider value={props.imageIdentity ? { ...props.imageIdentity, streaming: props.streaming } : undefined}>
       <div
         data-maka-contract="markdown"
         data-maka-script={hasHanProse(props.text) ? 'han' : undefined}
diff --git a/packages/ui/src/markdown-image.tsx b/packages/ui/src/markdown-image.tsx
index a7a8911ae6..07594687e9 100644
--- a/packages/ui/src/markdown-image.tsx
+++ b/packages/ui/src/markdown-image.tsx
@@ -18,7 +18,8 @@
  */
 
 import { useEffect, useRef, useState } from 'react';
-import { Button, useLightbox } from '@astryxdesign/core';
+import { Button, IconButton, useLightbox } from '@astryxdesign/core';
+import { Maximize2 } from './icons.js';
 import { Link } from '@astryxdesign/core/Link';
 import { parseAttachmentResourceRef } from '@maka/core/attachments';
 import { useAttachmentImage } from './attachment-image.js';
@@ -83,10 +84,11 @@ function DisplayImage(props: { src: string; alt: string; onError(): void }) {
   return <>
     {!loaded && <span className="maka-markdown-image-loading" role="status">{copy.imageLoading}</span>}
     <span className="maka-markdown-image-preview">
-      <Button variant="ghost" label={copy.imageExpand(props.alt)} onClick={() => lightbox.open()}>
-        <img src={props.src} alt={props.alt} loading="lazy" decoding="async" referrerPolicy="no-referrer"
+      <img src={props.src} alt={props.alt} loading="lazy" decoding="async" referrerPolicy="no-referrer"
           className="maka-markdown-attachment-image" onLoad={() => setLoaded(true)} onError={props.onError} />
-      </Button>
+      <span className="maka-markdown-image-expand">
+        <IconButton icon={<Maximize2 size={16} />} size="sm" label={copy.imageExpand(props.alt)} onClick={() => lightbox.open()} />
+      </span>
     </span>
     {lightbox.isOpen && lightbox.element}
   </>;
diff --git a/packages/ui/src/styles.css b/packages/ui/src/styles.css
index 9e10a5cfb1..6fd27fbf1e 100644
--- a/packages/ui/src/styles.css
+++ b/packages/ui/src/styles.css
@@ -646,13 +646,15 @@
 .maka-markdown-image-resource { display: inline-block; position: relative; max-width: 100%; }
 .maka-markdown-image-preview {
   display: inline-block;
+  position: relative;
+  min-inline-size: var(--space-10);
+  min-block-size: var(--space-10);
   max-width: 100%;
 }
-/* Keep the image's natural dimensions; Astryx owns interaction and focus styling. */
-.maka-markdown-image-preview .astryx-button {
-  max-width: 100%;
-  height: auto;
-  padding: 0;
+.maka-markdown-image-expand {
+  position: absolute;
+  inset-block-end: var(--space-2);
+  inset-inline-end: var(--space-2);
 }
 .maka-markdown-image-preview img { margin: 0; max-height: 480px; object-fit: contain; }
 .maka-markdown-image-loading { display: block; color: var(--muted-foreground); font-size: var(--maka-font-size-sm); }

From 56d1e070eae6a83a32685b438d62be839bb86263 Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Tue, 6 Oct 2026 00:12:06 +0800
Subject: [PATCH 04/35] fix(runtime): launch filesystem worker as explicit ESM

Avoid parent package.json reads outside the worker sandbox grant by shipping the bundled entry as .mjs. Update desktop and CLI packaging and add regression tests for invalid and CommonJS parent package configurations.

Generated-by: Codex (GPT-6)
---
 .../filesystem-worker-launch-spec.test.ts     | 34 +++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/packages/runtime/src/__tests__/filesystem-worker-launch-spec.test.ts b/packages/runtime/src/__tests__/filesystem-worker-launch-spec.test.ts
index 2c38163bab..ae91d8e2f0 100644
--- a/packages/runtime/src/__tests__/filesystem-worker-launch-spec.test.ts
+++ b/packages/runtime/src/__tests__/filesystem-worker-launch-spec.test.ts
@@ -18,12 +18,46 @@
  */
 
 import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
 import { chmod, copyFile, mkdir, mkdtemp, realpath, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { test } from 'node:test';
 
 import { createFilesystemWorkerLaunchSpecProvider } from '../filesystem-worker/launch-spec.js';
+import {
+  FILESYSTEM_WORKER_BUNDLE_NAME,
+  resolveFilesystemWorkerBundle,
+} from '../filesystem-worker/resource-resolver.js';
+import { FilesystemWorkerResponseSchema } from '../filesystem-worker/protocol.js';
+
+for (const packageConfig of ['{invalid JSON', '{"type":"commonjs"}']) {
+  test(`worker startup does not consult parent package config: ${packageConfig}`, async (t) => {
+    const root = await mkdtemp(join(tmpdir(), 'maka-worker-module-boundary-'));
+    t.after(() => rm(root, { recursive: true, force: true }));
+    const source = await resolveFilesystemWorkerBundle({ kind: 'runtime' });
+    assert.ok(source.ok);
+    const workers = join(root, 'workers');
+    await mkdir(workers);
+    const bundle = join(workers, FILESYSTEM_WORKER_BUNDLE_NAME);
+    await copyFile(source.path, bundle);
+    await writeFile(join(root, 'package.json'), packageConfig);
+    const result = spawnSync(process.execPath, ['--preserve-symlinks-main', bundle], {
+      cwd: root,
+      input: '{}',
+      encoding: 'utf8',
+      timeout: 5000,
+    });
+    assert.equal(
+      result.status,
+      0,
+      result.stderr || result.error?.message || 'Worker did not exit successfully',
+    );
+    const response = FilesystemWorkerResponseSchema.parse(JSON.parse(result.stdout));
+    assert.equal(response.ok, false);
+    if (!response.ok) assert.equal(response.error.code, 'invalid_request');
+  });
+}
 
 test('Linux Electron worker launch does not require a macOS Frameworks directory', async () => {
   const getLaunchSpec = createFilesystemWorkerLaunchSpecProvider({

From 3f57aea83faa50247d80b67076d63b12d145e34d Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Tue, 6 Oct 2026 13:26:26 +0800
Subject: [PATCH 05/35] fix(test): include PublishImage in the root provider
 tool contract

---
 .../src/__tests__/execution-model-composition.test.ts            | 1 +
 1 file changed, 1 insertion(+)

diff --git a/packages/runtime-host/src/__tests__/execution-model-composition.test.ts b/packages/runtime-host/src/__tests__/execution-model-composition.test.ts
index 97f85589b5..7380e8a19f 100644
--- a/packages/runtime-host/src/__tests__/execution-model-composition.test.ts
+++ b/packages/runtime-host/src/__tests__/execution-model-composition.test.ts
@@ -2954,6 +2954,7 @@ test('production Host executes a canonical ai-sdk Session against a real provide
       'Edit',
       'Glob',
       'Grep',
+      'PublishImage',
       'Read',
       'Skill',
       'SkillSearch',

From 0eaf235d5960152d7a0f9c70c937a9d0dc12682a Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Tue, 6 Oct 2026 15:15:43 +0800
Subject: [PATCH 06/35] fix(chat): harden image validation and delivery retries

Reuse shared image validation, preserve structured filesystem failures, recapture invalid saved images on retry, and clean up pending artifacts after terminal persistence. Add regression coverage for validation, retry, recovery, and browser image failures.

Generated-by: Codex (GPT-6)
---
 .../src/__tests__/chat-image-delivery.test.ts | 219 +++++++++++++++++-
 .../src/server/chat-image-delivery.ts         |  52 +++--
 .../src/server/chat-image-source.ts           |  24 +-
 .../src/server/execution-composition.ts       |   3 +-
 packages/runtime/package.json                 |   1 +
 .../runtime/src/__tests__/image-file.test.ts  |  76 +++++-
 .../src/filesystem-worker/operations.ts       |   9 +-
 .../runtime/src/filesystem-worker/protocol.ts |   2 +
 packages/runtime/src/image-file-reader.ts     |  64 ++++-
 packages/runtime/src/image-file.ts            |  32 ++-
 packages/runtime/src/workspace-executor.ts    |   9 +-
 .../scripts/markdown-images.browser.test.mjs  |  36 ++-
 packages/ui/src/image-delivery.tsx            |   1 +
 packages/ui/src/markdown-image.tsx            |   5 +-
 14 files changed, 467 insertions(+), 66 deletions(-)

diff --git a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
index dcc1bc2d94..75f83e299f 100644
--- a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
+++ b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
@@ -23,6 +23,9 @@ import { mkdtemp, readFile, writeFile, rm, stat } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { createServer } from 'node:http';
+import { createHash } from 'node:crypto';
+import { createImageFileReader } from '@maka/runtime/image-file-reader';
+import { FilesystemWorkerClientError } from '@maka/runtime/filesystem-worker';
 import { openInteractiveArtifactStoreForWrite } from '@maka/storage/artifact-stores';
 import { resolveStorageRoot, tryAcquireInteractiveRootOwner } from '@maka/storage/root-authority';
 import {
@@ -46,6 +49,7 @@ const REQUEST = {
 async function fixture(
   limits?: { sessionBytes: number; workspaceBytes: number },
   readLocalImage?: ChatImageDeliveryPorts['readLocalImage'],
+  beforeCreate?: (input: Parameters<ChatImageDeliveryPorts['artifacts']['create']>[0]) => void,
 ) {
   const root = await mkdtemp(join(tmpdir(), 'maka-image-delivery-'));
   const owner = await tryAcquireInteractiveRootOwner(
@@ -60,7 +64,14 @@ async function fixture(
   const messages = new Map<string, string>();
   let present = true;
   const service = new ChatImageDeliveryService({
-    artifacts: authority.store,
+    artifacts: {
+      create: async (input) => {
+        beforeCreate?.(input);
+        return authority.store.create(input);
+      },
+      findImageDelivery: authority.store.findImageDelivery,
+      deleteOwnedArtifactInSession: authority.store.deleteOwnedArtifactInSession,
+    },
     admission: new SessionAdmissionGate(),
     limits,
     isPresent: async () => present,
@@ -268,6 +279,212 @@ test('transient failure is persisted and is retried only on an explicit request'
     await f.close();
   }
 });
+
+test('truncated HTTP images are rejected, and an explicit retry archives the repaired source', async () => {
+  const f = await fixture();
+  let content = PNG.subarray(0, 8);
+  let requests = 0;
+  const server = createServer((_req, res) => {
+    requests++;
+    res.setHeader('Content-Type', 'image/png');
+    res.end(content);
+  });
+  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+  const source = `http://127.0.0.1:${(server.address() as import('node:net').AddressInfo).port}/image.png`;
+  const identity = { ...REQUEST, source };
+  try {
+    observe(f.service, source);
+    await f.service.waitForIdle();
+    assert.deepEqual(await f.service.resolve(identity), {
+      status: 'failed',
+      reason: 'unsupported_mime',
+    });
+    assert.equal(requests, 1);
+    const failed = await f.authority.store.listPage(REQUEST.sessionId, { offset: 0, limit: 10 });
+    assert.equal(failed.total, 1);
+    assert.equal(failed.records[0]?.imageDelivery?.status, 'failed');
+    content = PNG;
+    assert.equal((await f.service.resolve({ ...identity, retry: true })).status, 'pending');
+    await f.service.waitForIdle();
+    const ready = await f.service.resolve(identity);
+    assert.equal(ready.status, 'ready');
+    assert.equal(requests, 2);
+    if (ready.status === 'ready') {
+      const bytes = await f.authority.store.readBinaryInSession(
+        identity.sessionId,
+        ready.artifactId,
+      );
+      assert.ok(bytes.ok);
+      if (bytes.ok) assert.equal(bytes.base64, PNG.toString('base64'));
+    }
+    assert.equal(
+      (await f.authority.store.listPage(identity.sessionId, { offset: 0, limit: 10 })).total,
+      1,
+    );
+    assert.deepEqual(f.errors, []);
+  } finally {
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+    await f.close();
+  }
+});
+
+test('explicit decode retries replace a legacy ready image and share concurrent capture', async () => {
+  const f = await fixture();
+  let requests = 0;
+  let release!: () => void;
+  const gate = new Promise<void>((resolve) => {
+    release = resolve;
+  });
+  const server = createServer((_req, res) => {
+    requests++;
+    void gate.then(() => {
+      res.setHeader('Content-Type', 'image/png');
+      res.end(PNG);
+    });
+  });
+  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+  const source = `http://127.0.0.1:${(server.address() as import('node:net').AddressInfo).port}/image.png`;
+  const identity = { ...REQUEST, source };
+  try {
+    const broken = PNG.subarray(0, 8);
+    await f.authority.store.create({
+      id: 'legacy-image',
+      sessionId: identity.sessionId,
+      turnId: identity.turnId,
+      kind: 'image',
+      name: 'chat-image',
+      source: 'tool_result_projection',
+      content: broken,
+      mimeType: 'image/png',
+      imageDelivery: {
+        messageId: identity.messageId,
+        source,
+        status: 'ready',
+        contentSha256: createHash('sha256').update(broken).digest('hex'),
+      },
+    });
+    assert.deepEqual(await f.service.resolve(identity), {
+      status: 'ready',
+      artifactId: 'legacy-image',
+    });
+    assert.equal(requests, 0);
+    const retries = await Promise.all([
+      f.service.resolve({ ...identity, retry: true }),
+      f.service.resolve({ ...identity, retry: true }),
+    ]);
+    assert.deepEqual(retries, [{ status: 'pending' }, { status: 'pending' }]);
+    release();
+    await f.service.waitForIdle();
+    const ready = await f.service.resolve(identity);
+    assert.equal(ready.status, 'ready');
+    assert.equal(requests, 1);
+    const page = await f.authority.store.listPage(identity.sessionId, { offset: 0, limit: 10 });
+    assert.equal(page.total, 1);
+    assert.equal(page.records[0]?.sizeBytes, PNG.length);
+    assert.deepEqual(f.errors, []);
+  } finally {
+    release();
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+    await f.close();
+  }
+});
+
+test('Worker read errors retain their image delivery reasons in persisted failures', async () => {
+  for (const [reason, expected] of [
+    ['not_found', 'not_found'],
+    ['filesystem_denied', 'not_allowed'],
+    ['image_too_large', 'too_large'],
+    ['invalid_image', 'unsupported_mime'],
+  ] as const) {
+    const reader = createImageFileReader({
+      filesystemWorker: {
+        execute: async () => {
+          throw new FilesystemWorkerClientError({
+            reason,
+            stage: 'operation',
+            message: '读取失败',
+          });
+        },
+      },
+    });
+    const f = await fixture(undefined, (_session, path, abortSignal) =>
+      reader({ path, cwd: process.cwd(), abortSignal }),
+    );
+    try {
+      observe(f.service, REQUEST.source);
+      await f.service.waitForIdle();
+      assert.deepEqual(await f.service.resolve(REQUEST), { status: 'failed', reason: expected });
+      assert.deepEqual(f.errors, []);
+    } finally {
+      await f.close();
+    }
+  }
+});
+
+test('pending capture survives persistence failure and is removed only after a durable terminal record', async () => {
+  let failPublication = true;
+  const f = await fixture(
+    undefined,
+    async () => checkedChatImage(PNG),
+    (input) => {
+      if (failPublication && input.imageDelivery?.status === 'ready')
+        throw new Error('publication failed');
+    },
+  );
+  try {
+    observe(f.service, REQUEST.source);
+    await f.service.waitForIdle();
+    const pending = await f.authority.store.listPage(REQUEST.sessionId, { offset: 0, limit: 10 });
+    assert.equal(pending.total, 1);
+    assert.equal(pending.records[0]?.imageDelivery?.status, 'pending');
+    assert.equal(f.errors.length, 1);
+    failPublication = false;
+    assert.equal((await f.service.resolve(REQUEST)).status, 'pending');
+    await f.service.waitForIdle();
+    const ready = await f.authority.store.listPage(REQUEST.sessionId, { offset: 0, limit: 10 });
+    assert.equal(ready.total, 1);
+    assert.equal(ready.records[0]?.imageDelivery?.status, 'ready');
+    assert.equal(f.errors.length, 1);
+  } finally {
+    await f.close();
+  }
+});
+
+test('a conversation copied during capture resumes and cleans its copied pending record', async () => {
+  let release!: () => void;
+  const gate = new Promise<void>((resolve) => {
+    release = resolve;
+  });
+  const f = await fixture(undefined, async () => {
+    await gate;
+    return checkedChatImage(PNG);
+  });
+  try {
+    observe(f.service, REQUEST.source);
+    while (!f.reads) await new Promise<void>((resolve) => setImmediate(resolve));
+    await f.authority.store.copyConversationArtifacts({
+      sourceSessionId: REQUEST.sessionId,
+      targetSessionId: 'session-copy',
+      turnIds: [REQUEST.turnId],
+    });
+    const copied = { ...REQUEST, sessionId: 'session-copy' };
+    assert.equal((await f.service.resolve(copied)).status, 'pending');
+    release();
+    await f.service.waitForIdle();
+    for (const sessionId of [REQUEST.sessionId, copied.sessionId]) {
+      const page = await f.authority.store.listPage(sessionId, { offset: 0, limit: 10 });
+      assert.equal(page.total, 1);
+      assert.equal(page.records[0]?.imageDelivery?.status, 'ready');
+      const bytes = await f.authority.store.readBinaryInSession(sessionId, page.records[0]!.id);
+      assert.ok(bytes.ok);
+      if (bytes.ok) assert.equal(bytes.base64, PNG.toString('base64'));
+    }
+    assert.deepEqual(f.errors, []);
+  } finally {
+    release();
+    await f.close();
+  }
+});
 test('quota admission is atomic under concurrent jobs and identical content shares bytes across sessions', async () => {
   const f = await fixture({ sessionBytes: PNG.length, workspaceBytes: PNG.length });
   try {
diff --git a/packages/runtime-host/src/server/chat-image-delivery.ts b/packages/runtime-host/src/server/chat-image-delivery.ts
index 44fafa879a..95649a5c6c 100644
--- a/packages/runtime-host/src/server/chat-image-delivery.ts
+++ b/packages/runtime-host/src/server/chat-image-delivery.ts
@@ -18,6 +18,7 @@
  */
 
 import { createHash } from 'node:crypto';
+import { ImageFileReadError } from '@maka/runtime/image-file-reader';
 import type { CompleteEvent, TextCompleteEvent, TextDeltaEvent } from '@maka/core/events';
 import { foldAssistantDelta } from '@maka/core/events';
 import {
@@ -35,7 +36,6 @@ import type { SessionAdmissionGate } from './session-admission-gate.js';
 import { chatImageSources } from './chat-image-markdown.js';
 import { abortable } from '../client/wait-for-ready.js';
 import {
-  checkedChatImage,
   downloadChatImage,
   ImageSourceError,
   localImagePath,
@@ -138,7 +138,8 @@ export class ChatImageDeliveryService {
       identity.source,
     );
     const metadata = record?.imageDelivery;
-    if (metadata?.status === 'ready') return { status: 'ready', artifactId: record!.id };
+    if (metadata?.status === 'ready' && !identity.retry)
+      return { status: 'ready', artifactId: record!.id };
     if (metadata?.status === 'failed' && !identity.retry)
       return { status: 'failed', reason: metadata.reason! };
     if (this.#jobs.has(deliveryKey(identity))) return { status: 'pending' };
@@ -149,14 +150,21 @@ export class ChatImageDeliveryService {
       if (text === undefined || !chatImageSources(text).includes(identity.source))
         return { status: 'unavailable' };
     }
-    if (metadata?.status === 'failed') {
-      await this.ports.admission.runOrJoin(identity.sessionId, () =>
-        this.ports.artifacts.deleteOwnedArtifactInSession(
+    if (metadata?.status === 'failed' || metadata?.status === 'ready') {
+      return this.ports.admission.runOrJoin(identity.sessionId, async () => {
+        if (this.#closed) return { status: 'unavailable' };
+        if (this.#jobs.has(deliveryKey(identity))) return { status: 'pending' };
+        if (this.#jobs.size >= 128) return { status: 'failed', reason: 'queue_full' };
+        await this.ports.artifacts.deleteOwnedArtifactInSession(
           identity.sessionId,
           record!.id,
           'tool_result_projection',
-        ),
-      );
+        );
+        // Capture outlives this admission and takes its own write admissions.
+        return this.ports.admission.detach(() => this.#enqueue(identity))
+          ? { status: 'pending' }
+          : { status: 'failed', reason: 'queue_full' };
+      });
     }
     return this.#enqueue(identity)
       ? { status: 'pending' }
@@ -216,6 +224,7 @@ export class ChatImageDeliveryService {
     );
     if (existing?.imageDelivery?.status !== 'pending' && existing) return;
     const metadata = { messageId, source };
+    const pendingId = existing?.id ?? `chat_image_request_${deliveryKey(identity)}`;
     const base = {
       sessionId,
       turnId,
@@ -226,10 +235,18 @@ export class ChatImageDeliveryService {
       this.ports.admission.runOrJoin(sessionId, async () => {
         if (this.#abort.signal.aborted || !(await this.ports.isPresent(sessionId))) return;
         await this.ports.artifacts.create(input);
+        // Retain a pending request only until a terminal record is durable.
+        // A crash between these writes still replays the terminal record.
+        if (input.imageDelivery?.status !== 'pending')
+          await this.ports.artifacts.deleteOwnedArtifactInSession(
+            sessionId,
+            pendingId,
+            'tool_result_projection',
+          );
       });
     await publish({
       ...base,
-      id: `chat_image_request_${deliveryKey(identity)}`,
+      id: pendingId,
       kind: 'file',
       content: '',
       imageDelivery: { ...metadata, status: 'pending' },
@@ -240,9 +257,7 @@ export class ChatImageDeliveryService {
     try {
       const path = localImagePath(source);
       if (path !== undefined)
-        image = checkedChatImage(
-          (await abortable(() => this.ports.readLocalImage(sessionId, path, signal), signal)).bytes,
-        );
+        image = await abortable(() => this.ports.readLocalImage(sessionId, path, signal), signal);
       else {
         try {
           image = await (this.ports.download ?? downloadChatImage)(source, signal);
@@ -328,20 +343,9 @@ function deliveryKey(i: DeliveryIdentity): string {
 }
 function failureReason(error: unknown, source: string): ImageDeliveryFailure {
   if (error instanceof ImageSourceError) return error.reason;
+  if (error instanceof ImageFileReadError) return error.reason;
   const code = (error as NodeJS.ErrnoException | undefined)?.code;
-  if (
-    code === 'ERR_IMAGE_TOO_LARGE' ||
-    (error instanceof Error && /exceeds.*(?:MiB|MB)/i.test(error.message))
-  )
-    return 'too_large';
-  if (error instanceof Error && /supported raster|requires a PNG|not.*image/i.test(error.message))
-    return 'unsupported_mime';
   if (code === 'ENOENT' || code === 'ENOTDIR') return 'not_found';
-  if (
-    code === 'EACCES' ||
-    code === 'EPERM' ||
-    (error instanceof Error && /sandbox|outside|permission/i.test(error.message))
-  )
-    return 'not_allowed';
+  if (code === 'EACCES' || code === 'EPERM') return 'not_allowed';
   return /^https?:/i.test(source) ? 'download_failed' : 'read_failed';
 }
diff --git a/packages/runtime-host/src/server/chat-image-source.ts b/packages/runtime-host/src/server/chat-image-source.ts
index ce271573cc..3fde63293c 100644
--- a/packages/runtime-host/src/server/chat-image-source.ts
+++ b/packages/runtime-host/src/server/chat-image-source.ts
@@ -22,11 +22,8 @@ import { request as httpRequest } from 'node:http';
 import { request as httpsRequest } from 'node:https';
 import { isIP } from 'node:net';
 import { fileURLToPath } from 'node:url';
-import { sniffAttachmentMimeType } from '@maka/core/attachments';
-import {
-  ARTIFACT_IMAGE_PREVIEW_MAX_BYTES,
-  normalizeArtifactImagePreviewMime,
-} from '@maka/core/artifacts';
+import { ARTIFACT_IMAGE_PREVIEW_MAX_BYTES } from '@maka/core/artifacts';
+import { ImageFileError, validateImageBytes } from '@maka/runtime/image-file';
 import type { ImageDeliveryFailure } from '@maka/core/image-delivery';
 export class ImageSourceError extends Error {
   constructor(readonly reason: ImageDeliveryFailure) {
@@ -38,15 +35,14 @@ export interface ChatImageBytes {
   readonly mimeType: string;
 }
 export function checkedChatImage(bytes: Uint8Array): ChatImageBytes {
-  if (bytes.byteLength > ARTIFACT_IMAGE_PREVIEW_MAX_BYTES) throw new ImageSourceError('too_large');
-  const mimeType = sniffAttachmentMimeType(bytes);
-  if (
-    !mimeType ||
-    !normalizeArtifactImagePreviewMime(mimeType) ||
-    !['image/png', 'image/jpeg', 'image/webp', 'image/gif'].includes(mimeType)
-  )
-    throw new ImageSourceError('unsupported_mime');
-  return { bytes, mimeType };
+  try {
+    return validateImageBytes(bytes, 'chat');
+  } catch (error) {
+    if (!(error instanceof ImageFileError)) throw error;
+    throw new ImageSourceError(
+      error.code === 'ERR_IMAGE_TOO_LARGE' ? 'too_large' : 'unsupported_mime',
+    );
+  }
 }
 export function localImagePath(source: string): string | undefined {
   if (/^https?:/i.test(source)) return undefined;
diff --git a/packages/runtime-host/src/server/execution-composition.ts b/packages/runtime-host/src/server/execution-composition.ts
index 431f906414..993b0f5cd7 100644
--- a/packages/runtime-host/src/server/execution-composition.ts
+++ b/packages/runtime-host/src/server/execution-composition.ts
@@ -19,7 +19,6 @@
 
 import { createImageFileReader } from '@maka/runtime/image-file-reader';
 import { ChatImageDeliveryService } from './chat-image-delivery.js';
-import { checkedChatImage } from './chat-image-source.js';
 import { createWorkHubResultRuntime } from './workhub-result-runtime.js';
 import { createWorkHubInspectionTool } from './workhub-inspection-tool.js';
 import { copyWorkHubAttachmentsToTarget } from './workhub-message-attachments.js';
@@ -603,7 +602,7 @@ export async function createExecutionRuntimeHostComposition(
           executionBoundary: boundary,
           abortSignal,
         });
-        return checkedChatImage(result.bytes);
+        return result;
       },
       readMessage: async (identity) => {
         await requireSessionManager(manager).ensureTranscriptLedgerForRead(identity.sessionId);
diff --git a/packages/runtime/package.json b/packages/runtime/package.json
index 3c4841a2df..206a249ee6 100644
--- a/packages/runtime/package.json
+++ b/packages/runtime/package.json
@@ -12,6 +12,7 @@
     "./mcp-tools": "./dist/mcp-tools.js",
     "./read-page": "./dist/read-page.js",
     "./image-file-reader": "./dist/image-file-reader.js",
+    "./image-file": "./dist/image-file.js",
     "./builtin-tools": "./dist/builtin-tools.js",
     "./shell-tools": "./dist/shell-tools.js",
     "./shell-run-manager": "./dist/shell-run-manager.js",
diff --git a/packages/runtime/src/__tests__/image-file.test.ts b/packages/runtime/src/__tests__/image-file.test.ts
index 1efe9cc674..9bc0d1f9a0 100644
--- a/packages/runtime/src/__tests__/image-file.test.ts
+++ b/packages/runtime/src/__tests__/image-file.test.ts
@@ -28,7 +28,10 @@ import { LocalWorkspaceExecutor } from '../workspace-executor.js';
 import { executeFilesystemOperation } from '../filesystem-worker/operations.js';
 import { MAX_READ_IMAGE_BYTES } from '@maka/core/attachments';
 import { ARTIFACT_IMAGE_PREVIEW_MAX_BYTES } from '@maka/core/artifacts';
-import { createImageFileReader } from '../image-file-reader.js';
+import { createImageFileReader, ImageFileReadError } from '../image-file-reader.js';
+import { FilesystemWorkerClientError } from '../filesystem-worker/client.js';
+import { executeFilesystemWorkerRequest } from '../filesystem-worker/operations.js';
+import { FILESYSTEM_WORKER_PROTOCOL_VERSION } from '../filesystem-worker/protocol.js';
 import { buildBuiltinTools } from '../builtin-tools.js';
 
 const ONE_PIXEL_PNG = Buffer.from(
@@ -41,6 +44,77 @@ const WIDE_PNG = Buffer.from(
   'base64',
 );
 
+test('chat reader preserves structured Worker failures independently of message wording', async () => {
+  for (const [reason, expected] of [
+    ['not_found', 'not_found'],
+    ['filesystem_denied', 'not_allowed'],
+    ['path_denied', 'not_allowed'],
+    ['sandbox_denied', 'not_allowed'],
+    ['image_too_large', 'too_large'],
+    ['invalid_image', 'unsupported_mime'],
+    ['worker_io_incomplete', 'read_failed'],
+  ] as const) {
+    const reader = createImageFileReader({
+      filesystemWorker: {
+        execute: async () => {
+          throw new FilesystemWorkerClientError({
+            reason,
+            stage: 'operation',
+            message: '读取失败',
+          });
+        },
+      },
+    });
+    await assert.rejects(
+      reader({ path: 'image.png', cwd: process.cwd() }),
+      (error: unknown) => error instanceof ImageFileReadError && error.reason === expected,
+    );
+  }
+});
+
+test('chat reader preserves local missing paths and workspace boundary denials', async (t) => {
+  const cwd = await realpath(await mkdtemp(join(tmpdir(), 'maka-chat-read-errors-')));
+  t.after(() => rm(cwd, { recursive: true, force: true }));
+  const reader = createImageFileReader();
+  await assert.rejects(
+    reader({ path: 'missing.png', cwd }),
+    (error: unknown) => error instanceof ImageFileReadError && error.reason === 'not_found',
+  );
+  await assert.rejects(
+    reader({ path: join(cwd, '..', 'outside.png'), cwd }),
+    (error: unknown) => error instanceof ImageFileReadError && error.reason === 'not_allowed',
+  );
+});
+
+test('Worker transports typed image validation failures instead of generic filesystem errors', async (t) => {
+  const cwd = await realpath(await mkdtemp(join(tmpdir(), 'maka-chat-image-wire-')));
+  t.after(() => rm(cwd, { recursive: true, force: true }));
+  const path = join(cwd, 'image.png');
+  for (const [content, expected] of [
+    [ONE_PIXEL_PNG.subarray(0, 8), 'invalid_image'],
+    [Buffer.alloc(ARTIFACT_IMAGE_PREVIEW_MAX_BYTES + 1), 'image_too_large'],
+  ] as const) {
+    await writeFile(path, content);
+    const response = await executeFilesystemWorkerRequest({
+      version: FILESYSTEM_WORKER_PROTOCOL_VERSION,
+      requestId: 'read-image',
+      operation: { kind: 'read', cwd, path, imagePurpose: 'chat' },
+      operationBoundary: {
+        filesystem: { entries: [{ path: cwd, access: 'read', scope: 'subtree' }] },
+      },
+      expectedTarget: {
+        enforcementPath: path,
+        access: 'read',
+        scope: 'exact',
+        targetType: 'file',
+        identity: 'unchecked',
+      },
+    });
+    assert.equal(response.ok, false);
+    if (!response.ok) assert.equal(response.error.code, expected);
+  }
+});
+
 for (const route of ['workspace', 'worker'] as const) {
   test(`${route} chat reads admit wide screenshots without relaxing ordinary Read`, async (t) => {
     const cwd = await realpath(await mkdtemp(join(tmpdir(), 'maka-chat-image-policy-')));
diff --git a/packages/runtime/src/filesystem-worker/operations.ts b/packages/runtime/src/filesystem-worker/operations.ts
index eedd55ab8b..75fcdb9f77 100644
--- a/packages/runtime/src/filesystem-worker/operations.ts
+++ b/packages/runtime/src/filesystem-worker/operations.ts
@@ -47,7 +47,7 @@ import {
   StableWriteFailure,
   writeThroughHandle,
 } from '../file-stable-write.js';
-import { readWorkspaceFile } from '../image-file.js';
+import { ImageFileError, readWorkspaceFile } from '../image-file.js';
 import {
   FILESYSTEM_WORKER_PROTOCOL_VERSION,
   operationAccess,
@@ -128,7 +128,7 @@ export async function executeFilesystemOperation(
         ...(operation.imagePurpose ? { imagePurpose: operation.imagePurpose } : {}),
       }).catch((error: unknown) => {
         throw operationError(
-          'filesystem_error',
+          normalizeOperationError(error).code,
           error instanceof Error ? error.message : 'File could not be read.',
         );
       });
@@ -453,6 +453,11 @@ function operationError(
 
 function normalizeOperationError(error: unknown): FilesystemOperationError {
   if (error instanceof FilesystemOperationError) return error;
+  if (error instanceof ImageFileError)
+    return operationError(
+      error.code === 'ERR_IMAGE_TOO_LARGE' ? 'image_too_large' : 'invalid_image',
+      error.message,
+    );
   if (error instanceof StableWriteFailure) {
     return operationError(error.code, error.message);
   }
diff --git a/packages/runtime/src/filesystem-worker/protocol.ts b/packages/runtime/src/filesystem-worker/protocol.ts
index 3c3a07a61e..bf1512c4fe 100644
--- a/packages/runtime/src/filesystem-worker/protocol.ts
+++ b/packages/runtime/src/filesystem-worker/protocol.ts
@@ -251,6 +251,8 @@ export const FilesystemWorkerErrorCodeSchema = z.enum([
   'grep_unavailable',
   'sandbox_denied',
   'filesystem_denied',
+  'image_too_large',
+  'invalid_image',
   'filesystem_error',
   // The worker may have applied the mutation before it lost the ability to
   // report back (e.g. it wrote the file then the post-write identity check
diff --git a/packages/runtime/src/image-file-reader.ts b/packages/runtime/src/image-file-reader.ts
index c219de848c..6d5e798476 100644
--- a/packages/runtime/src/image-file-reader.ts
+++ b/packages/runtime/src/image-file-reader.ts
@@ -23,6 +23,56 @@ import {
   type FilesystemExecuteInput,
 } from './filesystem-executor.js';
 import { createLocalWorkspaceExecutor } from './workspace-executor.js';
+import { ImageFileError } from './image-file.js';
+import { FilesystemWorkerClientError } from './filesystem-worker/client.js';
+import { SandboxCommandError } from './sandbox/errors.js';
+
+type ImageFileReadFailure =
+  | 'not_found'
+  | 'not_allowed'
+  | 'too_large'
+  | 'unsupported_mime'
+  | 'read_failed';
+/** Normalizes filesystem backends at the image reader boundary. */
+export class ImageFileReadError extends Error {
+  constructor(
+    readonly reason: ImageFileReadFailure,
+    cause?: unknown,
+  ) {
+    super(cause instanceof Error ? cause.message : `Image read failed: ${reason}`, { cause });
+    this.name = 'ImageFileReadError';
+  }
+}
+
+function readFailure(error: unknown): ImageFileReadFailure {
+  if (error instanceof ImageFileError)
+    return error.code === 'ERR_IMAGE_TOO_LARGE' ? 'too_large' : 'unsupported_mime';
+  if (error instanceof SandboxCommandError) return 'not_allowed';
+  const code =
+    error instanceof FilesystemWorkerClientError
+      ? error.reason
+      : (error as NodeJS.ErrnoException | undefined)?.code;
+  switch (code) {
+    case 'image_too_large':
+      return 'too_large';
+    case 'invalid_image':
+      return 'unsupported_mime';
+    case 'ENOENT':
+    case 'ENOTDIR':
+    case 'not_found':
+      return 'not_found';
+    case 'EACCES':
+    case 'EPERM':
+    case 'filesystem_denied':
+    case 'path_denied':
+    case 'sandbox_denied':
+    case 'sandbox_required':
+    case 'sandbox_boundary_required':
+      return 'not_allowed';
+    default:
+      return 'read_failed';
+  }
+}
 /** The same filesystem boundary as Read, without model snapshots or tool execution. */
 export function createImageFileReader(
   options: Pick<
@@ -37,11 +87,15 @@ export function createImageFileReader(
   });
   return async (input: Omit<FilesystemExecuteInput, 'operation'> & { path: string }) => {
     const { path, ...context } = input;
-    const result = await filesystem.execute({
-      ...context,
-      operation: { kind: 'read', path, imagePurpose: 'chat' },
-    });
-    if (result.kind !== 'read_image') throw new Error('Not a supported raster image');
+    const result = await filesystem
+      .execute({
+        ...context,
+        operation: { kind: 'read', path, imagePurpose: 'chat' },
+      })
+      .catch((error: unknown) => {
+        throw new ImageFileReadError(readFailure(error), error);
+      });
+    if (result.kind !== 'read_image') throw new ImageFileReadError('unsupported_mime');
     return { bytes: result.bytes, mimeType: result.mimeType };
   };
 }
diff --git a/packages/runtime/src/image-file.ts b/packages/runtime/src/image-file.ts
index 3714892891..361e33ed6c 100644
--- a/packages/runtime/src/image-file.ts
+++ b/packages/runtime/src/image-file.ts
@@ -38,6 +38,15 @@ export interface WorkspaceFileReadOptions {
 const IMAGE_EXTENSIONS = new Set(['.png', '.jpg', '.jpeg', '.gif', '.webp']);
 export type ImageMimeType = 'image/png' | 'image/jpeg' | 'image/gif' | 'image/webp';
 
+export class ImageFileError extends Error {
+  constructor(
+    readonly code: 'ERR_IMAGE_TOO_LARGE' | 'ERR_INVALID_IMAGE',
+    message: string,
+  ) {
+    super(message);
+  }
+}
+
 export function isSupportedImagePath(path: string): boolean {
   return IMAGE_EXTENSIONS.has(extname(path).toLowerCase());
 }
@@ -86,7 +95,11 @@ export function validateImageBytes(
   if (bytes.length > (purpose === 'chat' ? ARTIFACT_IMAGE_PREVIEW_MAX_BYTES : MAX_READ_IMAGE_BYTES))
     throw imageTooLargeError(purpose);
   const mimeType = sniffImageMime(bytes);
-  if (!mimeType) throw new Error('Image content is not a supported PNG, JPEG, GIF, or WebP file.');
+  if (!mimeType)
+    throw new ImageFileError(
+      'ERR_INVALID_IMAGE',
+      'Image content is not a supported PNG, JPEG, GIF, or WebP file.',
+    );
   const dimensions = imageDimensionsFromData(bytes);
   if (
     !dimensions ||
@@ -97,7 +110,10 @@ export function validateImageBytes(
     dimensions.width <= 0 ||
     dimensions.height <= 0
   ) {
-    throw new Error('Image dimensions could not be read; verify the image file is valid.');
+    throw new ImageFileError(
+      'ERR_INVALID_IMAGE',
+      'Image dimensions could not be read; verify the image file is valid.',
+    );
   }
   if (purpose === 'model' && Math.max(dimensions.width, dimensions.height) > MAX_MODEL_IMAGE_EDGE) {
     throw new Error(
@@ -108,13 +124,11 @@ export function validateImageBytes(
 }
 
 function imageTooLargeError(purpose: 'model' | 'chat' = 'model'): Error {
-  return Object.assign(
-    new Error(
-      purpose === 'chat'
-        ? 'Image exceeds the 2 MiB chat preview limit; resize it before publishing.'
-        : READ_IMAGE_TOO_LARGE_MESSAGE,
-    ),
-    { code: 'ERR_IMAGE_TOO_LARGE' },
+  return new ImageFileError(
+    'ERR_IMAGE_TOO_LARGE',
+    purpose === 'chat'
+      ? 'Image exceeds the 2 MiB chat preview limit; resize it before publishing.'
+      : READ_IMAGE_TOO_LARGE_MESSAGE,
   );
 }
 
diff --git a/packages/runtime/src/workspace-executor.ts b/packages/runtime/src/workspace-executor.ts
index 5a3f549583..fc09a8507b 100644
--- a/packages/runtime/src/workspace-executor.ts
+++ b/packages/runtime/src/workspace-executor.ts
@@ -561,9 +561,12 @@ function assertInsideCwd(
   label: string,
 ): string {
   if (!isPathInside(root, candidate)) {
-    throw new Error(
-      `${label} path must stay inside session cwd ${JSON.stringify(root)}; ` +
-        `received ${JSON.stringify(inputPath)}, which resolves to ${JSON.stringify(candidate)}.`,
+    throw Object.assign(
+      new Error(
+        `${label} path must stay inside session cwd ${JSON.stringify(root)}; ` +
+          `received ${JSON.stringify(inputPath)}, which resolves to ${JSON.stringify(candidate)}.`,
+      ),
+      { code: 'EACCES' },
     );
   }
   return candidate;
diff --git a/packages/ui/scripts/markdown-images.browser.test.mjs b/packages/ui/scripts/markdown-images.browser.test.mjs
index c46675e6ec..147cfe6189 100644
--- a/packages/ui/scripts/markdown-images.browser.test.mjs
+++ b/packages/ui/scripts/markdown-images.browser.test.mjs
@@ -58,18 +58,19 @@ before(async () => {
       import {SessionAttachmentProvider} from './packages/ui/dist/attachment-image.js';
       import './apps/desktop/src/renderer/styles.css';
       const mode=new URLSearchParams(location.search).get('case') || 'remote';
-      let reads=0; window.imageReads=0; window.deliveryQueries=0; window.deliveryReady=false;
+      let reads=0; window.imageReads=0; window.deliveryQueries=0; window.deliveryReady=false; window.deliveryRetries=0;
       const race=mode.endsWith('-race');
       const text=mode==='attachment' ? '![Screenshot](maka://runtime/attachments/image-1)' :
         mode==='local' || mode==='local-saved' || race ? '![Screenshot](/tmp/private.png)' :
         '![Screenshot](${imageUrl}/'+(mode==='retry' ? 'retry.png' : 'image.png')+')';
       const root=createRoot(document.getElementById('root'));
       const readBytes=async()=>{
-        reads++; window.imageReads=reads; return mode==='attachment' && reads===1 ? {ok:false,reason:'read_failed'} :
-          {ok:true,base64:'${png.toString('base64')}',mimeType:'image/png'};
+        reads++; window.imageReads=reads; return (mode==='attachment' || mode==='read-retry-saved') && reads===1 ? {ok:false,reason:'read_failed'} :
+          {ok:true,base64:mode==='corrupt-saved' && !window.deliveryRetries ? 'iVBORw0KGgo=' : '${png.toString('base64')}',mimeType:'image/png'};
       };
-      const resolveDelivery=mode.endsWith('saved') || mode==='saving' || race ? async()=>{
+      const resolveDelivery=mode.endsWith('saved') || mode==='saving' || race ? async(_session,request)=>{
         window.deliveryQueries++;
+        if(request.retry) window.deliveryRetries++;
         if(race) return window.deliveryReady ? {status:'ready',artifactId:'saved-image'} : {status:'unavailable'};
         await new Promise(resolve=>setTimeout(resolve,100));
         return mode==='saving' && window.deliveryQueries===1 ? {status:'pending'} : {status:'ready',artifactId:'saved-image'};
@@ -158,6 +159,33 @@ test('attachment read failure recovers in place, and local paths explain how to
   } finally { await page.close(); }
 });
 
+test('a saved image decode failure invalidates both caches and recaptures its source on retry', async () => {
+  const page = await pageFor('corrupt-saved');
+  try {
+    await page.getByText('Could not load the image. Try again.').waitFor();
+    assert.equal(await page.evaluate(() => window.imageReads), 1);
+    await page.getByRole('button', { name: 'Retry', exact: true }).click();
+    await page.waitForFunction(() => [...document.images].some(img => img.src.startsWith('data:image/png;') && img.naturalWidth === 1));
+    assert.equal(await page.evaluate(() => window.deliveryRetries), 1);
+    assert.equal(await page.evaluate(() => window.deliveryQueries), 2);
+    assert.equal(await page.evaluate(() => window.imageReads), 2);
+  } finally { await page.close(); }
+});
+
+test('a transient saved attachment read retries its bytes without invalidating archival or touching origin', async () => {
+  requests = [];
+  const page = await pageFor('read-retry-saved');
+  try {
+    await page.getByText('Could not load the image. Try again.').waitFor();
+    await page.getByRole('button', { name: 'Retry', exact: true }).click();
+    await loaded(page);
+    assert.equal(await page.evaluate(() => window.deliveryRetries), 0);
+    assert.equal(await page.evaluate(() => window.deliveryQueries), 1);
+    assert.equal(await page.evaluate(() => window.imageReads), 2);
+    assert.deepEqual(requests, []);
+  } finally { await page.close(); }
+});
+
 for (const scenario of ['remote-saved', 'local-saved']) {
   test(`${scenario}: saved mapping avoids the original source and the image supports zoom`, async () => {
     requests = [];
diff --git a/packages/ui/src/image-delivery.tsx b/packages/ui/src/image-delivery.tsx
index 3c92daeb97..558e95059a 100644
--- a/packages/ui/src/image-delivery.tsx
+++ b/packages/ui/src/image-delivery.tsx
@@ -30,6 +30,7 @@ export function ImageDeliveryProvider(props: { sessionId: string; resolve?: Reso
     const ready = new Map<string, ImageDeliveryResult>();
     return { resolve(request: ImageDeliveryRequest) {
       const key = JSON.stringify([request.turnId, request.messageId, request.source]);
+      if (request.retry) ready.delete(key);
       const cached = ready.get(key); if (cached) return Promise.resolve(cached);
       const running = pending.get(key); if (running) return running;
       const job = resolve(props.sessionId, request).catch((): ImageDeliveryResult => ({ status: 'failed', reason: 'read_failed' }));
diff --git a/packages/ui/src/markdown-image.tsx b/packages/ui/src/markdown-image.tsx
index 07594687e9..9a98ab6d51 100644
--- a/packages/ui/src/markdown-image.tsx
+++ b/packages/ui/src/markdown-image.tsx
@@ -53,7 +53,10 @@ function ImageResource(props: { src: string; alt: string }) {
   const failed = !!source && failedSource === source || !!artifactId && image.status === 'failed';
   const retry = () => {
     setFailedSource(undefined); setAttempt(a => a + 1);
-    if (artifactId) image.retry(); else delivery.retry();
+    if (artifactId) image.retry();
+    // A transient byte-read failure retries the saved attachment. Only a
+    // browser decode failure invalidates automatic capture and rereads origin.
+    if (!artifactId || (!explicit && source && failedSource === source)) delivery.retry();
   };
   const sourceActions = <span className="maka-markdown-image-actions">
     <Button variant="ghost" size="sm" label={copy.imageRetry} onClick={retry} />

From 14393d0b1ce8f5422e51b0fb131fb0814bc222dc Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Tue, 6 Oct 2026 17:01:50 +0800
Subject: [PATCH 07/35] fix(chat): normalize image destinations and preserve
 preview layout

Resolve rendered image destinations with the Host Markdown parser, preserve canonical reference paths, and reserve a responsive preview frame through capture and decoding. Add browser regressions for destination identity, streaming recovery, layout stability, narrow screens, and zoom.

Generated-by: Codex (GPT-6)
---
 package-lock.json                             |   1 +
 .../src/__tests__/chat-image-delivery.test.ts |   9 +-
 packages/ui/package.json                      |   1 +
 .../scripts/markdown-images.browser.test.mjs  | 106 +++++++++++++++++-
 .../__tests__/markdown-image-source.test.ts   |  54 +++++++++
 packages/ui/src/markdown-body.tsx             |  86 +++++++-------
 packages/ui/src/markdown-image-source.ts      |  49 ++++++++
 packages/ui/src/markdown-image.tsx            |  25 +++--
 packages/ui/src/styles.css                    |  49 ++++++--
 9 files changed, 318 insertions(+), 62 deletions(-)
 create mode 100644 packages/ui/src/__tests__/markdown-image-source.test.ts
 create mode 100644 packages/ui/src/markdown-image-source.ts

diff --git a/package-lock.json b/package-lock.json
index 8d545bd5e7..5afaacc60e 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -17511,6 +17511,7 @@
         "clsx": "^2.1.1",
         "katex": "0.18.9",
         "lucide-react": "^1.48.0",
+        "marked": "^18.0.11",
         "mermaid": "^11.17.2",
         "react": "^19.3.0",
         "react-dom": "^19.3.0",
diff --git a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
index 75f83e299f..2d77d5a796 100644
--- a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
+++ b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
@@ -172,6 +172,8 @@ test('parses real Markdown image nodes, including references and balanced destin
   const text = [
     '![one](</tmp/a (1).png>)',
     '![two][pic]',
+    '![titled](https://example.com/titled.png "Screenshot title")',
+    String.raw`![escaped](/tmp/a\(1\).png)`,
     '',
     '[pic]: https://example.com/a.png',
     '`![code](/tmp/secret.png)`',
@@ -181,7 +183,12 @@ test('parses real Markdown image nodes, including references and balanced destin
     '<img src="/tmp/html.png">',
     '![incomplete](https://example.com/',
   ].join('\n');
-  assert.deepEqual(chatImageSources(text), ['/tmp/a (1).png', 'https://example.com/a.png']);
+  assert.deepEqual(chatImageSources(text), [
+    '/tmp/a (1).png',
+    'https://example.com/a.png',
+    'https://example.com/titled.png',
+    '/tmp/a(1).png',
+  ]);
 });
 test('automatically saves a local delivery without any UI request; deletion and Host restart do not break replay', async () => {
   const f = await fixture();
diff --git a/packages/ui/package.json b/packages/ui/package.json
index 8de5e24cdb..563f59710b 100644
--- a/packages/ui/package.json
+++ b/packages/ui/package.json
@@ -33,6 +33,7 @@
     "clsx": "^2.1.1",
     "katex": "0.18.9",
     "lucide-react": "^1.48.0",
+    "marked": "^18.0.11",
     "mermaid": "^11.17.2",
     "react": "^19.3.0",
     "react-dom": "^19.3.0",
diff --git a/packages/ui/scripts/markdown-images.browser.test.mjs b/packages/ui/scripts/markdown-images.browser.test.mjs
index 147cfe6189..3f911d05e8 100644
--- a/packages/ui/scripts/markdown-images.browser.test.mjs
+++ b/packages/ui/scripts/markdown-images.browser.test.mjs
@@ -32,10 +32,22 @@ const root = fileURLToPath(new URL('../../../', import.meta.url));
 const png = Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8DwHwAFBQIAX8jx0gAAAABJRU5ErkJggg==', 'base64');
 let appServer, imageServer, browser, appUrl, imageUrl;
 let requests = [], failedOnce = false;
+let releaseImage;
+let releaseAttachment;
+const delayedImage = new Promise(resolve => { releaseImage = resolve; });
+const delayedAttachment = new Promise(resolve => { releaseAttachment = resolve; });
 
 before(async () => {
+  const screenshot = await readFile(new URL('../../../docs/images/pr/chat-image-delivery/after.png', import.meta.url));
   imageServer = createServer((req, res) => {
     requests.push({ path: req.url, referer: req.headers.referer });
+    if (req.url === '/delayed.png') {
+      void delayedImage.then(() => { res.setHeader('Content-Type', 'image/png'); res.end(png); });
+      return;
+    }
+    if (req.url === '/screenshot.png') {
+      res.setHeader('Content-Type', 'image/png'); res.end(screenshot); return;
+    }
     if (req.url === '/retry.png' && !failedOnce) {
       failedOnce = true;
       res.writeHead(404).end();
@@ -46,6 +58,25 @@ before(async () => {
   });
   await new Promise(resolve => imageServer.listen(0, '127.0.0.1', resolve));
   imageUrl = `http://127.0.0.1:${imageServer.address().port}`;
+  const destinations = {
+    'angle-saved': '![Screenshot](</tmp/my image.png>)',
+    'title-saved': `![Screenshot](${imageUrl}/image.png "Screenshot title")`,
+    'escaped-saved': String.raw`![Screenshot](/tmp/a\(1\).png)`,
+    'reference-saved': '![Screenshot][picture]\n\n[picture]: </tmp/my "image".png>',
+    'attachment-title': '![Screenshot](maka://runtime/attachments/image-1 "Screenshot title")',
+    'geometry-remote': `![Screenshot](${imageUrl}/delayed.png)\n\nFollowing paragraph`,
+    'geometry-saved': '![Screenshot](/tmp/private.png)\n\nFollowing paragraph',
+    'streaming-angle-race': '![Screenshot](</tmp/my image.png>)',
+    screenshot: `![Screenshot](${imageUrl}/screenshot.png)`,
+  };
+  const canonicalSources = {
+    'angle-saved': ['/tmp/my image.png'],
+    'title-saved': [`${imageUrl}/image.png`],
+    'escaped-saved': ['/tmp/a(1).png'],
+    'reference-saved': ['/tmp/my "image".png'],
+    'geometry-saved': ['/tmp/private.png'],
+    'streaming-angle-race': ['/tmp/my image.png'],
+  };
   const bundle = await build({
     stdin: { contents: `
       import React from 'react';
@@ -58,18 +89,23 @@ before(async () => {
       import {SessionAttachmentProvider} from './packages/ui/dist/attachment-image.js';
       import './apps/desktop/src/renderer/styles.css';
       const mode=new URLSearchParams(location.search).get('case') || 'remote';
+      const destinations=${JSON.stringify(destinations)};
+      const canonicalSources=${JSON.stringify(canonicalSources)};
       let reads=0; window.imageReads=0; window.deliveryQueries=0; window.deliveryReady=false; window.deliveryRetries=0;
       const race=mode.endsWith('-race');
-      const text=mode==='attachment' ? '![Screenshot](maka://runtime/attachments/image-1)' :
+      const text=destinations[mode] ?? (mode==='attachment' ? '![Screenshot](maka://runtime/attachments/image-1)' :
         mode==='local' || mode==='local-saved' || race ? '![Screenshot](/tmp/private.png)' :
-        '![Screenshot](${imageUrl}/'+(mode==='retry' ? 'retry.png' : 'image.png')+')';
+        '![Screenshot](${imageUrl}/'+(mode==='retry' ? 'retry.png' : 'image.png')+')');
       const root=createRoot(document.getElementById('root'));
       const readBytes=async()=>{
+        if(mode==='geometry-saved') await fetch('/release-attachment');
         reads++; window.imageReads=reads; return (mode==='attachment' || mode==='read-retry-saved') && reads===1 ? {ok:false,reason:'read_failed'} :
           {ok:true,base64:mode==='corrupt-saved' && !window.deliveryRetries ? 'iVBORw0KGgo=' : '${png.toString('base64')}',mimeType:'image/png'};
       };
       const resolveDelivery=mode.endsWith('saved') || mode==='saving' || race ? async(_session,request)=>{
         window.deliveryQueries++;
+        window.deliverySource=request.source;
+        if(canonicalSources[mode] && !canonicalSources[mode].includes(request.source)) return {status:'unavailable'};
         if(request.retry) window.deliveryRetries++;
         if(race) return window.deliveryReady ? {status:'ready',artifactId:'saved-image'} : {status:'unavailable'};
         await new Promise(resolve=>setTimeout(resolve,100));
@@ -94,6 +130,7 @@ before(async () => {
   const index = await readFile(new URL('../../../apps/desktop/src/renderer/index.html', import.meta.url), 'utf8');
   const csp = index.match(/http-equiv="Content-Security-Policy"\s+content="([^"]+)"/)[1];
   appServer = createServer((req, res) => {
+    if (req.url === '/release-attachment') { void delayedAttachment.then(() => res.end()); return; }
     if (req.url === '/app.js') { res.setHeader('Content-Type', 'text/javascript'); res.end(js); }
     else if (req.url === '/app.css') { res.setHeader('Content-Type', 'text/css'); res.end(css); }
     else {
@@ -107,6 +144,7 @@ before(async () => {
 });
 
 after(async () => {
+  releaseImage(); releaseAttachment();
   await browser?.close();
   for (const server of [appServer, imageServer]) if (server) await new Promise(resolve => server.close(resolve));
 });
@@ -231,7 +269,7 @@ test('a new remote image previews during archival and switches to saved bytes af
   } finally { await page.close(); }
 });
 
-for (const scenario of ['streaming-race', 'settled-race']) {
+for (const scenario of ['streaming-race', 'settled-race', 'streaming-angle-race']) {
   test(`${scenario}: an unavailable live source recovers in place once Host archival completes`, async () => {
     const page = await pageFor(scenario);
     try {
@@ -248,3 +286,65 @@ for (const scenario of ['streaming-race', 'settled-race']) {
     } finally { await page.close(); }
   });
 }
+
+for (const scenario of ['angle-saved', 'title-saved', 'escaped-saved', 'reference-saved', 'attachment-title']) {
+  test(`${scenario}: standard Markdown destinations resolve to saved bytes without origin requests`, async () => {
+    requests = [];
+    const page = await pageFor(scenario);
+    try {
+      await loaded(page);
+      assert.match(await page.locator('img').getAttribute('src'), /^data:image\/png;base64,/);
+      assert.deepEqual(requests, []);
+      assert.equal(await page.evaluate(() => window.imageReads), 1);
+      if (scenario !== 'attachment-title') {
+        assert.equal(await page.evaluate(() => window.deliveryQueries), 1);
+      }
+    } finally { await page.close(); }
+  });
+}
+
+for (const scenario of ['geometry-remote', 'geometry-saved']) {
+  test(`${scenario}: loading and ready images preserve the position of subsequent content`, async () => {
+    const page = await pageFor(scenario);
+    try {
+      await page.getByText('Loading image…', { exact: true }).waitFor();
+      const before = await page.getByText('Following paragraph', { exact: true }).boundingBox();
+      if (scenario === 'geometry-remote') releaseImage(); else releaseAttachment();
+      await loaded(page);
+      await page.getByText('Loading image…', { exact: true }).waitFor({ state: 'hidden' });
+      const after = await page.getByText('Following paragraph', { exact: true }).boundingBox();
+      assert.equal(after.y, before.y);
+    } finally {
+      if (scenario === 'geometry-remote') releaseImage(); else releaseAttachment();
+      await page.close();
+    }
+  });
+}
+
+test('image frames fit narrow viewports without distorting screenshots or limiting the enlarged preview', async () => {
+  const page = await pageFor('screenshot');
+  try {
+    await page.waitForFunction(() => [...document.images].some(image => image.naturalWidth > 1));
+    for (const width of [720, 360]) {
+      await page.setViewportSize({ width, height: 600 });
+      const geometry = await page.locator('.maka-markdown-image-preview img').evaluate(image => {
+        const frame = image.closest('.maka-markdown-image-frame').getBoundingClientRect();
+        const box = image.getBoundingClientRect();
+        return { frame: { x: frame.x, y: frame.y, right: frame.right, bottom: frame.bottom },
+          box: { x: box.x, y: box.y, right: box.right, bottom: box.bottom, width: box.width, height: box.height },
+          ratio: image.naturalWidth / image.naturalHeight };
+      });
+      assert.ok(Math.abs(geometry.box.width / geometry.box.height - geometry.ratio) < 0.01);
+      assert.ok(geometry.box.x >= geometry.frame.x && geometry.box.right <= geometry.frame.right + 1);
+      assert.ok(geometry.box.y >= geometry.frame.y && geometry.box.bottom <= geometry.frame.bottom + 1);
+      assert.ok(geometry.frame.right <= width);
+    }
+    await page.getByRole('button', { name: 'Enlarge image: Screenshot', exact: true }).click();
+    await page.waitForFunction(() => document.images.length > 1);
+    assert.equal(await page.locator('.maka-markdown-image-preview > img').count(), 1);
+    const dialog = await page.getByRole('dialog').boundingBox();
+    const frame = await page.locator('.maka-markdown-image-frame').boundingBox();
+    assert.ok(dialog.height > frame.height);
+    assert.equal(await page.getByRole('dialog').locator('img').getAttribute('src'), await page.locator('.maka-markdown-image-preview > img').getAttribute('src'));
+  } finally { await page.close(); }
+});
diff --git a/packages/ui/src/__tests__/markdown-image-source.test.ts b/packages/ui/src/__tests__/markdown-image-source.test.ts
new file mode 100644
index 0000000000..f6abd597f5
--- /dev/null
+++ b/packages/ui/src/__tests__/markdown-image-source.test.ts
@@ -0,0 +1,54 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createMarkdownImageSourceResolver } from '../markdown-image-source.js';
+
+test('normalizes only complete image destinations present in canonical Markdown', () => {
+  const resolve = createMarkdownImageSourceResolver([
+    '![space](</tmp/my image.png>)',
+    '![title](https://example.com/image.png "Screenshot title")',
+    String.raw`![escaped](/tmp/a\(1\).png)`,
+    '![attachment](maka://runtime/attachments/image-1 "Preview")',
+  ].join('\n\n'));
+  assert.equal(resolve('</tmp/my image.png>'), '/tmp/my image.png');
+  assert.equal(resolve('https://example.com/image.png "Screenshot title"'), 'https://example.com/image.png');
+  assert.equal(resolve(String.raw`/tmp/a\(1\).png`), '/tmp/a(1).png');
+  assert.equal(resolve('maka://runtime/attachments/image-1 "Preview"'), 'maka://runtime/attachments/image-1');
+  assert.equal(resolve('/tmp/plain.png'), '/tmp/plain.png');
+});
+
+test('preserves literal title-like filenames resolved from image references', () => {
+  const source = '/tmp/my "image".png';
+  const resolve = createMarkdownImageSourceResolver(`![reference][picture]\n\n[picture]: <${source}>`);
+  assert.equal(resolve(source), source);
+});
+
+test('code, raw HTML, incomplete syntax and unrelated destinations do not become image grants', () => {
+  for (const text of [
+    '`![code](</tmp/my image.png>)`',
+    '```md\n![code](</tmp/my image.png>)\n```',
+    '<img src="/tmp/my image.png">',
+    '![incomplete](</tmp/my image.png>',
+    '![different](</tmp/other image.png>)',
+  ]) {
+    assert.equal(createMarkdownImageSourceResolver(text)('</tmp/my image.png>'), '</tmp/my image.png>');
+  }
+});
diff --git a/packages/ui/src/markdown-body.tsx b/packages/ui/src/markdown-body.tsx
index f864e2c3cb..47aea1c024 100644
--- a/packages/ui/src/markdown-body.tsx
+++ b/packages/ui/src/markdown-body.tsx
@@ -29,7 +29,7 @@
  * product-specific trust boundaries around that renderer.
  */
 
-import { MarkdownImage } from './markdown-image.js';
+import { MarkdownImage, MarkdownImageSourceProvider } from './markdown-image.js';
 import { ImageMessageScope } from './image-delivery.js';
 import { useCallback, useContext, useRef, type ReactNode } from 'react';
 import {
@@ -163,48 +163,50 @@ export function MarkdownBody(props: {
     : MARKDOWN_COMPONENTS[density];
 
   return (
-    <ImageMessageScope.Provider value={props.imageIdentity ? { ...props.imageIdentity, streaming: props.streaming } : undefined}>
-      <div
-        data-maka-contract="markdown"
-        data-maka-script={hasHanProse(props.text) ? 'han' : undefined}
-        // Migration-only identity wrapper. `display: contents` gives the
-        // contract harness a stable declared subtree without adding a layout
-        // box or interfering with Astryx's document root.
-        style={{ display: 'contents' }}
-      >
-        <AstryxMarkdown
-          autolink="gfm"
-          // Markdown holds no reading measure; the container it lands in does.
-          //
-          // Astryx caps prose at 680px by default but renders a supplied
-          // `components.code` bare — no spacing, no width, no alignment. Maka
-          // always supplies one, so any container that leans on the default gets
-          // prose at 680 and code blocks at whatever the container is: two right
-          // edges, which is the defect this whole change exists to remove. One
-          // authority per column, and it is the container.
-          contentWidth="100%"
-          // Chosen by the caller, and defaulting to document rhythm.
-          //
-          // The transcript passes `compact`: Astryx's default heading spacing
-          // assumes a page with a handful of sections, while an agent turn
-          // emits headings every few lines, so the default margins push each
-          // one into its own visual slab. That is the same argument that
-          // flattens transcript heading SIZES in styles/chat-message.css — and
-          // that rule is scoped to `.maka-turn` precisely because the other
-          // caller, the Daily Review panel, renders a report, which is a
-          // document. Hardcoding `compact` here contradicted that scoping: the
-          // review kept full heading sizes but got transcript block spacing,
-          // the one combination neither half of the argument asks for.
-          density={density}
-          components={components}
-          isStreaming={props.streaming}
-          settledText={props.settledText}
-          transformSource={transformMathSource}
+    <MarkdownImageSourceProvider text={budgetedText}>
+      <ImageMessageScope.Provider value={props.imageIdentity ? { ...props.imageIdentity, streaming: props.streaming } : undefined}>
+        <div
+          data-maka-contract="markdown"
+          data-maka-script={hasHanProse(props.text) ? 'han' : undefined}
+          // Migration-only identity wrapper. `display: contents` gives the
+          // contract harness a stable declared subtree without adding a layout
+          // box or interfering with Astryx's document root.
+          style={{ display: 'contents' }}
         >
-          {budgetedText}
-        </AstryxMarkdown>
-      </div>
-    </ImageMessageScope.Provider>
+          <AstryxMarkdown
+            autolink="gfm"
+            // Markdown holds no reading measure; the container it lands in does.
+            //
+            // Astryx caps prose at 680px by default but renders a supplied
+            // `components.code` bare — no spacing, no width, no alignment. Maka
+            // always supplies one, so any container that leans on the default gets
+            // prose at 680 and code blocks at whatever the container is: two right
+            // edges, which is the defect this whole change exists to remove. One
+            // authority per column, and it is the container.
+            contentWidth="100%"
+            // Chosen by the caller, and defaulting to document rhythm.
+            //
+            // The transcript passes `compact`: Astryx's default heading spacing
+            // assumes a page with a handful of sections, while an agent turn
+            // emits headings every few lines, so the default margins push each
+            // one into its own visual slab. That is the same argument that
+            // flattens transcript heading SIZES in styles/chat-message.css — and
+            // that rule is scoped to `.maka-turn` precisely because the other
+            // caller, the Daily Review panel, renders a report, which is a
+            // document. Hardcoding `compact` here contradicted that scoping: the
+            // review kept full heading sizes but got transcript block spacing,
+            // the one combination neither half of the argument asks for.
+            density={density}
+            components={components}
+            isStreaming={props.streaming}
+            settledText={props.settledText}
+            transformSource={transformMathSource}
+          >
+            {budgetedText}
+          </AstryxMarkdown>
+        </div>
+      </ImageMessageScope.Provider>
+    </MarkdownImageSourceProvider>
   );
 }
 
diff --git a/packages/ui/src/markdown-image-source.ts b/packages/ui/src/markdown-image-source.ts
new file mode 100644
index 0000000000..1fef771f8b
--- /dev/null
+++ b/packages/ui/src/markdown-image-source.ts
@@ -0,0 +1,49 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { Lexer, Marked } from 'marked';
+
+const parser = new Marked({ gfm: true });
+
+/** Astryx can pass destination syntax through its image slot. Resolve it with
+ * the Host's Markdown parser, without changing the text rendered or stored.
+ * Parse the document lazily, once, only for destinations needing normalization.
+ */
+export function createMarkdownImageSourceResolver(text: string): (source: string) => string {
+  let canonicalSources: Set<string> | undefined;
+  return (source) => {
+    if (!/[<>"'\\\s&]/.test(source) || source.length > 4096 || text.length > 1024 * 1024)
+      return source;
+    if (!canonicalSources) {
+      const sources = new Set<string>();
+      parser.walkTokens(parser.lexer(text), (token) => {
+        if (token.type === 'image') sources.add(token.href);
+      });
+      canonicalSources = sources;
+    }
+    // Reference destinations already arrive without brackets/title syntax.
+    // Preserve a canonical path containing literal quotes or whitespace.
+    if (canonicalSources.has(source)) return source;
+    const markdown = `![](${source})`;
+    const [token] = Lexer.lexInline(markdown, { gfm: true });
+    return token?.type === 'image' && token.raw === markdown && canonicalSources.has(token.href)
+      ? token.href
+      : source;
+  };
+}
diff --git a/packages/ui/src/markdown-image.tsx b/packages/ui/src/markdown-image.tsx
index 9a98ab6d51..b5e93d9eb4 100644
--- a/packages/ui/src/markdown-image.tsx
+++ b/packages/ui/src/markdown-image.tsx
@@ -17,8 +17,8 @@
  * under the License.
  */
 
-import { useEffect, useRef, useState } from 'react';
-import { Button, IconButton, useLightbox } from '@astryxdesign/core';
+import { createContext, useContext, useEffect, useMemo, useRef, useState, type ReactNode } from 'react';
+import { Button, IconButton, Spinner, useLightbox } from '@astryxdesign/core';
 import { Maximize2 } from './icons.js';
 import { Link } from '@astryxdesign/core/Link';
 import { parseAttachmentResourceRef } from '@maka/core/attachments';
@@ -26,10 +26,18 @@ import { useAttachmentImage } from './attachment-image.js';
 import { useImageDelivery } from './image-delivery.js';
 import { getSharedUiCopy } from './shared-ui-copy.js';
 import { useUiLocale } from './locale-context.js';
+import { createMarkdownImageSourceResolver } from './markdown-image-source.js';
+
+const ImageSourceContext = createContext<(source: string) => string>((source) => source);
+export function MarkdownImageSourceProvider(props: { text: string; children: ReactNode }) {
+  const resolve = useMemo(() => createMarkdownImageSourceResolver(props.text), [props.text]);
+  return <ImageSourceContext.Provider value={resolve}>{props.children}</ImageSourceContext.Provider>;
+}
 
 /** Presentation only: Host resolves local addresses and archives; UI receives artifact identities. */
 export function MarkdownImage(props: { src: string; alt: string }) {
-  return <ImageResource key={props.src} {...props} />;
+  const source = useContext(ImageSourceContext)(props.src);
+  return <ImageResource key={source} src={source} alt={props.alt} />;
 }
 function ImageResource(props: { src: string; alt: string }) {
   const copy = getSharedUiCopy(useUiLocale()).markdown;
@@ -68,10 +76,11 @@ function ImageResource(props: { src: string; alt: string }) {
     : explicit && image.status === 'unavailable' ? copy.imageUnavailable
     : delivery.status === 'failed' ? copy.imageArchiveFailure(delivery.reason)
     : delivery.status === 'pending' || artifactId ? copy.imageLoading : copy.imageUnsupported;
-  return <span ref={anchor} className="maka-markdown-image-resource" data-maka-image-state={message ? failed ? 'failed' : 'loading' : 'ready'}>
+  const hasFrame = !visible || !!source || !!artifactId || delivery.status === 'pending';
+  return <span ref={anchor} className={`maka-markdown-image-resource${hasFrame ? ' maka-markdown-image-frame' : ''}`} data-maka-image-state={message ? failed ? 'failed' : 'loading' : 'ready'}>
     {message ? <span className="maka-markdown-image-placeholder">
       {props.alt && <span className="maka-markdown-image-caption">{props.alt}</span>}
-      <span role="status">{message}</span>
+      <span role="status">{hasFrame && !failed && delivery.status !== 'failed' && <Spinner size="sm" shade="subtle" aria-hidden="true" />} {message}</span>
       {(failed || delivery.status === 'failed') && sourceActions}
     </span> : source && <DisplayImage key={`${source}\0${attempt}`} src={source} alt={props.alt} onError={() => setFailedSource(source)} />}
     {!explicit && delivery.status === 'pending' && remote && source && <span className="maka-markdown-image-saving" role="status">{copy.imageSaving}</span>}
@@ -85,13 +94,13 @@ function DisplayImage(props: { src: string; alt: string; onError(): void }) {
   const [loaded, setLoaded] = useState(false);
   const lightbox = useLightbox({ media: { src: props.src, alt: props.alt }, hasZoom: true });
   return <>
-    {!loaded && <span className="maka-markdown-image-loading" role="status">{copy.imageLoading}</span>}
     <span className="maka-markdown-image-preview">
+      {!loaded && <span className="maka-markdown-image-loading" role="status"><Spinner size="sm" shade="subtle" aria-hidden="true" /> {copy.imageLoading}</span>}
       <img src={props.src} alt={props.alt} loading="lazy" decoding="async" referrerPolicy="no-referrer"
           className="maka-markdown-attachment-image" onLoad={() => setLoaded(true)} onError={props.onError} />
-      <span className="maka-markdown-image-expand">
+      {loaded && <span className="maka-markdown-image-expand">
         <IconButton icon={<Maximize2 size={16} />} size="sm" label={copy.imageExpand(props.alt)} onClick={() => lightbox.open()} />
-      </span>
+      </span>}
     </span>
     {lightbox.isOpen && lightbox.element}
   </>;
diff --git a/packages/ui/src/styles.css b/packages/ui/src/styles.css
index 6fd27fbf1e..a31cf320e4 100644
--- a/packages/ui/src/styles.css
+++ b/packages/ui/src/styles.css
@@ -644,21 +644,54 @@
   gap: var(--space-3);
 }
 .maka-markdown-image-resource { display: inline-block; position: relative; max-width: 100%; }
+/* Source resolution and decoding share one responsive frame. Transient status
+   overlays never add a row or move the transcript when they disappear. */
+.maka-markdown-image-frame {
+  display: block;
+  width: 640px;
+  aspect-ratio: 4 / 3;
+}
+.maka-markdown-image-frame > .maka-markdown-image-placeholder {
+  position: absolute;
+  inset: 0;
+  align-items: center;
+  justify-content: center;
+  border: 0;
+}
 .maka-markdown-image-preview {
-  display: inline-block;
-  position: relative;
-  min-inline-size: var(--space-10);
-  min-block-size: var(--space-10);
-  max-width: 100%;
+  display: flex;
+  position: absolute;
+  inset: 0;
+  align-items: center;
+  justify-content: center;
 }
 .maka-markdown-image-expand {
   position: absolute;
   inset-block-end: var(--space-2);
   inset-inline-end: var(--space-2);
 }
-.maka-markdown-image-preview img { margin: 0; max-height: 480px; object-fit: contain; }
-.maka-markdown-image-loading { display: block; color: var(--muted-foreground); font-size: var(--maka-font-size-sm); }
-.maka-markdown-image-saving { display: block; color: var(--muted-foreground); font-size: var(--maka-font-size-sm); margin-block-start: var(--space-1); }
+.maka-markdown-image-preview img { margin: 0; max-height: 100%; max-width: 100%; object-fit: contain; }
+.maka-markdown-image-loading {
+  position: absolute;
+  inset: 0;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  gap: var(--space-2);
+  color: var(--muted-foreground);
+  font-size: var(--maka-font-size-sm);
+}
+.maka-markdown-image-saving {
+  position: absolute;
+  inset-inline-start: var(--space-2);
+  inset-block-end: var(--space-2);
+  max-width: calc(100% - var(--space-10));
+  padding: var(--space-1) var(--space-2);
+  background: var(--background);
+  border-radius: var(--radius-surface);
+  color: var(--muted-foreground);
+  font-size: var(--maka-font-size-sm);
+}
 
 /* Markdown code renderers are custom components so Mermaid can be loaded only
    for settled Mermaid fences. Astryx skips its own spacing wrapper when

From a8ec6b2358f92896a22c279a9406f353be0a1847 Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Tue, 6 Oct 2026 17:15:51 +0800
Subject: [PATCH 08/35] refactor(chat): share image parsing and archive
 contracts

Generated-by: Codex (GPT-6)
---
 package-lock.json                             |  5 +-
 packages/core/package.json                    |  4 +-
 .../core/src/__tests__/image-markdown.test.ts | 70 +++++++++++++
 packages/core/src/image-delivery.ts           | 21 ++--
 packages/core/src/image-markdown.ts           | 42 ++++++++
 packages/runtime-host/package.json            |  1 -
 .../chat-image-contract-share.json            |  5 +
 .../src/__tests__/chat-image-delivery.test.ts | 98 +++++++++++++++++++
 .../src/protocol/image-delivery.ts            | 13 ++-
 .../src/server/chat-image-artifact.ts         | 55 +++++++++++
 .../src/server/chat-image-delivery.ts         | 27 +++--
 .../src/server/chat-image-markdown.ts         | 24 ++---
 .../src/server/chat-image-source.ts           | 10 +-
 .../src/server/execution-artifacts.ts         | 29 +++---
 packages/runtime/src/image-file-reader.ts     |  5 +-
 packages/runtime/src/image-file.ts            |  5 +
 packages/ui/package.json                      |  1 -
 packages/ui/src/markdown-image-source.ts      | 29 +++---
 18 files changed, 358 insertions(+), 86 deletions(-)
 create mode 100644 packages/core/src/__tests__/image-markdown.test.ts
 create mode 100644 packages/core/src/image-markdown.ts
 create mode 100644 packages/runtime-host/protocol-compatible-changes/chat-image-contract-share.json
 create mode 100644 packages/runtime-host/src/server/chat-image-artifact.ts

diff --git a/package-lock.json b/package-lock.json
index 5afaacc60e..8166229ca9 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -17304,7 +17304,8 @@
       "version": "0.1.0",
       "license": "Apache-2.0",
       "dependencies": {
-        "intl-messageformat": "11.2.15"
+        "intl-messageformat": "11.2.15",
+        "marked": "^18.0.11"
       }
     },
     "packages/core/node_modules/@formatjs/icu-messageformat-parser": {
@@ -17420,7 +17421,6 @@
         "@maka/core": "0.1.0",
         "@maka/runtime": "0.1.0",
         "@maka/storage": "0.1.0",
-        "marked": "^18.0.11",
         "systeminformation": "^5.33.13",
         "ws": "^8.21.3",
         "yaml": "^2.9.1",
@@ -17511,7 +17511,6 @@
         "clsx": "^2.1.1",
         "katex": "0.18.9",
         "lucide-react": "^1.48.0",
-        "marked": "^18.0.11",
         "mermaid": "^11.17.2",
         "react": "^19.3.0",
         "react-dom": "^19.3.0",
diff --git a/packages/core/package.json b/packages/core/package.json
index 7547f7a881..e88b3b09d9 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -65,6 +65,7 @@
     "./tool-result-archive-evidence": "./dist/tool-result-archive-evidence.js",
     "./attachments": "./dist/attachments.js",
     "./image-delivery": "./dist/image-delivery.js",
+    "./image-markdown": "./dist/image-markdown.js",
     "./artifacts": "./dist/artifacts.js",
     "./pet": "./dist/pet.js",
     "./skill-invocation": "./dist/skill-invocation.js",
@@ -180,6 +181,7 @@
     "test:dist": "node --test \"dist/**/*.test.js\""
   },
   "dependencies": {
-    "intl-messageformat": "11.2.15"
+    "intl-messageformat": "11.2.15",
+    "marked": "^18.0.11"
   }
 }
diff --git a/packages/core/src/__tests__/image-markdown.test.ts b/packages/core/src/__tests__/image-markdown.test.ts
new file mode 100644
index 0000000000..c983b397ab
--- /dev/null
+++ b/packages/core/src/__tests__/image-markdown.test.ts
@@ -0,0 +1,70 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { markdownImageSources, parseMarkdownImageDestination } from '../image-markdown.js';
+import { IMAGE_MARKDOWN_MAX_LENGTH } from '../image-delivery.js';
+
+test('canonical destinations retain document order, references and explicit attachments', () => {
+  assert.deepEqual(
+    markdownImageSources(
+      [
+        '![space](</tmp/a (1).png> "Title")',
+        '![reference][pic]',
+        '![duplicate](</tmp/a (1).png>)',
+        '![attachment](maka://runtime/attachments/image-1 "Preview")',
+        String.raw`![escaped](/tmp/a\(1\).png)`,
+        '',
+        '[pic]: </tmp/my "image".png>',
+        '`![code](/tmp/secret.png)`',
+        '```md',
+        '![fenced](/tmp/secret2.png)',
+        '```',
+        '<img src="/tmp/html.png">',
+        '![incomplete](</tmp/partial.png>',
+      ].join('\n'),
+    ),
+    [
+      '/tmp/a (1).png',
+      '/tmp/my "image".png',
+      'maka://runtime/attachments/image-1',
+      '/tmp/a(1).png',
+    ],
+  );
+});
+
+test('document budget is measured in UTF-16 code units and accepts the boundary', () => {
+  const image = '![x](/tmp/a.png)';
+  const text = image + '\n\n' + '中'.repeat(IMAGE_MARKDOWN_MAX_LENGTH - image.length - 2);
+  assert.equal(text.length, IMAGE_MARKDOWN_MAX_LENGTH);
+  assert.deepEqual(markdownImageSources(text), ['/tmp/a.png']);
+  assert.deepEqual(markdownImageSources(text + '中'), []);
+});
+
+test('inline destinations require one complete image token with no trailing syntax', () => {
+  assert.equal(parseMarkdownImageDestination('</tmp/my image.png> "Title"'), '/tmp/my image.png');
+  assert.equal(parseMarkdownImageDestination(String.raw`/tmp/a\(1\).png`), '/tmp/a(1).png');
+  for (const source of [
+    '</tmp/incomplete.png',
+    '/tmp/a.png) trailing',
+    '/tmp/a.png) ![b](/tmp/b.png',
+  ])
+    assert.equal(parseMarkdownImageDestination(source), undefined);
+});
diff --git a/packages/core/src/image-delivery.ts b/packages/core/src/image-delivery.ts
index a949ab0b4a..f320d6a9d8 100644
--- a/packages/core/src/image-delivery.ts
+++ b/packages/core/src/image-delivery.ts
@@ -18,6 +18,18 @@
  */
 
 /** Client-safe delivery contract. No filesystem or networking capabilities live here. */
+export const IMAGE_DELIVERY_IDENTITY_MAX_LENGTH = 512;
+export const IMAGE_DELIVERY_SOURCE_MAX_LENGTH = 4096;
+/** JavaScript string length, shared by stream capture and Markdown consumers. */
+export const IMAGE_MARKDOWN_MAX_LENGTH = 1024 * 1024;
+export function isImageDeliverySource(value: unknown): value is string {
+  return (
+    typeof value === 'string' &&
+    value.length > 0 &&
+    value.length <= IMAGE_DELIVERY_SOURCE_MAX_LENGTH &&
+    !/[\x00-\x1f\x7f]/.test(value)
+  );
+}
 export const IMAGE_DELIVERY_FAILURES = [
   'not_found',
   'not_allowed',
@@ -65,17 +77,14 @@ export function isImageDeliveryMetadata(value: unknown): value is ImageDeliveryM
     ) &&
     typeof v.messageId === 'string' &&
     v.messageId.length > 0 &&
-    v.messageId.length <= 512 &&
-    typeof v.source === 'string' &&
-    v.source.length > 0 &&
-    v.source.length <= 4096 &&
+    v.messageId.length <= IMAGE_DELIVERY_IDENTITY_MAX_LENGTH &&
+    isImageDeliverySource(v.source) &&
     ['pending', 'ready', 'failed'].includes(String(v.status)) &&
     (v.reason === undefined ||
       IMAGE_DELIVERY_FAILURES.includes(v.reason as ImageDeliveryFailure)) &&
     (v.contentSha256 === undefined ||
       (typeof v.contentSha256 === 'string' && /^[a-f0-9]{64}$/.test(v.contentSha256))) &&
     (v.status === 'failed' ? v.reason !== undefined : v.reason === undefined) &&
-    (v.status === 'ready' ? v.contentSha256 !== undefined : v.contentSha256 === undefined) &&
-    !/[\x00-\x1f\x7f]/.test(v.source as string)
+    (v.status === 'ready' ? v.contentSha256 !== undefined : v.contentSha256 === undefined)
   );
 }
diff --git a/packages/core/src/image-markdown.ts b/packages/core/src/image-markdown.ts
new file mode 100644
index 0000000000..ebbdec6db5
--- /dev/null
+++ b/packages/core/src/image-markdown.ts
@@ -0,0 +1,42 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { Lexer, Marked } from 'marked';
+import { IMAGE_MARKDOWN_MAX_LENGTH } from './image-delivery.js';
+
+const parser = new Marked({ gfm: true });
+
+/** Canonical image destinations in real Markdown nodes, including attachment refs.
+ * Consumers own their source policy; parsing grants no filesystem or network access.
+ */
+export function markdownImageSources(text: string): string[] {
+  if (!text.includes('![') || text.length > IMAGE_MARKDOWN_MAX_LENGTH) return [];
+  const sources = new Set<string>();
+  parser.walkTokens(parser.lexer(text), (token) => {
+    if (token.type === 'image') sources.add(token.href);
+  });
+  return [...sources];
+}
+
+/** Resolve a complete inline destination, rejecting trailing or partial syntax. */
+export function parseMarkdownImageDestination(source: string): string | undefined {
+  const markdown = `![](${source})`;
+  const [token] = Lexer.lexInline(markdown, { gfm: true });
+  return token?.type === 'image' && token.raw === markdown ? token.href : undefined;
+}
diff --git a/packages/runtime-host/package.json b/packages/runtime-host/package.json
index c70c508db2..c55c2b5a47 100644
--- a/packages/runtime-host/package.json
+++ b/packages/runtime-host/package.json
@@ -38,7 +38,6 @@
     "@maka/core": "0.1.0",
     "@maka/runtime": "0.1.0",
     "@maka/storage": "0.1.0",
-    "marked": "^18.0.11",
     "systeminformation": "^5.33.13",
     "ws": "^8.21.3",
     "yaml": "^2.9.1",
diff --git a/packages/runtime-host/protocol-compatible-changes/chat-image-contract-share.json b/packages/runtime-host/protocol-compatible-changes/chat-image-contract-share.json
new file mode 100644
index 0000000000..3a050d31b6
--- /dev/null
+++ b/packages/runtime-host/protocol-compatible-changes/chat-image-contract-share.json
@@ -0,0 +1,5 @@
+{
+  "epoch": 206,
+  "files": ["packages/runtime-host/src/protocol/image-delivery.ts"],
+  "reason": "Shares the existing 512-character identity bound and 4096-character non-empty, control-free source validation with the core image delivery contract. Accepted and rejected request values, validation order, frame keys, output decoding and protocol errors are unchanged."
+}
diff --git a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
index 2d77d5a796..51b577fc8f 100644
--- a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
+++ b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
@@ -36,6 +36,8 @@ import { chatImageSources } from '../server/chat-image-markdown.js';
 import { checkedChatImage, downloadChatImage } from '../server/chat-image-source.js';
 import { IMAGE_DELIVERY_OPERATION_SPECS } from '../protocol/image-delivery.js';
 import { SessionAdmissionGate } from '../server/session-admission-gate.js';
+import { createHostExecutionArtifactServices } from '../server/execution-artifacts.js';
+import { isImageDeliveryMetadata, isImageDeliverySource } from '@maka/core/image-delivery';
 const PNG = Buffer.from(
   'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8DwHwAFBQIAX8jx0gAAAABJRU5ErkJggg==',
   'base64',
@@ -614,3 +616,99 @@ test('completed turns release unfinished stream slots without archiving partial
     await f.close();
   }
 });
+
+test('capture, wire and stored metadata share source limits while retaining boundary policies', () => {
+  const decode = IMAGE_DELIVERY_OPERATION_SPECS['artifact.image.resolve'].decodeInput;
+  const source = '/' + 'a'.repeat(4095);
+  assert.deepEqual(chatImageSources(`![x](<${source}>)`), [source]);
+  assert.equal(decode({ ...REQUEST, source, messageId: 'm'.repeat(512) }).source, source);
+  assert.throws(() => decode({ ...REQUEST, messageId: 'm'.repeat(513) }));
+  for (const source of ['', '/' + 'a'.repeat(4096), '/tmp/a\x01.png', '/tmp/a\x7f.png']) {
+    assert.equal(isImageDeliverySource(source), false);
+    assert.equal(isImageDeliveryMetadata({ messageId: 'm', source, status: 'pending' }), false);
+    assert.throws(() => decode({ ...REQUEST, source }));
+    assert.deepEqual(chatImageSources(`![x](<${source}>)`), []);
+  }
+  // Explicit attachment refs belong to UI resolution, not automatic source capture.
+  assert.deepEqual(chatImageSources('![x](maka://runtime/attachments/image-1)'), []);
+  assert.equal(
+    isImageDeliveryMetadata({ messageId: 'm\x01', source: REQUEST.source, status: 'pending' }),
+    true,
+  );
+  assert.throws(() => decode({ ...REQUEST, messageId: 'm\x01' }));
+  assert.equal(
+    chatImageSources(Array.from({ length: 70 }, (_, i) => `![x](/tmp/${i}.png)`).join('\n')).length,
+    64,
+  );
+});
+
+test('local and downloaded invalid image bytes retain identical failure reasons', async () => {
+  const f = await fixture();
+  try {
+    for (const [bytes, reason] of [
+      [PNG.subarray(0, 8), 'unsupported_mime'],
+      [new Uint8Array(2 * 1024 * 1024 + 1), 'too_large'],
+    ] as const) {
+      assert.throws(
+        () => checkedChatImage(bytes),
+        (error: unknown) => error instanceof Error && 'reason' in error && error.reason === reason,
+      );
+      const source = join(f.root, 'invalid.png');
+      await writeFile(source, bytes);
+      await assert.rejects(
+        createImageFileReader()({ path: source, cwd: f.root }),
+        (error: unknown) => error instanceof Error && 'reason' in error && error.reason === reason,
+      );
+    }
+  } finally {
+    await f.close();
+  }
+});
+
+test('automatic capture and PublishImage share content quota without merging their identities', async () => {
+  const limits = { sessionBytes: PNG.length, workspaceBytes: PNG.length };
+  const f = await fixture(limits, async () => checkedChatImage(PNG));
+  try {
+    observe(f.service, REQUEST.source);
+    await f.service.waitForIdle();
+    const automatic = await f.service.resolve(REQUEST);
+    assert.equal(automatic.status, 'ready');
+    if (automatic.status !== 'ready') return;
+    const services = createHostExecutionArtifactServices({
+      artifacts: f.authority.store,
+      sessionAdmission: new SessionAdmissionGate(),
+      sessions: { probeSessionRemoval: async () => ({ kind: 'present' }) },
+      imageArchiveLimits: limits,
+      requestDrain: () => assert.fail('shared bytes must not exceed quota or drain'),
+    });
+    const explicit = await services.publishImage({
+      sessionId: REQUEST.sessionId,
+      turnId: REQUEST.turnId,
+      toolCallId: 'publish-call',
+      name: 'published.png',
+      bytes: PNG,
+      mimeType: 'image/png',
+    });
+    assert.notEqual(explicit.relativePath, automatic.artifactId);
+    const captured = (await f.authority.store.getInSession(REQUEST.sessionId, automatic.artifactId))
+      .record!;
+    const published = (
+      await f.authority.store.getInSession(REQUEST.sessionId, explicit.relativePath)
+    ).record!;
+    assert.equal(captured.imageDelivery?.contentSha256, published.imageDelivery?.contentSha256);
+    assert.equal(captured.imageDelivery?.source, REQUEST.source);
+    assert.equal(published.imageDelivery?.source, 'published:publish-call');
+    assert.equal(published.imageDelivery?.messageId, 'publish-call');
+    assert.equal(published.summary, 'Published chat image');
+    assert.equal(
+      (await stat(join(f.root, 'artifacts', captured.relativePath))).ino,
+      (await stat(join(f.root, 'artifacts', published.relativePath))).ino,
+    );
+    const page = await f.authority.store.listPage(REQUEST.sessionId, { offset: 0, limit: 10 });
+    assert.equal(page.total, 2);
+    assert.ok(page.records.every((record) => record.imageDelivery?.status === 'ready'));
+    assert.deepEqual(f.errors, []);
+  } finally {
+    await f.close();
+  }
+});
diff --git a/packages/runtime-host/src/protocol/image-delivery.ts b/packages/runtime-host/src/protocol/image-delivery.ts
index 7ac1d5a01e..c22ec6826c 100644
--- a/packages/runtime-host/src/protocol/image-delivery.ts
+++ b/packages/runtime-host/src/protocol/image-delivery.ts
@@ -19,6 +19,8 @@
 
 import {
   IMAGE_DELIVERY_FAILURES,
+  IMAGE_DELIVERY_IDENTITY_MAX_LENGTH,
+  isImageDeliverySource,
   type ImageDeliveryRequest,
   type ImageDeliveryResult,
 } from '@maka/core/image-delivery';
@@ -67,11 +69,16 @@ export const IMAGE_DELIVERY_OPERATION_SPECS = {
       };
       if (v.retry !== undefined && typeof v.retry !== 'boolean')
         throw invalidProtocolFrame('Invalid image retry flag');
+      const source = (s: unknown) => {
+        if (!isImageDeliverySource(s))
+          throw invalidProtocolFrame('Invalid image delivery identity');
+        return s;
+      };
       return {
         sessionId: requireEntityId(v.sessionId, 'sessionId'),
-        turnId: text(v.turnId, 512),
-        messageId: text(v.messageId, 512),
-        source: text(v.source, 4096),
+        turnId: text(v.turnId, IMAGE_DELIVERY_IDENTITY_MAX_LENGTH),
+        messageId: text(v.messageId, IMAGE_DELIVERY_IDENTITY_MAX_LENGTH),
+        source: source(v.source),
         ...(v.retry === true ? { retry: true } : {}),
       };
     },
diff --git a/packages/runtime-host/src/server/chat-image-artifact.ts b/packages/runtime-host/src/server/chat-image-artifact.ts
new file mode 100644
index 0000000000..b2ee0b7a1a
--- /dev/null
+++ b/packages/runtime-host/src/server/chat-image-artifact.ts
@@ -0,0 +1,55 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { createHash } from 'node:crypto';
+import { DEFAULT_IMAGE_ARCHIVE_LIMITS, type ImageArchiveLimits } from '@maka/core/image-delivery';
+import type { InteractiveArtifactStoreWriter } from '@maka/storage/artifact-stores';
+import type { ChatImageBytes } from './chat-image-source.js';
+
+/** Build the shared ready record; callers own admission, identity and failures. */
+export function readyChatImageArtifact(input: {
+  id: string;
+  sessionId: string;
+  turnId: string;
+  name: string;
+  messageId: string;
+  source: string;
+  image: ChatImageBytes;
+  summary?: string;
+  limits?: ImageArchiveLimits;
+}): Parameters<InteractiveArtifactStoreWriter['create']>[0] {
+  return {
+    id: input.id,
+    sessionId: input.sessionId,
+    turnId: input.turnId,
+    name: input.name,
+    kind: 'image',
+    content: input.image.bytes,
+    mimeType: input.image.mimeType,
+    source: 'tool_result_projection',
+    ...(input.summary !== undefined ? { summary: input.summary } : {}),
+    imageDelivery: {
+      messageId: input.messageId,
+      source: input.source,
+      status: 'ready',
+      contentSha256: createHash('sha256').update(input.image.bytes).digest('hex'),
+    },
+    imageArchiveLimits: input.limits ?? DEFAULT_IMAGE_ARCHIVE_LIMITS,
+  };
+}
diff --git a/packages/runtime-host/src/server/chat-image-delivery.ts b/packages/runtime-host/src/server/chat-image-delivery.ts
index 95649a5c6c..9c6b88dd3a 100644
--- a/packages/runtime-host/src/server/chat-image-delivery.ts
+++ b/packages/runtime-host/src/server/chat-image-delivery.ts
@@ -22,7 +22,7 @@ import { ImageFileReadError } from '@maka/runtime/image-file-reader';
 import type { CompleteEvent, TextCompleteEvent, TextDeltaEvent } from '@maka/core/events';
 import { foldAssistantDelta } from '@maka/core/events';
 import {
-  DEFAULT_IMAGE_ARCHIVE_LIMITS,
+  IMAGE_MARKDOWN_MAX_LENGTH,
   type ImageArchiveLimits,
   type ImageDeliveryRequest,
   type ImageDeliveryResult,
@@ -34,6 +34,7 @@ import {
 } from '@maka/storage/artifact-stores';
 import type { SessionAdmissionGate } from './session-admission-gate.js';
 import { chatImageSources } from './chat-image-markdown.js';
+import { readyChatImageArtifact } from './chat-image-artifact.js';
 import { abortable } from '../client/wait-for-ready.js';
 import {
   downloadChatImage,
@@ -102,7 +103,7 @@ export class ChatImageDeliveryService {
       if (!folded) return;
       stream.text += folded.tail;
     }
-    if (stream.text.length > 1024 * 1024) {
+    if (stream.text.length > IMAGE_MARKDOWN_MAX_LENGTH) {
       clearTimeout(stream.timer);
       this.#streams.delete(key);
       return;
@@ -297,19 +298,17 @@ export class ChatImageDeliveryService {
       return;
     }
     try {
-      await publish({
-        ...base,
-        id: `chat_image_result_${deliveryKey(identity)}`,
-        kind: 'image',
-        content: image.bytes,
-        mimeType: image.mimeType,
-        imageDelivery: {
+      await publish(
+        readyChatImageArtifact({
+          id: `chat_image_result_${deliveryKey(identity)}`,
+          sessionId,
+          turnId,
+          name: base.name,
           ...metadata,
-          status: 'ready',
-          contentSha256: createHash('sha256').update(image.bytes).digest('hex'),
-        },
-        imageArchiveLimits: this.ports.limits ?? DEFAULT_IMAGE_ARCHIVE_LIMITS,
-      });
+          image,
+          limits: this.ports.limits,
+        }),
+      );
     } catch (error) {
       if (!(error instanceof ImageArchiveQuotaError)) throw error;
       await publish({
diff --git a/packages/runtime-host/src/server/chat-image-markdown.ts b/packages/runtime-host/src/server/chat-image-markdown.ts
index 0675689f67..82ca33b020 100644
--- a/packages/runtime-host/src/server/chat-image-markdown.ts
+++ b/packages/runtime-host/src/server/chat-image-markdown.ts
@@ -17,22 +17,12 @@
  * under the License.
  */
 
-import { Marked } from 'marked';
-const parser = new Marked({ gfm: true });
-/** Parse actual Markdown nodes, excluding code, HTML and incomplete destinations. */
+import { isImageDeliverySource } from '@maka/core/image-delivery';
+import { markdownImageSources } from '@maka/core/image-markdown';
+
+/** Capture policy excludes explicit attachments and limits jobs per message. */
 export function chatImageSources(text: string): string[] {
-  if (!text.includes('![') || text.length > 1024 * 1024) return [];
-  const sources = new Set<string>();
-  parser.walkTokens(parser.lexer(text), (token) => {
-    if (token.type !== 'image') return;
-    const source = token.href;
-    if (
-      source.length > 0 &&
-      source.length <= 4096 &&
-      !/[\u0000-\u001f\u007f]/.test(source) &&
-      !source.startsWith('maka:')
-    )
-      sources.add(source);
-  });
-  return [...sources].slice(0, 64);
+  return markdownImageSources(text)
+    .filter((source) => isImageDeliverySource(source) && !source.startsWith('maka:'))
+    .slice(0, 64);
 }
diff --git a/packages/runtime-host/src/server/chat-image-source.ts b/packages/runtime-host/src/server/chat-image-source.ts
index 3fde63293c..97d30b319d 100644
--- a/packages/runtime-host/src/server/chat-image-source.ts
+++ b/packages/runtime-host/src/server/chat-image-source.ts
@@ -23,7 +23,11 @@ import { request as httpsRequest } from 'node:https';
 import { isIP } from 'node:net';
 import { fileURLToPath } from 'node:url';
 import { ARTIFACT_IMAGE_PREVIEW_MAX_BYTES } from '@maka/core/artifacts';
-import { ImageFileError, validateImageBytes } from '@maka/runtime/image-file';
+import {
+  ImageFileError,
+  imageFileFailureReason,
+  validateImageBytes,
+} from '@maka/runtime/image-file';
 import type { ImageDeliveryFailure } from '@maka/core/image-delivery';
 export class ImageSourceError extends Error {
   constructor(readonly reason: ImageDeliveryFailure) {
@@ -39,9 +43,7 @@ export function checkedChatImage(bytes: Uint8Array): ChatImageBytes {
     return validateImageBytes(bytes, 'chat');
   } catch (error) {
     if (!(error instanceof ImageFileError)) throw error;
-    throw new ImageSourceError(
-      error.code === 'ERR_IMAGE_TOO_LARGE' ? 'too_large' : 'unsupported_mime',
-    );
+    throw new ImageSourceError(imageFileFailureReason(error));
   }
 }
 export function localImagePath(source: string): string | undefined {
diff --git a/packages/runtime-host/src/server/execution-artifacts.ts b/packages/runtime-host/src/server/execution-artifacts.ts
index 9dc11f953e..b3a08d8d81 100644
--- a/packages/runtime-host/src/server/execution-artifacts.ts
+++ b/packages/runtime-host/src/server/execution-artifacts.ts
@@ -17,7 +17,6 @@
  * under the License.
  */
 
-import { DEFAULT_IMAGE_ARCHIVE_LIMITS } from '@maka/core/image-delivery';
 import { createHash } from 'node:crypto';
 import { open, realpath, stat } from 'node:fs/promises';
 import { isAbsolute, resolve } from 'node:path';
@@ -48,6 +47,7 @@ import {
 import type { SessionManagerDeps } from '@maka/runtime/session-manager';
 import type { SessionAdmissionGate } from './session-admission-gate.js';
 import type { SessionPresenceReader } from './session-presence.js';
+import { readyChatImageArtifact } from './chat-image-artifact.js';
 
 export interface HostExecutionArtifactServices {
   recordToolArtifacts(event: ToolArtifactRecorderInput): Promise<void>;
@@ -138,24 +138,19 @@ export function createHostExecutionArtifactServices(input: {
       const id = `published_image_${createHash('sha256')
         .update(JSON.stringify([image.sessionId, image.turnId, image.toolCallId]))
         .digest('hex')}`;
-      const artifact = await publish({
-        id,
-        sessionId: image.sessionId,
-        turnId: image.turnId,
-        name: image.name,
-        kind: 'image',
-        content: image.bytes,
-        mimeType,
-        source: 'tool_result_projection',
-        summary: 'Published chat image',
-        imageDelivery: {
+      const artifact = await publish(
+        readyChatImageArtifact({
+          id,
+          sessionId: image.sessionId,
+          turnId: image.turnId,
+          name: image.name,
           messageId: image.toolCallId,
           source: `published:${image.toolCallId}`,
-          status: 'ready',
-          contentSha256: createHash('sha256').update(image.bytes).digest('hex'),
-        },
-        imageArchiveLimits: input.imageArchiveLimits ?? DEFAULT_IMAGE_ARCHIVE_LIMITS,
-      });
+          image: { bytes: image.bytes, mimeType },
+          summary: 'Published chat image',
+          limits: input.imageArchiveLimits,
+        }),
+      );
       if (!artifact)
         throw new Error('The session was removed before the image could be published.');
       return { kind: 'session_file', sessionId: image.sessionId, relativePath: artifact.id };
diff --git a/packages/runtime/src/image-file-reader.ts b/packages/runtime/src/image-file-reader.ts
index 6d5e798476..5be80181fc 100644
--- a/packages/runtime/src/image-file-reader.ts
+++ b/packages/runtime/src/image-file-reader.ts
@@ -23,7 +23,7 @@ import {
   type FilesystemExecuteInput,
 } from './filesystem-executor.js';
 import { createLocalWorkspaceExecutor } from './workspace-executor.js';
-import { ImageFileError } from './image-file.js';
+import { ImageFileError, imageFileFailureReason } from './image-file.js';
 import { FilesystemWorkerClientError } from './filesystem-worker/client.js';
 import { SandboxCommandError } from './sandbox/errors.js';
 
@@ -45,8 +45,7 @@ export class ImageFileReadError extends Error {
 }
 
 function readFailure(error: unknown): ImageFileReadFailure {
-  if (error instanceof ImageFileError)
-    return error.code === 'ERR_IMAGE_TOO_LARGE' ? 'too_large' : 'unsupported_mime';
+  if (error instanceof ImageFileError) return imageFileFailureReason(error);
   if (error instanceof SandboxCommandError) return 'not_allowed';
   const code =
     error instanceof FilesystemWorkerClientError
diff --git a/packages/runtime/src/image-file.ts b/packages/runtime/src/image-file.ts
index 361e33ed6c..cda689e278 100644
--- a/packages/runtime/src/image-file.ts
+++ b/packages/runtime/src/image-file.ts
@@ -47,6 +47,11 @@ export class ImageFileError extends Error {
   }
 }
 
+/** Translate validated image failures without changing backend/transport errors. */
+export function imageFileFailureReason(error: ImageFileError): 'too_large' | 'unsupported_mime' {
+  return error.code === 'ERR_IMAGE_TOO_LARGE' ? 'too_large' : 'unsupported_mime';
+}
+
 export function isSupportedImagePath(path: string): boolean {
   return IMAGE_EXTENSIONS.has(extname(path).toLowerCase());
 }
diff --git a/packages/ui/package.json b/packages/ui/package.json
index 563f59710b..8de5e24cdb 100644
--- a/packages/ui/package.json
+++ b/packages/ui/package.json
@@ -33,7 +33,6 @@
     "clsx": "^2.1.1",
     "katex": "0.18.9",
     "lucide-react": "^1.48.0",
-    "marked": "^18.0.11",
     "mermaid": "^11.17.2",
     "react": "^19.3.0",
     "react-dom": "^19.3.0",
diff --git a/packages/ui/src/markdown-image-source.ts b/packages/ui/src/markdown-image-source.ts
index 1fef771f8b..12cfc8627c 100644
--- a/packages/ui/src/markdown-image-source.ts
+++ b/packages/ui/src/markdown-image-source.ts
@@ -17,9 +17,11 @@
  * under the License.
  */
 
-import { Lexer, Marked } from 'marked';
-
-const parser = new Marked({ gfm: true });
+import {
+  IMAGE_DELIVERY_SOURCE_MAX_LENGTH,
+  IMAGE_MARKDOWN_MAX_LENGTH,
+} from '@maka/core/image-delivery';
+import { markdownImageSources, parseMarkdownImageDestination } from '@maka/core/image-markdown';
 
 /** Astryx can pass destination syntax through its image slot. Resolve it with
  * the Host's Markdown parser, without changing the text rendered or stored.
@@ -28,22 +30,17 @@ const parser = new Marked({ gfm: true });
 export function createMarkdownImageSourceResolver(text: string): (source: string) => string {
   let canonicalSources: Set<string> | undefined;
   return (source) => {
-    if (!/[<>"'\\\s&]/.test(source) || source.length > 4096 || text.length > 1024 * 1024)
+    if (
+      !/[<>"'\\\s&]/.test(source) ||
+      source.length > IMAGE_DELIVERY_SOURCE_MAX_LENGTH ||
+      text.length > IMAGE_MARKDOWN_MAX_LENGTH
+    )
       return source;
-    if (!canonicalSources) {
-      const sources = new Set<string>();
-      parser.walkTokens(parser.lexer(text), (token) => {
-        if (token.type === 'image') sources.add(token.href);
-      });
-      canonicalSources = sources;
-    }
+    canonicalSources ??= new Set(markdownImageSources(text));
     // Reference destinations already arrive without brackets/title syntax.
     // Preserve a canonical path containing literal quotes or whitespace.
     if (canonicalSources.has(source)) return source;
-    const markdown = `![](${source})`;
-    const [token] = Lexer.lexInline(markdown, { gfm: true });
-    return token?.type === 'image' && token.raw === markdown && canonicalSources.has(token.href)
-      ? token.href
-      : source;
+    const destination = parseMarkdownImageDestination(source);
+    return destination !== undefined && canonicalSources.has(destination) ? destination : source;
   };
 }

From 191458ca155d021fe6b479e89d22ecfd5b875d63 Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Tue, 6 Oct 2026 19:33:57 +0800
Subject: [PATCH 09/35] fix(chat): resolve encoded local image paths without
 breaking literal names

Retry missing local Markdown image paths with one percent-decoding pass through the same filesystem boundary and source-read budget. Preserve literal percent filenames, file URL semantics, and original delivery identities. Add capture, replay, validation, and permission regression coverage.

Generated-by: Codex (GPT-6)
---
 .../src/__tests__/chat-image-delivery.test.ts | 136 +++++++++++++++++-
 .../src/server/chat-image-delivery.ts         |  23 ++-
 .../src/server/chat-image-source.ts           |  15 +-
 3 files changed, 168 insertions(+), 6 deletions(-)

diff --git a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
index 51b577fc8f..ae04f90635 100644
--- a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
+++ b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
@@ -19,12 +19,13 @@
 
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
-import { mkdtemp, readFile, writeFile, rm, stat } from 'node:fs/promises';
+import { mkdtemp, mkdir, readFile, writeFile, rm, stat } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+import { pathToFileURL } from 'node:url';
 import { createServer } from 'node:http';
 import { createHash } from 'node:crypto';
-import { createImageFileReader } from '@maka/runtime/image-file-reader';
+import { createImageFileReader, ImageFileReadError } from '@maka/runtime/image-file-reader';
 import { FilesystemWorkerClientError } from '@maka/runtime/filesystem-worker';
 import { openInteractiveArtifactStoreForWrite } from '@maka/storage/artifact-stores';
 import { resolveStorageRoot, tryAcquireInteractiveRootOwner } from '@maka/storage/root-authority';
@@ -228,6 +229,137 @@ test('automatically saves a local delivery without any UI request; deletion and
     await f.close();
   }
 });
+test('encoded local Markdown images are archived under the original source and replay after deletion', async () => {
+  const reader = createImageFileReader();
+  const f = await fixture(undefined, (_session, path, abortSignal) =>
+    reader({ path, cwd: f.root, abortSignal }),
+  );
+  try {
+    const directory = join(f.root, 'My Project');
+    await mkdir(directory);
+    for (const name of ['screen shot.png', '截图.png', 'literal%20name.png']) {
+      const path = join(directory, name);
+      const source = `${f.root}/My%20Project/${encodeURIComponent(name)}`;
+      await writeFile(path, PNG);
+      observe(f.service, source);
+      await f.service.waitForIdle();
+      await rm(path);
+      const result = await f.service.resolve({ ...REQUEST, source });
+      assert.equal(result.status, 'ready', source);
+      if (result.status !== 'ready') continue;
+      const bytes = await f.authority.store.readBinaryInSession(
+        REQUEST.sessionId,
+        result.artifactId,
+      );
+      assert.equal(bytes.ok, true);
+      if (bytes.ok) assert.equal(bytes.base64, PNG.toString('base64'));
+    }
+    assert.deepEqual(f.errors, []);
+  } finally {
+    await f.close();
+  }
+});
+
+test('literal percent filenames retain precedence and file URLs are decoded only once', async () => {
+  const paths: string[] = [];
+  const reader = createImageFileReader();
+  const f = await fixture(undefined, (_session, path, abortSignal) => {
+    paths.push(path);
+    return reader({ path, cwd: f.root, abortSignal });
+  });
+  try {
+    for (const name of ['literal%20name.png', '100%.png', 'invalid%E4.png']) {
+      const path = join(f.root, name);
+      await writeFile(path, PNG);
+      if (name.includes('%20')) await writeFile(path.replace('%20', ' '), 'wrong source');
+      for (const source of [path, pathToFileURL(path).href]) {
+        paths.length = 0;
+        observe(f.service, source);
+        await f.service.waitForIdle();
+        assert.equal((await f.service.resolve({ ...REQUEST, source })).status, 'ready', source);
+        assert.deepEqual(paths, [path]);
+      }
+    }
+    assert.deepEqual(f.errors, []);
+  } finally {
+    await f.close();
+  }
+});
+
+test('encoded local fallback preserves filesystem denial and validation failures', async () => {
+  for (const reason of ['not_allowed', 'too_large', 'unsupported_mime', 'read_failed'] as const) {
+    const paths: string[] = [];
+    const f = await fixture(undefined, async (_session, path) => {
+      paths.push(path);
+      throw new ImageFileReadError(reason);
+    });
+    try {
+      const source = '/tmp/My%20Project/image.png';
+      observe(f.service, source);
+      await f.service.waitForIdle();
+      assert.deepEqual(await f.service.resolve({ ...REQUEST, source }), {
+        status: 'failed',
+        reason,
+      });
+      assert.deepEqual(paths, [source]);
+      assert.deepEqual(f.errors, []);
+    } finally {
+      await f.close();
+    }
+  }
+});
+
+test('decoded local images still pass through the Read workspace boundary', async () => {
+  const reader = createImageFileReader();
+  const paths: string[] = [];
+  const f = await fixture(undefined, (_session, path, abortSignal) => {
+    paths.push(path);
+    return reader({ path, cwd: join(f.root, 'workspace'), abortSignal });
+  });
+  try {
+    await mkdir(join(f.root, 'workspace'));
+    await writeFile(join(f.root, 'private image.png'), PNG);
+    const source = '%2e%2e/private%20image.png';
+    observe(f.service, source);
+    await f.service.waitForIdle();
+    assert.deepEqual(await f.service.resolve({ ...REQUEST, source }), {
+      status: 'failed',
+      reason: 'not_allowed',
+    });
+    assert.deepEqual(paths, [source, '../private image.png']);
+    assert.deepEqual(f.errors, []);
+  } finally {
+    await f.close();
+  }
+});
+
+test('missing encoded sources never double-decode file URLs or retry invalid escapes', async () => {
+  for (const source of [
+    'file:///tmp/missing%2520image.png',
+    '/tmp/missing%.png',
+    '/tmp/missing%E4.png',
+    '/tmp/missing%00.png',
+  ]) {
+    const paths: string[] = [];
+    const f = await fixture(undefined, async (_session, path) => {
+      paths.push(path);
+      throw new ImageFileReadError('not_found');
+    });
+    try {
+      observe(f.service, source);
+      await f.service.waitForIdle();
+      assert.deepEqual(await f.service.resolve({ ...REQUEST, source }), {
+        status: 'failed',
+        reason: 'not_found',
+      });
+      assert.equal(paths.length, 1, source);
+      assert.deepEqual(f.errors, []);
+    } finally {
+      await f.close();
+    }
+  }
+});
+
 test('remote delivery is downloaded once, remains replayable after the origin server disappears, and sends no credentials/referrer', async () => {
   const f = await fixture();
   let requests = 0;
diff --git a/packages/runtime-host/src/server/chat-image-delivery.ts b/packages/runtime-host/src/server/chat-image-delivery.ts
index 9c6b88dd3a..3780c437b4 100644
--- a/packages/runtime-host/src/server/chat-image-delivery.ts
+++ b/packages/runtime-host/src/server/chat-image-delivery.ts
@@ -38,6 +38,7 @@ import { readyChatImageArtifact } from './chat-image-artifact.js';
 import { abortable } from '../client/wait-for-ready.js';
 import {
   downloadChatImage,
+  decodedLocalImagePath,
   ImageSourceError,
   localImagePath,
   type ChatImageBytes,
@@ -257,9 +258,25 @@ export class ChatImageDeliveryService {
     let image: ChatImageBytes;
     try {
       const path = localImagePath(source);
-      if (path !== undefined)
-        image = await abortable(() => this.ports.readLocalImage(sessionId, path, signal), signal);
-      else {
+      if (path !== undefined) {
+        try {
+          image = await abortable(() => this.ports.readLocalImage(sessionId, path, signal), signal);
+        } catch (error) {
+          // Keep literal percent filenames authoritative. Only a missing path
+          // gets one decoding attempt, through the same Read boundary and budget.
+          const decoded = decodedLocalImagePath(source);
+          if (
+            signal.aborted ||
+            failureReason(error, source) !== 'not_found' ||
+            decoded === undefined
+          )
+            throw error;
+          image = await abortable(
+            () => this.ports.readLocalImage(sessionId, decoded, signal),
+            signal,
+          );
+        }
+      } else {
         try {
           image = await (this.ports.download ?? downloadChatImage)(source, signal);
         } catch (error) {
diff --git a/packages/runtime-host/src/server/chat-image-source.ts b/packages/runtime-host/src/server/chat-image-source.ts
index 97d30b319d..6ba5318944 100644
--- a/packages/runtime-host/src/server/chat-image-source.ts
+++ b/packages/runtime-host/src/server/chat-image-source.ts
@@ -28,7 +28,7 @@ import {
   imageFileFailureReason,
   validateImageBytes,
 } from '@maka/runtime/image-file';
-import type { ImageDeliveryFailure } from '@maka/core/image-delivery';
+import { isImageDeliverySource, type ImageDeliveryFailure } from '@maka/core/image-delivery';
 export class ImageSourceError extends Error {
   constructor(readonly reason: ImageDeliveryFailure) {
     super(reason);
@@ -59,6 +59,19 @@ export function localImagePath(source: string): string | undefined {
     throw new ImageSourceError('not_allowed');
   return source;
 }
+
+/** A missing literal path may be a URL-encoded Markdown destination. File URLs
+ * already went through fileURLToPath; never decode them a second time. */
+export function decodedLocalImagePath(source: string): string | undefined {
+  if (source.startsWith('file:') || /^https?:/i.test(source)) return undefined;
+  try {
+    const decoded = decodeURIComponent(source);
+    return decoded !== source && isImageDeliverySource(decoded) ? decoded : undefined;
+  } catch {
+    // A literal percent sign or incomplete escape is a valid filesystem name.
+    return undefined;
+  }
+}
 /** Pin DNS at connection time and check each redirect; never send cookies, auth or referer. */
 export async function downloadChatImage(
   source: string,

From 3ab63f041a5baa522fc9f385fafb596cc1b75ff6 Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Tue, 6 Oct 2026 19:59:42 +0800
Subject: [PATCH 10/35] fix(chat): preserve inline image badge dimensions

Keep small images at their intrinsic size across remote previews and saved attachment replay. Preserve large preview frames and accessible zoom controls, and cover badge layout in browser regression tests.

Generated-by: Codex (GPT-6)
---
 .../scripts/markdown-images.browser.test.mjs  | 55 +++++++++++++++++--
 packages/ui/src/markdown-image.tsx            | 19 +++++--
 packages/ui/src/styles.css                    | 19 ++++++-
 3 files changed, 80 insertions(+), 13 deletions(-)

diff --git a/packages/ui/scripts/markdown-images.browser.test.mjs b/packages/ui/scripts/markdown-images.browser.test.mjs
index 3f911d05e8..f0285bbb05 100644
--- a/packages/ui/scripts/markdown-images.browser.test.mjs
+++ b/packages/ui/scripts/markdown-images.browser.test.mjs
@@ -30,6 +30,7 @@ import { chromium } from '@playwright/test';
 
 const root = fileURLToPath(new URL('../../../', import.meta.url));
 const png = Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8DwHwAFBQIAX8jx0gAAAABJRU5ErkJggg==', 'base64');
+const badge = Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAFAAAAAUCAYAAAAa2LrXAAAATklEQVR4nO3OsQ0AIAzAsJ7O5/QIhsgSg3fPnLnfgzygywO6PKDLA7o8oMsDujygywO6PKDLA7o8oMsDujygywO6PKDLA7o8oMsDujyAW5KWWkgoVkkSAAAAAElFTkSuQmCC', 'base64');
 let appServer, imageServer, browser, appUrl, imageUrl;
 let requests = [], failedOnce = false;
 let releaseImage;
@@ -42,12 +43,15 @@ before(async () => {
   imageServer = createServer((req, res) => {
     requests.push({ path: req.url, referer: req.headers.referer });
     if (req.url === '/delayed.png') {
-      void delayedImage.then(() => { res.setHeader('Content-Type', 'image/png'); res.end(png); });
+      void delayedImage.then(() => { res.setHeader('Content-Type', 'image/png'); res.end(screenshot); });
       return;
     }
     if (req.url === '/screenshot.png') {
       res.setHeader('Content-Type', 'image/png'); res.end(screenshot); return;
     }
+    if (req.url === '/badge.png') {
+      res.setHeader('Content-Type', 'image/png'); res.end(badge); return;
+    }
     if (req.url === '/retry.png' && !failedOnce) {
       failedOnce = true;
       res.writeHead(404).end();
@@ -59,6 +63,9 @@ before(async () => {
   await new Promise(resolve => imageServer.listen(0, '127.0.0.1', resolve));
   imageUrl = `http://127.0.0.1:${imageServer.address().port}`;
   const destinations = {
+    'badge-remote': `Build ![Badge](${imageUrl}/badge.png) passing.`,
+    'badge-saved': `Build ![Badge](${imageUrl}/badge.png) passing.`,
+    'badge-saving': `Build ![Badge](${imageUrl}/badge.png) passing.`,
     'angle-saved': '![Screenshot](</tmp/my image.png>)',
     'title-saved': `![Screenshot](${imageUrl}/image.png "Screenshot title")`,
     'escaped-saved': String.raw`![Screenshot](/tmp/a\(1\).png)`,
@@ -100,16 +107,16 @@ before(async () => {
       const readBytes=async()=>{
         if(mode==='geometry-saved') await fetch('/release-attachment');
         reads++; window.imageReads=reads; return (mode==='attachment' || mode==='read-retry-saved') && reads===1 ? {ok:false,reason:'read_failed'} :
-          {ok:true,base64:mode==='corrupt-saved' && !window.deliveryRetries ? 'iVBORw0KGgo=' : '${png.toString('base64')}',mimeType:'image/png'};
+          {ok:true,base64:mode.startsWith('badge-') ? '${badge.toString('base64')}' : mode==='geometry-saved' ? '${screenshot.toString('base64')}' : mode==='corrupt-saved' && !window.deliveryRetries ? 'iVBORw0KGgo=' : '${png.toString('base64')}',mimeType:'image/png'};
       };
-      const resolveDelivery=mode.endsWith('saved') || mode==='saving' || race ? async(_session,request)=>{
+      const resolveDelivery=mode.endsWith('saved') || mode.endsWith('saving') || race ? async(_session,request)=>{
         window.deliveryQueries++;
         window.deliverySource=request.source;
         if(canonicalSources[mode] && !canonicalSources[mode].includes(request.source)) return {status:'unavailable'};
         if(request.retry) window.deliveryRetries++;
         if(race) return window.deliveryReady ? {status:'ready',artifactId:'saved-image'} : {status:'unavailable'};
         await new Promise(resolve=>setTimeout(resolve,100));
-        return mode==='saving' && window.deliveryQueries===1 ? {status:'pending'} : {status:'ready',artifactId:'saved-image'};
+        return mode.endsWith('saving') && window.deliveryQueries===1 ? {status:'pending'} : {status:'ready',artifactId:'saved-image'};
       } : undefined;
       const render=(streaming=race)=>root.render(
         React.createElement(Theme,{theme:makaTheme,mode:'light'},
@@ -234,7 +241,8 @@ for (const scenario of ['remote-saved', 'local-saved']) {
       assert.equal(await page.evaluate(() => window.imageReads), 1);
       assert.equal(await page.locator('img').count(), 1);
       assert.match(await page.locator('img').getAttribute('src'), /^data:image\/png;base64,/);
-      await page.getByRole('button', { name: 'Enlarge image: Screenshot', exact: true }).click();
+      await page.getByRole('button', { name: 'Enlarge image: Screenshot', exact: true }).focus();
+      await page.keyboard.press('Enter');
       await page.waitForFunction(() => document.images.length > 1);
     } finally { await page.close(); }
   });
@@ -310,7 +318,7 @@ for (const scenario of ['geometry-remote', 'geometry-saved']) {
       await page.getByText('Loading image…', { exact: true }).waitFor();
       const before = await page.getByText('Following paragraph', { exact: true }).boundingBox();
       if (scenario === 'geometry-remote') releaseImage(); else releaseAttachment();
-      await loaded(page);
+      await page.waitForFunction(() => [...document.images].some(image => image.naturalWidth > 1));
       await page.getByText('Loading image…', { exact: true }).waitFor({ state: 'hidden' });
       const after = await page.getByText('Following paragraph', { exact: true }).boundingBox();
       assert.equal(after.y, before.y);
@@ -348,3 +356,38 @@ test('image frames fit narrow viewports without distorting screenshots or limiti
     assert.equal(await page.getByRole('dialog').locator('img').getAttribute('src'), await page.locator('.maka-markdown-image-preview > img').getAttribute('src'));
   } finally { await page.close(); }
 });
+
+for (const scenario of ['badge-remote', 'badge-saved', 'badge-saving']) {
+  test(`${scenario}: a badge keeps its intrinsic size and surrounding text on one line`, async () => {
+    requests = [];
+    const page = await pageFor(scenario);
+    try {
+      await page.waitForFunction(() => [...document.images].some(image => image.naturalWidth === 80));
+      if (scenario === 'badge-saving') {
+        await page.waitForFunction(() => [...document.images].some(image => image.src.startsWith('data:') && image.naturalWidth === 80));
+      }
+      const geometry = await page.locator('.maka-markdown-image-resource').evaluate(element => {
+        const box = element.getBoundingClientRect();
+        const paragraph = element.closest('[role="paragraph"]');
+        const textBoxes = [...paragraph.childNodes].filter(node => node.nodeType === Node.TEXT_NODE && node.textContent.trim()).map(node => {
+          const range = document.createRange(); range.selectNodeContents(node);
+          return range.getBoundingClientRect().y;
+        });
+        return { width: box.width, height: box.height, textBoxes };
+      });
+      assert.equal(geometry.width, 80);
+      assert.equal(geometry.height, 20);
+      assert.equal(geometry.textBoxes.length, 2);
+      assert.equal(geometry.textBoxes[0], geometry.textBoxes[1]);
+      if (scenario === 'badge-saved') assert.deepEqual(requests, []);
+      if (scenario === 'badge-remote') {
+        await page.locator('.maka-markdown-image-preview').hover();
+        await page.getByRole('button', { name: 'Enlarge image: Badge', exact: true }).click();
+      } else {
+        await page.getByRole('button', { name: 'Enlarge image: Badge', exact: true }).focus();
+        await page.keyboard.press('Enter');
+      }
+      await page.getByRole('dialog').waitFor();
+    } finally { await page.close(); }
+  });
+}
diff --git a/packages/ui/src/markdown-image.tsx b/packages/ui/src/markdown-image.tsx
index b5e93d9eb4..06239351df 100644
--- a/packages/ui/src/markdown-image.tsx
+++ b/packages/ui/src/markdown-image.tsx
@@ -55,6 +55,8 @@ function ImageResource(props: { src: string; alt: string }) {
   const artifactId = explicit?.artifactId ?? (delivery.status === 'ready' ? delivery.artifactId : undefined);
   const image = useAttachmentImage(visible && artifactId ? { artifactId } : undefined);
   const [failedSource, setFailedSource] = useState<string>();
+  // Keep measured badge geometry across URL-to-attachment switches and retries.
+  const [compactSize, setCompactSize] = useState<{ width: number; height: number }>();
   const [attempt, setAttempt] = useState(0);
   const remote = isWebImage(props.src);
   const source = artifactId ? image.src : visible && remote && (!delivery.available || delivery.checked) ? props.src : undefined;
@@ -76,28 +78,33 @@ function ImageResource(props: { src: string; alt: string }) {
     : explicit && image.status === 'unavailable' ? copy.imageUnavailable
     : delivery.status === 'failed' ? copy.imageArchiveFailure(delivery.reason)
     : delivery.status === 'pending' || artifactId ? copy.imageLoading : copy.imageUnsupported;
-  const hasFrame = !visible || !!source || !!artifactId || delivery.status === 'pending';
-  return <span ref={anchor} className={`maka-markdown-image-resource${hasFrame ? ' maka-markdown-image-frame' : ''}`} data-maka-image-state={message ? failed ? 'failed' : 'loading' : 'ready'}>
+  const hasFrame = (!visible || !!source || !!artifactId || delivery.status === 'pending') && !(compactSize && failed);
+  return <span ref={anchor} className={`maka-markdown-image-resource${hasFrame ? compactSize ? ' maka-markdown-image-compact' : ' maka-markdown-image-frame' : ''}`}
+    style={hasFrame && compactSize ? { minWidth: compactSize.width, minHeight: compactSize.height } : undefined}
+    data-maka-image-state={message ? failed ? 'failed' : 'loading' : 'ready'}>
     {message ? <span className="maka-markdown-image-placeholder">
       {props.alt && <span className="maka-markdown-image-caption">{props.alt}</span>}
       <span role="status">{hasFrame && !failed && delivery.status !== 'failed' && <Spinner size="sm" shade="subtle" aria-hidden="true" />} {message}</span>
       {(failed || delivery.status === 'failed') && sourceActions}
-    </span> : source && <DisplayImage key={`${source}\0${attempt}`} src={source} alt={props.alt} onError={() => setFailedSource(source)} />}
+    </span> : source && <DisplayImage key={`${source}\0${attempt}`} src={source} alt={props.alt} compactSize={compactSize} onError={() => setFailedSource(source)}
+      onLoad={(width, height) => setCompactSize(width <= 320 && height <= 64 ? { width, height } : undefined)} />}
     {!explicit && delivery.status === 'pending' && remote && source && <span className="maka-markdown-image-saving" role="status">{copy.imageSaving}</span>}
     {!explicit && delivery.status === 'failed' && remote && source && !failed && <span className="maka-markdown-image-saving" role="status">
       {copy.imageArchiveFailure(delivery.reason)} {sourceActions}
     </span>}
   </span>;
 }
-function DisplayImage(props: { src: string; alt: string; onError(): void }) {
+function DisplayImage(props: { src: string; alt: string; compactSize?: { width: number; height: number }; onError(): void; onLoad(width: number, height: number): void }) {
   const copy = getSharedUiCopy(useUiLocale()).markdown;
   const [loaded, setLoaded] = useState(false);
   const lightbox = useLightbox({ media: { src: props.src, alt: props.alt }, hasZoom: true });
   return <>
-    <span className="maka-markdown-image-preview">
+    <span className="maka-markdown-image-preview" style={props.compactSize ? { width: props.compactSize.width, height: props.compactSize.height } : undefined}>
       {!loaded && <span className="maka-markdown-image-loading" role="status"><Spinner size="sm" shade="subtle" aria-hidden="true" /> {copy.imageLoading}</span>}
       <img src={props.src} alt={props.alt} loading="lazy" decoding="async" referrerPolicy="no-referrer"
-          className="maka-markdown-attachment-image" onLoad={() => setLoaded(true)} onError={props.onError} />
+          className="maka-markdown-attachment-image" onLoad={event => {
+            setLoaded(true); props.onLoad(event.currentTarget.naturalWidth, event.currentTarget.naturalHeight);
+          }} onError={props.onError} />
       {loaded && <span className="maka-markdown-image-expand">
         <IconButton icon={<Maximize2 size={16} />} size="sm" label={copy.imageExpand(props.alt)} onClick={() => lightbox.open()} />
       </span>}
diff --git a/packages/ui/src/styles.css b/packages/ui/src/styles.css
index a31cf320e4..1df381a388 100644
--- a/packages/ui/src/styles.css
+++ b/packages/ui/src/styles.css
@@ -651,7 +651,9 @@
   width: 640px;
   aspect-ratio: 4 / 3;
 }
-.maka-markdown-image-frame > .maka-markdown-image-placeholder {
+.maka-markdown-image-compact { display: inline-flex; align-items: center; vertical-align: middle; }
+.maka-markdown-image-frame > .maka-markdown-image-placeholder,
+.maka-markdown-image-compact > .maka-markdown-image-placeholder {
   position: absolute;
   inset: 0;
   align-items: center;
@@ -665,11 +667,22 @@
   align-items: center;
   justify-content: center;
 }
+.maka-markdown-image-compact > .maka-markdown-image-preview { position: relative; flex-shrink: 0; }
 .maka-markdown-image-expand {
   position: absolute;
   inset-block-end: var(--space-2);
   inset-inline-end: var(--space-2);
 }
+/* Badge controls remain keyboard reachable without covering the badge at rest. */
+.maka-markdown-image-compact .maka-markdown-image-expand {
+  inset: auto 0 0 auto;
+  opacity: 0;
+  pointer-events: none;
+}
+.maka-markdown-image-compact:is(:hover, :focus-within) .maka-markdown-image-expand {
+  opacity: 1;
+  pointer-events: auto;
+}
 .maka-markdown-image-preview img { margin: 0; max-height: 100%; max-width: 100%; object-fit: contain; }
 .maka-markdown-image-loading {
   position: absolute;
@@ -692,6 +705,10 @@
   color: var(--muted-foreground);
   font-size: var(--maka-font-size-sm);
 }
+.maka-markdown-image-compact > .maka-markdown-image-saving {
+  position: static;
+  max-width: none;
+}
 
 /* Markdown code renderers are custom components so Mermaid can be loaded only
    for settled Mermaid fences. Astryx skips its own spacing wrapper when

From f705794e65bf7141f1834b4006fd4622d97e0e79 Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Tue, 6 Oct 2026 20:20:50 +0800
Subject: [PATCH 11/35] fix(chat): stabilize image layout and resolve encoded
 workspace paths

Reserve image geometry from Markdown placement before loading, size previews to the conversation column, and retry encoded paths through the same Read boundary. Cover delayed badge loading, responsive chat layouts, and workspace boundary enforcement.

Generated-by: Codex (GPT-6)
---
 .../src/__tests__/chat-image-delivery.test.ts |  55 ++++++++-
 .../src/server/chat-image-delivery.ts         |   7 +-
 .../scripts/markdown-images.browser.test.mjs  | 110 +++++++++++++++++-
 packages/ui/src/markdown-body.tsx             |   3 +-
 packages/ui/src/markdown-image.tsx            |  90 ++++++++++----
 packages/ui/src/styles.css                    |  34 ++++--
 6 files changed, 252 insertions(+), 47 deletions(-)

diff --git a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
index ae04f90635..bff2fff7bb 100644
--- a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
+++ b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
@@ -260,6 +260,57 @@ test('encoded local Markdown images are archived under the original source and r
   }
 });
 
+test('encoded project roots are retried through the same workspace boundary', async () => {
+  const reader = createImageFileReader();
+  const paths: string[] = [];
+  const f = await fixture(undefined, (_session, path, abortSignal) => {
+    paths.push(path);
+    return reader({ path, cwd: join(f.root, 'My Project 中文'), abortSignal });
+  });
+  try {
+    const directory = join(f.root, 'My Project 中文');
+    await mkdir(directory);
+    const path = join(directory, 'image.png');
+    await writeFile(path, PNG);
+    const source = `${f.root}/${encodeURIComponent('My Project 中文')}/image.png`;
+    observe(f.service, source);
+    await f.service.waitForIdle();
+    assert.equal((await f.service.resolve({ ...REQUEST, source })).status, 'ready');
+    assert.deepEqual(paths, [source, path]);
+    await rm(path);
+    assert.equal((await f.service.resolve({ ...REQUEST, source })).status, 'ready');
+    assert.equal(paths.length, 2);
+    assert.deepEqual(f.errors, []);
+  } finally {
+    await f.close();
+  }
+});
+
+test('decoding a denied source cannot grant access outside the Read boundary', async () => {
+  const reader = createImageFileReader();
+  const paths: string[] = [];
+  const f = await fixture(undefined, (_session, path, abortSignal) => {
+    paths.push(path);
+    return reader({ path, cwd: join(f.root, 'workspace'), abortSignal });
+  });
+  try {
+    await mkdir(join(f.root, 'workspace'));
+    const path = join(f.root, 'private image.png');
+    await writeFile(path, PNG);
+    const source = `${f.root}/private%20image.png`;
+    observe(f.service, source);
+    await f.service.waitForIdle();
+    assert.deepEqual(await f.service.resolve({ ...REQUEST, source }), {
+      status: 'failed',
+      reason: 'not_allowed',
+    });
+    assert.deepEqual(paths, [source, path]);
+    assert.deepEqual(f.errors, []);
+  } finally {
+    await f.close();
+  }
+});
+
 test('literal percent filenames retain precedence and file URLs are decoded only once', async () => {
   const paths: string[] = [];
   const reader = createImageFileReader();
@@ -286,8 +337,8 @@ test('literal percent filenames retain precedence and file URLs are decoded only
   }
 });
 
-test('encoded local fallback preserves filesystem denial and validation failures', async () => {
-  for (const reason of ['not_allowed', 'too_large', 'unsupported_mime', 'read_failed'] as const) {
+test('encoded local fallback preserves validation and non-path read failures', async () => {
+  for (const reason of ['too_large', 'unsupported_mime', 'read_failed'] as const) {
     const paths: string[] = [];
     const f = await fixture(undefined, async (_session, path) => {
       paths.push(path);
diff --git a/packages/runtime-host/src/server/chat-image-delivery.ts b/packages/runtime-host/src/server/chat-image-delivery.ts
index 3780c437b4..e9eb690098 100644
--- a/packages/runtime-host/src/server/chat-image-delivery.ts
+++ b/packages/runtime-host/src/server/chat-image-delivery.ts
@@ -262,12 +262,13 @@ export class ChatImageDeliveryService {
         try {
           image = await abortable(() => this.ports.readLocalImage(sessionId, path, signal), signal);
         } catch (error) {
-          // Keep literal percent filenames authoritative. Only a missing path
-          // gets one decoding attempt, through the same Read boundary and budget.
+          // Keep readable literal percent filenames authoritative. An encoded cwd
+          // can look outside the workspace before decoding, so both missing and
+          // denied candidates get one retry through the same Read boundary/budget.
           const decoded = decodedLocalImagePath(source);
           if (
             signal.aborted ||
-            failureReason(error, source) !== 'not_found' ||
+            !['not_found', 'not_allowed'].includes(failureReason(error, source)) ||
             decoded === undefined
           )
             throw error;
diff --git a/packages/ui/scripts/markdown-images.browser.test.mjs b/packages/ui/scripts/markdown-images.browser.test.mjs
index f0285bbb05..e5cc1d1382 100644
--- a/packages/ui/scripts/markdown-images.browser.test.mjs
+++ b/packages/ui/scripts/markdown-images.browser.test.mjs
@@ -23,7 +23,8 @@
 import assert from 'node:assert/strict';
 import { before, after, test } from 'node:test';
 import { createServer } from 'node:http';
-import { readFile } from 'node:fs/promises';
+import { readFile, mkdir } from 'node:fs/promises';
+import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { build } from 'esbuild';
 import { chromium } from '@playwright/test';
@@ -66,6 +67,11 @@ before(async () => {
     'badge-remote': `Build ![Badge](${imageUrl}/badge.png) passing.`,
     'badge-saved': `Build ![Badge](${imageUrl}/badge.png) passing.`,
     'badge-saving': `Build ![Badge](${imageUrl}/badge.png) passing.`,
+    'badge-list': `- Build ![Badge](${imageUrl}/badge.png) passing.`,
+    'badge-table': `| Build | Result |\n| --- | --- |\n| ![Badge](${imageUrl}/badge.png) | passing |`,
+    'badge-strip': `![Badge](${imageUrl}/badge.png) ![Badge](${imageUrl}/badge.png)`,
+    'layout-main': `## Image delivery\n\nBuild ![Badge](${imageUrl}/badge.png) passing.\n\n![Screenshot](${imageUrl}/screenshot.png)\n\nFollowing paragraph stays in place.`,
+    'layout-side': `## Image delivery\n\nBuild ![Badge](${imageUrl}/badge.png) passing.\n\n![Screenshot](${imageUrl}/screenshot.png)\n\nFollowing paragraph stays in place.`,
     'angle-saved': '![Screenshot](</tmp/my image.png>)',
     'title-saved': `![Screenshot](${imageUrl}/image.png "Screenshot title")`,
     'escaped-saved': String.raw`![Screenshot](/tmp/a\(1\).png)`,
@@ -88,7 +94,7 @@ before(async () => {
     stdin: { contents: `
       import React from 'react';
       import {createRoot} from 'react-dom/client';
-      import {Theme} from '@astryxdesign/core';
+      import {Theme, ChatMessageList, ChatMessage, ChatMessageBubble} from '@astryxdesign/core';
       import {makaTheme} from './apps/desktop/src/renderer/astryx-theme/maka.js';
       import {MarkdownBody} from './packages/ui/dist/markdown-body.js';
       import {LocaleProvider} from './packages/ui/dist/locale-context.js';
@@ -105,6 +111,7 @@ before(async () => {
         '![Screenshot](${imageUrl}/'+(mode==='retry' ? 'retry.png' : 'image.png')+')');
       const root=createRoot(document.getElementById('root'));
       const readBytes=async()=>{
+        if(mode.startsWith('badge-')) await fetch('/badge-attachment');
         if(mode==='geometry-saved') await fetch('/release-attachment');
         reads++; window.imageReads=reads; return (mode==='attachment' || mode==='read-retry-saved') && reads===1 ? {ok:false,reason:'read_failed'} :
           {ok:true,base64:mode.startsWith('badge-') ? '${badge.toString('base64')}' : mode==='geometry-saved' ? '${screenshot.toString('base64')}' : mode==='corrupt-saved' && !window.deliveryRetries ? 'iVBORw0KGgo=' : '${png.toString('base64')}',mimeType:'image/png'};
@@ -118,13 +125,18 @@ before(async () => {
         await new Promise(resolve=>setTimeout(resolve,100));
         return mode.endsWith('saving') && window.deliveryQueries===1 ? {status:'pending'} : {status:'ready',artifactId:'saved-image'};
       } : undefined;
+      const markdown=(streaming)=>React.createElement(MarkdownBody,{text,streaming,settledText:race ? text : undefined,density:'compact',imageIdentity:{turnId:'turn',messageId:'message'}});
+      const surface=(streaming)=>mode.startsWith('layout-') ? React.createElement('section',{className:mode==='layout-side' ? 'maka-quote-companion' : '',style:{width:mode==='layout-side' ? '360px' : '100%',maxWidth:'100%'}},
+        React.createElement(ChatMessageList,{className:'maka-chat-message-list maka-chatContent',align:'top'},
+          React.createElement('div',{className:'maka-transcript-turn maka-turn',style:{width:'100%',maxWidth:'var(--maka-reading-measure)',marginInline:'auto'}},
+            React.createElement(ChatMessage,{sender:'assistant'},React.createElement(ChatMessageBubble,{variant:'ghost',width:'100%',className:'maka-chat-message-bubble maka-chat-message-bubble-assistant'},markdown(streaming)))))) : markdown(streaming);
       const render=(streaming=race)=>root.render(
         React.createElement(Theme,{theme:makaTheme,mode:'light'},
           React.createElement(LocaleProvider,{locale:'en'},
             React.createElement(SessionAttachmentProvider,{sessionId:'session',readBytes},
               React.createElement(ImageDeliveryProvider,{sessionId:'session',resolve:resolveDelivery},
               React.createElement('div',{style:mode==='offscreen' ? {paddingTop:'2500px'} : {}},
-                React.createElement(MarkdownBody,{text,streaming,settledText:race ? text : undefined,imageIdentity:{turnId:'turn',messageId:'message'}})))))));
+                surface(streaming)))))));
       window.finishStream=()=>render(false);
       render();
     `, resolveDir: root, loader: 'js' },
@@ -137,6 +149,7 @@ before(async () => {
   const index = await readFile(new URL('../../../apps/desktop/src/renderer/index.html', import.meta.url), 'utf8');
   const csp = index.match(/http-equiv="Content-Security-Policy"\s+content="([^"]+)"/)[1];
   appServer = createServer((req, res) => {
+    if (req.url === '/badge-attachment') { res.end(); return; }
     if (req.url === '/release-attachment') { void delayedAttachment.then(() => res.end()); return; }
     if (req.url === '/app.js') { res.setHeader('Content-Type', 'text/javascript'); res.end(js); }
     else if (req.url === '/app.css') { res.setHeader('Content-Type', 'text/css'); res.end(css); }
@@ -159,7 +172,7 @@ after(async () => {
 async function pageFor(scenario) {
   const page = await browser.newPage({ viewport: { width: 720, height: 600 } });
   page.setDefaultTimeout(5000);
-  await page.goto(`${appUrl}/?case=${scenario}`);
+  await page.goto(`${appUrl}/?case=${scenario}`, { waitUntil: 'domcontentloaded' });
   return page;
 }
 
@@ -375,8 +388,11 @@ for (const scenario of ['badge-remote', 'badge-saved', 'badge-saving']) {
         });
         return { width: box.width, height: box.height, textBoxes };
       });
-      assert.equal(geometry.width, 80);
-      assert.equal(geometry.height, 20);
+      assert.ok(geometry.width <= 120);
+      assert.ok(geometry.height <= 32);
+      const pixels = await page.locator('img').boundingBox();
+      assert.equal(pixels.width, 80);
+      assert.equal(pixels.height, 20);
       assert.equal(geometry.textBoxes.length, 2);
       assert.equal(geometry.textBoxes[0], geometry.textBoxes[1]);
       if (scenario === 'badge-saved') assert.deepEqual(requests, []);
@@ -391,3 +407,85 @@ for (const scenario of ['badge-remote', 'badge-saved', 'badge-saving']) {
     } finally { await page.close(); }
   });
 }
+
+for (const scenario of ['badge-saved', 'badge-saving']) {
+  test(`${scenario}: delayed saved bytes never change the inline placeholder geometry`, async () => {
+    const page = await browser.newPage({ viewport: { width: 720, height: 600 } });
+    page.setDefaultTimeout(5000);
+    let release;
+    const gate = new Promise(resolve => { release = resolve; });
+    await page.route('**/badge-attachment', async route => { await gate; await route.continue(); });
+    try {
+      await page.goto(`${appUrl}/?case=${scenario}`, { waitUntil: 'domcontentloaded' });
+      await page.waitForFunction(() => window.imageReads === 0 && !!document.querySelector('.maka-markdown-image-inline'));
+      const before = await page.locator('[role="paragraph"]').boundingBox();
+      const slotBefore = await page.locator('.maka-markdown-image-resource').boundingBox();
+      await page.waitForFunction(() => window.deliveryQueries >= (new URLSearchParams(location.search).get('case') === 'badge-saving' ? 2 : 1));
+      release();
+      await page.waitForFunction(() => [...document.images].some(image => image.src.startsWith('data:') && image.naturalWidth === 80));
+      assert.deepEqual(await page.locator('.maka-markdown-image-resource').boundingBox(), slotBefore);
+      assert.deepEqual(await page.locator('[role="paragraph"]').boundingBox(), before);
+    } finally { release(); await page.close(); }
+  });
+}
+
+for (const scenario of ['badge-list', 'badge-table', 'badge-strip']) {
+  test(`${scenario}: inline Markdown context is known before the image arrives`, async () => {
+    const page = await browser.newPage({ viewport: { width: 360, height: 600 } });
+    page.setDefaultTimeout(5000);
+    let release;
+    const gate = new Promise(resolve => { release = resolve; });
+    await page.route(`${imageUrl}/badge.png`, async route => { await gate; await route.continue(); });
+    try {
+      await page.goto(`${appUrl}/?case=${scenario}`, { waitUntil: 'domcontentloaded' });
+      await page.locator('.maka-markdown-image-inline').first().waitFor();
+      assert.equal(await page.locator('.maka-markdown-image-frame').count(), 0);
+      const before = await page.locator('.maka-markdown-image-resource').first().boundingBox();
+      assert.ok(before.width <= 120 && before.height <= 32);
+      release();
+      await page.waitForFunction(() => [...document.images].every(image => image.naturalWidth === 80));
+      assert.deepEqual(await page.locator('.maka-markdown-image-resource').first().boundingBox(), before);
+    } finally { release(); await page.close(); }
+  });
+}
+
+for (const [scenario, width, height] of [
+  ['layout-main', 1280, 900], ['layout-main', 480, 700],
+  ['layout-side', 720, 700], ['layout-side', 320, 600],
+]) {
+  test(`${scenario} ${width}x${height}: production chat columns preserve image geometry through loading`, async () => {
+    const page = await browser.newPage({ viewport: { width, height } });
+    page.setDefaultTimeout(5000);
+    let release;
+    const gate = new Promise(resolve => { release = resolve; });
+    await page.route(`${imageUrl}/**`, async route => { await gate; await route.continue(); });
+    const measure = () => page.locator('.maka-markdown-image-resource').evaluateAll(elements => elements.map(element => {
+      const r = element.getBoundingClientRect();
+      return { x: r.x, y: r.y, width: r.width, height: r.height };
+    }));
+    try {
+      await page.goto(`${appUrl}/?case=${scenario}`, { waitUntil: 'domcontentloaded' });
+      await page.getByText('Following paragraph stays in place.').waitFor();
+      const before = await measure();
+      const followingBefore = await page.getByText('Following paragraph stays in place.').boundingBox();
+      assert.equal(before.length, 2);
+      assert.ok(before[0].width <= 120 && before[0].height <= 32);
+      assert.ok(before[1].width <= 800 && before[1].height <= Math.min(480, height * 0.6));
+      for (const box of before) assert.ok(box.x >= 0 && box.x + box.width <= width);
+      const evidence = process.env.MAKA_IMAGE_LAYOUT_EVIDENCE_DIR;
+      if (evidence) {
+        await mkdir(evidence, { recursive: true });
+        await page.screenshot({ path: join(evidence, `${scenario}-${width}-loading.png`), fullPage: true });
+      }
+      release();
+      await page.waitForFunction(() => document.images.length === 2 && [...document.images].every(image => image.complete && image.naturalWidth > 0));
+      assert.deepEqual(await measure(), before);
+      assert.deepEqual(await page.getByText('Following paragraph stays in place.').boundingBox(), followingBefore);
+      assert.equal(await page.evaluate(() => document.documentElement.scrollWidth > innerWidth), false);
+      if (evidence) {
+        await page.screenshot({ path: join(evidence, `${scenario}-${width}-ready.png`), fullPage: true });
+        console.log(JSON.stringify({ scenario, viewport: { width, height }, images: before, layoutShift: 0 }));
+      }
+    } finally { release(); await page.close(); }
+  });
+}
diff --git a/packages/ui/src/markdown-body.tsx b/packages/ui/src/markdown-body.tsx
index 47aea1c024..eb1b24a5ef 100644
--- a/packages/ui/src/markdown-body.tsx
+++ b/packages/ui/src/markdown-body.tsx
@@ -29,7 +29,7 @@
  * product-specific trust boundaries around that renderer.
  */
 
-import { MarkdownImage, MarkdownImageSourceProvider } from './markdown-image.js';
+import { MarkdownImage, MarkdownImageSourceProvider, MARKDOWN_IMAGE_PLUGINS } from './markdown-image.js';
 import { ImageMessageScope } from './image-delivery.js';
 import { useCallback, useContext, useRef, type ReactNode } from 'react';
 import {
@@ -198,6 +198,7 @@ export function MarkdownBody(props: {
             // the one combination neither half of the argument asks for.
             density={density}
             components={components}
+            plugins={MARKDOWN_IMAGE_PLUGINS}
             isStreaming={props.streaming}
             settledText={props.settledText}
             transformSource={transformMathSource}
diff --git a/packages/ui/src/markdown-image.tsx b/packages/ui/src/markdown-image.tsx
index 06239351df..bd44cfbb51 100644
--- a/packages/ui/src/markdown-image.tsx
+++ b/packages/ui/src/markdown-image.tsx
@@ -18,8 +18,10 @@
  */
 
 import { createContext, useContext, useEffect, useMemo, useRef, useState, type ReactNode } from 'react';
-import { Button, IconButton, Spinner, useLightbox } from '@astryxdesign/core';
-import { Maximize2 } from './icons.js';
+import { Button, IconButton, Spinner, Tooltip, useLightbox } from '@astryxdesign/core';
+import { createMarkdownPlugin, type MarkdownExtensionNode } from '@astryxdesign/core/Markdown/plugins';
+import type { MarkdownAstNode, MarkdownAstRoot } from '@astryxdesign/core/Markdown';
+import { Maximize2, RotateCw, AlertTriangle } from './icons.js';
 import { Link } from '@astryxdesign/core/Link';
 import { parseAttachmentResourceRef } from '@maka/core/attachments';
 import { useAttachmentImage } from './attachment-image.js';
@@ -29,17 +31,52 @@ import { useUiLocale } from './locale-context.js';
 import { createMarkdownImageSourceResolver } from './markdown-image-source.js';
 
 const ImageSourceContext = createContext<(source: string) => string>((source) => source);
+
+type PlacedImage = MarkdownExtensionNode<'maka-images', 'image', { src: string; alt: string; inline: boolean }>;
+// Placement comes from Markdown structure before bytes arrive. Never change a
+// message's geometry in response to network/decode timing or archive resolution.
+export const MARKDOWN_IMAGE_PLUGINS = [createMarkdownPlugin<'maka-images', PlacedImage>({
+  name: 'maka-images', apiVersion: 1,
+  transform(document, context) {
+    if (!context.source.includes('![')) return document;
+    const rewrite = (node: MarkdownAstNode, inline = false, phrasing = false): MarkdownAstNode => {
+      if (node.type === 'image') return {
+        type: 'extension', plugin: 'maka-images', name: 'image',
+        display: phrasing ? 'inline' : 'block',
+        data: { src: node.url, alt: node.alt, inline },
+      } satisfies PlacedImage;
+      if (!('children' in node)) return node;
+      const childInline = node.type === 'paragraph' ? !isSingleImage(node.children)
+        : node.type === 'heading' || node.type === 'tableCell' ? true : inline;
+      const childPhrasing = ['paragraph', 'heading', 'tableCell', 'link', 'strong', 'emphasis', 'delete'].includes(node.type);
+      return { ...node, children: node.children.map(child => rewrite(child, childInline, childPhrasing)) } as MarkdownAstNode;
+    };
+    return rewrite(document) as MarkdownAstRoot<MarkdownExtensionNode>;
+  },
+  renderers: { image: {
+    render: ({ node }) => <MarkdownImage {...node.data} />,
+    toText: node => node.data.alt,
+  } },
+})];
+
+function isSingleImage(nodes: readonly MarkdownAstNode[]): boolean {
+  const meaningful = nodes.filter(node => node.type !== 'text' || node.value.trim());
+  if (meaningful.length !== 1) return false;
+  const node = meaningful[0]!;
+  return node.type === 'image' || (['link', 'strong', 'emphasis', 'delete'].includes(node.type)
+    && 'children' in node && isSingleImage(node.children));
+}
 export function MarkdownImageSourceProvider(props: { text: string; children: ReactNode }) {
   const resolve = useMemo(() => createMarkdownImageSourceResolver(props.text), [props.text]);
   return <ImageSourceContext.Provider value={resolve}>{props.children}</ImageSourceContext.Provider>;
 }
 
 /** Presentation only: Host resolves local addresses and archives; UI receives artifact identities. */
-export function MarkdownImage(props: { src: string; alt: string }) {
+export function MarkdownImage(props: { src: string; alt: string; inline?: boolean }) {
   const source = useContext(ImageSourceContext)(props.src);
-  return <ImageResource key={source} src={source} alt={props.alt} />;
+  return <ImageResource key={source} src={source} alt={props.alt} inline={props.inline} />;
 }
-function ImageResource(props: { src: string; alt: string }) {
+function ImageResource(props: { src: string; alt: string; inline?: boolean }) {
   const copy = getSharedUiCopy(useUiLocale()).markdown;
   const anchor = useRef<HTMLSpanElement>(null);
   const [visible, setVisible] = useState(typeof IntersectionObserver === 'undefined');
@@ -55,8 +92,6 @@ function ImageResource(props: { src: string; alt: string }) {
   const artifactId = explicit?.artifactId ?? (delivery.status === 'ready' ? delivery.artifactId : undefined);
   const image = useAttachmentImage(visible && artifactId ? { artifactId } : undefined);
   const [failedSource, setFailedSource] = useState<string>();
-  // Keep measured badge geometry across URL-to-attachment switches and retries.
-  const [compactSize, setCompactSize] = useState<{ width: number; height: number }>();
   const [attempt, setAttempt] = useState(0);
   const remote = isWebImage(props.src);
   const source = artifactId ? image.src : visible && remote && (!delivery.available || delivery.checked) ? props.src : undefined;
@@ -78,35 +113,44 @@ function ImageResource(props: { src: string; alt: string }) {
     : explicit && image.status === 'unavailable' ? copy.imageUnavailable
     : delivery.status === 'failed' ? copy.imageArchiveFailure(delivery.reason)
     : delivery.status === 'pending' || artifactId ? copy.imageLoading : copy.imageUnsupported;
-  const hasFrame = (!visible || !!source || !!artifactId || delivery.status === 'pending') && !(compactSize && failed);
-  return <span ref={anchor} className={`maka-markdown-image-resource${hasFrame ? compactSize ? ' maka-markdown-image-compact' : ' maka-markdown-image-frame' : ''}`}
-    style={hasFrame && compactSize ? { minWidth: compactSize.width, minHeight: compactSize.height } : undefined}
+  const hasFrame = props.inline || !visible || !!source || !!artifactId || delivery.status === 'pending';
+  return <span ref={anchor} className={`maka-markdown-image-resource${hasFrame ? props.inline ? ' maka-markdown-image-inline' : ' maka-markdown-image-frame' : ''}`}
     data-maka-image-state={message ? failed ? 'failed' : 'loading' : 'ready'}>
-    {message ? <span className="maka-markdown-image-placeholder">
+    {message && props.inline ? <Tooltip content={message}>
+      <span className="maka-markdown-image-placeholder" role="status" aria-label={message}>
+        {failed || delivery.status === 'failed'
+          ? <IconButton icon={<RotateCw size={14} />} size="sm" label={copy.imageRetry} onClick={retry} />
+          : delivery.status === 'unavailable' && visible
+            ? <AlertTriangle size={14} aria-hidden="true" /> : <Spinner size="sm" shade="subtle" aria-hidden="true" />}
+      </span>
+    </Tooltip> : message ? <span className="maka-markdown-image-placeholder">
       {props.alt && <span className="maka-markdown-image-caption">{props.alt}</span>}
       <span role="status">{hasFrame && !failed && delivery.status !== 'failed' && <Spinner size="sm" shade="subtle" aria-hidden="true" />} {message}</span>
       {(failed || delivery.status === 'failed') && sourceActions}
-    </span> : source && <DisplayImage key={`${source}\0${attempt}`} src={source} alt={props.alt} compactSize={compactSize} onError={() => setFailedSource(source)}
-      onLoad={(width, height) => setCompactSize(width <= 320 && height <= 64 ? { width, height } : undefined)} />}
-    {!explicit && delivery.status === 'pending' && remote && source && <span className="maka-markdown-image-saving" role="status">{copy.imageSaving}</span>}
-    {!explicit && delivery.status === 'failed' && remote && source && !failed && <span className="maka-markdown-image-saving" role="status">
+    </span> : source && <DisplayImage key={`${source}\0${attempt}`} src={source} alt={props.alt} onError={() => setFailedSource(source)} />}
+    {!explicit && delivery.status === 'pending' && remote && source && (props.inline ? <Tooltip content={copy.imageSaving}>
+      <span className="maka-markdown-image-saving" role="status" aria-label={copy.imageSaving}><Spinner size="sm" aria-hidden="true" /></span>
+    </Tooltip> : <span className="maka-markdown-image-saving" role="status">{copy.imageSaving}</span>)}
+    {!explicit && delivery.status === 'failed' && remote && source && !failed && (props.inline ? <Tooltip content={copy.imageArchiveFailure(delivery.reason)}>
+      <span className="maka-markdown-image-saving" role="status" aria-label={copy.imageArchiveFailure(delivery.reason)}>
+        <IconButton icon={<AlertTriangle size={14} />} size="sm" label={copy.imageRetry} onClick={retry} />
+      </span>
+    </Tooltip> : <span className="maka-markdown-image-saving" role="status">
       {copy.imageArchiveFailure(delivery.reason)} {sourceActions}
-    </span>}
+    </span>)}
   </span>;
 }
-function DisplayImage(props: { src: string; alt: string; compactSize?: { width: number; height: number }; onError(): void; onLoad(width: number, height: number): void }) {
+function DisplayImage(props: { src: string; alt: string; onError(): void }) {
   const copy = getSharedUiCopy(useUiLocale()).markdown;
   const [loaded, setLoaded] = useState(false);
   const lightbox = useLightbox({ media: { src: props.src, alt: props.alt }, hasZoom: true });
   return <>
-    <span className="maka-markdown-image-preview" style={props.compactSize ? { width: props.compactSize.width, height: props.compactSize.height } : undefined}>
-      {!loaded && <span className="maka-markdown-image-loading" role="status"><Spinner size="sm" shade="subtle" aria-hidden="true" /> {copy.imageLoading}</span>}
+    <span className="maka-markdown-image-preview">
+      {!loaded && <span className="maka-markdown-image-loading" role="status" aria-label={copy.imageLoading}><Spinner size="sm" shade="subtle" aria-hidden="true" /> <span className="maka-markdown-image-loading-label">{copy.imageLoading}</span></span>}
       <img src={props.src} alt={props.alt} loading="lazy" decoding="async" referrerPolicy="no-referrer"
-          className="maka-markdown-attachment-image" onLoad={event => {
-            setLoaded(true); props.onLoad(event.currentTarget.naturalWidth, event.currentTarget.naturalHeight);
-          }} onError={props.onError} />
+          className="maka-markdown-attachment-image" onLoad={() => setLoaded(true)} onError={props.onError} />
       {loaded && <span className="maka-markdown-image-expand">
-        <IconButton icon={<Maximize2 size={16} />} size="sm" label={copy.imageExpand(props.alt)} onClick={() => lightbox.open()} />
+        <IconButton icon={<Maximize2 size={16} />} size="sm" label={copy.imageExpand(props.alt)} onClick={event => { event.preventDefault(); event.stopPropagation(); lightbox.open(); }} />
       </span>}
     </span>
     {lightbox.isOpen && lightbox.element}
diff --git a/packages/ui/src/styles.css b/packages/ui/src/styles.css
index 1df381a388..37e6e68d83 100644
--- a/packages/ui/src/styles.css
+++ b/packages/ui/src/styles.css
@@ -644,16 +644,24 @@
   gap: var(--space-3);
 }
 .maka-markdown-image-resource { display: inline-block; position: relative; max-width: 100%; }
-/* Source resolution and decoding share one responsive frame. Transient status
-   overlays never add a row or move the transcript when they disappear. */
+/* The conversation owns the width (up to the 800px reading measure). A preview
+   fits that column, but cannot consume more than 60% of a short viewport.
+   Markdown placement, not decoded dimensions, fixes the loading/ready box. */
 .maka-markdown-image-frame {
   display: block;
-  width: 640px;
-  aspect-ratio: 4 / 3;
+  width: 100%;
+  aspect-ratio: 16 / 10;
+  max-height: min(480px, 60vh);
+}
+/* Six text ems leave room for a typical badge; one inherited line keeps it in
+   the prose rhythm. Scale down wider images and use the lightbox for detail. */
+.maka-markdown-image-inline {
+  width: 6em;
+  height: 1lh;
+  vertical-align: middle;
 }
-.maka-markdown-image-compact { display: inline-flex; align-items: center; vertical-align: middle; }
 .maka-markdown-image-frame > .maka-markdown-image-placeholder,
-.maka-markdown-image-compact > .maka-markdown-image-placeholder {
+.maka-markdown-image-inline .maka-markdown-image-placeholder {
   position: absolute;
   inset: 0;
   align-items: center;
@@ -667,19 +675,20 @@
   align-items: center;
   justify-content: center;
 }
-.maka-markdown-image-compact > .maka-markdown-image-preview { position: relative; flex-shrink: 0; }
+.maka-markdown-image-inline .maka-markdown-image-placeholder { padding: 0; }
+.maka-markdown-image-inline .maka-markdown-image-loading-label { display: none; }
 .maka-markdown-image-expand {
   position: absolute;
   inset-block-end: var(--space-2);
   inset-inline-end: var(--space-2);
 }
 /* Badge controls remain keyboard reachable without covering the badge at rest. */
-.maka-markdown-image-compact .maka-markdown-image-expand {
+.maka-markdown-image-inline .maka-markdown-image-expand {
   inset: auto 0 0 auto;
   opacity: 0;
   pointer-events: none;
 }
-.maka-markdown-image-compact:is(:hover, :focus-within) .maka-markdown-image-expand {
+.maka-markdown-image-inline:is(:hover, :focus-within) .maka-markdown-image-expand {
   opacity: 1;
   pointer-events: auto;
 }
@@ -705,9 +714,10 @@
   color: var(--muted-foreground);
   font-size: var(--maka-font-size-sm);
 }
-.maka-markdown-image-compact > .maka-markdown-image-saving {
-  position: static;
-  max-width: none;
+.maka-markdown-image-inline .maka-markdown-image-saving {
+  inset: auto auto 0 0;
+  max-width: 100%;
+  padding: 0;
 }
 
 /* Markdown code renderers are custom components so Mermaid can be loaded only

From 84dab3fec26f942fd026f214b282351e903c2770 Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Tue, 6 Oct 2026 20:30:15 +0800
Subject: [PATCH 12/35] test(ui): generate image fixture without committed
 screenshots

Remove PR evidence images and generate a deterministic PNG with matching dimensions for browser coverage.

Generated-by: Codex (GPT-6)
---
 .../scripts/markdown-images.browser.test.mjs  | 28 ++++++++++++++++++-
 1 file changed, 27 insertions(+), 1 deletion(-)

diff --git a/packages/ui/scripts/markdown-images.browser.test.mjs b/packages/ui/scripts/markdown-images.browser.test.mjs
index e5cc1d1382..a7120265a9 100644
--- a/packages/ui/scripts/markdown-images.browser.test.mjs
+++ b/packages/ui/scripts/markdown-images.browser.test.mjs
@@ -26,6 +26,7 @@ import { createServer } from 'node:http';
 import { readFile, mkdir } from 'node:fs/promises';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { crc32, deflateSync } from 'node:zlib';
 import { build } from 'esbuild';
 import { chromium } from '@playwright/test';
 
@@ -39,8 +40,33 @@ let releaseAttachment;
 const delayedImage = new Promise(resolve => { releaseImage = resolve; });
 const delayedAttachment = new Promise(resolve => { releaseAttachment = resolve; });
 
+// Keep the screenshot's original dimensions without committing evidence images.
+function screenshotFixture() {
+  const width = 900, height = 730;
+  const header = Buffer.alloc(13);
+  header.writeUInt32BE(width, 0); header.writeUInt32BE(height, 4);
+  header[8] = 8; header[9] = 2; // 8-bit RGB.
+  const stride = 1 + width * 3;
+  const pixels = Buffer.alloc(stride * height, 220);
+  for (let row = 0; row < height; row++) {
+    pixels.fill(row < height / 2 ? 120 : 220, row * stride, (row + 1) * stride);
+    pixels[row * stride] = 0; // PNG filter: None.
+  }
+  const chunk = (type, data) => {
+    const result = Buffer.alloc(data.length + 12);
+    result.writeUInt32BE(data.length, 0); result.write(type, 4, 'ascii');
+    data.copy(result, 8);
+    result.writeUInt32BE(crc32(result.subarray(4, data.length + 8)), data.length + 8);
+    return result;
+  };
+  return Buffer.concat([
+    Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]),
+    chunk('IHDR', header), chunk('IDAT', deflateSync(pixels)), chunk('IEND', Buffer.alloc(0)),
+  ]);
+}
+
 before(async () => {
-  const screenshot = await readFile(new URL('../../../docs/images/pr/chat-image-delivery/after.png', import.meta.url));
+  const screenshot = screenshotFixture();
   imageServer = createServer((req, res) => {
     requests.push({ path: req.url, referer: req.headers.referer });
     if (req.url === '/delayed.png') {

From 7fe2c9beff4579c14e6a5a951ebf8542ee35bb9c Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Wed, 7 Oct 2026 13:09:57 +0800
Subject: [PATCH 13/35] fix(ui): preserve image destinations through display
 redaction

Keep signed URLs and hashed image paths behind image-only aliases while redacting prose and lazy fallbacks. Exercise the complete Markdown entry in browser regressions, including saved replay, duplicate signatures, streaming and layout.

Generated-by: Codex (GPT-6)
---
 .../licenses/npm/THIRD_PARTY_NOTICES.txt      | 1060 ++++++++++++++++-
 package-lock.json                             |  453 ++++++-
 packages/core/src/image-markdown.ts           |   11 +-
 packages/ui/package.json                      |    1 +
 .../scripts/markdown-images.browser.test.mjs  |   71 +-
 .../ui/src/__tests__/markdown-body.test.ts    |   11 +
 .../markdown-image-redaction.test.ts          |  114 ++
 packages/ui/src/markdown-body.tsx             |   15 +-
 packages/ui/src/markdown-image-redaction.ts   |   83 ++
 packages/ui/src/markdown-image.tsx            |   10 +-
 packages/ui/src/markdown.tsx                  |   14 +-
 11 files changed, 1784 insertions(+), 59 deletions(-)
 create mode 100644 packages/ui/src/__tests__/markdown-image-redaction.test.ts
 create mode 100644 packages/ui/src/markdown-image-redaction.ts

diff --git a/apps/desktop/resources/licenses/npm/THIRD_PARTY_NOTICES.txt b/apps/desktop/resources/licenses/npm/THIRD_PARTY_NOTICES.txt
index dbe751bc9b..d5b17eab68 100644
--- a/apps/desktop/resources/licenses/npm/THIRD_PARTY_NOTICES.txt
+++ b/apps/desktop/resources/licenses/npm/THIRD_PARTY_NOTICES.txt
@@ -5395,6 +5395,36 @@ MIT License
 
 ================================================================================
 
+Package: @types/debug@4.1.13
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/DefinitelyTyped/DefinitelyTyped.git#types/debug
+
+--- LICENSE ---
+MIT License
+
+    Copyright (c) Microsoft Corporation.
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE
+
+================================================================================
+
 Package: @types/geojson@7946.0.16
 Declared license: MIT
 Selected license: MIT
@@ -5425,6 +5455,66 @@ MIT License
 
 ================================================================================
 
+Package: @types/mdast@4.0.4
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/DefinitelyTyped/DefinitelyTyped.git#types/mdast
+
+--- LICENSE ---
+MIT License
+
+    Copyright (c) Microsoft Corporation.
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE
+
+================================================================================
+
+Package: @types/ms@2.1.0
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/DefinitelyTyped/DefinitelyTyped.git#types/ms
+
+--- LICENSE ---
+MIT License
+
+    Copyright (c) Microsoft Corporation.
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE
+
+================================================================================
+
 Package: @types/node@26.6.3
 Declared license: MIT
 Selected license: MIT
@@ -5545,6 +5635,36 @@ MIT License
 
 ================================================================================
 
+Package: @types/unist@3.0.3
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/DefinitelyTyped/DefinitelyTyped.git#types/unist
+
+--- LICENSE ---
+MIT License
+
+    Copyright (c) Microsoft Corporation.
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE
+
+================================================================================
+
 Package: @upsetjs/venn.js@2.0.0
 Declared license: MIT
 Selected license: MIT
@@ -7256,6 +7376,37 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 
 ================================================================================
 
+Package: character-entities@2.0.2
+Declared license: MIT
+Selected license: MIT
+Repository: wooorm/character-entities
+
+--- license ---
+(The MIT License)
+
+Copyright (c) 2015 Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
 Package: cli-table3@0.6.5
 Declared license: MIT
 Selected license: MIT
@@ -8836,6 +8987,37 @@ THE SOFTWARE.
 
 ================================================================================
 
+Package: decode-named-character-reference@1.3.0
+Declared license: MIT
+Selected license: MIT
+Repository: wooorm/decode-named-character-reference
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
 Package: delaunator@5.1.0
 Declared license: ISC
 Selected license: ISC
@@ -8888,6 +9070,67 @@ THE SOFTWARE.
 
 ================================================================================
 
+Package: dequal@2.0.3
+Declared license: MIT
+Selected license: MIT
+Repository: lukeed/dequal
+
+--- license ---
+The MIT License (MIT)
+
+Copyright (c) Luke Edwards <luke.edwards05@gmail.com> (lukeed.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+
+================================================================================
+
+Package: devlop@1.1.0
+Declared license: MIT
+Selected license: MIT
+Repository: wooorm/devlop
+
+--- license ---
+(The MIT License)
+
+Copyright (c) 2023 Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
 Package: dijkstrajs@1.0.3
 Declared license: MIT
 Selected license: MIT
@@ -12779,33 +13022,777 @@ SOFTWARE.
 
 ================================================================================
 
-Package: mermaid@11.17.2
+Package: mdast-util-from-markdown@2.1.0
 Declared license: MIT
 Selected license: MIT
-Repository: https://github.com/mermaid-js/mermaid
-
---- LICENSE ---
-The MIT License (MIT)
+Repository: syntax-tree/mdast-util-from-markdown
 
-Copyright (c) 2014 - 2022 Knut Sveidqvist
+--- license ---
+(The MIT License)
 
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
 
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
 
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: mdast-util-to-string@4.0.0
+Declared license: MIT
+Selected license: MIT
+Repository: syntax-tree/mdast-util-to-string
+
+--- license ---
+(The MIT License)
+
+Copyright (c) 2015 Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: mermaid@11.17.2
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/mermaid-js/mermaid
+
+--- LICENSE ---
+The MIT License (MIT)
+
+Copyright (c) 2014 - 2022 Knut Sveidqvist
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+================================================================================
+
+Package: micromark@4.0.3
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-core-commonmark@2.0.4
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-core-commonmark
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-factory-destination@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-factory-destination
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-factory-label@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-factory-label
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-factory-space@2.1.0
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-factory-space
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-factory-title@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-factory-title
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-factory-whitespace@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-factory-whitespace
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-character@2.1.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-character
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-chunked@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-chunked
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-classify-character@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-classify-character
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-combine-extensions@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-combine-extensions
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-decode-numeric-character-reference@2.0.2
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-decode-numeric-character-reference
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-decode-string@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-decode-string
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-edit-map@1.0.0
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-edit-map
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-encode@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-encode
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-html-tag-name@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-html-tag-name
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-normalize-identifier@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-normalize-identifier
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-resolve-all@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-resolve-all
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-sanitize-uri@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-sanitize-uri
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-subtokenize@2.1.0
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-subtokenize
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-symbol@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-symbol
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-types@2.0.3
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-types
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ================================================================================
 
@@ -15697,6 +16684,37 @@ SOFTWARE.
 
 ================================================================================
 
+Package: unist-util-stringify-position@4.0.0
+Declared license: MIT
+Selected license: MIT
+Repository: syntax-tree/unist-util-stringify-position
+
+--- license ---
+(The MIT License)
+
+Copyright (c) 2016 Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
 Package: universalify@2.0.1
 Declared license: MIT
 Selected license: MIT
diff --git a/package-lock.json b/package-lock.json
index 8166229ca9..ef69dab255 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -5715,7 +5715,6 @@
       "version": "4.1.13",
       "resolved": "https://registry.npmjs.org/@types/debug/-/debug-4.1.13.tgz",
       "integrity": "sha512-KSVgmQmzMwPlmtljOomayoR89W4FynCAi3E8PPs7vmDVPe84hT+vGPKkJfThkmXs0x0jAaa9U8uW8bbfyS2fWw==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/ms": "*"
@@ -5799,7 +5798,6 @@
       "version": "4.0.4",
       "resolved": "https://registry.npmjs.org/@types/mdast/-/mdast-4.0.4.tgz",
       "integrity": "sha512-kGaNbPh1k7AFzgpud/gMdvIm5xuECykRR+JnWKQno9TAXVa6WIVCGTPvYGekIDL4uwCZQSYbUxNBSb1aUo79oA==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/unist": "*"
@@ -5809,7 +5807,6 @@
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/@types/ms/-/ms-2.1.0.tgz",
       "integrity": "sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA==",
-      "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/nlcst": {
@@ -5892,7 +5889,6 @@
       "version": "3.0.3",
       "resolved": "https://registry.npmjs.org/@types/unist/-/unist-3.0.3.tgz",
       "integrity": "sha512-ko/gIFJRv177XgZsZcBwnqJN5x/Gien8qNOn0D5bQU/zAzVf9Zt3BlcUiLqhV9y4ARk0GbT3tnUiPNgnTXzc/Q==",
-      "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/ws": {
@@ -7650,6 +7646,16 @@
         "url": "https://github.com/chalk/chalk?sponsor=1"
       }
     },
+    "node_modules/character-entities": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/character-entities/-/character-entities-2.0.2.tgz",
+      "integrity": "sha512-shx7oQ0Awen/BRIdkjkvz54PnEEI/EjwXDSIZp86/KKdbafHh1Df/RYGBhn4hbe2+uKC9FnT5UCEdyPz3ai9hQ==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
     "node_modules/character-entities-html4": {
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/character-entities-html4/-/character-entities-html4-2.1.0.tgz",
@@ -8666,6 +8672,19 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/decode-named-character-reference": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/decode-named-character-reference/-/decode-named-character-reference-1.3.0.tgz",
+      "integrity": "sha512-GtpQYB283KrPp6nRw50q3U9/VfOutZOe103qlN7BPP6Ad27xYnOIWv4lPzo8HCAL+mMZofJ9KEy30fq6MfaK6Q==",
+      "license": "MIT",
+      "dependencies": {
+        "character-entities": "^2.0.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
     "node_modules/decompress-response": {
       "version": "6.0.0",
       "resolved": "https://registry.npmjs.org/decompress-response/-/decompress-response-6.0.0.tgz",
@@ -8834,7 +8853,6 @@
       "version": "2.0.3",
       "resolved": "https://registry.npmjs.org/dequal/-/dequal-2.0.3.tgz",
       "integrity": "sha512-0je+qPKHEMohvfRTCEo3CrPG6cAzAYgmzKyxRiYSSDkS6eGJdyVJm7WaYA5ECaAD9wLB2T4EEeymA5aFVcYXCA==",
-      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=6"
@@ -8876,7 +8894,6 @@
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/devlop/-/devlop-1.1.0.tgz",
       "integrity": "sha512-RWmIqhcFf1lRYBvNmr7qTNuyCt/7/ns2jbpp1+PalgE/rDQcBT0fioSMUpJ93irlUhC5hrg4cYqe6U+0ImW0rA==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "dequal": "^2.0.0"
@@ -12374,6 +12391,30 @@
         "node": ">= 0.4"
       }
     },
+    "node_modules/mdast-util-from-markdown": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/mdast-util-from-markdown/-/mdast-util-from-markdown-2.1.0.tgz",
+      "integrity": "sha512-KRLgmPaP2H1ul2bpoJkOS+9pAcDAAj9Nu1mqLnh8NLeJG5tlvj42TH80PIGBpROWlRXLk0lDrWNuZCFy/tsB4A==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/mdast": "^4.0.0",
+        "@types/unist": "^3.0.0",
+        "decode-named-character-reference": "^1.0.0",
+        "devlop": "^1.0.0",
+        "mdast-util-to-string": "^4.0.0",
+        "micromark": "^4.0.0",
+        "micromark-util-decode-numeric-character-reference": "^2.0.0",
+        "micromark-util-decode-string": "^2.0.0",
+        "micromark-util-normalize-identifier": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0",
+        "unist-util-stringify-position": "^4.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
     "node_modules/mdast-util-to-hast": {
       "version": "13.2.1",
       "resolved": "https://registry.npmjs.org/mdast-util-to-hast/-/mdast-util-to-hast-13.2.1.tgz",
@@ -12396,6 +12437,19 @@
         "url": "https://opencollective.com/unified"
       }
     },
+    "node_modules/mdast-util-to-string": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/mdast-util-to-string/-/mdast-util-to-string-4.0.0.tgz",
+      "integrity": "sha512-0H44vDimn51F0YwvxSJSm0eCDOJTRlmN0R1yBh4HLj9wiV1Dn0QoXGbvFAWj2hSItVTlCmBF1hqKlIyUBVFLPg==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/mdast": "^4.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
     "node_modules/mdn-data": {
       "version": "2.27.1",
       "resolved": "https://registry.npmjs.org/mdn-data/-/mdn-data-2.27.1.tgz",
@@ -12468,11 +12522,188 @@
         "node": ">= 20"
       }
     },
+    "node_modules/micromark": {
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/micromark/-/micromark-4.0.3.tgz",
+      "integrity": "sha512-oGYfQzHSG5dOMovQcJ3fyTmZlWAWpi0XA0sJwJs+i6OT88o1+Jtw/8z0CmdowSLxGhhFK89rQ/oXph/wN02PNw==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "@types/debug": "^4.0.0",
+        "debug": "^4.0.0",
+        "decode-named-character-reference": "^1.0.0",
+        "devlop": "^1.0.0",
+        "micromark-core-commonmark": "^2.0.0",
+        "micromark-factory-space": "^2.0.0",
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-chunked": "^2.0.0",
+        "micromark-util-combine-extensions": "^2.0.0",
+        "micromark-util-decode-numeric-character-reference": "^2.0.0",
+        "micromark-util-edit-map": "^1.0.0",
+        "micromark-util-encode": "^2.0.0",
+        "micromark-util-normalize-identifier": "^2.0.0",
+        "micromark-util-resolve-all": "^2.0.0",
+        "micromark-util-sanitize-uri": "^2.0.0",
+        "micromark-util-subtokenize": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-core-commonmark": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/micromark-core-commonmark/-/micromark-core-commonmark-2.0.4.tgz",
+      "integrity": "sha512-wxEeE8v8XVvOrxn1TZj74qYhAtTQsSqufHVS3uNVyT1MupXxhyaHk8/9xDNPh9BmL77QNDgWTkZ3RsYHB2ry7w==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "decode-named-character-reference": "^1.0.0",
+        "devlop": "^1.0.0",
+        "micromark-factory-destination": "^2.0.0",
+        "micromark-factory-label": "^2.0.0",
+        "micromark-factory-space": "^2.1.0",
+        "micromark-factory-title": "^2.0.0",
+        "micromark-factory-whitespace": "^2.0.0",
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-chunked": "^2.0.0",
+        "micromark-util-classify-character": "^2.0.0",
+        "micromark-util-edit-map": "^1.0.0",
+        "micromark-util-html-tag-name": "^2.0.0",
+        "micromark-util-normalize-identifier": "^2.0.0",
+        "micromark-util-resolve-all": "^2.0.0",
+        "micromark-util-subtokenize": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.3"
+      }
+    },
+    "node_modules/micromark-factory-destination": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-factory-destination/-/micromark-factory-destination-2.0.1.tgz",
+      "integrity": "sha512-Xe6rDdJlkmbFRExpTOmRj9N3MaWmbAgdpSrBQvCFqhezUn4AHqJHbaEnfbVYYiexVSs//tqOdY/DxhjdCiJnIA==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-factory-label": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-factory-label/-/micromark-factory-label-2.0.1.tgz",
+      "integrity": "sha512-VFMekyQExqIW7xIChcXn4ok29YE3rnuyveW3wZQWWqF4Nv9Wk5rgJ99KzPvHjkmPXF93FXIbBp6YdW3t71/7Vg==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "devlop": "^1.0.0",
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-factory-space": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/micromark-factory-space/-/micromark-factory-space-2.1.0.tgz",
+      "integrity": "sha512-fS8hnLIjnjvdQIj39Geug8wWsR0HrYZ43KShKxNfwT7t2LOHo/LbWZEzEaSOjwtjdCsjoE6syHhonEzW0zv0+Q==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-factory-title": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-factory-title/-/micromark-factory-title-2.0.1.tgz",
+      "integrity": "sha512-5bZ+3CjhAd9eChYTHsjy6TGxpOFSKgKKJPJxr293jTbfry2KDoWkhBb6TcPVB4NmzaPhMs1Frm9AZH7OD4Cjzw==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-factory-space": "^2.0.0",
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-factory-whitespace": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-factory-whitespace/-/micromark-factory-whitespace-2.0.1.tgz",
+      "integrity": "sha512-Ob0nuZ3PKt/n0hORHyvoD9uZhr+Za8sFoP+OnMcnWK5lngSzALgQYKMr9RJVOWLqQYuyn6ulqGWSXdwf6F80lQ==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-factory-space": "^2.0.0",
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
     "node_modules/micromark-util-character": {
       "version": "2.1.1",
       "resolved": "https://registry.npmjs.org/micromark-util-character/-/micromark-util-character-2.1.1.tgz",
       "integrity": "sha512-wv8tdUTJ3thSFFFJKtpYKOYiGP2+v96Hvk4Tu8KpCAsTMs6yi+nVmGh1syvSCsaxz45J6Jbw+9DD6g97+NV67Q==",
-      "dev": true,
       "funding": [
         {
           "type": "GitHub Sponsors",
@@ -12489,11 +12720,130 @@
         "micromark-util-types": "^2.0.0"
       }
     },
+    "node_modules/micromark-util-chunked": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-chunked/-/micromark-util-chunked-2.0.1.tgz",
+      "integrity": "sha512-QUNFEOPELfmvv+4xiNg2sRYeS/P84pTW0TCgP5zc9FpXetHY0ab7SxKyAQCNCc1eK0459uoLI1y5oO5Vc1dbhA==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-util-symbol": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-util-classify-character": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-classify-character/-/micromark-util-classify-character-2.0.1.tgz",
+      "integrity": "sha512-K0kHzM6afW/MbeWYWLjoHQv1sgg2Q9EccHEDzSkxiP/EaagNzCm7T/WMKZ3rjMbvIpvBiZgwR3dKMygtA4mG1Q==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-util-combine-extensions": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-combine-extensions/-/micromark-util-combine-extensions-2.0.1.tgz",
+      "integrity": "sha512-OnAnH8Ujmy59JcyZw8JSbK9cGpdVY44NKgSM7E9Eh7DiLS2E9RNQf0dONaGDzEG9yjEl5hcqeIsj4hfRkLH/Bg==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-util-chunked": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-util-decode-numeric-character-reference": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/micromark-util-decode-numeric-character-reference/-/micromark-util-decode-numeric-character-reference-2.0.2.tgz",
+      "integrity": "sha512-ccUbYk6CwVdkmCQMyr64dXz42EfHGkPQlBj5p7YVGzq8I7CtjXZJrubAYezf7Rp+bjPseiROqe7G6foFd+lEuw==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-util-symbol": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-util-decode-string": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-decode-string/-/micromark-util-decode-string-2.0.1.tgz",
+      "integrity": "sha512-nDV/77Fj6eH1ynwscYTOsbK7rR//Uj0bZXBwJZRfaLEJ1iGBR6kIfNmlNqaqJf649EP0F3NWNdeJi03elllNUQ==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "decode-named-character-reference": "^1.0.0",
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-decode-numeric-character-reference": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-util-edit-map": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/micromark-util-edit-map/-/micromark-util-edit-map-1.0.0.tgz",
+      "integrity": "sha512-Pa2ljlsEL6sVwFaYeyrOLSYbQt73JvGbPOYFq+9AElXiSnfI5Q4465RRZ1sHv7lDjDOnGRDDaqPXqClqWK/q1Q==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-util-types": "^2.0.0"
+      }
+    },
     "node_modules/micromark-util-encode": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/micromark-util-encode/-/micromark-util-encode-2.0.1.tgz",
       "integrity": "sha512-c3cVx2y4KqUnwopcO9b/SCdo2O67LwJJ/UyqGfbigahfegL9myoEFoDYZgkT7f36T0bLrM9hZTAaAyH+PCAXjw==",
-      "dev": true,
       "funding": [
         {
           "type": "GitHub Sponsors",
@@ -12506,11 +12856,64 @@
       ],
       "license": "MIT"
     },
+    "node_modules/micromark-util-html-tag-name": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-html-tag-name/-/micromark-util-html-tag-name-2.0.1.tgz",
+      "integrity": "sha512-2cNEiYDhCWKI+Gs9T0Tiysk136SnR13hhO8yW6BGNyhOC4qYFnwF1nKfD3HFAIXA5c45RrIG1ub11GiXeYd1xA==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/micromark-util-normalize-identifier": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-normalize-identifier/-/micromark-util-normalize-identifier-2.0.1.tgz",
+      "integrity": "sha512-sxPqmo70LyARJs0w2UclACPUUEqltCkJ6PhKdMIDuJ3gSf/Q+/GIe3WKl0Ijb/GyH9lOpUkRAO2wp0GVkLvS9Q==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-util-symbol": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-util-resolve-all": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-resolve-all/-/micromark-util-resolve-all-2.0.1.tgz",
+      "integrity": "sha512-VdQyxFWFT2/FGJgwQnJYbe1jjQoNTS4RjglmSjTUlpUMa95Htx9NHeYW4rGDJzbjvCsl9eLjMQwGeElsqmzcHg==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-util-types": "^2.0.0"
+      }
+    },
     "node_modules/micromark-util-sanitize-uri": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/micromark-util-sanitize-uri/-/micromark-util-sanitize-uri-2.0.1.tgz",
       "integrity": "sha512-9N9IomZ/YuGGZZmQec1MbgxtlgougxTodVwDzzEouPKo3qFWvymFHWcnDi2vzV1ff6kas9ucW+o3yzJK9YB1AQ==",
-      "dev": true,
       "funding": [
         {
           "type": "GitHub Sponsors",
@@ -12528,11 +12931,32 @@
         "micromark-util-symbol": "^2.0.0"
       }
     },
+    "node_modules/micromark-util-subtokenize": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/micromark-util-subtokenize/-/micromark-util-subtokenize-2.1.0.tgz",
+      "integrity": "sha512-XQLu552iSctvnEcgXw6+Sx75GflAPNED1qx7eBJ+wydBb2KCbRZe+NwvIEEMM83uml1+2WSXpBAcp9IUCgCYWA==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "devlop": "^1.0.0",
+        "micromark-util-chunked": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
     "node_modules/micromark-util-symbol": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/micromark-util-symbol/-/micromark-util-symbol-2.0.1.tgz",
       "integrity": "sha512-vs5t8Apaud9N28kgCrRUdEed4UJ+wWNvicHLPxCa9ENlYuAY31M0ETy5y1vA33YoNPDFTghEbnh6efaE8h4x0Q==",
-      "dev": true,
       "funding": [
         {
           "type": "GitHub Sponsors",
@@ -12546,10 +12970,9 @@
       "license": "MIT"
     },
     "node_modules/micromark-util-types": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/micromark-util-types/-/micromark-util-types-2.0.2.tgz",
-      "integrity": "sha512-Yw0ECSpJoViF1qTU4DC6NwtC4aWGt1EkzaQB8KPPyCRR8z9TWeV0HbEFGTO+ZY1wB22zmxnJqhPyTpOVCpeHTA==",
-      "dev": true,
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/micromark-util-types/-/micromark-util-types-2.0.3.tgz",
+      "integrity": "sha512-oxB2Ik03hI0gv+VNn9tnh1t1YEe9MDPptViAEgfdf3YQHsn0pzGTgCdlSCJXcwhqm8phaEuM7zeEu3QQzVBrPg==",
       "funding": [
         {
           "type": "GitHub Sponsors",
@@ -16529,7 +16952,6 @@
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/unist-util-stringify-position/-/unist-util-stringify-position-4.0.0.tgz",
       "integrity": "sha512-0ASV06AAoKCDkS2+xw5RXJywruurpbC4JZSm7nr7MOt1ojAzvyyaO+UxZf18j8FCF6kmzCZKcAgN/yu2gm2XgQ==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/unist": "^3.0.0"
@@ -17511,6 +17933,7 @@
         "clsx": "^2.1.1",
         "katex": "0.18.9",
         "lucide-react": "^1.48.0",
+        "mdast-util-from-markdown": "^2.1.0",
         "mermaid": "^11.17.2",
         "react": "^19.3.0",
         "react-dom": "^19.3.0",
diff --git a/packages/core/src/image-markdown.ts b/packages/core/src/image-markdown.ts
index ebbdec6db5..5d823080c6 100644
--- a/packages/core/src/image-markdown.ts
+++ b/packages/core/src/image-markdown.ts
@@ -26,12 +26,17 @@ const parser = new Marked({ gfm: true });
  * Consumers own their source policy; parsing grants no filesystem or network access.
  */
 export function markdownImageSources(text: string): string[] {
+  return [...new Set(markdownImages(text).map((image) => image.source))];
+}
+
+/** Original token spelling and canonical destination, including reference images. */
+export function markdownImages(text: string): { raw: string; source: string }[] {
   if (!text.includes('![') || text.length > IMAGE_MARKDOWN_MAX_LENGTH) return [];
-  const sources = new Set<string>();
+  const images: { raw: string; source: string }[] = [];
   parser.walkTokens(parser.lexer(text), (token) => {
-    if (token.type === 'image') sources.add(token.href);
+    if (token.type === 'image') images.push({ raw: token.raw, source: token.href });
   });
-  return [...sources];
+  return images;
 }
 
 /** Resolve a complete inline destination, rejecting trailing or partial syntax. */
diff --git a/packages/ui/package.json b/packages/ui/package.json
index 8de5e24cdb..a1d61c248b 100644
--- a/packages/ui/package.json
+++ b/packages/ui/package.json
@@ -33,6 +33,7 @@
     "clsx": "^2.1.1",
     "katex": "0.18.9",
     "lucide-react": "^1.48.0",
+    "mdast-util-from-markdown": "^2.1.0",
     "mermaid": "^11.17.2",
     "react": "^19.3.0",
     "react-dom": "^19.3.0",
diff --git a/packages/ui/scripts/markdown-images.browser.test.mjs b/packages/ui/scripts/markdown-images.browser.test.mjs
index a7120265a9..fec2172f84 100644
--- a/packages/ui/scripts/markdown-images.browser.test.mjs
+++ b/packages/ui/scripts/markdown-images.browser.test.mjs
@@ -106,6 +106,14 @@ before(async () => {
     'geometry-remote': `![Screenshot](${imageUrl}/delayed.png)\n\nFollowing paragraph`,
     'geometry-saved': '![Screenshot](/tmp/private.png)\n\nFollowing paragraph',
     'streaming-angle-race': '![Screenshot](</tmp/my image.png>)',
+    'signed-saved': `![Screenshot](${imageUrl}/image.png?token=first-secret)`,
+    'signature-saved': `![Screenshot](${imageUrl}/image.png?signature=second-secret&expires=123)`,
+    'hash-saved': `![Screenshot](/tmp/${'a'.repeat(48)}.png)`,
+    'secret-reference-saved': `![Screenshot][picture]\n\n[picture]: ${imageUrl}/image.png?token=reference-secret`,
+    'signed-streaming-race': `![Screenshot](${imageUrl}/image.png?token=stream-secret)`,
+    'signed-preview': `![Screenshot](${imageUrl}/image.png?token=preview-secret)`,
+    'signed-duplicates-saved': `![First](${imageUrl}/image.png?token=first-secret) ![Second](${imageUrl}/image.png?token=second-secret)`,
+    'signed-live-saved': `![Screenshot](${imageUrl}/image.png?token=live-`,
     screenshot: `![Screenshot](${imageUrl}/screenshot.png)`,
   };
   const canonicalSources = {
@@ -115,6 +123,13 @@ before(async () => {
     'reference-saved': ['/tmp/my "image".png'],
     'geometry-saved': ['/tmp/private.png'],
     'streaming-angle-race': ['/tmp/my image.png'],
+    'signed-saved': [`${imageUrl}/image.png?token=first-secret`],
+    'signature-saved': [`${imageUrl}/image.png?signature=second-secret&expires=123`],
+    'hash-saved': [`/tmp/${'a'.repeat(48)}.png`],
+    'secret-reference-saved': [`${imageUrl}/image.png?token=reference-secret`],
+    'signed-streaming-race': [`${imageUrl}/image.png?token=stream-secret`],
+    'signed-duplicates-saved': [`${imageUrl}/image.png?token=first-secret`, `${imageUrl}/image.png?token=second-secret`],
+    'signed-live-saved': [`${imageUrl}/image.png?token=live-secret`],
   };
   const bundle = await build({
     stdin: { contents: `
@@ -122,7 +137,7 @@ before(async () => {
       import {createRoot} from 'react-dom/client';
       import {Theme, ChatMessageList, ChatMessage, ChatMessageBubble} from '@astryxdesign/core';
       import {makaTheme} from './apps/desktop/src/renderer/astryx-theme/maka.js';
-      import {MarkdownBody} from './packages/ui/dist/markdown-body.js';
+      import {Markdown} from './packages/ui/dist/markdown.js';
       import {LocaleProvider} from './packages/ui/dist/locale-context.js';
       import {ImageDeliveryProvider} from './packages/ui/dist/image-delivery.js';
       import {SessionAttachmentProvider} from './packages/ui/dist/attachment-image.js';
@@ -130,9 +145,9 @@ before(async () => {
       const mode=new URLSearchParams(location.search).get('case') || 'remote';
       const destinations=${JSON.stringify(destinations)};
       const canonicalSources=${JSON.stringify(canonicalSources)};
-      let reads=0; window.imageReads=0; window.deliveryQueries=0; window.deliveryReady=false; window.deliveryRetries=0;
+      let reads=0; window.imageReads=0; window.deliveryQueries=0; window.deliverySources=[]; window.deliveryReady=false; window.deliveryRetries=0;
       const race=mode.endsWith('-race');
-      const text=destinations[mode] ?? (mode==='attachment' ? '![Screenshot](maka://runtime/attachments/image-1)' :
+      let text=destinations[mode] ?? (mode==='attachment' ? '![Screenshot](maka://runtime/attachments/image-1)' :
         mode==='local' || mode==='local-saved' || race ? '![Screenshot](/tmp/private.png)' :
         '![Screenshot](${imageUrl}/'+(mode==='retry' ? 'retry.png' : 'image.png')+')');
       const root=createRoot(document.getElementById('root'));
@@ -145,13 +160,14 @@ before(async () => {
       const resolveDelivery=mode.endsWith('saved') || mode.endsWith('saving') || race ? async(_session,request)=>{
         window.deliveryQueries++;
         window.deliverySource=request.source;
+        window.deliverySources.push(request.source);
         if(canonicalSources[mode] && !canonicalSources[mode].includes(request.source)) return {status:'unavailable'};
         if(request.retry) window.deliveryRetries++;
         if(race) return window.deliveryReady ? {status:'ready',artifactId:'saved-image'} : {status:'unavailable'};
         await new Promise(resolve=>setTimeout(resolve,100));
         return mode.endsWith('saving') && window.deliveryQueries===1 ? {status:'pending'} : {status:'ready',artifactId:'saved-image'};
       } : undefined;
-      const markdown=(streaming)=>React.createElement(MarkdownBody,{text,streaming,settledText:race ? text : undefined,density:'compact',imageIdentity:{turnId:'turn',messageId:'message'}});
+      const markdown=(streaming)=>React.createElement(Markdown,{text,streaming,settledText:race ? text : undefined,density:'compact',imageIdentity:{turnId:'turn',messageId:'message'}});
       const surface=(streaming)=>mode.startsWith('layout-') ? React.createElement('section',{className:mode==='layout-side' ? 'maka-quote-companion' : '',style:{width:mode==='layout-side' ? '360px' : '100%',maxWidth:'100%'}},
         React.createElement(ChatMessageList,{className:'maka-chat-message-list maka-chatContent',align:'top'},
           React.createElement('div',{className:'maka-transcript-turn maka-turn',style:{width:'100%',maxWidth:'var(--maka-reading-measure)',marginInline:'auto'}},
@@ -164,6 +180,7 @@ before(async () => {
               React.createElement('div',{style:mode==='offscreen' ? {paddingTop:'2500px'} : {}},
                 surface(streaming)))))));
       window.finishStream=()=>render(false);
+      window.appendText=value=>{text+=value; render(true);};
       render();
     `, resolveDir: root, loader: 'js' },
     bundle: true, write: false, outdir: '/virtual', format: 'iife',
@@ -219,6 +236,45 @@ test('remote image loads automatically under the actual desktop CSP, without sen
   } finally { await page.close(); }
 });
 
+test('a signed image previews using its original URL without putting the token in visible text', async () => {
+  requests = [];
+  const page = await pageFor('signed-preview');
+  try {
+    await loaded(page);
+    assert.deepEqual(requests, [{ path: '/image.png?token=preview-secret', referer: undefined }]);
+    assert.ok(!(await page.locator('body').innerText()).includes('preview-secret'));
+  } finally { await page.close(); }
+});
+
+test('two signed destinations which redact alike replay their own saved attachments', async () => {
+  requests = [];
+  const page = await pageFor('signed-duplicates-saved');
+  try {
+    await page.waitForFunction(() => document.images.length === 2 && [...document.images].every(image => image.src.startsWith('data:') && image.naturalWidth === 1));
+    assert.deepEqual(await page.evaluate(() => window.deliverySources), [
+      `${imageUrl}/image.png?token=first-secret`, `${imageUrl}/image.png?token=second-secret`,
+    ]);
+    assert.deepEqual(requests, []);
+    assert.doesNotMatch(await page.locator('body').innerText(), /first-secret|second-secret/);
+  } finally { await page.close(); }
+});
+
+test('a signed image completed by a later text delta resolves its original destination', async () => {
+  requests = [];
+  const page = await pageFor('signed-live-saved');
+  try {
+    await page.waitForFunction(() => typeof window.appendText === 'function');
+    assert.equal(await page.locator('img').count(), 0);
+    await page.evaluate(() => window.appendText('secret)'));
+    await loaded(page);
+    assert.equal(await page.evaluate(() => window.deliverySource), `${imageUrl}/image.png?token=live-secret`);
+    await page.evaluate(() => window.finishStream());
+    await loaded(page);
+    assert.deepEqual(requests, []);
+    assert.doesNotMatch(await page.locator('body').innerText(), /live-secret/);
+  } finally { await page.close(); }
+});
+
 test('failed remote image has a working retry control instead of a broken image icon', async () => {
   failedOnce = false;
   const page = await pageFor('retry');
@@ -316,7 +372,7 @@ test('a new remote image previews during archival and switches to saved bytes af
   } finally { await page.close(); }
 });
 
-for (const scenario of ['streaming-race', 'settled-race', 'streaming-angle-race']) {
+for (const scenario of ['streaming-race', 'settled-race', 'streaming-angle-race', 'signed-streaming-race']) {
   test(`${scenario}: an unavailable live source recovers in place once Host archival completes`, async () => {
     const page = await pageFor(scenario);
     try {
@@ -326,7 +382,7 @@ for (const scenario of ['streaming-race', 'settled-race', 'streaming-angle-race'
         await page.waitForFunction(() => window.deliveryQueries >= 2);
       }
       await page.evaluate(() => { window.deliveryReady = true; });
-      await loaded(page);
+      await page.waitForFunction(() => [...document.images].some(image => image.src.startsWith('data:') && image.naturalWidth === 1));
       assert.equal(await page.evaluate(() => window.imageReads), 1);
       assert.match(await page.locator('img').getAttribute('src'), /^data:image\/png;base64,/);
       assert.equal(await page.locator('img').count(), 1);
@@ -334,7 +390,7 @@ for (const scenario of ['streaming-race', 'settled-race', 'streaming-angle-race'
   });
 }
 
-for (const scenario of ['angle-saved', 'title-saved', 'escaped-saved', 'reference-saved', 'attachment-title']) {
+for (const scenario of ['angle-saved', 'title-saved', 'escaped-saved', 'reference-saved', 'attachment-title', 'signed-saved', 'signature-saved', 'hash-saved', 'secret-reference-saved']) {
   test(`${scenario}: standard Markdown destinations resolve to saved bytes without origin requests`, async () => {
     requests = [];
     const page = await pageFor(scenario);
@@ -491,6 +547,7 @@ for (const [scenario, width, height] of [
     }));
     try {
       await page.goto(`${appUrl}/?case=${scenario}`, { waitUntil: 'domcontentloaded' });
+      await page.waitForFunction(() => document.querySelectorAll('.maka-markdown-image-resource').length === 2);
       await page.getByText('Following paragraph stays in place.').waitFor();
       const before = await measure();
       const followingBefore = await page.getByText('Following paragraph stays in place.').boundingBox();
diff --git a/packages/ui/src/__tests__/markdown-body.test.ts b/packages/ui/src/__tests__/markdown-body.test.ts
index edd696513a..abb4a21afc 100644
--- a/packages/ui/src/__tests__/markdown-body.test.ts
+++ b/packages/ui/src/__tests__/markdown-body.test.ts
@@ -380,6 +380,17 @@ it('redacts secrets before even the lazy Markdown fallback reaches the rendered
   assert.match(markup, /&lt;redacted&gt;/);
 });
 
+it('keeps signed image destinations out of the lazy fallback and rendered prose', () => {
+  const text = '![Screenshot](https://example.com/image.png?token=image-secret)\n\nAuthorization: Bearer prose-secret';
+  for (const markup of [
+    renderToStaticMarkup(createElement(Markdown, { text })),
+    renderToStaticMarkup(createElement(MarkdownBody, { text, redact: true })),
+  ]) {
+    assert.doesNotMatch(markup, /image-secret|prose-secret/);
+    assert.match(markup, /&lt;redacted&gt;/);
+  }
+});
+
 
 
 it('preserves allowlisted Maka navigation links through sanitization', () => {
diff --git a/packages/ui/src/__tests__/markdown-image-redaction.test.ts b/packages/ui/src/__tests__/markdown-image-redaction.test.ts
new file mode 100644
index 0000000000..74b10f9d78
--- /dev/null
+++ b/packages/ui/src/__tests__/markdown-image-redaction.test.ts
@@ -0,0 +1,114 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { markdownImageSources } from '@maka/core/image-markdown';
+import { IMAGE_MARKDOWN_MAX_LENGTH } from '@maka/core/image-delivery';
+import { redactMarkdownImages } from '../markdown-image-redaction.js';
+import { redactSecrets } from '../redact.js';
+
+const signed = 'https://example.com/image.png?token=private-value';
+function resolved(text: string) {
+  const result = redactMarkdownImages(text);
+  return { ...result, destinations: markdownImageSources(result.text).map(source => result.sources.get(source) ?? source) };
+}
+
+test('signed URLs and hashed paths retain their exact Host identities without exposing them as text', () => {
+  for (const source of [signed, signed + '&expires=123', signed.replace('token=', 'signature='), `/tmp/${'a'.repeat(48)}.png`]) {
+    const result = resolved(`![Screenshot](${source})`);
+    assert.deepEqual(result.destinations, [source]);
+    assert.ok(!result.text.includes(source));
+  }
+});
+
+test('destinations which redact to the same text retain separate identities', () => {
+  const other = signed.replace('private-value', 'another-value');
+  const result = resolved(`![one](${signed}) ![two](${other}) ![one again](${signed})`);
+  assert.deepEqual(result.destinations, [signed, other]);
+  assert.equal(result.sources.size, 2);
+});
+
+test('reference images retain original identity while shared ordinary links stay redacted', () => {
+  const result = resolved(`![Screenshot][pic]\n\n[ordinary link][pic]\n\n[pic]: ${signed}`);
+  assert.deepEqual(result.destinations, [signed]);
+  assert.ok(!result.text.includes('private-value'));
+  assert.ok(result.text.includes('[ordinary link][pic]'));
+  assert.ok(result.text.includes(redactSecrets(`[pic]: ${signed}`)));
+});
+
+test('code, HTML, prose and ordinary links remain identical to normal display redaction', () => {
+  const example = `![Screenshot](${signed})`;
+  const nonImages = [
+    '`' + example + '`',
+    '```md\n' + example + '\n```',
+    '<pre>\n' + example + '\n</pre>',
+    `<img src="${signed}">`,
+    `[ordinary](${signed})`,
+    `Prose ${signed}`,
+  ];
+  for (const text of nonImages) {
+    const result = redactMarkdownImages(text);
+    assert.equal(result.text, redactSecrets(text));
+    assert.equal(result.sources.size, 0);
+    const together = redactMarkdownImages(text + '\n\n' + example);
+    assert.ok(together.text.startsWith(redactSecrets(text) + '\n\n'));
+    assert.equal(together.sources.size, 1);
+  }
+});
+
+test('nested Markdown, escaped paths, entities, angle destinations and CRLF keep canonical identities', () => {
+  for (const text of [
+    `> ![Screenshot](${signed})`,
+    `- **![Screenshot](${signed})**`,
+    `| Image |\n| --- |\n| ![Screenshot](${signed}) |`,
+    `[![Screenshot](${signed})](https://example.com)`,
+    `![Screenshot](<${signed}> "title")`,
+    `![Screenshot](https://example.com/i?token=a&amp;expires=123)`,
+    String.raw`![Screenshot](/tmp/a\(1\)-${'a'.repeat(48)}.png)`,
+    `Before\r\n\r\n![Screenshot](${signed})\r\n`,
+  ]) {
+    assert.deepEqual(resolved(text).destinations, markdownImageSources(text), text);
+  }
+});
+
+test('image labels, titles and surrounding secrets are still redacted', () => {
+  const result = resolved(`Authorization: Bearer prose-secret\n\n![sk-1234567890abcdef](${signed} "token=title")`);
+  assert.deepEqual(result.destinations, [signed]);
+  assert.ok(!result.text.includes('prose-secret'));
+  assert.ok(!result.text.includes('sk-1234567890abcdef'));
+  assert.ok(!result.text.includes('private-value'));
+});
+
+test('settled and live sources share aliases without accepting source-authored aliases', () => {
+  const settled = `![Screenshot](${signed})`;
+  const authored = '![fake](maka-image-display:0)';
+  const result = redactMarkdownImages(`${settled}\n\n${authored}`, settled);
+  assert.equal(result.sources.has('maka-image-display:0'), false);
+  assert.equal(markdownImageSources(result.text)[0], markdownImageSources(result.settledText!)[0]);
+  assert.ok(!result.text.includes('private-value'));
+});
+
+test('plain messages and oversized or incomplete images retain existing redaction', () => {
+  for (const text of ['Plain **text**', `![x](${signed}`, 'x'.repeat(IMAGE_MARKDOWN_MAX_LENGTH) + `![x](${signed})`]) {
+    const result = redactMarkdownImages(text);
+    assert.equal(result.text, redactSecrets(text));
+    assert.equal(result.sources.size, 0);
+  }
+});
diff --git a/packages/ui/src/markdown-body.tsx b/packages/ui/src/markdown-body.tsx
index eb1b24a5ef..f9ecab9d3f 100644
--- a/packages/ui/src/markdown-body.tsx
+++ b/packages/ui/src/markdown-body.tsx
@@ -31,7 +31,8 @@
 
 import { MarkdownImage, MarkdownImageSourceProvider, MARKDOWN_IMAGE_PLUGINS } from './markdown-image.js';
 import { ImageMessageScope } from './image-delivery.js';
-import { useCallback, useContext, useRef, type ReactNode } from 'react';
+import { useCallback, useContext, useMemo, useRef, type ReactNode } from 'react';
+import { redactMarkdownImages } from './markdown-image-redaction.js';
 import {
   Markdown as AstryxMarkdown,
   type MarkdownComponents,
@@ -144,6 +145,8 @@ const MARKDOWN_COMPONENTS = {
 
 export function MarkdownBody(props: {
   text: string;
+  /** The lazy entry redacts its fallback; the body also preserves image identities. */
+  redact?: boolean;
   imageIdentity?: { turnId: string; messageId: string };
   streaming?: boolean;
   settledText?: string;
@@ -154,7 +157,11 @@ export function MarkdownBody(props: {
     (source: string) => prepareMarkdownMath(source, mathCache.current),
     [],
   );
-  const budgetedText = props.streaming ? props.text : applyMermaidRenderBudget(props.text);
+  const presentation = useMemo(() => props.redact
+    ? redactMarkdownImages(props.text, props.settledText)
+    : { text: props.text, settledText: props.settledText, sources: undefined },
+  [props.redact, props.text, props.settledText]);
+  const budgetedText = props.streaming ? presentation.text : applyMermaidRenderBudget(presentation.text);
   const density = props.density ?? 'default';
   const components = props.streaming
     ? density === 'compact'
@@ -163,7 +170,7 @@ export function MarkdownBody(props: {
     : MARKDOWN_COMPONENTS[density];
 
   return (
-    <MarkdownImageSourceProvider text={budgetedText}>
+    <MarkdownImageSourceProvider text={budgetedText} sources={presentation.sources}>
       <ImageMessageScope.Provider value={props.imageIdentity ? { ...props.imageIdentity, streaming: props.streaming } : undefined}>
         <div
           data-maka-contract="markdown"
@@ -200,7 +207,7 @@ export function MarkdownBody(props: {
             components={components}
             plugins={MARKDOWN_IMAGE_PLUGINS}
             isStreaming={props.streaming}
-            settledText={props.settledText}
+            settledText={presentation.settledText}
             transformSource={transformMathSource}
           >
             {budgetedText}
diff --git a/packages/ui/src/markdown-image-redaction.ts b/packages/ui/src/markdown-image-redaction.ts
new file mode 100644
index 0000000000..efaebe2b3a
--- /dev/null
+++ b/packages/ui/src/markdown-image-redaction.ts
@@ -0,0 +1,83 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { fromMarkdown } from 'mdast-util-from-markdown';
+import { markdownImages } from '@maka/core/image-markdown';
+import { redactSecrets } from './redact.js';
+
+interface PositionedNode {
+  type: string;
+  position?: { start: { offset?: number }; end: { offset?: number } };
+  children?: readonly PositionedNode[];
+  url?: string;
+  alt?: string | null;
+}
+
+/** Hide destinations behind opaque image-only aliases before redacting prose.
+ * Source positions keep identical examples in code, links and HTML untouched.
+ * Marked remains the authority for the destinations sent to the Host; mdast
+ * supplies only source ranges, which Marked does not expose.
+ */
+export function redactMarkdownImages(text: string, settledText?: string) {
+  let prefix = 'maka-image-display:';
+  while (text.includes(prefix) || settledText?.includes(prefix)) prefix += 'x';
+  const sources = new Map<string, string>();
+  const aliases = new Map<string, string>();
+  const prepare = (original: string): string => {
+    const redacted = redactSecrets(original);
+    if (redacted === original) return redacted;
+    const images = markdownImages(original).filter(image =>
+      redactSecrets(image.source) !== image.source || redactSecrets(image.raw) !== image.raw);
+    if (!images.length) return redacted;
+    const destinations = new Map(images.map(image => [image.raw, image.source]));
+    const canonical = new Set(images.map(image => image.source));
+    const replacements: { start: number; end: number; value: string }[] = [];
+    const visit = (node: PositionedNode) => {
+      if (node.type === 'image' || node.type === 'imageReference') {
+        const start = node.position?.start.offset;
+        const end = node.position?.end.offset;
+        if (start === undefined || end === undefined) return;
+        const raw = original.slice(start, end);
+        const source = destinations.get(raw) ?? (node.url && canonical.has(node.url) ? node.url : undefined);
+        if (!source || (redactSecrets(source) === source && redactSecrets(raw) === raw)) return;
+        let alias = aliases.get(source);
+        if (!alias) {
+          alias = `${prefix}${aliases.size}`;
+          aliases.set(source, alias);
+          sources.set(alias, source);
+        }
+        const alt = redactSecrets(node.alt ?? '').replace(/[\\[\]`*_<>|]/g, '\\$&');
+        replacements.push({ start, end, value: `![${alt}](${alias})` });
+        return;
+      }
+      node.children?.forEach(visit);
+    };
+    visit(fromMarkdown(original));
+    let protectedText = original;
+    for (const replacement of replacements.sort((a, b) => b.start - a.start)) {
+      protectedText = protectedText.slice(0, replacement.start) + replacement.value + protectedText.slice(replacement.end);
+    }
+    return redactSecrets(protectedText);
+  };
+  return {
+    text: prepare(text),
+    settledText: settledText === undefined ? undefined : prepare(settledText),
+    sources,
+  };
+}
diff --git a/packages/ui/src/markdown-image.tsx b/packages/ui/src/markdown-image.tsx
index bd44cfbb51..fa3811ba37 100644
--- a/packages/ui/src/markdown-image.tsx
+++ b/packages/ui/src/markdown-image.tsx
@@ -66,8 +66,14 @@ function isSingleImage(nodes: readonly MarkdownAstNode[]): boolean {
   return node.type === 'image' || (['link', 'strong', 'emphasis', 'delete'].includes(node.type)
     && 'children' in node && isSingleImage(node.children));
 }
-export function MarkdownImageSourceProvider(props: { text: string; children: ReactNode }) {
-  const resolve = useMemo(() => createMarkdownImageSourceResolver(props.text), [props.text]);
+export function MarkdownImageSourceProvider(props: { text: string; sources?: ReadonlyMap<string, string>; children: ReactNode }) {
+  const resolve = useMemo(() => {
+    const canonical = createMarkdownImageSourceResolver(props.text);
+    return (source: string) => {
+      const resolved = canonical(source);
+      return props.sources?.get(resolved) ?? resolved;
+    };
+  }, [props.text, props.sources]);
   return <ImageSourceContext.Provider value={resolve}>{props.children}</ImageSourceContext.Provider>;
 }
 
diff --git a/packages/ui/src/markdown.tsx b/packages/ui/src/markdown.tsx
index 3cb73d1f1e..57ef8fb3de 100644
--- a/packages/ui/src/markdown.tsx
+++ b/packages/ui/src/markdown.tsx
@@ -33,8 +33,10 @@
  * lazy split, that code is parsed on demand the first time a message appears,
  * and cached for every subsequent render.
  *
- * Secret redaction happens eagerly in this wrapper so the Suspense fallback
- * is safe. The remaining trust-boundary contract (URI allowlist, safe-scheme
+ * Secret redaction happens eagerly here for the Suspense fallback. The lazy
+ * body redacts prose after protecting original image destinations behind opaque
+ * aliases, so signed image URLs remain usable without becoming visible text.
+ * The remaining trust-boundary contract (URI allowlist, safe-scheme
  * external gate, broken-link inline errors) lives in `markdown-body.tsx`;
  * see that file for the routing rationale.
  *
@@ -62,9 +64,6 @@ export function Markdown(props: {
   density?: 'default' | 'compact';
 }) {
   const safeText = redactSecrets(props.text);
-  const safeSettledText = props.settledText === undefined
-    ? undefined
-    : redactSecrets(props.settledText);
   const streaming = isProgressiveStreamingEnabled(props.streaming);
   return (
     <Suspense
@@ -78,10 +77,11 @@ export function Markdown(props: {
       )}
     >
       <MarkdownBody
-        text={safeText}
+        text={props.text}
+        redact
         imageIdentity={props.imageIdentity}
         streaming={streaming}
-        settledText={safeSettledText}
+        settledText={props.settledText}
         density={props.density}
       />
     </Suspense>

From 732e14989f1a6a5b6416e2c94e82393b158b35cf Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Wed, 7 Oct 2026 13:13:05 +0800
Subject: [PATCH 14/35] test(ui): cover signed image resolution in the CI suite

Exercise the lazy Markdown entry with signed URLs, distinct tokens and hashed local paths through the saved attachment ports.

Generated-by: Codex (GPT-6)
---
 .../src/__tests__/attachment-image.test.tsx   | 35 +++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/packages/ui/src/__tests__/attachment-image.test.tsx b/packages/ui/src/__tests__/attachment-image.test.tsx
index 1203e69db4..ad59683d76 100644
--- a/packages/ui/src/__tests__/attachment-image.test.tsx
+++ b/packages/ui/src/__tests__/attachment-image.test.tsx
@@ -29,6 +29,8 @@ import {
 } from '../attachment-image.js';
 import { LocaleProvider } from '../locale-context.js';
 import { MarkdownBody } from '../markdown-body.js';
+import { Markdown } from '../markdown.js';
+import { ImageDeliveryProvider } from '../image-delivery.js';
 import type { TurnViewModel } from '../materialize.js';
 
 const originalGlobals = {
@@ -82,6 +84,39 @@ async function renderAttachmentMarkdown(text: string, readBytes: ReadAttachmentB
   return { container, root };
 }
 
+test('the complete Markdown entry resolves original signed and hashed destinations after redacting display text', async () => {
+  const sources = [
+    'https://example.com/image.png?token=first-secret',
+    'https://example.com/image.png?token=second-secret',
+    `/tmp/${'a'.repeat(48)}.png`,
+  ];
+  const { container, root } = domRoot();
+  const requested: string[] = [];
+  await act(async () => {
+    root.render(
+      <LocaleProvider locale="en">
+        <SessionAttachmentProvider sessionId="session-1" readBytes={async () => ({ ok: true, base64: 'aW1n', mimeType: 'image/png' })}>
+          <ImageDeliveryProvider sessionId="session-1" resolve={async (sessionId, request) => {
+            assert.equal(sessionId, 'session-1');
+            assert.equal(request.turnId, 'turn-1');
+            assert.equal(request.messageId, 'message-1');
+            requested.push(request.source);
+            assert.ok(sources.includes(request.source));
+            return { status: 'ready', artifactId: `saved-${sources.indexOf(request.source)}` };
+          }}>
+            <Markdown text={sources.map(source => `![Screenshot](${source})`).join('\n\n') + '\n\nAuthorization: Bearer prose-secret'} imageIdentity={{ turnId: 'turn-1', messageId: 'message-1' }} />
+          </ImageDeliveryProvider>
+        </SessionAttachmentProvider>
+      </LocaleProvider>,
+    );
+  });
+  await act(async () => { await import('../markdown-body.js'); });
+  assert.deepEqual(requested, sources);
+  assert.equal(container.querySelectorAll('img').length, sources.length);
+  for (const image of container.querySelectorAll('img')) assert.equal(image.getAttribute('src'), 'data:image/png;base64,aW1n');
+  assert.doesNotMatch(container.textContent ?? '', /first-secret|second-secret|prose-secret|a{48}/);
+});
+
 const TURN_WITH_IMAGE: TurnViewModel = {
   turnId: 'turn-1',
   status: 'completed',

From c2077d4e8c6db84728193a2155e7b06733c6341c Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Wed, 7 Oct 2026 13:50:51 +0800
Subject: [PATCH 15/35] fix(images): require remote consent and preserve saved
 archives

Harden image loading permissions, source validation, renderer isolation, and retry behavior. Add regression coverage and update the protocol contract and browser CI.

Generated-by: Codex (GPT-6)
---
 .github/workflows/ci.yml                      |   6 +-
 .../check-renderer-architecture.test.mjs      |   2 +-
 .../scripts/vite-renderer-entry-contract.ts   |   2 +-
 .../runtime-host-artifacts-ipc-main.test.ts   |  22 ++
 .../runtime-host-client-operations.test.ts    |  12 +
 .../main/runtime-host-artifacts-ipc-main.ts   |   6 +-
 apps/desktop/src/main/runtime-host-client.ts  |   2 +-
 apps/desktop/src/renderer/index.html          |   2 +-
 package-lock.json                             |   2 +-
 packages/core/package.json                    |   2 +-
 packages/core/src/__tests__/artifacts.test.ts |  23 ++
 packages/core/src/artifacts.ts                |   6 +-
 packages/core/src/image-delivery.ts           |  25 ++
 .../chat-image-contract-share.json            |   5 -
 .../src/__tests__/chat-image-delivery.test.ts | 270 ++++++++++++++----
 .../__tests__/execution-composition.test.ts   |  85 ++++++
 .../src/__tests__/protocol.test.ts            |   3 +
 .../src/protocol/image-delivery.ts            |  12 +-
 .../src/server/chat-image-delivery.ts         | 129 ++++-----
 .../src/server/chat-image-source.ts           |   9 +-
 .../src/server/execution-composition.ts       |  25 +-
 .../runtime/src/__tests__/image-file.test.ts  |  12 +
 packages/runtime/src/image-file.ts            |  11 +-
 .../src/system-prompt/main-session-prompt.ts  |   4 +-
 .../scripts/markdown-images.browser.test.mjs  | 112 ++++++--
 .../ui/src/__tests__/markdown-body.test.ts    |   8 +-
 packages/ui/src/image-delivery.tsx            |  12 +-
 packages/ui/src/markdown-image.tsx            |  17 +-
 packages/ui/src/shared-ui-copy.ts             |  47 ++-
 packages/ui/stories/attachment.stories.tsx    |  31 ++
 30 files changed, 702 insertions(+), 202 deletions(-)
 delete mode 100644 packages/runtime-host/protocol-compatible-changes/chat-image-contract-share.json

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 38f5017431..850760db73 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -450,9 +450,13 @@ jobs:
       # The smoke only launches headless; the full Chrome build was downloaded
       # and never opened. The headed consumer (perf/storybook.mjs) self-installs.
       - name: Install Playwright Chromium
-        if: steps.plan.outputs.storybook == 'true'
+        if: steps.plan.outputs.storybook == 'true' || contains(steps.plan.outputs.standard_workspaces, 'packages/ui')
         run: npx playwright install --with-deps --only-shell chromium
 
+      - name: Markdown image security and layout
+        if: steps.plan.outputs.storybook == 'true' || contains(steps.plan.outputs.standard_workspaces, 'packages/ui')
+        run: node --test packages/ui/scripts/markdown-images.browser.test.mjs
+
       - name: Build Storybook
         if: steps.plan.outputs.storybook == 'true'
         run: npm --workspace @maka/desktop run build-storybook
diff --git a/apps/desktop/scripts/check-renderer-architecture.test.mjs b/apps/desktop/scripts/check-renderer-architecture.test.mjs
index b1236071e2..2295af9530 100644
--- a/apps/desktop/scripts/check-renderer-architecture.test.mjs
+++ b/apps/desktop/scripts/check-renderer-architecture.test.mjs
@@ -317,7 +317,7 @@ function canonicalRendererEntryHtml(
         <meta name="referrer" content="no-referrer" />
         <meta
           http-equiv="Content-Security-Policy"
-          content="default-src 'self'; ${policy}; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; connect-src 'self'"
+          content="default-src 'self'; ${policy}; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; connect-src 'self'"
         />
         <title>Maka</title>
         <style>body { margin: 0; }</style>
diff --git a/apps/desktop/scripts/vite-renderer-entry-contract.ts b/apps/desktop/scripts/vite-renderer-entry-contract.ts
index 4e9ed2c98a..0a1403043a 100644
--- a/apps/desktop/scripts/vite-renderer-entry-contract.ts
+++ b/apps/desktop/scripts/vite-renderer-entry-contract.ts
@@ -40,7 +40,7 @@ const ALLOWED_HTML_TAGS = new Set([
   'title',
 ]);
 const CONTENT_SECURITY_POLICY =
-  "default-src 'self'; script-src 'self' maka-client-plugin:; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; connect-src 'self'";
+  "default-src 'self'; script-src 'self' maka-client-plugin:; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; connect-src 'self'";
 
 function normalizePath(path: string): string {
   return path.split(sep).join('/');
diff --git a/apps/desktop/src/main/__tests__/runtime-host-artifacts-ipc-main.test.ts b/apps/desktop/src/main/__tests__/runtime-host-artifacts-ipc-main.test.ts
index 420765c7e0..5d7619bb04 100644
--- a/apps/desktop/src/main/__tests__/runtime-host-artifacts-ipc-main.test.ts
+++ b/apps/desktop/src/main/__tests__/runtime-host-artifacts-ipc-main.test.ts
@@ -26,6 +26,28 @@ import { test } from "node:test";
 import { registerRuntimeHostArtifactsIpc } from "../runtime-host-artifacts-ipc-main.js";
 import { ManagedArtifactPreview } from '../managed-artifact-preview.js';
 
+test('image resolution validates renderer requests before forwarding them', async () => {
+  const handlers = new Map<string, Handler>();
+  const forwarded: unknown[] = [];
+  registerRuntimeHostArtifactsIpc({
+    uiLocale: () => 'en',
+    ipcMain: { handle: (channel, handler) => handlers.set(channel, handler as Handler) },
+    client: { hostEpoch: 'host', resolveImageDelivery: async (...args: unknown[]) => {
+      forwarded.push(args); return { status: 'requires_confirmation' };
+    } } as never,
+    mainWindowController: {} as never,
+    showItemInFolder() {},
+  });
+  const resolve = handlers.get('attachments:resolveImage')!;
+  const request = { turnId: 'turn', messageId: 'message', source: 'https://example.invalid/image.png', loadRemote: true };
+  await resolve({}, 'session', request);
+  assert.deepEqual(forwarded, [['session', request]]);
+  for (const invalid of [null, { ...request, sessionId: 'other' }, { ...request, loadRemote: 'yes' }, { ...request, source: 'bad\nurl' }]) {
+    await assert.rejects(async () => resolve({}, 'session', invalid), /Invalid image delivery request/);
+  }
+  assert.equal(forwarded.length, 1);
+});
+
 for (const launchFails of [false, true]) {
   test(`HTML external open uses the managed endpoint and reports launch failure=${launchFails}`, async () => {
     const service = new ManagedArtifactPreview();
diff --git a/apps/desktop/src/main/__tests__/runtime-host-client-operations.test.ts b/apps/desktop/src/main/__tests__/runtime-host-client-operations.test.ts
index d852e9f8d1..c577a7cfd3 100644
--- a/apps/desktop/src/main/__tests__/runtime-host-client-operations.test.ts
+++ b/apps/desktop/src/main/__tests__/runtime-host-client-operations.test.ts
@@ -34,6 +34,18 @@ import {
   DesktopRuntimeHostClientError,
 } from '../runtime-host-client.js';
 
+test('image resolution keeps the routed session even if a request carries another id', async () => {
+  const { client, requests } = clientWithResponses([{ status: 'requires_confirmation' }]);
+  await client.resolveImageDelivery('routed-session', {
+    sessionId: 'injected-session', turnId: 'turn', messageId: 'message',
+    source: 'https://example.invalid/image.png', loadRemote: true,
+  } as import('@maka/core/image-delivery').ImageDeliveryRequest);
+  assert.deepEqual(requests, [{ operation: 'artifact.image.resolve', input: {
+    sessionId: 'routed-session', turnId: 'turn', messageId: 'message',
+    source: 'https://example.invalid/image.png', loadRemote: true,
+  } }]);
+});
+
 test('restarts a paginated catalog read instead of mixing revisions', async () => {
   const revisionOne = catalogRevision('1');
   const revisionTwo = catalogRevision('2');
diff --git a/apps/desktop/src/main/runtime-host-artifacts-ipc-main.ts b/apps/desktop/src/main/runtime-host-artifacts-ipc-main.ts
index faa7b7161b..203daf8ac3 100644
--- a/apps/desktop/src/main/runtime-host-artifacts-ipc-main.ts
+++ b/apps/desktop/src/main/runtime-host-artifacts-ipc-main.ts
@@ -18,6 +18,7 @@
  */
 
 import type { UiCatalog, UiLocale } from '@maka/core/ui-locale';
+import { isImageDeliveryRequest } from '@maka/core/image-delivery';
 import { randomUUID } from "node:crypto";
 import { open, mkdir, rename, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
@@ -89,7 +90,10 @@ export function registerRuntimeHostArtifactsIpc(
       return result;
     },
   );
-  deps.ipcMain.handle('attachments:resolveImage', (_event, sessionId: string, request: import('@maka/core/image-delivery').ImageDeliveryRequest) => deps.client.resolveImageDelivery(sessionId, request));
+  deps.ipcMain.handle('attachments:resolveImage', (_event, sessionId: string, request: unknown) => {
+    if (!isImageDeliveryRequest(request)) throw new Error('Invalid image delivery request');
+    return deps.client.resolveImageDelivery(sessionId, request);
+  });
   registerRuntimeHostAttachmentPreviewIpc(deps);
   const materializePresentationArtifact = async (
     sessionId: string,
diff --git a/apps/desktop/src/main/runtime-host-client.ts b/apps/desktop/src/main/runtime-host-client.ts
index 7272fe6d27..a90cba26e8 100644
--- a/apps/desktop/src/main/runtime-host-client.ts
+++ b/apps/desktop/src/main/runtime-host-client.ts
@@ -868,7 +868,7 @@ export class DesktopRuntimeHostClient {
   }
 
   resolveImageDelivery(sessionId: string, request: import('@maka/core/image-delivery').ImageDeliveryRequest): Promise<import('@maka/core/image-delivery').ImageDeliveryResult> {
-    return this.request('artifact.image.resolve', { sessionId, ...request });
+    return this.request('artifact.image.resolve', { ...request, sessionId });
   }
 
   async listArtifacts(sessionId: string): Promise<ArtifactProjection[]> {
diff --git a/apps/desktop/src/renderer/index.html b/apps/desktop/src/renderer/index.html
index aa66e09e36..ad98a582be 100644
--- a/apps/desktop/src/renderer/index.html
+++ b/apps/desktop/src/renderer/index.html
@@ -25,7 +25,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <meta
       http-equiv="Content-Security-Policy"
-      content="default-src 'self'; script-src 'self' maka-client-plugin:; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; connect-src 'self'"
+      content="default-src 'self'; script-src 'self' maka-client-plugin:; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; connect-src 'self'"
     />
     <title>Maka</title>
     <style>
diff --git a/package-lock.json b/package-lock.json
index ef69dab255..171b7645a5 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -17727,7 +17727,7 @@
       "license": "Apache-2.0",
       "dependencies": {
         "intl-messageformat": "11.2.15",
-        "marked": "^18.0.11"
+        "marked": "18.0.11"
       }
     },
     "packages/core/node_modules/@formatjs/icu-messageformat-parser": {
diff --git a/packages/core/package.json b/packages/core/package.json
index e88b3b09d9..cdfa244469 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -182,6 +182,6 @@
   },
   "dependencies": {
     "intl-messageformat": "11.2.15",
-    "marked": "^18.0.11"
+    "marked": "18.0.11"
   }
 }
diff --git a/packages/core/src/__tests__/artifacts.test.ts b/packages/core/src/__tests__/artifacts.test.ts
index 66fd52cb00..b2489ad63a 100644
--- a/packages/core/src/__tests__/artifacts.test.ts
+++ b/packages/core/src/__tests__/artifacts.test.ts
@@ -59,6 +59,29 @@ describe('Artifact turn key', () => {
 });
 
 describe('Artifact source policy', () => {
+  test('image delivery placeholders are not child-result outputs', () => {
+    for (const status of ['pending', 'failed'] as const) {
+      assert.equal(
+        isArtifactChildResultOutput({
+          source: 'tool_result_projection',
+          imageDelivery: { messageId: 'message', source: '/tmp/image.png', status },
+        }),
+        false,
+      );
+    }
+    assert.equal(
+      isArtifactChildResultOutput({
+        source: 'tool_result_projection',
+        imageDelivery: {
+          messageId: 'message',
+          source: '/tmp/image.png',
+          status: 'ready',
+          contentSha256: 'a'.repeat(64),
+        },
+      }),
+      true,
+    );
+  });
   test('keeps workflow-owned evidence out of independent user deletion', () => {
     for (const source of ARTIFACT_SOURCES) {
       assert.equal(
diff --git a/packages/core/src/artifacts.ts b/packages/core/src/artifacts.ts
index 1cd87adc5c..6a0e99e102 100644
--- a/packages/core/src/artifacts.ts
+++ b/packages/core/src/artifacts.ts
@@ -186,7 +186,11 @@ export function isArtifactSharedSessionReadable(record: Pick<ArtifactRecord, 'so
   return ARTIFACT_SOURCE_POLICIES[record.source].sharedReadable;
 }
 
-export function isArtifactChildResultOutput(record: Pick<ArtifactRecord, 'source'>): boolean {
+export function isArtifactChildResultOutput(
+  record: Pick<ArtifactRecord, 'source'> & Partial<Pick<ArtifactRecord, 'imageDelivery'>>,
+): boolean {
+  if (record.imageDelivery?.status === 'pending' || record.imageDelivery?.status === 'failed')
+    return false;
   return CHILD_RESULT_OUTPUT_SOURCES.has(record.source);
 }
 
diff --git a/packages/core/src/image-delivery.ts b/packages/core/src/image-delivery.ts
index f320d6a9d8..d1193b9c3f 100644
--- a/packages/core/src/image-delivery.ts
+++ b/packages/core/src/image-delivery.ts
@@ -30,6 +30,28 @@ export function isImageDeliverySource(value: unknown): value is string {
     !/[\x00-\x1f\x7f]/.test(value)
   );
 }
+export function isRemoteImageSource(source: string): boolean {
+  return /^https?:/i.test(source);
+}
+export function isImageDeliveryRequest(value: unknown): value is ImageDeliveryRequest {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
+  const v = value as Record<string, unknown>;
+  const identity = (s: unknown) =>
+    typeof s === 'string' &&
+    s.length > 0 &&
+    s.length <= IMAGE_DELIVERY_IDENTITY_MAX_LENGTH &&
+    !/[\x00-\x1f\x7f]/.test(s);
+  return (
+    Object.keys(v).every((k) =>
+      ['turnId', 'messageId', 'source', 'retry', 'loadRemote'].includes(k),
+    ) &&
+    identity(v.turnId) &&
+    identity(v.messageId) &&
+    isImageDeliverySource(v.source) &&
+    (v.retry === undefined || typeof v.retry === 'boolean') &&
+    (v.loadRemote === undefined || typeof v.loadRemote === 'boolean')
+  );
+}
 export const IMAGE_DELIVERY_FAILURES = [
   'not_found',
   'not_allowed',
@@ -46,8 +68,11 @@ export interface ImageDeliveryRequest {
   readonly messageId: string;
   readonly source: string;
   readonly retry?: boolean;
+  /** Explicit user action; the Host must also allow networking for this session. */
+  readonly loadRemote?: boolean;
 }
 export type ImageDeliveryResult =
+  | { readonly status: 'requires_confirmation' }
   | { readonly status: 'pending' }
   | { readonly status: 'ready'; readonly artifactId: string }
   | { readonly status: 'failed'; readonly reason: ImageDeliveryFailure }
diff --git a/packages/runtime-host/protocol-compatible-changes/chat-image-contract-share.json b/packages/runtime-host/protocol-compatible-changes/chat-image-contract-share.json
deleted file mode 100644
index 3a050d31b6..0000000000
--- a/packages/runtime-host/protocol-compatible-changes/chat-image-contract-share.json
+++ /dev/null
@@ -1,5 +0,0 @@
-{
-  "epoch": 206,
-  "files": ["packages/runtime-host/src/protocol/image-delivery.ts"],
-  "reason": "Shares the existing 512-character identity bound and 4096-character non-empty, control-free source validation with the core image delivery contract. Accepted and rejected request values, validation order, frame keys, output decoding and protocol errors are unchanged."
-}
diff --git a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
index bff2fff7bb..409b603951 100644
--- a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
+++ b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
@@ -53,6 +53,7 @@ async function fixture(
   limits?: { sessionBytes: number; workspaceBytes: number },
   readLocalImage?: ChatImageDeliveryPorts['readLocalImage'],
   beforeCreate?: (input: Parameters<ChatImageDeliveryPorts['artifacts']['create']>[0]) => void,
+  download?: ChatImageDeliveryPorts['download'],
 ) {
   const root = await mkdtemp(join(tmpdir(), 'maka-image-delivery-'));
   const owner = await tryAcquireInteractiveRootOwner(
@@ -62,6 +63,9 @@ async function fixture(
   const store = await openInteractiveArtifactStoreForWrite(owner.lease);
   const authority = { store, close: () => store.close() };
   const errors: unknown[] = [];
+  const presentationErrors: unknown[] = [];
+  let remoteAllowed = true;
+  let loopbackOrigin: string | undefined;
   let reads = 0;
   let leases = 0;
   const messages = new Map<string, string>();
@@ -77,6 +81,10 @@ async function fixture(
     },
     admission: new SessionAdmissionGate(),
     limits,
+    sourceReadTimeoutMs: 1000,
+    canLoadRemote: async () => remoteAllowed,
+    download:
+      download ?? ((source, signal) => downloadChatImage(source, signal, { loopbackOrigin })),
     isPresent: async () => present,
     readMessage: async (i) => messages.get(i.messageId),
     readLocalImage: async (sessionId, path, signal) => {
@@ -93,6 +101,7 @@ async function fixture(
       };
     },
     persistenceFailed: (error) => errors.push(error),
+    presentationFailed: (error) => presentationErrors.push(error),
   });
   return {
     root,
@@ -101,6 +110,13 @@ async function fixture(
     service,
     messages,
     errors,
+    presentationErrors,
+    allowRemote(value: boolean) {
+      remoteAllowed = value;
+    },
+    trustRemoteOrigin(source: string) {
+      loopbackOrigin = new URL(source).origin;
+    },
     get reads() {
       return reads;
     },
@@ -425,8 +441,19 @@ test('remote delivery is downloaded once, remains replayable after the origin se
   await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
   const source = `http://127.0.0.1:${(server.address() as import('node:net').AddressInfo).port}/image.png`;
   try {
+    f.trustRemoteOrigin(source);
+    f.messages.set(REQUEST.messageId, `![Screenshot](${source})`);
     observe(f.service, source);
     await f.service.waitForIdle();
+    assert.equal(requests, 0);
+    assert.deepEqual(await f.service.resolve({ ...REQUEST, source }), {
+      status: 'requires_confirmation',
+    });
+    assert.equal(
+      (await f.service.resolve({ ...REQUEST, source, loadRemote: true })).status,
+      'pending',
+    );
+    await f.service.waitForIdle();
     assert.deepEqual(f.errors, []);
     assert.equal((await f.service.resolve({ ...REQUEST, source })).status, 'ready');
     assert.equal(requests, 1);
@@ -483,9 +510,11 @@ test('truncated HTTP images are rejected, and an explicit retry archives the rep
   });
   await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
   const source = `http://127.0.0.1:${(server.address() as import('node:net').AddressInfo).port}/image.png`;
-  const identity = { ...REQUEST, source };
+  const identity = { ...REQUEST, source, loadRemote: true };
   try {
-    observe(f.service, source);
+    f.trustRemoteOrigin(source);
+    f.messages.set(REQUEST.messageId, `![Screenshot](${source})`);
+    await f.service.resolve(identity);
     await f.service.waitForIdle();
     assert.deepEqual(await f.service.resolve(identity), {
       status: 'failed',
@@ -520,63 +549,37 @@ test('truncated HTTP images are rejected, and an explicit retry archives the rep
   }
 });
 
-test('explicit decode retries replace a legacy ready image and share concurrent capture', async () => {
+test('ready image retries retain the only saved copy after its source is deleted', async () => {
   const f = await fixture();
-  let requests = 0;
-  let release!: () => void;
-  const gate = new Promise<void>((resolve) => {
-    release = resolve;
-  });
-  const server = createServer((_req, res) => {
-    requests++;
-    void gate.then(() => {
-      res.setHeader('Content-Type', 'image/png');
-      res.end(PNG);
-    });
-  });
-  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
-  const source = `http://127.0.0.1:${(server.address() as import('node:net').AddressInfo).port}/image.png`;
-  const identity = { ...REQUEST, source };
+  const source = join(f.root, 'temporary.png');
   try {
-    const broken = PNG.subarray(0, 8);
-    await f.authority.store.create({
-      id: 'legacy-image',
-      sessionId: identity.sessionId,
-      turnId: identity.turnId,
-      kind: 'image',
-      name: 'chat-image',
-      source: 'tool_result_projection',
-      content: broken,
-      mimeType: 'image/png',
-      imageDelivery: {
-        messageId: identity.messageId,
-        source,
-        status: 'ready',
-        contentSha256: createHash('sha256').update(broken).digest('hex'),
-      },
-    });
-    assert.deepEqual(await f.service.resolve(identity), {
-      status: 'ready',
-      artifactId: 'legacy-image',
-    });
-    assert.equal(requests, 0);
+    await writeFile(source, PNG);
+    observe(f.service, source);
+    await f.service.waitForIdle();
+    const identity = { ...REQUEST, source };
+    const ready = await f.service.resolve(identity);
+    assert.equal(ready.status, 'ready');
+    await rm(source);
     const retries = await Promise.all([
       f.service.resolve({ ...identity, retry: true }),
       f.service.resolve({ ...identity, retry: true }),
     ]);
-    assert.deepEqual(retries, [{ status: 'pending' }, { status: 'pending' }]);
-    release();
-    await f.service.waitForIdle();
-    const ready = await f.service.resolve(identity);
-    assert.equal(ready.status, 'ready');
-    assert.equal(requests, 1);
-    const page = await f.authority.store.listPage(identity.sessionId, { offset: 0, limit: 10 });
-    assert.equal(page.total, 1);
-    assert.equal(page.records[0]?.sizeBytes, PNG.length);
+    assert.deepEqual(retries, [ready, ready]);
+    assert.equal(f.reads, 1);
+    assert.equal(
+      (await f.authority.store.listPage(REQUEST.sessionId, { offset: 0, limit: 10 })).total,
+      1,
+    );
+    if (ready.status === 'ready') {
+      const bytes = await f.authority.store.readBinaryInSession(
+        REQUEST.sessionId,
+        ready.artifactId,
+      );
+      assert.ok(bytes.ok);
+      if (bytes.ok) assert.equal(bytes.base64, PNG.toString('base64'));
+    }
     assert.deepEqual(f.errors, []);
   } finally {
-    release();
-    await new Promise<void>((resolve) => server.close(() => resolve()));
     await f.close();
   }
 });
@@ -757,7 +760,12 @@ test('source readers reject oversized payloads, unsafe MIME and redirects to pri
   await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
   try {
     const source = `http://127.0.0.1:${(server.address() as import('node:net').AddressInfo).port}/redirect`;
-    await assert.rejects(downloadChatImage(source, AbortSignal.timeout(2000)), /not_allowed/);
+    await assert.rejects(
+      downloadChatImage(source, AbortSignal.timeout(2000), {
+        loopbackOrigin: new URL(source).origin,
+      }),
+      /not_allowed/,
+    );
   } finally {
     await new Promise<void>((resolve) => server.close(() => resolve()));
   }
@@ -767,6 +775,164 @@ test('resolver codec rejects excess fields and noncanonical artifact identities'
   assert.deepEqual(spec.decodeInput(REQUEST), REQUEST);
   assert.throws(() => spec.decodeInput({ ...REQUEST, arbitraryRead: true }));
   assert.throws(() => spec.decodeOutput({ status: 'ready', artifactId: '../private' }));
+  assert.deepEqual(spec.decodeInput({ ...REQUEST, loadRemote: true }), {
+    ...REQUEST,
+    loadRemote: true,
+  });
+  assert.deepEqual(spec.decodeOutput({ status: 'requires_confirmation' }), {
+    status: 'requires_confirmation',
+  });
+  assert.throws(() => spec.decodeInput({ ...REQUEST, loadRemote: 'true' }));
+  assert.throws(() => spec.decodeOutput({ status: 'requires_confirmation', source: '/private' }));
+});
+
+test('remote capture requires a user action and current network authority, including on retry', async () => {
+  let downloads = 0;
+  const f = await fixture(undefined, undefined, undefined, async () => {
+    downloads++;
+    return checkedChatImage(PNG);
+  });
+  const source = 'https://example.invalid/image.png?data=secret';
+  const identity = { ...REQUEST, source };
+  f.messages.set(REQUEST.messageId, `![](${source})`);
+  try {
+    observe(f.service, source);
+    await f.service.waitForIdle();
+    assert.equal(downloads, 0);
+    assert.deepEqual(await f.service.resolve(identity), { status: 'requires_confirmation' });
+    f.allowRemote(false);
+    assert.deepEqual(await f.service.resolve({ ...identity, loadRemote: true }), {
+      status: 'failed',
+      reason: 'not_allowed',
+    });
+    assert.equal(downloads, 0);
+    assert.equal(
+      (await f.authority.store.listPage(REQUEST.sessionId, { offset: 0, limit: 10 })).total,
+      0,
+    );
+    f.allowRemote(true);
+    assert.deepEqual(await f.service.resolve({ ...identity, loadRemote: true }), {
+      status: 'pending',
+    });
+    await f.service.waitForIdle();
+    assert.equal(downloads, 1);
+    const ready = await f.service.resolve(identity);
+    assert.equal(ready.status, 'ready');
+    f.allowRemote(false);
+    assert.deepEqual(await f.service.resolve({ ...identity, retry: true }), ready);
+    assert.equal(downloads, 1, 'saved replay/retry never contacts origin');
+    assert.deepEqual(
+      await f.service.resolve({
+        ...identity,
+        source: 'https://example.invalid/forged',
+        loadRemote: true,
+      }),
+      { status: 'unavailable' },
+    );
+  } finally {
+    await f.close();
+  }
+});
+
+test('failed remote downloads issue one request and require explicit retry consent', async () => {
+  let downloads = 0;
+  const f = await fixture(undefined, undefined, undefined, async () => {
+    downloads++;
+    throw new Error('offline');
+  });
+  const source = 'https://example.invalid/image.png';
+  const identity = { ...REQUEST, source };
+  f.messages.set(REQUEST.messageId, `![](${source})`);
+  try {
+    await f.service.resolve({ ...identity, loadRemote: true });
+    await f.service.waitForIdle();
+    assert.equal(downloads, 1);
+    assert.deepEqual(await f.service.resolve({ ...identity, retry: true }), {
+      status: 'requires_confirmation',
+    });
+    assert.equal(downloads, 1);
+    await f.service.resolve({ ...identity, retry: true, loadRemote: true });
+    await f.service.waitForIdle();
+    assert.equal(downloads, 2);
+  } finally {
+    await f.close();
+  }
+});
+
+test('unsettled reference destinations never open half-written local paths', async () => {
+  const f = await fixture(undefined, async () => checkedChatImage(PNG));
+  try {
+    f.service.observe(REQUEST.sessionId, {
+      type: 'text_delta',
+      id: 'delta',
+      ts: 1,
+      turnId: REQUEST.turnId,
+      messageId: REQUEST.messageId,
+      text: '![image][ref]\n\n[ref]: /tmp/partial',
+    });
+    await new Promise((resolve) => setTimeout(resolve, 300));
+    assert.equal(f.reads, 0);
+    observe(f.service, '/tmp/partial-complete.png');
+    await f.service.waitForIdle();
+    assert.equal(f.reads, 1);
+  } finally {
+    await f.close();
+  }
+});
+
+test('a Markdown parser failure stays in presentation and subsequent images still capture', async () => {
+  const f = await fixture(undefined, async () => checkedChatImage(PNG));
+  try {
+    f.service.observe(REQUEST.sessionId, {
+      type: 'text_complete',
+      id: 'deep-text',
+      ts: 1,
+      turnId: REQUEST.turnId,
+      messageId: REQUEST.messageId,
+      text: '> '.repeat(5000) + '![](/tmp/image.png)',
+    });
+    assert.equal(f.presentationErrors.length, 1);
+    assert.ok(f.presentationErrors[0] instanceof RangeError);
+    assert.deepEqual(f.errors, []);
+    observe(f.service, REQUEST.source);
+    await f.service.waitForIdle();
+    assert.equal((await f.service.resolve(REQUEST)).status, 'ready');
+  } finally {
+    await f.close();
+  }
+});
+
+test('loopback is denied before GET and a served-origin grant cannot follow another local port', async () => {
+  let hits = 0;
+  const target = createServer((_req, res) => {
+    hits++;
+    res.end(PNG);
+  });
+  await new Promise<void>((resolve) => target.listen(0, '127.0.0.1', resolve));
+  const targetUrl = `http://127.0.0.1:${(target.address() as import('node:net').AddressInfo).port}/image.png`;
+  const origin = createServer((_req, res) => {
+    res.writeHead(302, { location: targetUrl });
+    res.end();
+  });
+  await new Promise<void>((resolve) => origin.listen(0, '127.0.0.1', resolve));
+  const source = `http://127.0.0.1:${(origin.address() as import('node:net').AddressInfo).port}/redirect`;
+  try {
+    for (const url of [targetUrl, 'http://[::1]:80/image.png'])
+      await assert.rejects(downloadChatImage(url, AbortSignal.timeout(1000)), /not_allowed/);
+    await assert.rejects(
+      downloadChatImage(source, AbortSignal.timeout(1000), {
+        loopbackOrigin: new URL(source).origin,
+      }),
+      /not_allowed/,
+    );
+    assert.equal(hits, 0);
+  } finally {
+    await Promise.all(
+      [target, origin].map(
+        (server) => new Promise<void>((resolve) => server.close(() => resolve())),
+      ),
+    );
+  }
 });
 
 test('completed turns release unfinished stream slots without archiving partial messages', async () => {
diff --git a/packages/runtime-host/src/__tests__/execution-composition.test.ts b/packages/runtime-host/src/__tests__/execution-composition.test.ts
index 29c935adfb..a2a656c863 100644
--- a/packages/runtime-host/src/__tests__/execution-composition.test.ts
+++ b/packages/runtime-host/src/__tests__/execution-composition.test.ts
@@ -4727,3 +4727,88 @@ test('production Host automatically archives assistant Markdown images and serve
     }
   });
 });
+
+test('production Host never downloads remote Markdown images in restricted session modes', async () => {
+  await withCompositionRoot(async ({ root, owner }) => {
+    let requests = 0;
+    const server = createServer((_request, response) => {
+      requests++;
+      response.end();
+    });
+    await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+    const source = `http://127.0.0.1:${(server.address() as import('node:net').AddressInfo).port}/secret.png`;
+    const captured = await createCapturedExecutionComposition(owner, {
+      primaryBackendFactory: (context) =>
+        new (class extends FakeBackend {
+          override async *send(input: BackendSendInput): AsyncIterable<SessionEvent> {
+            yield {
+              type: 'text_complete',
+              id: `text-${input.turnId}`,
+              turnId: input.turnId,
+              ts: Date.now(),
+              messageId: `message-${input.turnId}`,
+              text: `![](${source})`,
+            };
+            yield {
+              type: 'complete',
+              id: `complete-${input.turnId}`,
+              turnId: input.turnId,
+              ts: Date.now(),
+              stopReason: 'end_turn',
+            };
+          }
+        })(context),
+      context: {
+        retainUntilProcessExit: () => undefined,
+        requestDrain: () => assert.fail('remote images must not drain Host'),
+      },
+    });
+    try {
+      for (const permissionMode of ['explore', 'ask'] as const) {
+        const session = await captured.manager.createSession({
+          cwd: root,
+          llmConnectionId: FAKE_CONNECTION_ID,
+          llmConnectionSlug: 'fake',
+          model: 'fake-model',
+          permissionMode,
+        });
+        const context = {
+          hostEpoch: 'execution-composition-test',
+          connectionId: 'image-client',
+          principal: 'local_os_user',
+          acquireResidency: () => ({ release() {} }),
+        };
+        const turnId = `remote-${permissionMode}`;
+        assert.equal(
+          (
+            await captured.composition.handlers['turn.start'](
+              { sessionId: session.id, turnId, content: { text: 'deliver image' } },
+              context,
+            )
+          ).ok,
+          true,
+        );
+        const request = { sessionId: session.id, turnId, messageId: `message-${turnId}`, source };
+        await waitFor(async () => {
+          const result = await captured.composition.handlers['artifact.image.resolve'](
+            request,
+            context,
+          );
+          return result.ok && result.result.status === 'requires_confirmation';
+        }, 5000);
+        assert.deepEqual(
+          await captured.composition.handlers['artifact.image.resolve'](
+            { ...request, loadRemote: true },
+            context,
+          ),
+          { ok: true, result: { status: 'failed', reason: 'not_allowed' } },
+        );
+      }
+      assert.equal(requests, 0);
+    } finally {
+      captured.composition.beginDrain();
+      await captured.composition.close();
+      await new Promise<void>((resolve) => server.close(() => resolve()));
+    }
+  });
+});
diff --git a/packages/runtime-host/src/__tests__/protocol.test.ts b/packages/runtime-host/src/__tests__/protocol.test.ts
index bce0ba4d4a..707e1524e8 100644
--- a/packages/runtime-host/src/__tests__/protocol.test.ts
+++ b/packages/runtime-host/src/__tests__/protocol.test.ts
@@ -133,6 +133,9 @@ describe('Runtime Host bootstrap protocol', () => {
     // field, so mixed-version peers must fail during the handshake instead.
     assert.ok(RUNTIME_HOST_COMPATIBILITY_EPOCH > 22);
   });
+  test('rejects peers predating remote image consent and image resolution', () => {
+    assert.ok(RUNTIME_HOST_COMPATIBILITY_EPOCH > 209);
+  });
 
   test('publishes a new compatibility epoch for Artifact invalidation frames', () => {
     assert.ok(RUNTIME_HOST_COMPATIBILITY_EPOCH > 196);
diff --git a/packages/runtime-host/src/protocol/image-delivery.ts b/packages/runtime-host/src/protocol/image-delivery.ts
index c22ec6826c..4ce40a4cb3 100644
--- a/packages/runtime-host/src/protocol/image-delivery.ts
+++ b/packages/runtime-host/src/protocol/image-delivery.ts
@@ -61,6 +61,9 @@ export const IMAGE_DELIVERY_OPERATION_SPECS = {
         ...(Object.hasOwn(requireRecord(value, 'image delivery request'), 'retry')
           ? ['retry']
           : []),
+        ...(Object.hasOwn(requireRecord(value, 'image delivery request'), 'loadRemote')
+          ? ['loadRemote']
+          : []),
       ]);
       const text = (s: unknown, max: number) => {
         if (typeof s !== 'string' || !s.length || s.length > max || /[\u0000-\u001f\u007f]/.test(s))
@@ -69,6 +72,8 @@ export const IMAGE_DELIVERY_OPERATION_SPECS = {
       };
       if (v.retry !== undefined && typeof v.retry !== 'boolean')
         throw invalidProtocolFrame('Invalid image retry flag');
+      if (v.loadRemote !== undefined && typeof v.loadRemote !== 'boolean')
+        throw invalidProtocolFrame('Invalid remote image load flag');
       const source = (s: unknown) => {
         if (!isImageDeliverySource(s))
           throw invalidProtocolFrame('Invalid image delivery identity');
@@ -80,11 +85,16 @@ export const IMAGE_DELIVERY_OPERATION_SPECS = {
         messageId: text(v.messageId, IMAGE_DELIVERY_IDENTITY_MAX_LENGTH),
         source: source(v.source),
         ...(v.retry === true ? { retry: true } : {}),
+        ...(v.loadRemote === true ? { loadRemote: true } : {}),
       };
     },
     decodeOutput(value) {
       const v = requireRecord(value, 'image delivery result');
-      if (v.status === 'pending' || v.status === 'unavailable') {
+      if (
+        v.status === 'pending' ||
+        v.status === 'unavailable' ||
+        v.status === 'requires_confirmation'
+      ) {
         requireExactRecord(v, 'image delivery status', ['status']);
         return { status: v.status };
       }
diff --git a/packages/runtime-host/src/server/chat-image-delivery.ts b/packages/runtime-host/src/server/chat-image-delivery.ts
index e9eb690098..1c37267465 100644
--- a/packages/runtime-host/src/server/chat-image-delivery.ts
+++ b/packages/runtime-host/src/server/chat-image-delivery.ts
@@ -20,9 +20,9 @@
 import { createHash } from 'node:crypto';
 import { ImageFileReadError } from '@maka/runtime/image-file-reader';
 import type { CompleteEvent, TextCompleteEvent, TextDeltaEvent } from '@maka/core/events';
-import { foldAssistantDelta } from '@maka/core/events';
 import {
   IMAGE_MARKDOWN_MAX_LENGTH,
+  isRemoteImageSource,
   type ImageArchiveLimits,
   type ImageDeliveryRequest,
   type ImageDeliveryResult,
@@ -62,8 +62,11 @@ export interface ChatImageDeliveryPorts {
   isPresent(sessionId: string): Promise<boolean>;
   readMessage(identity: DeliveryIdentity): Promise<string | undefined>;
   readLocalImage(sessionId: string, path: string, signal: AbortSignal): Promise<ChatImageBytes>;
+  canLoadRemote(sessionId: string): Promise<boolean>;
   acquireResidency(): { release(): void };
   persistenceFailed(error: unknown): void;
+  presentationFailed(error: unknown): void;
+  readonly sourceReadTimeoutMs?: number;
   readonly limits?: ImageArchiveLimits;
   readonly download?: typeof downloadChatImage;
 }
@@ -71,64 +74,28 @@ export interface ChatImageDeliveryPorts {
 export class ChatImageDeliveryService {
   readonly #jobs = new Map<string, DeliveryJob>();
   readonly #queue: DeliveryJob[] = [];
-  readonly #streams = new Map<
-    string,
-    { turnId: string; text: string; seen: Set<string>; timer?: ReturnType<typeof setTimeout> }
-  >();
   readonly #abort = new AbortController();
   #running = 0;
   #closed = false;
   constructor(private readonly ports: ChatImageDeliveryPorts) {}
 
   observe(sessionId: string, event: TextDeltaEvent | TextCompleteEvent | CompleteEvent): void {
-    if (this.#closed) return;
-    if (event.type === 'complete') {
-      for (const [key, stream] of this.#streams) {
-        if (key.startsWith(`${sessionId}\0`) && stream.turnId === event.turnId) {
-          clearTimeout(stream.timer);
-          this.#streams.delete(key);
-        }
-      }
+    if (
+      this.#closed ||
+      event.type !== 'text_complete' ||
+      event.text.length > IMAGE_MARKDOWN_MAX_LENGTH
+    )
       return;
-    }
-    const key = `${sessionId}\0${event.messageId}`;
-    let stream = this.#streams.get(key);
-    if (!stream) {
-      if (this.#streams.size >= 32) return;
-      stream = { turnId: event.turnId, text: '', seen: new Set() };
-      this.#streams.set(key, stream);
-    }
-    if (event.type === 'text_complete') stream.text = event.text;
-    else {
-      const folded = foldAssistantDelta(stream.text.length, event);
-      if (!folded) return;
-      stream.text += folded.tail;
-    }
-    if (stream.text.length > IMAGE_MARKDOWN_MAX_LENGTH) {
-      clearTimeout(stream.timer);
-      this.#streams.delete(key);
-      return;
-    }
-    const capture = () => {
-      stream!.timer = undefined;
-      for (const source of chatImageSources(stream!.text)) {
-        if (stream!.seen.has(source)) continue;
-        stream!.seen.add(source);
+    // Reference destinations can grow during streaming. Only settled text
+    // grants capture, and remote sources always require an explicit action.
+    try {
+      for (const source of chatImageSources(event.text)) {
+        if (isRemoteImageSource(source)) continue;
         this.#enqueue({ sessionId, turnId: event.turnId, messageId: event.messageId, source });
       }
-    };
-    if (event.type === 'text_complete') {
-      clearTimeout(stream.timer);
-      capture();
-      this.#streams.delete(key);
-    } else if (!stream.timer)
-      stream.timer = setTimeout(() => {
-        try {
-          capture();
-        } catch (error) {
-          if (!this.#closed) this.ports.persistenceFailed(error);
-        }
-      }, 250);
+    } catch (error) {
+      this.ports.presentationFailed(error);
+    }
   }
 
   async resolve(identity: DeliveryIdentity): Promise<ImageDeliveryResult> {
@@ -140,8 +107,8 @@ export class ChatImageDeliveryService {
       identity.source,
     );
     const metadata = record?.imageDelivery;
-    if (metadata?.status === 'ready' && !identity.retry)
-      return { status: 'ready', artifactId: record!.id };
+    // A browser decode/read failure is not authority to destroy saved history.
+    if (metadata?.status === 'ready') return { status: 'ready', artifactId: record!.id };
     if (metadata?.status === 'failed' && !identity.retry)
       return { status: 'failed', reason: metadata.reason! };
     if (this.#jobs.has(deliveryKey(identity))) return { status: 'pending' };
@@ -152,7 +119,12 @@ export class ChatImageDeliveryService {
       if (text === undefined || !chatImageSources(text).includes(identity.source))
         return { status: 'unavailable' };
     }
-    if (metadata?.status === 'failed' || metadata?.status === 'ready') {
+    if (isRemoteImageSource(identity.source)) {
+      if (!identity.loadRemote) return { status: 'requires_confirmation' };
+      if (!(await this.ports.canLoadRemote(identity.sessionId)))
+        return { status: 'failed', reason: 'not_allowed' };
+    }
+    if (metadata?.status === 'failed') {
       return this.ports.admission.runOrJoin(identity.sessionId, async () => {
         if (this.#closed) return { status: 'unavailable' };
         if (this.#jobs.has(deliveryKey(identity))) return { status: 'pending' };
@@ -195,7 +167,10 @@ export class ChatImageDeliveryService {
         try {
           await this.#capture(identity);
         } catch (error) {
-          if (!this.#abort.signal.aborted) this.ports.persistenceFailed(error);
+          if (!this.#abort.signal.aborted) {
+            if (error instanceof ImagePersistenceError) this.ports.persistenceFailed(error.cause);
+            else this.ports.presentationFailed(error);
+          }
         } finally {
           finish();
         }
@@ -236,15 +211,20 @@ export class ChatImageDeliveryService {
     const publish = async (input: Parameters<InteractiveArtifactStoreWriter['create']>[0]) =>
       this.ports.admission.runOrJoin(sessionId, async () => {
         if (this.#abort.signal.aborted || !(await this.ports.isPresent(sessionId))) return;
-        await this.ports.artifacts.create(input);
-        // Retain a pending request only until a terminal record is durable.
-        // A crash between these writes still replays the terminal record.
-        if (input.imageDelivery?.status !== 'pending')
-          await this.ports.artifacts.deleteOwnedArtifactInSession(
-            sessionId,
-            pendingId,
-            'tool_result_projection',
-          );
+        try {
+          await this.ports.artifacts.create(input);
+          // Retain a pending request only until a terminal record is durable.
+          // A crash between these writes still replays the terminal record.
+          if (input.imageDelivery?.status !== 'pending')
+            await this.ports.artifacts.deleteOwnedArtifactInSession(
+              sessionId,
+              pendingId,
+              'tool_result_projection',
+            );
+        } catch (error) {
+          if (error instanceof ImageArchiveQuotaError) throw error;
+          throw new ImagePersistenceError('Image persistence failed', { cause: error });
+        }
       });
     await publish({
       ...base,
@@ -254,7 +234,10 @@ export class ChatImageDeliveryService {
       imageDelivery: { ...metadata, status: 'pending' },
     });
     if (this.#abort.signal.aborted || !(await this.ports.isPresent(sessionId))) return;
-    const signal = AbortSignal.any([this.#abort.signal, AbortSignal.timeout(10_000)]);
+    const readAbort = new AbortController();
+    // Keep the read deadline alive even when a source has no active handles.
+    const deadline = setTimeout(() => readAbort.abort(), this.ports.sourceReadTimeoutMs ?? 10_000);
+    const signal = AbortSignal.any([this.#abort.signal, readAbort.signal]);
     let image: ChatImageBytes;
     try {
       const path = localImagePath(source);
@@ -278,16 +261,9 @@ export class ChatImageDeliveryService {
           );
         }
       } else {
-        try {
-          image = await (this.ports.download ?? downloadChatImage)(source, signal);
-        } catch (error) {
-          if (
-            signal.aborted ||
-            (error instanceof ImageSourceError && error.reason !== 'download_failed')
-          )
-            throw error;
-          image = await (this.ports.download ?? downloadChatImage)(source, signal);
-        }
+        if (!identity.loadRemote || !(await this.ports.canLoadRemote(sessionId)))
+          throw new ImageSourceError('not_allowed');
+        image = await (this.ports.download ?? downloadChatImage)(source, signal);
       }
     } catch (error) {
       if (this.#abort.signal.aborted) return;
@@ -299,6 +275,8 @@ export class ChatImageDeliveryService {
         imageDelivery: { ...metadata, status: 'failed', reason: failureReason(error, source) },
       });
       return;
+    } finally {
+      clearTimeout(deadline);
     }
     if (this.#abort.signal.aborted) return;
     if (signal.aborted) {
@@ -341,8 +319,6 @@ export class ChatImageDeliveryService {
   beginDrain(): void {
     this.#closed = true;
     this.#abort.abort();
-    for (const stream of this.#streams.values()) clearTimeout(stream.timer);
-    this.#streams.clear();
     for (const job of this.#queue.splice(0)) job.cancel();
   }
   async close(): Promise<void> {
@@ -353,6 +329,7 @@ export class ChatImageDeliveryService {
     await Promise.all([...this.#jobs.values()].map((job) => job.done));
   }
 }
+class ImagePersistenceError extends Error {}
 function deliveryKey(i: DeliveryIdentity): string {
   return createHash('sha256')
     .update(JSON.stringify([i.sessionId, i.turnId, i.messageId, i.source]))
diff --git a/packages/runtime-host/src/server/chat-image-source.ts b/packages/runtime-host/src/server/chat-image-source.ts
index 6ba5318944..fa64e383a4 100644
--- a/packages/runtime-host/src/server/chat-image-source.ts
+++ b/packages/runtime-host/src/server/chat-image-source.ts
@@ -76,16 +76,19 @@ export function decodedLocalImagePath(source: string): string | undefined {
 export async function downloadChatImage(
   source: string,
   signal: AbortSignal,
+  options: { readonly loopbackOrigin?: string } = {},
 ): Promise<ChatImageBytes> {
   let url = new URL(source);
+  // Only an embedding Host's exact served origin can opt into loopback. A
+  // public source cannot acquire this grant by redirecting into that origin.
+  const loopbackOrigin = url.origin === options.loopbackOrigin ? options.loopbackOrigin : undefined;
   for (let redirect = 0; redirect <= 3; redirect++) {
     signal.throwIfAborted();
     if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password)
       throw new ImageSourceError('not_allowed');
     const host = url.hostname.replace(/^\[|\]$/g, '');
-    // Literal loopback supports images served by this execution Host. Other private
-    // networks and DNS names resolving to them are never automatically fetched.
-    const literalLoopback = host === '127.0.0.1' || host === '::1';
+    const literalLoopback =
+      !!loopbackOrigin && url.origin === loopbackOrigin && (host === '127.0.0.1' || host === '::1');
     const addresses = isIP(host)
       ? [{ address: host, family: isIP(host) }]
       : await abortableLookup(host, signal);
diff --git a/packages/runtime-host/src/server/execution-composition.ts b/packages/runtime-host/src/server/execution-composition.ts
index 993b0f5cd7..d0e4a3d506 100644
--- a/packages/runtime-host/src/server/execution-composition.ts
+++ b/packages/runtime-host/src/server/execution-composition.ts
@@ -19,6 +19,7 @@
 
 import { createImageFileReader } from '@maka/runtime/image-file-reader';
 import { ChatImageDeliveryService } from './chat-image-delivery.js';
+import { createGenesisExecutionBoundary } from '@maka/core/sandbox-boundary';
 import { createWorkHubResultRuntime } from './workhub-result-runtime.js';
 import { createWorkHubInspectionTool } from './workhub-inspection-tool.js';
 import { copyWorkHubAttachmentsToTarget } from './workhub-message-attachments.js';
@@ -590,6 +591,20 @@ export async function createExecutionRuntimeHostComposition(
         console.warn('[runtime-host] Image delivery persistence failed', error);
         context.requestDrain();
       },
+      presentationFailed: (error) => {
+        console.warn('[runtime-host] Image presentation failed', error);
+      },
+      canLoadRemote: async (sessionId) => {
+        const [header, stored] = await Promise.all([
+          stores.sessionStore.readHeaderSnapshot(sessionId),
+          stores.sessionStore.readExecutionBoundary(sessionId),
+        ]);
+        const boundary = stored ?? createGenesisExecutionBoundary(header.permissionMode);
+        return (
+          boundary.kind === 'bypass' ||
+          (boundary.kind === 'managed' && boundary.profile.network.kind === 'enabled')
+        );
+      },
       readLocalImage: async (sessionId, path, abortSignal) => {
         const [header, boundary] = await Promise.all([
           stores.sessionStore.readHeaderSnapshot(sessionId),
@@ -792,9 +807,13 @@ export async function createExecutionRuntimeHostComposition(
         return Uint8Array.from(Buffer.from(result.base64, 'base64'));
       },
       list: async (invocation) =>
-        (await openedArtifactStore.listTurnArtifacts(invocation.sessionId, invocation.turnId)).map(
-          pluginAttachmentRef,
-        ),
+        (await openedArtifactStore.listTurnArtifacts(invocation.sessionId, invocation.turnId))
+          .filter(
+            (record) =>
+              record.imageDelivery?.status !== 'pending' &&
+              record.imageDelivery?.status !== 'failed',
+          )
+          .map(pluginAttachmentRef),
     });
     const webSearchService = createHostWebSearchService({
       policy: runtimePolicyStores.operations,
diff --git a/packages/runtime/src/__tests__/image-file.test.ts b/packages/runtime/src/__tests__/image-file.test.ts
index 9bc0d1f9a0..194ae70c55 100644
--- a/packages/runtime/src/__tests__/image-file.test.ts
+++ b/packages/runtime/src/__tests__/image-file.test.ts
@@ -43,6 +43,18 @@ const WIDE_PNG = Buffer.from(
   'iVBORw0KGgoAAAANSUhEUgAACgAAAAABCAYAAAASePczAAAAIUlEQVR4nO3BAQ0AAADCoPdPbQ43oAAAAAAAAAAAAIA7AygBAAEQnI5pAAAAAElFTkSuQmCC',
   'base64',
 );
+test('chat images cap both edge length and total decoded pixels', () => {
+  for (const [width, height] of [
+    [16_385, 1],
+    [8192, 8192],
+  ]) {
+    const bytes = Buffer.from(ONE_PIXEL_PNG);
+    bytes.writeUInt32BE(width, 16);
+    bytes.writeUInt32BE(height, 20);
+    assert.throws(() => validateImageBytes(bytes, 'chat'), /Image exceeds/);
+  }
+  assert.equal(validateImageBytes(WIDE_PNG, 'chat').mimeType, 'image/png');
+});
 
 test('chat reader preserves structured Worker failures independently of message wording', async () => {
   for (const [reason, expected] of [
diff --git a/packages/runtime/src/image-file.ts b/packages/runtime/src/image-file.ts
index cda689e278..c1f0ec5a71 100644
--- a/packages/runtime/src/image-file.ts
+++ b/packages/runtime/src/image-file.ts
@@ -125,6 +125,15 @@ export function validateImageBytes(
       `Image dimensions ${dimensions.width}x${dimensions.height} exceed the ${MAX_MODEL_IMAGE_EDGE}px model input limit; downscale it and try again.`,
     );
   }
+  // Compressed byte size does not bound renderer decoding memory. Permit large
+  // screenshots while rejecting pathological headers before archival/preview.
+  if (
+    purpose === 'chat' &&
+    (Math.max(dimensions.width, dimensions.height) > 16_384 ||
+      dimensions.width * dimensions.height > 32 * 1024 * 1024)
+  ) {
+    throw imageTooLargeError(purpose);
+  }
   return { bytes, mimeType };
 }
 
@@ -132,7 +141,7 @@ function imageTooLargeError(purpose: 'model' | 'chat' = 'model'): Error {
   return new ImageFileError(
     'ERR_IMAGE_TOO_LARGE',
     purpose === 'chat'
-      ? 'Image exceeds the 2 MiB chat preview limit; resize it before publishing.'
+      ? 'Image exceeds a chat preview limit (2 MiB, 16384px per edge, or 32 megapixels); resize it before publishing.'
       : READ_IMAGE_TOO_LARGE_MESSAGE,
   );
 }
diff --git a/packages/runtime/src/system-prompt/main-session-prompt.ts b/packages/runtime/src/system-prompt/main-session-prompt.ts
index eab9df35ad..c9f8914b73 100644
--- a/packages/runtime/src/system-prompt/main-session-prompt.ts
+++ b/packages/runtime/src/system-prompt/main-session-prompt.ts
@@ -52,8 +52,8 @@ Keep simple answers simple; do not add headings or lists to simple answers.
 Use short headings and flat lists to organize longer answers.
 Use fenced code blocks for multiline code and backticks for inline commands, paths, identifiers, and literal values.
 Prefer descriptive link text for external sources when it is available.
-To deliver a generated screenshot or local image, include a Markdown image with its absolute path. The Host automatically saves supported images referenced in assistant messages as session attachments; HTTP/HTTPS images can also be embedded directly. Reading an image for your own inspection does not deliver it.
-If you need to delete or replace the source file immediately, use PublishImage when available first and include its returned Markdown. Keep source files available until capture finishes. Images above the automatic save limit may be displayed without a saved copy.
+To deliver a generated screenshot or local image, include a Markdown image with its absolute path. The Host automatically saves supported local images after the assistant message completes. Remote images require the user to choose Load image and the session to allow network access; include them only when relevant to the user's request. Reading an image for your own inspection does not deliver it.
+If you need to delete or replace the source file immediately, use PublishImage when available first and include its returned Markdown. Keep source files available until capture finishes. Images above the save limits cannot be previewed automatically.
 Only claim an image was saved after publication succeeds. Saving does not confirm that the client displayed it.
 Follow a more specific format requested by the user or task.`;
 }
diff --git a/packages/ui/scripts/markdown-images.browser.test.mjs b/packages/ui/scripts/markdown-images.browser.test.mjs
index fec2172f84..40696bdfcb 100644
--- a/packages/ui/scripts/markdown-images.browser.test.mjs
+++ b/packages/ui/scripts/markdown-images.browser.test.mjs
@@ -145,29 +145,42 @@ before(async () => {
       const mode=new URLSearchParams(location.search).get('case') || 'remote';
       const destinations=${JSON.stringify(destinations)};
       const canonicalSources=${JSON.stringify(canonicalSources)};
-      let reads=0; window.imageReads=0; window.deliveryQueries=0; window.deliverySources=[]; window.deliveryReady=false; window.deliveryRetries=0;
+      let reads=0; const captured=new Map(); window.imageReads=0; window.deliveryQueries=0; window.deliverySources=[]; window.deliveryReady=false; window.deliveryRetries=0;
       const race=mode.endsWith('-race');
+      let messageId='message';
       let text=destinations[mode] ?? (mode==='attachment' ? '![Screenshot](maka://runtime/attachments/image-1)' :
         mode==='local' || mode==='local-saved' || race ? '![Screenshot](/tmp/private.png)' :
         '![Screenshot](${imageUrl}/'+(mode==='retry' ? 'retry.png' : 'image.png')+')');
       const root=createRoot(document.getElementById('root'));
-      const readBytes=async()=>{
+      const readBytes=async(_session,artifactId)=>{
+        if(captured.has(artifactId)) return captured.get(artifactId);
+        if(mode.startsWith('layout-')) await fetch('/fixture/'+encodeURIComponent(artifactId));
         if(mode.startsWith('badge-')) await fetch('/badge-attachment');
         if(mode==='geometry-saved') await fetch('/release-attachment');
         reads++; window.imageReads=reads; return (mode==='attachment' || mode==='read-retry-saved') && reads===1 ? {ok:false,reason:'read_failed'} :
-          {ok:true,base64:mode.startsWith('badge-') ? '${badge.toString('base64')}' : mode==='geometry-saved' ? '${screenshot.toString('base64')}' : mode==='corrupt-saved' && !window.deliveryRetries ? 'iVBORw0KGgo=' : '${png.toString('base64')}',mimeType:'image/png'};
+          {ok:true,base64:mode.startsWith('badge-') || artifactId.endsWith('badge.png') ? '${badge.toString('base64')}' : mode==='geometry-saved' || artifactId.endsWith('screenshot.png') ? '${screenshot.toString('base64')}' : mode==='corrupt-saved' && reads===1 ? 'iVBORw0KGgo=' : '${png.toString('base64')}',mimeType:'image/png'};
       };
-      const resolveDelivery=mode.endsWith('saved') || mode.endsWith('saving') || race ? async(_session,request)=>{
+      const preview=mode==='preview' || mode==='signed-preview' || mode==='local';
+      const seeded=mode.endsWith('saved') || mode.endsWith('saving') || race || mode.startsWith('badge-') || mode.startsWith('layout-');
+      const resolveDelivery=preview ? undefined : async(_session,request)=>{
         window.deliveryQueries++;
         window.deliverySource=request.source;
         window.deliverySources.push(request.source);
         if(canonicalSources[mode] && !canonicalSources[mode].includes(request.source)) return {status:'unavailable'};
         if(request.retry) window.deliveryRetries++;
+        if(!seeded) {
+          if(!request.loadRemote) return {status:'requires_confirmation'};
+          const response=await fetch('/capture?source='+encodeURIComponent(request.source));
+          const payload=await response.json();
+          if(!payload.ok) return {status:'failed',reason:'download_failed'};
+          captured.set(request.source,payload);
+          return {status:'ready',artifactId:request.source};
+        }
         if(race) return window.deliveryReady ? {status:'ready',artifactId:'saved-image'} : {status:'unavailable'};
         await new Promise(resolve=>setTimeout(resolve,100));
-        return mode.endsWith('saving') && window.deliveryQueries===1 ? {status:'pending'} : {status:'ready',artifactId:'saved-image'};
-      } : undefined;
-      const markdown=(streaming)=>React.createElement(Markdown,{text,streaming,settledText:race ? text : undefined,density:'compact',imageIdentity:{turnId:'turn',messageId:'message'}});
+        return mode.endsWith('saving') && window.deliveryQueries===1 ? {status:'pending'} : {status:'ready',artifactId:mode.startsWith('layout-') ? request.source : 'saved-image'};
+      };
+      const markdown=(streaming)=>React.createElement(Markdown,{text,streaming,settledText:race ? text : undefined,density:'compact',imageIdentity:{turnId:'turn',messageId}});
       const surface=(streaming)=>mode.startsWith('layout-') ? React.createElement('section',{className:mode==='layout-side' ? 'maka-quote-companion' : '',style:{width:mode==='layout-side' ? '360px' : '100%',maxWidth:'100%'}},
         React.createElement(ChatMessageList,{className:'maka-chat-message-list maka-chatContent',align:'top'},
           React.createElement('div',{className:'maka-transcript-turn maka-turn',style:{width:'100%',maxWidth:'var(--maka-reading-measure)',marginInline:'auto'}},
@@ -179,6 +192,7 @@ before(async () => {
               React.createElement(ImageDeliveryProvider,{sessionId:'session',resolve:resolveDelivery},
               React.createElement('div',{style:mode==='offscreen' ? {paddingTop:'2500px'} : {}},
                 surface(streaming)))))));
+      window.nextMessage=()=>{messageId='next-message'; render(false);};
       window.finishStream=()=>render(false);
       window.appendText=value=>{text+=value; render(true);};
       render();
@@ -192,6 +206,14 @@ before(async () => {
   const index = await readFile(new URL('../../../apps/desktop/src/renderer/index.html', import.meta.url), 'utf8');
   const csp = index.match(/http-equiv="Content-Security-Policy"\s+content="([^"]+)"/)[1];
   appServer = createServer((req, res) => {
+    if (req.url.startsWith('/capture?')) {
+      const source=new URL(req.url, appUrl).searchParams.get('source');
+      void fetch(source).then(async response=> {
+        const payload=response.ok ? {ok:true,base64:Buffer.from(await response.arrayBuffer()).toString('base64'),mimeType:'image/png'} : {ok:false};
+        res.setHeader('Content-Type','application/json'); res.end(JSON.stringify(payload));
+      }).catch(()=>res.end(JSON.stringify({ok:false}))); return;
+    }
+    if (req.url.startsWith('/fixture/')) { res.end(); return; }
     if (req.url === '/badge-attachment') { res.end(); return; }
     if (req.url === '/release-attachment') { void delayedAttachment.then(() => res.end()); return; }
     if (req.url === '/app.js') { res.setHeader('Content-Type', 'text/javascript'); res.end(js); }
@@ -223,29 +245,57 @@ async function loaded(page) {
   await page.waitForFunction(() => [...document.images].some(image => image.naturalWidth === 1));
 }
 
-test('remote image loads automatically under the actual desktop CSP, without sending a referrer', async () => {
+test('a remote image sends no request until clicked, then renders Host-owned bytes', async () => {
   requests = [];
   const page = await pageFor('remote');
   try {
-    assert.equal(await page.getByRole('button', { name: 'Load image', exact: true }).count(), 0);
+    await page.getByRole('button', { name: 'Load image', exact: true }).waitFor();
+    assert.deepEqual(requests, []);
+    assert.equal(await page.locator('img').count(), 0);
+    await page.getByRole('button', { name: 'Load image', exact: true }).click();
     await loaded(page);
     assert.deepEqual(requests, [{ path: '/image.png', referer: undefined }]);
-    // Astryx Button keeps an empty live region for asynchronous actions.
-    await page.getByText('Loading image…', { exact: true }).waitFor({ state: 'hidden' });
-    assert.equal(await page.getByRole('status').filter({ hasText: /\S/ }).count(), 0);
+    assert.match(await page.locator('img').getAttribute('src'), /^data:/);
   } finally { await page.close(); }
 });
 
-test('a signed image previews using its original URL without putting the token in visible text', async () => {
+test('remote consent belongs to one message, even when the next message reuses its URL', async () => {
   requests = [];
-  const page = await pageFor('signed-preview');
+  const page = await pageFor('remote');
   try {
+    await page.getByRole('button', { name: 'Load image', exact: true }).click();
+    await loaded(page);
+    assert.equal(requests.length, 1);
+    await page.evaluate(() => window.nextMessage());
+    await page.getByRole('button', { name: 'Load image', exact: true }).waitFor();
+    assert.equal(await page.locator('img').count(), 0);
+    assert.equal(requests.length, 1);
+    await page.getByRole('button', { name: 'Load image', exact: true }).click();
     await loaded(page);
-    assert.deepEqual(requests, [{ path: '/image.png?token=preview-secret', referer: undefined }]);
-    assert.ok(!(await page.locator('body').innerText()).includes('preview-secret'));
+    assert.equal(requests.length, 2);
   } finally { await page.close(); }
 });
 
+for (const scenario of ['preview', 'signed-preview']) {
+  test(`${scenario}: untrusted Markdown cannot load remote images or signed tracking URLs`, async () => {
+    requests = [];
+    const page = await pageFor(scenario);
+    try {
+      await page.getByText('Open in browser', { exact: true }).waitFor();
+      assert.deepEqual(requests, []);
+      assert.equal(await page.locator('img').count(), 0);
+      assert.equal(await page.getByRole('button', { name: 'Load image', exact: true }).count(), 0);
+      assert.ok(!(await page.locator('body').innerText()).includes('preview-secret'));
+      // Prove the production CSP blocks a bypass of the Markdown component too.
+      await page.evaluate(url => {
+        const img=document.createElement('img'); img.src=url; document.body.append(img);
+        return new Promise(resolve=> { img.onerror=resolve; img.onload=()=>resolve(); });
+      }, `${imageUrl}/blocked.png`);
+      assert.deepEqual(requests, []);
+    } finally { await page.close(); }
+  });
+}
+
 test('two signed destinations which redact alike replay their own saved attachments', async () => {
   requests = [];
   const page = await pageFor('signed-duplicates-saved');
@@ -279,7 +329,8 @@ test('failed remote image has a working retry control instead of a broken image
   failedOnce = false;
   const page = await pageFor('retry');
   try {
-    await page.getByText('Could not load the image. Try again.').waitFor();
+    await page.getByRole('button', { name: 'Load image', exact: true }).click();
+    await page.getByText('Image not saved: download failed. Try again.').waitFor();
     assert.equal(await page.locator('img').count(), 0);
     await page.getByRole('button', { name: 'Retry', exact: true }).click();
     await loaded(page);
@@ -293,21 +344,21 @@ test('attachment read failure recovers in place, and local paths explain how to
     await loaded(page);
     assert.match(await page.locator('img').getAttribute('src'), /^data:image\/png;base64,/);
     await page.goto(`${appUrl}/?case=local`);
-    await page.getByText('This image address cannot be displayed. Send the image as a chat attachment.').waitFor();
+    await page.getByText('This image address cannot be displayed here.').waitFor();
     assert.equal(await page.locator('img').count(), 0);
     assert.equal(await page.getByRole('button', { name: 'Load image' }).count(), 0);
   } finally { await page.close(); }
 });
 
-test('a saved image decode failure invalidates both caches and recaptures its source on retry', async () => {
+test('a saved image decode failure retries archived bytes without touching its source', async () => {
   const page = await pageFor('corrupt-saved');
   try {
     await page.getByText('Could not load the image. Try again.').waitFor();
     assert.equal(await page.evaluate(() => window.imageReads), 1);
     await page.getByRole('button', { name: 'Retry', exact: true }).click();
     await page.waitForFunction(() => [...document.images].some(img => img.src.startsWith('data:image/png;') && img.naturalWidth === 1));
-    assert.equal(await page.evaluate(() => window.deliveryRetries), 1);
-    assert.equal(await page.evaluate(() => window.deliveryQueries), 2);
+    assert.equal(await page.evaluate(() => window.deliveryRetries), 0);
+    assert.equal(await page.evaluate(() => window.deliveryQueries), 1);
     assert.equal(await page.evaluate(() => window.imageReads), 2);
   } finally { await page.close(); }
 });
@@ -351,24 +402,27 @@ test('offscreen image performs no image request until it approaches the viewport
     assert.deepEqual(requests, []);
     assert.equal(await page.locator('img').count(), 0);
     await page.locator('[data-maka-image-state]').scrollIntoViewIfNeeded();
+    await page.getByRole('button', { name: 'Load image', exact: true }).waitFor();
+    assert.deepEqual(requests, []);
+    await page.getByRole('button', { name: 'Load image', exact: true }).click();
     await loaded(page);
     assert.deepEqual(requests, [{ path: '/image.png', referer: undefined }]);
   } finally { await page.close(); }
 });
 
-test('a new remote image previews during archival and switches to saved bytes after background completion', async () => {
+test('a pending archive stays a placeholder until saved bytes are available', async () => {
   requests = [];
   const page = await pageFor('saving');
   try {
-    await loaded(page);
-    await page.getByText('Saving image…').waitFor();
-    assert.equal(requests.length, 1);
+    await page.getByText('Loading image…', { exact: true }).waitFor();
+    assert.deepEqual(requests, []);
+    assert.equal(await page.locator('img').count(), 0);
     await page.waitForFunction(() => [...document.images].some(img=>img.src.startsWith('data:image/png;') && img.naturalWidth===1));
     await page.getByText('Loading image…', { exact: true }).waitFor({ state: 'hidden' });
     await page.getByText('Saving image…', { exact: true }).waitFor({ state: 'hidden' });
     assert.equal(await page.getByRole('status').filter({ hasText: /\S/ }).count(), 0);
     assert.equal(await page.evaluate(() => window.deliveryQueries), 2);
-    assert.equal(requests.length, 1);
+    assert.equal(requests.length, 0);
   } finally { await page.close(); }
 });
 
@@ -410,6 +464,7 @@ for (const scenario of ['geometry-remote', 'geometry-saved']) {
   test(`${scenario}: loading and ready images preserve the position of subsequent content`, async () => {
     const page = await pageFor(scenario);
     try {
+      if (scenario === 'geometry-remote') await page.getByRole('button', { name: 'Load image', exact: true }).click();
       await page.getByText('Loading image…', { exact: true }).waitFor();
       const before = await page.getByText('Following paragraph', { exact: true }).boundingBox();
       if (scenario === 'geometry-remote') releaseImage(); else releaseAttachment();
@@ -427,6 +482,7 @@ for (const scenario of ['geometry-remote', 'geometry-saved']) {
 test('image frames fit narrow viewports without distorting screenshots or limiting the enlarged preview', async () => {
   const page = await pageFor('screenshot');
   try {
+    await page.getByRole('button', { name: 'Load image', exact: true }).click();
     await page.waitForFunction(() => [...document.images].some(image => image.naturalWidth > 1));
     for (const width of [720, 360]) {
       await page.setViewportSize({ width, height: 600 });
@@ -517,7 +573,7 @@ for (const scenario of ['badge-list', 'badge-table', 'badge-strip']) {
     page.setDefaultTimeout(5000);
     let release;
     const gate = new Promise(resolve => { release = resolve; });
-    await page.route(`${imageUrl}/badge.png`, async route => { await gate; await route.continue(); });
+    await page.route('**/badge-attachment', async route => { await gate; await route.continue(); });
     try {
       await page.goto(`${appUrl}/?case=${scenario}`, { waitUntil: 'domcontentloaded' });
       await page.locator('.maka-markdown-image-inline').first().waitFor();
@@ -540,7 +596,7 @@ for (const [scenario, width, height] of [
     page.setDefaultTimeout(5000);
     let release;
     const gate = new Promise(resolve => { release = resolve; });
-    await page.route(`${imageUrl}/**`, async route => { await gate; await route.continue(); });
+    await page.route('**/fixture/**', async route => { await gate; await route.continue(); });
     const measure = () => page.locator('.maka-markdown-image-resource').evaluateAll(elements => elements.map(element => {
       const r = element.getBoundingClientRect();
       return { x: r.x, y: r.y, width: r.width, height: r.height };
diff --git a/packages/ui/src/__tests__/markdown-body.test.ts b/packages/ui/src/__tests__/markdown-body.test.ts
index abb4a21afc..60082e7917 100644
--- a/packages/ui/src/__tests__/markdown-body.test.ts
+++ b/packages/ui/src/__tests__/markdown-body.test.ts
@@ -502,13 +502,9 @@ function renderImageMarkdown(props: { text: string }) {
   }));
 }
 
-it('renders remote images automatically with lazy decoding and no referrer', () => {
+it('keeps remote URLs out of image elements until a Host archive is available', () => {
   const markup = renderImageMarkdown({ text: '![preview](https://example.com/image.png)' });
-  assert.match(markup, /<img\b/);
-  assert.match(markup, /src="https:\/\/example\.com\/image\.png"/);
-  assert.match(markup, /loading="lazy"/);
-  assert.match(markup, /referrerPolicy="no-referrer"|referrerpolicy="no-referrer"/);
-  assert.doesNotMatch(markup, /Load image|rel="preload"/);
+  assert.doesNotMatch(markup, /<img\b|rel="preload"/);
 });
 
 it('defers Mermaid fences beyond the per-Markdown automatic diagram budget', () => {
diff --git a/packages/ui/src/image-delivery.tsx b/packages/ui/src/image-delivery.tsx
index 558e95059a..8881d5338d 100644
--- a/packages/ui/src/image-delivery.tsx
+++ b/packages/ui/src/image-delivery.tsx
@@ -50,16 +50,20 @@ export function useImageDelivery(source: string, enabled: boolean) {
   const scope = useContext(ImageMessageScope);
   const context = useContext(DeliveryContext);
   const [attempt, setAttempt] = useState(0);
+  const consentKey = JSON.stringify([scope?.turnId, scope?.messageId, source]);
+  const [consent, setConsent] = useState<{ context: typeof context; key: string }>();
+  const loadRemote = consent?.context === context && consent?.key === consentKey;
   const identity = useMemo(() => context && scope?.turnId && scope.messageId && enabled
-    ? { context, turnId: scope.turnId, messageId: scope.messageId, streaming: scope.streaming === true, source, attempt } : undefined,
-    [context, scope?.turnId, scope?.messageId, scope?.streaming, source, attempt, enabled]);
+    ? { context, turnId: scope.turnId, messageId: scope.messageId, streaming: scope.streaming === true, source, attempt, loadRemote } : undefined,
+    [context, scope?.turnId, scope?.messageId, scope?.streaming, source, attempt, loadRemote, enabled]);
   const [settled, setSettled] = useState<{ identity: typeof identity; result: ImageDeliveryResult }>();
   const retry = useCallback(() => setAttempt(a => a + 1), []);
+  const confirmRemote = useCallback(() => setConsent({ context, key: consentKey }), [context, consentKey]);
   useEffect(() => {
     if (!identity) return;
     let cancelled = false; let timer: ReturnType<typeof setTimeout> | undefined; let delay = 500; let unavailableRetries = 0;
     const query = async (retry: boolean) => {
-      const result = await identity.context.resolve({ turnId: identity.turnId, messageId: identity.messageId, source: identity.source, ...(retry ? { retry: true } : {}) });
+      const result = await identity.context.resolve({ turnId: identity.turnId, messageId: identity.messageId, source: identity.source, ...(retry ? { retry: true } : {}), ...(identity.loadRemote ? { loadRemote: true } : {}) });
       if (cancelled) return;
       setSettled({ identity, result });
       // Canonical text can lag the displayed stream. Retry briefly after settlement,
@@ -73,5 +77,5 @@ export function useImageDelivery(source: string, enabled: boolean) {
   }, [identity, attempt]);
   const result: ImageDeliveryResult = !identity ? { status: 'unavailable' }
     : settled?.identity === identity ? settled.result : { status: 'pending' };
-  return { ...result, retry, available: !!identity, checked: settled?.identity === identity };
+  return { ...result, retry, confirmRemote, available: !!identity, checked: settled?.identity === identity };
 }
diff --git a/packages/ui/src/markdown-image.tsx b/packages/ui/src/markdown-image.tsx
index fa3811ba37..909a1bf673 100644
--- a/packages/ui/src/markdown-image.tsx
+++ b/packages/ui/src/markdown-image.tsx
@@ -100,23 +100,24 @@ function ImageResource(props: { src: string; alt: string; inline?: boolean }) {
   const [failedSource, setFailedSource] = useState<string>();
   const [attempt, setAttempt] = useState(0);
   const remote = isWebImage(props.src);
-  const source = artifactId ? image.src : visible && remote && (!delivery.available || delivery.checked) ? props.src : undefined;
+  const source = artifactId ? image.src : undefined;
   const failed = !!source && failedSource === source || !!artifactId && image.status === 'failed';
   const retry = () => {
     setFailedSource(undefined); setAttempt(a => a + 1);
     if (artifactId) image.retry();
-    // A transient byte-read failure retries the saved attachment. Only a
-    // browser decode failure invalidates automatic capture and rereads origin.
-    if (!artifactId || (!explicit && source && failedSource === source)) delivery.retry();
+    if (!artifactId) delivery.retry();
   };
   const sourceActions = <span className="maka-markdown-image-actions">
     <Button variant="ghost" size="sm" label={copy.imageRetry} onClick={retry} />
     {remote && <Link href={props.src} isExternalLink type="inherit" hasUnderline>{copy.imageOpen}</Link>}
   </span>;
   let message: string | undefined;
+  const needsConsent = visible && remote && !artifactId &&
+    (delivery.status === 'requires_confirmation' || !delivery.available);
   if (failed) message = copy.imageLoadFailed;
   else if (!source) message = !visible ? copy.imageLoading
     : explicit && image.status === 'unavailable' ? copy.imageUnavailable
+    : needsConsent ? copy.imageRemoteConsent
     : delivery.status === 'failed' ? copy.imageArchiveFailure(delivery.reason)
     : delivery.status === 'pending' || artifactId ? copy.imageLoading : copy.imageUnsupported;
   const hasFrame = props.inline || !visible || !!source || !!artifactId || delivery.status === 'pending';
@@ -126,14 +127,18 @@ function ImageResource(props: { src: string; alt: string; inline?: boolean }) {
       <span className="maka-markdown-image-placeholder" role="status" aria-label={message}>
         {failed || delivery.status === 'failed'
           ? <IconButton icon={<RotateCw size={14} />} size="sm" label={copy.imageRetry} onClick={retry} />
-          : delivery.status === 'unavailable' && visible
+          : needsConsent || delivery.status === 'unavailable' && visible
             ? <AlertTriangle size={14} aria-hidden="true" /> : <Spinner size="sm" shade="subtle" aria-hidden="true" />}
       </span>
     </Tooltip> : message ? <span className="maka-markdown-image-placeholder">
       {props.alt && <span className="maka-markdown-image-caption">{props.alt}</span>}
-      <span role="status">{hasFrame && !failed && delivery.status !== 'failed' && <Spinner size="sm" shade="subtle" aria-hidden="true" />} {message}</span>
+      <span role="status">{hasFrame && !failed && !needsConsent && delivery.status !== 'failed' && <Spinner size="sm" shade="subtle" aria-hidden="true" />} {message}</span>
       {(failed || delivery.status === 'failed') && sourceActions}
     </span> : source && <DisplayImage key={`${source}\0${attempt}`} src={source} alt={props.alt} onError={() => setFailedSource(source)} />}
+    {needsConsent && <span className="maka-markdown-image-actions">
+      {delivery.available && <Button variant="ghost" size="sm" label={copy.imageLoad} onClick={delivery.confirmRemote} />}
+      <Link href={props.src} isExternalLink type="inherit" hasUnderline>{copy.imageOpen}</Link>
+    </span>}
     {!explicit && delivery.status === 'pending' && remote && source && (props.inline ? <Tooltip content={copy.imageSaving}>
       <span className="maka-markdown-image-saving" role="status" aria-label={copy.imageSaving}><Spinner size="sm" aria-hidden="true" /></span>
     </Tooltip> : <span className="maka-markdown-image-saving" role="status">{copy.imageSaving}</span>)}
diff --git a/packages/ui/src/shared-ui-copy.ts b/packages/ui/src/shared-ui-copy.ts
index 5f85e840e9..3a8de3405e 100644
--- a/packages/ui/src/shared-ui-copy.ts
+++ b/packages/ui/src/shared-ui-copy.ts
@@ -32,6 +32,8 @@ export interface SharedUiCopy {
     unsafeLink: string;
     imageLoading: string;
     imageSaving: string;
+    imageRemoteConsent: string;
+    imageLoad: string;
     imageExpand: (alt: string) => string;
     imageArchiveFailure: (reason: import('@maka/core/image-delivery').ImageDeliveryFailure) => string;
     imageUnavailable: string;
@@ -136,11 +138,22 @@ const SHARED_UI_COPY = {
       unsafeLink: '链接不安全',
       imageLoading: '正在加载图片…',
       imageSaving: '正在保存图片…',
+      imageRemoteConsent: '远程图片需要授权加载，图片来源会收到请求。',
+      imageLoad: '加载图片',
       imageExpand: (alt) => alt ? `放大图片：${alt}` : '放大图片',
-      imageArchiveFailure: (reason) => reason === 'quota_exceeded' ? '图片未保存：存储配额已满。' : reason === 'too_large' ? '图片未保存：超过 2 MiB 自动保存上限。' : reason === 'not_allowed' ? '图片未保存：当前权限不允许读取。' : '图片未保存，原文件或链接失效后可能无法查看。',
+      imageArchiveFailure: (reason) => ({
+        quota_exceeded: '图片未保存：存储配额已满（每个会话 100 MiB，工作区 1 GiB）。删除不再需要的会话可释放空间，仅归档不会释放。',
+        too_large: '图片未保存：超过自动保存的大小或像素上限。',
+        not_allowed: '图片未保存：当前权限不允许读取或联网。',
+        not_found: '图片未保存：原文件已不存在。',
+        unsupported_mime: '图片未保存：不是支持的有效图片。',
+        download_failed: '图片未保存：下载失败，请重试。',
+        read_failed: '图片未保存：读取失败，请重试。',
+        queue_full: '图片未保存：保存队列已满，请稍后重试。',
+      })[reason],
       imageUnavailable: '当前无法读取图片附件。',
       imageLoadFailed: '图片加载失败，请重试。',
-      imageUnsupported: '此图片地址无法直接显示，请将图片作为会话附件发送。',
+      imageUnsupported: '此图片地址无法在这里显示。',
       imageRetry: '重试',
       imageOpen: '在浏览器中打开',
       taskList: '任务列表',
@@ -225,11 +238,22 @@ const SHARED_UI_COPY = {
       unsafeLink: '連結不安全',
       imageLoading: '正在載入圖片…',
       imageSaving: '正在儲存圖片…',
+      imageRemoteConsent: '遠端圖片需要授權載入，圖片來源會收到請求。',
+      imageLoad: '載入圖片',
       imageExpand: (alt) => alt ? `放大圖片：${alt}` : '放大圖片',
-      imageArchiveFailure: (reason) => reason === 'quota_exceeded' ? '圖片未儲存：儲存配額已滿。' : reason === 'too_large' ? '圖片未儲存：超過 2 MiB 自動儲存上限。' : reason === 'not_allowed' ? '圖片未儲存：目前權限不允許讀取。' : '圖片未儲存，原檔案或連結失效後可能無法查看。',
+      imageArchiveFailure: (reason) => ({
+        quota_exceeded: '圖片未儲存：儲存配額已滿（每個對話 100 MiB，工作區 1 GiB）。刪除不再需要的對話可釋放空間，僅封存不會釋放。',
+        too_large: '圖片未儲存：超過自動儲存的大小或像素上限。',
+        not_allowed: '圖片未儲存：目前權限不允許讀取或連線。',
+        not_found: '圖片未儲存：原檔案已不存在。',
+        unsupported_mime: '圖片未儲存：不是支援的有效圖片。',
+        download_failed: '圖片未儲存：下載失敗，請重試。',
+        read_failed: '圖片未儲存：讀取失敗，請重試。',
+        queue_full: '圖片未儲存：儲存佇列已滿，請稍後重試。',
+      })[reason],
       imageUnavailable: '目前無法讀取圖片附件。',
       imageLoadFailed: '圖片載入失敗，請重試。',
-      imageUnsupported: '此圖片位址無法直接顯示，請將圖片作為對話附件傳送。',
+      imageUnsupported: '此圖片位址無法在這裡顯示。',
       imageRetry: '重試',
       imageOpen: '在瀏覽器中開啟',
       taskList: '任務列表',
@@ -314,11 +338,22 @@ const SHARED_UI_COPY = {
       unsafeLink: 'Unsafe link',
       imageLoading: 'Loading image…',
       imageSaving: 'Saving image…',
+      imageRemoteConsent: 'Load this remote image only if you trust its source. Loading sends a request to that source.',
+      imageLoad: 'Load image',
       imageExpand: (alt) => alt ? `Enlarge image: ${alt}` : 'Enlarge image',
-      imageArchiveFailure: (reason) => reason === 'quota_exceeded' ? 'Image not saved: storage quota reached.' : reason === 'too_large' ? 'Image not saved: exceeds the 2 MiB automatic save limit.' : reason === 'not_allowed' ? 'Image not saved: current permissions do not allow reading it.' : 'Image not saved. It may become unavailable if the original file or link expires.',
+      imageArchiveFailure: (reason) => ({
+        quota_exceeded: 'Image not saved: storage quota reached (100 MiB per session, 1 GiB per workspace). Delete unneeded sessions to free space; archiving does not free space.',
+        too_large: 'Image not saved: exceeds the automatic save size or pixel limit.',
+        not_allowed: 'Image not saved: current permissions do not allow reading it or using the network.',
+        not_found: 'Image not saved: the original file no longer exists.',
+        unsupported_mime: 'Image not saved: not a supported valid image.',
+        download_failed: 'Image not saved: download failed. Try again.',
+        read_failed: 'Image not saved: read failed. Try again.',
+        queue_full: 'Image not saved: the save queue is full. Try again later.',
+      })[reason],
       imageUnavailable: 'This image attachment is unavailable here.',
       imageLoadFailed: 'Could not load the image. Try again.',
-      imageUnsupported: 'This image address cannot be displayed. Send the image as a chat attachment.',
+      imageUnsupported: 'This image address cannot be displayed here.',
       imageRetry: 'Retry',
       imageOpen: 'Open in browser',
       taskList: 'Task list',
diff --git a/packages/ui/stories/attachment.stories.tsx b/packages/ui/stories/attachment.stories.tsx
index 878c33509c..5b7d03149c 100644
--- a/packages/ui/stories/attachment.stories.tsx
+++ b/packages/ui/stories/attachment.stories.tsx
@@ -24,6 +24,8 @@ import type { AttachmentRef } from '@maka/core/events';
 import type { SessionSummary, StoredMessage } from '@maka/core/session';
 import { ChatSurfaceLayout, ChatView, Composer } from '../src/components.js';
 import type { ChatModelChoice } from '../src/chat-model-helpers.js';
+import type { ImageDeliveryResult } from '@maka/core/image-delivery';
+import { LocaleProvider } from '../src/locale-context.js';
 
 const NOW = Date.UTC(2026, 6, 1, 9, 30, 0);
 
@@ -151,6 +153,35 @@ function AttachmentChat(props: ComponentProps<typeof ChatView>) {
   );
 }
 
+function imageDeliveryStory(result: ImageDeliveryResult): Story {
+  return {
+    render: () => <LocaleProvider locale="en"><Frame><AttachmentChat {...baseChat}
+      messages={[{ type: 'assistant', id: 'image-message', turnId: 'image-turn', ts: NOW,
+        modelId: 'claude-sonnet-4-5', text: '![Dashboard](https://example.invalid/dashboard.png)' }]}
+      onResolveImageDelivery={async () => result}
+    /></Frame></LocaleProvider>,
+    play: async ({ canvasElement }) => {
+      await waitFor(() => {
+        const image = canvasElement.querySelector('.maka-markdown-image-resource');
+        if (!image) throw new Error('assistant image has not mounted');
+        if (result.status === 'ready') expect(image.querySelector('img')?.getAttribute('src')).toMatch(/^data:/);
+        else if (result.status === 'requires_confirmation') expect(image.textContent).toContain('Load image');
+        else if (result.status === 'failed') expect(image.textContent).toContain('download failed');
+        else expect(image.textContent).toContain('Loading image');
+      });
+    },
+  };
+}
+
+// Real path: assistant chat bubble → remote image awaits the user's Load image action.
+export const AssistantImageConsent = imageDeliveryStory({ status: 'requires_confirmation' });
+// Real path: assistant chat bubble → Host is saving bytes; the image remains a placeholder.
+export const AssistantImageSaving = imageDeliveryStory({ status: 'pending' });
+// Real path: assistant chat bubble → saved attachment is read through the production byte reader.
+export const AssistantImageSaved = imageDeliveryStory({ status: 'ready', artifactId: 'dashboard-image' });
+// Real path: assistant chat bubble → failed download offers Retry with the failure reason.
+export const AssistantImageFailed = imageDeliveryStory({ status: 'failed', reason: 'download_failed' });
+
 // Real path: composer → ＋ → attach files → the pending chips before the message is sent.
 export const ComposerPendingChips: Story = {
   render: () => (

From d2a36a9bd5592604d59137a820007aef4998910d Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Wed, 7 Oct 2026 13:58:49 +0800
Subject: [PATCH 16/35] refactor(images): share validation and remove obsolete
 preview states

Reuse request validation, remote source classification and abortable DNS waits. Consolidate failure publication and remove unreachable preview saving UI, unused state and ready-cache invalidation.

Generated-by: Codex (GPT-6)
---
 .../image-delivery-request-validator.json     |  5 ++
 .../src/protocol/image-delivery.ts            | 55 +++++++------------
 .../src/server/chat-image-delivery.ts         | 43 +++++----------
 .../src/server/chat-image-source.ts           | 24 +++-----
 packages/ui/src/image-delivery.tsx            |  3 +-
 packages/ui/src/markdown-image.tsx            | 16 +-----
 packages/ui/src/shared-ui-copy.ts             |  4 --
 packages/ui/src/styles.css                    | 16 ------
 8 files changed, 51 insertions(+), 115 deletions(-)
 create mode 100644 packages/runtime-host/protocol-compatible-changes/image-delivery-request-validator.json

diff --git a/packages/runtime-host/protocol-compatible-changes/image-delivery-request-validator.json b/packages/runtime-host/protocol-compatible-changes/image-delivery-request-validator.json
new file mode 100644
index 0000000000..f684e87575
--- /dev/null
+++ b/packages/runtime-host/protocol-compatible-changes/image-delivery-request-validator.json
@@ -0,0 +1,5 @@
+{
+  "epoch": 210,
+  "files": ["packages/runtime-host/src/protocol/image-delivery.ts"],
+  "reason": "At epoch 210, replace duplicate image request validation with the core validator and existing shaped-record codec. Required and optional fields, identity/source bounds, control-character rejection, error codes, normalized boolean flags and output codecs remain unchanged. Differential checks against the epoch-210 implementation preserve all 443 tested input outcomes; no field or operation is added or removed."
+}
diff --git a/packages/runtime-host/src/protocol/image-delivery.ts b/packages/runtime-host/src/protocol/image-delivery.ts
index 4ce40a4cb3..b5e44e65c4 100644
--- a/packages/runtime-host/src/protocol/image-delivery.ts
+++ b/packages/runtime-host/src/protocol/image-delivery.ts
@@ -19,13 +19,17 @@
 
 import {
   IMAGE_DELIVERY_FAILURES,
-  IMAGE_DELIVERY_IDENTITY_MAX_LENGTH,
-  isImageDeliverySource,
+  isImageDeliveryRequest,
   type ImageDeliveryRequest,
   type ImageDeliveryResult,
 } from '@maka/core/image-delivery';
 import { isCanonicalArtifactEntityId } from '@maka/core/artifacts';
-import { requireExactRecord, requireEntityId, requireRecord } from './codec.js';
+import {
+  requireExactRecord,
+  requireEntityId,
+  requireRecord,
+  requireShapedRecord,
+} from './codec.js';
 import { invalidProtocolFrame } from './errors.js';
 import { defineOperation } from './operation-spec.js';
 export interface ResolveImageDeliveryInput extends ImageDeliveryRequest {
@@ -53,39 +57,20 @@ export const IMAGE_DELIVERY_OPERATION_SPECS = {
       'internal_failure',
     ],
     decodeInput(value) {
-      const v = requireExactRecord(value, 'image delivery request', [
-        'sessionId',
-        'turnId',
-        'messageId',
-        'source',
-        ...(Object.hasOwn(requireRecord(value, 'image delivery request'), 'retry')
-          ? ['retry']
-          : []),
-        ...(Object.hasOwn(requireRecord(value, 'image delivery request'), 'loadRemote')
-          ? ['loadRemote']
-          : []),
-      ]);
-      const text = (s: unknown, max: number) => {
-        if (typeof s !== 'string' || !s.length || s.length > max || /[\u0000-\u001f\u007f]/.test(s))
-          throw invalidProtocolFrame('Invalid image delivery identity');
-        return s;
-      };
-      if (v.retry !== undefined && typeof v.retry !== 'boolean')
-        throw invalidProtocolFrame('Invalid image retry flag');
-      if (v.loadRemote !== undefined && typeof v.loadRemote !== 'boolean')
-        throw invalidProtocolFrame('Invalid remote image load flag');
-      const source = (s: unknown) => {
-        if (!isImageDeliverySource(s))
-          throw invalidProtocolFrame('Invalid image delivery identity');
-        return s;
-      };
+      const { sessionId, ...request } = requireShapedRecord(
+        value,
+        'image delivery request',
+        ['sessionId', 'turnId', 'messageId', 'source'],
+        ['retry', 'loadRemote'],
+      );
+      if (!isImageDeliveryRequest(request))
+        throw invalidProtocolFrame('Invalid image delivery request');
+      const { retry, loadRemote, ...identity } = request;
       return {
-        sessionId: requireEntityId(v.sessionId, 'sessionId'),
-        turnId: text(v.turnId, IMAGE_DELIVERY_IDENTITY_MAX_LENGTH),
-        messageId: text(v.messageId, IMAGE_DELIVERY_IDENTITY_MAX_LENGTH),
-        source: source(v.source),
-        ...(v.retry === true ? { retry: true } : {}),
-        ...(v.loadRemote === true ? { loadRemote: true } : {}),
+        sessionId: requireEntityId(sessionId, 'sessionId'),
+        ...identity,
+        ...(retry === true ? { retry: true } : {}),
+        ...(loadRemote === true ? { loadRemote: true } : {}),
       };
     },
     decodeOutput(value) {
diff --git a/packages/runtime-host/src/server/chat-image-delivery.ts b/packages/runtime-host/src/server/chat-image-delivery.ts
index 1c37267465..23743af105 100644
--- a/packages/runtime-host/src/server/chat-image-delivery.ts
+++ b/packages/runtime-host/src/server/chat-image-delivery.ts
@@ -48,7 +48,6 @@ interface DeliveryIdentity extends ImageDeliveryRequest {
   readonly sessionId: string;
 }
 interface DeliveryJob {
-  readonly identity: DeliveryIdentity;
   readonly done: Promise<void>;
   run(): Promise<void>;
   cancel(): void;
@@ -160,7 +159,6 @@ export class ChatImageDeliveryService {
       settle();
     };
     const job: DeliveryJob = {
-      identity,
       done,
       cancel: finish,
       run: async () => {
@@ -201,6 +199,7 @@ export class ChatImageDeliveryService {
     );
     if (existing?.imageDelivery?.status !== 'pending' && existing) return;
     const metadata = { messageId, source };
+    const resultId = `chat_image_result_${deliveryKey(identity)}`;
     const pendingId = existing?.id ?? `chat_image_request_${deliveryKey(identity)}`;
     const base = {
       sessionId,
@@ -226,6 +225,14 @@ export class ChatImageDeliveryService {
           throw new ImagePersistenceError('Image persistence failed', { cause: error });
         }
       });
+    const publishFailure = (reason: ImageDeliveryFailure) =>
+      publish({
+        ...base,
+        id: resultId,
+        kind: 'file',
+        content: '',
+        imageDelivery: { ...metadata, status: 'failed', reason },
+      });
     await publish({
       ...base,
       id: pendingId,
@@ -267,36 +274,20 @@ export class ChatImageDeliveryService {
       }
     } catch (error) {
       if (this.#abort.signal.aborted) return;
-      await publish({
-        ...base,
-        id: `chat_image_result_${deliveryKey(identity)}`,
-        kind: 'file',
-        content: '',
-        imageDelivery: { ...metadata, status: 'failed', reason: failureReason(error, source) },
-      });
+      await publishFailure(failureReason(error, source));
       return;
     } finally {
       clearTimeout(deadline);
     }
     if (this.#abort.signal.aborted) return;
     if (signal.aborted) {
-      await publish({
-        ...base,
-        id: `chat_image_result_${deliveryKey(identity)}`,
-        kind: 'file',
-        content: '',
-        imageDelivery: {
-          ...metadata,
-          status: 'failed',
-          reason: failureReason(signal.reason, source),
-        },
-      });
+      await publishFailure(failureReason(signal.reason, source));
       return;
     }
     try {
       await publish(
         readyChatImageArtifact({
-          id: `chat_image_result_${deliveryKey(identity)}`,
+          id: resultId,
           sessionId,
           turnId,
           name: base.name,
@@ -307,13 +298,7 @@ export class ChatImageDeliveryService {
       );
     } catch (error) {
       if (!(error instanceof ImageArchiveQuotaError)) throw error;
-      await publish({
-        ...base,
-        id: `chat_image_result_${deliveryKey(identity)}`,
-        kind: 'file',
-        content: '',
-        imageDelivery: { ...metadata, status: 'failed', reason: 'quota_exceeded' },
-      });
+      await publishFailure('quota_exceeded');
     }
   }
   beginDrain(): void {
@@ -341,5 +326,5 @@ function failureReason(error: unknown, source: string): ImageDeliveryFailure {
   const code = (error as NodeJS.ErrnoException | undefined)?.code;
   if (code === 'ENOENT' || code === 'ENOTDIR') return 'not_found';
   if (code === 'EACCES' || code === 'EPERM') return 'not_allowed';
-  return /^https?:/i.test(source) ? 'download_failed' : 'read_failed';
+  return isRemoteImageSource(source) ? 'download_failed' : 'read_failed';
 }
diff --git a/packages/runtime-host/src/server/chat-image-source.ts b/packages/runtime-host/src/server/chat-image-source.ts
index fa64e383a4..c1e36cc7a5 100644
--- a/packages/runtime-host/src/server/chat-image-source.ts
+++ b/packages/runtime-host/src/server/chat-image-source.ts
@@ -28,7 +28,12 @@ import {
   imageFileFailureReason,
   validateImageBytes,
 } from '@maka/runtime/image-file';
-import { isImageDeliverySource, type ImageDeliveryFailure } from '@maka/core/image-delivery';
+import {
+  isImageDeliverySource,
+  isRemoteImageSource,
+  type ImageDeliveryFailure,
+} from '@maka/core/image-delivery';
+import { abortable } from '../client/wait-for-ready.js';
 export class ImageSourceError extends Error {
   constructor(readonly reason: ImageDeliveryFailure) {
     super(reason);
@@ -47,7 +52,7 @@ export function checkedChatImage(bytes: Uint8Array): ChatImageBytes {
   }
 }
 export function localImagePath(source: string): string | undefined {
-  if (/^https?:/i.test(source)) return undefined;
+  if (isRemoteImageSource(source)) return undefined;
   if (source.startsWith('file:')) {
     try {
       return fileURLToPath(source);
@@ -63,7 +68,7 @@ export function localImagePath(source: string): string | undefined {
 /** A missing literal path may be a URL-encoded Markdown destination. File URLs
  * already went through fileURLToPath; never decode them a second time. */
 export function decodedLocalImagePath(source: string): string | undefined {
-  if (source.startsWith('file:') || /^https?:/i.test(source)) return undefined;
+  if (source.startsWith('file:') || isRemoteImageSource(source)) return undefined;
   try {
     const decoded = decodeURIComponent(source);
     return decoded !== source && isImageDeliverySource(decoded) ? decoded : undefined;
@@ -91,7 +96,7 @@ export async function downloadChatImage(
       !!loopbackOrigin && url.origin === loopbackOrigin && (host === '127.0.0.1' || host === '::1');
     const addresses = isIP(host)
       ? [{ address: host, family: isIP(host) }]
-      : await abortableLookup(host, signal);
+      : await abortable(() => lookup(host, { all: true }), signal);
     if (!addresses.length || (!literalLoopback && addresses.some((a) => !publicAddress(a.address))))
       throw new ImageSourceError('not_allowed');
     const target = addresses[0]!;
@@ -158,14 +163,3 @@ function publicAddress(address: string): boolean {
   // Only global-unicast IPv6 is eligible. Mapped IPv4/ULA/link-local are excluded.
   return /^[23][0-9a-f]{3}:/i.test(address);
 }
-
-function abortableLookup(host: string, signal: AbortSignal) {
-  signal.throwIfAborted();
-  return new Promise<import('node:dns').LookupAddress[]>((resolve, reject) => {
-    const abort = () => reject(signal.reason);
-    signal.addEventListener('abort', abort, { once: true });
-    void lookup(host, { all: true })
-      .then(resolve, reject)
-      .finally(() => signal.removeEventListener('abort', abort));
-  });
-}
diff --git a/packages/ui/src/image-delivery.tsx b/packages/ui/src/image-delivery.tsx
index 8881d5338d..763539497e 100644
--- a/packages/ui/src/image-delivery.tsx
+++ b/packages/ui/src/image-delivery.tsx
@@ -30,7 +30,6 @@ export function ImageDeliveryProvider(props: { sessionId: string; resolve?: Reso
     const ready = new Map<string, ImageDeliveryResult>();
     return { resolve(request: ImageDeliveryRequest) {
       const key = JSON.stringify([request.turnId, request.messageId, request.source]);
-      if (request.retry) ready.delete(key);
       const cached = ready.get(key); if (cached) return Promise.resolve(cached);
       const running = pending.get(key); if (running) return running;
       const job = resolve(props.sessionId, request).catch((): ImageDeliveryResult => ({ status: 'failed', reason: 'read_failed' }));
@@ -77,5 +76,5 @@ export function useImageDelivery(source: string, enabled: boolean) {
   }, [identity, attempt]);
   const result: ImageDeliveryResult = !identity ? { status: 'unavailable' }
     : settled?.identity === identity ? settled.result : { status: 'pending' };
-  return { ...result, retry, confirmRemote, available: !!identity, checked: settled?.identity === identity };
+  return { ...result, retry, confirmRemote, available: !!identity };
 }
diff --git a/packages/ui/src/markdown-image.tsx b/packages/ui/src/markdown-image.tsx
index 909a1bf673..b28140d196 100644
--- a/packages/ui/src/markdown-image.tsx
+++ b/packages/ui/src/markdown-image.tsx
@@ -24,6 +24,7 @@ import type { MarkdownAstNode, MarkdownAstRoot } from '@astryxdesign/core/Markdo
 import { Maximize2, RotateCw, AlertTriangle } from './icons.js';
 import { Link } from '@astryxdesign/core/Link';
 import { parseAttachmentResourceRef } from '@maka/core/attachments';
+import { isRemoteImageSource } from '@maka/core/image-delivery';
 import { useAttachmentImage } from './attachment-image.js';
 import { useImageDelivery } from './image-delivery.js';
 import { getSharedUiCopy } from './shared-ui-copy.js';
@@ -99,7 +100,7 @@ function ImageResource(props: { src: string; alt: string; inline?: boolean }) {
   const image = useAttachmentImage(visible && artifactId ? { artifactId } : undefined);
   const [failedSource, setFailedSource] = useState<string>();
   const [attempt, setAttempt] = useState(0);
-  const remote = isWebImage(props.src);
+  const remote = isRemoteImageSource(props.src);
   const source = artifactId ? image.src : undefined;
   const failed = !!source && failedSource === source || !!artifactId && image.status === 'failed';
   const retry = () => {
@@ -139,16 +140,6 @@ function ImageResource(props: { src: string; alt: string; inline?: boolean }) {
       {delivery.available && <Button variant="ghost" size="sm" label={copy.imageLoad} onClick={delivery.confirmRemote} />}
       <Link href={props.src} isExternalLink type="inherit" hasUnderline>{copy.imageOpen}</Link>
     </span>}
-    {!explicit && delivery.status === 'pending' && remote && source && (props.inline ? <Tooltip content={copy.imageSaving}>
-      <span className="maka-markdown-image-saving" role="status" aria-label={copy.imageSaving}><Spinner size="sm" aria-hidden="true" /></span>
-    </Tooltip> : <span className="maka-markdown-image-saving" role="status">{copy.imageSaving}</span>)}
-    {!explicit && delivery.status === 'failed' && remote && source && !failed && (props.inline ? <Tooltip content={copy.imageArchiveFailure(delivery.reason)}>
-      <span className="maka-markdown-image-saving" role="status" aria-label={copy.imageArchiveFailure(delivery.reason)}>
-        <IconButton icon={<AlertTriangle size={14} />} size="sm" label={copy.imageRetry} onClick={retry} />
-      </span>
-    </Tooltip> : <span className="maka-markdown-image-saving" role="status">
-      {copy.imageArchiveFailure(delivery.reason)} {sourceActions}
-    </span>)}
   </span>;
 }
 function DisplayImage(props: { src: string; alt: string; onError(): void }) {
@@ -167,6 +158,3 @@ function DisplayImage(props: { src: string; alt: string; onError(): void }) {
     {lightbox.isOpen && lightbox.element}
   </>;
 }
-function isWebImage(source: string): boolean {
-  try { return ['http:', 'https:'].includes(new URL(source).protocol); } catch { return false; }
-}
diff --git a/packages/ui/src/shared-ui-copy.ts b/packages/ui/src/shared-ui-copy.ts
index 3a8de3405e..5a3acaef67 100644
--- a/packages/ui/src/shared-ui-copy.ts
+++ b/packages/ui/src/shared-ui-copy.ts
@@ -31,7 +31,6 @@ export interface SharedUiCopy {
     invalidInternalLink: string;
     unsafeLink: string;
     imageLoading: string;
-    imageSaving: string;
     imageRemoteConsent: string;
     imageLoad: string;
     imageExpand: (alt: string) => string;
@@ -137,7 +136,6 @@ const SHARED_UI_COPY = {
       invalidInternalLink: '内部链接无效',
       unsafeLink: '链接不安全',
       imageLoading: '正在加载图片…',
-      imageSaving: '正在保存图片…',
       imageRemoteConsent: '远程图片需要授权加载，图片来源会收到请求。',
       imageLoad: '加载图片',
       imageExpand: (alt) => alt ? `放大图片：${alt}` : '放大图片',
@@ -237,7 +235,6 @@ const SHARED_UI_COPY = {
       invalidInternalLink: '內部連結無效',
       unsafeLink: '連結不安全',
       imageLoading: '正在載入圖片…',
-      imageSaving: '正在儲存圖片…',
       imageRemoteConsent: '遠端圖片需要授權載入，圖片來源會收到請求。',
       imageLoad: '載入圖片',
       imageExpand: (alt) => alt ? `放大圖片：${alt}` : '放大圖片',
@@ -337,7 +334,6 @@ const SHARED_UI_COPY = {
       invalidInternalLink: 'Invalid internal link',
       unsafeLink: 'Unsafe link',
       imageLoading: 'Loading image…',
-      imageSaving: 'Saving image…',
       imageRemoteConsent: 'Load this remote image only if you trust its source. Loading sends a request to that source.',
       imageLoad: 'Load image',
       imageExpand: (alt) => alt ? `Enlarge image: ${alt}` : 'Enlarge image',
diff --git a/packages/ui/src/styles.css b/packages/ui/src/styles.css
index 37e6e68d83..d8e30dd5e8 100644
--- a/packages/ui/src/styles.css
+++ b/packages/ui/src/styles.css
@@ -703,22 +703,6 @@
   color: var(--muted-foreground);
   font-size: var(--maka-font-size-sm);
 }
-.maka-markdown-image-saving {
-  position: absolute;
-  inset-inline-start: var(--space-2);
-  inset-block-end: var(--space-2);
-  max-width: calc(100% - var(--space-10));
-  padding: var(--space-1) var(--space-2);
-  background: var(--background);
-  border-radius: var(--radius-surface);
-  color: var(--muted-foreground);
-  font-size: var(--maka-font-size-sm);
-}
-.maka-markdown-image-inline .maka-markdown-image-saving {
-  inset: auto auto 0 0;
-  max-width: 100%;
-  padding: 0;
-}
 
 /* Markdown code renderers are custom components so Mermaid can be loaded only
    for settled Mermaid fences. Astryx skips its own spacing wrapper when

From 49cdee63061620ba375904a59b5c6e007ac1d486 Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Wed, 7 Oct 2026 15:38:21 +0800
Subject: [PATCH 17/35] fix(images): honor redaction and clarify remote consent

Disable remote load/open actions for destinations hidden by display redaction while preserving saved replay and archived-byte retries. Report network restrictions before asking for consent, distinguish non-chat copy, and document the test-only loopback grant. Correct the MCP patch provenance version.

Generated-by: Codex (GPT-6)
---
 .../src/__tests__/chat-image-delivery.test.ts |  4 +
 .../__tests__/execution-composition.test.ts   |  4 +-
 .../src/server/chat-image-delivery.ts         |  2 +-
 .../src/server/chat-image-source.ts           |  5 +-
 .../scripts/markdown-images.browser.test.mjs  | 91 ++++++++++++++++---
 packages/ui/src/markdown-image.tsx            | 40 +++++---
 packages/ui/src/shared-ui-copy.ts             |  8 ++
 7 files changed, 122 insertions(+), 32 deletions(-)

diff --git a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
index 409b603951..ceb28a1619 100644
--- a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
+++ b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
@@ -801,6 +801,10 @@ test('remote capture requires a user action and current network authority, inclu
     assert.equal(downloads, 0);
     assert.deepEqual(await f.service.resolve(identity), { status: 'requires_confirmation' });
     f.allowRemote(false);
+    assert.deepEqual(await f.service.resolve(identity), {
+      status: 'failed',
+      reason: 'not_allowed',
+    });
     assert.deepEqual(await f.service.resolve({ ...identity, loadRemote: true }), {
       status: 'failed',
       reason: 'not_allowed',
diff --git a/packages/runtime-host/src/__tests__/execution-composition.test.ts b/packages/runtime-host/src/__tests__/execution-composition.test.ts
index a2a656c863..7cc077b347 100644
--- a/packages/runtime-host/src/__tests__/execution-composition.test.ts
+++ b/packages/runtime-host/src/__tests__/execution-composition.test.ts
@@ -4794,7 +4794,9 @@ test('production Host never downloads remote Markdown images in restricted sessi
             request,
             context,
           );
-          return result.ok && result.result.status === 'requires_confirmation';
+          return (
+            result.ok && result.result.status === 'failed' && result.result.reason === 'not_allowed'
+          );
         }, 5000);
         assert.deepEqual(
           await captured.composition.handlers['artifact.image.resolve'](
diff --git a/packages/runtime-host/src/server/chat-image-delivery.ts b/packages/runtime-host/src/server/chat-image-delivery.ts
index 23743af105..10358d64c9 100644
--- a/packages/runtime-host/src/server/chat-image-delivery.ts
+++ b/packages/runtime-host/src/server/chat-image-delivery.ts
@@ -119,9 +119,9 @@ export class ChatImageDeliveryService {
         return { status: 'unavailable' };
     }
     if (isRemoteImageSource(identity.source)) {
-      if (!identity.loadRemote) return { status: 'requires_confirmation' };
       if (!(await this.ports.canLoadRemote(identity.sessionId)))
         return { status: 'failed', reason: 'not_allowed' };
+      if (!identity.loadRemote) return { status: 'requires_confirmation' };
     }
     if (metadata?.status === 'failed') {
       return this.ports.admission.runOrJoin(identity.sessionId, async () => {
diff --git a/packages/runtime-host/src/server/chat-image-source.ts b/packages/runtime-host/src/server/chat-image-source.ts
index c1e36cc7a5..8d03c028d2 100644
--- a/packages/runtime-host/src/server/chat-image-source.ts
+++ b/packages/runtime-host/src/server/chat-image-source.ts
@@ -84,8 +84,9 @@ export async function downloadChatImage(
   options: { readonly loopbackOrigin?: string } = {},
 ): Promise<ChatImageBytes> {
   let url = new URL(source);
-  // Only an embedding Host's exact served origin can opt into loopback. A
-  // public source cannot acquire this grant by redirecting into that origin.
+  // Test fixtures alone pass loopbackOrigin; production callers must omit it.
+  // The fixture grant is pinned to its original exact origin, so redirects
+  // cannot acquire it or reach a different local port.
   const loopbackOrigin = url.origin === options.loopbackOrigin ? options.loopbackOrigin : undefined;
   for (let redirect = 0; redirect <= 3; redirect++) {
     signal.throwIfAborted();
diff --git a/packages/ui/scripts/markdown-images.browser.test.mjs b/packages/ui/scripts/markdown-images.browser.test.mjs
index 40696bdfcb..35e4a36a27 100644
--- a/packages/ui/scripts/markdown-images.browser.test.mjs
+++ b/packages/ui/scripts/markdown-images.browser.test.mjs
@@ -111,6 +111,11 @@ before(async () => {
     'hash-saved': `![Screenshot](/tmp/${'a'.repeat(48)}.png)`,
     'secret-reference-saved': `![Screenshot][picture]\n\n[picture]: ${imageUrl}/image.png?token=reference-secret`,
     'signed-streaming-race': `![Screenshot](${imageUrl}/image.png?token=stream-secret)`,
+    'signed-corrupt-saved': `![Screenshot](${imageUrl}/image.png?token=corrupt-secret)`,
+    'signed-remote': `![Screenshot](${imageUrl}/image.png?token=remote-secret)`,
+    'signed-inline': `Build ![Badge](${imageUrl}/image.png?token=inline-secret) passing.`,
+    'signed-failed': `![Screenshot](${imageUrl}/image.png?token=failed-secret)`,
+    'secret-alt': `![https://example.invalid/?token=alt-secret](${imageUrl}/image.png)`,
     'signed-preview': `![Screenshot](${imageUrl}/image.png?token=preview-secret)`,
     'signed-duplicates-saved': `![First](${imageUrl}/image.png?token=first-secret) ![Second](${imageUrl}/image.png?token=second-secret)`,
     'signed-live-saved': `![Screenshot](${imageUrl}/image.png?token=live-`,
@@ -158,7 +163,7 @@ before(async () => {
         if(mode.startsWith('badge-')) await fetch('/badge-attachment');
         if(mode==='geometry-saved') await fetch('/release-attachment');
         reads++; window.imageReads=reads; return (mode==='attachment' || mode==='read-retry-saved') && reads===1 ? {ok:false,reason:'read_failed'} :
-          {ok:true,base64:mode.startsWith('badge-') || artifactId.endsWith('badge.png') ? '${badge.toString('base64')}' : mode==='geometry-saved' || artifactId.endsWith('screenshot.png') ? '${screenshot.toString('base64')}' : mode==='corrupt-saved' && reads===1 ? 'iVBORw0KGgo=' : '${png.toString('base64')}',mimeType:'image/png'};
+          {ok:true,base64:mode.startsWith('badge-') || artifactId.endsWith('badge.png') ? '${badge.toString('base64')}' : mode==='geometry-saved' || artifactId.endsWith('screenshot.png') ? '${screenshot.toString('base64')}' : mode.endsWith('corrupt-saved') && reads===1 ? 'iVBORw0KGgo=' : '${png.toString('base64')}',mimeType:'image/png'};
       };
       const preview=mode==='preview' || mode==='signed-preview' || mode==='local';
       const seeded=mode.endsWith('saved') || mode.endsWith('saving') || race || mode.startsWith('badge-') || mode.startsWith('layout-');
@@ -168,6 +173,8 @@ before(async () => {
         window.deliverySources.push(request.source);
         if(canonicalSources[mode] && !canonicalSources[mode].includes(request.source)) return {status:'unavailable'};
         if(request.retry) window.deliveryRetries++;
+        if(mode==='restricted') return {status:'failed',reason:'not_allowed'};
+        if(mode==='signed-failed') return {status:'failed',reason:'download_failed'};
         if(!seeded) {
           if(!request.loadRemote) return {status:'requires_confirmation'};
           const response=await fetch('/capture?source='+encodeURIComponent(request.source));
@@ -281,7 +288,13 @@ for (const scenario of ['preview', 'signed-preview']) {
     requests = [];
     const page = await pageFor(scenario);
     try {
-      await page.getByText('Open in browser', { exact: true }).waitFor();
+      if(scenario==='signed-preview') {
+        await page.getByText('The image address contains hidden sensitive information. Loading and opening it are disabled.', {exact:true}).waitFor();
+        assert.equal(await page.getByText('Open in browser', {exact:true}).count(), 0);
+      } else {
+        await page.getByText('Remote images cannot be loaded here. You can open this image in your browser.', {exact:true}).waitFor();
+        await page.getByText('Open in browser', {exact:true}).waitFor();
+      }
       assert.deepEqual(requests, []);
       assert.equal(await page.locator('img').count(), 0);
       assert.equal(await page.getByRole('button', { name: 'Load image', exact: true }).count(), 0);
@@ -296,6 +309,50 @@ for (const scenario of ['preview', 'signed-preview']) {
   });
 }
 
+for (const scenario of ['signed-remote', 'signed-inline', 'signed-failed']) {
+  test(`${scenario}: hidden destinations provide no network actions, including failure and inline states`, async () => {
+    requests = [];
+    const page = await pageFor(scenario);
+    try {
+      const message = 'The image address contains hidden sensitive information. Loading and opening it are disabled.';
+      if (scenario === 'signed-inline') await page.getByRole('status', {name: message, exact: true}).waitFor();
+      else await page.getByText(message, {exact: true}).waitFor();
+      assert.equal(await page.getByRole('button', {name: 'Load image', exact: true}).count(), 0);
+      assert.equal(await page.getByRole('button', {name: 'Retry', exact: true}).count(), 0);
+      assert.equal(await page.getByText('Open in browser', {exact: true}).count(), 0);
+      assert.equal(await page.locator('a[href*="token="]').count(), 0);
+      assert.equal(await page.locator('img').count(), 0);
+      assert.doesNotMatch(await page.locator('body').innerText(), /remote-secret|inline-secret|failed-secret/);
+      assert.deepEqual(requests, []);
+    } finally { await page.close(); }
+  });
+}
+
+test('redacting only image alt text does not disable a safe destination', async () => {
+  requests = [];
+  const page = await pageFor('secret-alt');
+  try {
+    await page.getByRole('button', {name: 'Load image', exact: true}).waitFor();
+    assert.doesNotMatch(await page.locator('body').innerText(), /alt-secret/);
+    await page.getByRole('button', {name: 'Load image', exact: true}).click();
+    await loaded(page);
+    assert.equal(requests.length, 1);
+  } finally { await page.close(); }
+});
+
+test('network-restricted images show denial before any load click and can recheck permissions', async () => {
+  requests = [];
+  const page = await pageFor('restricted');
+  try {
+    await page.getByText('Image not saved: current permissions do not allow reading it or using the network.', {exact: true}).waitFor();
+    assert.equal(await page.getByRole('button', {name: 'Load image', exact: true}).count(), 0);
+    await page.getByRole('button', {name: 'Retry', exact: true}).click();
+    await page.getByText('Image not saved: current permissions do not allow reading it or using the network.', {exact: true}).waitFor();
+    await page.getByText('Open in browser', {exact: true}).waitFor();
+    assert.deepEqual(requests, []);
+  } finally { await page.close(); }
+});
+
 test('two signed destinations which redact alike replay their own saved attachments', async () => {
   requests = [];
   const page = await pageFor('signed-duplicates-saved');
@@ -350,18 +407,24 @@ test('attachment read failure recovers in place, and local paths explain how to
   } finally { await page.close(); }
 });
 
-test('a saved image decode failure retries archived bytes without touching its source', async () => {
-  const page = await pageFor('corrupt-saved');
-  try {
-    await page.getByText('Could not load the image. Try again.').waitFor();
-    assert.equal(await page.evaluate(() => window.imageReads), 1);
-    await page.getByRole('button', { name: 'Retry', exact: true }).click();
-    await page.waitForFunction(() => [...document.images].some(img => img.src.startsWith('data:image/png;') && img.naturalWidth === 1));
-    assert.equal(await page.evaluate(() => window.deliveryRetries), 0);
-    assert.equal(await page.evaluate(() => window.deliveryQueries), 1);
-    assert.equal(await page.evaluate(() => window.imageReads), 2);
-  } finally { await page.close(); }
-});
+for (const scenario of ['corrupt-saved', 'signed-corrupt-saved']) {
+  test(`${scenario}: a saved image decode failure retries archived bytes without touching its source`, async () => {
+    requests = [];
+    const page = await pageFor(scenario);
+    try {
+      await page.getByText('Could not load the image. Try again.').waitFor();
+      assert.equal(await page.evaluate(() => window.imageReads), 1);
+      await page.getByRole('button', { name: 'Retry', exact: true }).click();
+      await page.waitForFunction(() => [...document.images].some(img => img.src.startsWith('data:image/png;') && img.naturalWidth === 1));
+      assert.equal(await page.evaluate(() => window.deliveryRetries), 0);
+      assert.equal(await page.evaluate(() => window.deliveryQueries), 1);
+      assert.equal(await page.evaluate(() => window.imageReads), 2);
+      assert.deepEqual(requests, []);
+      if(scenario==='signed-corrupt-saved') assert.equal(await page.getByText('Open in browser', {exact:true}).count(), 0);
+    } finally { await page.close(); }
+  });
+
+}
 
 test('a transient saved attachment read retries its bytes without invalidating archival or touching origin', async () => {
   requests = [];
diff --git a/packages/ui/src/markdown-image.tsx b/packages/ui/src/markdown-image.tsx
index b28140d196..f332e0ff70 100644
--- a/packages/ui/src/markdown-image.tsx
+++ b/packages/ui/src/markdown-image.tsx
@@ -30,8 +30,11 @@ import { useImageDelivery } from './image-delivery.js';
 import { getSharedUiCopy } from './shared-ui-copy.js';
 import { useUiLocale } from './locale-context.js';
 import { createMarkdownImageSourceResolver } from './markdown-image-source.js';
+import { redactSecrets } from './redact.js';
 
-const ImageSourceContext = createContext<(source: string) => string>((source) => source);
+const ImageSourceContext = createContext<(source: string) => { source: string; redacted: boolean }>(
+  (source) => ({ source, redacted: false }),
+);
 
 type PlacedImage = MarkdownExtensionNode<'maka-images', 'image', { src: string; alt: string; inline: boolean }>;
 // Placement comes from Markdown structure before bytes arrive. Never change a
@@ -72,7 +75,8 @@ export function MarkdownImageSourceProvider(props: { text: string; sources?: Rea
     const canonical = createMarkdownImageSourceResolver(props.text);
     return (source: string) => {
       const resolved = canonical(source);
-      return props.sources?.get(resolved) ?? resolved;
+      const original = props.sources?.get(resolved) ?? resolved;
+      return { source: original, redacted: props.sources?.has(resolved) === true && original !== redactSecrets(original) };
     };
   }, [props.text, props.sources]);
   return <ImageSourceContext.Provider value={resolve}>{props.children}</ImageSourceContext.Provider>;
@@ -80,10 +84,10 @@ export function MarkdownImageSourceProvider(props: { text: string; sources?: Rea
 
 /** Presentation only: Host resolves local addresses and archives; UI receives artifact identities. */
 export function MarkdownImage(props: { src: string; alt: string; inline?: boolean }) {
-  const source = useContext(ImageSourceContext)(props.src);
-  return <ImageResource key={source} src={source} alt={props.alt} inline={props.inline} />;
+  const { source, redacted } = useContext(ImageSourceContext)(props.src);
+  return <ImageResource key={source} src={source} redacted={redacted} alt={props.alt} inline={props.inline} />;
 }
-function ImageResource(props: { src: string; alt: string; inline?: boolean }) {
+function ImageResource(props: { src: string; redacted: boolean; alt: string; inline?: boolean }) {
   const copy = getSharedUiCopy(useUiLocale()).markdown;
   const anchor = useRef<HTMLSpanElement>(null);
   const [visible, setVisible] = useState(typeof IntersectionObserver === 'undefined');
@@ -108,16 +112,24 @@ function ImageResource(props: { src: string; alt: string; inline?: boolean }) {
     if (artifactId) image.retry();
     if (!artifactId) delivery.retry();
   };
+  // Redaction preserves the original identity for saved replay, never for a
+  // network action whose destination the user cannot inspect.
+  const hiddenRemote = remote && props.redacted;
+  const remoteBlocked = remote && delivery.status === 'failed' && delivery.reason === 'not_allowed';
   const sourceActions = <span className="maka-markdown-image-actions">
-    <Button variant="ghost" size="sm" label={copy.imageRetry} onClick={retry} />
-    {remote && <Link href={props.src} isExternalLink type="inherit" hasUnderline>{copy.imageOpen}</Link>}
+    {(!hiddenRemote || artifactId) && <Button variant="ghost" size="sm" label={copy.imageRetry} onClick={retry} />}
+    {remote && !hiddenRemote && <Link href={props.src} isExternalLink type="inherit" hasUnderline>{copy.imageOpen}</Link>}
   </span>;
   let message: string | undefined;
-  const needsConsent = visible && remote && !artifactId &&
-    (delivery.status === 'requires_confirmation' || !delivery.available);
+  const remotePlaceholder = visible && remote && !artifactId;
+  const needsConsent = remotePlaceholder && !hiddenRemote && delivery.status === 'requires_confirmation';
+  const remoteUnavailable = remotePlaceholder && !hiddenRemote && !delivery.available;
+  const remoteNotice = remotePlaceholder && (hiddenRemote || remoteUnavailable || needsConsent || remoteBlocked);
   if (failed) message = copy.imageLoadFailed;
   else if (!source) message = !visible ? copy.imageLoading
     : explicit && image.status === 'unavailable' ? copy.imageUnavailable
+    : remotePlaceholder && hiddenRemote ? copy.imageRemoteRedacted
+    : remoteUnavailable ? copy.imageRemoteUnavailable
     : needsConsent ? copy.imageRemoteConsent
     : delivery.status === 'failed' ? copy.imageArchiveFailure(delivery.reason)
     : delivery.status === 'pending' || artifactId ? copy.imageLoading : copy.imageUnsupported;
@@ -126,18 +138,18 @@ function ImageResource(props: { src: string; alt: string; inline?: boolean }) {
     data-maka-image-state={message ? failed ? 'failed' : 'loading' : 'ready'}>
     {message && props.inline ? <Tooltip content={message}>
       <span className="maka-markdown-image-placeholder" role="status" aria-label={message}>
-        {failed || delivery.status === 'failed'
+        {(failed || delivery.status === 'failed') && (!hiddenRemote || artifactId)
           ? <IconButton icon={<RotateCw size={14} />} size="sm" label={copy.imageRetry} onClick={retry} />
-          : needsConsent || delivery.status === 'unavailable' && visible
+          : remoteNotice || delivery.status === 'unavailable' && visible
             ? <AlertTriangle size={14} aria-hidden="true" /> : <Spinner size="sm" shade="subtle" aria-hidden="true" />}
       </span>
     </Tooltip> : message ? <span className="maka-markdown-image-placeholder">
       {props.alt && <span className="maka-markdown-image-caption">{props.alt}</span>}
-      <span role="status">{hasFrame && !failed && !needsConsent && delivery.status !== 'failed' && <Spinner size="sm" shade="subtle" aria-hidden="true" />} {message}</span>
+      <span role="status">{hasFrame && !failed && !remoteNotice && delivery.status !== 'failed' && <Spinner size="sm" shade="subtle" aria-hidden="true" />} {message}</span>
       {(failed || delivery.status === 'failed') && sourceActions}
     </span> : source && <DisplayImage key={`${source}\0${attempt}`} src={source} alt={props.alt} onError={() => setFailedSource(source)} />}
-    {needsConsent && <span className="maka-markdown-image-actions">
-      {delivery.available && <Button variant="ghost" size="sm" label={copy.imageLoad} onClick={delivery.confirmRemote} />}
+    {(needsConsent || remoteUnavailable) && <span className="maka-markdown-image-actions">
+      {needsConsent && <Button variant="ghost" size="sm" label={copy.imageLoad} onClick={delivery.confirmRemote} />}
       <Link href={props.src} isExternalLink type="inherit" hasUnderline>{copy.imageOpen}</Link>
     </span>}
   </span>;
diff --git a/packages/ui/src/shared-ui-copy.ts b/packages/ui/src/shared-ui-copy.ts
index 5a3acaef67..e3a4ec829c 100644
--- a/packages/ui/src/shared-ui-copy.ts
+++ b/packages/ui/src/shared-ui-copy.ts
@@ -32,6 +32,8 @@ export interface SharedUiCopy {
     unsafeLink: string;
     imageLoading: string;
     imageRemoteConsent: string;
+    imageRemoteRedacted: string;
+    imageRemoteUnavailable: string;
     imageLoad: string;
     imageExpand: (alt: string) => string;
     imageArchiveFailure: (reason: import('@maka/core/image-delivery').ImageDeliveryFailure) => string;
@@ -137,6 +139,8 @@ const SHARED_UI_COPY = {
       unsafeLink: '链接不安全',
       imageLoading: '正在加载图片…',
       imageRemoteConsent: '远程图片需要授权加载，图片来源会收到请求。',
+      imageRemoteRedacted: '图片地址含已隐藏的敏感信息，无法加载或在浏览器中打开。',
+      imageRemoteUnavailable: '此处无法加载远程图片，可在浏览器中打开。',
       imageLoad: '加载图片',
       imageExpand: (alt) => alt ? `放大图片：${alt}` : '放大图片',
       imageArchiveFailure: (reason) => ({
@@ -236,6 +240,8 @@ const SHARED_UI_COPY = {
       unsafeLink: '連結不安全',
       imageLoading: '正在載入圖片…',
       imageRemoteConsent: '遠端圖片需要授權載入，圖片來源會收到請求。',
+      imageRemoteRedacted: '圖片位址含已隱藏的敏感資訊，無法載入或在瀏覽器中開啟。',
+      imageRemoteUnavailable: '此處無法載入遠端圖片，可在瀏覽器中開啟。',
       imageLoad: '載入圖片',
       imageExpand: (alt) => alt ? `放大圖片：${alt}` : '放大圖片',
       imageArchiveFailure: (reason) => ({
@@ -335,6 +341,8 @@ const SHARED_UI_COPY = {
       unsafeLink: 'Unsafe link',
       imageLoading: 'Loading image…',
       imageRemoteConsent: 'Load this remote image only if you trust its source. Loading sends a request to that source.',
+      imageRemoteRedacted: 'The image address contains hidden sensitive information. Loading and opening it are disabled.',
+      imageRemoteUnavailable: 'Remote images cannot be loaded here. You can open this image in your browser.',
       imageLoad: 'Load image',
       imageExpand: (alt) => alt ? `Enlarge image: ${alt}` : 'Enlarge image',
       imageArchiveFailure: (reason) => ({

From 85fbf756c667ceff8466c01f855b55ecef5e0387 Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Wed, 7 Oct 2026 17:19:24 +0800
Subject: [PATCH 18/35] fix(images): remove test-only loopback grant from
 downloader

Keep network fixture routing in tests at the Node DNS and HTTP boundary. Exercise the production downloader without an address-policy exception, including private redirects, mixed DNS, byte limits, downgrade prevention and cancellation. Assert that the former runtime option no longer grants loopback access.

Generated-by: Codex (GPT-6)
---
 .../src/__tests__/chat-image-delivery.test.ts | 190 +++++++++++++++---
 .../src/server/chat-image-source.ts           |   9 +-
 2 files changed, 164 insertions(+), 35 deletions(-)

diff --git a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
index ceb28a1619..5e6d78afec 100644
--- a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
+++ b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
@@ -18,12 +18,15 @@
  */
 
 import assert from 'node:assert/strict';
-import { test } from 'node:test';
+import { test, type TestContext } from 'node:test';
 import { mkdtemp, mkdir, readFile, writeFile, rm, stat } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { pathToFileURL } from 'node:url';
-import { createServer } from 'node:http';
+import http, { createServer, type RequestOptions, type IncomingMessage } from 'node:http';
+import https from 'node:https';
+import dns from 'node:dns/promises';
+import { syncBuiltinESMExports } from 'node:module';
 import { createHash } from 'node:crypto';
 import { createImageFileReader, ImageFileReadError } from '@maka/runtime/image-file-reader';
 import { FilesystemWorkerClientError } from '@maka/runtime/filesystem-worker';
@@ -43,6 +46,46 @@ const PNG = Buffer.from(
   'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8DwHwAFBQIAX8jx0gAAAABJRU5ErkJggg==',
   'base64',
 );
+// Mock only Node's DNS/transport boundary. The production downloader still
+// checks public addresses, pins DNS, follows redirects and validates HTTP bytes.
+// Top-level tests in this file run serially; restore the ESM bindings at teardown.
+function publicImageOrigin(t: TestContext, localSource: string, protocol = 'http:'): string {
+  const local = new URL(localSource);
+  const source = new URL(localSource);
+  source.hostname = 'image.example';
+  source.protocol = protocol;
+  const request = http.request;
+  t.mock.method(dns, 'lookup', async (host: string) => {
+    assert.equal(host, source.hostname);
+    return [{ address: '93.184.216.34', family: 4 }];
+  });
+  const transport = (
+    url: URL,
+    options: RequestOptions,
+    callback: (res: IncomingMessage) => void,
+  ) => {
+    assert.equal(url.origin, source.origin);
+    assert.ok(options.lookup);
+    options.lookup(url.hostname, { all: true }, (error, addresses) => {
+      assert.equal(error, null);
+      assert.deepEqual(addresses, [{ address: '93.184.216.34', family: 4 }]);
+    });
+    return request(
+      new URL(url.pathname + url.search, local),
+      { ...options, lookup: undefined },
+      callback,
+    );
+  };
+  t.mock.method(http, 'request', transport);
+  t.mock.method(https, 'request', transport);
+  syncBuiltinESMExports();
+  t.after(() => {
+    t.mock.restoreAll();
+    syncBuiltinESMExports();
+  });
+  return source.href;
+}
+
 const REQUEST = {
   sessionId: 'session-1',
   turnId: 'turn-1',
@@ -65,7 +108,6 @@ async function fixture(
   const errors: unknown[] = [];
   const presentationErrors: unknown[] = [];
   let remoteAllowed = true;
-  let loopbackOrigin: string | undefined;
   let reads = 0;
   let leases = 0;
   const messages = new Map<string, string>();
@@ -83,8 +125,7 @@ async function fixture(
     limits,
     sourceReadTimeoutMs: 1000,
     canLoadRemote: async () => remoteAllowed,
-    download:
-      download ?? ((source, signal) => downloadChatImage(source, signal, { loopbackOrigin })),
+    download: download ?? downloadChatImage,
     isPresent: async () => present,
     readMessage: async (i) => messages.get(i.messageId),
     readLocalImage: async (sessionId, path, signal) => {
@@ -114,9 +155,6 @@ async function fixture(
     allowRemote(value: boolean) {
       remoteAllowed = value;
     },
-    trustRemoteOrigin(source: string) {
-      loopbackOrigin = new URL(source).origin;
-    },
     get reads() {
       return reads;
     },
@@ -427,7 +465,7 @@ test('missing encoded sources never double-decode file URLs or retry invalid esc
   }
 });
 
-test('remote delivery is downloaded once, remains replayable after the origin server disappears, and sends no credentials/referrer', async () => {
+test('remote delivery is downloaded once, remains replayable after the origin server disappears, and sends no credentials/referrer', async (t) => {
   const f = await fixture();
   let requests = 0;
   const server = createServer((req, res) => {
@@ -439,9 +477,11 @@ test('remote delivery is downloaded once, remains replayable after the origin se
     res.end(PNG);
   });
   await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
-  const source = `http://127.0.0.1:${(server.address() as import('node:net').AddressInfo).port}/image.png`;
+  const source = publicImageOrigin(
+    t,
+    `http://127.0.0.1:${(server.address() as import('node:net').AddressInfo).port}/image.png`,
+  );
   try {
-    f.trustRemoteOrigin(source);
     f.messages.set(REQUEST.messageId, `![Screenshot](${source})`);
     observe(f.service, source);
     await f.service.waitForIdle();
@@ -499,7 +539,7 @@ test('transient failure is persisted and is retried only on an explicit request'
   }
 });
 
-test('truncated HTTP images are rejected, and an explicit retry archives the repaired source', async () => {
+test('truncated HTTP images are rejected, and an explicit retry archives the repaired source', async (t) => {
   const f = await fixture();
   let content = PNG.subarray(0, 8);
   let requests = 0;
@@ -509,10 +549,12 @@ test('truncated HTTP images are rejected, and an explicit retry archives the rep
     res.end(content);
   });
   await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
-  const source = `http://127.0.0.1:${(server.address() as import('node:net').AddressInfo).port}/image.png`;
+  const source = publicImageOrigin(
+    t,
+    `http://127.0.0.1:${(server.address() as import('node:net').AddressInfo).port}/image.png`,
+  );
   const identity = { ...REQUEST, source, loadRemote: true };
   try {
-    f.trustRemoteOrigin(source);
     f.messages.set(REQUEST.messageId, `![Screenshot](${source})`);
     await f.service.resolve(identity);
     await f.service.waitForIdle();
@@ -750,7 +792,7 @@ test('copying a conversation carries delivery provenance and saved bytes; it doe
     await f.close();
   }
 });
-test('source readers reject oversized payloads, unsafe MIME and redirects to private networks', async () => {
+test('source readers reject oversized payloads, unsafe MIME and redirects to private networks', async (t) => {
   assert.throws(() => checkedChatImage(Buffer.alloc(2 * 1024 * 1024 + 1)), /too_large/);
   assert.throws(() => checkedChatImage(Buffer.from('<svg/>')), /unsupported_mime/);
   const server = createServer((_req, res) => {
@@ -759,17 +801,104 @@ test('source readers reject oversized payloads, unsafe MIME and redirects to pri
   });
   await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
   try {
-    const source = `http://127.0.0.1:${(server.address() as import('node:net').AddressInfo).port}/redirect`;
+    const source = publicImageOrigin(
+      t,
+      `http://127.0.0.1:${(server.address() as import('node:net').AddressInfo).port}/redirect`,
+    );
+    await assert.rejects(downloadChatImage(source, AbortSignal.timeout(2000)), /not_allowed/);
+  } finally {
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+  }
+});
+test('HTTP download enforces header/stream limits, redirect budget and cancellation', async (t) => {
+  const server = createServer((req, res) => {
+    if (req.url === '/length') {
+      res.writeHead(200, { 'content-length': 2 * 1024 * 1024 + 1 });
+      res.end();
+    } else if (req.url === '/stream') {
+      res.writeHead(200);
+      res.write(Buffer.alloc(2 * 1024 * 1024 + 1));
+      res.end();
+    } else if (req.url === '/redirect') {
+      res.writeHead(302, { location: '/redirect' });
+      res.end();
+    } else if (req.url === '/stalled') {
+      // Keep the response open until the downloader's cancellation closes it.
+    } else {
+      res.writeHead(503);
+      res.end();
+    }
+  });
+  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+  const source = publicImageOrigin(
+    t,
+    `http://127.0.0.1:${(server.address() as import('node:net').AddressInfo).port}/`,
+  );
+  try {
+    for (const [path, reason] of [
+      ['length', 'too_large'],
+      ['stream', 'too_large'],
+      ['redirect', 'download_failed'],
+      ['unavailable', 'download_failed'],
+    ]) {
+      await assert.rejects(
+        downloadChatImage(source + path, AbortSignal.timeout(2000)),
+        new RegExp(reason),
+      );
+    }
+    await assert.rejects(downloadChatImage(source + 'stalled', AbortSignal.timeout(50)), {
+      name: 'AbortError',
+    });
+  } finally {
+    server.closeAllConnections();
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+  }
+});
+
+test('HTTPS download cannot redirect to HTTP', async (t) => {
+  let requests = 0;
+  const server = createServer((_req, res) => {
+    requests++;
+    res.writeHead(302, { location: 'http://image.example/image.png' });
+    res.end();
+  });
+  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+  const source = publicImageOrigin(
+    t,
+    `http://127.0.0.1:${(server.address() as import('node:net').AddressInfo).port}/`,
+    'https:',
+  );
+  try {
+    await assert.rejects(downloadChatImage(source, AbortSignal.timeout(2000)), /not_allowed/);
+    assert.equal(requests, 1);
+  } finally {
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+  }
+});
+
+test('DNS answers containing any private address are denied before a request', async (t) => {
+  const answers = [
+    { address: '93.184.216.34', family: 4 },
+    { address: '127.0.0.1', family: 4 },
+  ];
+  const lookup = t.mock.method(dns, 'lookup', async () => answers);
+  const request = t.mock.method(http, 'request', () => {
+    assert.fail('unsafe DNS must not reach transport');
+  });
+  syncBuiltinESMExports();
+  try {
     await assert.rejects(
-      downloadChatImage(source, AbortSignal.timeout(2000), {
-        loopbackOrigin: new URL(source).origin,
-      }),
+      downloadChatImage('http://image.example/image.png', AbortSignal.timeout(1000)),
       /not_allowed/,
     );
+    assert.equal(lookup.mock.callCount(), 1);
+    assert.equal(request.mock.callCount(), 0);
   } finally {
-    await new Promise<void>((resolve) => server.close(() => resolve()));
+    t.mock.restoreAll();
+    syncBuiltinESMExports();
   }
 });
+
 test('resolver codec rejects excess fields and noncanonical artifact identities', () => {
   const spec = IMAGE_DELIVERY_OPERATION_SPECS['artifact.image.resolve'];
   assert.deepEqual(spec.decodeInput(REQUEST), REQUEST);
@@ -906,7 +1035,7 @@ test('a Markdown parser failure stays in presentation and subsequent images stil
   }
 });
 
-test('loopback is denied before GET and a served-origin grant cannot follow another local port', async () => {
+test('loopback is denied before GET, including redirects from a public origin', async (t) => {
   let hits = 0;
   const target = createServer((_req, res) => {
     hits++;
@@ -919,16 +1048,23 @@ test('loopback is denied before GET and a served-origin grant cannot follow anot
     res.end();
   });
   await new Promise<void>((resolve) => origin.listen(0, '127.0.0.1', resolve));
-  const source = `http://127.0.0.1:${(origin.address() as import('node:net').AddressInfo).port}/redirect`;
   try {
-    for (const url of [targetUrl, 'http://[::1]:80/image.png'])
-      await assert.rejects(downloadChatImage(url, AbortSignal.timeout(1000)), /not_allowed/);
+    // An untyped caller passing the former fixture option cannot grant access.
     await assert.rejects(
-      downloadChatImage(source, AbortSignal.timeout(1000), {
-        loopbackOrigin: new URL(source).origin,
-      }),
+      Reflect.apply(downloadChatImage, undefined, [
+        targetUrl,
+        AbortSignal.timeout(1000),
+        { loopbackOrigin: new URL(targetUrl).origin },
+      ]),
       /not_allowed/,
     );
+    const source = publicImageOrigin(
+      t,
+      `http://127.0.0.1:${(origin.address() as import('node:net').AddressInfo).port}/redirect`,
+    );
+    for (const url of [targetUrl, 'http://[::1]:80/image.png'])
+      await assert.rejects(downloadChatImage(url, AbortSignal.timeout(1000)), /not_allowed/);
+    await assert.rejects(downloadChatImage(source, AbortSignal.timeout(1000)), /not_allowed/);
     assert.equal(hits, 0);
   } finally {
     await Promise.all(
diff --git a/packages/runtime-host/src/server/chat-image-source.ts b/packages/runtime-host/src/server/chat-image-source.ts
index 8d03c028d2..84364ca23a 100644
--- a/packages/runtime-host/src/server/chat-image-source.ts
+++ b/packages/runtime-host/src/server/chat-image-source.ts
@@ -81,24 +81,17 @@ export function decodedLocalImagePath(source: string): string | undefined {
 export async function downloadChatImage(
   source: string,
   signal: AbortSignal,
-  options: { readonly loopbackOrigin?: string } = {},
 ): Promise<ChatImageBytes> {
   let url = new URL(source);
-  // Test fixtures alone pass loopbackOrigin; production callers must omit it.
-  // The fixture grant is pinned to its original exact origin, so redirects
-  // cannot acquire it or reach a different local port.
-  const loopbackOrigin = url.origin === options.loopbackOrigin ? options.loopbackOrigin : undefined;
   for (let redirect = 0; redirect <= 3; redirect++) {
     signal.throwIfAborted();
     if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password)
       throw new ImageSourceError('not_allowed');
     const host = url.hostname.replace(/^\[|\]$/g, '');
-    const literalLoopback =
-      !!loopbackOrigin && url.origin === loopbackOrigin && (host === '127.0.0.1' || host === '::1');
     const addresses = isIP(host)
       ? [{ address: host, family: isIP(host) }]
       : await abortable(() => lookup(host, { all: true }), signal);
-    if (!addresses.length || (!literalLoopback && addresses.some((a) => !publicAddress(a.address))))
+    if (!addresses.length || addresses.some((a) => !publicAddress(a.address)))
       throw new ImageSourceError('not_allowed');
     const target = addresses[0]!;
     const response = await new Promise<import('node:http').IncomingMessage>((resolve, reject) => {

From 5356d55276a190e8e0acc3a3932a407e6eb0e781 Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Wed, 7 Oct 2026 19:53:37 +0800
Subject: [PATCH 19/35] fix(ui): enlarge chat images directly on click

Remove the separate expand control and hover affordance. Keep keyboard activation and restore focus after closing the image preview.

Generated-by: Codex (GPT-6)
---
 .../pr/chat-image-delivery/click-after.png    | Bin 0 -> 60327 bytes
 .../pr/chat-image-delivery/click-before.png   | Bin 0 -> 61189 bytes
 .../pr/chat-image-delivery/click-enlarged.png | Bin 0 -> 4496 bytes
 .../scripts/markdown-images.browser.test.mjs  |  57 ++++++++++++++++--
 packages/ui/src/markdown-image.tsx            |  19 ++++--
 packages/ui/src/styles.css                    |  19 ++----
 6 files changed, 72 insertions(+), 23 deletions(-)
 create mode 100644 docs/images/pr/chat-image-delivery/click-after.png
 create mode 100644 docs/images/pr/chat-image-delivery/click-before.png
 create mode 100644 docs/images/pr/chat-image-delivery/click-enlarged.png

diff --git a/docs/images/pr/chat-image-delivery/click-after.png b/docs/images/pr/chat-image-delivery/click-after.png
new file mode 100644
index 0000000000000000000000000000000000000000..b9d4268f04917a8f5007f42b3b00d5a744a77825
GIT binary patch
literal 60327
zcmY&fWmMGL+a0>Qhwkp~p}V`gL%Jk}?x8!R8>A(b?(P!l21x}(eU*Fff35e!e3@^*
zb<TcvJp06|tIDAv1Cap$0Gfilv?c%mJ@@CQj|lzepP?1mU;qFUpdc-w?U#S?(`9A9
z3!Ntl`ob6SyKTKS+4xo}6iuls6^4cm1?}eNw})y==x#GtqnWh9u}oC}%olPj3s$v^
z-}@oIzubKj_~lOe`w8<Y<acM#uRAq?;9pPAPD5V>qw1}q(pGLBR%^kHEd0$B-&t&f
zG)-t9LyzkWgBwT&k7w=Do6rSkBn%8{&QnjjjPZ!sq;)KcpLL%G<*XGNwB}TK9r5^l
zairw7mNm39ho9RB41V=JytStKeLNB_t~dQiB$`Ad;__33103#hO#1l574pkFbI(dg
zg!Ag`8<2-Tfh6zVGtdwJgdv&Uw)^YgyW<~YOwi>chho4Q(7SLc%@1pwG#x~O_nF5t
z>vt0Yra}8X&*Hz||DH4~WEwOiV>#ai`c>SyE93Sr<|P%NXat7hH{_h3<eR=v?c@2h
z<!I)1_(c9uct+J&j4fdZdnq4}E%{jjj{;RO#`|*iJtsD04d^89-5`8Nv8w!mdy#of
zhPNo*BnAUJczUl2XA7EP0%u?bKQj)=P72|z<eXZJ5y)A5>`0JrfvO?Yt<9G7ovmXB
z(&r;(KiH$)?+%Y|XgnY<LCE{HXVMl`N=&oKze>V}3hM6GR6hTD*F+6^Z$U(;p8yQj
z^UtOVb%$t{J{~l5HDh?r6zYk-|LARMFd1HMCP2n|ev_Mr*g$P1u^P~TZ&?2Y9<iTh
zZ}0OLoNF)~b*Kd=2Q@3;;D-Db+5AN)#~bPp2ZU?|NQz|yTLJRvMUu;D<#?M})B+Cr
z#9(YDCPUodg{XAEU(W{U84E$!YbYjM@ESZJ-a1|P3iA`r+4KXy<u!LZ8|_nVid$5r
z?}71i$zQJsP}JHOGJCX1--c54YeLP5|9*LXV#U^!n2kqA4?9xZMEp4X&W;gVBo*oQ
z{0>A6qsV=(Z$?7BU#dMbCUHDX7vcr&=6HW0Q+Ocy{?FN+_cUiBD1CAhF}$9*YA!uO
z8IzyOemN66m-ykYs{oHvL6Ag*l$&Qa<+fLnFgbK9T~1-3_>#@h1g|nUIFyC24_Fy=
z0G8A0%w=zB(H&7JwKTt|f=w3&cWKluYmwGe9}z;40khfMd6}cwRv{FGicXEfp;QE2
z*g2s|7aXW#f&rd23-U};kg68+1>zrKMXqX7^z;w`Hx4Ks1m`EXk}=W@l!v~vpTKoY
zv}jgxUie)zZ9@92-VKBulJD_T5O0h8#WIsj2YdUzE`qniH?N20^}j<KrH&X4G9U|z
zS*ML6yo@<Nr_rw`4=z0HB%O4P7~8q~v<~eC1yFvDiuT9;Vs3Bn&9sR630q`Cwgl+{
zC9G`XSCfBORDWPWl<S&DxU6%Z&o^%xp9z6Wg!z{zal-X5MUNftd;SwzFvQR*D6$0F
zA9<k{^JCZKiitFY8rRyJjP9!dlkb8Ix;tMIf6P8DcA^i>o#LLts$ZYPjsl(u3|$yK
zFkdPUAard__gm(>CRW0|Shn$F2VPf5?X>tXM(XmxNYQWIw1FbBx26w0&ny1Rx7Mcw
z5IK~-B~*BWQYi!dRNaLDF^LD*<tG-QYKo~6kUIBshUh!D&h+75_|J1FPC6WZ>3FWh
zp(%~>Kp|ZQayBZW)EgiV9qUG^q2o|xkhvsI@@mwgF!R6%Ak=CDLBdtTS2r<qq9<mR
zh7*SqSUhOa<{Q$u31wRc#QJ$v);%0u7dbmek^>QT<U}@0zXdzea;$UUXYt!-iqDmc
z8)fwgSxU6J7#u2Y-%(|Q6MKcF&}?`(5`AZx&;1{U?`jUK7uZRX@UxhC9>ds+4k&-I
zmvEq}s!>v?RB=3qrSH%X<?o`4+e4|$kCPzuLs33fMa4At^s*%QS;T!J7y<}~>08R^
zwCL>bm=&3M=HfzX%Y{9ZW4I>Ul=!s9j>>}U$1tyuVWDD&xZ8jaP87Pa%wTkHgy|PT
zOL`4BNt`1VwtW)wF!yZ;i6#Uh<V1XWju>!NmuR9QFl+XW^jPE?2n#VV&xqUz_mjdD
zzgDUeZEHE!nXP?OpvQ`l8NBP)VP6l-!4laP01z_rfs$eHyJA&wpRh0}sh0M5_Prmu
zpLz&xIO`7LlRpz0)2MQ#aBu=-UXYk95;Ux_UG;;r_ZZe2)?j_t`WKOJOh7_qlw&>S
z_@>i^a-qvi)sRrF0zcaqE&VJNQ~C;3qBJR{Zmv>1K_7ePskK(c<s*%1k<$$Dba(oe
zIk#;-fAr9tjW&WmstR=e&0>U^6p4Qv7L~eNBLR!;0P9y-Z>_{3m9PHGcW1)KI+JOC
zrdc8Dy>^-?&2CKKHFQ2p>Dmd{<QPZI9jov%a67ugpy3Q5h+(l><b5r$ffts1C`UY5
zT%Q6AP&F34qr&%hNsiTKL^@;;&wv+mXDm!1ODU%TOLuPaTRQoF%3&xzgD~0y?YTno
zz&!BtoVs6<Is_ABN`8Y5z}&?WQD;9)VXDw?zTOT|3#C|-C^nAeOT81=J2-iX#sWIR
z`MOaaR(TVd2JG5dyV0){b%P9^EgBjp-kk@p^HIHbgU8Z8qh^vg%fKt=A2|7O{Q2sC
zA9fg`KN(JYa)kREXE|G#CgD-Z88CH_Mqc!ms8ucgPBP}<#I8piW=K6*%`ZhI)JZ~^
zZ&!8;+SYgvSC2Y((v5{ox{9X^7mVev%}4#EKPak9R^oYNd%i&h;W|AxCgR&#B^nLe
z1as!$*5V8COrUIVk@pDHPT%zz9yVqK%a(dLg%T>E$Z}%X^N=(aG(z*mowkzf(T5E6
z=dIAmqkGsL^nTlSXk@2El}$kWx9Q>bV4^wkMJ8MIVX1=$pM1~LSO<8U4*`F1zWoR1
z#ttZ>rL>{eIke-&1NR`9k?Y3JwM|U#lpjPRTOzW0SJuH{4_`4SV<m7LFr@-tfM6E8
zr7kbnmGwmi*Kt0&%Nbo=<0|AF`}tg?ySltJ>M`<LD(g%-;_RdtHct}y31Zk;=RN>H
zSPxTn%q(B_u+AdP%Enndv8S&|W|N74DibG;Y2w6~`UEe21j6o!NN8%kbc)=!qx|W!
zz`YcFP*@2jc7b9M{ZBeCnCI}6-%Dml(`hNF45_)PpNN`-mlgPC<=S$QqryjVQU5>R
z7)^+>w)go4h@8xrbCnq6S_g%b3813v!Kkn`#-!)(jp%$wazzLK7ERe!r*p`Og!4IH
zGNW-f?#iT+VgRJrnlvW6N$>*4xXs(Y!ETO~zeIdMl5#DC(pNSPFU|ez+bBnx&7qAD
zkk?xXWta=O91kvAm@^-9Mt$@W8W==cwe}1@*3|Pr6!>OCPw=>Tv}Zd^p6Dms>_gOB
z@WEeoXzLII5uK1GOT-`?mA7XEtqWN(Hwe^nq`xHY7~$IyqD}ldjR*dn#vzh%^7hpf
z{m!EHG;})#Vsr{<1i$CQNn(Vl4|6$i2Mt}g<Wi~aX@j@&k1};w_FJe?2DSqwIneNJ
z0DA{Kk>riX$Q(Ec%W3*NPKb`5k$YFXwUB^~e3~>```EzvWWhXjMe``lSVc09L)1|l
zMAIqUq+)oOfiso_9_X7jvm<s6Q<o94oLd$HgX3zTBoM%w@$_3=`P3^3D8^$;g>1Hr
z9LBxgR(Ve9K&mow_MB}B?Ms?Q-q-tgs<FTOcdE5ZTfB?iLK8b;bkmuv?dCehypx_;
zm?oL>m%oMu_URiUG8|#?q333;<4Fi3^A;1sLi))S<O<Hw=S0@D_^}0ck}jOcxrOH8
zig#o?zr&3uw_=PhLRsy3h7UGlttq0o!J?bvs!|2bk1XjdHYMt1mNkCr%6I0Kt2Z|;
z4akp{RJi|EEDtvdb)>G9!T8O*)NWxh7sb<PydKwhDLHxsC%^Y)W0<Q=&~Uc4P|r;0
zecfUIA1ax}=U?asbK-(Tz$6^5LROzv)JlDH0H)GStl1z0P8RY>2_ais-MP%3xrA)B
zGHKM+ajUHyNkjEiMp#hLt#g(hQ32xc*HE<*L>Q-d1`-95X*0dXULgdI#GvsxOIQ|0
z*pH(~juKmKhF0>Mg5CfN&MaO(-i5=|?={T!wO=;V!W83P1X*^63kssXltfJk8d%9)
zD%Mq?_o1<6CSrSf&P)BsT~P+O35u^cv}(u4Ji9rPS=%%52eo4ehduP1`9EabP5e>M
zKL>97pe6}FJ$XY7O!c)i#Y&B#=T*!pjJh@mC&XCNY(968y|m%aAhsFveFcNz9Q7s0
z2fSED2`;A$)4$EGD+^U}8<nsJW^)~~F%WB2XG9UAFfy8xufg6U32wDef<L#SsbOw2
z+C#^c94LB<U>zqJ24bf_1Ofcy*nUt`G$ZVR2R`lx&EkIJD<`fw*2IgmhFOuKZ~EOM
z*Xo<*(n2*#CGol70R@MfMiwKzYvu?U)Xs*f+c;ubGKr`GimEDCtGL2z)@|gZL)*Bk
zIbP<UVRrIwyl-BUi(ktkB&uu7K?A5cB=;W5c>vrR<b_He+}lVX($Q1Q2J&?v4mnH#
zN*Kibur_TBn<H<l0`QVen<`8Lo|I=37yTK+O`0Fn{kxeAXa&QR{^)x3cUzM<K~=>s
z4zOxO-DVoXx{|)b63hx}Dkv1Z9azXc+;fUAAS#`n*(vD>lffy(erMKFg5qzIoNjc)
z{BzzjJo0*^d+RCIY(_yB2pWTL@>s~qh;SlSz&j_)YzC^*$2;nJ8I&8ZV4wL<dQFZM
z1+YU)C%6fj7ktyBMqDg)?hIBrzn7eGIL0V~r(DwiQaPD9ZZ2f2DSKP4bF@c>fBzzz
z(}rYJ>puu9)UZmE%GO@sGNWaeqV8KJE&p;fz)!zYh3Uo<*#)E1h$)T`TZ@Z5&{=!P
zbD>K65|L@njNanJphT0<Uj4n9yZ`VvVVMrg)~q;8%BS?Ju}6P9fntqVTXHlg$bn;>
zAGE$;gv6ns<NL-9xl+TiLvZ8GvAXJ_JjlitM)~vL^TO8MR&_?|j8!=mo`P%7_CKdo
zn|Z9*txd*?)9-!{pB9yk6o$h_5{3fJ{DsPQW#r}|-*PZAu%nHE{Q$m#V0kh*uhE|6
zGwM|QH#32ZAa*U>k<@obL_CLvf*vkuxiXzc_b>($%JbBzy0WPm@#1&%OB?dHq?QZT
z+1*(M_yX@2s%wWPnwx^PU7Zzx@dY(g?Na$BUUXWDN$yK@84}E*cn52>%!??=*FE9r
zWneG6I$3x9pLN0tMR<b|i~s_x?oPur)oW}2o)L>M`n1{ZY1uNfz;Az%)b>YU{+$X*
z_#bM^dFsL{Br~;0s_Cc4qf21<oC-Czl$oKh@F7yec~kNf)}wT4l4(&-Wykr_c=OhH
zrdjs9u(%*rDz*<fEb=^{RE{}&3Jim;`WepyDbSk~uD&qYc|nK&vVh9Dk0t;Y8!0yP
zW~*dLRvr#H3Ojp55++o;ii&s*%<;A0^?(feTxmVZghvQPVD^4^Q66k!yIG<s#e{fV
zRq_4Q_B8RSV{ln11?!pA_oayWa`-z})TR2P1GO}(^}k2sJ5!rU|LW2D1|_c}<Wkb9
z!jyi2>#zpe-Aqm%M~4{v?60{Kv$nXIrTQZ3h`gfWnt}A)N;K+h2a<A0`@3@W%yM&X
zM1C3@q13PpIFTMW7_{trSH=ij<Iwq{goHTmAFDD6L&xkPvhlHbu<Rbn7X}i21h>Mx
zMfcz)h(Rp69x=Rsn|7WRYKdcV;<|j}<-oaPH`}+YvT4|k9*g*9Ph;;pjxb{or8sOY
z*DqJ)O%s^3PjW8aHIa$0w7=Wq=-+(*N6Z`&^kJ$;I>)kwMIAe>wO4G6`(|oqKMPUD
zF9c^qaV20zfdVdKlV#|<Lbr;T%Cv`UHXSD`x2(@~Lt`U2V}nIZCQ8NLPo_{{%5x*S
zoQG^_glX8pOT)(507T;vmSMCBcI$r$Qo7f#-}O@4M-bkEHisq9yko+;UygO3(MZFC
z-ZnZO6DBD?*mqtePmlbx%%g%m8J2G8)wk*EKAyrPrA$EU#A~)F6?q;y*h?KerV-jt
z<=W87vo$WIzq$M?HJ$!w=zkJ{oLPc5cg6=t!x-1ipWJSJcY!1&YfRYcaLCd_uoo(8
z9@F>t=vOi+zn1VmU<4`=8pg!8L0bzy`CE3!Ca~ZLOuWC+Mgu|1uDq{+NGy034S2QT
zA=-qUXTX^2kp9@g%?g(YMtw{#?ipxRqca4^+5#?UwD4GCCb{(8v9mluSU)RdLOQ2m
zu`=kTT_dpQkon_JLgS8p<<u5$NiQiBIxL!z8g8clrrNQb+j${VPD<aOWttDH`&oyY
zr#R)(5mc?sRT;*mEWfA^sx@zHk_34DgP`75F6vc0oZs{EQ7f63To@N6xMv|&7{<*h
zd0NEzWU}q5=mFzFCl}G923HHE1M-lp{l=PrRI*saimWim)GB?O@4v<quJG30msk3X
z{O82af+$V_QdkV)6k+{~EiV)|{0ej{JgTir{i{Ajdf#RWC8hLQZJDR~{N2$oVc}nn
z$y|LLO(+_0)JUsS%vk603v@50a`e%|!^3O8_ZA$2AYX_`koIqz$B!)|)Ca<~Lj|Er
zhTOSCR^wC=HfAX%jXreg;tBAyd-9oMCy@5e{e{x%A1M8aJ21oy%}dcrfDG_CMBu1~
zOEfK1rAoOqQiqtwkhSPE?wqZ@l&4?U!ip6^Le^`;j#BEJTxH&vv1wd1)A_Kjgww-A
zN^A%0se@mKmLspyc1oI4vFXy)gnB=q;g1(Tp^?i=)8DerVSXYVkJZgl8SANdE+Qg@
z3)ewLRnT#d@wuQfAtBi7SwR~LZNk&U;COE=pKxJj5>96Pi8-(JJa>5{rIat6I3FD{
zy>~d3I#i{IIb${h7v9mkK&9~`wDd=Vx!6qJYtrFk+9sm^9Jzn0d1Y$ZjHkwdBQVhA
zB%=Y)w?sD&pb3PJ*(RXAFiT=f!8%&l5lcgk)eF~0>|g+Qct|4j_7uCkUvzhsg)M{8
zov}`(r3=F4m6nrhnwvH(V|rwDxvd5qMe(%GBT43{0@{5mLvwTcj5Pv><Mn;XvU<f&
zn||7^jFXgAWu(&yDV6q6%=+40XBaPzJwW<kP@ylE9d>NRWE@AOH<lP92V}5|8KV^u
zt5tLgXhH4~@d_(nUO&O@->{~THDC!fSa*?HnIb;?EmE{4H{~rACgcS=m@b}++<vjV
z5TdWeXgVIEs#KnroiL})W+)+rJBuj$jVKf|Mj)d@V_<5;bPXC@4_qVHKIe3F8-w7T
zKynFw95fu7s_1r?wxUT0*LhIkwJohV1p4Ihz_+PWS|Lr0CH{b&ae<!FB+?{vet%`j
z8@=pqy|X;xz1!t~kfdvFl!Lrf*%bo!&~bP6PA}tiqJ8;aaCYG06J`w-SCOq&xaNra
z4$z5|c$z~u<a9wD@P+mDR@{NXRL%)i!EBkVR(DrQql+VKCWNU*my8}6y=FE~$sNlu
zZH)nEoI#u1;W);dm*bF3F(A4U(k>{qKOg6xLO=1kI*w9gWxNykJ@v&s!H>nW*$~+7
zoq;ZaqW(myH7h*WFRnahTiM>K>F?0D{T*>P$zS*C^fb(aW*a>te56da(?d=!*wul;
z+ez>8V25y$F=O*D7_$C=p;GZr_GdIU$hCp8llLwZTI%Z)SVm~5Q}6yr%8#euTB{n$
zSi|1x5}YAkG@)=}<eg~A9ZB#swBK21?(@+>yI7u0o4ctKW@O&^8*@r}Ib4oq%y-1X
zd|{#SXUFUB6?X5~9I%<ML1>C-MUh(@I}(jEvy%FqRiwKi`f>D8$R>x8&e~Cs7TXjN
z^o<Q^WVcR3E(gdA#G<m+Vd~r@oNMJXu`|lnUh{%l8<Z0=2ty$sCNEL&D=0>@<bf(4
zeW+ptjWO}{8u|V~f^I;@M2ifajA-IjK$&g1#LDK+fL|WW(*X@l$><%n7MsYVQKDF>
z^mV@lxB5r?ench{1wzn(1vdsx61&pBEYp=hWEL62j4@Jg)sV>m9oJGTuq<A?wFbpm
zo+c87-xrZC_%#}%!gtgbA*MO1s5fF+1(}FB`AB|8TTr!rm7xo<P8Lm;$x_f*o*5D~
zO_rYRrAP{<^UAYD0~)yZ2xzNOIhib5<51<vekmznVV}}QpxyB=tabf4sS7`{1V_X|
zqjLcgkww5dB?zOg`r<F&82!sPg{)vQOLei@&KXopZ9av$PSlo(pSccv4TMb2JQ7ty
zN(mNNpgl5m3)^4)J3=kibaC&MOq+s#2->Yd-9XzMTLOA0cfTa_=E{u_;-K6R7(@C-
zG~43oKaZL2Wbr1W?9ubt+E5|Czx*^c<^qH7%`7|I)ojYv<0XYpealWA8@{n7>|pV*
z(_BQHP3yp{Gn-Ii7VBf2pik*UXntV@_vMr2g;H^5l$7_N^D(Rb8T0qcJVR#(FU`{X
zty5wrL>Oj#kF0O%Sz1}#x$MNEPB%L%X^wV(ecTt`_kXO<rKW!?;798%Ix0i&7)*>v
zOs4V)$vEy!D!b|-g}4_~HzptXQ!~Asy`B73OW(v871}1VHAwgl!Na7Wc5Yd-f&#uf
ze4FEGSFeV)As80ORiBJkN9ZXYuwG0p>E}qL1LDUc0m#0Le7r`@6y_33iNDz)<R2_N
zJgH;CQqrvp`G%hGj9`$$-mmpmxlWeHzLx=xu@Uag{<ZlM&S|F@lviHN`w{Mjq7&{r
z4kE%IJBhNWR<f*;Nc2sxQofP0_)AvBbeM+OYL&jPAN8L(RU<g=3KCguG+x0+9pa(?
zeoNY|)|`>!o1kk+@ZD`7K5W}c3xx`4a9$&sd;6UuC36i7h&ow`FunjYqNEW@(B=5l
zjg*t{y{R@wD-%YM#GVWt^K4IwAw10a8aDN#CNrR5a5;#H{I|?1Z!5YZGL5->Ih<T0
z^qG9LI|7R*T7TuVZhzk=j=Yb*HV|NkO!|{4S$Wf%k<g#GB^E$)mLGCCV|p@re&}vx
z_zDy6Sqv|^CoG1RCd=(*lWa1+^5*yHR}Y6Wx=71MLi93tUWH<PKnwZFOTOw-Sf>nr
zjA}_WIa{akp_!hDi@H1(Wt6{x$86}72oQfV7fkqWg%xYHhPze8k}z?2V(tMf7y%At
zDnF7$mTL>N&e^sDP72QoB2{vV*Hetyk7I0c;Lrn#6)I9q)f|YKH>OCXgXo(YMo^t;
z%b8M#I#UHRZK2>0AWk&VtyC!F$^}8~hRQ2mco|zeYu6CZee~|n`vR_fSLiunldlLO
z{$J`DdU89MDKE6whhV@SK9_LphNuZH_M*%>&DM*VFCWuPET|1LKVX<r2CE#k#=gU{
z9dic&Y`&^mTa-o~fxlI?6A7+jp49FQ*jnlsf)BmEC5D84W?%nK@e~fX5*N*QJ=<Xq
zYUGuj7ctDkkwVHdqHe(NOv6h>Qq@kP<m}(Mg|eSYD15u1Sg+0y{>z=)`Ab~asv`9?
z>(CbZwEkuhf_JSfQ<Xm_UdLMBq!y&%{;!`Y_%9i7R%j%0VyAg7jNcyXzx2BovD6}#
zD7&t%GV23$vyl!fD1&nWqXp^6L0Iq~zHw!@SYASbC>-2M5ZqCmab7SVv!WKO8F*??
zJ`AEbuLnv`(#PN(8xu4X;Fg)LV8jWaQsJs&6)6KdgLBI3>>1P^Ni5%95W0!N`?4Z@
zAk$`o(!U=N#ARbrn)3y|Ta|xYag->WnY0q}X$IAD>KjNI>}Ls!jc@a~@KENypRTUT
zREV&;_<@`l+d%mO2$JJcfcRgrHyjqcGU)y*gTB}FZ>Jf{#TKGI3ncx%!Ad3nm86^Y
zpe45|b7g4=y-ZFyVk$5$X0n;aX`B}!^O81rPk?MwFzl@ZyupN8y%Z06$B1Z&q<%`J
z<vJKd7Xql-;gaMXQy=in?OrD({^b1Y8&!AA0r|a@)ZKwD`Wi7zjrGwUXz)3(E1Xo=
zVrU*>Ifi(Rv#YY{TmzOEIc|og&voymu4Z)w0j73ylO%YvS==N$Iqal?quj?*=(cWs
z;a>dw)YGjHP>|cxT#VEw!gR$<fl@!3#5>tT+%D~JZ_@{s%g^69ue}D-#K#%`D75vx
zK)*!3O=~L!4)d`B+33pVJDNcbmN$7|Qi__%+|D#8yA;=Ev}3CRr3bI5!0I}_5@hbh
zRVajZ;qNu*>FJ5EGAOQ-xS$hrT=5WJgUWILRiaP6`JZr1#yssy;R?bfOW1BXiZRCv
z7x|c%8;j1ee7a$;h``%us-D_lFO1gR1<Q}4{YrwcNIWXz2w(`wrC?-oZ3R(;s;xFv
z9P>`1Z}vVeNg9RdR9tq97T;Sv=02NKh3K%UZk-0#x{Bm*0P?{9R#5tXS5WaRP3~)=
z7IScqp$*{16i3>h139g3N28(izL+7ISUh9h5s?RfJVPR<E8WM@EqLbXcbm3^0RA;E
z0wy@Ux_;QpalJZB^gzBed~4RUULL;A06SG^J6D?k+H072BuLH*MMU+{M8Qy7=s5-J
zwyF(>O*7xm=qAM_8r9Jy^}JT141#r@x<jfB<tp6H7;X;>@+edzFQM+Z2JitCH-BlF
zA0x`bj*A`t>A`Zg2~Z2aZ_d@@W4FDJ%TA$_DC*JoSLNXSM>*&TMeWb0zWITA2iXe=
zFqU%>&4JFdOXuHEFutAol9|M|3Wq4Z56$nFn|P&1VQI-IPr+E&OtM!BI8FR73+U%J
zM^>N1_Ub>PN~b=lqPwhXa;aa3xHz?)Q3$=cg=rZdmiZ}=*YsSjD*4vb&gPK<4MCY^
z8yP3wQ^LW9+`|k*Z<<5@y)dU!M_O`5UT($1b#Fa9*gq`94gz<xI#+PGR@bC8Lv<;J
zH~eOLIif7SdQZMxL-d0--s1#ekRw71+RZDp?*6me<rk%mZ^Ax;9$RVa_fS4A9zF>t
z&eMfupwG3!;4msf+;uGuyouFfs@+frwd0q64N0W$+60xar_Y<V+0gF*%t!%spIiH{
z`3T1c^PAjG?yS?kxe2VJrU`T}!m#xoe56bplb*uhOAIumuCVVRIffbnA}utdcw(R@
zw?N(XxQR>S3D(GF_I{n`aMjp_n|e!P{Jqk?jrE#!FPqMuC*gb6cZ+lV!!)1o;U8Q2
zfn9DyCG&pl?*m`cUH*U5-6Z_swB0811K7y7#ch!#Av`&<vb&tgq}qrm$9$&L#Q=b%
zGn-soa%C8#qrKPTF&VCZd1OlPf=%^|%ip%@c_2L}!4a4Hr{EjaYB;DrYPh?)Z7i$^
zIle107p_c!2idBEb|byTUy(ZzhLQ)_*2wrlm9Z=|Ow-%VGn#50#*rQmdq!HOY(RQJ
zo838b`Ra>iY11g_#7N!qdy5z@_N;(X7)n|9l>x_M?u_Oumz!aa&{8T_cz6i#^*Ap7
z^9sh&bojsE*X0aKB{=a5(Ylg8BfbCVj<^c&<7>C}69y#5MlDjIP1=a{d+rk;BOVDL
zJHqFJnmo`tpc`jw{IvM~gz|JaBq=SC8z)pw?u5P6ccg=yt~nG;*-$xPX-C2{GS15)
zV@<f$ftGlgfPTmFsDpF*7I^z+&e|rNL23SvoK+mr^RcUK_!3<RY;FWUEPrscj`R6i
zGH`TiC%JajbNO1G&rG!|SWo}%#D(Za#{qtsE)VR^T2#g2mXo}qf8jL+Et(IJ9D>0{
zRrq0^L93L#W*;}p(iq60(m$kw@`b5X_2PId#-}p~%BKhj*kwTQ$w_pvb%atU9_eX8
zBy`xFF4RcZ76tLkTXYzr!y+iHTSKkd>YKMglv9ROK1f=V%o{51Z-^|A0kk6I?UTDR
zijB^syW+D5b84Hu!wB`WS8T+gDi;nnnTWi#RGN%I%hrH$-#c@PDbj0%2Z$$iP2e8Q
z8Wm)zGhWG-Aps`|S_9KJAP3%()Q_Bx3eZYs-~SS8@9QQS9}=x}@(?1fz@hz1{%Rjg
zKi^ah?PJR^Nm_smzIj9;MWTW}jc6aH%YqUHXkaNLS;H7fJ+asMA}APFqSnFbAENTi
z7bs*mtx$YWzfKU@BuqXLj%&<~Eg%#&FbuuNV1V}(3WJVyJn?Ig0lN!Y*t2`OHK_(;
zbWNcl=;j?K!}0f?Ul|619X;9Am#{SzDbeW*<6cmapW_{~>`0*<A?a1zn-e0+h$oXV
zy)0Jh$L>9uj>_Ldo+*kxG`e~s=iez?c2zU+*)K#SVTTy8Hl6%u8?4IT%zmQa;*JZ)
ziamY<YotPI@>|sn5kwdx5lmQ;$hI>z_FE%T^*KO=?!cRb*eCvX|67$ZC<)3O<3svx
zE>L#g>|PfiMxWJ4vIyn`Ljw%rEH@5mDECM>h;64QO%ML^XoT=BmR-|)4Q?cK*Glk-
z{w2t8gvrGX>^P)??k}vs<cR5M)n^f87;WboMns_9zHdlJk~~Z*fJP=9zG7=4Mxw0U
zBPt+07fP*{#&vPc=QKn2_TdY9ZSd;|;QMz3U=Zx#TMYb^Ht?uaF^=d~ec_;}5E=EZ
zcAL9g6IZH4{u)cuID0ipSe~*Y-4<~g6E}_79gDsikis}`LpWLjKoNe%=d6Vj8EyaB
zd2LFPHnDq=Yc{dZZm|`-XmX*u9(Ir#T^js;uKSyLRt6Dcn^!W!l(>dp9ClQ!R?8=)
z_)JwxnY_tjRuP5=bxs(CtI_HbV-{Y^w@i{1Z;Sn7zlOX*qs!mspLRey00Z5;umv?;
zX!t(grcCrYbj<f9hFjrLK3Sf=ruo2Ott&PIQ?CpPzk>GRI*gNE(2L-_j<w?D1U6Jp
z=_p(T+5BvI5UoOrm5vSC0fVb6<jZ}E2{9sPDeW4cI9}Hcl{z&-0^6eK^ds^@QayL-
z=88F5#Ih%D>kGRgQbf%@0)65=Fyw>E&KzU2aH(Qb91}<G%PIzP_)w#Cq6?o72YYHK
zE}A4J{M*PMuOT!4?7tzi5kM<J*)w!;O*`Qc<rk0bN%=dqtDTY_Xw>0)g#4oz`mBrv
zXe=v<8k#jX9lKbHmX8N&;lz9bt0;hSK4wXpJPLvpy9^4g6ZA@YXhx&3Q^_TcmjO8(
zE;)CQJ0FXBUGgLOF=vtE<q{}3ONmTAHR0%O*4N;uuy2wZ2L$N=s@?d?l-X0C1Ekvb
zFpBh5)_qJ$?8`CFVx~eAwM0Fe{W#D_&7QTlBn2tXg_|D2Z#cEwxV3oGwU6?0V}A&e
zZ0+{^U1@&(Q`AVxFfG5eN2>LbbkF8!^TzETJJFm@q?Cf%mN<f<@m^e+d+VfnT&fxs
zdfy+~*b~^iE6it=T3m2X=r>>|0+k1_yHb|qz^23|4W4`Xp6_oB{E$cGyWa&<=5Eba
zb}B__DF`1=0mO}>LcMchitXIrjF5f~!s~aFBJqBYDDD;Lcj!h4)kpnl+rk5GMOuvB
zgIch?1nayR(UAd_VN_jSMFu)~HeJ2{QuIvq@Cb9g^2NgOGgNf$voqHRT0@;oXdLy*
zioCtCwc9B=gW!g_S6u&%pS4~KX|8=S<7@Xt`<oJ-)^qp9bXh#f_=_S_*<T;(xIxaM
zQ!p2(=|kfvTZA0wLtOqcFwC%U#!wwxJ4h4o@M9~TeSUcgEg4%lIB(sF8V;}0qgY!L
zJ{!2?%}|K;%OTdoo<#9Pc|yaEe`#O$buX&Ahv*~p?aedmy-CuYfi=c(z*@et{}>v8
zZ6Fnk<Ci6`T%eJ>q`ioa64dU5?QauOSuriKSQH*A9Lsm!7Q|v*MXmvV(EOwOVx7cc
z3%o&>@LRL=bzKwrX9|xmuw}?8Ndn|^W(|nhhAN2rw4pNxD~PtfRedvU9`9=#qZedN
zmnxE0Jt;DgaB4;2vT$VGY=p}^^H*mkv>-XAM(CrVqlw0PDh<Orqwh&lR%k`-?4vQ~
z@HNKF4;|;s;B{lEubt8!-=n{{1W{0#&xI?4$p&h-g7Yi9*G{y=De)Gt*0P*uCT&A{
zIklN3H;d>HFJ@#85};39sL*c=A(;|Z#e3uZNLbTQ?4b0>{4VyI@4S@BxqXvuMfh^3
zT^Cmyhp!zW_CHro?Qch@>!iAnLlXX?2?Sppak^aS?l{OdxvN%$5KfSg!ly%>n#<DL
znqI;ZrnSLm0bg#hnlldWL^;ruS)f~x!tuL;;EI<lr?)b(r|OV4B2hq711&=_!F8UU
zzp0w>GnUr)2WY2Rhf@M*k6O{@z|L}o&cY;fBztQ-m~g5&z0*wn1Iabayr9DPs07$W
z?K=IVQQ?@n>AnCaaJ{^5Dm}I?&dMS**b1hetJ<KBq;Jm7Y^2~)u=n>~-m7dm{G%cp
z{w{5XRa#3>r+NGue$y>dT;AD5`KW}p-+7tZdyF?k%pn)jQ!I9n93(?~6-!kEJScAa
zYxK9^#-n_H6d+qLBY_f%&?1~KV^Z3+;vHEP7iBzx5cqqymSVw9%4PcdySl>aJ5v-}
zE!D%i<x>J-NLxPT1#Ow3Xy}Zh6kLAfTibJj&f>ngW7Col(b{Y3R{0pqu;ozdE*|5u
z72-b&9x(MW+#*xa`)2OEtjst~EAM#dw|*KhuUD)5&(&)B+YiW0)c<k1ua()f=ZzXM
z3EfR`+Dwsmqc{;=f-1J8;j}VFWSz}h&W&pz)QIi3kKlYfq6!MIF<vp%ZoM>gQ6bXg
zv^TyTuqn>`?kmM*P+hY(484tgq3BIm+m_A248Q3emh~oB+UPCxd!}U>1I3HGoRXRm
zF>4$)e!g`=z9Toox9*hlZ%vEl`T-^tH(QlU*%VCeu13G}`T;T=GR|u4&QtqboE7l(
zw(@)+{(^8m&+ydOx%~Z4NPDb^kSJz^$$1E%r8Yd8{D{H|dPuP2C=nyH!EZny7si8)
z!Fn88!{8bCpzQuaRL6U66)Ja&T52M&XRb5Ip96(d+TZR*AHI)=n3X8=OJ)eVq_XkO
za0m`Lbmj&5eaKmQvAg<!G<KiyXL=tJ8&6W>_T)C|#c~TAH6J@i>m_cYgS!NS(t=4U
zP<zFrGvtM^Twxu*b=3~!Tb*M-ZAG?NQl~G9t(=BEyn(tlB(YQOP3JtN=|PBZ_)!9Z
z`a1<Hjqm17-26YG^S?<_sf_{FX!hZ!Rw`qqmBH95KMo)VW40Q?*0_^ic`=}g@{1eh
zg{SY=Y@a%%spHMouRN#?NW`(sp7oL>5m0HN8Ljb0ZoaJ2+QjoGjMB3ZK@HZC_k%D~
zejIw~g()Y++y-M|87Z-7t@3lo=q;n%l*V+2868c1Z?S7M)+~xmK520mo6oO<aKZ}Q
zA{UO=D45g}R`$)qOB{hPS*+xl0ro<Lsa7Lx#oG3$#6$Jz?FIVK0`#LiPPsz;iYU8B
z^P7MnJDIp+rQwyo-}P_H;SXAD;2hKl6@CVKL1jCv((nM^1%hL3h8_nJVSQ3XcW)^;
z>;PhubT{&l;w||Il8YM51?VP|HB+Sr>!Nc0!WfE}yReP^HBQ6f&)Tk2F5CFAiD#T8
zOHyk@57c9C*5Es=dp78B@r~xJbzL;YHF}V%{w!QBmw4n*jPE_TnAE#-^F(f5Y`yu1
zUY0^b+o17CvmPNl*u{{stSg@OQ8IvoX6{3O`1sdiJ*hw)=d2iVWt*KCPU-Sj%pd>3
ze4`iYXbUakM+Fmr8W*z=e|+Y-p!5cbh837aI%0l3#}4+p2b*uDpYqrNN<25o@CZvp
z)Dmb$HrX5Z7jYU*sR*Ay>?UEJ7p%LMhU2|GxikH5xh>QiR!g2Shp54yU|_?vv)a_t
zP*-P&ZacJ*sEtwR$L24<`}DM5LY{xN)cX5167AixiXFXdL_|%q#&X(jo1Pe=2fUJ$
zyu}#(4-g)Smc{7Hd_K2h5_!WDouL&+L45Ub&o3*JxROB%ht;50F*fmUTcc7*+PML|
z<G)bl^_&VJ!pwx9^=4A}z-C|8`5aLUT_efshN&rUjWa>|t`^mVs7r{G(S8n&S!1O9
zg*7JjD(|VEmfepQlg@|*VxMzKgoMt6IINbKsdc=aJ)F?*+Vmi`cZhmQR{BMZ!r&$5
zzbpXxOeQ{T#K~*;0MVzo3-oNB^U{5By{t6A&-!uHfbg^i%Kl^YCv8I+s_Vj?Z?wMb
z?F0y;@J|hINtcLU5Ll5lj2x>krCtgDzs@EZD<zIKCa*F>>L=9{IPP^%oI%S?Zz$)P
zDcL+X{pMH$)4Lb6O@nMweJ6swk~dmip(kQG&S2Mrb+PtxLDYGFNn3G?2x+vDFD23R
ztlr+|a_~69$X#60WM&$+mz@;LQYI}xapNWQjvU)9<lItxLLca?Gmpsq;%)WGWh{P^
zq!b{<*b<R_7`eK0iHEDEREBga?jpzSsCVS4^kXULr0s=6??lb?$2sAlsQPQI<ikJZ
zAC%FSNVOU#W|h4%`?z@$mSmuxGB>mn=FDS)9xMqaDIt})yYo*58j73vwDx}8=^)xw
zx(z2!_*OPaL5lbTKxbw+F`Bd%NH3dPo%2NE5<0KS1>Nri(rU6eKUFqXp|vdS#ZZ=e
zp{@*Oggwurey48TXX$+2eh1weOwAU`6^-XacdgdOn=AwRVI<&XF1w!yJEM-Qn3YBJ
zBLwOeEw|nLvt%MNw5#qw4w(E~s0B~YA0NCRH5Q4KXyQ2A`CIoji2dsqI~OEMlQNMR
ztsaRlYSYI3$JVZI-yIWFWM6c)uzVuky7QF<Lp?|yn<bP2dbtKm79I=qZm?z-G37EP
zj%2f8SqIKpByX5(c7-69?*MxzR6V0>t=!i1HrOMm3RYYWEbKJNcnEtEp3W61MHkIH
zS~3FrfXT>088mgpO!Cn}GLW{^fe04Is-ksjmFPF5!M)FHXtJ=anu2@zKJDaq^>BD;
z!pU}kZ9r*dZ!S`9RkoAib-ts^HDrG#jOF$!900HU@QU?^zgYjv@8uVxh}-CO$)&8F
z*hsLeN#mSorrL<b1ISu^F^Cf&xX`L1bhRKiMzMD;6szodjIzL34<gqOr2}Ih5UF_1
z<C2m|BlT06cr4PKKSuuAk-OgxQxy6(=Eh2C49g<gIiPj5*7j}OE4Mb<ayvzWtD5l#
z*&6oeD*QR-ZfDxA=O(%Iwcd%t%yM<{&Z5xotTADVkM`CZl+G{3@t?-0isU<bB<4Cl
zq79+B-S;UAI+oNdy_JfmtKvXtA)p9}Tm^=|rg)zJTO;F@Ov@$8ZYjGCnLh+3<fzQU
z6=lwTWq~PoH-gqu=I0bxL;?@@{puM*#-^&G$<Ie$LNcGA7m<*}OrL#<u|hJj<r(vV
zhxslwgbB#1x6Dd~0<tbSi)~&mN$BgzG5Zw9B{8Rm0tL;zQu#ZZF{?De^-a>uaXgJ?
zA8v)KiK3|*)0AxW5W>;NM*1dGVg;39^NqY?xwIDbeR93XgqW3$G9=BOCw^ZK{-oF8
zZpE=D1y1No*T>b-%niA+nBd;QeUu7+y>J<?(wOs4lc`cXv#fs%g*0#&-%&Xi_*6xw
zH}R>B5x2fXddhoY>L+t-jWS?}e&d=W%@Ls5w=`kcNrcv!Tr2cJCCOgcHfj$!T&<pC
zA|pN+k0<4KY&Moegq>lS{iXqNoqclRE@H@Vmn6Sn<CD#q9^8$D#etaNo>H4sWKFft
zNz8nAgD9KDIYI@Kuvb}>2itq=8KlW&qASZasxL)rBvNOMqOK*sYfyl$9vvsr>KJL!
zT6RC?eNxrpUk~QLih>yy$EURJ@h|6r-Tb8n9V@e=KDO^sk^|=YSmkH<Mi#h@DfI<_
z%5fycZhW_C5uYO1`C#F+xs%01RZW`T^^gU7Q)?)tqBLEyMcHJ^I<~LNaLbHG__^^Y
zVG!j-Ol8=s?P6YxK8l1$Ny*1Qwlky|mfT~0ueA?A|1h{U8(gXEh;&r8B~8X~p$U+9
zkTvb?Wcw=XOu`@L)G#Z*FA}BKMa{qAmiz|7=0mP=dxk7;J&XP><o_j+v-q4zffwd7
za11B?HrFCz8y1@A!EnF>MpGUvn`q820FD5u59ig80WK4aL59Ky|2=}OwlQ@ud~9OH
z=dO#7(GN!X8h+Ta!W_S_AEiRvnU=u@o%tU~`9{mw5}_-dSS;+V5105P>xf;}krJdn
zSF!=>6J5aVbI6h_W)6ANwI(85kR}W!Iq@-Wgv`90*ul_C!4DM^I)o`fM05p~n)yBq
z*vTsTTTZ%l7TN9sr>{)-UrE_6{!K-y8cq8~<`c)0Dc2xs4R8m0$c8u%Wt_}-mU~CB
zXI5Tv?5p`tn;s*}SPW>LWpit}NybUzc%>*LdJ{wjRMcH^^9|T>37i1gd6+Y<ZPYPi
z8Vq5hw8=V0ht+L&S9C(S5?Tjh)s@k-VYpcLqZh>m!7LA>-=3Hv%q>k+Fev~blme{b
z1!Y)_F2|a3W(M|JXkJ#Srt{30kM(z=+;3DH0EiB>p932zt~KC;E(#pg`6zh@IS>$<
zl|JmrN^SbT!lLbUAx6scY(H+da_YYA*OQ;?chz`AJ|*9O7K+J9V19e~ZuS7tqg*=N
zo0n>KD%%<SL;i{DfR0+}x?sm$f&wPp|Jh8=|E&zqEeKk$I4^f_%vRJ$5K9^1aM!pv
z+e8xcOW9F&Sw<h(nknn|Ws<gGZNfYLBDhjn_U=slQwBP1x7=b+eb(KaHq5PR<M}!6
z7-i4u7?Gz+Wv@agD2l#DqL#&-WSQB7;v^;8oZM+gDdd~=o$W7@##?78n{GLzd9D$%
zo-v;Wl{kB-m^9$;M_XMWuL~oi*M-r>z>Tv((LFU3{Z$#MNB@wy&!9CjIu)-1N5Y5#
zfeeVOFi_dasXXF*{8$%6t!1;o2r#k^6W@PBEg>Y@=|6)JGf#LP_9*YcP-3gifYcej
zwAe^`M8k!(u{a{!7m(^wqZ+<<ZK(|Pu?;sA!&aDz13}-qD*HjMn+05%2{E)uTte#f
z9Wf4vF-^b=TGB#ZuQd@rKu(s}vN@nj2I}t>)#rSmQId!kcz$F&t!WqKKbR$>vs7Z5
z^g@>k^|meB8_B>?pI+0*sN;?K%pt?P@dfYK>n`~prQ90%XWe4DiFrjc0FfbRlsO1X
z9IqR8H=q?r5N2BlRYc5_Nv$x)CxNMsPH0~s&2^;!nlmXVb~?UuyNU?9FcPKq<xkGQ
zaeIgO!M8a=A*<V)pg6_0*b*tCvN#Y1rB0<Q(HLLR$)rd3r{H)E0U~X@Rk`a#cyjQW
zLMn}?bCt_uHzASAgS$nJ%z-h)2j7BtLt{<TkSGviCimGsH<$j6WYq@6JAR@xjFl^I
zPXguwsSij7O~H;pf4h@1hA;tnz2YW6VVkZ0e`fZv({%V#b<=r7e0cganc5Vg5lOCn
zVoDxf`laK%;0jgG_W48>KWP&$CjwR74gn9Kpgq;8m87I$Oq!I6*l!vewis$=)<*g+
z;Z}6Q+5Cg#10hONxd#5Iftw|sK9mP2{nYVQ<~MAOCekTG5CGanwFe1O+B|dtoQ;fS
z-L^puC{>vtz(|AB9|<s}CH4a|HeE5)HbPTIFM)w<t<j4MZu!|IZXwh+cN}A9ivLnm
z3Eif5)tpO8Dxquje-_}is|mNFh6Cbip|sxTgHnC}#N&z_K4lF{2RSZA;?OPYoliiT
z^~k;`^JkR0@vpy^9P6H0*sb`CZetS$%Z;~L+WoN)>SxL6a$Bc$JJd0GI2K2C+I^8|
zcp}yeo&*oYx~=&5w(KzB(P4PcTuiGEsv#PC3xN<(na(?1K57pKF0p&93DiM}7f8^T
z5+QUG$tv3Jl>!7OKFYe&dzu{0Y=JX%V~Q9F^qE$;$VvZIPJx!=j6d&Y7XFvPF6}cF
zYUZOyTbxh%eU-+Kcz<jq9HE`!{@??BJByVa2Gj2@>B{P}YH+vpp~QUg@p=_OlDBW1
zaDaTk&z5H3Dc+<0y-p;S5L~+k!`J-<EukbB2QX+N`MJ?6tY1FfO%Swwy`Xvmb(1Tk
zlCX;S+0>Bo@e7rg!%$(w@P5UGTiC$cC0;7k{Ld1R>wSk`-lIu!R-O1`>3+)+!gmz#
zPS<)cm`<vq+;ZXx`<XGnF@|dr_wjFZ`M&VaYm5xYu3tOsmkpUB5rrt@)z*TA(oRj#
zZ}{=PI}$@JIcF#;RoJmfAr~68)5etsUHxP=?#3NQa0a+U`PdKuX6GUgSAz@XH~Bi#
z$C<*z&1S((G+W?k(H2SU9&3c(^}J0@`L^e*u*retRNvB+sQga*F<^hk<$TIubgD1A
zYV6yD6c!zDDLy!|zex>%UM;e_@95x~s*}0X#o;x%=2^ndaw@>$g&sIQ_6bj3-h`tP
zk!5LTjgZ_?T4VT2KNd;(M=TVgSIhrz>GDs{3>!XG1vga|dKULBg(nQbK+A-)aI2b8
zbGlbGRes^F&kLoz0b+SXceP{z-vXxdi{B8zZ38orP!_Qfnj7Ds$7m5jHVck<_KF%c
zuX07k4%M6Hy16_YyeM1tVid3eq9`@9bR7{faAY{H4lB>hMw{wBLyLc|Rao(N*#K}P
zA=dK^H|I{fFYI&o)NOfdRZ8pSw4n^<*n|4cv8J86h*w#+<FGDHIazQ6nK73<+F*6E
zFW@MUu%xp49k)z|2M4C^SO%itfTsAh*((uwzY>uPIG|m-nV5iZOn`}|HKNWK`WROK
zg}bA9#`;IP&C((zuyy$;Rm4qZM@npZhsfAo4Sn2B1cwzt5QB6rV#ayNFe{0)oePL+
zL*tyBVjE9HXG_71v~faNw;_Oj6c;*1%BTsY04LBEn_Q27nG>U#Ttb&-)Rusm#aBko
z1sq@RxM1ExF)=cq{z9^bDlY9mhqaDVN6KTkS)ku_k1(}m?^L6F<(t7uJZyf0&{<8@
zFJ7U;biRbDIcWM}m9u&4VZa>U?7Igq>*c)ujs@0m&^nU+&Z~Cw`nO&>k6q&Kw?&tB
zm&}~*6i|^tM5n<)T51O*p?vCNsGACNu;rtrsH<WT*$n*&Y~fny-NQjbvy?xe4?{Cl
z@wX_UlOPGi61Nbpr68ToKvWkA%aPVy;M?Otu%M5M;9j*Kw}~<GdpaRHtMHD7T}Nt-
ztigofb;bG;b8vSSF010hg?i$vEiqWkjaQ;EvDh{lvs;>MM^I(g)=ni1<w6xK`B%m1
z=NdBjE^L|b*9nbTry?FEF)2+6cYbxX|F@0x&+8g{_ciHI{in47Z<AoBuqYVd)CC7G
z&>?}SK3_NIaUsNrht11yA=<$2jaLK=*PRg8`~y*xDN1TSMM-uCHGr|tNZuq;&L2(C
zd_cubt%^~5;#-u0nsyw+l?PEb&~DE$m7U5=-{859lIFiGK<}rzZa)yET4KpoevBvb
zs{{8DU4gc0e*$#lJ9gzrbPr~Je&M7x3?LHJr>|qOb_G1|T7u4D-VBgIrJvO;!LD>z
zH%_TgeP2R+K8-yyPk$ZL|9iP@EPY0zmL3iR2*+m}LRaAGkv*DopCb)S*3jxV8=C4Q
zZI5sme51NaU&P%4)ir;dm!-yxQz6V+B9YeYhcUL}xJ5zczTV5UevLMSLX<fE02b8U
z8P<t6h4+J?XB!SsZT*lX=OiM@*$z8V=5mRSQ<7LJdc&04NlBm3(P&Dpf>zDV<BlJX
zr%DBZtbd?ZK1VW<BCjCJsoOVTM>M-g`FuhY$HBn{(GT_FLPM--SrgFlY~QLc5{chL
zp?rPoIPt%kolJB+uDAoFPz0rK^_*UBQfY^TPGAmWt?CPWm`a}{>b3|J?a%SnKTzdU
z#xY@0g#XzWHJ&VZ-`2A|<27SU{ze;~vjZ6Fb6ZwkB8Ef`bBb;KunfRVkqb=$#22+v
z@^6Zi85b#yWrSXu_ou}WJvLLinn*G?nx*5Oa|pb@bCV_Lx@?E9d)#rS?)yeHfvWOJ
zOw+IOl+-GkZMxb9Wy-jk&qi<G{CPhsXPF8dac6K5EKIOu%j9GTrCj)r5&iG+c_Hi8
zn+Zg5hqy8VZrXQaLD0#tZ*|{{@D3kS`3h#QS$Pn#&<AcfN%Y~WVp5@PMMO=F;laAq
zDMEF`KF${uctZ{8<pmc(kJuABw|t&L%!y(C;yJJ*S#Y}MIIxr|fvyOD)UI;!r-*x?
zD7hLkVnJyv^)-Sq7;PWM$LIg3dJDd&x9|O%7`nS*29WOV?vieh?rsothDK`W?naPq
z(4j$6I;D{=K@kCO<ec-pfB%Otulek~*Sgkqy%!vTrGc7{Be9DYWXr}2ncB!~6q)*H
zjMHulSTYc)E7ylA|K%kj`w(o8s(fE{eURrKtj#pb^dRV&?S==Fux8Z44nZ!C9n?~_
zWn1{4TbNOmGd84MErmH_imtdqir%Y<^`iQ!`g5s@0IGvZB(M4$ghD*Dklp{5h49k0
zIZz`#Q8k@TAmfOW)4Q)<&W=8ce56>~fHGQI#CBAhuzlz)7FNC^Y%odsgF~MJNlg(N
z{5}cKO*ScZbE>YM-DA?QC<?aYdwX1`Jp*h^nFvlEhFT?#9K=?lIQ85zj4;AraNb0V
z@}l8^km-WMAmOge5LhK|K(B^{2}^-p)wE)J5DHb+;UqfMNUn^C9|XTYI<?b;zKWAZ
zCTm_)d~WT8>x}dNrtUnJnH(vYLNm)@uI>Fv`NBUt*_>Xm*w}c`tEg#PL{xXsS}+mk
zMcO4%*y`0_f*A}!iwLsH`q91tODGf*6{BL2^=sM_)3un5qDc|aev7z1(2n{TFeo4P
zDtJW6g~4~L25?Z8UmTpP)KZL*=7?ABf9;H$904gEcGyBaVNHLnRJxt(l!Rf1_n_!%
z?L6#F@I$nP^krM<+e&mPHcf%6axV9Idd=8*;y?!ZDD!5cUcdMBmAEI9X@thS#m|L9
z?%x=vUzM2g=h<90V`0H~jGvZV*gcCFLoDF#gi#6%PZ4)21)Y4GAs@-ZmxJ2yLy>4=
z8NWo7nNKRiz|I!3F(fb)GJy`+3JM4m*{#XSyaU@K67$fh!F5>V<LRU!HwOk5Zv3vV
ziX#dfS?&RdYu^EhIj=({W=Rhj9+NKamCRENe+}(K9D<xGv$>9%td&`wBt=`=AIi$A
zs#iY@%%z9HnIIc1)D=CRk83v@$!<6VhyF?;-9YgU?Zv@;zS%DSojWx}6qf0^h7)cj
zCH>Aca*5u`Zmj<vBAJO&r9o7AbSe04<}H_$49GG94P>+hvw}ZclCv0JgS)(HAAYcy
zz8a@0b(mS#UjoVk)Ne{!l<iw`<f4z?xoec<<PqC472icS3ZnvJ>Zeu~82jci38zKE
zn!n=23lpNEo1fW2rDVFs>ec+J!0l)w<!365Q7}d9#xtb($Q++9@3v?v9dQsO)#}D)
z+QsL5e*5XfGP%6nO(-+<dCokx{gX5Ki`A%E!Q;l(z(*y(xgzFG;zbma<BG%r*6W{T
z9a_>`d$MJfU@cQ>%oa1Fjgf82H?f6G%2<Be6*dGN>#%M<_)6(S?8V2K_%nXS!z1g;
zFyNr!X-{?4z^Fbt>{6^Vb-NgEJ<z2$N7Uj7;N5@~Jg8%f?|OU?I4>G|O5{4nFZ|Lr
zmNxmwy$3oHUq$2X(z;1izi-~@LLPtb+eLk3Yz>7d1(Vinp*(gr35#v=6p7;7G|n=o
zFf&*Gzsars7c{<gw)O$#@soOj3IVQ<MZxmFnl-|c@=~Lw{Dbn+D3eIcm*6F*pyH%+
z=(l-FmD57KFKNFKCaOIaea8|a|M-h835oj{Mn0bgPJ`vGlS#pFtwpBEgTKTym2bov
zdQrG}nc;sWM-|i({icXnqXi#|ns`wK>J!rXG|EatKUx2>VlwNuLPu+pRCmY;y7I~R
zK%D1Bsnp^k=q*Hf$8o?6ar;yB{uA|tn>XZoS^<3TTYV+5v-^L<!7v3H4#}aZSEC@(
zd18fGrY+3Gqm_APL5~EkFWfG=6W?f5&-8W4nMkEIqUlMu`})+`YeGjy@mstFg`t+p
z*#SpzSw`?bK(p_`!7V5tZ?yn57I|d59NFxr@$agX4O#l^XjZ(3h|wpq>3n{n6us?T
zvT@zQNW;KVZUlXp@O1qt0H@}f_YW2-JrdOj;vqwP#u&;s-6lbd*t`-j27}D!fzcb>
zD8<|g6RLiZ+*qJjfI&H1Xbltf$;hW3pYIw$;h-1#QFOkD3yeZ%ssAT8?E2I$+yg@&
z6!vK|e(~eZaztMT+j;v+{6dLq4VG|~=JEQ*CB6fIH=g=|s|wB|^9aR&AS>wassY7v
zJt*ZV2xz8JO`Vst#Rjr(xjS+;VIAofY25Rn9du`qB47YP!p}LaNxk2dSoVPL6g6&M
zid=kHpAo6etzJFmd<#$Jcxh#-#uPzmc0!+K1c1p7b1}zf<>II?%z4FW!`ngAK_~=<
zJK(C<7XCHUKZxGb=A=!Fisr6+HLRk3s53S3?O%{=nRQ5*-h3#HU5{htQcd*O@EKsW
z3x4%nz5RDfyMRU!;{X;*gFDd>F>a$VHf?DzLh97ok&%h@Y|82Is1d_>CicBh?Wp;Q
zjhhO{xVKbQLsa-cg$cn;(;8OX*<}l-I8aztm7f1vaGUu@d8!$|AT!FN^(se6S6-x-
z144G4rLn>*Z&j{cmH}|4h($vVU1TQ1izpG&q2@8SwLFCOyh3Gjv?<A&^J!D7rDEqL
zC?+CDL~nkl*tW4G*Bi{`<$<)I&xH)U@q+2@BeXChn2Gfy@a-h}bg!<Xrmu^@jM(JB
z;qzDd*LZ656yDnMVuK^hcb$PVVRisX^-hdEnGj2Dl&!-IQ2BYa#Yf7~--ilqM_4q4
zPDfPUasiZz7|15-?1l1@e0UbEk1~v$31B$!im0CmE_yh2vctGM>9xwjj!BDNS}5cW
zLR~u@8=Wa$JL{6naUR1+ArrjO11MxPN=fYrHdkOkpK|W-mW`z@F+4H@>6(-((P2YZ
zikYGOLxKpIqIZeLH`-B{VYb@i<n(})9sM<hwcF|>rimct*Av_SD(mML)Bz1LbhmBI
z^T<BX8|Qp#u^Ca+$Wi;LL*D~0Tpjy@uf&j58)e)oZC6m{zDZ8*0*8bN-)&*B*O^VQ
z16Z$#Av7PJSgbC$QZucWidPcnlMYvBUS+A6BIPIV@jcarQG-*{#6lphux{w}h~lYJ
z$9!QFc%j8Kr4wplAjK*PZe)z8<g^fMKhJcd=wg>2D!{IV@uyf)Z2L~uoJ{Xd=KpS_
zalkk_k0VEACCUu%+{SuVM?d~A)y)8RX6}e0-LYR|k301!pmBu92bY$_IE{sY>%nLS
zEbJvXM$a5p5pIE>;{Ad+hT7irQ;Rl+I({Zg3|LP=Z*>=K8S8*;JfLhfY>X_p#M#KC
z*ljpXoWo#NoItayg9r^5$l4*?O-3i4ZyG1VO_PH01HxYiYzVpuADhs%)pWrfS;Ur4
zC%9<rs#YhrjlORgoE_2X{}AqCSz~qYqvIQX^ciPi?32dVQTVSBSSc+X2YfAQNt6G_
zMe|;lnj<L=Jl<=&zPHUk*c^t6DbWd1WhTyre1f@TOLpX2F46M7`-)$e=Zu2;Sj)I3
zP&R^yR-?r9@IC82Dakoo1}kN?6o4s?=nN^xFM4ZK_T%(h^!Bage5KsD?{Yt(_e?Ch
z8<$zC2=#K3{i{V;(Qm?SuIA950%q%=`E*&nhHcFsmU4s&zE)QB6-<I>Vb^&%K8WtP
zFkQiL!30L6`?;*e91H?JO2m%bO2Y5N7YbaU9|Nuyc<r3^kpynN)#B^xAAjd#Wnv1H
zo*n*|x78_Qr+k^AT)-qnJTR<&ujsr_E2t01M%6j6<d0P!)Q6D>rVpeY8<%QxJQ7u7
zKpRfS2~<Gv-uMJ~P8qM?bcWU9y?MujV9*U7GF3g;n%hVJ$R-?^gjs)5j`%0xLBO#+
zy(7n%A&Hs-;)Qquyh_w6q+F{TyQaw7kbP}-S8fcSO@2FG+X24lElc?&*p;pdQ2P<G
zdpvZpuc@6E2W2L07YSR$q8e54K16WY8#QKBcGZ#_bI$k)@85PMEh2~*<tO96X;`sL
zsZ;rk-1whKs2zxvxDAIU4fsg;F<>`&oF2hq*0rW!u^)T?3XwuGn#*sE+6dKk*iqAR
zj!X?^N+m_nXunL?JHC}g)sgDf8zmGya}IuC91WGzBQ&>gqxXc{K}ub2hhbycs;g5A
zkR2-o5Jm4r&<82O$4}%VjOG#7+E{$VIf>+0$y_hx8Ij9q^5gbbIP4&z!RY^*sTsSZ
z6er8uU;^kU`6VssnOI4jhn7@`G-||7;G9ytbIqT<R^(F&zo-o1uteLL=24DEQlKK|
z^UWOI4>e(Y{uo34ORV@5m1Ir#`FaEWVgTMbp%X0`1klM4>j*NxC#MMLyCn_xm~w))
z1-5z@(`SE?IM<U#<W@JEmL`{3Wl1SZ7>VNxzg|IjVP3&B9bu(f)P<pV`be!8akPDa
z%K@ONiiNEJJO_hXfNXxbg<2K{Qi?v($qs43lD;7$9HVXy0$k!gH)p6uzf|ZAk{gy%
z<x1?^D#_65DVbm*L{f%6Y7;$e@!ib?@6lJ$?}Cha*{e}VC!>2t^)%6P)V5}P{$D*b
z;)LFkZ*oUEfxwD79CAZg$0xr=7P^L8(37uY@i~{%7xETnlpm0OJ>#fj%dUV?dr9dK
z(GyldWyz*{{GS#u0FBdiWjyS+PvR8{YobwPL{h~I<r<rlhl%L%eb0u}D6jQ`aB-mZ
z%<*9NB<7gRN+VI|A_8hLZ`f^kuco1J@Xnk^Y0;e;tYE*)37>1$LQ>F{ATXck4^9Mp
z*@2d^t|EMg{3V;43PN_yBz#4OR4xg5XR3P@?D@s{Zx;83N5JjM6J;5U<-JcmyQ>lW
z9R<A|Ne3whc+C_6hz+*i(V;C^o8Vjij3>&v3=vARm7>9BDUYj+6u>+8C%|{s6<X0`
z8GxEilj#qg)z^o&jc>}yvVSlq2Wh=AUXBlAkyj=JA@l)r#;3f`VEj9udq(zfww*Zy
zkTdgl$4I$Bpco-3yvNJl*Wr`NNn<DO{BoTOe2vQ*gNHe1@fl|$eUW}&u4jx7>MuF!
zX{TMSPeN664Xyqy2L7SGBofQL$Fj7w84%vGkS?P+|IQbV-dU{HQ9jL4EZ<9xGzK3@
zX9kqEm)^}q350ipC;?MBc9$c2y0nGIWXN++@Jc8<pk}A?UwU8pyY(S_WW7<XQJL}#
zHM7~I2uLO|VC@DZ8?5_;8*mIm%_PaR2~l5zihe^}2jnj-Hgvu38fN#yC)zwHAwO?P
zKmT+o`!3@@mdi)|`Q^!KLV>yw3J)nT@>=_=Iq!^gHK;V7!Th)7`eNR5BCYGm#L4??
z;_MK(NdD2W8UJGwdP#=EVvs~O(e;b|<<y9$tj%k;H@?~w{dWOpVj!IFpDm%U--t@b
z!l75E=wV;U{3+8606hGHJ9Fp(m2`ZT`<N}1#4JoVOZt)qNyjBSi^*{7LlFNG>g9sV
zuW8!O&b31&zta^ka=0U}7jA_X3+?IG$+$FU*K$xigv`-Ro4Y|_GqADWxE(HdNdJ&r
zug~QSTZP4pDZAEqjM-ie>rH%D+LtBijVdI5No@j<f&UO<vP8CXumwJi;ksexGfAi}
z&tT!o;%_!+3}EW;YEUc^><;ir*_o3~$8GwkPT*w1POKJIQCA_{K$^IZ8{FBBg*v;r
zfS=OLh&zxD>mO-bQ}HG%Xc(MhAk#@jZBKSEja=)dc19#HV`$N+&b~Rnpmj3L&j>&U
zSh?frwrOORHo#g@Pv-W_t8fCCfAZPW@EBuv3Ba-GNXLoUGB<(5<lN;r445S)ABtl{
zkvaDTDE;{OcjFVFdepVy3EZ@Gq#`8<;NKm3OS?UwFoRP1=7vU1_Q?Zd=Yt{3;g>|%
zNq;7`R|4yw8|<e``<edMe2>t`@P!Oa$0PL97|hW`8(((uf>)E0VGE`|xgtD6bgIsm
z+0Hcz@as067PML+41iz5oA^|`)<2q5uGS0kQjYeT<LM|bAmq)FMr?~><r25iV<_x%
zE*K@f%7I%0v;^8P5i~hdhHhOAyam$7j&Nr~;-JSkeaHC4y!nY;K_YYN+H>254CcRP
zZ#T&C`O<qlK4^F}8ed~pQFPBa$^6C@9j=1p$OGgD9tvf_!c4mZ_Wr$}coPypSYg~K
zk>#6TQF03L8nb!-RTKXObVOjxBAx)GUHD)#ibsw2<Z2}_{N8PVwy;A<60+?Q1@$KC
z*?H}Gc#<4gF4(*P>9_lBKUwsr863logpgVrZ!bp3PcVFLbukxp_srOj_oq}fKzE~x
z<#+1QbNLpT)FtB=Na;6ofTdS_u6=yN#9Lk`!4t>GO*9&G?mxy&<-|+H(#qFA%9{<w
zrA!u+EITaTNtE1`fFzx4Qt&kf#kF@hh$_Xfnp1Q>K@Eo{bK)Dg0}<n@UvSzUuf3y_
zA+kV)x*;4@{Qb9{SbhI~i>f0>=ob?e#yCB*3yusJEH0%vRS{|<H>4<78CmzkrkKzv
zclPX!c~R@nN6L1>2)U#Cm~iB9iAt%Z-!+Lq_l-i(*zk9y5u_xgt;N20*8`lGX|tr{
zk(!k=R|qUIthcz4-yD7O4*eLiCeNf4(J0l|AzIni7$;brrA9thoWm7xgdzyd?)q6A
zy#6QBT%W?H$!;5H!X~9*Qm1%K`kB~)e)ETho28?xQLA<N&rj(8LZ1$xII#8HtR7Q+
z{-;+K9>ny1yYV1k$y*}@D+7fm&IEb!87`q@3j%C_m_UzIK*53I^>@^AI&^CX39-K2
ztQeuCSeZBe_*|t-^vyOUxdJ9L#NIQ#a}=0FyO}n*<SzS|Qtykbbig4F)zB4e%H0UW
zqQ|BH)5o{x7s@Ue(;Z0-5%5j!kwl$ydIDK5@w2NIM98?5s*eTgUHcSLWdmBt5osGE
z*G&ZjAKalg=&pDs6+z1(*2YS4GRTxO)f@kh>$6F|J}Q&H=Ycbk-4V?t5vB3s%L_`(
z!C^GPQH2^XE5_nEW28t;QEw@N^ntF289jLddd4>nv|m%ePD}*1Oj35sIZdvh29Er&
zuSa+_{d1x}U1gAYz7XJi<?je@tUT-V5Q;zbXx2%=T}c+8!-hG;L{yQ5Y*(JwmP(b+
zjAOC-*aDNQgqE9uZ;4{D<pRGl25r7$1yp9=mR;}@700ZUoZVpfA*MJ{&<|;czz)`k
zt>0}1R;hgm0gD#u$~-HE|K++9)3^2PK2ykf2}~TFezpBDJ|}`WqW%E|Uuh14W0IQ8
zFsnDlw`(V1C}ZA_#m=^VR4RCAPsQNPTD4eBeM|=b)ezsIINMwLQ>;+!!Urk_sZG>H
zV?9`GB(J{2oZ)=a`mgdn?CO?6HXTwBm!|n1mfYEO4Wg))8+ms}!X@cj-C<;_o>$y3
zC_+D6Y#kPZ=4U9tU*vMDA)gJN$)yEIaN+@cNsCOxH7V5N(nm<F%5Ia@aqr#o#)1+5
zzPSbv#zx8tD4r(u1OF?L{L_qn>5J0v+YNpc|1)7vBPX4pZb<Ik#5kr%a?1xV79eFN
zU{k~`4e~_TcZOq`xs?~6B~Z{B#?FG9Vp^g%8EaIq`o?FT_3`A!KNN^S?SPA{DEk`q
zt41<e2Qg1homkY;C2jp9o-tgv`l{ZPa%;HXgjTeiL|0695gyk^#Hf(TelN_;{IwoJ
ziSN?KJ*`;sMn#rZbV4IBXF8;;Sjl)E&G{*jjGf=0o?<C@UIl(E=(BPbsZXV3N=cZ(
z%d5w<V36SHID|S&QUx9PEaKTjP4X0O8U9PUFeimi$aKF`3A3T?-+Urlths=0H5Wh<
zvDb0L)=UbSK7)>_NGfr*fB2T<z6$~Qr3dY#Md}d~jG(%%c36OLVPoL2T5&zOX5~?Y
zL5#LGzU;}AcOv=;)fq7T<Uy$W5Mzq=XIW|yg@S7hp+}>obppe8^la~P3v}#k9e3ND
zdT&AaklQT@bNfFU-3o=$9UG1U8IHp9C=}roDItBWYuz12eKy#TVwWl%L#{IiPseE;
zH(;wZJ$niKg(!v9w5Yc3ZVP4T^B?x#oPnC%W13uiS&m~#aRSOzb<$Ssc^hs|rZ6rX
z0Rr*06%}KfxVtUJAVo2~E2XUh<<_;*b!S>@`3wrUWUEMZb(6lzmrUkDSBg%*;v%3i
zGW3$KJ)v_bjsR%-1!#D%-B0RM3Zo3y73Xr*%mz=0#b|sb@?ux*07b@Ul(%LM=Dg48
z2Ccx;C%h)na&X_xEIsEFqU(iyd^@Djc)ncS@Jn<U48dU$*<QjKsEQ6&#3~%b)*cIb
z?!EuX68=pRN9%?j8`2NO@2kjO$r#2k7OdaEC;9G~Xe=>Zh{mLo;o;IiH&7_7j|@>G
zTuRs=rqePlxLT{0+9s6tC3I5exa~|B)s-6MY4krBE42sLj)>*Fg9~ehfS64(+vSNe
zCdTn-DZ51@l0>u$WbZS@iGld!X4Xhzav2UA3w=^spvs*0=O(k$-Pq!U{45;VnU$Z(
zedOr>kg7Q*)n{<0C$9CR0-pNVG7jd!*}qrX|BwhfFZ@4p5b%UsFyu5HM<I#LhGX|F
z4y@mNuM6o)d#H3;wmV=(2;xR^mjW8a7zJP4Cc!90c;zg3oL<GA;oIbTC|y(S_0cGW
zI)Ih*R5TesX%oGFr33+v36xANOwC3G)DnTz${=<RGNf-4K&G%bsW>6rX|nN=>kLZr
z%<{zwq;H5{0w(q1EZnDA$M+0}%&!(Q`JL$eTgca%%{E09%0=I4*LtqKmg#n*T0pTX
zz-H#+6bJG`__qDvpQqTa&n`nwN}P;=HY$RtVSF%^d1B_`VH_Z*uiUHG7^xRY5+8_e
z*;9#uHQ&IjesNiD8(92??n5J}BghSgYC4BZp9qv!C#Vr@48g8*1s+kAqG>Y8?C|^v
z64|gm^Ff+sBRf>Y_krayLsFw_eH3QYZ7s*&=rC*1JQSW3TB!y_*QCQu`ifD_Lo9Qn
z={;g6m?u=YL$eedVMPf*3pi0%xQ5=oLup1|)d+sac0t{3*gmO`Q_c{kAdAY+@W@r+
zOzrjOLgw&kc<|S~()1z&fDq5fOoQ3<%j|Mz%l0llr5;eAwhw}1!)DcSGf#8=h4M2o
z(*{T+sBrF2%#-K*CHEe=3#c3S007)&rYxvuzq9=o`ODuamdQSIh43*!rWg(zzd2qx
zxha2xk7@QQ8(MAyC;jGN(<+=!)phXZ^}Q$DRt0YxVibMh{erJyH<+mptwqQtw?Yxd
zN{r3m!`416D^Ji?WHv&@-S+lt(vPDy-q~=06^nUGlQB&UJL>l<2HW4#CzMxW$|4Hq
z{2X>Eb9<>6O0AyH%F&ZfW%`TesiYZA71cnNnFg@bRrq4|a4Pitel3mGmJJwz!06LH
zM?^bgj4{(4vA8X)ymgU@;FId677q6+dO+Qg$mKBcDSQMPnNj#A1G5(<kUX&BhK?jl
z%#GOh(BWV-zwm2XQqF!65i!ZbK%nbJ=H@=e67o^v5H3dP6*rWmHCvqFCG5!FJyI72
zrCXHkVhV4!t|l4_3ZCin5+nFNnj|c*2Tl_{oq`WIvsNU8({eCNvLEW!p&ZB)C(?{!
zE_3e#UMO<myUrd|i*^!(yZ+-4{i}oOKRMnUl*2eYh9;Uta0R{q@H{@+=$2}QdzECQ
zT-UHANQVwJ3zxDrzmJ5jUXY3!u1no!CndFisp(imHQeoM4NvS57u3r0VJ2XnK~>9X
zL3_-FI0l*lA=*3?iM0>`m0o?5Gzw<=-&x~A>>og<R#N6V6DW0kBz1XQ$<tn#%W@v7
zHHbdR?0r88Z|F`3(+HHQVQ*r>Viv6zNt)Xe*P)-eLDmxI_K(U~xGg)CD~X;tHl03d
z?XW*wnaAninCD3G-^9`AU-n?eE-q|ft8JY&0QpB4GN*E6OO@KL{?t#WI;;P*fSc{}
zARwAZ!^Fq(mu^HN!{Tkye_FBT0$WKEY0X$&@v6hKa>JSve_NWQep#uMxVq+Rj%53M
zAdG|G#Z%i5<W&CFOnv546o?c!sxlF78m{S5loTI%=r3D{7e8C+&S=>mV8fz79?I{f
zA518Lz-SVgpJ{|?k`g|XM#!SYzf=NFG;S&WZL}!IN{U>`EY)Zrf-9PBWm)PT+x&t*
z_xU{iMF~8Iz>oq&Vq8}34iaj+9er!Q%`1YEh}e=N2{X5WwXH!mc_)L)$*8=g<`>yI
zD45^~%wn{?{`bD!EK1+@rBNKK`FU7r*-X9_!5XgpMDHTxe_i0>B-PNX)9c^~f(g&O
z|J2cg-@rYvM8;x5op?@^NG-HwvAxA_31xAO(nzh~?j08ezQ|gZ#muB>Fe9|zjC;yL
zwkVk}agoFBc}l&eLu?@WZN+YO(-t37dGhuS7|v18p3Aij;r}QC>7mv&KY1k@8XU<B
z)OvPbTCGUo_rteetvD;+I@|^WYb_6{#%DhiKth5)!wUi3mZpH2enFox)RSooQQ)+S
zGFkL;a9_H|f$if=>L1myq@8nv<bsFN;Nbh^_;+2tcRJKwMnz`TL`)zT^uI9()nzsL
zj!SY=+*;%|TKTCmzkz~mCff1_W7B$$GEW;_HMB8pJNz!2wt|?vxW=*Ee4M632Jt(s
zqGRR~-5g5I;W7$oAKu$xSN3`cszTNO(|>m2Dwdlc*!N*7sV?<?%}xBxW6dyIZ3-V|
zr@LKqZZn>wwa2<E>JO#`$spK>ENUVAnXx=7X0H-ZaFc}SMTEDEd-E+Z!LpJSDU732
z!%$y_slcTRS#9-^&K6WqU~a!xvn<DbLoA&DFtP_0D{GNL+;m^iXRxYxZdO42tWgrs
zZUts!RUgteY-ST^4-8*`TIKCr?}mFKp=XF33c%0`FUSl}Y2-K?+SZb#9OS3mtWiUp
zji11l1<GpJ8^f^e-A`zzbPi}rUk?$HkDtq#zx*zPCw^B+#Dc+C1*MxaF5>RX>y+Xo
z@h{kD-lt@_=gsDQv9W5(9bAcrAxa|g*VtpH4sZ52VQUspauBGU4-0crk#-%`k`#|A
z?~J#t0!|yV22(eaW}-EnORR#V4(WlmrvxwKwacGm2){*tWPbozFrvPzFW)T9tf9ox
zhTNSaA9a|lj4Kj<>J!<n6Q3g2N{(B%KPC)q2cEpgGtqy_Qow-5k&%)Arg`8c<5ocu
z@i7qwnwWW;LwsJ8GR8hlX*mn;$2qNPjw6Jfp>4cz3J8_z=G8NL{T~Ps`;(X7z+v^S
z@lgYc>mRY4@-5<#njW3_2*HgPBAhv993jx|jwH;$OAJ6WZQZ2T*9UJ?a4YaYZN#Ge
zr}~h-X&lMkHGH7(_(uDpDP<myKFae&eaw#V#EM2^W+7U&NE3A&ngT8CJ;HC3B1Yx$
zH5Aw3`Yq}ucNCLU-|XEw%sJ9GZo_Cj@-N?vQ1#4$vYN4keYUSsRbdT2v^xaI#osdF
zMBY(TSHI}uR<8NUJl)=%;;S=9z$yEq)5XQ4>CExD2NL}Y?0Rxd1TRm~-eze_F0zKW
zlq+x%b1&VpH*N!XN%^cPoPU|layY}um)MF#k5(do!VKZ%)^oyc=6zV<<5%>=``yFK
zDGFZU3DI`T?O`fo-Ar_Ok!tQBw3L(`TP@6n7s}2^hCz^Hwz&VpP@1#H5|?cC6)4a+
zi)>yIp|Y3BltSc|yIZ5Ht$LDD|J|<)YG3TdDtAmq1f4JDMoml9KE%PPJGMRxP4D&D
z1!Z_E;8TY!BKYtyv1+bmpJl}V@FG(g&HMyt%E}z+vNptUR>>5%7g{8-h-V%T2m!2i
z=^C#Lz&#_#g{}`&`b?G=b#{-4RLrJQl$qn}n3by}<hY5N*a2uRumNA+qRECds|W{s
zvv)e^bGfU6^@C+_GUdN_4ZW3!^Z+J-?_?QPw4^w1EM!FNV;4C;aph|Vo=n>CLFT3F
zEf+q65UPmM)HI?rEaFP5aAg^dyFQqA&K_PTF0Cc|C+k5Kka=AScpXQ-2Gu;@208!c
zjGO2BUs2G(JXA_(H%=IP89nh5Z{_rDmeV~$TrbD%Q<xMJl0?Omf`O9LBYLl;*;YuU
zDUrT$Stg&<o9pWo-C2%Ktg~-k-lQZOGb0!osK!!Ozp#*{QtJb=9OY_)9OBhi7hL^J
z@<X5o*?sXoi+Ba@a!)%~4jGMdBW^xfr=N|zv8CH}QfN>z-cvmHzNFW-Zmf{E&&p>;
zKf(Ip#ce%p#jEhxbZW|!WSJ~a;@Lqr6_)ZF+4`r2<iAS^{zW7m^0X_%$9HNaUa8zU
z%h`)%X{ecZ$&h$niMiq;jazt5ep?C0-n!=PH<D<cAP}hXLM{x`C*~dBykO?SO70Y6
zd`~6!hs(whUmD~ywvD;rr?hkO&>;h6_}zpz%~0|f=Bp)G%ZFMb#f^c9r--M#5UqnN
zfCIHHFLU%_M)7>TTlNuQXPLNy7?TLD(nOsctl(+l^Gf}j<a=n$8}80Gr%e&7TTTqp
z^CUG#Zq}()qEhB>-Ns2dKIH6&$dkzEpy!9hytgKJc)riPp7TfsPi`DkS-5RL?Gp9!
zO=?De&UpP-pgcSkQ^(E%Z3nO*SX0>`vy))NVw}FFn1L&4tsoS7v}QsvZjCB+puM;7
zb$ACSUeh*61ZEi~P|ti@&&VGcFn{OSkX0rAVSsOW3b)LwI^R@?jJzkJ2lIxviHgzQ
zww2oXcT5LsI7|ONwn}KYUcB?G_tWt}&YvfH^tkT^k}zg>vE$a_9}lsKnL;~Iitm@-
zchjX9m1&zrNA6Q`k;D)U`Y^Q6W4+X;$jP(cASvgyNltC~S5$lAD*Ro5F;Fg%5al}B
z=%hjSh{pnx!OW504-=^;&BwXlWH9Kkb2sBrAI;xd*fS^C)RykkI^K`Tl9Q{ONJiyf
zs^&%K&SkRg#6MoJxZcYas6@c$OkNu~L23fBLcV+xD-1W>N!fSX?wX!#pa$g#prBqg
z{2Y+-c(WuO!02N>(Awc$MB}`Eo$$uZ^hj*un?7*|(CTm;?YD;`8r|FBC<sNQYOWSy
zcNk2AL3{cWe61Kt2Xnf)44Su!Mf`s0sc{n>A)Eyx@VR9Bi;He};txc{&Q6hGzNt`5
zf!d>u!+%t;N$tS@);=cDoxToXhO)DxB1aCb<UXZtq#hf!=}mb$jNyqjn6eDvhiCM;
z!;E_kk$-e?^hIq7mY{Ef=(GrUMxm->9iaDgMag^p@)8}tkc`9QnezPBLO-=6+Bw`<
zkT+(vfel^A8!y)Morv-6ITf;-%(~Nq7#-&L_fzTPOC$S52BVFG8gd+Sj-7-KrH5aB
zs-)T3bZQ6cSU|cbDHmHVlJ3~6SX8L59CWO;Nc#3o=VqR}h3%(q;ja#Fk3nq}z^zEe
zq2A4ELCOv;rxQzJco$p?<diuw^0?1mLmb;<n0GfHc0fc*+T5XR0Ey(4!}Eg)5k^&D
zp2$iGm<vkT^eJ@^Tk;r+!dQE^W-o31foUY<-Wr+H!Y3MY9uJf|OX-x4K-4qFg~-Gq
z(`B+=L^Q5#DF}bfiQ$4|jJ}{mB&Sc5&D-Jy*q1NnUaZ;BYD4OSkA*+m>H5&Rm?t}o
z<nTq@E;Z%s+m~lkQ~{B)L|T`I*ayJ3L;GfpS<g1T4blIR{%Of@CkP`G>;-7*RPHcZ
z!?`-d<hhdnTr$<+u(sPoQy%dYEtN~7K;3usSK|ni{M?KT+ZNN+(z$k9najq9VI-FV
zK8t1^yQ@a$4CN(;t%b|EyH3ZEQeFr=Ow(I6?x~7o2f{5Wa%Phgw5C1p%ziJ#fqqMp
z(HpXwZG4C%W|h-F3?0r=rK#W|smAEU%^nainGh9K7K}Gu+-@hi+lhchtd41%4XQa)
z`j|Zb7eoI#3@TLn2xtcB<(2nIr}(o7m%A4x$VwX0fq1>iz3W(N0oh1+gQmI2-JuLx
ztRnIQShSt5wJ_;Gx%Yg%y18@EvK(++gV_hYkZqHan&$E{4?ddr#+J6oTk$-32uFSz
zjFNB_eltuQSS~z8dZ}S#Z#CbC`DKsr%oStIPg_;11}2C%DNe&!UGe*rYo(<s8XYg>
zhR@bm*h_xl&P{oat{R^Rc%0uW@%J(}p7~t$`5v~;o8UXo!81zyTzF0*$39K1y#G$E
zIKmn6+X0K{yoe7MuL8*%8ooZjXJZGbF-f;)$1QXD8}IQTxR3^~Ulp$;DR5yZjpLRo
z^sWF^UZ{M4zUGi6yo<f0htsG{#o#WknnCYV__Yafh|^?s@glajHK>SW>OXCbD#12O
zNZM}Q)Ro@#TQ=tK$ox$*dz<V(ADyMPZ6__-iT9~Wwrb18-J&6C)LsE$H~QrPTvY4G
zG~~!-{g!Bqi$zk~LHU4oZfT^yzE1B)L1$_fTB%1~cJ<$DjPogD@y|6TRKUS`SMNuN
z%E6_&_N%A6I%xWP#}oji144&O*~J<9n&~C5qu|mJIa8>S2BNjwi`b+k2Bg?G+$F$_
z$`EQ`N+x1w!W`<TN{%qHv+@PMYPMd@S_d?rg$|zVXf7Ww3Y#|9Uobje>_+OMC5h2l
zU!><>;c8K!&k_X35;hh_bc`D`*Us9}+G;dU7<;fO5?J2!9)zy3VEEhCTllay(d&JW
zU$J5bpaPVFK5SufYaeveY?=ku+SiXN8Q><U<@s=ACg}u45R<o^j@K+Te`tFApPsA#
zWG?!WT$q*Q<hM&)`am!=0$*Z_kE^h9nmP$IkXjy~xB@kW!MK$RlDNp@^84E+Nbh4S
zT_RW*RL=+-8vvcFDS@};+I;am2X3KipQVoUg#4nWWuym4_Kka9h2e@4L?qFonfTf1
z=tnx<G>nv)d}tm3T8X`x^12;EKE7dsp`Os&=-8-<OmxJ-<qZg|FGGspq>@#pN>P|{
zRG!T2lN*#I-}DsBC``+w(g0~-1uQ#Ap)uFYr%iBE+n#Kt$H3JU9cId>=bO6rzvh~F
zlO*g4%}t+J39lg7rH8gQPJbi#kyMZ|)(zBjkmi~4?mqB9Gg>yX5d(lW%knxCVH%!W
z?nkp|Kbo1LZ1V14^#YC$ob?8ZuWxZ{_>blQ#!DVf7KX`eeg*?C4h|@SCe*_9sPGSX
zZaH?7dcQRD<HQ&XYDQf6fRIo|mViH3z8N~5QqQQ}qJ=?Zl$!oT_L9qobj*@38+(L>
zZK7jnP)9+)%3*@Xt;>n%hhU`5{^kN5aiNqKBcw0$p5?>84pCy7PkH}o0ndPc6Uwm%
zL|_bI92d&#Uy^3vQdNi6v{OP%h|A39DXPXGE9}x6{}K9{3s%c+C+{mk&2&}OhI<al
z_g3F0q=}fAnzus#r0DAr)EZAPY!{4H-fN3wH7Cu>QDNVW9!J|E>|dWF^Y8#5IGFlQ
zfHNoS05fjIn<j)~E^3D2!xkP|wIc-s&5~rc>Sc_ps@za?X6K2u)P`d(>)+VoV{Mu+
z9w#lsB6YJZ%9oC=+;8rdOa7|}{=wbM4JkEupvMpJ*LakGvoF6PF(gxDD@K;8Ygb+%
z)DeVWRiRbnJJ-EKm0+-8rx2{48HrK~77PAf*lUv@M0eV0(@CNCg}kmWu!eNvOB*zT
z6n5J7!(?cI8Krk_vq<l#k6IR`@>gWY9K6^VwdQwr9giyYpi7iy^;(LWh0iNzUbKMM
zs_$H8M1WUU<0Rs{NS#}~yXcgt4&1g?EB^PPu;$tfvcl)%|Lm0hi|A4FO1rtInl!n>
zI}7SbApQfihZDoHyWM$vJE-LC0Mj7g>4=WTeyha_rsgvH99P>C?Nj}7D6ohfCR7r*
zNHjahnirS~ukM1Z={YM0V+JcZ<7Jp+Y}O8WDa8rducEpfwTT82x6|Ae7o~FMNs&?d
zGIyh%q7Ftsz-=LZc8tQ-_U+s^dtD`qI4#0{W4qT=ClGmB+fEi<C~67XK8&I=9uux_
zSt|UPgq7o~RB`aiNgdPZxqbQDg0b{ue4e!>h;@yfVDt<OOHuBimRETDA}AF7&dPGz
z^tco<@^+@Wa3Zxk(oajOC-x5}0jtU^Gmwxz4inwf%ZsGOmk3_%tu$`KpYWv7FVW~;
z{T7`r6QthnlFSO@7lX0`@`6;vrYME+;HOQButb~XkoW2cHV+uKyoIm6z<~J05x4g8
z^JAH3Wh31ydh_xghKok;l$J`++2N^TriDA<N1~}rj7VGGZ$AhQ;5Ry}KrEEL=Q@((
zx3naY1`2dJFvNoU@5OMC*Zykii~nJUOI{p6hEjT{2iEF?EDGS4nc-zL?C{V<y$RfQ
zAcCJdL?7z)quTS1=s#M#W@!-r@Paf{_T=71Mhx#$QXtOZ3BO!X6aQUuv#l?3ub+>b
zeLq8zNH2Crft&i&KD(M}h?RMXtT)@aXSr8jf)1%l$AkJM0y!7XO^C{<QR*yt^g)`0
zhzWzMzF0CH3YYxJ77I>QOF!VMVVN^hOb&Et(B{)-BHWFkv_&+0r{Dq_Qc3Pekx|u2
z->3arl9Up>{(LZ=5M)nctz*XLrWXQK{j+x_`g@JSv+rW^aKP+C_JMFXc_!K~uS##!
zu;C_K*OD(ljJy+5M)kZ5XCv*`6fO*qRWPsfceh-cLN|`YYixJ>M#dK*xx9jI9{ebe
zu5SdBB`PYu*5ejT-i_G4%Ti!g<z^!0RBugMiZD+o^OpX204x@W{=PkAXS!LykCeAX
z7jw08?!4)rU_y_xt7$J}a<DyacghrJ7-I>Zqy!eGC_F$s!z200&r=?XhINIm2wl1v
zi*#vF4?o6lVwd`Tm2$fN_htESC8jy{gj%TsAM=9An*hkSH<vFr+`bx?ekXg)%EpP(
zG5ScUu+e%zsLJ;+hSk!-i1<M;d2;DKRO#5^E9NODe2{hl!0}DyE9sWv&3I%>J56E&
z9z!*=AO5W3Tl(BV;VNv0D3=%@FIp<)6k>Y)w?#y#zMhS0yY1tbd^_0RX2i~lH;#;w
zMwsfnnPBnPFKg6)n+*vol~X{H6$U5p^tbj~J6ET>OMBg}_zP9F{HrP}wrQR#vj5mH
z!>STJ0guPbh`Zq)gGl5-$gZC!vOi5V>qp^2fmmJ49j_$5%mMVg^LaH0?M%`m1nAbg
zsehMr=<_j~><_LkIXwZLQU~<mj+=A6eDjDZq*)EHT{h~~5%}dSW%U%ZoNDi9&%DIK
zuD6`SiNG&1-uK7~n?{tnl}3^G3$2nEmj$kg&h2}*`8-gO8C&QnX}ViH(4!!(X^<<?
zaW!v+KQ=v(4F*(u%oqts5Fz^?XUqLVto8igeoIDKASf5%WAJt~>j+%)?0HuG;BjA?
zg&`0*ZY9wBcFj40Mit)1g_kF5kf|oMUl%I;&YjTCHlp936Q2(E23v~l6K@B$5Ox>H
znGG4dBu~h0YN80~o>AeeL!=~gaku?Z7S!KfrohZ)cTG*E8_k12?`;I%C}$mvt9d^2
z#8x`n6O3YzvHexhe{jZ|P}Cc+|3rcA`*YAEL0I`1{wO*z+@5n(2)RwD!8WS*$Ycfh
zg+@GoMXvwjbvQce$<TOTveyHI92Rj950Jj{Hir>{g<if|SY%EfuGj!<$O(v@&~l72
znw}6u4Z|J{2|mt;wS$#9(C93K<h2L)UNRJcfbivo_~qO$b$Si%3d~ghY)Me-1Bi+q
zhF&0i_GMb5x!&EuJmR9mYmP75Q$ykP3$^2FWj7lKcq6vLBRfV3l0eqXk4gJ33Ceqq
zZD4*8t**J8_P?jvHi}v)MjInrXRtNnGc74_xF>OU=0a>$@h?ztW{c`0oBzHjPsXQz
zd4r<?zi%WB>Pg@|;?`{X;Gs5ZXU)o!jedP1Js&j)8jZvksCl{(HuW3S3~>Rdr17>3
zxg1kLD)b+w_1_H)N)glcQ})-zS)YczSjR<x?zREkQ<!tHL(Za!h;3!QB?nJYG3Sy|
z&#Tb~UOQ#R-j@nMa)Jg4X=lF=@FO2zj|^g<<Iu02OWWVl+)4L2H6rsGY1c}OyGj*O
zJNrUt#!v;!7>{{tENk$VZTOVSY;)Rz8m2$))lbTvTK?uXA3^sZFuPxgnEIdh@vr*d
z^a2-ZZf7DE-b@vlFDFCD6l1OvHzlk-(ow|_mxYFLm`DXcAQf$jBeNYxirKV}gr=<$
zdBAHQ0dU_R!{8gt^P|rvMbJII!)2@xm_-}E|ImA_*tn(-7OS$pfNBiQLx}vV2B%po
z&PZX}Uei?^q$GE&D1aGCHcaZZ*5tKV(Hzm=Z4!^Pv^lP#d_=H2cb5&H?Gqmt1)^<-
zSsTo$Hw{rwt8>^7KbYynDrZQqYs&rzv1sFl{sc)4V<9<~ean4U_FSwyJ^atbN;7UG
z$```&&7!t9Z7M1QOS~0%$pRYkjajERKUJ+}QN+H-P08?=gkH)l@}O*Q<9b)%n3m!f
znKZv8X*JNLK3ym_#Ap}_pUQ4&C|;U(olmOGc9OSZN=DhklW{WIgr6>M<Qq!%&_+>u
zU-XNv=UbJ9*Fby6oNkWXJI4>LPDHI!Y6Rj6Ccp3uS`lIN!=991!nLID%3T-5YnscB
zsmHY`<F;4Ry$;l{6C-hbt;H)A!JU|Ab1Mw5B{qYer?z=d#c=P;Up5TFKH;)5=OH1T
za`!A1U>8je;)`<0MNXH;DEg&v^NFpEkHJlyr1YKupA`ZA5Dh*Oi)G9GX0|O}0qq(d
z-SG~2GyDq+rG=Z}H0Ru;_JH;DJ-`~i#1(4a6)YHY!~Nn#-Za4W?)NF2V6U;mFROg@
z96v%S5+yINm=j#Y!tqxRoT-)*_%THA2Ok>T(%7YvET^#Z*EXbZwFpYmeHA`|qQ+aL
z>nAj)^K3y6-?Ys9?{=ReVt>~U@BE7(nvKZR?UoX?K+&ubXq{B#GppT4Fd(H+CU67@
zAfV=L52>mX+AJt;mrS1n)t3lp9SJe>$&eLNqZ;%V!F@@oHhMC8tNGTPh59DbBOwWv
z@@tVPLiO*E^@xevAnzjquERA7^rP{|p!Md&VF}hxMn)rOfABmF3oK`%mX}mzi!9w5
zX`9|U#IyFo<&5M+!|Mx<Ubnu9H|>mBp9#z`?XjCWma;p=WW5?L$#U&|enVFN3#~R2
z?j&&=)m@<tdti4(Cv;3q^ywnx4(t*rHHItdPO+e6M=Z2QMJqtl<8cWH&*)FoJg6v(
zSB2z<KNp@_1nl!b7W+QAped1YXI!YRg-Q!JD-%aL^zsCmkfr`4b%em>gla>Es3Y7l
z1)89TA9WYsW!o20J?#j{R{#dDhHlLv%l9WM2k)fs9=bCMQtusc#1Czkv|H1<r8=4P
zMnb@HUwIoXnFYV<eT9ld|2EAS6hKzXu7Ca!|357OP6Q=sq$L4IsdE_&YQyo&DOzpL
zOO{E%^run7bLp#VmPf2ieMv5GqBnh>B~%vAfxe?8vsls5BCX#8#t%erv_i%ht?7@$
zlwFNtZFNicQ+~m-^x{LuSTIVAV}c&kdNrm)g9ock<6v^4+Yy4Zoz-ZsI9Tc!OsD1k
zFm%f6h4{fp>PX)rw{@2<k&X!7!`HY$G8H9HYOSD}#WTgRI}C@4?MpcppEIPG$aX?j
zXDHZyKZd2A)O}ZhwDEh6)g$*uI@F&zub<s>|34w7w?r~+Ls02s-)^5ePv#QrM8R-r
zN;YNc8o^+UF{@_M)_}kKvZ}qNo(D0-Raa-EAQTOwoEIh``$vHYhm_U_Iw}nJFb(P;
zoPm2~zO-|w&L~BehNw^9I1fSnW7^$*jp<*C&Y#q!&(Z#QsmFIK^B@ngEcEevv9ViP
z4BiCvfm}@G!yVV`WU05t^ee*jd*>)TaERX9WmuUPIL(Qh4naLLcn(XPsV96Fk6XS}
z*__OO6LoB?j3Vsac+U@{czE&$=Xm2cc4p5f=KSfzls>^zwh%sXklcwXtBI%)xXY))
znw9VvTNPyvDADAB0nWceM~V7T-Rb?03ygB;;pr$*DI)p$##6<>oqI{ccC#^DhT2h6
zfiBp%@|*syOlQp>8EjzXr!89pp;e<kpL2{aqmmvxm@(obZCtyF;52!)X{BhyudB8Y
z(4u(=AWcHq!^;F-j!UhJ?%v0W_;aOw#OTHSA%=g{*E(c^zepnTPl<-oWMm89BQvDj
zPfbuO8HiVL1tbJ`)vuz9Mnlgnj<6|+wu})DqYj^a!{`6ImtmNW;rP~9+v6q<*W8Ig
zL*Z(pE(xw!w*ZWSav>ENI+@|TXtV)%34|t#4+@5FLwVn!*zF#U_Yo2WzmzFXC!CpP
zQi<g=%5INI>0@!?_(f!_<^UfjS~RcJSN%PF>!cHhEOa^91;OQD4zCL_Qd2(EZaURv
zwV&Ntl26^`>Ohn>;ayl5wat>;XGfkvoh>b-4(D-it;*ZN!(m$?8u|sh-)H;kH!|DX
zK4<8Hn_EdfY4=cq^5+`hX^ra3zuI_nJ1*wS5bXx8Ra~2!+pXXtBQ=?NB&vD<Qt6MK
zK7MXKA{hYD2AQ7}G&aA=7Ea<WwrRhf{`x;Hz|j%)#n|!$D5$WPRg9DN^M$gv11JQ~
z5Jpdq3w{tHQ}ghIj1?rnZ`%uvRV-=02tw#+VN(5l=iMMxf@j_t`|8`8Gf*(6NvPy2
zSAF@$^cKGgVuN3!_3MXj(NMJnxe4`jMcdyJ?%b)H7a<p!T%m8;Uat%y{b}+EdLHim
zH!+_gt_W<8Ym=eOrv9}VQ>8`=UGDXj2`mwOO9-jvdR?D6O2q`z$YoT}-J_M1f;jWW
zU-~e-bmHcwEiUWID-=T~1$<%@i9I1a@t~ABDh3Z7vvtN;;!iH5X07<t=A@bmI1}p;
znMb9`eC|aS1vK4Q=|p>aBa>YDSp0%(j>>T2A|lB+FKSL6oU7H`NM4#+zndXPn{e*w
zFDkWU{!~ekdulD%+wq<u#`3u%7WsE58K8wA!E2<BczFpKc@6BdBW@oNP}`Nw#XIIW
zQ6C~eZ^F^8#6|Qn5DOgYN74QXS6>pm0aotwR`O(P-lfKX6PCQg3l$H>wNds3zsn|l
z;W`*StTWG-ToI~;hqs4C6P6KrRjoUQDzxp3dad4rIy5S(r?kL}JWO1bovI<as9)2W
z#EZa1Qf#>y7d@3B0Tr<f(Q8=yUZgale!iGzv~mFcabhXJTwmW;D)1(L(@VM9gR>g*
z@zn69q5G%s%>R*9{sOF(Zz&?xK?+G&F3V8hpyJBNKyHp65oK8JX%93GfY1$H6{o*@
z2q^xR%j#X=g+eB+;;?z0F^e0kQ~zD(<OU(^%W(`Z`jN>e7~{F02S{;ycbf@A3FbDE
z+&oM&Uh!!LnX0G^&fKs+v)hz6L;da$y=Iz}IGGMkQp(W=lX5e)_d6-!2`P6Gd!+|U
zU@?{M=Qd6<Svi25wLd!i0dQ_$ow4-Gg7|>2d61h~*Zp^(dw!c^a{t3nRXc{#`~YEU
zyY6e3dhvl9v3F*}(8tc_I_#g`_z6CUM3zLLjM~!t_5-~j;+I{%BP-^QekNQJ!=nU-
zh5#~!N7YCGgPfYcw77{bZEa^0^`@<B-W8iDsg_KiO=q4H8txK2l>>LBjhW=A7P}1<
zk?L3`PcV#oco5BqI8H8X%a<8gYQ?o=Da@t#F;r}``D?7F-Bc<Fz1(QdWbSn>C#u2T
zNYVvw>8BAGf3Zfs!RFLkrCD1ILD#Xo7WHJaN8KUo0{UUNTNmpDnR{%<2->>$8<@~A
zM);mpUmcKVnp|n4npui;;y-xXC#R|X^G>yPW<P})Mn$mrrB7;5GLb^#9zhITtF$3$
zoGylxo+X;)R5vlTh;q8e5Ch$iw4Il$3F+x4&>d<HSG8uG0hfySea7C9akvUN<1(xn
zQD%&cN&%MoMfU*XBY{HqD{RxjFJ;NeJ1dk8*3uV9D`7R-7+f^kBiV^9xE3v%sC*MB
zv&6l%l%LWNQhprZ(hSF6QeC@i>hUdip}+JSqW;Do+l*Ba^U;US*hW4xuZ%VbTq>v~
z_*QM+mW@k0;yZmj=bv-RkDCw2e-n6rtqcEbywq|qCU#g1>)P1+-r--Exr7^6%>_^L
zI=gf3T~wgQm&aD`7276OnV1|Vk_L;^Q{qf@Due*PL%4ce#M@mx>C{WB9FW_gt()FY
z%FS0Ra6TvzASADmAXCGVh*+>1<I`H%$HT5cqd?b9;qcPQ4f#V@y6p)=7gm*=u~(6T
zg;69AF0WdlnmX;9?(?kKI-HWOnuC*yBqX{$`fcRGfRWhvZob#q*GVGu-X!6M66eS{
zQ)(p7=jm^Q_D^;LZvCo6za1kxVkRhGHaE6Qc9W0Dn#ZoOUMYjOz|7E;_q7iPfa%zF
zB+|)KV&pJ){%cw_{CM4d$||xY|7<Ox8tNHAC)%*deE2L<w@F;k;=4Dyiu6--XMoZA
z$gMTqeuo<Q%0D1l`|jq#g1I!rJ>#p9H;!xwV?;}&dTBKRD#}$gOXE4!<=HQI>`~nP
z*d2CzhCU-WB*ht$>WA%A|9?DPg+o&h*A^5h0YyquLTbWjkd#JJT4Eq2-Q9vTNGKs7
z-Hh&@bc4hg-OWaKjBo1u`~HHv-Fwb?&hwm7ZJChktVUCv_^4d#Jo1+-|Lu+WqvaEF
z_;xg<w5cK9#*M-zzvn*`i<y6*-T#HlZT2#FXxO1d=2<Au&Z-e+40>>XhJ!9LzeG68
z{}}zHuA?jmHvmrp8RjI+H~W;9(LW_uz3$44ZeJ>z286k|G5wWXlk2O|NA3P%!PD;2
zm-cJioaE+Xlin7sFE97AvC3{JleXqix-hVBzBPpZnIJmnMb;e;m3(neZ`!#VQ}~w-
z1^GrbzHwT6vUl^B(^0dT0JoL*j&mHN(A<W|0Jg5bt6pYNwXlD;gSMKg=P@E!d=y8?
zDw4G}VhIuj*tKY%v(xuZ!JLxkl6yI@&Rrn7eK=`RW{<U5zUk`Bgs}m>o;oxu&R@s$
z#ed*<I*zFyQmSWQ!sHs*UB_4HfcCVfooqf4@m9c3E{<#mRLNZY=rc=`(t-qr)Z0?r
zK+4x?OVRVcS<PuTKTFUd$9@BC`LYbSGO|mWm~CHWDb6e3h!T>RKCAvnxQh|z?$9oj
zNFabWOlg{2^(BaKVc`Cg1CMD?fkAHIy3$xg`)9Skvs{4xE<BA%knySkKE{UH>BS$t
z7^RV1jjI<}nP}9*n3kai6(-F;;IZB>rqr^?LaXhN3wvRgt<wby_5fg*W|HXW<?uXQ
zCTpRezzKhrqL|kxC}#Ye(r7Wa>g9scL0M%6`1gx1E6Cg=(fA6%LOjCCMnI8*+(Oh{
zD%=Ep{UfLcnO)oPm_o>OOO}_THV$Lq-UzeSM6c3JHo!aaO$fGl60av}2~V<dhqK@_
zvUlcj!f~cZGO=vrP$CuH`J|-eJN9;?6`ZHd?8v`TEGeo!@$cxc=^+Nc!s*LdblLE3
zX@+ABcmkE;)0!`f4}QK4xpk;W<Oy}UculU1=Nj8H{OBSaOSrNy93!0G^?`?xgD+)7
zBE%;j>}pRvOm1O&MpgRBICYXF3j?E~jBw(~;Ddsw;q^%U_6KdLZ<7i)O$_QD*C%Mn
z<r@`7d<+#o3p(MHH+e%pPnJXaOL@9n91&t6Ak^6797})`#JvEG7wvfYMpNFj;-^Z1
zrYJG-MT`7hWE{3o7`tvl%QTaHz9j9+V{wS_4h9tP@5)8ee|tIf3C$DSF#E8+6d2sN
z&NB1_-u?h+$Bc2<;+Q!L-*^b7je2x^TAj{pBqOj}f1Lc0G}lU%Queg03LOvgyqvN>
z?7^eG)2|j5Z(}pd9!|6Ve1STh##fk(owl48Q^@>&P(m&685A>Rn5ycBW|)@FlZBW3
z-0NZbxq@;}@RUqmIM2q9e`xvbOA#ZUV(G+~xVij1oXuVGLc)<T0_#}u$4D01ucL=e
znj?3aV8Ou*0N@c0xm>&p3-LVAsxT_&?fZgFSG+i(qrdy&?0^1m&dEITVe&DHFy(8l
z*i0t8Oqmokjlv|~yxmTEn{^XOH;u=(d6m4jd8*JsjUqPo0IK3gA7yW9NE=>()YCi3
z<U@$mSoPlJ#!3tq&St&|nPV*DCBwf{C4GDrF8B1w(9Qrg@n?Q|sUj1-Y$ZRx`URe^
z29sD8hQs|Xauy`AmY3~?_=Dy6iZw8$-1wbjaZ}JI-+g6KqH?)aD=FVK5rQBgUCO8n
zGFqSwK9V)XfM@P61HJxVK=6NS`b5SqYptQt%{Yusa)g6_)ir(l^nO=&1^i-%AuQ^<
z!*<JB0ECyB_wCcD2o1(xvDjHoM`hwt?-1<?Hj@C07&9XMok(bq=PnK9SAicS{RD^p
zFCkU9<98Y&GUPImCGlZJ{p7(P`;0BZ5={kV9#~|t;SV_%fCmv=HC<1c1UQP->sPaX
zw2*nO?AWDjXI81KJibB+=OGypwhV$4KTj{W^D3(O6J(0F5@edTpxVR#jg@>X4C;6P
zcDdmwY$Ua+#8~rz?JX0!VwchkdY9Fc!Ns62be}gV4A#zVPvZI>#RUld{-va&5xyl#
z>bYb5Q6EF6CDaQ;&*+gy-h96)k0+W!te8L%UUThzvIOi`9`Oa!yY2P!pV4IPv7$MN
zx>;^^7^B-Rflf{5n5|>9PY9Ay;=Ir#gCuyUNR)^uO8SIA%n3gR2Jbo&p8J5M5055Z
zjy&f&B1*%>!X4VxVlX(e%3&P!ezU^%x2XUB2kOQGw-%+NgjXyFVt+)*?qStSl4d3Z
zxKc;m7BnV|9((<G_Vm-bZF^~UWPYZgdH4(oxv36HGw7FDPorA15E7}mWO4r%t@fg0
zn(oVT&N}K9@I@>Ae8ke#7Cij}b)zZc(^6?4v;Rn#M+r{Y;djyiPK<|(B2*`yybAAd
z`GArln1q7zzie@wUzCrjSqLJQl!QlqbkX8ARe72~AI!Z?Sov7I>av6P@`kF&?>N_J
zc4J=Zj<hk?OwYE9Jx}lJ-xBdZRjj#NRQK(pA)Kx!Z^9*!sv8{HS2H`y`j}+)G4|+=
zvf1lraxt-bWMo<KBOl3mA~x~AI?!S+N6k4frhZ^>3S7@TKEylIKau&y^YmS>TUV?>
zA9Gu)^+xW28^+@Bm!W4$eczrGVML@S6N}3XbE}hml&gyGf8hDKyt#orWUS$tOobEr
zeGu_nkQ3Mzz}7X%)$(#gi3iCO6gvLmja{??ZgC?wOk{QvIQIabG(ZMdt~DP0Sb}vq
z({3Go-w1Wv!PQH79rVD8U^|c*MD}-+y7qsY)N@{~JdQJbfc-5ua4_f-6BD*N5k;jB
z1zE77*N_n><4R6r{O@OyJwvqXM3h^i>Oq{#0yDG@L(>)O(kA3}o(x(Rpma|(OyOxr
zat7HjE}z{uKU$B`!B04MK>$tpcD+oO&rqObTJTcPhAWf@k6dD&k>ta-AC@nF$#z1!
z8@+<zxRm0d#bdK#i<H~csPg?+XXvl0ss;VC4?k(#qh@pT*BLg|u;p_4d&&Yg*+C?(
z7F;l-|9rkno*z2x-wWyrfBQ&4tTBoGnB0w&G_BLPkadgmSrtM?wf(M_m&(~jLPM<;
zi<WU+$*ioW(~rg3#+?;10TNhb3Lm&=fqm5NVn2W!+^@3Pgb29Eu-^htuo#3iA3pb+
z=2;Ot5+%I~R@}yrc8y9jrW&XgQ05q#SZ!X`%jxP9nDHutqqa2WWUAKO+pqRL)8U%_
z?x0%prgpa7G{xZ7X3A^yk!shvP@?Vrew7F5W(xTOKYOV0LafVci}bgzD!+_8%aBQ5
z_&WiF0+TIyJppRA`-%Jedr~i~(Dtr@Uh5JJS2QigV`;6=sA~5KfxsLQoqrm7majzn
zxFc#S*o%D2tjFRM*@{80(72|*p+Uu$BQkU}zccj9wS2ZUXkDwfeJv9BpB7N@mDXS;
z179;v*j?Ec*(j9#OT@2_JaI*oFF*Ay;G7wo!ySev@;D7&_iKLxTC0XUS)vKY#mjm8
zvZkI(;uHQb`qFDL8;{GDY{qwO)gjOym4cj7ha9HARVosyalX*%*PAe>KX{}XfcsZo
zn){z1o3r76w}j;PIYj(s9C~47dymUp;bedCWmP25QQz3?S{NT4r1Y|2$phuWmgA-`
znEm0CBA=ww4^wdsz-a8-9BN6`viwJ1BhMF6RsGVc5n3!hCq1tn$;Dp~?_wYnnBvo^
z-|2B4h}inQ)7FxRx)f}OIuX67kEe`=z;J5ShLK0c%kE%+!^QbNu!ro{Mw(^t*Zmb)
z{&c<m6<Kb9_b2zq{M;)PuYGaL?^j@e$HehRowyQcL}Da6S^<uvFFoDGS5qL;cWWB=
z4iR^u`}$+|Doh6W>0+%nxB2vrB1d_{Fhc}#Eucsvz1Py8EZ|0k#;&?)<L|rpbN{9a
zbqgbBV`4(DPSW2!P$0&ixjLGL$%A-9me%fuQ*`Xf&sT8dgwEy^1xYiL8E&f!(-402
zNl{~Y&Wc}iM~n*WyWxWd__&(}eD0OqwWYQ_Y>ZQ_CTG7vKR2Ms)uMhS*E;v+S+mOV
zD$LTc@z)44o%qW8bb<cQ)NF$9f5S{`8_~WP%%3^@MQEJ1Ufm3FljE8(Z!g$yfT%5f
zwRn;swl*!)P4Q&fZegr<7Gte=vf++jI-{I#T-asy168*?9XWRH0(MyzFAx~^K#o@0
z1HQJKU2lrr0vm<-==*TDlaanbU)C-#;pralKI}0_Z~6oWb<*r^5LIJn{4>o$^6k0b
zO1r?~&eCChJpsr@80fcF9^=)5kwYp-lH}G>(;zyBNh{^m(_=nu_>*`3#^rbEAWe))
za1JeTih0JIcg<GGCa8Z)wT$<@d(PW?vJ7|a44%{4kN&dY1I+TKVELEwh<R6Z;&sMA
zE4M#t&Q|+DvNqf3-!I)F0}H@8&ZLStHYZ!m1L1zXym>|Q$n=$6?>zkR(aq9H*Ov<Y
z<<)3UAWeO3Q#4JNysWC?nKGKaTaE#yeoxOke^{b7F*8rJF4nbuSrgxt#SKNK51NX<
z$mKqf>Uu?e!6%U8)Y!@HaV6?3I*P&<$Uz)#DXPX+mbrKU*ND)I!VrZrnt&4IO1v0l
z6#wG<rTzh;OKSH%F!G|9-XI!^)uq7cj_yk@$)w-2(N!HA)5mUjS32Z7tW)h9Yuvx@
zj<<Cl_cWs*?z)ZU5~6}y6xoX{QVti|)EqQHHPj)okLvYh{DJTtJWtQY^;-|lZ3ClU
zqGF@=Z@#x0;@m%ec^jj(ryyM}YcS9(=zn((7Dc+lTfDaUs|+z&7sdVbYvb>;5<y`b
zm}2iW8LkK%u0t~Hc<DoI5B3)13%8)6<0r++&3-q5sBG&gsx34WH{+0ALvKYt82xN5
zq&OyOB{0PvYg3ge*2n}Z`-7fHjkkp<@<!49talhGIizj0uxY>qU({6nDT{yB*}%KR
z%mnwL0yj{1_xs%-^Yf6!RmEL`LEMOqiS|hG$7_;%@LJ6#BXf`CXQ%E2iSfX{Z8xx4
z_!3GZjrrR@954Q2hTu6*tmAggVcSzWQmjSQ38YpkXJUHRvinV?d??mNJMVsw)ad>B
zLJx5ZeDySs^D1xn+Ib^2p?~{zN0}@>#}{5c<D7ZC8bqFM4M^P65lQ5z)d#j0@#3Bw
zC(!fm2`;nU7G^&ZI^1_&EZJ%)8l8q-iNt69SrqN1H<dJm3gGWhW5IflS`;c0(?^9o
z6OIBdZg}S@(3|O}Z!VCB^$@IOQL$zUho!8{NCphozPUg?kQ7>N=3xYv-9h2YCO3e9
zny1adnZg7gjnu~_o$R?vwr)o+`15lML)IF)G{@2p1&}A4<&AOY4Yh{?LP2YGH{Wtz
znUk)~hTrY^&iqv_?`cq`9utRBj_Yhvq;7?cLQQiHcUl;uzlQ;U1Xt)m*^XN|aC^~(
zM{}ZG0Owo^P@xjOF;X|t&}9%aex`-9jJSnu5NH3E8;NDP7Fh6l^9wnEx2BrMP(iq@
z>!?|a>Zd%GmvZ+dFLuy3u9iB9`Wb}HyQ22`Ya3Gd1@dR<j;EPOd7C$C0!I?1GSI|P
zVVu(_yFq9N6?RtzR#*srlKu?4qOMGPx=gzH<E#fzh;i@#j?h7f6AlC~2HD%oF6WJV
zG@hy#!5HuAxtFYCI?j`pRCsGeV0y9$x}~T^+<e373LIZs)kgH_6N7<2s*?PcZ||Q7
ziz+X>_a!{(;T1q2>TofIeVId?s%m^Wf=ssZ_)YeqI4zM*{!3rPaxg9iynx8wgAClB
z#|i$daUUUk&ml(Ht(L|}@4JoYeEa0&1?DtJyp_N3vGPFX-Tn41%<WI9G{Ict&tLnq
zX>G@eo0Np+*oVv7duXtFi&W~e0ueYTwC?8{;;QUp^~1i+nfgMgb*5+L!r`pn)q5TH
zI?PfV<E&uZpuCx9t6Q3Y9XY%1K6&7_vls4nSG(V-pm%_CTAZNSvzWDZCak$p|7|g2
z=47|^w52KI;_|=F-$C3GDc?wL&l9v){+Z-{!R29iifzEfUmt-#Jbv*2TUK13KEAwZ
zep<u-as`QYVHjgysLp-2+(vp*Ok>+-9g+P*d-ft9&#4+>IfuMBBlUm7out)dh_5+g
z@8H&X?3=)NpgGTNCY?~K;wiTD2<vZ!IN`r7Ocsrz1CErX=64d3rm@i~qf21k$)yL+
z1KJ68SLU1}Wp7)Wl&8<ISXl!)W-=+5)6!1%k`GwJ1Pw1W1ze(3jjpPGZ`NfMd@7Cx
z(M><4_1B4U=q=ZFI9vYxQ_ndV<XH1jkbUss5{aKx^GPC{j~ei7amzb;uONy155-%Z
zF+?fz=`5&mA&W*~5mI^W(QCY~htur<dD9s!CD;XQo5NcYucB;N%8T9OB#^gqOb4Q`
zAu+$#sWO{xm4oaNPK)NtME9q{_wMC1@ox&HIi9xmuY9*1m*)sGyzf@{O1p79#&s_^
z?PpR{Fi<TyH?wCOZW6?P-CK^=%&oly`CHdO^^pG?S{m*9N~y2(n^a26ZT&9xL{eY*
z<2%y83$-n(B}9yhix2ZEGIA(O)xzbS(hmrTBY$$h2v5`x!dyBCG?$#m@3?u~xQbsO
z%i<U?K|sE&wHR7m{lc$^Z_#k)yr{Sya#{4Vs^DhRprGrl_>X#rJRKC{``@Dv<n${D
zM(>bFnyw|P#%2$D5_r<={rd@Tjj#2XYk9BSr@y+F^4<t7c;EY$K0d4u))%!e^I&F$
zWSnE~Uw&UAXv5#dob_rwb`CRc5jyocL@Y0j?s=ZATpq1$9f*{Rf^P5k|C9((UL{7a
zt!3tM;_pn|xrkKjD4?gQSg(D2Ly+VraBx!VZ-D;PKO!O~>AN8?26F8&_SxlAM#R9V
z;nmT@m#cw#LUfDi=KhKsKEK=UIbt*R`%}3W#L`e0nHQa|ZNFidf&%A15v%1g^<g$H
ze~uYW=b{1owF>iH##3e_{R=7X@~^i(T<oz|SCBPIg}D#jcgr_4z%%DJM|o&T_<~P1
zkxto7=53wWi#j>?480Ov7fh5Xo4-zAsh&#TckD$G<@Voobw|M$ninlzjRVLclrJ%$
zpsRNfH+;o}P1e;&7OrlmJsmvm<0rSk4nVu=HJm*OeC&tkE5;6SD*6rdHx44!a0ggs
zWk57V%@5YDzdS*ud%}ZNVguo!A;F=Jg-xxjz-Z_b8*|GX54Lglt@;o_y6ZbHabFQN
zWtunDZh*YosQSVtFF8u+pR#grh!5<4x14YFR<*;1ReHa1K}21V=*nI51dQtfPvxI2
z2~n~~LLN-Caj<VY1~e5<gO_vg?$Kz9F&u-k3~Lh&y;lzgqu111oRw~_X!lFsN~KRq
zwz$Rms-<^n>kf1}ma>l&+fN<bqzqbTIU>GO<@iBkU@Kwu?vO2LTiF&A^4}=LePWmL
zL-^J=f1idf?;9$!5n~+0Mb_HVAg!^W_W8owVdbhX9(UF(_2jpUArCLy-fZbM-#O2d
zn^B~dFZhHGA@@(x%z6hgo9~bvf(OKUMqpf9-!E;3RxL76kV2C&hYIAmqyOD9rX&BH
zjHmY)E$QENe8PJhonk!yvuFE08O*s%kH;+#gJW!xi+0!@XZr_(QNIoLqhoj~<g0nP
zu^5qy2I#HJuit|@G`J1?TPN+8gN^o9t;Cx&(HS(>sv9e_(P8&mCN^{)y5&oihH3Q8
z?Ezarqi4YSx~+tfT~F6^vzwp(j;IK(iHhJ$v5)}Jtyse?LY2R{dYCkF4|8H8*zy`c
z@kVTsECKRyQGwQ&=ji;Wx9dIL7lXaq$YGx^wTRqr<*+3^50;$h%d@??9?$9C)IAtu
z+e+0@-O!%dffaJ_!2hNZMKA!~+9!s7_j9B7f1dc^FC3C8ScqKGP*+1B7mzHk^1ZEF
zNOm}A?WX2%Q4H#9;OS6%Vd2iXWni7RbrbXSd@2!H*W%IaZt;u-U;6wMq}4h2n09W}
z)~(f9^`4rkB|&JGCegN8<7~W<GzsaA0$-rm+HAV^{r3OZml$1^n3u(#x(_2)0rrWR
zbHT;2e8>D9w0o~S$wv-wJN3bL?j>pr=*S8E{pGEjts${z;8ZOeu<les+&G?w*BE=l
z`W5D8@6}dr!jY4vribCd(=7p#EwS@uuh3su_CDbf6%Bg<gNNi`V_*J-K{1hXI|P`{
z+W=984EP^p`AZsD^c=B>8lZ6%PMo6LQb}ZFe8~g4)}-~zaQD=`;sea!@H>sYc%VJ7
zBnGwy^J<-?sSKxUZ9VYqX&ZDo8flpH(6|n)65NNW-vQs&e^;fp#R;f;2=}!w*r`9)
zXZ6t;ax5)IzVUlP=Qj;9YBgvEdNBQAULs!qq4jZ-27H+1f}oe!F-z$Twboh1@hwTZ
z{Y5L*q1J9K%d`gzay*#zB9EItUhu;(_G`a~ZlJ-0SVy*Hvuc$%4d4SX-(42Mu6HrB
zUS@s)&3_D+Y*pasq(RcHMD>tB@Z3sWOz*hNQ&#a8sHG?O54{Bb*ND(G|GKi?e77k?
zw2Vog=GR0DoSIYsQccRyhgWXS2~)|ynh<*Z#%Ov;U-La(2a%Pl#^`OCJba|yp=<B`
z<CXqP1jSbbn=t65JHa;F?P1LCb0oh$<!{xaO&31Z2iJ`ZwKz|`Uq=g%VBL3ix6J+d
z->pPv2PpFKM|Qt`PRMi)@@rUOJgV#YPYd9Ri#hZX@24k6SPi!M-GZOFlX~14(O;(0
zED<~V%rw7SC~uzoRSxN$vsT8?cyA3XFlbot{B5|`P)>0>*$Sy@j!kS{P$k@86(ePn
zv6Lh>WaT-c;_zlGZ0kzRUpRvN$&0K0oF9q#=C^Xmzs?pmL&18Ep0IyWQKf>hH=dey
z1y#Ee{oek#L2N)a@KoO8UUzDcIAbFwoP4o3mA~LFN$&cdSxwuoh5%;`uX=v^KDnzA
za_6V%S?+bwu<Uep_I?zsGJdja`M*hy`v{`AFt3vN{ZW8$nzkX_PwLLDx~85G7J4nB
z*w&!<aGK(RF(YZ+6L}6xlKBByVc)%kc8myA3%XfOQ~bQM>8YKFvaWv|z<G~1ep~Bv
z@3ESNpG?AHcL6W}R?WHTHIR~;-!>h7+nI^^bd^e2`u9dm#D6v}b!%1QO5K!0`Z}8e
zzigVy{mV(Jmw}_u>SMQtI(ebXfh(wegWA|fzw}lBpEqJ~47<LRb=Ar!1`yRPYvN8-
zmggfdW5`;oGKC0(RqdwEDahoV?AeZO-h8{8G;=gi^SW5Y4;yS<)^W59o|IYmtnT=C
zXEW$;?;eoyJ_Kt6ivmLoX8s$fzw!b7;uClApe%%{65tcGz&sYb+l?{2fByafbY{FE
z$)R!Rz|{tF0$`?ibL9Bp1)U+$XclvJ;_+49zQP?0ycDmIQXwBr&R4G5`b4sY!jjSv
zuq|dJX17+SA_}ZiPu2L&>bK&Y`}S|M1V1W*1OB9BGfx>v+P9{b(1!@jg%8irYo({y
zA7sa<%4UBylRcapT%)WXHKIwIIr7>jEb{A~540AWyDp2(`TRXZny6yo!H&|4`cI!Z
z_EKkR(FAMibJP&_9v|l2AB0zDCgooiXdP%>>P*?0zH+E}o}H(#rq;z?u?6jwKz09h
zqQYGvDpASV2z<HKNpur8$Ix^BeAn?<&b!wfxy*MSX?fM8_!hPZJdcSzcUs|fU#GZ?
zx>517KYYA@x!mDfPv4!vAlq-x=24w64K4P8NGGZC-}hPD_jZci*0f)s_e$#`6gNEF
zu1N}?CLQN&L3NZz0XO-m&;MsO(qG0vRpyNw`}>Vb0;JCR{M~1%8@ZM#@A~}fR1Ev(
z7KJ<uME?dHw6^FQIf}`y3AySQOTR>=Bz%`o+}xYI>EZ87>c5{aG^*NeQWRD#b@Nld
zcxBLUsbO6-cE>AoG`!&Box259I9a@%JlS<x&BMGuKvB-W{>^>N{$n4b4|%@bR%v5!
zm+vTcg(Y|+No<cFbhFjd!kuTJ;vs2#VUHE<?u~nCKNtz2Jh{6_Zxd9(^DZAmenB?o
zNmP;gI!qGQmuH-g4MKTeHoW&=ZR>lx)mHSkBRL6t-}*m0mmPd%gW!-fh`y`eiUO|<
ziRKNwK{L*1@o!6XBe}^!gMDZbqF7sb9(a4#4dft~J?@fhzZFk7boY0c;1oJd?h@*_
z&G%fL@_{5^gWGh1r_#*rqb<s3*LBCK^_qd_^XX^aKrSSgowlLMvpR1S^`YGNJPSq{
zdE8&|Nc9;|%e|Z6Q3cJiS8%SPs=l;l)}<xPDgGUun{VO))(WY5X)7K%L=!Eu7KT3?
z5^=nS9s?4TU5M68wU_E&l~$m7_}pzpO}6mfRX^I9&Ol~Yt!3&Iid9YF^kK>5ut?xG
zXrFSqFHNw1Q7BGVDXcm|&%1c#CbCs?@63J_fJ%__{+|o6yq#86^@fGa<q*UCU36O5
z5{<NsjZ)V@4OA=QavPW*sfLXQ0!Y1F-P;UHDy(|*fz;4f<+iMRAE+IA9y*c)ZHBb&
z95g?>j2yjW=IuMsH#tMM49;+r+-&#;d(g~Q<rTQm-Hoj3IzS)u<E!L3J?e&+;<s59
zrE52bqcoq$&Hqiij}d0zU)|7*#tK55!oKH0pL+)+RFf%uW`05#MOiQ}aU(5xzLH8F
z#@`y|EpSa$wttK>*s_{F+HR=pMf+LXQ?}01lzr7h<7rX{5bx^wZ2Lyb!ZHaBI-;ZA
z`d$Jlp`EgjsFPS#xpvc5VYi)EslDTQR+foMGnP?)_ou5{jG_002u7bupZ?Z+<>`Tr
zuEDLuGu*mTH}@8?b=Z)29^)eLee-vXY6#_J=ZZl4vB32{gP5-FhZ{khaxAJ)aUtcm
z+Gs)-ad%lWet;7o9d}L0lHK~j>(jR%fq5rozrXzM?e)5tfzgYUFQ%hh0M#P%S5CZ-
zopi3-iGjqB+yEZ80;de0@vXXzD^NsF&>_{kfenXVnsyb3*!Fy%_SRv}i-|W`zX0~F
z#BJq*WbwUQcyHLruHVfs^4!G8=eI#z1d$qJ)&b=?&=XdFRJM4xk%2<6(RdVsF?E$^
z5NwCz1rXmN`6y#(ZY8s>4twrazi6bDbc~YUD>NT$wXSxs`L#OXw4A>}K3rTHIdVrF
z)_)E6zzwgL0KEPs7Ik_yx`%y))P~gl7IWu?=Tjm(5fwLq<LTONS37=PNFU`<FzeAD
zKubm$`+ZQ?-j+5dXLc7{s>!xVc%+e=QM==n@dEbugQ+@@LUSa|Jv5pB$GJNx2n#BM
zAV_7<ASP|_#MP+#vZhROk&k%W>!E(i4vM8Q@7Ka`x(IW>ZPf@g)O97HAiZ`A(oAPs
z?0m6%T@P2rf!k(y8~7IIqd0-c{|I(@ICs!KR2+VGOT)0IgpK(Vi%wi%)v5nT9eRjn
zc&l}d{zauR_%?0k1UloZPjwW6hFt=W7-}o`EG6^56-2)Xp(M>k^O)-Zo~e3YM&gG*
zHwGp!kYB6zhnJO0I=vScs(V!aS#AqwG-<EAB^9HKBF{T6U3=;zqT7EEWmZ2?W(8ra
zG|pc=o55hXTY{&BH<dJ%8RT8~Tf73#zpGLl_I*xRXdhKQn!>Z6*=65Pb{REa{I2B|
zT%>^z!IbQIC1y)z>L#6dCWKQu8xMuKvr5wC#j`9#M72)XR1N-4X;5O)J5x5wU^3@<
z4>D>~J;5FjuxdVC?D5xiOW+PXas2e`=BlU6we*@CGN)KqZapB}@!k(kWc9A6tO9IU
z3GjF=KncwJfz6NcIwXXZ``d@qfoYX45jsc*#SC~iHFN;6W4uo9XhxD%$1tN{I#Z<2
zZRSlvmBN@Mbc_k1E2^7f7}7Ut4JRQt@hhBqtp%OP)$30s+a>v7hrQ|rU(>*E)(k|G
zVx2i}t^~|P^pxF})z1<O6H!K!J_SM?yX!LP_MHtwe@bZShv?M6qOHEQSSc5SuA01_
zB=cgQm35i4=8esN*)Ht17p?-w*}hPm5+b@&4U(5Rh(}lI?^sfCSzx^QY`7p^HgJyr
ziZM3QcWdcABKB>>B`>0<jB+}me7)5TL*;Sk8n0=0EjY~>IXL-3$cCoTc=|naWjCZ$
zaSu&_b-vcL1^;D)^4yPjIb@$$7V1b(M5%I4)jszN+UCB9pBj-wq0dFR8gy)Pz7X9=
z?zsYs<#Iw>cJ=algTlS8AG&D<fLftt%l*p^EtqUm+AnMJT-IXzn5S9XUOQt%<?$6#
zrlS`YyFB}7_bX0!;Zz}Fbm0(5m{%hU(fEBFRjBI{Gt^e&<-+U+-PX8y_wsICD6L>(
zpf1<*$rT9_31;`acZ=v1bPEQxPX2q!11O!$IQ5lgQd1g#$<D`69@X&P^Q&h#3&$44
zS@qK@t{2TQ#?~8$g&5-YXPQmAl+na`Egx&|Y#)E#osx1cFm;K(+CL@Q&x1&}2(B%t
zMiMivKUdkcP~FWgftRQd*w|3j3=3~IlfmUBe5awnX=33Ql+jyjOsYGxj9mBk;TpOR
zRual%!mZf%Y3#W4e!e>ZBF~=fv9Nh_s1Gz|>>@?3n7w#~H@9a+M2(@^l4R>!w_A{`
z5-Zh?)CV<11^JJIOu-AF!P;W!Kf~9pYAWA7KWy~*T*mR-%1N86TJHBvs2o?lg5xw_
zziSRG2<$xaDS2O=^+kbpzIFY4+dK81D(K~|ec7^e<0qwae>R)FV1vR672+C>@;qcu
z;K1H2`7E58aC=3|1`$86p*f@F>RK?)Zf{yHO5atL?a9}6C11rA5*12yr@kf)nWZVT
zSx6>EP`MTuJZL7@lT57yzlQ-3IO#a}y(dMkJI3gZN}jmEKWu=?Q<-#(hU_zJ%#ORp
zBGNOnJmL<b{o8>=3Zb0F$v-Mt^%3*C&#p_mTscXecU6xQuqkKj84kkxLvGK1*JLQV
zn$H`@6@4y7J1bHak^%8`$N_LD3)D3(z7txtm&t%D0G{=r_O)Lt9-_V0@<~s-5yg4~
z#JUY)-NEcz1J}fMTkay%X5CCF-^|UDo(?$cZbRW@W#I}8qHUD^h`km3xCQ+2RfeWf
z&kB)hEh~el<a&P68QrgJl;ZPKPhd%Qo_XsoebWgF!Jx*4H|6odb7jkMD9a66O(9AZ
zZR<gNV)v!cA<5X4pN;(b#_NXht*)tIxXjb@+Fg_+<RZ4!_Hw;M9&5~0Q;O!M^duy&
zia0SHS3o1_8g^#an^4Rz32YX>Q@7`DdOnB$q<NR35)39+5&r$pa)WFc{Tmo<ahs;j
zAPh`qQzpL{E8&HgbK7;hi8;1*yE993@vGHzA(3XqQ69`~?K>|;>uR?$WoT0<vC~GZ
z@g)lyZj!isb|~g@&;)xRc|#hffE92mpac-uab*6}+EC8%cAqIK*hqU?(<;6N_22$@
zWyo=<mn8RO_z|_9%R=?w-1@5Knjxoh%oM{pEl8dHi`M1(=Gi%`Zm}T>sDo`E%Or+q
z$DAfxXu&jdlRQ6ZfUvFWDYENbXx^|F?<w8{1+HTDuVmyO^0R`6CADC*mu;{4JcP~2
ziTt!`W8Rr)7u7OVfMF=FA*PImy;s=N7$mtCc!ABz8zBJtZgPARMy_Pi$0teXe6sEy
zjtvU-eIaTP`f<a6KUrBt{kj%aM9G=N8T9O~7g(g9G7j=nFv-b7@J}mO=tO-><;iE4
zgo?Gq#=BBAU3vWWS!#*6c;h}G`k+}bJ_J;{>N}EFF!T4({0<H9j+f@Rz9FA4WEbk9
zRLRn!qPM1M40|@ghX=r2rvo16BGtCxpM;wvHb)<9GEx=I@6sL?`I8+8k+;U%;pBOX
z<Y-#aRt;i{il_FktOFh6sTXU@jI0{94l+)+riKyD{Ijpz*h=3|s6S#W3eaK{-0wwU
zOWMU8u`mf`G{1wx!rIVDY@NcaYOtRCNvaq+541-!OS*zEyP@t?Tb;T5Y4?u{f8x?9
zbwwp?!)tQs+{~%EZ(A=<d=~Ag0?SVY3sWmiOLF~Zjly<_yIG*6wXLa*tUCaz#s9Pb
zg|lgIUySAyyq+?rIv5IG$S9-TIeO*pBQfn!Me2sjTDc#QtYR%@y9saJ)d0#o5;MOg
z*$*+FQ5Gho4l`kk{G@oHjQJs``0k-zleU%Kz-Uh?Y^>BWl*C^1X1O|e*|p_$Q9T94
z365KB!LPDKEA2yl2Z6=*Z*zm-V~D<Yuj8o1aVHX_yQz5Jm{&klKa)^@_9Af#T(+vA
zPc_+3^A5f4u?N_6ZxPbad}2@p@TF2ee@*KCBAiL4Q<tpuPHL6j#L(1VK%%z`Z9y$a
z#$XD`Ujb$Vy1DAyEL~QE+P}1~cn~N0dVRGHmKrH>R)>)}>-hwboDeG=)>=@I*H@V3
z$LmY)$>>`ang8f)D08Kc-*Ysi#+=$s8*D2W;}H?#W!Z>I=<TZOsWV|OC@(fr%bdE?
zfo4u0<vz+W+Ej0vEbZLZ9Jsc&z1f2JVL>f;QCL$N4>8p~WOfipj}~kt3u@N`2HyF1
zn+Zimcr6fKan8q}nC$PnZw3)|gy;CKIIGk9GZ)i+`q+B!XLU0T2x0N9nbU&Jv65tY
zIlhiwNLGa}L_p5T50Qe>bu$uY$NPS9Gt^XIQNDv2{abS7G`2T}TTDN%Ib-+zu0B56
zW61L}KJPe*w45e(tDQYjK%qEB=-STo@5soxthHHgel)|Dfv<1nhX7u$nD}b_60?ma
zk|^dR_k0{?lOiRmr-thC_&x~cJ|pcRlwFWKXdbwBkXwD!rP*^I{ZeVGpc_=_T0c?O
zgzV9*@#1->z*k)qm0^u!kgR3f7;ry<5v=IyFjBox<FLu;ZAV$O=2ZDV5KQ{$#EB-f
zza6utLiH3l0Tp_rQbM~m9b4Aq?KR^nUZ0mB5&FdHeL~e%vg2IrWa)?0S2vhf-QiPk
zr4kD-La`&X$&yROaycJg(iw@HS_1i`0?o)JkomKfmNdHKmKo#2ND#Ig?{Ul0ztDwI
z{xFT`DoT3di^I(ztmNr3<dF#79&dme&r!p09RlzqN=OXI)#oJ)`JPNZ-z~2OV6(BX
zPCyT_3>Q_w$670FCebV#|MYZc)aW`{U(7PcclEljl*&@i>f)RNR8+oU2A6mGQVG`l
zG}iI00QDbHZmS*F&1+aZRl{ZYGj%pO(l@%Bre0g^jdd}g>~JMTe*B2!3~o#f8xFO1
zTY#&%T^#2rx-kp7iP7zRjV)_dtv0@qa;279^c2WTS}iWP<jUBo;y@vJv1d4_-2`RK
zc)BH|+7Mz^OK&u#2W&}Ou<@IS^GiD5?szTPa$_GCPgVpMZ*HGnF0&cn_9<gT5(ow$
zRw(*3+?_nfEr^)_n({TQ4>$92HZC*4NbR;~@%Grl6?j#=>IpA?)Xb`TOWho3j!GG9
zQW$(0%Vu=%;W*kG7Yb}oTF(c$3v=^UCvTe{_ddT$^*EPSqNw`(0|EMy0ydCT<qnWx
zQ(I`tDXmih6+68c*MTt`wgjuUx_$LtDO)`H{3TLOX@vh_75T;U{p;bG`pfwgFE&vB
zo%jLOY>VT|=8p1j6#$qMe769Ola7twTU~hs&rr{FsMNbWY2Sly$x}XGouU-flc#aM
z08d}vt7SsdC4}|Icd0R=yy{qoF`3Bilj?_e33C<i)RUd-2MYx;&JDRzOLg<|kU8$c
zZF&0|3Tcj~8u<X2)xxZsutG6-k)@j@a0xIqRc`^FxhPcQ@u2iQfbdX78>1j_^diy?
zBL?L;GZyh3HR>=3zJHwmdhSx3!ESX`g1hO-*}Sx6yuQIWg6eH+e`Am<PfjHEj8hTq
z<{ZiW8N+_`k>Wf=*uZx}S99P<Yw5^BGcMlqw&Up5R>;LwCufoJ+l=QYf0pIC7a@Mu
zgR;YT&9kJHU>X#);1Hl3?HM=h{c-7r45<b(6<5lMIHj=0a`bq;5pPwSVw><N{Y^tY
z4?g$o4ea-Mt%`$9p(0i0zmOBYCCLG1olRXQ;hh?<x6lPfs2e6wSutznd0m-JpJ_Ty
zGy^ICaCyI>vgLLZxIbay*~%J47fRZEq;TSDXP1*!es!64^uBz9yw*;U_|oS2&fZ(=
zy-0@M@O@gj@K*zx=8ob*Zz>b(HpoH;>xZi#b4`@EKnl3Yp*kt@4x|_e`YL6s!j9cs
z9O3^B)czf1u>?C-g8;*pn?1+*Hr=lubf0xdi$s4}0L$PN$&9c}Y4SFD)|G3;yzKdG
z0W9*d4zP$$+dQu+^H&`Zv?|flH(m5!Fi9vlIwDpaEs9Se{7^~U+)*}Lmr()m;1Zxb
z`1n|x&5iX-95HX1|CB35b|0wgcD{v<acKM+Si75|=09G}3fFKKu+CAw1ARYr**Gj^
zX^xf1iueUqQig98Sm^*2S2JtR__YtLnw34^hb}=OUKWma5UPv51il+Xws|v)t2)Qe
zn)yK?CMdJ8Irc`Swz&AcLLaiUQh(Nd`XoK(;;wd50askpPE?yt(eYz3S(CAObL8hj
z?hM6qZVIs?2JB)n!+xH=&<V~NJwv@A$OO}U;5xD-py45vI?^Q~sj<azx<#dryPrya
z?{0{AYovLY-T6TERyDWv=;a!H$cuY$!l-o+*Ttjhgsv**<Y{O#0*4v{zjtCs%{+Cw
zagS%|J3GBVOm{F?ufkwdb~a~7>5V>^#q<s4r#2?$!LMeah-#(H{JX0L8)560fN$v;
z(OgUh(jF;iC5c_5gGs{~Dm3IhG44Bz%}$Q78NGKJBTP(0#qXf9p%#taJ!OxYuWg$H
zw*oqkTtX&a>HI#DjclcNs1%XZQx+ffGI+_9rrz^Om<MAjsSK&6ZP;}y+QYAU6{%6U
zslmQ_)X$Lqor7_H<ik{d`VewHF<sF-X5FnOW2k2t0vC%ZCDcFjZYB569OLi({-y~p
zl_jlDPne&??W1-z5qwt`F8|kBvHbDstTj~l)1~XEn%L)g4S}Fbvk`XQcb>Lj7e!`n
z!yvqH4sGdI&Hix_zBM9PoAQZu?9g-088;$pr}-sQfS6DP5r?Z(5%<LVKyVwD6ZrR>
zzNGYOBrjNZUM3ExR|(dE6-aaH%tnCTCFIUt-=i|`KW-BC4C_fv)41}pB^>olKOv%L
zg8+$y{C)9dQI=utay#u2pkeZg4M~IUTm+$Jq}^I1z9G*hfsl*OyFIU(d7Dw)f?ET#
z!Rj5mgL_dXRbbV?Kp05#qjq^UAOQ1A=Mh~8b1}a3Z*|ixXDi2|lv|a+hjXh!XP{ry
zLo+P?F9+{!^oeG`o_5{}7kMdf7WaCp*4~!F+2*|)oP<HwF&fxbs@YmNCA&S-k>m_!
zFCeajh{MgEpLorL@LkM*W)k@!VDX0$?BKJvxNgTv!f;@wl#)=d4q$;#a2MwT{cuWW
zI#hq*SXS2tAo)T`0;|}s?Y>QKm++)?2}kUK-D+=@Euh?t4D1N;U*yWrJ-b^kbl%TU
zQs9TcbcmPOMM4vMx5ap?1i0W<xjkim?PbeZ%MQZn=Q{ar??#?>Rz=-5Cw9V$1{6j+
zy21N|XWB;%w_By^P$i5sDFHL*${+WH`G|Tu&2Rc(^`5EMuri15zBU8S3-xC1dl$?J
zBzCRV7K_u*oIcEo@Tb}owA|CBJ`MHW2#uZ0LtbQr3}qeYen;;`19w5dy-via@C^l`
z(pePo?wt@FoMi7Wn&gK6(DqF?Kc8uo2=cHUeGPq8%)U^dR!d|MwY97F)`AoN`51$T
zp8!n3{%61eVbIDf3v*6HUNM^wTSs|?{*$`ViDQ+MYgkR%^5br|X9#@`Rew6)%A7$P
z`wcg|H!_{OgO=ZlIltp?uzN{>T0f=A3fu^aWmFM5!>thQWom5~|9(*YZ_~<m(~vjU
z8DVUOXWW+-U^_DYq8wMe36It(SXpD{(D-@TYsq&vvQ=gPBOZrhFIv6~cf}D4#tj2i
z4WbW1eow4y>nI7%UKXV_-$qGjIp8ix>plVH4^Q%S3`31J>B|^gZ_^X?en;O-JXg3)
zF3D(Yt6IEWet4#y!GKB$&z#*bMp3ZF<|Ac}V~$&1M`rz)HWZx_v0Bf(rZoAD%dhDn
zn`|t<2%Z<0!RYp?yii2^*>8)QGP(TT5;bD$jn(3I>!v2g10xM6_x6;(929<D-5-)K
zYIm@x`=0b+i|WVXj&mmZ$&&4{rk1^_xA5X2)@jrficfRkA8TjziQ>W-xxXTKHC!m+
zgiTUk+g!e3@rl`SBKpirruXcNEqPUbXVs!bz2h)uO>1oAv5Ecar%BCc$69-Gjhd!;
zE{PN{#CBXE+@cu04LOBy*)F2h91R5-X^R<aAAWQYFbK56rSW={W%tWD_Za(v?CoHo
zQ)JGq?eTrY=4>thX?7u74cociwzmsx;k{g=HIAKVDeH}Cn<tYuU_v=Gdr1q*zPfOd
zKg9<No;)l6r4G6CnTF2CfbLL`MvsCt?0sEe-37QI^3%k?#<?|&&~--kJ!x>eK1m#h
z$na)E(Z~yPHW=ATA}76#7H81VW{AqkkoJpUncJ*nG5BZFT*|Rw%VXP-bd6lj6=>rJ
z;sR)^f|ya!D`{BOPBU@ZXX+a7pR?%`#-2$=cLfT2=a~gBpEe(V)b>5NLHRQ(JDL+%
zDofYSuzj;>JA1XCmOlT<;!`7`Bfr-I)HVmr`Pz4m%UDXi@=YV4PD)+r-G<bNmC?~+
zo&WsD@aSEvW6=nUlXrcBi@M&%u|=vguA%~&d*b3p#-!=y9I8U|0<b*f9MX;5weBMW
zH#U{(Dj7~>!=j*zRDpUFD#NawJv9FJEg3^(zJl%W<+O6TNORH+R9s>Tr`pm5i%_GR
zV&B=4DY?c1l`pvHK(;Xmk+9TVgCgo+hY`G?V_xJ{SnfT#bY8vE*8Eqbzw=#BQrVO<
zW^tA-U|{=Ikf=#*+5Q`ulLec*4<!xzioO~7CkV`(gOn4>h?$2k{zzL?|N8~wK3o?Y
ztoPTQjhtmS%*C=I8SO(Q;>rirxu?D&O$yJ<ifa!Xf%H|H4JuGO$i?PfR^h8n(rh&r
zttah6cum*Z+>->r*Ot77iPsbZz3Ig&i$X=m)X;=})+6GATfn`?O#qclLZ>}Y4>6rU
z+5VTr@;C@kN9UUfA!>ozsWRPtK-FD6sI4_2(dKx)lJA3RyIw7O<~9pcg7Ls}d1Bf+
z41o2a>P*7^55pQK9T|RCLjQaDz!OV*$$qb~&)^9+Pv)z;pF2Hnpa80ikJ^DC->SQi
zf813-{Y%Xg+EaO4HF0uny-Joi+s4-|in>;%yDR!u(%xb#nn$FQ@6KY6^$&5<!4~df
zzHGu@k7}UZ)PgKDcGPpk&D3L&Xd6HGvZoPSLWv<Dj0(Wji+`^Ue@e`?fa^akz?4PP
zA9J$jW6m6xnzGBjDr#T13tX?9sH7YTwiY0;D8{uhp4hahew|?=?uyYSEe(3!xtlJ4
z1J`KfWB!=~V##&E&CV@Zbx@vtv+WEA(<l4NOd1S690*-4C9{TjB?SA9xuZVZH^XXx
z2fF|zfw_U2<m9Sp)hMwJ9#4<B!H%FAy?@MN4<KG9c~e2otOua)J7d?bYcoz5T91BO
zEE-8OGhJ0Tv!ieWvQ5e8JaFHympqu$hD}nW#%z1Uw7A+D&~aDeB+)Z&7r-JOvD=?f
zMM{2gLTCmy;a0T%xSB6g_zb!luK*-1r=ddNqtLY#IM-96U#|h(TdQpL$Fl<^g4sdT
zf(>u(Syg?#uq*%#ik*2W$dRU$KrP+F@_@Qt9<xYUgl=A8eF^eoG(tBbcSvobMJ<H?
zB~&%9@%ty%tuX7bqJgL}EeANc-i97_O~wW7PS#H1_Z_YMOT{F7Xiu38Vj60X(wI=#
zbYZmW+GqXa6ks@HZF0#iWhsrVz_0lU^Qlya=Ft_tmKw3M|4nLKF?=nC&lavSU7xxv
z&96@B_NuveeVm+!z^T|{e(7Ro_gK_>le50)vFCBd>36<CeW=_RR@|9|M0sC=%Pxs`
zFC)Uo(jP5o&slqKp}n!L;qg~(0ez9L0iedoX{a?Spgh6v)ho0cR<4YzWUPHMTls#J
zaNtK4zz+;t&kO*0RB`F(h5><As&S3u%1Wi~jo#f(O2m(5EY1Yd67?uZwJ9zfIP$Tq
zS-+`lUoOYr4;OEqkyvu}LB8qStp`SLJ0>vR2r*Ow;KgM-wg13}DtBzNeDe7+qA9}j
zP4BM?KwIS8C#I*x@cxTB3uTMdarPn>7cGcwY*w?su+SR_)hUl6_k7MYvIudTC0|`C
zo8Xh(Q~Kyi&lyBU3XUl6n;-q<@vZYys~%=Bh>9P}4O;Ax@y~@Y-AKMgD!g9Ysj;dD
zX=l}02fQ*<@h<0Yj5~Urni8s)SK^J^C_#RgEdahzGgOr`B23WQW3GEwN3`xybHSr~
zR<M*pAv7dn6@M3GF`qHvztEsri|8mDsQaj$L{VQ{2fF7+QC8GDr1<Tcyx&3U%E|B}
z$<+65?!uw)iLh7XDP8Ni_wK5$Xo{(~qn@*kR+i4MPMa#F#bKuv^6%&4vg(kK3PJNb
zZ(pra>ISm=F214k9+`w3qoptr3*DdZ^a<(+cdnD`It`Oi?~oNZ!te*@82+eBby?l6
zEZ3mDQOan$iS=3>Lmt*Ml3%8_VQK=2A;lpD3xRL%aiv5JlN``nPC3HsOFOa7YFVW=
zOKK+PpY~o~j+1g3%V*^5t-xLK9ke76%DMj3?YEtNvwFyx3TtCe6Xf?vTO4omYqqIL
zDDqmrtoxGN*N+feHUxAwKMf^7r8LheqYEbTtM}X*`-ukG(G)1>a_utg^qbg<Cg_V+
zBb9JqPAus;ZU|kN22f$$X4kwMCWIt%M%T`NB_#c1y4vDe^o()bx%y1moJvQ%O{W`c
zR|a#L6(ll0)R5Nno9m=C-x>nu+;%#EYn7X=6zqHL`yG^OTZYEY3X5Kepgw|0k$HES
zUvJrRGAdPn!1Typj{JpsQ{bbKu8m&@el#w@<ZhZ<5frktYkbagd%^U;Xv{61O)l+0
zB8NeV55ejH@!y@TXjkuR{KIZD?bw<v*$bh@dI8l1`c$z5;h^#YE<<TfZvl$RiU=wm
zVQ7=pj7+8y15-Cj+FC-zGE^aufC+=s^MWtE@zr#Q3h=vs6_MU+#P+b7$Od1MU8~kd
z>jcuOb6JMIfeos=7E0%<m!mrei2(eqVhUFG;aH+5U3QD9>>}B?hbdhABDK)XHdFBS
zqJ3VV;yNUT(L~#6K?1&uD#ra0BUXOg@JBN?XR_s$y`PXjd_~Iaul|FYP3Kun)A6K;
z|H1d$qUhIgZ9(8)$Ioe#r>OMVN;aM4!|mF)-=qweJLAx`SbekBi0LMkK+<SvYi9(3
zx(O@5EoZWD9BOp@-p*vnlGO3!aO6zueV2Ah*E{ELDwWpvMX#yONO#Qu7eBQUdr(w9
zykoM?YwCmD%7+D02LdI;Z<nt}d19@4=}-w<^*Q4Nuu$Vuk+iD4k*M3edTYqRR7Tjk
zKvRiZV!rfM2#A>2L>pqMefSauqa&1jWo47Rg>&7!RSXKYtj8^OTY3cJO+euUegjg5
zDx5cpJr_Amb{x}FV-0T%`5t>T6Y9#d7cg_43oP*#EJ<cyls$tJne}|#jTV4im4~SV
z8E$mais#AU(Ao1#wM~a>eOMib-<)VcmcO|~XTXT?xU$nAmH8^F%mFP&8889LfKB}8
zn@2akow-JEaF2k0#s|6-4+SocqBsBYT`wcDs6M_?EGwj?D^}L>v9YrL-c#ayKRM6b
zK&SU)ry4)pT7~w!Oy!(J-ftlQD6zFJrEQYes66DIEI1Krs!LN)K6x$1<#)T-NFs@-
z9)Ly~X=iA{S=o@Wp!O3~t?ESzkFz?_eR&=tBQK^a1vp%XE)kca-I<6q{!&Jx>LLWH
zVXLhf$E!ZNlAT+3uyL~g5T@CHp+{J>Z%`Gj1b)FMwWzqd=IJQ~JL6~cEM6kp0;0Fr
zYAkK48Sc=$tAB5Npg^#@%gC84I=TA(Mxdpt7atYBD!?@VBott0;@c6t{bEGQa-w=M
zOXb?QEB$Z4#CT}3M<UN+(DHyaST7HgEk&Mkj(^Zz?S*<MF{xIbsYz|dXT(g<Z(rBA
zkvq-SLE;8posNL*wtlwW>a;qm5evHfC7#+ak4W~3TX|J1lq{ZSdQkIMv;oR=N}F3(
z6B&kJvBGj%Cy+$bya5pAgXah;no!7qhYWZ!kzc9xg|~j;2cm+i?0(<t)WL?@F&mW+
zALpV)z3qgsp}!j5oi%Ul7nQm11)u4q)1#OTuX7uUus5QJXUbk=lgG0WB3@k5(^-hD
z2Cci7`>#SK(@M4g-8|o;oNv_;vD})Xq+m>XS3n+?|1hi#!!!e{fByg4yUu^M+PL36
zs1AfuqpGxawY6#$rCN<GDQedqsS#Ql?p9S%wDwliN{Ct^2~xX8C=n}0QB)$d2sOfU
z+@9xec;4KvPLdbr`kb8W{C?kco$JAOE!Hj$n~W+y1NDaOa>ojji6^E80r03hCl)B^
zO^MoP`1e)isCqdx=c4#hV5(K4FTe+GOWg)aU9S)B>)K~^iE-~HbHdt;#9Kn~h_0<~
zE3M~ZRdo4J?Hgur)rJaq9cDh22Qy(?*5PE2+Q8t)!VB8|F>Q9P@cms7{(f7g&}5B}
z0T0L$Q3)~6pp%4bp$!15u3B!Vv+NQ8{^X)oBSj1;`DA4>qttX!E;WkHN@x?IfsMQB
zROtrlLw(Y)l9*32Fe#<I0x3zJjiqjig_fE*%_H+4j0Y<CnE|f>K|tMO8S@g={r;@<
zTb0xP&$Ey4^xoyU5wbfuKTo5UkBQZPor8J(feH-Tqh-<di{d4=(1>i{<{eVxi*1We
zKOx2g<8~4H^!D8kK4OWX<7sQs35IK$c-1x9%i)=RNpoh+;+!85>pQq1MekF3&O6Xr
z!5dgywkFJHo#DChg7?R>UwVsyGjb7*lU@z4L>C|d+c(HA#ayK+mL+jS@bWg6m*A^D
z?klwS0o&0KvRc?9eJK=RcvrM#33mUwNCMHx99DK&y64|;F1M6PtkZ5=las0%=Mq)!
zA?vZW`3tiPaj{0m3}m*@V>+S(%?VP{->vBL{>Bo)!u(<y<^Fj1!WO6c8CYID?a>yg
z_}1l;xm%-(CCt0_(MX!28rwzs_Yv(A;~8DF`lG5x*2W!?-s{Z`17qw%pEwQep=N=L
z)Y$_t(|3lA24&8>u?~5O9oE2X!vk~ds5h}CiH8bdZtnfZiK#VHlNJ}MKG;(7FgZ7|
zToG39+>%9XiY~dw&X)GL(AGWFD~gz|p>z<gDbU$<Hsf_&pF*R3KS!ndg^j+xfloJ-
zj^J59wotj{1Ms~3wNqP(MMu`9#1bQgQ|hjxOdPhAO^LU-|5HZ%cSPt*!(S*yNTJtA
z&PAwe0^#wK;CYRUlhsV!q&ipWek5C<BKOuL$Y}3ND_O-M_)iT7hTUIznCm#+qP6y6
zISLAR8Qg#sX!!E^r&!AZx<hp>6Q3{WrVuGUdv~^IS(?2Pwdm7bZ~wJ-#ppDHPk3SP
zk)IzVjW;va?tuqSSIqj)OB+~uX79Kr{M!uPGH99PWebabhS&<GXaf2(61FLZf87q)
z3}-R;p0sd?$dgPi1uWf&+u}C-j|PieA%D4~`9`0J^)_yIotU<?f_d%yd_*nd&*?J`
z754h(Ts{)=Xlc|PY5v4cP|y>VJB?JH!|G=U$&SLNb?D|v@7R%6_-8lcu~M{tsC&RB
z3(I0BD8>q4Rj2no&Uq8@CvYpoG2zJA=w<0ac2_m$A}`7G_W_zH?(E`^!Z{B=oaWI~
z#|-aaT96f!hS~L@6c{a4SvfMw-3iu`;^X9Vfv?aLH%e%?ney0u(DjlFOvub^8k=~t
zBEK`5>y?bAR`pVR$GzX1NhKFj2tsu0TmEFOFQ|FI+}&5DZaF81py5{RTvd<T(4OdB
zobF!Rdw#8~3l*PTx7{}gAy52nz6k~&yDfIY!WsAS#%ika>Qt}dj%fl>e*KFfGkXI0
z@avo`2KiEjd?$JBj6LYOlOvmK@q$^cQWQVJ!OYC#<6F%(?qTAPyAZ@|T;EfD1_-yZ
z;aS4=-7x?usbuk_BhcEG>`v@uUvA{7=_U)X4%vI2)<_7qjwpf+Oqg;++?pFy;~sG8
z*1o2fY6`hGy7dmyO6aw<aI?H{%i;--<CcO*1};k6&$lDJ>cmIVa7IH%-P`q&B$W7x
zd=z*!yIfsO?z~p7+4qWgdQ9y;vn7W73<r<~pkOE$HQklbo`JpS09~p4+yirO%#C%8
z)Lg7UC)D2UN^cOZ;FUWA9=h<cCs*CaJqQi~DW)MCx<?L;<4z1Ud+-w>FqQKtfhHAs
z7lZO_PP%7u=8Nm-x+q^YUvu-bK)2a!A=pBH>jH96sGCx$<Qp)F7&{dc`NVy2)M=ez
zUI`jm7;Gy0CA39pMZnqNObIjQv@Qp?LYl4-AXm)A80^Vr-KtV$SZnf~5p*t43zL4T
z`o_URPNoAkZqzM6Kc}wI6JgcSa2ju6ZsYYYnz8=+T-6>+qOwgvs-mM1v9g0Fz{mgI
z3v%O$V`NKjP{|M6v)_s+CzqC&&(gRwwdMDUJ5#ahq)BK3FE6*=@4}kQVu2g5(;J~T
zMp$U<m+*CeJsM}9F?lB^0>OI$l=oKo7<*{>w`2ge0PzTJ!;{8=FJ6^)S)roQE%})_
z_sVY4?Bw7<T5Hu9H~!qJV_>e^IvI2?T(<P!Y{9^gs*hU`gY#HsIs9Vq4RdFcc59-u
zZ_j0y(W1)BUk^X__&+Ux!uuhAR8ZF)PgYG&mvBYvY!qB0SM2#D)|5iL_5*N}Kr7hC
zz3nzeyMg3Q(5n=;-ce~XynL?8>P<EAPv=O`Q-)Z}0Q^)okvjAigM<imJ~RgVSLV8E
zNx`pDy=NBDw?RS;e@t${)t_bBJDPVx&#k^Ve-|#En$)Du`(qC<wi_}Lxzn8<O5R*X
zL!s5#-A!ddE}18~`hMRBN(glW;9Nk!sJWc99&3mxoOKLI&TT8vx|`Jh^B5EKKw6(S
zCsndlK`^=aZGE|`ueU1e4I8J+sHAd_9M>sZNbP4zLW9|wq~{`O{pN{DopiZ$lV4e#
z>gAVdd~ck&A_emX6fS+N4eVRuPr$6tS<ZP@y0;eF@*nm{k=W2~3>EvU9s~j~hsZ64
zGQgk#KPYM#RI4f_Q!$b4n=c8GF1s#zOh_7OT;poB`#>)42-<$|x;NKHGy97fnMeDr
ze>sq4^9`=*ZHIe-!ajS58mmcPymAxO<5~(6X0I`Ow{9Ekr7&rcJO(xA9NQKrBAzCy
z-3|%+6!=I%uNiG`h4!vrsT0Hp#vCA!!`_@V`m(bD1{<@yRduG<E9R(ANvBxd2>tmb
zP!9U)T`a%+QYU6%@72wncv#V(HgZR#45vdc)Qyz(_Sgu_inAoAA&6a@-3wc+i=D6*
zba3;(P^#__>gVNCX@o(>xe9NcP``Ivng1-A^iiFu$lW~CH%cj&I50bN#u-tHiM+`k
zXZ*@uF9x}WhqKMDnLh2_R*n9~`#olMFQ4KQ)>3!HBA}V3Vh>#vY(&QZ-(>*&DXz$8
zP$<z>7c*xzK64u!Xv<V)2R5uY?ScJWzQgl_E%6<Q$FrqSPiEEcIUIZ@eJk#5G*wtc
zO!-jy$!X(aKEVuHc)!-vd3yA^J5_0CF91Wj5x<+C-dXl)r4Ui=mMAx)+f}(S!}Hs0
zt@ykYP9Q%?$y58saH1`gW;2o$@)i9<11N@>YV$9x?=z7C$-4r&jLjcQ72{c4e&S#J
zp1#}0y+;%@rx6#0(rKcR0f$|(C(+>%*8UK6@F=@rh6&;3?qj2#Z)KIL5}xmIazDwB
zn>EIeXps{mXfW4CuY%%Edbl9xc)#nIHC!&pU47XA>RP%sd>A0E=ltc|Ul6PsP4;b4
zg!l`>O6Zlq-0Qk$2cKM(zj+e$<)N+v$o#|3ud4K6nENskR!9FjN(z|uF8EgdP?p*c
zF2UbxU85#Kp<<AssfV|1(2CLNV$L;1#RG=6Wb<ydu8k_;3_cP~t<X|ytGc4c{S{79
ze*0CuRx=tBX~gZ%a61SH3Y3JD3R!=+KOo^NBgA>lC{8Cr>&<{C9z8GYsP*D)3NeG%
zLRd?Ls2@k@fVix&V`BZ*mDe;Z9SpY~j10hjx`BwoW4y)zk7>*}TFxU{<owS;h8b@<
zJ*GIjN_yhKWKHig{=n}ax4L3r#_s_f=UCaW_#Am4&<M6ao(i>I9FvCXv0TL*8<S>n
z<0eEYJ-Gtz(7bom$?=nXCuM_pN~i2K7JSEKxqkq*W^`q8rgp65yJIScZ*)iZRsF_n
z@U!Sj?|#V1!2W=3y-PL2Uto+v>mhTs!78a)@niT%06oP5;0f^7m+yA9HVC!4d6N9g
zsk^Up_%wcPR*Xln+9d1Ozv?m@ua=_NCI1;r9_KBLkM7hu-k<l$Z$R9*8$&@2)$2sH
z7C&iu?|T1Fdh{nXkx1BdR&}@(2I~D+iUh>B_PzDK10^E#h1K!YU&s$KcS<$2w%5&D
zy<aK7sl3(gf)2+>+NsW}C3#6&_R)I0HAJ1WaEmKqON@6o3*UF25Mjc{*08Zxb8fSm
zBWI9a<*@-$UfQE9vEv2Ly*yE!`egG7Wx<ofZZ1;$@tR2>F(3*&Mc3HOwz|F~IV7%?
z&WlYgu;?3o<11qZh{S%N$1B_x>Ws`p|B+qwLQ#j`{jqmv^pUw{Qao-Acxd}DEOQOS
zpPHPRxe?sW6w{C+!~~MjCddt2{q={QX3C<hxCZ_9SKUb<?RS5**0q--<aVnS*_T%K
zZ8ie{DgubA&=<jNUitSYn?rvlsqWbn)w<vu@#@lG0#qyKj^NV)S)Pff5+N+4^AUY-
z{go-*P;|pY{MTNentv*)do!qWlJvVtpWW^lUlM7TzRC9i5-xV7eQL{_62yhs!tFLW
z#cz&BB#^oL3+3I0(?OHt-UhE+-8_&d@M*L5&=v6mFzGjFWwuv0Z1_V|L>ikv@@#HZ
zQfeuLIbqgKJ-LO9k&_v5_p-3u{`Cp#lV|;)e;sji>!Mzdy&{c~>m&Psc(S;DwxD8~
zs><L*C>$@P@~qPM?=P_P4z3p&#EE<4eLwl}2|U_$w?Up&aJn=8WZgQ>>;5#?kpBK%
z@V}?-@UQul6(d#bbHvt)Iyx$p*D7Y4bW~U!F^Sv|yWbj<x=IOMJ3mj%kK#Us6OA4n
zd|Z`w=~PzG%FzI$<#;Y)qc=!ZpY;YS;ztQu4UO(c#SHK4)J-R6c~mXc!d(AEMu1-*
z(PPPz0`ciz0U%DtzJ37!b>|uBB1uUbc$>|Ru~oE@B`r>7$rK-=&I)P$&`_5r;KJ@R
zBo9*O+{N0Y-^ob2K5?oBClohv&ya8QjyQiIaoq=#mrX}?ar_~j%hNBbgLpv$x>u8S
zxN_cRKc8q?4(d*nF)sqdM{4qc(pl*ZwZe_*-1RA@Y#I-INfJ*%amlCr8bUokreKkf
z)SQ2%Cefx*?VG+)xBvMxcJsutw6u#3B^BCo!G8l}Ze{je_%gR%62hGO&cQYRbP$_~
zpcFdB#Iz>ITET(*-sJYdFj3z@_tt2=($@eTj*}aLRSiru(Uh`FhcMm{kV>!8?L?=P
zLd)GOQ(ZmRRQI@~3X6Z%#e86~7nNGg#<wx_y4lqHJYl2ycihuDyJ>sT2G5FS4!1m0
z3{ns_Zdm}jx0%9J^Z|#{t~C^S$f!{<LhWQlc~+oTe!m|x{wUtGb8QpM(%MB3yzAAw
zJYvDP!s*b4Xm6v6_#x!+FW=apKzbq+F4Z#f%DwgzU63c~%P!gqGd&&GF8W0;#V@X(
zK87s*kYwpN9%>*Z$P(NK_&djk$v}i;A2O_tpoOB@%S8vl<{o{idVQ<Kx`ufOqv}(R
z9{An+-$~nS>75R$)zx7a6T+y-6yN;sZX06@(6Ko={p|Msp_i5G+Qkm)@opx`>V9w1
zxFj=vr-&-#KXRfrm|MWF-O)#N^J+t!vc2gk(ehFEFAtNGF5;<jom~f`llt-x(Wu<s
ztMzKK;AE|A+pzaq!`)FG$i_+YOnbC7ht=5-?O0a_lq&a7&|pc*0RP<}gS*@38Fw_j
z<J_#RldsFsY4_>+u{uH(7Ku%=F?YY)v*~$;Pv8Pn!sd@L-Kc|VeZ^-xthBNAQG=!7
z;`Xjfu|pGN=^=R7k#dPfbnrp2S%sg*oxwl%Ey%H`GGzCd>IRfyh=kYz3!z@;2Nv2E
z(itl`;QXfQ^|dMQ^15qRR}L4*G-r#&4{Y_dz9~ZK?cE7xg?S=-eZF@OGiuFBm2(?B
zDKl{27DPRva`<$MUuhq<5m}+GtJLhaC|+|K9|*ME{bbT%6Rp>A$Q=ed3HO!JGmo`0
z@WoYK|4Oyrm^Jx02i^TA!X<`!cEK2qzT|>*7NYv_I0yV?E{^7q)4IkuJi=AvU8y!L
zXQj&Bp4skc`~2l;>je@dqW*I0^#I2Lf+H%Kc~5sY^gK;A*7>aBaw~FGQ?{jlrS0NW
zb9Cc9b<!3aVb*_ThHDx(!4~JpE@M1`9ERpKe`L~K3r*Z6S8;s-eTXkF^fCg)D4k*!
z8#awV45xFJvvj*`=iGs9LlSFJW<Yn)$Mr7bOh+IIcvt?xyg`}*f>j&i<mp*#D%2}#
z!)rVqVFrCmuv;D-i&-Nucmu1w7?HD?uFuChcYG9O?eIjn#LbeQ#g53Oq;;EV)uHlQ
z`!?x)vre%3U(H9R<s~1xKw!M|kb{Q_?d1I2nOgJQOJ^7lljGPx()L{j_TX5yvyI-N
zJvZC3@-@d5_<h7Az!a*@v%g9r<cog<(&_QzbGRg_xX(|;c)^}>VkQ>dx5G$R7r!y@
z4I|S8x;)ewwfW=Aoi#9DqQj_WZ&brkAinZ&0w7jT0Sfn)T5IUprrq3I1E%EGeO7E+
zD}v?aK4}Zqc7OEq_ziUv=i+xDjfIC|3y%HDa}~cNMcVuuz9s}g^ZC?(9Y7NneUoZ9
zUf6G+*QE+TbQ_M)5sE>Xwcl6U@|L2j22B!}OYo?DgUT}me=s-LtUSSE98QSzN1&LG
zcMZF^aGNRZ;?=+7wniu-ifWOfGc4!MEnt^&k_FTAc4Jd$M=Lt9o3QH0HOhP?C+z_|
zMCPt|FZq{cCB_UEK$TJ$pP$Dc<7E$7^FegjvrONSx)ahxj-PFsNf#dc{02S{GW$%v
zT;iNR!yo_p8X)uWmJHjIy)J3ACS11qX!~Irm&OOLdI@<{Pk3isYH@S#+SQ)0k@@ov
z|Cp%C)r%RcbY~To*oD2oxzX{OA+n-^X&G&cj<MCuqmfKd3U-%1U|PX1+A&)|c2RZA
z>8OQB8CZTnnV$70UwY#4GUec+FOg>xrPn{(Y`1@2yZmf{9DK{097#}}Etsr9LZ+|!
zC;T7@CvjWSbKwti%plnVX@yIn8JJ{MQet}77NaC<n~Mm>FqV)evR*7tCtSiefSz~&
z5dh62ywa)+IDfkV>T2+^*bAn3P8C`l+Du?47tOyrIlandART<JS{|d*6Oty5g=f2S
zKcG|Q-GagKZAEY=-dD~-qh|H)&{HpbJ4^R6?QH&3dYJnXa#4T|XYg;9YCjHmZaz;t
zcglL>=?QgDyO?Z<MV@cxru9Ds-wnt037pO$bWf`^o|VlD9>g@$g!Kz(zJC@bGQ<O^
z9f9A;qwe|!zAJo{(Gea@&c$;IpM!J5Y|!ugOQwK~(3XXv3F=B82d^@o`FUg~zynh>
zwckK)GnxOJ67?%Be_2L38Ibf-ctX4y3!hZ*66(zvk9{;;r&l5b6M3Tl1rC)Zjh!pv
zuaZV-vwKjEo9F(TeTmRj^#`1V3NrUBfdk_|Ecm*JY*>b$TQ5ELvXGRMGtT{5iFbKu
zTNiW3OkOXarpQ)Y3XD8^X?bX$y_5rGCfy>jt*R#8NlMPoB9~XVGlbhWaIM!k6_Ut9
z`3P#Fn~W63KpSl-<%yF=xwmt#6i9e0W=Ln;%&n6y(5vtyPaORwQoUQ{@|PoBpdC?T
z0%K<=A3DTR_28a{=?#mUK{Y9&1vLpo(7;iecpjVC*^Nrd%1#?~P-NdjfdP^hJ73KG
zcy(v;fXta{$fFlU)h!WN!9;=L72$2%N}*l<1sB(mw-?vD9qYX+-Jized5C-~u|>{K
zO82Vqyu}HKY;!ROF<bXk(zpvFrzTARXR_z)ylht%cH8ew!<k9f)Rr%NK<YCXSi`kn
zR?~KFSZ}9%9mPL@H-|$}lG_4@Us}6*z~2lAV;gcCemG#MtiQT2WTpNjW>jlfv&P>k
zQ@r9Msb<+s+ElIa;4t!~*H9A+v6O16!)=MFc&|yM5AMRqJvgm|D<S}}VwN0GlRHZ5
zQFh}ON8U%A<Nj0-pfRMm==e>><6#jtwe_~orgHMR>luBy8`z?&qNI$Cfnv_7Ph2zz
zeNg@OJ!HJ3<({ndwyk3gyIWZpf^E<N3T*V~RVJ~>b}(ZWhFiCux0f?Cpx78M$$C~?
z*gcJ=COKv6ITKYo#mGO69T{DT(o7|RlHe|jhVzk1HH7;%WNz6(j!<pBYsrs4>cG|i
zA-k7ufi;~JzLzd77A-2t3{zF>#=oL(4c2=^MVCq+#&?PVtD*}3S0&KU$&*Jnk}C_<
z)vSN_&0l%U$5KN$Zg*AzmOqO5k(LIl?EUj2v1_aFQ&o)$pWR>O$t{(JUmvm}wz*4+
zC2X3N(!kk!vw0ig3Kl^Zcb0=%Hw^N3=Y;0Guh#F1za=^sF$H)ZQnsVVS}y8ujf#r_
zT9Jg9Ps8|uD<i0$_;7dS?zkZqBwi&p$rVNIqa+xX&6#A9ZuvI+_*9+8x$20%E{VCH
z_M;YGHFavphRKJ>7e|kH^9{c|KkQypj(z_sN!poBMF-Og`vSj)GrPgweJUi=@guU%
z{D)$1_%7089$A`i_P|@kUxeMKz{vr+jFEVL8Aw#m=Y22=nIYM+uSdK0(FXnw`bmgu
z8)=`P5+=U56{I_Fnt`qs&csoDBKF?6Q3D`h^eJ40$n^2s8^@I<3nx==E(Lr}Ga)$~
zbKhRy62-{KW{#VKU9z_Gf}Yn`EG(W!n^LA<w@LTRsZp{NzoISLuy3q3SEiek53sCq
z3hy+eeV)gOH(Ns{@+JYlqxM>2RdX_s9nOD0y7QN*aUv@2Z%KAwn3ZLXtYfMBrB^?x
z5u=3k#Z8h@j8md<1b#LP8AtH!GIO>sK5o~$b^TY!<$Fc4_e${B7dxFVEK+k@KGKf^
zaQ0~U4ES?02!Wn{K7yPKFf+zVf!#@_u94GDe*Td+P@`?>3F}vdnl3O&&By(Vh||{U
z&X*UqAVrDV%QH=*teC2N-Ga%Ji5qX%eyi|D{Oxnt)H#bc@Of{Q$$IuuIZBE$16<Sl
z-PyC34jnr5b?@~1XZuI`kN*z;{RRKcg8v?b|7yX1<?#QdBkafk!|v_Xfs=ZH4=48V
c>(N7pniF4D9*M~UemV3&TmK$f)AsfM0A6x;@c;k-

literal 0
HcmV?d00001

diff --git a/docs/images/pr/chat-image-delivery/click-before.png b/docs/images/pr/chat-image-delivery/click-before.png
new file mode 100644
index 0000000000000000000000000000000000000000..25f98ff3b82703c12aba0db4ca0686ba1d92878c
GIT binary patch
literal 61189
zcmY&fWmMGL+a0>Qhwkp~p}V`gL%Jk}?x8!R8>A(b?(P!l21x}(eU*Fff35e!e3@^*
zb<TcvJp06|tIDAv1Cap$0Gfilv?c%mJ@@CQj|lzepP?1mU;qFUpdc-w?U#S?(`9A9
z3!Ntl`ob6SyKTKS+4xo}6iuls6^4cm1?}eNw})y==x#GtqnWh9u}oC}%olPj3s$v^
z-}@oIzubKj_~lOe`w8<Y<acM#uRAq?;9pPAPD5V>qw1}q(pGLBR%^kHEd0$B-&t&f
zG)-t9LyzkWgBwT&k7w=Do6rSkBn%8{&QnjjjPZ!sq;)KcpLL%G<*XGNwB}TK9r5^l
zairw7mNm39ho9RB41V=JytStKeLNB_t~dQiB$`Ad;__33103#hO#1l574pkFbI(dg
zg!Ag`8<2-Tfh6zVGtdwJgdv&Uw)^YgyW<~YOwi>chho4Q(7SLc%@1pwG#x~O_nF5t
z>vt0Yra}8X&*Hz||DH4~WEwOiV>#ai`c>SyE93Sr<|P%NXat7hH{_h3<eR=v?c@2h
z<!I)1_(c9uct+J&j4fdZdnq4}E%{jjj{;RO#`|*iJtsD04d^89-5`8Nv8w!mdy#of
zhPNo*BnAUJczUl2XA7EP0%u?bKQj)=P72|z<eXZJ5y)A5>`0JrfvO?Yt<9G7ovmXB
z(&r;(KiH$)?+%Y|XgnY<LCE{HXVMl`N=&oKze>V}3hM6GR6hTD*F+6^Z$U(;p8yQj
z^UtOVb%$t{J{~l5HDh?r6zYk-|LARMFd1HMCP2n|ev_Mr*g$P1u^P~TZ&?2Y9<iTh
zZ}0OLoNF)~b*Kd=2Q@3;;D-Db+5AN)#~bPp2ZU?|NQz|yTLJRvMUu;D<#?M})B+Cr
z#9(YDCPUodg{XAEU(W{U84E$!YbYjM@ESZJ-a1|P3iA`r+4KXy<u!LZ8|_nVid$5r
z?}71i$zQJsP}JHOGJCX1--c54YeLP5|9*LXV#U^!n2kqA4?9xZMEp4X&W;gVBo*oQ
z{0>A6qsV=(Z$?7BU#dMbCUHDX7vcr&=6HW0Q+Ocy{?FN+_cUiBD1CAhF}$9*YA!uO
z8IzyOemN66m-ykYs{oHvL6Ag*l$&Qa<+fLnFgbK9T~1-3_>#@h1g|nUIFyC24_Fy=
z0G8A0%w=zB(H&7JwKTt|f=w3&cWKluYmwGe9}z;40khfMd6}cwRv{FGicXEfp;QE2
z*g2s|7aXW#f&rd23-U};kg68+1>zrKMXqX7^z;w`Hx4Ks1m`EXk}=W@l!v~vpTKoY
zv}jgxUie)zZ9@92-VKBulJD_T5O0h8#WIsj2YdUzE`qniH?N20^}j<KrH&X4G9U|z
zS*ML6yo@<Nr_rw`4=z0HB%O4P7~8q~v<~eC1yFvDiuT9;Vs3Bn&9sR630q`Cwgl+{
zC9G`XSCfBORDWPWl<S&DxU6%Z&o^%xp9z6Wg!z{zal-X5MUNftd;SwzFvQR*D6$0F
zA9<k{^JCZKiitFY8rRyJjP9!dlkb8Ix;tMIf6P8DcA^i>o#LLts$ZYPjsl(u3|$yK
zFkdPUAard__gm(>CRW0|Shn$F2VPf5?X>tXM(XmxNYQWIw1FbBx26w0&ny1Rx7Mcw
z5IK~-B~*BWQYi!dRNaLDF^LD*<tG-QYKo~6kUIBshUh!D&h+75_|J1FPC6WZ>3FWh
zp(%~>Kp|ZQayBZW)EgiV9qUG^q2o|xkhvsI@@mwgF!R6%Ak=CDLBdtTS2r<qq9<mR
zh7*SqSUhOa<{Q$u31wRc#QJ$v);%0u7dbmek^>QT<U}@0zXdzea;$UUXYt!-iqDmc
z8)fwgSxU6J7#u2Y-%(|Q6MKcF&}?`(5`AZx&;1{U?`jUK7uZRX@UxhC9>ds+4k&-I
zmvEq}s!>v?RB=3qrSH%X<?o`4+e4|$kCPzuLs33fMa4At^s*%QS;T!J7y<}~>08R^
zwCL>bm=&3M=HfzX%Y{9ZW4I>Ul=!s9j>>}U$1tyuVWDD&xZ8jaP87Pa%wTkHgy|PT
zOL`4BNt`1VwtW)wF!yZ;i6#Uh<V1XWju>!NmuR9QFl+XW^jPE?2n#VV&xqUz_mjdD
zzgDUeZEHE!nXP?OpvQ`l8NBP)VP6l-!4laP01z_rfs$eHyJA&wpRh0}sh0M5_Prmu
zpLz&xIO`7LlRpz0)2MQ#aBu=-UXYk95;Ux_UG;;r_ZZe2)?j_t`WKOJOh7_qlw&>S
z_@>i^a-qvi)sRrF0zcaqE&VJNQ~C;3qBJR{Zmv>1K_7ePskK(c<s*%1k<$$Dba(oe
zIk#;-fAr9tjW&WmstR=e&0>U^6p4Qv7L~eNBLR!;0P9y-Z>_{3m9PHGcW1)KI+JOC
zrdc8Dy>^-?&2CKKHFQ2p>Dmd{<QPZI9jov%a67ugpy3Q5h+(l><b5r$ffts1C`UY5
zT%Q6AP&F34qr&%hNsiTKL^@;;&wv+mXDm!1ODU%TOLuPaTRQoF%3&xzgD~0y?YTno
zz&!BtoVs6<Is_ABN`8Y5z}&?WQD;9)VXDw?zTOT|3#C|-C^nAeOT81=J2-iX#sWIR
z`MOaaR(TVd2JG5dyV0){b%P9^EgBjp-kk@p^HIHbgU8Z8qh^vg%fKt=A2|7O{Q2sC
zA9fg`KN(JYa)kREXE|G#CgD-Z88CH_Mqc!ms8ucgPBP}<#I8piW=K6*%`ZhI)JZ~^
zZ&!8;+SYgvSC2Y((v5{ox{9X^7mVev%}4#EKPak9R^oYNd%i&h;W|AxCgR&#B^nLe
z1as!$*5V8COrUIVk@pDHPT%zz9yVqK%a(dLg%T>E$Z}%X^N=(aG(z*mowkzf(T5E6
z=dIAmqkGsL^nTlSXk@2El}$kWx9Q>bV4^wkMJ8MIVX1=$pM1~LSO<8U4*`F1zWoR1
z#ttZ>rL>{eIke-&1NR`9k?Y3JwM|U#lpjPRTOzW0SJuH{4_`4SV<m7LFr@-tfM6E8
zr7kbnmGwmi*Kt0&%Nbo=<0|AF`}tg?ySltJ>M`<LD(g%-;_RdtHct}y31Zk;=RN>H
zSPxTn%q(B_u+AdP%Enndv8S&|W|N74DibG;Y2w6~`UEe21j6o!NN8%kbc)=!qx|W!
zz`YcFP*@2jc7b9M{ZBeCnCI}6-%Dml(`hNF45_)PpNN`-mlgPC<=S$QqryjVQU5>R
z7)^+>w)go4h@8xrbCnq6S_g%b3813v!Kkn`#-!)(jp%$wazzLK7ERe!r*p`Og!4IH
zGNW-f?#iT+VgRJrnlvW6N$>*4xXs(Y!ETO~zeIdMl5#DC(pNSPFU|ez+bBnx&7qAD
zkk?xXWta=O91kvAm@^-9Mt$@W8W==cwe}1@*3|Pr6!>OCPw=>Tv}Zd^p6Dms>_gOB
z@WEeoXzLII5uK1GOT-`?mA7XEtqWN(Hwe^nq`xHY7~$IyqD}ldjR*dn#vzh%^7hpf
z{m!EHG;})#Vsr{<1i$CQNn(Vl4|6$i2Mt}g<Wi~aX@j@&k1};w_FJe?2DSqwIneNJ
z0DA{Kk>riX$Q(Ec%W3*NPKb`5k$YFXwUB^~e3~>```EzvWWhXjMe``lSVc09L)1|l
zMAIqUq+)oOfiso_9_X7jvm<s6Q<o94oLd$HgX3zTBoM%w@$_3=`P3^3D8^$;g>1Hr
z9LBxgR(Ve9K&mow_MB}B?Ms?Q-q-tgs<FTOcdE5ZTfB?iLK8b;bkmuv?dCehypx_;
zm?oL>m%oMu_URiUG8|#?q333;<4Fi3^A;1sLi))S<O<Hw=S0@D_^}0ck}jOcxrOH8
zig#o?zr&3uw_=PhLRsy3h7UGlttq0o!J?bvs!|2bk1XjdHYMt1mNkCr%6I0Kt2Z|;
z4akp{RJi|EEDtvdb)>G9!T8O*)NWxh7sb<PydKwhDLHxsC%^Y)W0<Q=&~Uc4P|r;0
zecfUIA1ax}=U?asbK-(Tz$6^5LROzv)JlDH0H)GStl1z0P8RY>2_ais-MP%3xrA)B
zGHKM+ajUHyNkjEiMp#hLt#g(hQ32xc*HE<*L>Q-d1`-95X*0dXULgdI#GvsxOIQ|0
z*pH(~juKmKhF0>Mg5CfN&MaO(-i5=|?={T!wO=;V!W83P1X*^63kssXltfJk8d%9)
zD%Mq?_o1<6CSrSf&P)BsT~P+O35u^cv}(u4Ji9rPS=%%52eo4ehduP1`9EabP5e>M
zKL>97pe6}FJ$XY7O!c)i#Y&B#=T*!pjJh@mC&XCNY(968y|m%aAhsFveFcNz9Q7s0
z2fSED2`;A$)4$EGD+^U}8<nsJW^)~~F%WB2XG9UAFfy8xufg6U32wDef<L#SsbOw2
z+C#^c94LB<U>zqJ24bf_1Ofcy*nUt`G$ZVR2R`lx&EkIJD<`fw*2IgmhFOuKZ~EOM
z*Xo<*(n2*#CGol70R@MfMiwKzYvu?U)Xs*f+c;ubGKr`GimEDCtGL2z)@|gZL)*Bk
zIbP<UVRrIwyl-BUi(ktkB&uu7K?A5cB=;W5c>vrR<b_He+}lVX($Q1Q2J&?v4mnH#
zN*Kibur_TBn<H<l0`QVen<`8Lo|I=37yTK+O`0Fn{kxeAXa&QR{^)x3cUzM<K~=>s
z4zOxO-DVoXx{|)b63hx}Dkv1Z9azXc+;fUAAS#`n*(vD>lffy(erMKFg5qzIoNjc)
z{BzzjJo0*^d+RCIY(_yB2pWTL@>s~qh;SlSz&j_)YzC^*$2;nJ8I&8ZV4wL<dQFZM
z1+YU)C%6fj7ktyBMqDg)?hIBrzn7eGIL0V~r(DwiQaPD9ZZ2f2DSKP4bF@c>fBzzz
z(}rYJ>puu9)UZmE%GO@sGNWaeqV8KJE&p;fz)!zYh3Uo<*#)E1h$)T`TZ@Z5&{=!P
zbD>K65|L@njNanJphT0<Uj4n9yZ`VvVVMrg)~q;8%BS?Ju}6P9fntqVTXHlg$bn;>
zAGE$;gv6ns<NL-9xl+TiLvZ8GvAXJ_JjlitM)~vL^TO8MR&_?|j8!=mo`P%7_CKdo
zn|Z9*txd*?)9-!{pB9yk6o$h_5{3fJ{DsPQW#r}|-*PZAu%nHE{Q$m#V0kh*uhE|6
zGwM|QH#32ZAa*U>k<@obL_CLvf*vkuxiXzc_b>($%JbBzy0WPm@#1&%OB?dHq?QZT
z+1*(M_yX@2s%wWPnwx^PU7Zzx@dY(g?Na$BUUXWDN$yK@84}E*cn52>%!??=*FE9r
zWneG6I$3x9pLN0tMR<b|i~s_x?oPur)oW}2o)L>M`n1{ZY1uNfz;Az%)b>YU{+$X*
z_#bM^dFsL{Br~;0s_Cc4qf21<oC-Czl$oKh@F7yec~kNf)}wT4l4(&-Wykr_c=OhH
zrdjs9u(%*rDz*<fEb=^{RE{}&3Jim;`WepyDbSk~uD&qYc|nK&vVh9Dk0t;Y8!0yP
zW~*dLRvr#H3Ojp55++o;ii&s*%<;A0^?(feTxmVZghvQPVD^4^Q66k!yIG<s#e{fV
zRq_4Q_B8RSV{ln11?!pA_oayWa`-z})TR2P1GO}(^}k2sJ5!rU|LW2D1|_c}<Wkb9
z!jyi2>#zpe-Aqm%M~4{v?60{Kv$nXIrTQZ3h`gfWnt}A)N;K+h2a<A0`@3@W%yM&X
zM1C3@q13PpIFTMW7_{trSH=ij<Iwq{goHTmAFDD6L&xkPvhlHbu<Rbn7X}i21h>Mx
zMfcz)h(Rp69x=Rsn|7WRYKdcV;<|j}<-oaPH`}+YvT4|k9*g*9Ph;;pjxb{or8sOY
z*DqJ)O%s^3PjW8aHIa$0w7=Wq=-+(*N6Z`&^kJ$;I>)kwMIAe>wO4G6`(|oqKMPUD
zF9c^qaV20zfdVdKlV#|<Lbr;T%Cv`UHXSD`x2(@~Lt`U2V}nIZCQ8NLPo_{{%5x*S
zoQG^_glX8pOT)(507T;vmSMCBcI$r$Qo7f#-}O@4M-bkEHisq9yko+;UygO3(MZFC
z-ZnZO6DBD?*mqtePmlbx%%g%m8J2G8)wk*EKAyrPrA$EU#A~)F6?q;y*h?KerV-jt
z<=W87vo$WIzq$M?HJ$!w=zkJ{oLPc5cg6=t!x-1ipWJSJcY!1&YfRYcaLCd_uoo(8
z9@F>t=vOi+zn1VmU<4`=8pg!8L0bzy`CE3!Ca~ZLOuWC+Mgu|1uDq{+NGy034S2QT
zA=-qUXTX^2kp9@g%?g(YMtw{#?ipxRqca4^+5#?UwD4GCCb{(8v9mluSU)RdLOQ2m
zu`=kTT_dpQkon_JLgS8p<<u5$NiQiBIxL!z8g8clrrNQb+j${VPD<aOWttDH`&oyY
zr#R)(5mc?sRT;*mEWfA^sx@zHk_34DgP`75F6vc0oZs{EQ7f63To@N6xMv|&7{<*h
zd0NEzWU}q5=mFzFCl}G923HHE1M-lp{l=PrRI*saimWim)GB?O@4v<quJG30msk3X
z{O82af+$V_QdkV)6k+{~EiV)|{0ej{JgTir{i{Ajdf#RWC8hLQZJDR~{N2$oVc}nn
z$y|LLO(+_0)JUsS%vk603v@50a`e%|!^3O8_ZA$2AYX_`koIqz$B!)|)Ca<~Lj|Er
zhTOSCR^wC=HfAX%jXreg;tBAyd-9oMCy@5e{e{x%A1M8aJ21oy%}dcrfDG_CMBu1~
zOEfK1rAoOqQiqtwkhSPE?wqZ@l&4?U!ip6^Le^`;j#BEJTxH&vv1wd1)A_Kjgww-A
zN^A%0se@mKmLspyc1oI4vFXy)gnB=q;g1(Tp^?i=)8DerVSXYVkJZgl8SANdE+Qg@
z3)ewLRnT#d@wuQfAtBi7SwR~LZNk&U;COE=pKxJj5>96Pi8-(JJa>5{rIat6I3FD{
zy>~d3I#i{IIb${h7v9mkK&9~`wDd=Vx!6qJYtrFk+9sm^9Jzn0d1Y$ZjHkwdBQVhA
zB%=Y)w?sD&pb3PJ*(RXAFiT=f!8%&l5lcgk)eF~0>|g+Qct|4j_7uCkUvzhsg)M{8
zov}`(r3=F4m6nrhnwvH(V|rwDxvd5qMe(%GBT43{0@{5mLvwTcj5Pv><Mn;XvU<f&
zn||7^jFXgAWu(&yDV6q6%=+40XBaPzJwW<kP@ylE9d>NRWE@AOH<lP92V}5|8KV^u
zt5tLgXhH4~@d_(nUO&O@->{~THDC!fSa*?HnIb;?EmE{4H{~rACgcS=m@b}++<vjV
z5TdWeXgVIEs#KnroiL})W+)+rJBuj$jVKf|Mj)d@V_<5;bPXC@4_qVHKIe3F8-w7T
zKynFw95fu7s_1r?wxUT0*LhIkwJohV1p4Ihz_+PWS|Lr0CH{b&ae<!FB+?{vet%`j
z8@=pqy|X;xz1!t~kfdvFl!Lrf*%bo!&~bP6PA}tiqJ8;aaCYG06J`w-SCOq&xaNra
z4$z5|c$z~u<a9wD@P+mDR@{NXRL%)i!EBkVR(DrQql+VKCWNU*my8}6y=FE~$sNlu
zZH)nEoI#u1;W);dm*bF3F(A4U(k>{qKOg6xLO=1kI*w9gWxNykJ@v&s!H>nW*$~+7
zoq;ZaqW(myH7h*WFRnahTiM>K>F?0D{T*>P$zS*C^fb(aW*a>te56da(?d=!*wul;
z+ez>8V25y$F=O*D7_$C=p;GZr_GdIU$hCp8llLwZTI%Z)SVm~5Q}6yr%8#euTB{n$
zSi|1x5}YAkG@)=}<eg~A9ZB#swBK21?(@+>yI7u0o4ctKW@O&^8*@r}Ib4oq%y-1X
zd|{#SXUFUB6?X5~9I%<ML1>C-MUh(@I}(jEvy%FqRiwKi`f>D8$R>x8&e~Cs7TXjN
z^o<Q^WVcR3E(gdA#G<m+Vd~r@oNMJXu`|lnUh{%l8<Z0=2ty$sCNEL&D=0>@<bf(4
zeW+ptjWO}{8u|V~f^I;@M2ifajA-IjK$&g1#LDK+fL|WW(*X@l$><%n7MsYVQKDF>
z^mV@lxB5r?ench{1wzn(1vdsx61&pBEYp=hWEL62j4@Jg)sV>m9oJGTuq<A?wFbpm
zo+c87-xrZC_%#}%!gtgbA*MO1s5fF+1(}FB`AB|8TTr!rm7xo<P8Lm;$x_f*o*5D~
zO_rYRrAP{<^UAYD0~)yZ2xzNOIhib5<51<vekmznVV}}QpxyB=tabf4sS7`{1V_X|
zqjLcgkww5dB?zOg`r<F&82!sPg{)vQOLei@&KXopZ9av$PSlo(pSccv4TMb2JQ7ty
zN(mNNpgl5m3)^4)J3=kibaC&MOq+s#2->Yd-9XzMTLOA0cfTa_=E{u_;-K6R7(@C-
zG~43oKaZL2Wbr1W?9ubt+E5|Czx*^c<^qH7%`7|I)ojYv<0XYpealWA8@{n7>|pV*
z(_BQHP3yp{Gn-Ii7VBf2pik*UXntV@_vMr2g;H^5l$7_N^D(Rb8T0qcJVR#(FU`{X
zty5wrL>Oj#kF0O%Sz1}#x$MNEPB%L%X^wV(ecTt`_kXO<rKW!?;798%Ix0i&7)*>v
zOs4V)$vEy!D!b|-g}4_~HzptXQ!~Asy`B73OW(v871}1VHAwgl!Na7Wc5Yd-f&#uf
ze4FEGSFeV)As80ORiBJkN9ZXYuwG0p>E}qL1LDUc0m#0Le7r`@6y_33iNDz)<R2_N
zJgH;CQqrvp`G%hGj9`$$-mmpmxlWeHzLx=xu@Uag{<ZlM&S|F@lviHN`w{Mjq7&{r
z4kE%IJBhNWR<f*;Nc2sxQofP0_)AvBbeM+OYL&jPAN8L(RU<g=3KCguG+x0+9pa(?
zeoNY|)|`>!o1kk+@ZD`7K5W}c3xx`4a9$&sd;6UuC36i7h&ow`FunjYqNEW@(B=5l
zjg*t{y{R@wD-%YM#GVWt^K4IwAw10a8aDN#CNrR5a5;#H{I|?1Z!5YZGL5->Ih<T0
z^qG9LI|7R*T7TuVZhzk=j=Yb*HV|NkO!|{4S$Wf%k<g#GB^E$)mLGCCV|p@re&}vx
z_zDy6Sqv|^CoG1RCd=(*lWa1+^5*yHR}Y6Wx=71MLi93tUWH<PKnwZFOTOw-Sf>nr
zjA}_WIa{akp_!hDi@H1(Wt6{x$86}72oQfV7fkqWg%xYHhPze8k}z?2V(tMf7y%At
zDnF7$mTL>N&e^sDP72QoB2{vV*Hetyk7I0c;Lrn#6)I9q)f|YKH>OCXgXo(YMo^t;
z%b8M#I#UHRZK2>0AWk&VtyC!F$^}8~hRQ2mco|zeYu6CZee~|n`vR_fSLiunldlLO
z{$J`DdU89MDKE6whhV@SK9_LphNuZH_M*%>&DM*VFCWuPET|1LKVX<r2CE#k#=gU{
z9dic&Y`&^mTa-o~fxlI?6A7+jp49FQ*jnlsf)BmEC5D84W?%nK@e~fX5*N*QJ=<Xq
zYUGuj7ctDkkwVHdqHe(NOv6h>Qq@kP<m}(Mg|eSYD15u1Sg+0y{>z=)`Ab~asv`9?
z>(CbZwEkuhf_JSfQ<Xm_UdLMBq!y&%{;!`Y_%9i7R%j%0VyAg7jNcyXzx2BovD6}#
zD7&t%GV23$vyl!fD1&nWqXp^6L0Iq~zHw!@SYASbC>-2M5ZqCmab7SVv!WKO8F*??
zJ`AEbuLnv`(#PN(8xu4X;Fg)LV8jWaQsJs&6)6KdgLBI3>>1P^Ni5%95W0!N`?4Z@
zAk$`o(!U=N#ARbrn)3y|Ta|xYag->WnY0q}X$IAD>KjNI>}Ls!jc@a~@KENypRTUT
zREV&;_<@`l+d%mO2$JJcfcRgrHyjqcGU)y*gTB}FZ>Jf{#TKGI3ncx%!Ad3nm86^Y
zpe45|b7g4=y-ZFyVk$5$X0n;aX`B}!^O81rPk?MwFzl@ZyupN8y%Z06$B1Z&q<%`J
z<vJKd7Xql-;gaMXQy=in?OrD({^b1Y8&!AA0r|a@)ZKwD`Wi7zjrGwUXz)3(E1Xo=
zVrU*>Ifi(Rv#YY{TmzOEIc|og&voymu4Z)w0j73ylO%YvS==N$Iqal?quj?*=(cWs
z;a>dw)YGjHP>|cxT#VEw!gR$<fl@!3#5>tT+%D~JZ_@{s%g^69ue}D-#K#%`D75vx
zK)*!3O=~L!4)d`B+33pVJDNcbmN$7|Qi__%+|D#8yA;=Ev}3CRr3bI5!0I}_5@hbh
zRVajZ;qNu*>FJ5EGAOQ-xS$hrT=5WJgUWILRiaP6`JZr1#yssy;R?bfOW1BXiZRCv
z7x|c%8;j1ee7a$;h``%us-D_lFO1gR1<Q}4{YrwcNIWXz2w(`wrC?-oZ3R(;s;xFv
z9P>`1Z}vVeNg9RdR9tq97T;Sv=02NKh3K%UZk-0#x{Bm*0P?{9R#5tXS5WaRP3~)=
z7IScqp$*{16i3>h139g3N28(izL+7ISUh9h5s?RfJVPR<E8WM@EqLbXcbm3^0RA;E
z0wy@Ux_;QpalJZB^gzBed~4RUULL;A06SG^J6D?k+H072BuLH*MMU+{M8Qy7=s5-J
zwyF(>O*7xm=qAM_8r9Jy^}JT141#r@x<jfB<tp6H7;X;>@+edzFQM+Z2JitCH-BlF
zA0x`bj*A`t>A`Zg2~Z2aZ_d@@W4FDJ%TA$_DC*JoSLNXSM>*&TMeWb0zWITA2iXe=
zFqU%>&4JFdOXuHEFutAol9|M|3Wq4Z56$nFn|P&1VQI-IPr+E&OtM!BI8FR73+U%J
zM^>N1_Ub>PN~b=lqPwhXa;aa3xHz?)Q3$=cg=rZdmiZ}=*YsSjD*4vb&gPK<4MCY^
z8yP3wQ^LW9+`|k*Z<<5@y)dU!M_O`5UT($1b#Fa9*gq`94gz<xI#+PGR@bC8Lv<;J
zH~eOLIif7SdQZMxL-d0--s1#ekRw71+RZDp?*6me<rk%mZ^Ax;9$RVa_fS4A9zF>t
z&eMfupwG3!;4msf+;uGuyouFfs@+frwd0q64N0W$+60xar_Y<V+0gF*%t!%spIiH{
z`3T1c^PAjG?yS?kxe2VJrU`T}!m#xoe56bplb*uhOAIumuCVVRIffbnA}utdcw(R@
zw?N(XxQR>S3D(GF_I{n`aMjp_n|e!P{Jqk?jrE#!FPqMuC*gb6cZ+lV!!)1o;U8Q2
zfn9DyCG&pl?*m`cUH*U5-6Z_swB0811K7y7#ch!#Av`&<vb&tgq}qrm$9$&L#Q=b%
zGn-soa%C8#qrKPTF&VCZd1OlPf=%^|%ip%@c_2L}!4a4Hr{EjaYB;DrYPh?)Z7i$^
zIle107p_c!2idBEb|byTUy(ZzhLQ)_*2wrlm9Z=|Ow-%VGn#50#*rQmdq!HOY(RQJ
zo838b`Ra>iY11g_#7N!qdy5z@_N;(X7)n|9l>x_M?u_Oumz!aa&{8T_cz6i#^*Ap7
z^9sh&bojsE*X0aKB{=a5(Ylg8BfbCVj<^c&<7>C}69y#5MlDjIP1=a{d+rk;BOVDL
zJHqFJnmo`tpc`jw{IvM~gz|JaBq=SC8z)pw?u5P6ccg=yt~nG;*-$xPX-C2{GS15)
zV@<f$ftGlgfPTmFsDpF*7I^z+&e|rNL23SvoK+mr^RcUK_!3<RY;FWUEPrscj`R6i
zGH`TiC%JajbNO1G&rG!|SWo}%#D(Za#{qtsE)VR^T2#g2mXo}qf8jL+Et(IJ9D>0{
zRrq0^L93L#W*;}p(iq60(m$kw@`b5X_2PId#-}p~%BKhj*kwTQ$w_pvb%atU9_eX8
zBy`xFF4RcZ76tLkTXYzr!y+iHTSKkd>YKMglv9ROK1f=V%o{51Z-^|A0kk6I?UTDR
zijB^syW+D5b84Hu!wB`WS8T+gDi;nnnTWi#RGN%I%hrH$-#c@PDbj0%2Z$$iP2e8Q
z8Wm)zGhWG-Aps`|S_9KJAP3%()Q_Bx3eZYs-~SS8@9QQS9}=x}@(?1fz@hz1{%Rjg
zKi^ah?PJR^Nm_smzIj9;MWTW}jc6aH%YqUHXkaNLS;H7fJ+asMA}APFqSnFbAENTi
z7bs*mtx$YWzfKU@BuqXLj%&<~Eg%#&FbuuNV1V}(3WJVyJn?Ig0lN!Y*t2`OHK_(;
zbWNcl=;j?K!}0f?Ul|619X;9Am#{SzDbeW*<6cmapW_{~>`0*<A?a1zn-e0+h$oXV
zy)0Jh$L>9uj>_Ldo+*kxG`e~s=iez?c2zU+*)K#SVTTy8Hl6%u8?4IT%zmQa;*JZ)
ziamY<YotPI@>|sn5kwdx5lmQ;$hI>z_FE%T^*KO=?!cRb*eCvX|67$ZC<)3O<3svx
zE>L#g>|PfiMxWJ4vIyn`Ljw%rEH@5mDECM>h;64QO%ML^XoT=BmR-|)4Q?cK*Glk-
z{w2t8gvrGX>^P)??k}vs<cR5M)n^f87;WboMns_9zHdlJk~~Z*fJP=9zG7=4Mxw0U
zBPt+07fP*{#&vPc=QKn2_TdY9ZSd;|;QMz3U=Zx#TMYb^Ht?uaF^=d~ec_;}5E=EZ
zcAL9g6IZH4{u)cuID0ipSe~*Y-4<~g6E}_79gDsikis}`LpWLjKoNe%=d6Vj8EyaB
zd2LFPHnDq=Yc{dZZm|`-XmX*u9(Ir#T^js;uKSyLRt6Dcn^!W!l(>dp9ClQ!R?8=)
z_)JwxnY_tjRuP5=bxs(CtI_HbV-{Y^w@i{1Z;Sn7zlOX*qs!mspLRey00Z5;umv?;
zX!t(grcCrYbj<f9hFjrLK3Sf=ruo2Ott&PIQ?CpPzk>GRI*gNE(2L-_j<w?D1U6Jp
z=_p(T+5BvI5UoOrm5vSC0fVb6<jZ}E2{9sPDeW4cI9}Hcl{z&-0^6eK^ds^@QayL-
z=88F5#Ih%D>kGRgQbf%@0)65=Fyw>E&KzU2aH(Qb91}<G%PIzP_)w#Cq6?o72YYHK
zE}A4J{M*PMuOT!4?7tzi5kM<J*)w!;O*`Qc<rk0bN%=dqtDTY_Xw>0)g#4oz`mBrv
zXe=v<8k#jX9lKbHmX8N&;lz9bt0;hSK4wXpJPLvpy9^4g6ZA@YXhx&3Q^_TcmjO8(
zE;)CQJ0FXBUGgLOF=vtE<q{}3ONmTAHR0%O*4N;uuy2wZ2L$N=s@?d?l-X0C1Ekvb
zFpBh5)_qJ$?8`CFVx~eAwM0Fe{W#D_&7QTlBn2tXg_|D2Z#cEwxV3oGwU6?0V}A&e
zZ0+{^U1@&(Q`AVxFfG5eN2>LbbkF8!^TzETJJFm@q?Cf%mN<f<@m^e+d+VfnT&fxs
zdfy+~*b~^iE6it=T3m2X=r>>|0+k1_yHb|qz^23|4W4`Xp6_oB{E$cGyWa&<=5Eba
zb}B__DF`1=0mO}>LcMchitXIrjF5f~!s~aFBJqBYDDD;Lcj!h4)kpnl+rk5GMOuvB
zgIch?1nayR(UAd_VN_jSMFu)~HeJ2{QuIvq@Cb9g^2NgOGgNf$voqHRT0@;oXdLy*
zioCtCwc9B=gW!g_S6u&%pS4~KX|8=S<7@Xt`<oJ-)^qp9bXh#f_=_S_*<T;(xIxaM
zQ!p2(=|kfvTZA0wLtOqcFwC%U#!wwxJ4h4o@M9~TeSUcgEg4%lIB(sF8V;}0qgY!L
zJ{!2?%}|K;%OTdoo<#9Pc|yaEe`#O$buX&Ahv*~p?aedmy-CuYfi=c(z*@et{}>v8
zZ6Fnk<Ci6`T%eJ>q`ioa64dU5?QauOSuriKSQH*A9Lsm!7Q|v*MXmvV(EOwOVx7cc
z3%o&>@LRL=bzKwrX9|xmuw}?8Ndn|^W(|nhhAN2rw4pNxD~PtfRedvU9`9=#qZedN
zmnxE0Jt;DgaB4;2vT$VGY=p}^^H*mkv>-XAM(CrVqlw0PDh<Orqwh&lR%k`-?4vQ~
z@HNKF4;|;s;B{lEubt8!-=n{{1W{0#&xI?4$p&h-g7Yi9*G{y=De)Gt*0P*uCT&A{
zIklN3H;d>HFJ@#85};39sL*c=A(;|Z#e3uZNLbTQ?4b0>{4VyI@4S@BxqXvuMfh^3
zT^Cmyhp!zW_CHro?Qch@>!iAnLlXX?2?Sppak^aS?l{OdxvN%$5KfSg!ly%>n#<DL
znqI;ZrnSLm0bg#hnlldWL^;ruS)f~x!tuL;;EI<lr?)b(r|OV4B2hq711&=_!F8UU
zzp0w>GnUr)2WY2Rhf@M*k6O{@z|L}o&cY;fBztQ-m~g5&z0*wn1Iabayr9DPs07$W
z?K=IVQQ?@n>AnCaaJ{^5Dm}I?&dMS**b1hetJ<KBq;Jm7Y^2~)u=n>~-m7dm{G%cp
z{w{5XRa#3>r+NGue$y>dT;AD5`KW}p-+7tZdyF?k%pn)jQ!I9n93(?~6-!kEJScAa
zYxK9^#-n_H6d+qLBY_f%&?1~KV^Z3+;vHEP7iBzx5cqqymSVw9%4PcdySl>aJ5v-}
zE!D%i<x>J-NLxPT1#Ow3Xy}Zh6kLAfTibJj&f>ngW7Col(b{Y3R{0pqu;ozdE*|5u
z72-b&9x(MW+#*xa`)2OEtjst~EAM#dw|*KhuUD)5&(&)B+YiW0)c<k1ua()f=ZzXM
z3EfR`+Dwsmqc{;=f-1J8;j}VFWSz}h&W&pz)QIi3kKlYfq6!MIF<vp%ZoM>gQ6bXg
zv^TyTuqn>`?kmM*P+hY(484tgq3BIm+m_A248Q3emh~oB+UPCxd!}U>1I3HGoRXRm
zF>4$)e!g`=z9Toox9*hlZ%vEl`T-^tH(QlU*%VCeu13G}`T;T=GR|u4&QtqboE7l(
zw(@)+{(^8m&+ydOx%~Z4NPDb^kSJz^$$1E%r8Yd8{D{H|dPuP2C=nyH!EZny7si8)
z!Fn88!{8bCpzQuaRL6U66)Ja&T52M&XRb5Ip96(d+TZR*AHI)=n3X8=OJ)eVq_XkO
za0m`Lbmj&5eaKmQvAg<!G<KiyXL=tJ8&6W>_T)C|#c~TAH6J@i>m_cYgS!NS(t=4U
zP<zFrGvtM^Twxu*b=3~!Tb*M-ZAG?NQl~G9t(=BEyn(tlB(YQOP3JtN=|PBZ_)!9Z
z`a1<Hjqm17-26YG^S?<_sf_{FX!hZ!Rw`qqmBH95KMo)VW40Q?*0_^ic`=}g@{1eh
zg{SY=Y@a%%spHMouRN#?NW`(sp7oL>5m0HN8Ljb0ZoaJ2+QjoGjMB3ZK@HZC_k%D~
zejIw~g()Y++y-M|87Z-7t@3lo=q;n%l*V+2868c1Z?S7M)+~xmK520mo6oO<aKZ}Q
zA{UO=D45g}R`$)qOB{hPS*+xl0ro<Lsa7Lx#oG3$#6$Jz?FIVK0`#LiPPsz;iYU8B
z^P7MnJDIp+rQwyo-}P_H;SXAD;2hKl6@CVKL1jCv((nM^1%hL3h8_nJVSQ3XcW)^;
z>;PhubT{&l;w||Il8YM51?VP|HB+Sr>!Nc0!WfE}yReP^HBQ6f&)Tk2F5CFAiD#T8
zOHyk@57c9C*5Es=dp78B@r~xJbzL;YHF}V%{w!QBmw4n*jPE_TnAE#-^F(f5Y`yu1
zUY0^b+o17CvmPNl*u{{stSg@OQ8IvoX6{3O`1sdiJ*hw)=d2iVWt*KCPU-Sj%pd>3
ze4`iYXbUakM+Fmr8W*z=e|+Y-p!5cbh837aI%0l3#}4+p2b*uDpYqrNN<25o@CZvp
z)Dmb$HrX5Z7jYU*sR*Ay>?UEJ7p%LMhU2|GxikH5xh>QiR!g2Shp54yU|_?vv)a_t
zP*-P&ZacJ*sEtwR$L24<`}DM5LY{xN)cX5167AixiXFXdL_|%q#&X(jo1Pe=2fUJ$
zyu}#(4-g)Smc{7Hd_K2h5_!WDouL&+L45Ub&o3*JxROB%ht;50F*fmUTcc7*+PML|
z<G)bl^_&VJ!pwx9^=4A}z-C|8`5aLUT_efshN&rUjWa>|t`^mVs7r{G(S8n&S!1O9
zg*7JjD(|VEmfepQlg@|*VxMzKgoMt6IINbKsdc=aJ)F?*+Vmi`cZhmQR{BMZ!r&$5
zzbpXxOeQ{T#K~*;0MVzo3-oNB^U{5By{t6A&-!uHfbg^i%Kl^YCv8I+s_Vj?Z?wMb
z?F0y;@J|hINtcLU5Ll5lj2x>krCtgDzs@EZD<zIKCa*F>>L=9{IPP^%oI%S?Zz$)P
zDcL+X{pMH$)4Lb6O@nMweJ6swk~dmip(kQG&S2Mrb+PtxLDYGFNn3G?2x+vDFD23R
ztlr+|a_~69$X#60WM&$+mz@;LQYI}xapNWQjvU)9<lItxLLca?Gmpsq;%)WGWh{P^
zq!b{<*b<R_7`eK0iHEDEREBga?jpzSsCVS4^kXULr0s=6??lb?$2sAlsQPQI<ikJZ
zAC%FSNVOU#W|h4%`?z@$mSmuxGB>mn=FDS)9xMqaDIt})yYo*58j73vwDx}8=^)xw
zx(z2!_*OPaL5lbTKxbw+F`Bd%NH3dPo%2NE5<0KS1>Nri(rU6eKUFqXp|vdS#ZZ=e
zp{@*Oggwurey48TXX$+2eh1weOwAU`6^-XacdgdOn=AwRVI<&XF1w!yJEM-Qn3YBJ
zBLwOeEw|nLvt%MNw5#qw4w(E~s0B~YA0NCRH5Q4KXyQ2A`CIoji2dsqI~OEMlQNMR
ztsaRlYSYI3$JVZI-yIWFWM6c)uzVuky7QF<Lp?|yn<bP2dbtKm79I=qZm?z-G37EP
zj%2f8SqIKpByX5(c7-69?*MxzR6V0>t=!i1HrOMm3RYYWEbKJNcnEtEp3W61MHkIH
zS~3FrfXT>088mgpO!Cn}GLW{^fe04Is-ksjmFPF5!M)FHXtJ=anu2@zKJDaq^>BD;
z!pU}kZ9r*dZ!S`9RkoAib-ts^HDrG#jOF$!900HU@QU?^zgYjv@8uVxh}-CO$)&8F
z*hsLeN#mSorrL<b1ISu^F^Cf&xX`L1bhRKiMzMD;6szodjIzL34<gqOr2}Ih5UF_1
z<C2m|BlT06cr4PKKSuuAk-OgxQxy6(=Eh2C49g<gIiPj5*7j}OE4Mb<ayvzWtD5l#
z*&6oeD*QR-ZfDxA=O(%Iwcd%t%yM<{&Z5xotTADVkM`CZl+G{3@t?-0isU<bB<4Cl
zq79+B-S;UAI+oNdy_JfmtKvXtA)p9}Tm^=|rg)zJTO;F@Ov@$8ZYjGCnLh+3<fzQU
z6=lwTWq~PoH-gqu=I0bxL;?@@{puM*#-^&G$<Ie$LNcGA7m<*}OrL#<u|hJj<r(vV
zhxslwgbB#1x6Dd~0<tbSi)~&mN$BgzG5Zw9B{8Rm0tL;zQu#ZZF{?De^-a>uaXgJ?
zA8v)KiK3|*)0AxW5W>;NM*1dGVg;39^NqY?xwIDbeR93XgqW3$G9=BOCw^ZK{-oF8
zZpE=D1y1No*T>b-%niA+nBd;QeUu7+y>J<?(wOs4lc`cXv#fs%g*0#&-%&Xi_*6xw
zH}R>B5x2fXddhoY>L+t-jWS?}e&d=W%@Ls5w=`kcNrcv!Tr2cJCCOgcHfj$!T&<pC
zA|pN+k0<4KY&Moegq>lS{iXqNoqclRE@H@Vmn6Sn<CD#q9^8$D#etaNo>H4sWKFft
zNz8nAgD9KDIYI@Kuvb}>2itq=8KlW&qASZasxL)rBvNOMqOK*sYfyl$9vvsr>KJL!
zT6RC?eNxrpUk~QLih>yy$EURJ@h|6r-Tb8n9V@e=KDO^sk^|=YSmkH<Mi#h@DfI<_
z%5fycZhW_C5uYO1`C#F+xs%01RZW`T^^gU7Q)?)tqBLEyMcHJ^I<~LNaLbHG__^^Y
zVG!j-Ol8=s?P6YxK8l1$Ny*1Qwlky|mfT~0ueA?A|1h{U8(gXEh;&r8B~8X~p$U+9
zkTvb?Wcw=XOu`@L)G#Z*FA}BKMa{qAmiz|7=0mP=dxk7;J&XP><o_j+v-q4zffwd7
za11B?HrFCz8y1@A!EnF>MpGUvn`q820FD5u59ig80WK4aL59Ky|2=}OwlQ@ud~9OH
z=dO#7(GN!X8h+Ta!W_S_AEiRvnU=u@o%tU~`9{mw5}_-dSS;+V5105P>xf;}krJdn
zSF!=>6J5aVbI6h_W)6ANwI(85kR}W!Iq@-Wgv`90*ul_C!4DM^I)o`fM05p~n)yBq
z*vTsTTTZ%l7TN9sr>{)-UrE_6{!K-y8cq8~<`c)0Dc2xs4R8m0$c8u%Wt_}-mU~CB
zXI5Tv?5p`tn;s*}SPW>LWpit}NybUzc%>*LdJ{wjRMcH^^9|T>37i1gd6+Y<ZPYPi
z8Vq5hw8=V0ht+L&S9C(S5?Tjh)s@k-VYpcLqZh>m!7LA>-=3Hv%q>k+Fev~blme{b
z1!Y)_F2|a3W(M|JXkJ#Srt{30kM(z=+;3DH0EiB>p932zt~KC;E(#pg`6zh@IS>$<
zl|JmrN^SbT!lLbUAx6scY(H+da_YYA*OQ;?chz`AJ|*9O7K+J9V19e~ZuS7tqg*=N
zo0n>KD%%<SL;i{DfR0+}x?sm$f&wPp|Jh8=|E&zqEeKk$I4^f_%vRJ$5K9^1aM!pv
z+e8xcOW9F&Sw<h(nknn|Ws<gGZNfYLBDhjn_U=slQwBP1x7=b+eb(KaHq5PR<M}!6
z7-i4u7?Gz+Wv@agD2l#DqL#&-WSQB7;v^;8oZM+gDdd~=o$W7@##?78n{GLzd9D$%
zo-v;Wl{kB-m^9$;M_XMWuL~oi*M-r>z>Tv((LFU3{Z$#MNB@wy&!9CjIu)-1N5Y5#
zfeeVOFi_dasXXF*{8$%6t!1;o2r#k^6W@PBEg>Y@=|6)JGf#LP_9*YcP-3gifYcej
zwAe^`M8k!(u{a{!7m(^wqZ+<<ZK(|Pu?;sA!&aDz13}-qD*HjMn+05%2{E)uTte#f
z9Wf4vF-^b=TGB#ZuQd@rKu(s}vN@nj2I}t>)#rSmQId!kcz$F&t!WqKKbR$>vs7Z5
z^g@>k^|meB8_B>?pI+0*sN;?K%pt?P@dfYK>n`~prQ90%XWe4DiFrjc0FfbRlsO1X
z9IqR8H=q?r5N2BlRYc5_Nv$x)CxNMsPH0~s&2^;!nlmXVb~?UuyNU?9FcPKq<xkGQ
zaeIgO!M8a=A*<V)pg6_0*b*tCvN#Y1rB0<Q(HLLR$)rd3r{H)E0U~X@Rk`a#cyjQW
zLMn}?bCt_uHzASAgS$nJ%z-h)2j7BtLt{<TkSGviCimGsH<$j6WYq@6JAR@xjFl^I
zPXguwsSij7O~H;pf4h@1hA;tnz2YW6VVkZ0e`fZv({%V#b<=r7e0cganc5Vg5lOCn
zVoDxf`laK%;0jgG_W48>KWP&$CjwR74gn9Kpgq;8m87I$Oq!I6*l!vewis$=)<*g+
z;Z}6Q+5Cg#10hONxd#5Iftw|sK9mP2{nYVQ<~MAOCekTG5CGanwFe1O+B|dtoQ;fS
z-L^puC{>vtz(|AB9|<s}CH4a|HeE5)HbPTIFM)w<t<j4MZu!|IZXwh+cN}A9ivLnm
z3Eif5)tpO8Dxquje-_}is|mNFh6Cbip|sxTgHnC}#N&z_K4lF{2RSZA;?OPYoliiT
z^~k;`^JkR0@vpy^9P6H0*sb`CZetS$%Z;~L+WoN)>SxL6a$Bc$JJd0GI2K2C+I^8|
zcp}yeo&*oYx~=&5w(KzB(P4PcTuiGEsv#PC3xN<(na(?1K57pKF0p&93DiM}7f8^T
z5+QUG$tv3Jl>!7OKFYe&dzu{0Y=JX%V~Q9F^qE$;$VvZIPJx!=j6d&Y7XFvPF6}cF
zYUZOyTbxh%eU-+Kcz<jq9HE`!{@??BJByVa2Gj2@>B{P}YH+vpp~QUg@p=_OlDBW1
zaDaTk&z5H3Dc+<0y-p;S5L~+k!`J-<EukbB2QX+N`MJ?6tY1FfO%Swwy`Xvmb(1Tk
zlCX;S+0>Bo@e7rg!%$(w@P5UGTiC$cC0;7k{Ld1R>wSk`-lIu!R-O1`>3+)+!gmz#
zPS<)cm`<vq+;ZXx`<XGnF@|dr_wjFZ`M&VaYm5xYu3tOsmkpUB5rrt@)z*TA(oRj#
zZ}{=PI}$@JIcF#;RoJmfAr~68)5etsUHxP=?#3NQa0a+U`PdKuX6GUgSAz@XH~Bi#
z$C<*z&1S((G+W?k(H2SU9&3c(^}J0@`L^e*u*retRNvB+sQga*F<^hk<$TIubgD1A
zYV6yD6c!zDDLy!|zex>%UM;e_@95x~s*}0X#o;x%=2^ndaw@>$g&sIQ_6bj3-h`tP
zk!5LTjgZ_?T4VT2KNd;(M=TVgSIhrz>GDs{3>!XG1vga|dKULBg(nQbK+A-)aI2b8
zbGlbGRes^F&kLoz0b+SXceP{z-vXxdi{B8zZ38orP!_Qfnj7Ds$7m5jHVck<_KF%c
zuX07k4%M6Hy16_YyeM1tVid3eq9`@9bR7{faAY{H4lB>hMw{wBLyLc|Rao(N*#K}P
zA=dK^H|I{fFYI&o)NOfdRZ8pSw4n^<*n|4cv8J86h*w#+<FGDHIazQ6nK73<+F*6E
zFW@MUu%xp49k)z|2M4C^SO%itfTsAh*((uwzY>uPIG|m-nV5iZOn`}|HKNWK`WROK
zg}bA9#`;IP&C((zuyy$;Rm4qZM@npZhsfAo4Sn2B1cwzt5QB6rV#ayNFe{0)oePL+
zL*tyBVjE9HXG_71v~faNw;_Oj6c;*1%BTsY04LBEn_Q27nG>U#Ttb&-)Rusm#aBko
z1sq@RxM1ExF)=cq{z9^bDlY9mhqaDVN6KTkS)ku_k1(}m?^L6F<(t7uJZyf0&{<8@
zFJ7U;biRbDIcWM}m9u&4VZa>U?7Igq>*c)ujs@0m&^nU+&Z~Cw`nO&>k6q&Kw?&tB
zm&}~*6i|^tM5n<)T51O*p?vCNsGACNu;rtrsH<WT*$n*&Y~fny-NQjbvy?xe4?{Cl
z@wX_UlOPGi61Nbpr68ToKvWkA%aPVy;M?Otu%M5M;9j*Kw}~<GdpaRHtMHD7T}Nt-
ztigofb;bG;b8vSSF010hg?i$vEiqWkjaQ;EvDh{lvs;>MM^I(g)=ni1<w6xK`B%m1
z=NdBjE^L|b*9nbTry?FEF)2+6cYbxX|F@0x&+8g{_ciHI{in47Z<AoBuqYVd)CC7G
z&>?}SK3_NIaUsNrht11yA=<$2jaLK=*PRg8`~y*xDN1TSMM-uCHGr|tNZuq;&L2(C
zd_cubt%^~5;#-u0nsyw+l?PEb&~DE$m7U5=-{859lIFiGK<}rzZa)yET4KpoevBvb
zs{{8DU4gc0e*$#lJ9gzrbPr~Je&M7x3?LHJr>|qOb_G1|T7u4D-VBgIrJvO;!LD>z
zH%_TgeP2R+K8-yyPk$ZL|9iP@EPY0zmL3iR2*+m}LRaAGkv*DopCb)S*3jxV8=C4Q
zZI5sme51NaU&P%4)ir;dm!-yxQz6V+B9YeYhcUL}xJ5zczTV5UevLMSLX<fE02b8U
z8P<t6h4+J?XB!SsZT*lX=OiM@*$z8V=5mRSQ<7LJdc&04NlBm3(P&Dpf>zDV<BlJX
zr%DBZtbd?ZK1VW<BCjCJsoOVTM>M-g`FuhY$HBn{(GT_FLPM--SrgFlY~QLc5{chL
zp?rPoIPt%kolJB+uDAoFPz0rK^_*UBQfY^TPGAmWt?CPWm`a}{>b3|J?a%SnKTzdU
z#xY@0g#XzWHJ&VZ-`2A|<27SU{ze;~vjZ6Fb6ZwkB8Ef`bBb;KunfRVkqb=$#22+v
z@^6Zi85b#yWrSXu_ou}WJvLLinn*G?nx*5Oa|pb@bCV_Lx@?E9d)#rS?)yeHfvWOJ
zOw+IOl+-GkZMxb9Wy-jk&qi<G{CPhsXPF8dac6K5EKIOu%j9GTrCj)r5&iG+c_Hi8
zn+Zg5hqy8VZrXQaLD0#tZ*|{{@D3kS`3h#QS$Pn#&<AcfN%Y~WVp5@PMMO=F;laAq
zDMEF`KF${uctZ{8<pmc(kJuABw|t&L%!y(C;yJJ*S#Y}MIIxr|fvyOD)UI;!r-*x?
zD7hLkVnJyv^)-Sq7;PWM$LIg3dJDd&x9|O%7`nS*29WOV?vieh?rsothDK`W?naPq
z(4j$6I;D{=K@kCO<ec-pfB%Otulek~*Sgkqy%!vTrGc7{Be9DYWXr}2ncB!~6q)*H
zjMHulSTYc)E7ylA|K%kj`w(o8s(fE{eURrKtj#pb^dRV&?S==Fux8Z44nZ!C9n?~_
zWn1{4TbNOmGd84MErmH_imtdqir%Y<^`iQ!`g5s@0IGvZB(M4$ghD*Dklp{5h49k0
zIZz`#Q8k@TAmfOW)4Q)<&W=8ce56>~fHGQI#CBAhuzlz)7FNC^Y%odsgF~MJNlg(N
z{5}cKO*ScZbE>YM-DA?QC<?aYdwX1`Jp*h^nFvlEhFT?#9K=?lIQ85zj4;AraNb0V
z@}l8^km-WMAmOge5LhK|K(B^{2}^-p)wE)J5DHb+;UqfMNUn^C9|XTYI<?b;zKWAZ
zCTm_)d~WT8>x}dNrtUnJnH(vYLNm)@uI>Fv`NBUt*_>Xm*w}c`tEg#PL{xXsS}+mk
zMcO4%*y`0_f*A}!iwLsH`q91tODGf*6{BL2^=sM_)3un5qDc|aev7z1(2n{TFeo4P
zDtJW6g~4~L25?Z8UmTpP)KZL*=7?ABf9;H$904gEcGyBaVNHLnRJxt(l!Rf1_n_!%
z?L6#F@I$nP^krM<+e&mPHcf%6axV9Idd=8*;y?!ZDD!5cUcdMBmAEI9X@thS#m|L9
z?%x=vUzM2g=h<90V`0H~jGvZV*gcCFLoDF#gi#6%PZ4)21)Y4GAs@-ZmxJ2yLy>4=
z8NWo7nNKRiz|I!3F(fb)GJy`+3JM4m*{#XSyaU@K67$fh!F5>V<LRU!HwOk5Zv3vV
ziX#dfS?&RdYu^EhIj=({W=Rhj9+NKamCRENe+}(K9D<xGv$>9%td&`wBt=`=AIi$A
zs#iY@%%z9HnIIc1)D=CRk83v@$!<6VhyF?;-9YgU?Zv@;zS%DSojWx}6qf0^h7)cj
zCH>Aca*5u`Zmj<vBAJO&r9o7AbSe04<}H_$49GG94P>+hvw}ZclCv0JgS)(HAAYcy
zz8a@0b(mS#UjoVk)Ne{!l<iw`<f4z?xoec<<PqC472icS3ZnvJ>Zeu~82jci38zKE
zn!n=23lpNEo1fW2rDVFs>ec+J!0l)w<!365Q7}d9#xtb($Q++9@3v?v9dQsO)#}D)
z+QsL5e*5XfGP%6nO(-+<dCokx{gX5Ki`A%E!Q;l(z(*y(xgzFG;zbma<BG%r*6W{T
z9a_>`d$MJfU@cQ>%oa1Fjgf82H?f6G%2<Be6*dGN>#%M<_)6(S?8V2K_%nXS!z1g;
zFyNr!X-{?4z^Fbt>{6^Vb-NgEJ<z2$N7Uj7;N5@~Jg8%f?|OU?I4>G|O5{4nFZ|Lr
zmNxmwy$3oHUq$2X(z;1izi-~@LLPtb+eLk3Yz>7d1(Vinp*(gr35#v=6p7;7G|n=o
zFf&*Gzsars7c{<gw)O$#@soOj3IVQ<MZxmFnl-|c@=~Lw{Dbn+D3eIcm*6F*pyH%+
z=(l-FmD57KFKNFKCaOIaea8|a|M-h835oj{Mn0bgPJ`vGlS#pFtwpBEgTKTym2bov
zdQrG}nc;sWM-|i({icXnqXi#|ns`wK>J!rXG|EatKUx2>VlwNuLPu+pRCmY;y7I~R
zK%D1Bsnp^k=q*Hf$8o?6ar;yB{uA|tn>XZoS^<3TTYV+5v-^L<!7v3H4#}aZSEC@(
zd18fGrY+3Gqm_APL5~EkFWfG=6W?f5&-8W4nMkEIqUlMu`})+`YeGjy@mstFg`t+p
z*#SpzSw`?bK(p_`!7V5tZ?yn57I|d59NFxr@$agX4O#l^XjZ(3h|wpq>3n{n6us?T
zvT@zQNW;KVZUlXp@O1qt0H@}f_YW2-JrdOj;vqwP#u&;s-6lbd*t`-j27}D!fzcb>
zD8<|g6RLiZ+*qJjfI&H1Xbltf$;hW3pYIw$;h-1#QFOkD3yeZ%ssAT8?E2I$+yg@&
z6!vK|e(~eZaztMT+j;v+{6dLq4VG|~=JEQ*CB6fIH=g=|s|wB|^9aR&AS>wassY7v
zJt*ZV2xz8JO`Vst#Rjr(xjS+;VIAofY25Rn9du`qB47YP!p}LaNxk2dSoVPL6g6&M
zid=kHpAo6etzJFmd<#$Jcxh#-#uPzmc0!+K1c1p7b1}zf<>II?%z4FW!`ngAK_~=<
zJK(C<7XCHUKZxGb=A=!Fisr6+HLRk3s53S3?O%{=nRQ5*-h3#HU5{htQcd*O@EKsW
z3x4%nz5RDfyMRU!;{X;*gFDd>F>a$VHf?DzLh97ok&%h@Y|82Is1d_>CicBh?Wp;Q
zjhhO{xVKbQLsa-cg$cn;(;8OX*<}l-I8aztm7f1vaGUu@d8!$|AT!FN^(se6S6-x-
z144G4rLn>*Z&j{cmH}|4h($vVU1TQ1izpG&q2@8SwLFCOyh3Gjv?<A&^J!D7rDEqL
zC?+CDL~nkl*tW4G*Bi{`<$<)I&xH)U@q+2@BeXChn2Gfy@a-h}bg!<Xrmu^@jM(JB
z;qzDd*LZ656yDnMVuK^hcb$PVVRisX^-hdEnGj2Dl&!-IQ2BYa#Yf7~--ilqM_4q4
zPDfPUasiZz7|15-?1l1@e0UbEk1~v$31B$!im0CmE_yh2vctGM>9xwjj!BDNS}5cW
zLR~u@8=Wa$JL{6naUR1+ArrjO11MxPN=fYrHdkOkpK|W-mW`z@F+4H@>6(-((P2YZ
zikYGOLxKpIqIZeLH`-B{VYb@i<n(})9sM<hwcF|>rimct*Av_SD(mML)Bz1LbhmBI
z^T<BX8|Qp#u^Ca+$Wi;LL*D~0Tpjy@uf&j58)e)oZC6m{zDZ8*0*8bN-)&*B*O^VQ
z16Z$#Av7PJSgbC$QZucWidPcnlMYvBUS+A6BIPIV@jcarQG-*{#6lphux{w}h~lYJ
z$9!QFc%j8Kr4wplAjK*PZe)z8<g^fMKhJcd=wg>2D!{IV@uyf)Z2L~uoJ{Xd=KpS_
zalkk_k0VEACCUu%+{SuVM?d~A)y)8RX6}e0-LYR|k301!pmBu92bY$_IE{sY>%nLS
zEbJvXM$a5p5pIE>;{Ad+hT7irQ;Rl+I({Zg3|LP=Z*>=K8S8*;JfLhfY>X_p#M#KC
z*ljpXoWo#NoItayg9r^5$l4*?O-3i4ZyG1VO_PH01HxYiYzVpuADhs%)pWrfS;Ur4
zC%9<rs#YhrjlORgoE_2X{}AqCSz~qYqvIQX^ciPi?32dVQTVSBSSc+X2YfAQNt6G_
zMe|;lnj<L=Jl<=&zPHUk*c^t6DbWd1WhTyre1f@TOLpX2F46M7`-)$e=Zu2;Sj)I3
zP&R^yR-?r9@IC82Dakoo1}kN?6o4s?=nN^xFM4ZK_T%(h^!Bage5KsD?{Yt(_e?Ch
z8<$zC2=#K3{i{V;(Qm?SuIA950%q%=`E*&nhHcFsmU4s&zE)QB6-<I>Vb^&%K8WtP
zFkQiL!30L6`?;*e91H?JO2m%bO2Y5N7YbaU9|Nuyc<r3^kpynN)#B^xAAjd#Wnv1H
zo*n*|x78_Qr+k^AT)-qnJTR<&ujsr_E2t01M%6j6<d0P!)Q6D>rVpeY8<%QxJQ7u7
zKpRfS2~<Gv-uMJ~P8qM?bcWU9y?MujV9*U7GF3g;n%hVJ$R-?^gjs)5j`%0xLBO#+
zy(7n%A&Hs-;)Qquyh_w6q+F{TyQaw7kbP}-S8fcSO@2FG+X24lElc?&*p;pdQ2P<G
zdpvZpuc@6E2W2L07YSR$q8e54K16WY8#QKBcGZ#_bI$k)@85PMEh2~*<tO96X;`sL
zsZ;rk-1whKs2zxvxDAIU4fsg;F<>`&oF2hq*0rW!u^)T?3XwuGn#*sE+6dKk*iqAR
zj!X?^N+m_nXunL?JHC}g)sgDf8zmGya}IuC91WGzBQ&>gqxXc{K}ub2hhbycs;g5A
zkR2-o5Jm4r&<82O$4}%VjOG#7+E{$VIf>+0$y_hx8Ij9q^5gbbIP4&z!RY^*sTsSZ
z6er8uU;^kU`6VssnOI4jhn7@`G-||7;G9ytbIqT<R^(F&zo-o1uteLL=24DEQlKK|
z^UWOI4>e(Y{uo34ORV@5m1Ir#`FaEWVgTMbp%X0`1klM4>j*NxC#MMLyCn_xm~w))
z1-5z@(`SE?IM<U#<W@JEmL`{3Wl1SZ7>VNxzg|IjVP3&B9bu(f)P<pV`be!8akPDa
z%K@ONiiNEJJO_hXfNXxbg<2K{Qi?v($qs43lD;7$9HVXy0$k!gH)p6uzf|ZAk{gy%
z<x1?^D#_65DVbm*L{f%6Y7;$e@!ib?@6lJ$?}Cha*{e}VC!>2t^)%6P)V5}P{$D*b
z;)LFkZ*oUEfxwD79CAZg$0xr=7P^L8(37uY@i~{%7xETnlpm0OJ>#fj%dUV?dr9dK
z(GyldWyz*{{GS#u0FBdiWjyS+PvR8{YobwPL{h~I<r<rlhl%L%eb0u}D6jQ`aB-mZ
z%<*9NB<7gRN+VI|A_8hLZ`f^kuco1J@Xnk^Y0;e;tYE*)37>1$LQ>F{ATXck4^9Mp
z*@2d^t|EMg{3V;43PN_yBz#4OR4xg5XR3P@?D@s{Zx;83N5JjM6J;5U<-JcmyQ>lW
z9R<A|Ne3whc+C_6hz+*i(V;C^o8Vjij3>&v3=vARm7>9BDUYj+6u>+8C%|{s6<X0`
z8GxEilj#qg)z^o&jc>}yvVSlq2Wh=AUXBlAkyj=JA@l)r#;3f`VEj9udq(zfww*Zy
zkTdgl$4I$Bpco-3yvNJl*Wr`NNn<DO{BoTOe2vQ*gNHe1@fl|$eUW}&u4jx7>MuF!
zX{TMSPeN664Xyqy2L7SGBofQL$Fj7w84%vGkS?P+|IQbV-dU{HQ9jL4EZ<9xGzK3@
zX9kqEm)^}q350ipC;?MBc9$c2y0nGIWXN++@Jc8<pk}A?UwU8pyY(S_WW7<XQJL}#
zHM7~I2uLO|VC@DZ8?5_;8*mIm%_PaR2~l5zihe^}2jnj-Hgvu38fN#yC)zwHAwO?P
zKmT+o`!3@@mdi)|`Q^!KLV>yw3J)nT@>=_=Iq!^gHK;V7!Th)7`eNR5BCYGm#L4??
z;_MK(NdD2W8UJGwdP#=EVvs~O(e;b|<<y9$tj%k;H@?~w{dWOpVj!IFpDm%U--t@b
z!l75E=wV;U{3+8606hGHJ9Fp(m2`ZT`<N}1#4JoVOZt)qNyjBSi^*{7LlFNG>g9sV
zuW8!O&b31&zta^ka=0U}7jA_X3+?IG$+$FU*K$xigv`-Ro4Y|_GqADWxE(HdNdJ&r
zug~QSTZP4pDZAEqjM-ie>rH%D+LtBijVdI5No@j<f&UO<vP8CXumwJi;ksexGfAi}
z&tT!o;%_!+3}EW;YEUc^><;ir*_o3~$8GwkPT*w1POKJIQCA_{K$^IZ8{FBBg*v;r
zfS=OLh&zxD>mO-bQ}HG%Xc(MhAk#@jZBKSEja=)dc19#HV`$N+&b~Rnpmj3L&j>&U
zSh?frwrOORHo#g@Pv-W_t8fCCfAZPW@EBuv3Ba-GNXLoUGB<(5<lN;r445S)ABtl{
zkvaDTDE;{OcjFVFdepVy3EZ@Gq#`8<;NKm3OS?UwFoRP1=7vU1_Q?Zd=Yt{3;g>|%
zNq;7`R|4yw8|<e``<edMe2>t`@P!Oa$0PL97|hW`8(((uf>)E0VGE`|xgtD6bgIsm
z+0Hcz@as067PML+41iz5oA^|`)<2q5uGS0kQjYeT<LM|bAmq)FMr?~><r25iV<_x%
zE*K@f%7I%0v;^8P5i~hdhHhOAyam$7j&Nr~;-JSkeaHC4y!nY;K_YYN+H>254CcRP
zZ#T&C`O<qlK4^F}8ed~pQFPBa$^6C@9j=1p$OGgD9tvf_!c4mZ_Wr$}coPypSYg~K
zk>#6TQF03L8nb!-RTKXObVOjxBAx)GUHD)#ibsw2<Z2}_{N8PVwy;A<60+?Q1@$KC
z*?H}Gc#<4gF4(*P>9_lBKUwsr863logpgVrZ!bp3PcVFLbukxp_srOj_oq}fKzE~x
z<#+1QbNLpT)FtB=Na;6ofTdS_u6=yN#9Lk`!4t>GO*9&G?mxy&<-|+H(#qFA%9{<w
zrA!u+EITaTNtE1`fFzx4Qt&kf#kF@hh$_Xfnp1Q>K@Eo{bK)Dg0}<n@UvSzUuf3y_
zA+kV)x*;4@{Qb9{SbhI~i>f0>=ob?e#yCB*3yusJEH0%vRS{|<H>4<78CmzkrkKzv
zclPX!c~R@nN6L1>2)U#Cm~iB9iAt%Z-!+Lq_l-i(*zk9y5u_xgt;N20*8`lGX|tr{
zk(!k=R|qUIthcz4-yD7O4*eLiCeNf4(J0l|AzIni7$;brrA9thoWm7xgdzyd?)q6A
zy#6QBT%W?H$!;5H!X~9*Qm1%K`kB~)e)ETho28?xQLA<N&rj(8LZ1$xII#8HtR7Q+
z{-;+K9>ny1yYV1k$y*}@D+7fm&IEb!87`q@3j%C_m_UzIK*53I^>@^AI&^CX39-K2
ztQeuCSeZBe_*|t-^vyOUxdJ9L#NIQ#a}=0FyO}n*<SzS|Qtykbbig4F)zB4e%H0UW
zqQ|BH)5o{x7s@Ue(;Z0-5%5j!kwl$ydIDK5@w2NIM98?5s*eTgUHcSLWdmBt5osGE
z*G&ZjAKalg=&pDs6+z1(*2YS4GRTxO)f@kh>$6F|J}Q&H=Ycbk-4V?t5vB3s%L_`(
z!C^GPQH2^XE5_nEW28t;QEw@N^ntF289jLddd4>nv|m%ePD}*1Oj35sIZdvh29Er&
zuSa+_{d1x}U1gAYz7XJi<?je@tUT-V5Q;zbXx2%=T}c+8!-hG;L{yQ5Y*(JwmP(b+
zjAOC-*aDNQgqE9uZ;4{D<pRGl25r7$1yp9=mR;}@700ZUoZVpfA*MJ{&<|;czz)`k
zt>0}1R;hgm0gD#u$~-HE|K++9)3^2PK2ykf2}~TFezpBDJ|}`WqW%E|Uuh14W0IQ8
zFsnDlw`(V1C}ZA_#m=^VR4RCAPsQNPTD4eBeM|=b)ezsIINMwLQ>;+!!Urk_sZG>H
zV?9`GB(J{2oZ)=a`mgdn?CO?6HXTwBm!|n1mfYEO4Wg))8+ms}!X@cj-C<;_o>$y3
zC_+D6Y#kPZ=4U9tU*vMDA)gJN$)yEIaN+@cNsCOxH7V5N(nm<F%5Ia@aqr#o#)1+5
zzPSbv#zx8tD4r(u1OF?L{L_qn>5J0v+YNpc|1)7vBPX4pZb<Ik#5kr%a?1xV79eFN
zU{k~`4e~_TcZOq`xs?~6B~Z{B#?FG9Vp^g%8EaIq`o?FT_3`A!KNN^S?SPA{DEk`q
zt41<e2Qg1homkY;C2jp9o-tgv`l{ZPa%;HXgjTeiL|0695gyk^#Hf(TelN_;{IwoJ
ziSN?KJ*`;sMn#rZbV4IBXF8;;Sjl)E&G{*jjGf=0o?<C@UIl(E=(BPbsZXV3N=cZ(
z%d5w<V36SHID|S&QUx9PEaKTjP4X0O8U9PUFeimi$aKF`3A3T?-+Urlths=0H5Wh<
zvDb0L)=UbSK7)>_NGfr*fB2T<z6$~Qr3dY#Md}d~jG(%%c36OLVPoL2T5&zOX5~?Y
zL5#LGzU;}AcOv=;)fq7T<Uy$W5Mzq=XIW|yg@S7hp+}>obppe8^la~P3v}#k9e3ND
zdT&AaklQT@bNfFU-3o=$9UG1U8IHp9C=}roDItBWYuz12eKy#TVwWl%L#{IiPseE;
zH(;wZJ$niKg(!v9w5Yc3ZVP4T^B?x#oPnC%W13uiS&m~#aRSOzb<$Ssc^hs|rZ6rX
z0Rr*06%}KfxVtUJAVo2~E2XUh<<_;*b!S>@`3wrUWUEMZb(6lzmrUkDSBg%*;v%3i
zGW3$KJ)v_bjsR%-1!#D%-B0RM3Zo3y73Xr*%mz=0#b|sb@?ux*07b@Ul(%LM=Dg48
z2Ccx;C%h)na&X_xEIsEFqU(iyd^@Djc)ncS@Jn<U48dU$*<QjKsEQ6&#3~%b)*cIb
z?!EuX68=pRN9%?j8`2NO@2kjO$r#2k7OdaEC;9G~Xe=>Zh{mLo;o;IiH&7_7j|@>G
zTuRs=rqePlxLT{0+9s6tC3I5exa~|B)s-6MY4krBE42sLj)>*Fg9~ehfS64(+vSNe
zCdTn-DZ51@l0>u$WbZS@iGld!X4Xhzav2UA3w=^spvs*0=O(k$-Pq!U{45;VnU$Z(
zedOr>kg7Q*)n{<0C$9CR0-pNVG7jd!*}qrX|BwhfFZ@4p5b%UsFyu5HM<I#LhGX|F
z4y@mNuM6o)d#H3;wmV=(2;xR^mjW8a7zJP4Cc!90c;zg3oL<GA;oIbTC|y(S_0cGW
zI)Ih*R5TesX%oGFr33+v36xANOwC3G)DnTz${=<RGNf-4K&G%bsW>6rX|nN=>kLZr
z%<{zwq;H5{0w(q1EZnDA$M+0}%&!(Q`JL$eTgca%%{E09%0=I4*LtqKmg#n*T0pTX
zz-H#+6bJG`__qDvpQqTa&n`nwN}P;=HY$RtVSF%^d1B_`VH_Z*uiUHG7^xRY5+8_e
z*;9#uHQ&IjesNiD8(92??n5J}BghSgYC4BZp9qv!C#Vr@48g8*1s+kAqG>Y8?C|^v
z64|gm^Ff+sBRf>Y_krayLsFw_eH3QYZ7s*&=rC*1JQSW3TB!y_*QCQu`ifD_Lo9Qn
z={;g6m?u=YL$eedVMPf*3pi0%xQ5=oLup1|)d+sac0t{3*gmO`Q_c{kAdAY+@W@r+
zOzrjOLgw&kc<|S~()1z&fDq5fOoQ3<%j|Mz%l0llr5;eAwhw}1!)DcSGf#8=h4M2o
z(*{T+sBrF2%#-K*CHEe=3#c3S007)&rYxvuzq9=o`ODuamdQSIh43*!rWg(zzd2qx
zxha2xk7@QQ8(MAyC;jGN(<+=!)phXZ^}Q$DRt0YxVibMh{erJyH<+mptwqQtw?Yxd
zN{r3m!`416D^Ji?WHv&@-S+lt(vPDy-q~=06^nUGlQB&UJL>l<2HW4#CzMxW$|4Hq
z{2X>Eb9<>6O0AyH%F&ZfW%`TesiYZA71cnNnFg@bRrq4|a4Pitel3mGmJJwz!06LH
zM?^bgj4{(4vA8X)ymgU@;FId677q6+dO+Qg$mKBcDSQMPnNj#A1G5(<kUX&BhK?jl
z%#GOh(BWV-zwm2XQqF!65i!ZbK%nbJ=H@=e67o^v5H3dP6*rWmHCvqFCG5!FJyI72
zrCXHkVhV4!t|l4_3ZCin5+nFNnj|c*2Tl_{oq`WIvsNU8({eCNvLEW!p&ZB)C(?{!
zE_3e#UMO<myUrd|i*^!(yZ+-4{i}oOKRMnUl*2eYh9;Uta0R{q@H{@+=$2}QdzECQ
zT-UHANQVwJ3zxDrzmJ5jUXY3!u1no!CndFisp(imHQeoM4NvS57u3r0VJ2XnK~>9X
zL3_-FI0l*lA=*3?iM0>`m0o?5Gzw<=-&x~A>>og<R#N6V6DW0kBz1XQ$<tn#%W@v7
zHHbdR?0r88Z|F`3(+HHQVQ*r>Viv6zNt)Xe*P)-eLDmxI_K(U~xGg)CD~X;tHl03d
z?XW*wnaAninCD3G-^9`AU-n?eE-q|ft8JY&0QpB4GN*E6OO@KL{?t#WI;;P*fSc{}
zARwAZ!^Fq(mu^HN!{Tkye_FBT0$WKEY0X$&@v6hKa>JSve_NWQep#uMxVq+Rj%53M
zAdG|G#Z%i5<W&CFOnv546o?c!sxlF78m{S5loTI%=r3D{7e8C+&S=>mV8fz79?I{f
zA518Lz-SVgpJ{|?k`g|XM#!SYzf=NFG;S&WZL}!IN{U>`EY)Zrf-9PBWm)PT+x&t*
z_xU{iMF~8Iz>oq&Vq8}34iaj+9er!Q%`1YEh}e=N2{X5WwXH!mc_)L)$*8=g<`>yI
zD45^~%wn{?{`bD!EK1+@rBNKK`FU7r*-X9_!5XgpMDHTxe_i0>B-PNX)9c^~f(g&O
z|J2cg-@rYvM8;x5op?@^NG-HwvAxA_31xAO(nzh~?j08ezQ|gZ#muB>Fe9|zjC;yL
zwkVk}agoFBc}l&eLu?@WZN+YO(-t37dGhuS7|v18p3Aij;r}QC>7mv&KY1k@8XU<B
z)OvPbTCGUo_rteetvD;+I@|^WYb_6{#%DhiKth5)!wUi3mZpH2enFox)RSooQQ)+S
zGFkL;a9_H|f$if=>L1myq@8nv<bsFN;Nbh^_;+2tcRJKwMnz`TL`)zT^uI9()nzsL
zj!SY=+*;%|TKTCmzkz~mCff1_W7B$$GEW;_HMB8pJNz!2wt|?vxW=*Ee4M632Jt(s
zqGRR~-5g5I;W7$oAKu$xSN3`cszTNO(|>m2Dwdlc*!N*7sV?<?%}xBxW6dyIZ3-V|
zr@LKqZZn>wwa2<E>JO#`$spK>ENUVAnXx=7X0H-ZaFc}SMTEDEd-E+Z!LpJSDU732
z!%$y_slcTRS#9-^&K6WqU~a!xvn<DbLoA&DFtP_0D{GNL+;m^iXRxYxZdO42tWgrs
zZUts!RUgteY-ST^4-8*`TIKCr?}mFKp=XF33c%0`FUSl}Y2-K?+SZb#9OS3mtWiUp
zji11l1<GpJ8^f^e-A`zzbPi}rUk?$HkDtq#zx*zPCw^B+#Dc+C1*MxaF5>RX>y+Xo
z@h{kD-lt@_=gsDQv9W5(9bAcrAxa|g*VtpH4sZ52VQUspauBGU4-0crk#-%`k`#|A
z?~J#t0!|yV22(eaW}-EnORR#V4(WlmrvxwKwacGm2){*tWPbozFrvPzFW)T9tf9ox
zhTNSaA9a|lj4Kj<>J!<n6Q3g2N{(B%KPC)q2cEpgGtqy_Qow-5k&%)Arg`8c<5ocu
z@i7qwnwWW;LwsJ8GR8hlX*mn;$2qNPjw6Jfp>4cz3J8_z=G8NL{T~Ps`;(X7z+v^S
z@lgYc>mRY4@-5<#njW3_2*HgPBAhv993jx|jwH;$OAJ6WZQZ2T*9UJ?a4YaYZN#Ge
zr}~h-X&lMkHGH7(_(uDpDP<myKFae&eaw#V#EM2^W+7U&NE3A&ngT8CJ;HC3B1Yx$
zH5Aw3`Yq}ucNCLU-|XEw%sJ9GZo_Cj@-N?vQ1#4$vYN4keYUSsRbdT2v^xaI#osdF
zMBY(TSHI}uR<8NUJl)=%;;S=9z$yEq)5XQ4>CExD2NL}Y?0Rxd1TRm~-eze_F0zKW
zlq+x%b1&VpH*N!XN%^cPoPU|layY}um)MF#k5(do!VKZ%)^oyc=6zV<<5%>=``yFK
zDGFZU3DI`T?O`fo-Ar_Ok!tQBw3L(`TP@6n7s}2^hCz^Hwz&VpP@1#H5|?cC6)4a+
zi)>yIp|Y3BltSc|yIZ5Ht$LDD|J|<)YG3TdDtAmq1f4JDMoml9KE%PPJGMRxP4D&D
z1!Z_E;8TY!BKYtyv1+bmpJl}V@FG(g&HMyt%E}z+vNptUR>>5%7g{8-h-V%T2m!2i
z=^C#Lz&#_#g{}`&`b?G=b#{-4RLrJQl$qn}n3by}<hY5N*a2uRumNA+qRECds|W{s
zvv)e^bGfU6^@C+_GUdN_4ZW3!^Z+J-?_?QPw4^w1EM!FNV;4C;aph|Vo=n>CLFT3F
zEf+q65UPmM)HI?rEaFP5aAg^dyFQqA&K_PTF0Cc|C+k5Kka=AScpXQ-2Gu;@208!c
zjGO2BUs2G(JXA_(H%=IP89nh5Z{_rDmeV~$TrbD%Q<xMJl0?Omf`O9LBYLl;*;YuU
zDUrT$Stg&<o9pWo-C2%Ktg~-k-lQZOGb0!osK!!Ozp#*{QtJb=9OY_)9OBhi7hL^J
z@<X5o*?sXoi+Ba@a!)%~4jGMdBW^xfr=N|zv8CH}QfN>z-cvmHzNFW-Zmf{E&&p>;
zKf(Ip#ce%p#jEhxbZW|!WSJ~a;@Lqr6_)ZF+4`r2<iAS^{zW7m^0X_%$9HNaUa8zU
z%h`)%X{ecZ$&h$niMiq;jazt5ep?C0-n!=PH<D<cAP}hXLM{x`C*~dBykO?SO70Y6
zd`~6!hs(whUmD~ywvD;rr?hkO&>;h6_}zpz%~0|f=Bp)G%ZFMb#f^c9r--M#5UqnN
zfCIHHFLU%_M)7>TTlNuQXPLNy7?TLD(nOsctl(+l^Gf}j<a=n$8}80Gr%e&7TTTqp
z^CUG#Zq}()qEhB>-Ns2dKIH6&$dkzEpy!9hytgKJc)riPp7TfsPi`DkS-5RL?Gp9!
zO=?De&UpP-pgcSkQ^(E%Z3nO*SX0>`vy))NVw}FFn1L&4tsoS7v}QsvZjCB+puM;7
zb$ACSUeh*61ZEi~P|ti@&&VGcFn{OSkX0rAVSsOW3b)LwI^R@?jJzkJ2lIxviHgzQ
zww2oXcT5LsI7|ONwn}KYUcB?G_tWt}&YvfH^tkT^k}zg>vE$a_9}lsKnL;~Iitm@-
zchjX9m1&zrNA6Q`k;D)U`Y^Q6W4+X;$jP(cASvgyNltC~S5$lAD*Ro5F;Fg%5al}B
z=%hjSh{pnx!OW504-=^;&BwXlWH9Kkb2sBrAI;xd*fS^C)RykkI^K`Tl9Q{ONJiyf
zs^&%K&SkRg#6MoJxZcYas6@c$OkNu~L23fBLcV+xD-1W>N!fSX?wX!#pa$g#prBqg
z{2Y+-c(WuO!02N>(Awc$MB}`Eo$$uZ^hj*un?7*|(CTm;?YD;`8r|FBC<sNQYOWSy
zcNk2AL3{cWe61Kt2Xnf)44Su!Mf`s0sc{n>A)Eyx@VR9Bi;He};txc{&Q6hGzNt`5
zf!d>u!+%t;N$tS@);=cDoxToXhO)DxB1aCb<UXZtq#hf!=}mb$jNyqjn6eDvhiCM;
z!;E_kk$-e?^hIq7mY{Ef=(GrUMxm->9iaDgMag^p@)8}tkc`9QnezPBLO-=6+Bw`<
zkT+(vfel^A8!y)Morv-6ITf;-%(~Nq7#-&L_fzTPOC$S52BVFG8gd+Sj-7-KrH5aB
zs-)T3bZQ6cSU|cbDHmHVlJ3~6SX8L59CWO;Nc#3o=VqR}h3%(q;ja#Fk3nq}z^zEe
zq2A4ELCOv;rxQzJco$p?<diuw^0?1mLmb;<n0GfHc0fc*+T5XR0Ey(4!}Eg)5k^&D
zp2$iGm<vkT^eJ@^Tk;r+!dQE^W-o31foUY<-Wr+H!Y3MY9uJf|OX-x4K-4qFg~-Gq
z(`B+=L^Q5#DF}bfiQ$4|jJ}{mB&Sc5&D-Jy*q1NnUaZ;BYD4OSkA*+m>H5&Rm?t}o
z<nTq@E;Z%s+m~lkQ~{B)L|T`I*ayJ3L;GfpS<g1T4blIR{%Of@CkP`G>;-7*RPHcZ
z!?`-d<hhdnTr$<+u(sPoQy%dYEtN~7K;3usSK|ni{M?KT+ZNN+(z$k9najq9VI-FV
zK8t1^yQ@a$4CN(;t%b|EyH3ZEQeFr=Ow(I6?x~7o2f{5Wa%Phgw5C1p%ziJ#fqqMp
z(HpXwZG4C%W|h-F3?0r=rK#W|smAEU%^nainGh9K7K}Gu+-@hi+lhchtd41%4XQa)
z`j|Zb7eoI#3@TLn2xtcB<(2nIr}(o7m%A4x$VwX0fq1>iz3W(N0oh1+gQmI2-JuLx
ztRnIQShSt5wJ_;Gx%Yg%y18@EvK(++gV_hYkZqHan&$E{4?ddr#+J6oTk$-32uFSz
zjFNB_eltuQSS~z8dZ}S#Z#CbC`DKsr%oStIPg_;11}2C%DNe&!UGe*rYo(<s8XYg>
zhR@bm*h_xl&P{oat{R^Rc%0uW@%J(}p7~t$`5v~;o8UXo!81zyTzF0*$39K1y#G$E
zIKmn6+X0K{yoe7MuL8*%8ooZjXJZGbF-f;)$1QXD8}IQTxR3^~Ulp$;DR5yZjpLRo
z^sWF^UZ{M4zUGi6yo<f0htsG{#o#WknnCYV__Yafh|^?s@glajHK>SW>OXCbD#12O
zNZM}Q)Ro@#TQ=tK$ox$*dz<V(ADyMPZ6__-iT9~Wwrb18-J&6C)LsE$H~QrPTvY4G
zG~~!-{g!Bqi$zk~LHU4oZfT^yzE1B)L1$_fTB%1~cJ<$DjPogD@y|6TRKUS`SMNuN
z%E6_&_N%A6I%xWP#}oji144&O*~J<9n&~C5qu|mJIa8>S2BNjwi`b+k2Bg?G+$F$_
z$`EQ`N+x1w!W`<TN{%qHv+@PMYPMd@S_d?rg$|zVXf7Ww3Y#|9Uobje>_+OMC5h2l
zU!><>;c8K!&k_X35;hh_bc`D`*Us9}+G;dU7<;fO5?J2!9)zy3VEEhCTllay(d&JW
zU$J5bpaPVFK5SufYaeveY?=ku+SiXN8Q><U<@s=ACg}u45R<o^j@K+Te`tFApPsA#
zWG?!WT$q*Q<hM&)`am!=0$*Z_kE^h9nmP$IkXjy~xB@kW!MK$RlDNp@^84E+Nbh4S
zT_RW*RL=+-8vvcFDS@};+I;am2X3KipQVoUg#4nWWuym4_Kka9h2e@4L?qFonfTf1
z=tnx<G>nv)d}tm3T8X`x^12;EKE7dsp`Os&=-8-<OmxJ-<qZg|FGGspq>@#pN>P|{
zRG!T2lN*#I-}DsBC``+w(g0~-1uQ#Ap)uFYr%iBE+n#Kt$H3JU9cId>=bO6rzvh~F
zlO*g4%}t+J39lg7rH8gQPJbi#kyMZ|)(zBjkmi~4?mqB9Gg>yX5d(lW%knxCVH%!W
z?nkp|Kbo1LZ1V14^#YC$ob?8ZuWxZ{_>blQ#!DVf7KX`eeg*?C4h|@SCe*_9sPGSX
zZaH?7dcQRD<HQ&XYDQf6fRIo|mViH3z8N~5QqQQ}qJ=?Zl$!oT_L9qobj*@38+(L>
zZK7jnP)9+)%3*@Xt;>n%hhU`5{^kN5aiNqKBcw0$p5?>84pCy7PkH}o0ndPc6Uwm%
zL|_bI92d&#Uy^3vQdNi6v{OP%h|A39DXPXGE9}x6{}K9{3s%c+C+{mk&2&}OhI<al
z_g3F0q=}fAnzus#r0DAr)EZAPY!{4H-fN3wH7Cu>QDNVW9!J|E>|dWF^Y8#5IGFlQ
zfHNoS05fjIn<j)~E^3D2!xkP|wIc-s&5~rc>Sc_ps@za?X6K2u)P`d(>)+VoV{Mu+
z9w#lsB6YJZ%9oC=+;8rdOa7|}{=wbM4JkEupvMpJ*LakGvoF6PF(gxDD@K;8Ygb+%
z)DeVWRiRbnJJ-EKm0+-8rx2{48HrK~77PAf*lUv@M0eV0(@CNCg}kmWu!eNvOB*zT
z6n5J7!(?cI8Krk_vq<l#k6IR`@>gWY9K6^VwdQwr9giyYpi7iy^;(LWh0iNzUbKMM
zs_$H8M1WUU<0Rs{NS#}~yXcgt4&1g?EB^PPu;$tfvcl)%|Lm0hi|A4FO1rtInl!n>
zI}7SbApQfihZDoHyWM$vJE-LC0Mj7g>4=WTeyha_rsgvH99P>C?Nj}7D6ohfCR7r*
zNHjahnirS~ukM1Z={YM0V+JcZ<7Jp+Y}O8WDa8rducEpfwTT82x6|Ae7o~FMNs&?d
zGIyh%q7Ftsz-=LZc8tQ-_U+s^dtD`qI4#0{W4qT=ClGmB+fEi<C~67XK8&I=9uux_
zSt|UPgq7o~RB`aiNgdPZxqbQDg0b{ue4e!>h;@yfVDt<OOHuBimRETDA}AF7&dPGz
z^tco<@^+@Wa3Zxk(oajOC-x5}0jtU^Gmwxz4inwf%ZsGOmk3_%tu$`KpYWv7FVW~;
z{T7`r6QthnlFSO@7lX0`@`6;vrYME+;HOQButb~XkoW2cHV+uKyoIm6z<~J05x4g8
z^JAH3Wh31ydh_xghKok;l$J`++2N^TriDA<N1~}rj7VGGZ$AhQ;5Ry}KrEEL=Q@((
zx3naY1`2dJFvNoU@5OMC*Zykii~nJUOI{p6hEjT{2iEF?EDGS4nc-zL?C{V<y$RfQ
zAcCJdL?7z)quTS1=s#M#W@!-r@Paf{_T=71Mhx#$QXtOZ3BO!X6aQUuv#l?3ub+>b
zeLq8zNH2Crft&i&KD(M}h?RMXtT)@aXSr8jf)1%l$AkJM0y!7XO^C{<QR*yt^g)`0
zhzWzMzF0CH3YYxJ77I>QOF!VMVVN^hOb&Et(B{)-BHWFkv_&+0r{Dq_Qc3Pekx|u2
z->3arl9Up>{(LZ=5M)nctz*XLrWXQK{j+x_`g@JSv+rW^aKP+C_JMFXc_!K~uS##!
zu;C_K*OD(ljJy+5M)kZ5XCv*`6fO*qRWPsfceh-cLN|`YYixJ>M#dK*xx9jI9{ebe
zu5SdBB`PYu*5ejT-i_G4%Ti!g<z^!0RBugMiZD+o^OpX204x@W{=PkAXS!LykCeAX
z7jw08?!4)rU_y_xt7$J}a<DyacghrJ7-I>Zqy!eGC_F$s!z200&r=?XhINIm2wl1v
zi*#vF4?o6lVwd`Tm2$fN_htESC8jy{gj%TsAM=9An*hkSH<vFr+`bx?ekXg)%EpP(
zG5ScUu+e%zsLJ;+hSk!-i1<M;d2;DKRO#5^E9NODe2{hl!0}DyE9sWv&3I%>J56E&
z9z!*=AO5W3Tl(BV;VNv0D3=%@FIp<)6k>Y)w?#y#zMhS0yY1tbd^_0RX2i~lH;#;w
zMwsfnnPBnPFKg6)n+*vol~X{H6$U5p^tbj~J6ET>OMBg}_zP9F{HrP}wrQR#vj5mH
z!>STJ0guPbh`Zq)gGl5-$gZC!vOi5V>qp^2fmmJ49j_$5%mMVg^LaH0?M%`m1nAbg
zsehMr=<_j~><_LkIXwZLQU~<mj+=A6eDjDZq*)EHT{h~~5%}dSW%U%ZoNDi9&%DIK
zuD6`SiNG&1-uK7~n?{tnl}3^G3$2nEmj$kg&h2}*`8-gO8C&QnX}ViH(4!!(X^<<?
zaW!v+KQ=v(4F*(u%oqts5Fz^?XUqLVto8igeoIDKASf5%WAJt~>j+%)?0HuG;BjA?
zg&`0*ZY9wBcFj40Mit)1g_kF5kf|oMUl%I;&YjTCHlp936Q2(E23v~l6K@B$5Ox>H
znGG4dBu~h0YN80~o>AeeL!=~gaku?Z7S!KfrohZ)cTG*E8_k12?`;I%C}$mvt9d^2
z#8x`n6O3YzvHexhe{jZ|P}Cc+|3rcA`*YAEL0I`1{wO*z+@5n(2)RwD!8WS*$Ycfh
zg+@GoMXvwjbvQce$<TOTveyHI92Rj950Jj{Hir>{g<if|SY%EfuGj!<$O(v@&~l72
znw}6u4Z|J{2|mt;wS$#9(C93K<h2L)UNRJcfbivo_~qO$b$Si%3d~ghY)Me-1Bi+q
zhF&0i_GMb5x!&EuJmR9mYmP75Q$ykP3$^2FWj7lKcq6vLBRfV3l0eqXk4gJ33Ceqq
zZD4*8t**J8_P?jvHi}v)MjInrXRtNnGc74_xF>OU=0a>$@h?ztW{c`0oBzHjPsXQz
zd4r<?zi%WB>Pg@|;?`{X;Gs5ZXU)o!jedP1Js&j)8jZvksCl{(HuW3S3~>Rdr17>3
zxg1kLD)b+w_1_H)N)glcQ})-zS)YczSjR<x?zREkQ<!tHL(Za!h;3!QB?nJYG3Sy|
z&#Tb~UOQ#R-j@nMa)Jg4X=lF=@FO2zj|^g<<Iu02OWWVl+)4L2H6rsGY1c}OyGj*O
zJNrUt#!v;!7>{{tENk$VZTOVSY;)Rz8m2$))lbTvTK?uXA3^sZFuPxgnEIdh@vr*d
z^a2-ZZf7DE-b@vlFDFCD6l1OvHzlk-(ow|_mxYFLm`DXcAQf$jBeNYxirKV}gr=<$
zdBAHQ0dU_R!{8gt^P|rvMbJII!)2@xm_-}E|ImA_*tn(-7OS$pfNBiQLx}vV2B%po
z&PZX}Uei?^q$GE&D1aGCHcaZZ*5tKV(Hzm=Z4!^Pv^lP#d_=H2cb5&H?Gqmt1)^<-
zSsTo$Hw{rwt8>^7KbYynDrZQqYs&rzv1sFl{sc)4V<9<~ean4U_FSwyJ^atbN;7UG
z$```&&7!t9Z7M1QOS~0%$pRYkjajERKUJ+}QN+H-P08?=gkH)l@}O*Q<9b)%n3m!f
znKZv8X*JNLK3ym_#Ap}_pUQ4&C|;U(olmOGc9OSZN=DhklW{WIgr6>M<Qq!%&_+>u
zU-XNv=UbJ9*Fby6oNkWXJI4>LPDHI!Y6Rj6Ccp3uS`lIN!=991!nLID%3T-5YnscB
zsmHY`<F;4Ry$;l{6C-hbt;H)A!JU|Ab1Mw5B{qYer?z=d#c=P;Up5TFKH;)5=OH1T
za`!A1U>8je;)`<0MNXH;DEg&v^NFpEkHJlyr1YKupA`ZA5Dh*Oi)G9GX0|O}0qq(d
z-SG~2GyDq+rG=Z}H0Ru;_JH;DJ-`~i#1(4a6)YHY!~Nn#-Za4W?)NF2V6U;mFROg@
z96v%S5+yINm=j#Y!tqxRoT-)*_%THA2Ok>T(%7YvET^#Z*EXbZwFpYmeHA`|qQ+aL
z>nAj)^K3y6-?Ys9?{=ReVt>~U@BE7(nvKZR?UoX?K+&ubXq{B#GppT4Fd(H+CU67@
zAfV=L52>mX+AJt;mrS1n)t3lp9SJe>$&eLNqZ;%V!F@@oHhMC8tNGTPh59DbBOwWv
z@@tVPLiO*E^@xevAnzjquERA7^rP{|p!Md&VF}hxMn)rOfABmF3oK`%mX}mzi!9w5
zX`9|U#IyFo<&5M+!|Mx<Ubnu9H|>mBp9#z`?XjCWma;p=WW5?L$#U&|enVFN3#~R2
z?j&&=)m@<tdti4(Cv;3q^ywnx4(t*rHHItdPO+e6M=Z2QMJqtl<8cWH&*)FoJg6v(
zSB2z<KNp@_1nl!b7W+QAped1YXI!YRg-Q!JD-%aL^zsCmkfr`4b%em>gla>Es3Y7l
z1)89TA9WYsW!o20J?#j{R{#dDhHlLv%l9WM2k)fs9=bCMQtusc#1Czkv|H1<r8=4P
zMnb@HUwIoXnFYV<eT9ld|2EAS6hKzXu7Ca!|357OP6Q=sq$L4IsdE_&YQyo&DOzpL
zOO{E%^run7bLp#VmPf2ieMv5GqBnh>B~%vAfxe?8vsls5BCX#8#t%erv_i%ht?7@$
zlwFNtZFNicQ+~m-^x{LuSTIVAV}c&kdNrm)g9ock<6v^4+Yy4Zoz-ZsI9Tc!OsD1k
zFm%f6h4{fp>PX)rw{@2<k&X!7!`HY$G8H9HYOSD}#WTgRI}C@4?MpcppEIPG$aX?j
zXDHZyKZd2A)O}ZhwDEh6)g$*uI@F&zub<s>|34w7w?r~+Ls02s-)^5ePv#QrM8R-r
zN;YNc8o^+UF{@_M)_}kKvZ}qNo(D0-Raa-EAQTOwoEIh``$vHYhm_U_Iw}nJFb(P;
zoPm2~zO-|w&L~BehNw^9I1fSnW7^$*jp<*C&Y#q!&(Z#QsmFIK^B@ngEcEevv9ViP
z4BiCvfm}@G!yVV`WU05t^ee*jd*>)TaERX9WmuUPIL(Qh4naLLcn(XPsV96Fk6XS}
z*__OO6LoB?j3Vsac+U@{czE&$=Xm2cc4p5f=KSfzls>^zwh%sXklcwXtBI%)xXY))
znw9VvTNPyvDADAB0nWceM~V7T-Rb?03ygB;;pr$*DI)p$##6<>oqI{ccC#^DhT2h6
zfiBp%@|*syOlQp>8EjzXr!89pp;e<kpL2{aqmmvxm@(obZCtyF;52!)X{BhyudB8Y
z(4u(=AWcHq!^;F-j!UhJ?%v0W_;aOw#OTHSA%=g{*E(c^zepnTPl<-oWMm89BQvDj
zPfbuO8HiVL1tbJ`)vuz9Mnlgnj<6|+wu})DqYj^a!{`6ImtmNW;rP~9+v6q<*W8Ig
zL*Z(pE(xw!w*ZWSav>ENI+@|TXtV)%34|t#4+@5FLwVn!*zF#U_Yo2WzmzFXC!CpP
zQi<g=%5INI>0@!?_(f!_<^UfjS~RcJSN%PF>!cHhEOa^91;OQD4zCL_Qd2(EZaURv
zwV&Ntl26^`>Ohn>;ayl5wat>;XGfkvoh>b-4(D-it;*ZN!(m$?8u|sh-)H;kH!|DX
zK4<8Hn_EdfY4=cq^5+`hX^ra3zuI_nJ1*wS5bXx8Ra~2!+pXXtBQ=?NB&vD<Qt6MK
zK7MXKA{hYD2AQ7}G&aA=7Ea<WwrRhf{`x;Hz|j%)#n|!$D5$WPRg9DN^M$gv11JQ~
z5Jpdq3w{tHQ}ghIj1?rnZ`%uvRV-=02tw#+VN(5l=iMMxf@j_t`|8`8Gf*(6NvPy2
zSAF@$^cKGgVuN3!_3MXj(NMJnxe4`jMcdyJ?%b)H7a<p!T%m8;Uat%y{b}+EdLHim
zH!+_gt_W<8Ym=eOrv9}VQ>8`=UGDXj2`mwOO9-jvdR?D6O2q`z$YoT}-J_M1f;jWW
zU-~e-bmHcwEiUWID-=T~1$<%@i9I1a@t~ABDh3Z7vvtN;;!iH5X07<t=A@bmI1}p;
znMb9`eC|aS1vK4Q=|p>aBa>YDSp0%(j>>T2A|lB+FKSL6oU7H`NM4#+zndXPn{e*w
zFDkWU{!~ekdulD%+wq<u#`3u%7WsE58K8wA!E2<BczFpKc@6BdBW@oNP}`Nw#XIIW
zQ6C~eZ^F^8#6|Qn5DOgYN74QXS6>pm0aotwR`O(P-lfKX6PCQg3l$H>wNds3zsn|l
z;W`*StTWG-ToI~;hqs4C6P6KrRjoUQDzxp3dad4rIy5S(r?kL}JWO1bovI<as9)2W
z#EZa1Qf#>y7d@3B0Tr<f(Q8=yUZgale!iGzv~mFcabhXJTwmW;D)1(L(@VM9gR>g*
z@zn69q5G%s%>R*9{sOF(Zz&?xK?+G&F3V8hpyJBNKyHp65oK8JX%93GfY1$H6{o*@
z2q^xR%j#X=g+eB+;;?z0F^e0kQ~zD(<OU(^%W(`Z`jN>e7~{F02S{;ycbf@A3FbDE
z+&oM&Uh!!LnX0G^&fKs+v)hz6L;da$y=Iz}IGGMkQp(W=lX5e)_d6-!2`P6Gd!+|U
zU@?{M=Qd6<Svi25wLd!i0dQ_$ow4-Gg7|>2d61h~*Zp^(dw!c^a{t3nRXc{#`~YEU
zyY6e3dhvl9v3F*}(8tc_I_#g`_z6CUM3zLLjM~!t_5-~j;+I{%BP-^QekNQJ!=nU-
zh5#~!N7YCGgPfYcw77{bZEa^0^`@<B-W8iDsg_KiO=q4H8txK2l>>LBjhW=A7P}1<
zk?L3`PcV#oco5BqI8H8X%a<8gYQ?o=Da@t#F;r}``D?7F-Bc<Fz1(QdWbSn>C#u2T
zNYVvw>8BAGf3Zfs!RFLkrCD1ILD#Xo7WHJaN8KUo0{UUNTNmpDnR{%<2->>$8<@~A
zM);mpUmcKVnp|n4npui;;y-xXC#R|X^G>yPW<P})Mn$mrrB7;5GLb^#9zhITtF$3$
zoGylxo+X;)R5vlTh;q8e5Ch$iw4Il$3F+x4&>d<HSG8uG0hfySea7C9akvUN<1(xn
zQD%&cN&%MoMfU*XBY{HqD{RxjFJ;NeJ1dk8*3uV9D`7R-7+f^kBiV^9xE3v%sC*MB
zv&6l%l%LWNQhprZ(hSF6QeC@i>hUdip}+JSqW;Do+l*Ba^U;US*hW4xuZ%VbTq>v~
z_*QM+mW@k0;yZmj=bv-RkDCw2e-n6rtqcEbywq|qCU#g1>)P1+-r--Exr7^6%>_^L
zI=gf3T~wgQm&aD`7276OnV1|Vk_L;^Q{qf@Due*PL%4ce#M@mx>C{WB9FW_gt()FY
z%FS0Ra6TvzASADmAXCGVh*+>1<I`H%$HT5cqd?b9;qcPQ4f#V@y6p)=7gm*=u~(6T
zg;69AF0WdlnmX;9?(?kKI-HWOnuC*yBqX{$`fcRGfRWhvZob#q*GVGu-X!6M66eS{
zQ)(p7=jm^Q_D^;LZvCo6za1kxVkRhGHaE6Qc9W0Dn#ZoOUMYjOz|7E;_q7iPfa%zF
zB+|)KV&pJ){%cw_{CM4d$||xY|7<Ox8tNHAC)%*deE2L<w@F;k;=4Dyiu6--XMoZA
z$gMTqeuo<Q%0D1l`|jq#g1I!rJ>#p9H;!xwV?;}&dTBKRD#}$gOXE4!<=HQI>`~nP
z*d2CzhCU-WB*ht$>WA%A|9?DPWk3^L+ZL1-P&%bsx?4h0Kw4V5yIZ=uq`PBu!=xJ|
zMt67jV0=@b_xrmaJ3D80UDsWT?bA{{bufz4-{l(|$NysGzqK)cxO@y2@9x&LPNkDi
zaT9Yh2}Q4kW0qg34+XHfEZzr=j@ea6ybs|x*wjaefejkUw$p?ZRS4wzUc!=U+Do#q
zGoXq>LLCIS7T=Lk`=%8rH$E7XpNdD5=pd}_%tsNZvPJ2CS05_lyY8zbwcTQ8B`}?w
z@igloy+6%EtO66I>@7igVdlZ*j$rQhe6Xx{xz8NLGG+Y(nYS)9VFBH;GA&A6Q)ISy
z(#!Yrk&8JDE*oF%mslo11<etDjJ<zHy(~g=VgGgq?X}h|!-dm%eVM?kPF359MNj5o
zQX|7;q8ON+b4XoE9biGcbpmP*B4<V#!>iN9YicZnGBQM6+qHdJevBDR{KoQb3PC%#
zQcKs6#@WBGk*mfI=3Rdm-g5HECmtWEIJ^U$8rrfqKj>QJRz%^%KUJdm6Mf8Fi(dXs
zZ%VfNLzEmc`J36AD_55-JFlXZ)|x8!%d$LJ2m{CHecgAAL%29syDt7@bRN_(BBRvW
zfIy6u;TID-4x_+g-2(q@xykUZA4-3FxfuSp;b~G7k5h@^du)h}R^kQz1c}&YTocd6
zbc+_;yu=5cl9c6F9G0hLL~3TaFb&;Oq4+j=8ohHtZVYfnIXD_x`5dp;@!Bb-k;C4n
zeJO0=6E?sk(qAp8C0&s_tE$N^|BWB80VzlkO04E9LB*(PVJMZAT8Vs4KQ@Hj{;tyx
z$!lnaC*(KUljLM+h=W^s(MM=7)T%L-^z%&S4Mq}4;dF-%;Yl^<cI11HCv6%h5N8Cz
z6V8K-CKIFH&WMRgGj-{2Airy4g8ZdoaiRH%e@lmr&f&OauSpkSCBynYQ(meZClP;n
zS0AwYD&te|lU;Q(M~K7SM*?|N=h*(SH+Nx(0yQOJaA6eAuiW(Qyoth-fnG)B&bA-M
z2+XW+h$~GD(r0jT;oz#PFs9#*yef_y+m6ugdexc!DWzoBP`44jDM?MLNWUcfdx*$Q
z;1#QkAuq);UOw(G`FViINw66Ye@nk(EIM)^`wA#gsGF2mRmP|~L!nqz2pjvZUFJC=
z4v9aMNi(T^p2oIFjBEp51ZZ#o2V(fQ<s#*Ob2+pzOp{y?1`z{_b-~Vyl>PosKN-|x
zCRwbJjU5HRZhV;&ZrvuE^EoYe=r-H%so!x6EEI_(ud8ZdQ4wwdL_?vk-W**=nVEfx
z&8d1lPoIGgU7f~Nl8ThMUKmqC`*lQA$^ShFA#IGf_NQv7n#S7|Qf~I`Q0)Rfskf+d
zhWL()iBsR&e|r<gh@_c2P$%!MV}>!hirtCYQ->p7e)&0`3-jyZb*t+5b51$mNHzn*
z8)O2hL?=4zWoC<#$ox-Vi+7z-<M=QB&Wp3n_^;2&G~#vYC7l4#N43}-8q^$#G#HhV
z6z{^r9tx{%LopW>c<aI%PU}KN(1=PYBa<I-*_-c@;CkF<Djnsl9z2;~EG2p^>4I3%
zv696c-ryzbDo#AKXGL82n=q+&Z$}S?KVbjhrVuYR)XJ0d@o8G&h|--wG}9X!a*{H`
zku<;WDnT0opna*IlPgF(NEI>CG4Vc?7s3KaZCZ$XZwaCY@@o=B-r<okTcJVd({wqO
z{vy!F{|tifC!@C#Ho05PEiMM3<YMD2+?&o>``0grnj7W#2b7_a33mJKTYf-JTFy`J
zBEwavf5jr@I$TtVh)bVzC0Wfdn8g@lX&*#@0^JWuh@yCY;tZjm`;r1{QKp_%1SJS0
zA}SI?ONR)8z7HChg(e&ENxU-4WkefwEG{28VXN<bN5jKXrrfld_p=?(edE9;Z9k`0
zVFUgFN}LC0hg(zf5oTQ9?-y3raVJTX?IlUH?t#?D{?}IWy(DnRHU56bUO-=bQ;xd+
z8{;P$*e|_u3$VQwZ%0-G1IT~u66$W<T3^KtzKQeW`~6E!LnUla2-p3<;JY@QMtg_{
zoR<C@x5DKiBMx^M*;rwoQq;DFmsHWYUxnCrG}8Oqw;9oRU9m#>$(p$?HgFUBPW}$9
zw+J1RWN*<^(&9W|!~#V*h;ihw2rCBpb!d}*4v#!{Ct-S(e?GsMCLPCQyTHmsK|~on
zRHM|ru*j#L@Z{ZK{F~JO{{?lE{(GyRBLz0hhhu+6N**CLiQ(oX`8j`xd@629nz;1%
z`Tm{Bwslu!UPMt2pJ~_v4uO#dlrtET*v=&0GUFGlzo&DJk5<C(o+l4j&)<eV0avtK
z#v8ic&Y=09&>c<LCTo?0w7%n^ZWYL(=LxuetZ=Va1&OcRIc23$xR}KR5is~<epw?s
z;sYj?%=k{$<OIfl_L8Br*18*lUM+n}+W20!>2!cf3MMY~xh&9M+*uZX#%(Du*0Szp
zD%6Vln<D<lina9#X?}V$iro8_H%ttoxWkh7uyC-hjeutxV+(69nYVo-6%(t4hnJf;
z{+)m$d>1XsjtpTva><T5{Tro&|8~yhIqHq}l|($pJLv(J-dNp1+RhHkoq{tLxYe<M
z(f4wL@o!7v!n0DbMI^@9mGQny)g}(Ta{mEnYi0_bY<@3M?Ew1{h`ki(P;Sk@*gM14
zPC72f0pSP?nZoC_iIznvYhj-gT%2KEdWDATCxIf>kqCP!O23|CvkiNy58dtH>><Cc
z^U4B!-=9_o@9!ja_5V#$&!^gekJEdF6kp&!5@<q0gQSc_SmQ;A7xcwrRG*c4Bfll_
z_j|GaQL=3;qCFwyK-P7h1v0zQ`ReV@h6Ii7lxk)=S?(|h0`tJsY`ifPE}M8CGPj8l
z6XfSW2346ZtsJKxAZD@5ptZmqXAlP}f#@<d&bRoV=A^$Qdq90H9zn+_L?R(&lZ(Qu
zMEf70>H8>0(68Fs744gE86>Wei}~8yl)FkuQu#yuRsOq7IylZ|Y;zFb<szp-A6T-#
z8`Ne0){*GY$0QFSu(uGAbj+gwx6N)B6)>okPJ2o3<@5CUM?0!l&EtAg>FKZM;YApy
z9A$GDL=o|1zp;@q4}Rzp{>jY3PL;>VkIsgN^ojWjk&<8aHKxxz$A<8Q5bi_JmwmX;
z&XLIm#KUzw@+_m%n{De_`MrZY3m&D%&?$}iIg0f!wwr_RHQ448>=f&H8y35a(sZA!
zW<4g}DE4miCtIJM*1F;DrV+gIu>~2d#5#R6%lbrB6EOZhTOw=aZwC<6ne54E@qA!>
znSObB!Sz54>FOOGu&jV{hEb!w{H*o^n(e+q=UKuc_sxXO^%m`#vWHFu!!I(=g%=^r
z`w~b6!!{oe0}@#e&(=^)pd6BF|6#4$vDIY#QPBT?TtIacneIY1nrfVYtGqR&g+K3?
zpwA#d@`eysQTiu_TUsO**Ev){_)Ij-sG(+<4iy=^WJ8ua(q*)&*8Y3!EACK=%12=<
zxBK=yYU$3pV9?JRK34H_7Ng$^)k$^80c6@uhO}9)-YEK^{H2$c{v%}bcYL4MAlzQ(
zC%>sj@%61=P-v?iY|jEV1^w-{4U8WJ&|r1sNQ>9ppek%WWrR=bdpsj(@;U1~9Ywbs
zhH0NgDWy)5`ywjhb`_e{udE#>L*#PM@;DG%{RQ+aV+Jv&dG%=bxZV1n?EOCIY)^)6
z3bui+h+fr3m4`WjbLdc?BZx?pJb)_?6XE*C6nxkaVVup~_?Kk)Q}z0nWO-tKxq7+e
zX5S$E=#2t+*_dO1$4<QHK@o+)62>`D^Rve#b$1onOap#?-cot73x5td)t-D&pwUIk
z67B#$6;ap=UKEba>778f{7O}_2F!i&{J;t%Hg&B#f8XNI{+n9pE{y!0>1nM-F<)1I
zo)}-+x@Zy_H|!lrG8-_f(B#_;s$<Bs#_lX3P8*FeN{188C|dMYX$v5K!>6q~Mqw^N
z?^W~hl#9yo5|z!Pxw`G#B&$+={%NyzfnTe$S<^;=WdZnoo5JPhoVk6=uW?8g_Jim3
z3dNtU*(C4(H8XAPM0>;0{$TMHByrfI0*|s2pcvEcuh{PBd@%P`<46HoTeW{^O~g}o
z38jBFo9sZ946_gDiF5=zF-e^IEAF}5vm8A89n!7doxs^LvviQ1adm<ZJqZtstz?&@
zU&36j#s^2d>3hpDu8%lR=iqg;=C6>UE6tuqpgD$?Kiw=i@t8gvT|BD?Yv)Z(=sH#c
z%syLy7>{<id|W=96qok;W}zhnGI5Xoe$#oq49;b+)9=a=k{E@cd@}4b)9fYB`n`%>
zouNI&D$cL2`JZ0!vR&1)Ij$SN`%0FdAplx~WJqOBmYrd-x2gRtT>h{*dtGO#>WmYA
z|LJy#IX~pf9O9TuQ@qte9h9hhFcrxgBPyGL<zx5@@Y+>xK(+SzX0$sqNmD~>G)b?F
zq~ezwc^F%ld|d?X{(foSxnxglT8?N<#7EnzR;~v#Fky}tjDoM={VA5>c6C#+iH`m3
z<kjJ24RkF!6v7uv0qvd$YbQ6>**F*;PeSfWf@P~n{3;+DiNZvY+^fs?+Gi)d;)gH(
z5qD)2y3ruSURhRGSZ@k38twj_-n!VBK_<QD%2DqzjXLjGgP~Jb)V<rdciF{pkDVm<
zKn3Wa$N?llz%l=>>WCq<pbmm`(WEWm%Y1x*>h9jM{p7~FudDw{NO;1QH=#oh`30Wz
zDMsx`_A@|Icestu_xZM52;zF&?y=8ZtA{|pD&nKvkoc0DtP{F}ApBL8@&VoMF*w_X
zlOovq>}W-%WDg`XbyX(c<^%SJMqBToWuYM`+2<50S{vFyus2)5WigQ({%N*|yNWci
z`i3CMpA=Y1ob5Cb;4iK>17i@eQFZ;5U0s^vRaM0dNwk}uX3jNQnqx2G^5zeHLq1?g
zQ6Z$Pwyc*gko{z5x+_8ieoO4=xIwj5-_&jW{k1E4aw7BJvYWZZ<25Kp8uPb)I8g+D
z0UeVg)_%YKyz?D7F5;@<G(;_(H90GH-4$FT6N0$Y#d#ViKJjw9(vRJKym?*7`cOFb
z=(v-fG_?P*yGjy`C4iI5Ab%OP{-jW|UPr{;9)e}BHdt;e=)pcSg|6k<A5>+%FTixc
ze}3w?TCvw&Ix!D=5KPSdGbq|aYc^#RYQUwTZNXY^+GVSgvnKf6lP>)3z?{p3ux%9c
z;5*296A*D-NVtvAZY?(_f)dVoaLJ!bM;xXh=RBOv=B$LY)rEma$=&MgMs}KuMEv`j
zM&42lW1qdpG3KqA9(_G|rhVnNV&Gd=Kug?hbHh0gf8dr4I6j}s6nASe?D@!h;V*Of
zLIM@_m^dhN+-Q|1{v@CuVw8V=&`uql5X!)e{s0@8XTO(!Y%8?#W=W`*!Lfi)r$i3T
z0HT?!=QM(lxX{j8h273Lf_(bK4nZ{E@-P0l8$iIoSzpJYCo9m|d(oywoFRkgA>Vh;
zi4+*m*4`-Ev~Xf2UE0<3XoY)x2g#^Ba5okNbb3NNaKxZ214$e)+%1W`3y^F?_HdJD
zgAP3dHzV}nLrvzpb==*bH~kDHa4){n7<T-u$IRucfws1i>xENpE!WDWbJWjG>}!@W
z-M1-g3Y-msb6S!o<ZF?uC`Een)yUq~iY>6wSGvQ0SS6V~?}0xS7Mfmm9ZY)L&&hLg
z(ujf};7uFsP+RZK5@@(r$ZdEELT-<6@LdZK&WF1j_F#q#oMof*!zcOD$9)HKVFLB@
zI?N3qp3ghcMYgG_E3}!wL<?VmOZnlP=a>D%IhQ}F(j-&CKUe!RY3;y)9T$h>(u>W~
zb9AI`4_ExY`ow>Uf7{19*je7o;-_t=<A*!`j)ne(JG+}9XU}bv$53;1xSQfBT|gVh
zUf*YQCdlHp>&%(U!BLpcbHizmtkxOwby<>X|7z~mjezP-Q~YZ7!qs8Nb$e^}-TnV6
ze@9R%#JwZf-LGJ%d~*nVf&ihYUpkpre|=~E>Gq3*xqZX=9sE7G?Oi=L=>`PmPA|r`
zM4A10y%YDUjKsRrGCc36`r=&?szV*nd<k-QgX_!7o}$*Oho-t<Yv<B)>77J<rn<~-
z{5h#o!CiRm4dUMnank>$FqyRo4cik{nm&t)8O25`Osti2&aAz{^y@-D+*opqkbG)y
zm7l*sq^I}mUdSP&&CI+yN<E_w<<q-Y<#CEs)PJb`z1x^uY*H4jLq7kG%vU4EZUCTe
zceDOGL(4Hp$G-kMAJfR|H5?y{wyWf0t`7|FSNA-lkBU<W{y@CV1wAM;pG6047cy%R
z5X6;HpLj%#I-l=ikTF_NlbgGn+h_3<L#?hF6Zc?pyYlC(nbZJktB5Wi^(ZW6S>!|d
z1u~<#a$tRl(L4uO4SicfNG|6seQTum;|lHP^j`X8qsVqHC)r;3=6wuHi-+sPmKKhz
z!wdtN9tQxZZS3l6z`uD7Xbt(lrlpC&C?ajS-?-vxF5AzsS7O@o-=%T=@09k4*G^&-
zoV;i^ArYgwie^sIazBAOEJZWJ`lv!aK-$U?W>c|cv~Dnb%O+Z}B%QtAG&;e$+G<E$
z9llQ~*Q(yZZE0B(@V+#owivvtTikn7_J_TLT#pEI{de@4ly)`x#4`j!(z{07(&lE1
zbDXmH@^#u%C8`NwtB}fdKFYO{6U@Kj`Qlv(f8G?NEo58eMoSOOzC}8{Pgq0mL_0)S
z^ys*B3^i!yzxFskSzntta=+QQzu4M469fq9JiVO$NfAP|N|-`j&DibA*YQKoDnzNf
zn1ZBwy8#}Ip5nuEcGcjk3;WJDJUk{PL612G_~<tI!^tE&e0W0d;o>#vroR?H`D&J_
z@0T5~-<>ZkvDv3X>Fg`QnNS~D7@ehVyQ7x|b<Te*R{MSW>pT?hd}HLERb8e>1={EA
zceD@+d~tR_)RPw*Q|!Y7aEnNG>6_>CI+%p{#*z1;5GDnU@9i$cA+Oc6vj=HaBmaeR
zK(zOchA3_K*VSCQyIjJ7t<VX;HbGN!qWn(vuHB<$7*Yz=B}%C48W=$d+c0F5bk>(V
zR<==}51R7wky>G5fO#0uTfFjz_d)d*W&%2t{$}<y2*g%#WiZdp2C52~o^3q_yoH8)
z0wcA;!(k!8K_T`ftsV5t(V(|hrsnx>j8m?AO~HKRkIx<=-hxW<B)oMl424gTO(m@!
zQbeFXY2~0`uetwrIX`J_s)vp#48*emg`6R<^1aLG)Z0AoWZtjw6EQ^qUrl$iFzws>
zwU*77ujiw_z>t)|*$3w8H6-hKZk~-qZz;Ds%7GuqPAfl&XU&MUyTp1cW%a6S4)@qs
zGL4tn&YpqOMl5sfPZEgpeLyjD8=+0Ez&%iB)gB1=zgCEs<X-vL$9wU<Ud_FpU}EEO
z1LTvt+^w|{G6O#K+m%ma^0fhO&z5ve1W&8MukT!V_cYs{9hV7=2{QpJULm89)2mG5
zff0nZXGk~S8Mc;wIf}J+K&PHXy97u_w$*?|0f=eu`@D`|&%Gq!?m0<@`*$3lz|l^R
zFvoxLY&$4{u$1El-wxEhM8di2ntNvL`ldVKv%_?8d7KW6G6fh2V>zkld~*8rdqjf-
zrI~y0s_TBF#nz$&dzU0So5WIaXJaus^hM3kirh^TuvVj&NzvBjx5upip1G-UFKPVH
z-8st`oZ)K^wcx5y3%(W$^wW6~ZhksZ<Zi1Q!;LsXnBEC8e`Fx!6<)<l0)AhWB{Sf-
zxXti%enAb;J$i~5^9pD<DToKmt!cT@<wxJ&94+;`&kv*@%~5x5)Lt}>9vPomKt|4d
z!7WgL!QiQWrRVdqH1YE1#BYDyA+D^M;62HQIw0^4nCk&J+Is@#h3Ra8>(5t(LEgIV
zb`5uCuB>~ymW6xZn0L3c$&ki&w>DR^_jG8VZ?ARKdPd;MmNu<jIvf>WKG3u$@h_4j
zTeqp)Ots*qKs=$&msxmgF-!er|3CC4Or9(3VRoeKMa@=>bY<*Ve0M3+z5ER7I|8J5
zNijUle)C=;g|-1*IKY0re{!+b!*=(dZD3?>ycQKPNF?DjK-#gSLf9R6*egi7a8Ols
z(>r^&$Ahyce7o)u@(a<{D@?Sy`N(hNoS@vmn|ozMSP)=yQcmuvdr}MW`_E<his_p5
zU(gBZ!myQ0UqjVWPH=o`%?-5Gs`g9o@Y=Qd+nnxs0*S4Nzb$h`%-q(TN5>*bO&EDc
z$C-D3=ZMqAc=L>#%A<cR-|3w4GxMjW1jP^5$bOBlkG*Y+51MYZ>Af^Y?JLV5ygqNq
zedcxaJ9OKa-Dv(GFF}w0dF#tomE$qGJM;l;`&_vj=vZe3`%gGows#$f=W2%ybn|X>
zkf|X0yFzyEM80ohNFRM(yXcH0#o9Bj8`mkssW87P=X%aPu^Cv+X_8o8f$^P0!Q14y
zxM~)2sZcye=exB~7S_6~a+mz_OQ*fR;19fH{$C+N>+;8%Cey>#V4*4+ZIWNpX~!RM
zd4P4eEQ6>3Q`R|!Y{Y5)kG%TxYuc(`$-A*EoK+^Cs$`DGo9udzzQS(|-JcLfoiGaM
zkh-GpGd`Wi{Jw>7YZLueyx4W(QhfE;LfL@)&hulmz&PSdPhb1epL=&;-JC(e#~<4L
z2@`|nR>!A#gZiSe|9@NnTU^Y!hsY2G!HLC4r_WRQdskeyXMKwMbdoh}N3Vr8=@mfR
z(k}pTV98P*PUWj5bFpsoiu-T9qh<i%(@Y1jwk<ZfZAB4dhh7+$QNmmdTaTXOf|$jV
zv81y%y=dhE_$Mx|{j+`~Cf;Y`o_m`ybb*lm7B=bhuDVtM?r17K^8uvvAe7Jr-z+>V
z>3=Qb_M$mEf}On+6GpIFmd;)LoFeu3LaU_iQ;&|kg<7{f|B~9<0(|ySbq9FdHLp9|
z+<cuVSD3mwH2<%Y<0Tv`F4Uu9`E-IoAX8oM*hl=?rmnsTV=m-T@Jna&m)G-zchuP_
z+wPFtxfF??zzwFudr<c{PaU6&`8;99vsHh?bfjeyydUce>eN$%*NfX`E?O!Moy{GC
zE_3aYi&ir(uIW?jdHlgbjLAbfM&;ifG2#D{aq%aMdgl+V`M4kR2+^wMiCqJ((mizT
z`8VNRnj2;K?}r~iw#`bD-+i(=7`Qx7MkbM(D(N>Z^kWzz`y>rriK_~|coy{N8x&?w
zLg#7^)0bo=3a^f=CwIZ|&ojpMx=J2*n`ogU9qStQ=0P(OD?gO&|ITdI`CGfkO!N|r
zxPwRtCp>5Rn^}9~8|<A4d)bI2khq4yD{zH&GU%`mZtV2->nqU0RC9`5%jlW274V9I
zmXP<t{u@5I9@a!IZC>)_L*c3H^IZ8_qDoq|Of&%(K(XVkSUaIPkv+q{u)eU(R-=Lt
zbE9&)N&>ylhGW5}zr_;VPz%oRCnQ^VM~Tz5H@gNqif$@!egoU^d6wx_UW}q--VbBR
z^QDn3qNWLblFWq*k9~|%pT1>(OW~!*s@VJ=3BjMSs#jhe$l*7c{9rjsUub~gt8dCz
zI<a;8w(R;UtS%>|=)PF(OzmD{*2aj+t{yY5P<BhHm#KOWG$0DC{_BC7yAo)ilE33m
zy4QmRj$5Mazr{SXzm)PEFomph-A0%{w0`+Cx5|7Q6MO5h!Rfk9cpnK?@UcCIKfPb?
z_HLr+%chhZvSoCuOPU9jc>zDCD006HTG|fu2tU<#-N6og);#&L<L2^+Q}Qn5GJg-G
zAwR(YE`t93e|jT*C3F=fcwLyj?$n?|G`5$Ye~5#n+GjnRiXPM9Y}?vp3(Zc3c8+zn
zR=p!85SUbf4@1IP_t21p>;A2aYpW;4@z;u`gxi%CMeAL{lG?RC?hp7>x<lqFmZg)=
zoDvsfD_))jdm!1X)u)-OLx;^mgqJfY<ov7O?3YYGPvHh3xBHznR=Uqc_QDT{d|)wb
zTeLv%UVl4#p{|0Pn8BSbVzjF#%DwGK1d!<J`7W!IPXW~vFaimHv=oZg;(FW7U^D@;
zuO~-9oTSZPeK$J?Kkapv{;fz(DSzqsPtGMrsH{#{#B`&doAx5hw?>5uhk0QPvfF(-
zlU;DYxiE9z+W85$HZc94p8J?t2qZ6i#k!tElFnUyT}4^>uTy*ZyPt~OH)p+oNl4|L
z8bPy}rnb>$fW>XisSjFh%(u%~H=fLF5H=fiJ%#s;o>1sRbn1Q+1QqhQzvPkPduBD)
zKJ+)$B<mhQ1z!}kKda{6o6k8UN|U>IC!Zm1;3`*kpb`L8VR9Pg&=!NkFSlT0boeA!
zqP5a(#fLUO%M!oFblFgnEO~L(j&>y1l{i#tpS=bl))6{<TQfW_<#`G`C0ZZM<ZD{x
zkJFS3tqa%kEZYD_bf_NP*iJA&1LVU0$3k?U<`oq^=Yp5=vFCi9G};-H_0<gY)3<b*
zi8n-~b`ZW3j~NX6;d(f`cIs7BTMQI2e*jSdtm(PFeX#3)ZI2VU8{Bbl*7p8BV&a~b
zbMQ>t@CMdADBE6aw>f_9RU2cihyPArAEdVT40h6otA^wHqVKp8t<$13OT8@&%K1d>
z{@3k3iII)=04AA;<pVl|CKQ4&J^hmE@MM3`zQu?nDqa=^e-^vlNGAy8?g;hdc_gkn
zy+j^q-^`lm($n-H`=RbG*=TOWwCSeuE~T3p^#OCSYo~o>9ft(=q`S%TMHC{cp0<*#
zkz8A|1@5f2*)Ob7KXAXP%7KO%>rlP>Q`Id@IdFwFN0CmE^~rPN-I<1_?vv<yl*URI
z*LLCUxlxfq>Q&~iZ3!xMK%)De4W6z`p2t&4VNK0%U_N93B5{Zazx*e482-Ds=iCJ!
zhAU=r_WIy8o9(lY*Pp&K7hYBU4){GV;BmJwM<EDU&4Q``v_$4Fo%j+v<Jfo*1B}4|
zGr)H+&+5JB+H{$cC5)aXhbZ?kH=lc`+Ekw-*>ag2ZO=KbCWCW-G1zuscLMnE5(oBB
zd71DYrI%MZz%epKoj@l(h{~j;A0QueMehrZ7N2*rp&o1^5$eHcdI8z!`(dbl*iR5H
zq8O4VvD}CA{^!jAmCTCn34#~dwzIvC&2C1Y4hQ7+TPn!w)wS^p*OT+6s4zE_uqIK4
zkH3T?uWu%fkS-wVz=q$#uAIk3M3A17YOw!Qmb%Nsfln{QOMar9{^E~AON9#iOJMKO
zo;m_+UhlDZt97fucndqVdN-B93R1$^Y@?2BTLj4qD3$x?tt+k$B1qx{J)Keo8@JgV
zMWr!dOCIO0=;YIYoANc2PArM(kQ$uBU8w6*hl;<RrZWy9?xRbfY8K6E5B}j})3H4A
zv30hmu6J1x6cY&k2e1KQ?185sk>i^u63QbvB!mn^auJ?QhoK8)&^e6WliDL}fI>^q
zQ|7`IXu(^X_#zkvsp2?%v=iW7iRb&o2YVMxgj)dPw$#mhqv&}bffj~oz??)$@TfQx
zRs|4q_$tER_y+JpY7coL<p|K84%bUq=oy!#K6@43=Q{!ws|=`E0jX;YiZ*W+;3%Kh
zjx%-2x#ZN=ECt!a^GnvgzfIfbe<K;dLUZWHi;^WPMfpyga*YhnkdzrCUTmur#y(V$
zMXK|Mxa4b!XoOuScq567lq7Gxo5tBPRqvB$f$190EASZm-DyghD#*JMqF#A;csejx
zX?Bs~%av5txtBBI7N$VRmzo)844v3D#`XE8Axb7?Fn&1kBenMtN0}Ad3_a8IkV%W!
z{J_uwHkRS2nuUPKfuwcus^yEqRFQ+Y9oP6517WR&7AELU0oU^6ouf2kqTISO!XWMV
z3x=n|j(cov96lm$(o`hwH=`lJN)nW;+=VrIbi3~#@K+NXN*Y_rm(#{2h57(*G4qt;
zE5(bVhFQfLL(J71Hq$6P&)MV4ELFQ_@GMnT)bSg{8p=9LlBt(vbbG%h|8kOEpYtZ9
zF|N}JcYLKlz2w5}qlz<qpS0qv4)l)@4cUUf9|7pqaF(2dN9V{wVyRN}u})ej(kYoS
z5@eJ+i$3U>G&DPyZg%QUOIe8&q!@79Xn>?r-fHghW1T2Ai+UVk!H!`B0W<g8<#%C#
z?S2_Sm8jtgU(s$)e8nc^{NsB8`rJOozW`QbcQ*{pY)(8jVk+8#iyAXNseF0qCxR*H
zgcww6FHMUxIMr{qim0ERU+Fp>_UDN2Bze6nyS*gWJ7S@?6iV2rO<|*;iKFb>4ZM46
zqNZg_8qt||Tbm{`HAoGZ*Bs)~C(VZZ&@*0Fcl~$HX#nLB`#Vjgv<pdoEGw*~r3@Iu
zGE^ll1sJ2xX^1Rp-({<8E-CxAY}`D<l;$ZEkW1V>RCJ7@MzdyGxoJIA4!%Chlb&qz
z;}<JWw+6buy}*Gymdm^Qx`c!Ie1h~=W&rEMzc-p;$fYAG881heoL6jrPIqycw`1I$
zY*Ap<ZpVEUEw9Nuv~jiVQ=8sUboSRB8FAv|C6a6W)>Q^RdiyG_Fx*03+LmZ*<$!Ei
z**C$>xwowYOHO`}A}dih|F^jL;<vL8^WO-}h}~znSnpNscQ(||y8az2<bshjYF!xl
zB21n{@afx*rC}b%nD?(QCRgkSCw;=g27(2~s3uChP0B0TG-pMoecsVUE6)^a)}SB}
zmvP^xBP-*Gz7C{MWgapmKV-R%R_e8Dm5ksMp`_o<3>z8)ajL6ud@~81`A4>~6Zb{w
ztj<6^=;>2{^)l$Ch0;ni=DJGX?dm#sUw4eZxQMRbaO0deYv)rh0S_BF^AYH+lzAB=
zEps~*i!a%lTKUpL-e@-OSn^YHV<pY1ep%>R+=x0}FlqkQD3uWfXpAk1WZE*31kbol
zRW%~eTRIj=dwVYAV*dg>s;Qek4JSFv0{zRO;`+GV>crxw9n#KAp_z<J6QTT`QGscJ
zik1~Rjq0=J5{rnPz>t|g7HY_(A$~S1J5wvb8U5L0b2;+y4Wy!8>?&b@caBY~mI=tn
zVNIhvimz_VhBrtbn|)ZFpHe6oIn(=HIP<fSAYB#KQ`sCckpAwLp_#~ur)uIhEuK!?
zr)@CaAsA;@!67%rTmJ-k?z!zlQ>_6e>d<t(wB2najwa_)uw@@5Jy++k@6Ex6OPmgx
z(lcf2fctOGIwOm$$kaJ*+ym_!&SQ~fCDiF;CU@E4)7T4!1Y{svo8fA_gEi1!7J5r+
z$~mLS$pKuT4yXV?G16DW7k_JH7`d8-6ic~an)e}4kdZGY^uyRhC!-xNI|@_U=$HDM
zH35K@jAiad%MUsGT<^>?myA+P&h2XaMD+%j4&KR~U+3kG?}2>u_5*Ow$W?ENqtmNL
zw_WE7m_+8<A;sH)qqV5>;Y}ylzW6IR8V)mKs)9?N>7riAy>_cbi677(xOuF5B~u=)
zW(Gee2<A?@hw1OXa|J5}(^wmNb9{Qdca>(RItd3K?!G;W&#8Vn*jpr!j$V5TT*ZT`
zOOQ;GCm35BpO2`C%)4B7?k%f9dq0lc-Ss(_drjFzSL9?qZ&-)yT&!#{Hdl*ghhTW}
z<s50fy*{yDT<`{n(V9AK*O=;HgomBHzkAs_c%O4w@;1VNV45qJ^g+bno`&q{X1HuC
zwvPj`k?{)qR3Viwh~#sn;nclq$qCxiA(s!FdJx)x^<bfMi7~2oWF$}0A+^h#QTEen
zz63T&ZB(rIn81Uofwpq4LU7C;nOW=Hm!gD~L?3g{6Q!oKTvpo}&fB|CD*Rl%DKmii
zGiows#bN$7eN^tyyBc)nH^!MERa_rbmbetIxb|cg;n&p(E$=}bwvJWWWB+vKb^6FS
zs>AH>ViY&e8SA0_pvgfqUmLka<BCQ^FeH!qPJ+Fdpl@lEOuwQFBj({Tb;xOPmG|9Z
z2&6NARc0vfYi;thCDkE$+t2m)_2vs1Pju0RL9Pwvc$!QLV49N_PDk)))a_<^vW1E<
zu1LyP5jjljyDjy5(D3s!G7}1MG=KF$D>!wJ$vUCF5_vAsf?HS|f5Q8JT)-Q%k|;XS
z`0st6?VTfhttVpl16a?R!qu$lf{U7&y`3@1N<e*=ct#&4z++<7K_3vDDUz>)>J|8%
zSOv*>3u|W@IoTx}#TzT<l+Vi*^`GcX+A8(Bf^vK8(fjcZv^>rqk<*9zn5DbT=%3G%
z!&P@lC;PQ8KZ;N@Pv9vY3VoI3E|=TX<Y8wcLSsQvT|#IyVpK^<jERyhr;r74aq5OQ
zcA27fUAeUc&Q{q*GTejGV1cdWdR@+cPAFRbpqpgda@)9-6}H{>TwWiU3Ne(G)fhD~
zv^8hvs4$i58`u6YlcbLE#tQA+WN5eJ#o%;Yt8o0fL1AIq?34uq{W=`P;_(m`9u-+R
zbZZxQ9rn7mz%EJP<FoU+x~%TgVfFRgg$2+bMJ!}X&FpwOLQj^`!H76Lt-oZ!0JUr)
zMWrj5+}TWfB{{CPm)wHgpdu()|Ls=V;?38pK5u)XZ?&#WOUV-5*H2#yW2bRXF^`Cr
zZd)Qd!<(i3;+sr0g1mY#F|NZ)<;<1l;PbIHcJ(TkNM0Jm1|`a&F@i;rmx2#mia*)_
z=zTseF}IuL=jvzX7ON0Cz#L~BagX=DgbJ(%^Fisp=JINlygbp7AQ*?Rw5Iw^VFSDY
zmA(9eV>n|z(n6r()X`q?o`Tk9fm?X)y;3i2Z8Sl6lIvAO<fD{cLyh~0$)>vNq0{h#
zfbi+eouAXy2tUnF8oGMSeC!W;UwQ!N<r>*{+v;|z`*zyICm!~8{PlXC7S!vw<qm?e
z^cL8H37Ev1!WE%Q*W3LrbI=mE#+_cXnKZ?wuL!6iGh3pzH7P4Mouw71A>r9Sc&yvS
zW9hf1H~Xztk7p{2I#}Vxa4G|-h!+a3vn`(}bs9Lg!(FfT(Df}+sZa1lSt>gEx}ZP7
z{OC`}1T`hxA|qXItbqA~(ZWtS-%`g{$(jw(c){TuAf4$HRa_&DG`fP393E9^t*rM=
z&eA%ght*aj+sqR65|(+=pn!X9!cS5DclG|^jAx|j<-mH8gX?;k%eE1gjqxQW@|biG
z0`Ok73*eCj{%5*eyAD55hzofu8dEIaUaHEyx#tv7pu6Jqqbl8WNoQIz#oKok(lvT_
z<K{)fuF@Q)iqxRelv`ztykA7MD8Nd3oqrmS#akIgI+fLP&YtR`<oO(KPLbjfXq~${
zV(V1UNsw|;j=>PACzmdbs$8|HZl|$tw;WDeb)f_*OS;(9o{^V3uHyu*WJ&MP(lPV&
z1Y0WkN6(d*Vmkt>xV)yfEQ)K}7Maa!qs-Ty5;0a0&C>`K<r>k&`$c*))0I7Ft7;>d
zw^HS!Hq`G`$K{^>nuR6OArFTe%e?qjf)d!0$t)d|GX~AAh-O;lIj<k4<g)5PABVA0
z$ZhDtlKSqczkF14kt<L97!*&Hrd(Idji#ig(PX_sp1d&@RuhSDMGZ98=;62go<bY3
zcTtY@L|=O0{e)bFL>z6YOm)C&FSqw-n9@d{t!H7g-=LEvPsRBYv*C>3SYexaa{-6S
zDik)al?yem$j!b;0`@|avX(<q);y+Gd{|$qST4W9-MQG~^zg1*uH_j90W;2GVeM_G
z#j<>}Ik)7JfupQhgAsKTLI;=GR=<b_wvT2v;LF%Wx$BO)og7qP2~Q><_;3!mZLPxS
z72`rxy+UL*<GItN*Fvss;SJBsZ!~Y{ddH|3cNISYOzVET*?oRGxop+=;vZY;P49Tj
zh5tGDmyc9YzS^{=nXqP$p{0eq^AP)OvW)R=T0{C$qp7q}GJgS&__<}5(h^Q7)e=qv
zCHAT0+9ESj2*o|N59qQ(66iky_3w+JDc#k|yFhr)IN|MrmAI@!_PRn>qph1|@lq{$
z=7UGH9JL)Y{SR`s2HK5gpgymW&5-2YW!4X2ODO|&wwe)%PVFErfp~0{DFGLKPe?K`
zTY81A&D$X-;W}Y#I~^jiEYMEwZn$1$#65`rf}xoO8p1>c1A~PwtY1(~EeFc&=^h5n
zX>*!cXM2ziQ)`)0A1#A)6*tuC$ChyGBL^^K$@QPZ1|I<K9QMA5Wf~%uNuzo9N{cv1
zM`64*pAU)xjT(%Yflh5%^fqp;a8L)I<hrYFrw<j^w-g-U+=(|UTI~K*7kuh<ig$DE
zFXPP&>V{$Q>eMJ+$zj*-ISuunsrtiq$p$wWlk@vGe|R`}(K(NBp)pTzrQEE{9(;4t
z)F%u$OFQ2?GoZg$RZzJTm%WEB@RWhN@nEz8Z$x!1ZTG1*;SU4W<qM&O)MOcRhQjlL
zvREl)dqf7A*qG(TM;5n;dFY{PvIkly;l1<bR_I5U1cjsd{q6nIyEk(yI4y)E*<IH^
zW$4KKsI{O*w#>#8_utnG;&rJ;WlnuJl8Cy>c3)|wb--rj=VlH=%CGm4Vq`0xIlE>+
z;qN0FU#1oF-J=vt<+ZY&qNY?Vp*$~3z+8G5vY3s;7B;Iq83UCsj$@t@3LNC-T3HYs
z0hR=Jq|#3SyQge3UL!oe>NT|cpeGNjKXm%Q%|YW6!JoNmnHij>Chn6Qu1Z_g$5Mvs
zMN0b_8a}j!&k|OA7oFS$hM>2OY2h+B3^M4ndl}d7HCpmxc5cL-fs-^~|Lxlf5mto7
z;-{f^%$)Ae)$ZxB#Z+9h4L8b$;~B2Ra=VLp^ZAIL&mxbKZz*ooWwYn(xaQv6t6ntb
z%RL>g{^w-Om5L+gQ;#@S6XYp)A|8YCwW`%7JQpiRQF$}U$&3~dOd6@APCS-uz$FQ3
z=Du7^M-v2z_|h>7lBMqflmby6$+DYUJ0lho#i*#y18qieD-L$CF$2#9#|qKx^dcb7
zfRY;begLx1O(!%IMIeqYpDtt?^uHF4KR)q`sKP&VK=jzXf@MAU$;P#rOIAJGIxnkJ
z5q9AnX_|LQQ2GwqJJ@TOfbA>4{L@a*P?1K9&D&W=lMSCSenHWf?IhsE_}Se_lcf)^
z6aM1ov2?6pV$0=Jz(EdxESD_#>7hcy2mXt4SX`(mMODvz?~pKd-D*iR4jDyp9iKzN
z^+~Ifmiwx!gM5NHJd^gD>AgkxpwS(tQcZLte^<s(_iX7R7qwQjfqb-Qrd6LQLJ@3m
zFfE74=Et9#38dU89Uzr@tQUi^3aq-CL>jG&a>dzv2_cR7aJ{6D(v3GS`Tyb~3J=oX
zamO-CpS{?>;DenFyO(4|lgduz*FVsKaF|WhNA<GUx)*5eS{kWvKF6DEg`ttC>|*m5
z_(~tS)oVMCr4@VW8jaQM+gL(#fQo3f$*J#w!@mGFd+KmZ(CD6ULqf5T!T*??KV3Oq
zR&`_m3C$_&td|SMlBKxqDVp{r-$B<XX1Ar1Qzylt-wl92a{Ic$xN>8$yKw8E@L4J~
zhZ=`U`TKkJ{;b5WqR9{~gh>}$o5+Rpa(}%JF(^(E3E7eu{REh(wsiefNh-HdJzOOJ
zwY}(Mt0L6~pO_PVSE{bJ+Eh(F`6-KFDY+_AQyY=qrSqk=Z5wB+a_ueutE#?e<0Aur
z$$q&H(0i3FOS9(0h}rR&L=}Y_xTnF`s9TH9*fi-|V&q^1H33n29SHv@i_4h_Hju1C
zARdA7c2C1`r+kvG$03t0Yf4E+ICw|cCNumay%}XUZF*SWaSDrbhcg4!U<00U1&Hm&
zfqMa5#53ou!37=Dpj3J~+tz$|L(CKsykc0Fyp!0ZXY}5{72t&#pEg4R!Ax0b&~a4y
zF8rMia%NTY#Sd!3Z$A9PP9w^~BPz^8xib{Uc<SC6rnmFFVsCt{V?HiW(NnMFf1P}%
zd%bsP`Kd$*jp4KZ`oe}bLx&H1r}TQTWk}97c~RNyIVTcu*@10dNPYxi%u;Wf%l`;#
zNxa@rBw`-ZeC(FGt}|&##fT6!qCuHT)r<OIII}*GO>2xV#;)GkMaY<X_a3wypcmxz
zAFXmKn$$<HPqMo&Oy1}QidoOEO4DD?iC*OR@^q7?*Jk0*hPsqq>qKQuGQ<=Sq}!Ey
z7&b4k%F3IU8tW;csQcX+%v#c-VJI-;U*K`N$&Rep1>(fjpX5yCQ?f+oHVwd!;YpZ*
zcv@752%bvHYClaBoQyUkJ?tV7mYgjX`2QgX#sTZCP;vkTeG<Q0qo<szpFm`=|3@w~
zcs6bi*ZkTq=}3Bjc$rr$ukd(;FQ;9q6*q-LaI;7?WR%`uWWuSFLG?`zS9ymsa##~y
zV=*RPwGCorEFwzS#AVA_as{KyjTip=W(ZMHPP3l+tXAb6P^J#&iGH`U^PfI3SVgkE
z8HczB6uwtYG!uDl^tj_B9&^IMJ^2YR<scHCr)IL``DmTQMY!knNhgYE{;o1CRWarB
zplqq&j#6yVRH{uzQ@&?jeeTd(f#=GjgIJx<waMtfZoq2TzY{QxG~9lZBeK5E5=@e7
z?tc|8kt9oGY?}bY4l9%`-}ft}s+YShxAZgu>6lWkaK7QrQlmRE>a?fvtSN01i!&|H
zL%2BgQLaok7rneRU8kGy5qh#X9ssN+=yg#+aSY~YLzb1Tx;^GtSyJ5+vz%<N(V0jl
zE<C4(jQ#YqQ)K$^PkS}ToA;+vrh!r9t+5C5=OtN-<Q>1UJk2c7m-ON2B%BP>yfW+5
z*}8w8TWNDdOkd6xW>$YqC@|N!)=7}~#I?AhU_Da0x~l)}#cV1~c#sLP7x3|3b;;BB
zAM;>yY^xqqu8=~s#dYF#Cofw?!7=?!ij~`A3{=?xYxwBBGG!>9lxOIW0tgF?_a9EG
zRY$qGYdqP4S9TKjh`swNPOKohdojDb74YR^m}#pECKVkShr#949iA~Sop6s0<h!6Z
zQ5Z>ZZKSC!hBY7DUHEf$kyE@)IZ_Y%$zpb+-v{oGS<c)i00CNANmHXRNFqHn1>-pL
z(!iRBIn*Y3Pf}dQwIkxFd}AY_Mzbq(t`s)pmbtaq-K^X!!|E@4WbwBsSgEUOne5z;
z!lO4wdaY>_#G%aw&@!-(&0L1FOt!opH)B@bwv9h`zgVSHZ=E1?oDf_Q#V@>m|AY+m
z5dQBMAYKiPrj#Eap$|v^ZSqTSZUo@j^WpJ3V&bQ68}^yR6LV)82iha0itW?OR-rZh
zDN&_#y9jylbjj#lGjCfL)!DbvnZKB;TFM@y?pVu$sLxJR+@lVsj8gA$@}Jm!eZhV<
z5=kqzddX84<+X5s(JUyZ$KIau<B<(OsAaL2LBcCcX^GxMD~XglrPIdZ^-p)fWQWX$
zf_O$L$3?AL#2O|uP5-FjXeY^&yrPjpZe{+9CIIDp_AOuHM+9shKI@PWjI{}T8>>CI
zeHU~e)$?-6#=DKbahi5Uu1I|FJBI?euGo8!1y|1Gi_QPI0Lm$<l-3mK6zy_N9$X8>
zH3c^#2z0WJmC`Bd#5!+;%iOejk1~mZrH#w9)PkL(7W3LQ7BAk{=oYk5CgHVN0-v2<
zfZ?`(VdrUA#z!iHvmX{DRvcO$!+w#1<R;;1*WOo2{tqBuC)5ELIaa?Yz~WD9oSi!6
z(9vJqbS36_S~}3=6>*t5LXcs-76zS;e@Q$}4KK|NQ9bYNLR=(Qk0qcVW+%#Bu75E`
z*Em<<ni#64!=6_R%}h=_OykW3ttAgbMllR*gl5+P?S%)4w@-{7M}V(~Tp&$Eu4inf
z*+z}u1nD!qr<JcNO9nQ@xRNWJT^?tAl+$|m&X+R5JHMB17dRS*`zaPzDFAZmNrQv5
z-P`9#iw7V|zoB&R0R!dSZyw2{wy;i|>{<MrNaqZes6aNP(}RClBSRHF1GYq>&`rDj
zKu$L^^|MFfZ&3vHJ-u-CY#i9bw@f{DrGdcwin5$k9Iuj`DponoE!|clx=Y47K|I4Y
z0&+UgSI+XpQ&cH;mD1gU(nRlGP@l?h=%k6A6@B_nI#NOA9n(S8Awj~BL6dKhY^%kV
zdWX}~q4&dIWPB$U0U|5cFVuPXT*=ictdnSx$l|O#Z1yTc>L>Y!wJzkcyj@#QcBSNw
zm$<U16C|()rhvIge9yR%YkK<(a#R2j{pnqkH(Pr9K$iWebD2oSllr1GA(tsDRjD}L
z)nuSrY)!o-j#iJ_;Y0i_EaLR;_+okhyE7~HA;6BugWxrgt@NUN=@DBSkB`Wetc{bu
zx9GYdek8{xO0($e<6F54%N9*8g84ui`h;M(m&-f??9!UXa*NK9Wd^1JBazr!&AVyn
zCqDMG_NWNn$W7FRy_k!_JjT9t6&{rm@oz6DjG)VBNd-MJW``fqq@j8{EZYhtoc_{5
z-DX$Hmq_Ox+P%#g-rwi3)_Se;-`jm|+_u!Aq@FRDk}s8ZQp>WY)p6BxcQNo;*)L5u
zX_lxtQC_+bODdC%(A*3=Y{D2mDzoh7(M$CGyz2q~m_WogtV2NiWYLzpuHFy|hQ2fO
zYImRRL>=tH9{4lUPG+~r#nl;q=N#*wT~M>LeK1zuw6l~R(G_J%k;tMQx9aT0*;X>U
zkYRAg(xPgk>~*Ve;D~Q1o+vva9Obn5c!cyGC|u;*YENge5TsY=+yy}6X8O$7)`|HK
zln}?dr&e|EIZsmIr5O1<A6?neq6%n6ZIgD?dmi@9w5v<2JIXpcVUa2RTCuAAysDaS
ze<7WIqYEk~tBBNiQOo{Zi@@|K+=-T7IH_v{m}mDwA;6KunD!qNXY(!EIX5+dK4N$T
z#n2zThylfm(KESy?sSVfR}*;ARnyy4D0;mNHyFRft<RO_Q(DVfi&ru}`67yc&`V)~
z6}VvuZ5r>f+X0cw;MYxwI_nTwZpm5}3?y<%PWMdizug!OT+EOH3-~XFJQskTYV<+9
z*Zofvr3>4)(buvSbajx2mW&99smBv#A2GfU$YD$U>^ERN4H{4IIrFuBOwqzOSfKnK
zZkRb^J$)nFM9t};QhRR@*WHp4Zpy5aHmeGXz~C)={8qDbD?F6(E7g2h9^-Z6M~qH|
zj?nA*ipt4UNwp+ftjU1Z)mJ}7O;Nbnn2N_iU#!c`4{c?fT9*mh7A#7^rRiDeYo6w+
zhh%|#cM3jtjQ6T~78)1jP$KmYg|PgJ;tfFR@IbjW<4tt$!LKt95~pAS50%|W!nQb{
z^p?|x?)SLh0LM+oQaWSAW(l&<?$Xp>2OFAxZnRTE;+=|3X*yH{Wrh0&cJ+yMFtubg
z<~IeA>WYy#@}3_*e&#0lAd^}6k>a<e%$M*#5!D1>y%zccJY=C^Z7CO{R9$Rd9zUPr
zs21|{CCifsnVQm^t{PxvD=T6_!i78<yzTiUDc($k+xX8q4i6jJtYSMw1XOSG2~eYy
zDC=pB0|G}?6`W^V7!NpB7AwC?$-0Bh*nCu@EkpHI=Ked%0&<f-L~Vvr$}UcY`GkR*
zJV*B>BAEk8GfI$kVr_{MKu;l4&|ru4O^BQ_soifRNY#2go?MotHO6G?C?f-LB7T^a
zT<a<<7AWFu+$epY)bvBIukx%HuulHxCWfKTihLk)!0D>+CIiwYCF@Yn@iMTEs^dw#
z!wI@McDVbetEXUG`eO0~K?LV<dBoeQ+)|q|CZW#yV%H&dOIl}(bY=%G8iYI=F_*Da
zI)M4f;aOWfO<^w&AEV2+gx=0gb?L5q5cry*`Q0B^fX6jnHN#u7)C*##l69iJY_=KD
zLho+n{BV3T2baVaWktQUq^QG=S8-)Fn!$YXx?K*5lajfOcCv|Qg0px<j0AoU(Iu4a
zS%OuPXyoa;!5nhZO$C~26?UUVrKOifzun`vl-A$AOI*dd-ln3<e$fJjS=(t#6TN@P
z(z`=-JHbCxsrSyRGn0C%Ua=kfR>g3VN~}vz=`>is8fjVVRLM_G4me@-#rgev)>;EY
z<;?V6Q(|z)u16Q6aTuBPER#KymYTgzY6zz4JpGjx%gQ^M_|v@V{gsKbgh$Gk%dPq#
z3vlr@36QgD=qs4kq0!(TWQYw!jyM|xtb0Ho9Up_kQ4tFa2tJ7^4CyUvD2jkFRoX0D
zn$orUeccmblONU?oMzIRyD0op5<zq;w~LC>iCCATOy0LFo7`!xCe}7sj`QNCOEk%O
z5|zvY0>oU=z^t;B0Srqk>thPa>*g1yqFU3W-{zvK3eT*fGh5f_beuyo+r<CTv|`1d
zqEUCttkb?Hi<ObpJWp{_{AQn?35j$2c4#Zga(j5Fv@a16i~)W`1*_6~TQnJTm&H~9
z8ZoN{($~`f)KfJb!>;%NvPlvA?=-kmjeQ$?)WYx^u#!yE(!|@P6G~mESpOgpvIW6^
z=!}r!G;g}4g;Forj(#q$V+HbVUe!;y`Y!agF{X#ac$q@OA}T$2^;(cx<;$pa>f|=x
z^O%wLVM#0Xm*2*c>4HrefmYwOWpCU1cIlX1&4YF{vKXP@kJDilYLot89F758=S%Vo
zGK)i|{r_w4yWiRV{`b3dXi*fkwY6vMRaCXq2&J|LHA|?yN~o&6Y7?uaqDI7u739@g
zHA0P;wfBe}E6C^R{rbNDgzs<fpB~qh>&lgrbDi^e+>iUd&pGu$u|M8yZf|}xkL%9U
zywa~lJXPaTqZYR34G^@WQth(hx)p>=ZN6p`e^VW+{slxaNSm8g?W!}4Ay(K8fT!LS
z7sxlfz=!PHjvUcx)n%)WAK^@yt;sOE==T7p1_ss-j0tA5(`GIE#<FrSH{-qhY$^EU
zoUWyBsFdeVg_Tz!)%c0=E=PJ7jLmHHi8**L=8h($JoWpdiY5Pb@FvIr`jmfDd`#3g
z3DizVOL}mk)7v21*QOAZk%gapFk@8n7!W(RvWax32teK#c=Fz?_{><j34Y@7S<z9C
zmYM0%4ph0~3x{3)JH8ijpRS9dSj^ZAaPS+jg;z>X_=$ygQca6CqlFFDmeAj-D(8#K
z(2me*1q;56nv#;-V(!|OiF+@Dt`B@X-XTdTS=dF}YOh|F3-lmh+z;s`Q$)$;joy=C
z$QuET_x4j@0O@Y8dAQE-S0u09W1!y1&tNRp`dKp0Aq6rBJ+aBA@YjOzm9VE`v&uw$
zv?rR26vVFUWH-FiR}mm&1lG0eRpHrmt~yadqrfGN*D9PQaE7lm>u_KtEgXbjU8tQN
zYva*R^e#Ku`m23t9HC@WTIoE!Q8d`nH3QJ%e32O!2>D{xnFM&mS{n7TI6nJ!1c58S
zh3Cb?Un%6u7KHT(STb=?70+wMhJp<PC2;u~F)@~o&sP3e)4xU6?q%`{VB^qg`%5_j
zAAReKCuG|X<Y+Tqek+x$OMHvCF{gPiqhsgCQ)GAy_rU6san2U&JL<2_!YYyZtTl$#
zAg$16Pa`dCS9eM>0pWo`jwKBaF-EVk8)c%sU*B@AoGcr>N<o{{X@k8c6Y$#Xlkm%)
z#yg~?D2~W$>r5!Gl*od6)1M<GOe$5e#^_pU=KO-OLBj9GgK&xl`gbv?cD+GaGPiuh
zr<3pUs{VRCYHBK>e;00^cF}#bSo{mroQoBH116k`u;dJBue34C%f$Ae7g;Z@h14gm
zzx0bGe=^6xd~e(eKmE<DLDZU@u)B<H^I@yo0fXahx-y?9!JNNf>%Y_r<TYAF^ZB)&
zwoPdp3zi0!3(}uD!bC&ojB2<4gVZ;bcV~m8-ZR!5;ua3J5}QlF(kWfR$%y96ms;_a
zY0jIBR~1uhHF$~l)fIDAe)CG`%dxd2k4mKC36av9)(*Q%b`Rti&L<HlLXmWNnnt=5
zw8>c)NIk{QentS7dBLa}Z^~)1m<nyK>0>&b4jW$O7llyiMKIyFYq}ca%}-GxdoB}#
zv%)TtPkwcu%*Lo$t|W1Jbme`4RJuu-jJc_cRI^mHw>44s<WQHlY?lb(zs<QZ9>k&h
z%(YbbO%u_$F^9(lZ42dK3&we%?ri@{D-zV{gwbVepJv<Ch&~J+k@}f~bR%h~eV=F1
zbh+OW6u#Z#p)I%#oz9z|psD)ptpcs4w8Qk;Z+Z#{!(j*-XjevR$c&6rk_k!j+}(c9
zz|^kl<q_VKVX21yd+qEpy(rp-p2vAA#~}_{THK!_NNT8tbRHRi|3Q{*8M)d5t2aj!
zed>njPJUe2R<LEdwAL5B?-euJzqtB9GrdO1C+Mi-IS+Vc`T0|!&Zp}y8K~@@coa&V
zu7<N~t^TmSeY@@40o8TQiN#u|tNk^~?N%R$U9gqDAwyCzOK4_`lM8cIUO;Rs<En+F
zky%-Tv4M>&3Li6XR3&lR#aNHA_$dkS8Gfox2X*vb8tL>wq4kUe?FJjjn?w}fHFGx8
z2QQoohKn8f0^9%owf{680b8-*PfBJ?7?#ST-<cIpXIe{bjaf5l01@Gz!5#^r@45X_
z40+t=N(QBhaDP$_taUrTde%6c4jvK<uLrEiQh=09HX|5Li)W1Hb9dtaX$z2?{J(?-
z8%CW>?<Z<Lx6{a;Gz@vcJjkiKUtan}MtLB!S)p=`%M+BwmOwd3RgXi-VDB6hN1<f-
zIWz|?P16g$nRF3u<c+DMPmm+{hLav5Hf?QLqAGk`d)0(NcpzD%fKJ)|{iO+xL~Q|&
zw}UH7L{~Kp+2PW95Mi~-PP{UyAWSC#v|k%Vbm9a!pW@TD1XHcQKMFY8YDV90_*S!@
z$*O=~Bk4~qeU-$I`6M2!bF(CseozkF3$v<zhdjDvrF~jlnz>z)L0AHK2|xj+SV5|3
z`8YQJoQxU{tU!vk|K<4k5mXHq23Jmb*4rbsVZ>IU)v21JE;!Q6m2CBhr%K#i36AOG
z#ToRPl^53L6wyBxxiu2<r}938W<B!>$?4~;>lw?mxhaU~GZteJ+TiOaiT*DaFlRKi
z00OEiIlw4?xuNIo8;tD+R{|G;4r$x>7xx4hgL=#vpjbp=IIpB~3fT^|eN*Q9!f45Q
zb%IxH)|&YknX<npTNtZWsxGeCXl{%}{ARIK*W>S+WO@1%SBtzx8g0crxNynuruI1#
zYb@Z~4F-eQ3!+u=U)MskHImoAsp}}}qYlark+#-oY(38XOK;h?Z3A$|-q#hS_+?!+
ziYh}qG>H&PvPqhhC^9wDT#YpSD+3d_#T|t>{i9_<^(M^N;ojcZuP1ER?lNj{7i}Ms
zk1E~3gdyxRf5?bKv{+sYRa+8xULUT%cjW2yXg%Y*7{WQATmt_)Iv<Uv`c|sbokjph
z%~g3{&d{Kxtv2G!kSPkcv*m9duhVM96AYN6_e?(Sh=qu0u6C~#FHzcsX;x~jX2Qc!
z%{pt{_nlb1l1o*;neh`_pJgonqfqtb^nOvZLwsvnlsDw-_hIQNF=Qr4$UCgyM)~`)
zzqDjNWtODU7Z){&v1kjR6)v>k2!r7D!QFzM!(|q}Xn41Hl$&xyWO1t#EG_6&?AMQj
zJuF;t55<HUevXN9IEPL#;9rkFw{;8}LA1X74KMf}f4d<<tI7kmZWiC_#gstb6OVU<
zKoTb&(zYNFiKD7^t6+ltP5ueb7J$R)7E6JIcAOpIyntx{{3FaWYHoY?R02mlb;^`u
zH6tHt3YG~nebdI<H+&(y%Y(A;j$qpj#^}$czk~%XGCr(V=R<Z1!1dPo_|=m}Yt0m>
zIwec64R(tG3ley;KwIfKqpg;Ii_K+NXE3dVKcZW}#yVbRl{Zo1N~QLT?%bm8@pyge
zcFQsy<Gm8~3h9cfwX|v~PaTz$zvD}9TPpqe2bQ5Z@MPJqcsvF^CZ-xNrN`+Kw(Qr6
zY*!+~j5F={xy=0QR>+3mpO<4Y@`@hhTnVn(da3ozguDF3JoH%fpLKFRn9UGdu69$*
z;B1?Izq6y}oK#e7vc~wO6`8w98eIoJ>%Dn}?s@l{BQc*-Th4=QWhox5LSRKlOuYW%
z_6RtFTFo)5X{+y}P#!4sN55AsY-xxwc;1K%10$u{9$(<#n{q5hg;-hk5nXgKu>f;j
z&snjq-YKn+ES6l0b#+cr#5&WV3jPS)Z3l}4ZfY4=s_nMROWVZhe5yIRvD{j=uLK)i
zJ+>XPhZA&b>l)`YM<dLJtB*J)hSbl_cdmz1?QLi0L1bdPOUhIs&dX<=)rJV-^-GvF
zf547&VF9{W$;3bK#9D!AzPz^RXOTZ)k*y!>3a`L!6^T3~Ph`!Oq9uB5W-k(IS>HiV
zgcW-4%G&XLFsY32O5)8mFWv2`&hukz&of20z5Dx87WU$nVfN3`iu=x~&JO-EV}&CM
z+O>829=16n*F;S`tFJ;r!Yr`&ngmbRh5-U&agc2DSx|tvlV`!ig4ibtc8+nnNa;GP
zfso-{O<CS$YK{Y>L=m5Q*UdLt%JB>mMQf_NUI{`xhObBUmpjXghH}5Fb+OGBIkdM^
z3)6K{`LtRV4+xAytQTr(sL$xpFvm=58iY%3>GZUxgNh^H3&P6jdKIfqpwdN2a6sj3
z)D>I&<XOs`K3%Gnn?66N9h6{)?)MkU<(}_D<N>~8Gn`wK_K_+P3Y`op-wAohHJh<y
zu#yWZuFNxeV6eTRhUl)5y?<b(3oeyHOWUceTeTTE5qC{9Xm&JyR80+klI3YLtLZ#p
z&hMy-&D<MsdV;i;e;hf;e0talxypz3zK$W6<U7K#o{=kF7MYAj2A!>ou*Qvi513`1
zK5FmY)eN5(&pqzZWLR(zeqZ$Wsyf5Ob)~zLQivAJ`t2~QYi?hkmdN_-L|0jR*!nmR
zeqiY^)A5eZ)gHd>LzXP{jycX$L)~ry(bjF6_rXK$giXh3H<Q32#kuP;$5wzAinMVF
z)Wl6{T|eb7VGH!q!F-DUskt?aJYPea4^G@{wDIdSmS^v{fPV80?qdD=56nFu4KbD2
z>V8fM3^wv|Wa5I5bqVVK9oI#vEbfvYaqUc~a-row34+`j$tIbgYtFZmYp_dGG@tcw
zww-YT=(ee8R9!lYa?`{@A42#==x^~QRQt*NCCytX?u+yqcuGFiHGPVm4!}b!{09`K
z_Y!xwh|vl2HW%zu+9L+)#pVZX(<LbnW@pJMbtB?jL3Y0ney<nL*uL-?@y+$Cy@x_P
z52`?ot~f@zRSSv_Ey+|bxI|7BeW4Vs?jyFf&%b>TcR!Q;8!J3jFkJxhO)eUrL<TbB
zIeV&#rJ*etRjGlGw9b*n6I?BXE~tM%|94qlT>5Q6B3Pv9^h762X2k>Bro<zF!6fgf
zmBP8J8K>tn+vPYIX4kfr`o$<qmyt?LBlix{wnFK1QS@_Ui|;6Q`bYNS<~865;*~B_
zCCOsus-dg8;(LEmWuDhH**mac<T*MitCA~O%Ur_6W3e@5P36aKub(i!tD#s`vBybb
z^$gpjw?@f>9ez0RUdJ$b@07R;U_RCE5|BY)4DIrE+wbV2kZZsk^){9`<}$34zbR<t
zG?Hg78`XT>`p%6AIn)MT?R!@;Fj8tW!RId-Go<L?+^RmT{pY|->;t=IoRv%$isAEb
zWpPoVT3AUkqY<(we5LQDlr!V}IxCtm$8UHT0iq!<&HvNku`%w$WA&(LQ{|1@?nj*Y
z;Kn^n+fda-RZ__FnK#;2Z6+XGpfP^T@@urh=%yzH?p~f6Db$xxI>FA@mUeL6igl)*
zvC*xHd(wHgl70)+^iA?}D6}V>lNF_-MOYi3{?RW=8(xEharT5YHsZ$Iqhq-c=<wS+
zanYO01DWEuJxz)Qpry3eFWsac2|FI1({1C~qfPtN(=3~5+1h$g5jwDLD#4i>)*<WA
z5P!j%4I*cpS@x+6&sXBlk9-1`eb~>M;?MU<0XrRm8y!Ih_M{!h?bo>{`mk*3IEeMh
zhUn+SWm%m0+&XTwS`sUl=Ck;D_}MZ8NB#ph*~%*;mIWiAC{}W#TP`{)WS^O5VMd(A
zzV7e#eyAoDmH<x!tDU*~x2+(d(N%pVtKOm=Pu_QmP!|&;(T;}-jvMhInFlI<i+4{Q
z5jO)3x@<2NeP)<+^KJ@qczTJ7bjW@_>~eO%(7YWgiB+Zov@cY}q)$*i;p4)q+W7+B
z_d@p`8{(Y*Jk&wX!Jq0f;LiBuW$)qwBI=x&Xw_*N3~ohAbf<wpcjC$HB)ckFFeO-5
zRsVmO*2PJvOt5BpR+8?L`+-+>>KHRUgdO7u*cqDv_PQ}eI@a|Rn4u7hqtKuo6{Y>L
zY2xHGvA++x8LmiFfxtr8E?fi;#3SB~<g#gVY|)r#8QUKG*6p3saGT&1=s2T`yw!83
zYA#27rKDl>4x|ZxT>e88#J%kIIeA809Tqe#(Q9GlRQ?SD9rXTVl42=dhKW^k<vqLn
z+(!l?{#t{k5U{5jn1{-r&^5-+FKZYE?n#p-M9$|#&WNO=t-zyjQe0GXCkHT!x6kNA
zaDBVJh)RFTniRhjwEY4+%7%LBMki9wxb$@5^1{h!POpK$Gex^MK7v}|X~$z5`_zG*
zh7!iZTpw~uRwEDSgrn=_rgf9-+Ov|>9>3$C<R0tPvrVx4zLaXU`7^CDRdR`Clj<_Y
zeZ~lo)MetQ&+#Is10rYL7DN<jdr;{(DeuL;^H_$&2PmhxaeO9nk8&f+cx3()%u<`4
z`EuThT;#M!lyBR>F%kiy`mk0l%1GPXE`HsB3X161kOEU_M#+ApaVaLYZdTp$_FyhF
zl1_8ZsWe~SwSi@K3W$F=sI4uK{vsBZ-?Gt|!Oar&Qaus1Qk~m`lFi8ND8Dfk825hQ
zdaL#tPAlOKpBDE25o}qlX{6IWi*~8=y`W<q(soDCsV$)}@TBnhl$71h22C)=pn1PQ
zq;sgB2Dt#77jjPtpES&RHeReh!8eOH-0}GXT9}b>gu=cXG%@>cJi6*JW=t!R2IafC
zv-B!eKR?26ZKMb8-WKI9D!yB}eAA|JZN`hIX0mH!{!zM6(&u)0^_YuI_Xi1FS{wNN
zAG4!1Bh1N3s|aWS(z{J{K0^hcs0WflH5lEH@d){7Oqe(yKZ$%VQ@wKYQR^M`UdH)`
z=Ym}9YAM)VxVB>KtqR5GiG-=I?Fz!W@h*83{_s>Ogrv8#)7a2+{0`)%QB{@Td(Hcp
z+S;iq#irQKY~3BQm=Vh&_LRO}R8y{;SqW-DjIwsds7(6^2f&`*84=PhX*g78G&jG+
z?P^$<3|GqTxTcnS$X<4zHF{&oQ{C#RN7edn@AvT(qp$fOCNs|@;d}P5VETSk#Uj`I
zJIdT#@Z^wb9#-<F`)_E{=YxV3IJdV{u<&i`7MknhE$zrK&}s1&8fbcbJ}I5&iv;dO
z2kE5+kq$}AI;XA6q&boEyZ|epCC^6KG@t324T0xJ7Yyx3EH~@FY92ujWRgrdGd|o4
znXcQWcM^B~o7{6G`r=fZl>RZ<kNvD1)*xSS@?`6de41fp-QyZAN<^}-cj9;x-37Ag
z*VaSV?uwp~H`AV;xSX~Joe`#eO^&ij=SqQ_%jccQ(@cx=4SOXsMNyz&XwytZHq99c
z@gD3b6I1N-$>(a*@3iqx(n3ABA*j>_o8r6nNtqKU^++qH(M|}wm+*3W*ztFN!;%1#
zPuQ#*XfF*L={Dh23Q2s+O(jX2aO@s3(&`U?D{6Nl3=~lQE#OoPC?LJ~Y&Ih~=%g?3
zJdH%aoUG=abna$<1bSCp=J2}kDUGCc#Tvfj5D)9b(eiiKRS*NAHsH{t(cJ{&U)CXD
z*PgE)tJZy7Dm~Jyc_|t2_b3sWfUHEP7~fcI7{7x=dY3^-{bwP0hrK=0GG<MjVs>cG
zyVd)bGu^Ft+u_`X>4En?i|e)Z?V>{8mX!g&7cf(QCy_IVfPLKo3g6>;(neqN{+<%4
zFKE#y@R<Fqr!Tqo3zHL?{4aSz;J04;-yf7L7@YTZY3A;yAesrE@?r^5^tr#uXTH#T
zh4gZ-CG+_y*xnLJGS^Ld5k|*8VG{D-uvkMh;7x1osO$+|JOh~^C6svI<JVX&&3%+v
zc-3;GhY(U}%}^a7^kRIIZR9?nR<9kPi9i<KNAp;m@1~JvsLn^0l}N`*q}{Y2f)NRy
z8?d9(T`~rJS+LCpq+x|AG4f$Hlt{tomZ51Rv+4IWMHHtkEyck#kC^)Ao5~wLIVT5t
ze><|YW<>FsYt?E8rq4)Mu8@-7DoF6XkmfI)f1YkwxaJLyZqMQC*Y9!~{NCE2KCW_I
z9qMFYHg_@?w$mQ$<~YP!L2ndYFuCgzmmdGnRL$4skb3^oB}y9g=gRu5nN^V%Cfg<d
z8Mx=uIS-|SdiJB>Es}rG;Z~YU&=F(vE)JP&<nj2|Pk$L<Y#NYxcD)_1z1`A4&ZZ@0
zauG`co=x#;xrlS2k(N=7lMX%x__apI9EgZrB>P^v(m5ZfuSeW#vhmw&#g5-*{`jm>
z-$p$C2nRXtJ)zs0^%Ve+vUKwS3YoISGEHonCW5C4;MEJbOwn0$9J@v&D&BLH@`jm-
zIdnPhG!*__I5w0em+ThsdBSHeVjwgH8!m7%BlGF0Xgy$FpzD{w4|*1~#Wi;k%<SZ8
z<F%w}D4D(X&h7sT1{VuFTwQ4w5RK{M1StRsc2~VYjx9=d=+w%{j&k)`aNQd&kRrda
zCiuX^-E7pxl!BGDBdj2CKDSuIZgR==h2Ho<1(U^~4R=p8cF5&6XI^%SyiZ0`rb&`8
zgv4`fl3H2;PB3{ANZ{WtnK-5kxMSYVxnTW<?Y4-jxfUzug&Ty;bbmG|u~?N@D;zUB
zrUhA(celC4szG&6i(XV7pO|}w8uoI8cQ0?vr{13u93H3ev(PmuNqV6pWOBQ~5sF)J
z&|<T$QA|K&e<I9={m~xU?oR*Fv8Fw{3DTBC>AuE3>}Q>0MiaiT9@V-SB4+_)o}zzt
z4j|#h{CLHaoUP-W-AF%C_s7BcKyM%ig0LlRfKTnNuu<&Je)nD&u(61~f)D51U}@&#
z?N2Y7){ih~)3=i6Xy|YFL9bk%)Tc=&@<G&sS?@45A|k=50&cV7m|dZyJu=AQXgIW1
z27~Thou2iKC^-zaJm{JrNF@rXrWk~Htrk8Qq67Ac(<1&vep}$^e!!tm(4oEJUPin^
zuWpBwc?=5=kkOsp4VVUZr0d~KOhVK<)QjQKvQJJ5f5PpgpbB}<(xG|?GB@>@C*Fbw
znd|FGx4%Lus@Nh1QPj|3US#BIvQu_J?Im{&go4oA`B5>^4R~*J9~Lu=E!<g^v=I+8
zwam61D(l(|^aiJ%hX{jc0H<@43joIV2Ea$>TcmTHpc8CgSu@Z)`9Aith6}pBJ@IK!
z(|Wxz?^KCy4SSOQxCNXpUOhx(3vV@<v$E0uwO`gCnmL6O-spFIPL#{kFsxr^-`dFi
z8FTDEBwi`FY%4|0cIyLI4b<3?{;HIu^yL#jzpSX71FrA54a<VuB_7PwOW_Z^1tzE#
zzdz-dFYIZ6?}2BgZLoQZ*t|7y(c4~Naz$Sg?bpqJ<&O75bf9amJ8E?W0X-Ci{sMHh
z)ukG`avWeop&_F;NwA^-2F!!TZ=)goZwKLbtQ(TY2D_G;(csaS(NOAt`hyz=>CA*F
zI_N6Lr<LO&vc)h7{-(%DjQ3BM9T%@sB-B+XZc}W1Q~%<y5s@Hp)EclqBl(ElrRL4d
z_)+j5TW??HvHeJChOeJ}lr<B%8znmh1sypmV4V`XyB{doUyTmlFt;$$|HB>W=QGZ=
z{+cSW6jEbmuA7jUy`V;>lBvi1IHfeFZ2#1-jis~$8TS*}V{W}c`7ghZ>klEE$IYwV
z<g)cx>@~}o1^<!cbf;M=Gr`l&N}!5{>r(l=byM2!DOH#)?FPS!sXrqGaS<Q32Uxut
z_>lT&55kl{xD>^@P~(SvfUQ-FmX#NmOCDL7)!SUcU;mI*vGHD{r=I%a9LR3emiW|v
z87pnoCMlRSjf?-u**qB)RQpp~nd`dQ-FDYKD}yw$*9JkEO+9>pb}MyIat%}LBy|JE
z6vIB&o?sAC98fN1zA~D};}NHd>j>Ie!Os%Lg_nN{)&xULd_pC>kl1m8X!P58#$rsk
z3<QFvE?H?&H#6mK1Gc6?VwTV0f3%ab_|MFB$hy*TI(ac1-}D*?wc`Bphr!;r-q{RU
z$f$#JZQk%w%&!2b1|17%lYyaDz3XHbYSDT_U@o7R_FByV%0=7yYf-oE)!GESomf7%
zI_R>(&xq}16Jf3@={pB|jSk3x54{79rhE_LI*=M}vMQ*Z5`RFDx+}*rvi$9fdC=M5
z+cy0ANFJ`}9I@)i|6Eu7?%PLLH*vJ)@~bR3N+COaF0YO1ndH8F@vmK1uxXMNnM4hl
z=yd)hqu6_&&xtBH=(UpdgH!Gr)cxK~-gbk&(*()J9N-<fn`*^~K;;11LhD>%9hMm*
z$$8^n$WjH2D;4IG0H9H_-JuXIIorGQC>G0c13t8=jfuB(Vp}oOd<dWYoiM<h@@hfw
z`OtKhP~??vF}R?ggTj|AA>A{d1O<ONV!xI^MjgbdNbK0GhDDN_$#LeOdU(H1R72>%
zN%474ChuvN9YE9sx8>lk1GfASz>RoQMBu|4;0^{l^ww{^1|cm-(yMn7bE=*-(T}SJ
zPBN2+IfZ|XJu$_sn09Ku#*Fkb-fU>Tj~m*T6BfjlhY6{R`6>QrH2faAJo_?=RYABf
z;_ab!+)hc;+gfUjX(bqN&US6z6~A=pQWoVS79hCFdCCA`#&g9L2>-19nFYef!EY^>
zfmo;#eiaDX;gmOkkVVN#2?QBdx&M9ff0OgSmGi&d@xRpZzx4S3yLR-FfH@|SR+Zu{
hfuwu=qC32LiOAY`bQ7=Z27Gc!{e|}PvS*f`{tu63_k{oe

literal 0
HcmV?d00001

diff --git a/docs/images/pr/chat-image-delivery/click-enlarged.png b/docs/images/pr/chat-image-delivery/click-enlarged.png
new file mode 100644
index 0000000000000000000000000000000000000000..aee0afd560cf64ca31d5cf84b2cb2eac0a3e5cf3
GIT binary patch
literal 4496
zcmd^DdpOi-8-B(iIqYaZq{F0k)4^dwT4p3^JGv-|8WkU<NI8sTk<)~-rL?UM<kV)Z
zwd7DSD9o4~3WF_&avCHuc1jKj&3x}WnYKRLxBLC~UDx-A%jNmK^ZuUazVGLLo^g8n
zw#}c(&65Lw&&;-L*a09>hkk5lN}$NS#!bNhv%qY_Ivc<Efwpzu&fhuDwDSimqWW_U
zdHNT+2UX7QlO6~wJ5V0KQ&;*_#&snw?V3@ZdPQnN^A9()sA<KX-xHnd;-4-l6m+Ch
zc?*Nb_Qk||&Dq8N@?7^=?ONgF+t(c-f;YXqrYzya_(&Z3HP(He;qV59I|MBRdP2kD
zk^0T5wT-nV{({M#Dpef^L2pmhm88H|_iwq>nvC})GlZl4k_TftT^`I0CT2!x>^bBP
zG&lXXrWAH9%XNkf3{*VzT`DC5`Ub`3#D{}scjm<Ch8%}&<r(S+O9^l#@cfmPod8Ee
zC81K52#c1HfgaCA0c%;J;^MZN$FB6DZ%32DQbV*y$FDqcSq}2I>uOmKWh(mVSvPZE
zX-Uym%pRxob!GWy_ei}AE?yib%hHoiehQ9_#wij|oK_V}16`L*%xK1&w|e+hOG&_O
zb=^h-_;G8^;~fMXdH76SnVDe6)>B1KvyUYqTvQzby(V}L!Ebt8l7b9KVO((JR2xQh
zmPM*|1ifx+atH|;iu4o?ws@8VO=O*N%0_Q9e_f?hVjLovjPoq^pBO^d_~-w6jv*X-
zXu0<7I4_H>H#6$A_ji(9HNkb`Gh1EUt~w1xGjem@bXm<L0{6F?XJij|g-}WQZvFO{
zNF%a=7VAP{#49Zs8Y4}$BHlzMtJYoN4yEF3o=u>m$#4Bafhv7>Y>h)lQ?A#7xfSlj
zy_!SU452S@q=71=&Ts0awBPmjz9_R3F`(Vn^6S`O#lnz@-x+ZZfh{D@OofU?WarYH
z<*>3uD3}N+3C=Jl&p_ynT0_igmY(F#^PxI{8zWOgU}oIt2)a18RZ@3vv0fb6Gg2Ck
zGV*NfK9ghq@P_0z5X#Qd2JdIyZe1Q*$sUtYlr{qM-U6Z0gI>q(u2<B-M2AYREFA*V
z{}shg%6H9dtv;|_nH08pm>EExRD<jTCNhdWT{_@g-B@lnphQ~fAvd`Kj8#G;7oLbL
zL6Z3D((YMJP#wpOSrrfs@iKcg!ITs3v_fGu#ONs@;kcCQxe_BKXlfQ>1?AZ|vrb#V
zvzqV^wADILOPd^Na$r9$$j|rl>OsUT0CL@0>Zzeu2pmOkXQaxf2(IsyNMMRZLSg+`
zppg4A)EXSq?>q_o8o(|Gkw5)Y*Hdi_YVRH2E)Dqy@U?{jWPnpuLFaSih;bUgT%Biw
zOH+YGd3%sbfr1P1@xSS9*!gm$KP+-GmxjvU^K6VO<lw;jx~8?tv_Si8d9W#OQ$$*R
zR{}=sVD1D9BXNV#OEHj@fLY|Sa3>PbH{Qaz8$@hsd8>TqYsjV@Sp)FME$!pVY0f|U
zEj)=E6TOXG*Qu|p<0%QmV`G=*;kR(m&75lGtl?Gv-ps8mmR?y)70~A|9oy%QQ0QG6
zY|-<@nxU6m-F~1iDG)pj*-}diRIKQ4v;^Qg<C+Uxm7%#JdDP&)C_2+X2KFSQ42_zy
zZmXi44i1$v>gS@ilESw%_8%_QBLbw1cm(vwx}WL2FVqM68T~1U3N%Rba$_aHg=3Ad
zIwA}p8{d}z<9PhsBk3!Z?$3bRxeJxblpXLt^e9Xnm~2d0L9A4SlR7e(3AZ#0$F*gb
ziBKJj6ziClX*g@#b09&C2QnIZic#n1W|-smE;o%j94Hu*hd#HCrY}+2oKXX7%pU)q
zQq*91E%ik)t@KVSf&MU{UpC?q(4}LTbBQ$wRSv3jk#Co5gzF5@z99Q40lNg;&!1wk
z(*7))j1W2bdqNWLQp;KbJqAk==cY(`k|QtH{pvy9a{_%X<w^9C=tP>|KUIMfCO#;#
z>S&Wy{X`oeEAravEf(^@wCu9nAN_Ow+m5!~M^X)eeidgmv_b{A_52nckr)4I{o*;$
zY7^RBtksO(z54Ce<R;h71uGz1IaM*Lf#4twoKP`$q7J>As0K6L6KB7_7CZYladA3-
zEg`DIWNv|J5b9(3T`~w%z~WycF8?DRXl#jFIm0qr0#q=KzPv6SYM2C6<jE6H65s&#
zzKanL7XZ`B&aUy^nss{oktGPtd|r?HjQJ>P{L(#Vj}$Z~RqQ9wTTPUR-3q|9`s)n;
zvtGn_iOBd<M15FT`qakt2miOt%41Y1>P3k#80g-w`y0~taWE5?8u%i+_b6IZn`1T$
z=uC~Jq;3H1t5}5$%Bm;))aDxm`pLaK0$daM#|Mbe_4UgpmQNWv^8_*JM?e4hK)c4y
zdZatG4Pb9eNuAa*L}HXi`#)zut1e6N2%?*8IOwFQ_&hd3Cc+Ah)B7XKgzJw#;|7p-
zF@hz4W+)m-Ta$rlqL$0p_xHvK&dWQO0(JAGWuUGgIHd?Rr)HdL@i`7Mmt~IVmfO3i
zN>N?_%WwF$XjvYzHntQb5x^#1Y%E(l>wc+G2C{b|68xTt4tA&6Y~)p<=g5@icmgOg
z@Q$_3v37m3nmPg0uv=HwsFO*H33N(}i}^u`35~pCXuq+Wlm>I3q7!u?PA?RuEQEua
zS-U~@{FbYq9ERd?$tiOHQ<sV2*{FAp<uPKP;N@yrBJHeUaPjfiCzaZJh!EdyZAtzK
zc@$HMLpy{}^~IGIC|Qy%^uh7;CwsxD#k?G0BpS>7{iJe?h}(-vyR24$EZh^1tH8?o
zD0{R@iCnDpw1cH0R9Ds~YR3+Tvxf?SrY1fp8rE^cKU(=-lVJMWzKC)jr^$e(XdqAd
zqu=cbK4;JBA_6=TW#x;sh|Dbb^faZ2>wmv4{QM8nYkL+N1<lVr=M`;}e?dd$PY$AG
z5XUruHv2tySf{-s!(e)7==OKwYcb%np0o!3wS)@ByRvGe`_l<vn{9+abwtCn?*sAw
zu~#$N+b`<*g{r_WF&OT>sv!mQkZAJkY0DL0k@t~OuVmwRK0s7g*UhDT*)w=sgFvRe
zj;DSzj-K$0Z1@tG0%NpVJROat&2d3s?Em{B|HwtB;q}QtraYE@{!KMaR3!JzM`K6q
zbgFAoZu&264ATVW670%NZEOPQ+VKO<?xZza5TISOoMGZ~8XjQf<GGzy6`gQLHsZ>C
zNtlZp*MpJLMcIW`uD@T>P@XMZTgeX=*$7SsPaMtkcWc-Gm02aQ!@C>OsgetCYgBD6
z>QMB^$y{zrb>W0}-+hy8&MLg_XrFMap}|@cx%T!wmWwpc)uZRi8Cr6Ywp9LyM%Jk=
z%{vq7vvJ?&ya%F1tTn*AELs~MZB&uw_2-Cft<p#oKxap6wGiuEsZrxq{f-9jKF%sU
zu8pN&7|qQN+9XQADn?lN1Y4cAdUA&T0eh=#oa5%~fyk1~uzH7CqzgV9(Lq|NPme-{
z#hl-Eh@Rg)kIkT}eTQD`PmZF`#MA6WtGZ`of^0|Y_Ni0i-hJ-?VnuVDa*!nkG+|#i
zYKh#9Wr)qrqj)`SgfE|&(rqQG?PO18dTJtVYzi(b+v>urXtN7BrGbD7TehwefIz|j
z3qYr<Y^h?;4D>a9SDh`t5PSUe@6kw@eQr8b74e=M={2VUjmhjHo?Fq;IJJPm>lPv;
z51)Bwjb4T=Tbp(j+mqFJ{a1Z_HZ(ST&FlXzDlb!95&vFRYSM!Bly~@-);Bi%w2Wk+
zj`Kvh_1?~OORK(6^7tLWdH4^OhKQB2%NV7&;qdiytVOUXb6o9j*c0U8QR4nmub}WP
zPe~nP?GBBDHYLs7=Y&P$A;z6Aa(q;7W@e;^`s8N#^wjlvou!6s@VF80HNoyF$q(3l
zPGHh)Ad*aH81FEZx=bPJR-nP*;mRiKTbN+w%SD+2833WMfAP^f05AiCC<$hqvzyrE
S!^m6!%r<V@kok>c=)V94XUhTr

literal 0
HcmV?d00001

diff --git a/packages/ui/scripts/markdown-images.browser.test.mjs b/packages/ui/scripts/markdown-images.browser.test.mjs
index 35e4a36a27..dcf12f870a 100644
--- a/packages/ui/scripts/markdown-images.browser.test.mjs
+++ b/packages/ui/scripts/markdown-images.browser.test.mjs
@@ -98,6 +98,7 @@ before(async () => {
     'badge-strip': `![Badge](${imageUrl}/badge.png) ![Badge](${imageUrl}/badge.png)`,
     'layout-main': `## Image delivery\n\nBuild ![Badge](${imageUrl}/badge.png) passing.\n\n![Screenshot](${imageUrl}/screenshot.png)\n\nFollowing paragraph stays in place.`,
     'layout-side': `## Image delivery\n\nBuild ![Badge](${imageUrl}/badge.png) passing.\n\n![Screenshot](${imageUrl}/screenshot.png)\n\nFollowing paragraph stays in place.`,
+    'screenshot-saved': '![Screenshot](/tmp/screenshot.png)',
     'angle-saved': '![Screenshot](</tmp/my image.png>)',
     'title-saved': `![Screenshot](${imageUrl}/image.png "Screenshot title")`,
     'escaped-saved': String.raw`![Screenshot](/tmp/a\(1\).png)`,
@@ -163,7 +164,7 @@ before(async () => {
         if(mode.startsWith('badge-')) await fetch('/badge-attachment');
         if(mode==='geometry-saved') await fetch('/release-attachment');
         reads++; window.imageReads=reads; return (mode==='attachment' || mode==='read-retry-saved') && reads===1 ? {ok:false,reason:'read_failed'} :
-          {ok:true,base64:mode.startsWith('badge-') || artifactId.endsWith('badge.png') ? '${badge.toString('base64')}' : mode==='geometry-saved' || artifactId.endsWith('screenshot.png') ? '${screenshot.toString('base64')}' : mode.endsWith('corrupt-saved') && reads===1 ? 'iVBORw0KGgo=' : '${png.toString('base64')}',mimeType:'image/png'};
+          {ok:true,base64:mode.startsWith('badge-') || artifactId.endsWith('badge.png') ? '${badge.toString('base64')}' : mode==='geometry-saved' || mode==='screenshot-saved' || artifactId.endsWith('screenshot.png') ? '${screenshot.toString('base64')}' : mode.endsWith('corrupt-saved') && reads===1 ? 'iVBORw0KGgo=' : '${png.toString('base64')}',mimeType:'image/png'};
       };
       const preview=mode==='preview' || mode==='signed-preview' || mode==='local';
       const seeded=mode.endsWith('saved') || mode.endsWith('saving') || race || mode.startsWith('badge-') || mode.startsWith('layout-');
@@ -456,6 +457,54 @@ for (const scenario of ['remote-saved', 'local-saved']) {
     } finally { await page.close(); }
   });
 }
+for (const scenario of ['local-saved', 'remote-saved', 'badge-saved', 'screenshot-saved']) {
+  test(`${scenario}: clicking the image itself opens the enlarged preview`, async () => {
+    requests = [];
+    const page = await pageFor(scenario);
+    try {
+      const image = page.locator('.maka-markdown-image-preview img');
+      await image.waitFor();
+      await image.evaluate(image => image.decode());
+      assert.equal(await page.locator('.maka-markdown-image-expand').count(), 0);
+      assert.equal(await page.getByRole('button', { name: /^Enlarge image:/ }).count(), 1);
+      const source = await image.getAttribute('src');
+      const url = page.url();
+      await image.hover();
+      assert.equal(await image.evaluate(element => getComputedStyle(element).cursor), 'default');
+      const evidence = scenario === 'screenshot-saved' && process.env.MAKA_IMAGE_LAYOUT_EVIDENCE_DIR;
+      if (evidence) {
+        await mkdir(evidence, { recursive: true });
+        await page.screenshot({ path: join(evidence, 'click-image-ready.png'), fullPage: true });
+      }
+      await image.click();
+      const dialog = page.getByRole('dialog');
+      await dialog.waitFor();
+      assert.equal(await dialog.locator('img').getAttribute('src'), source);
+      if (evidence) await page.screenshot({ path: join(evidence, 'click-image-enlarged.png'), fullPage: true });
+      assert.equal(page.url(), url);
+      assert.deepEqual(requests, []);
+      await page.keyboard.press('Escape');
+      await dialog.waitFor({ state: 'hidden' });
+    } finally { await page.close(); }
+  });
+}
+
+for (const key of ['Enter', 'Space']) {
+  test(`the image itself supports keyboard enlargement with ${key}`, async () => {
+    const page = await pageFor('local-saved');
+    try {
+      await loaded(page);
+      const trigger = page.locator('.maka-markdown-image-trigger');
+      await trigger.focus();
+      await page.keyboard.press(key);
+      await page.getByRole('dialog').waitFor();
+      await page.keyboard.press('Escape');
+      await page.getByRole('dialog').waitFor({ state: 'hidden' });
+      await page.waitForFunction(() => document.activeElement?.classList.contains('maka-markdown-image-trigger'));
+    } finally { await page.close(); }
+  });
+}
+
 test('offscreen image performs no image request until it approaches the viewport', async () => {
   requests = [];
   const page = await pageFor('offscreen');
@@ -558,16 +607,16 @@ test('image frames fit narrow viewports without distorting screenshots or limiti
       });
       assert.ok(Math.abs(geometry.box.width / geometry.box.height - geometry.ratio) < 0.01);
       assert.ok(geometry.box.x >= geometry.frame.x && geometry.box.right <= geometry.frame.right + 1);
-      assert.ok(geometry.box.y >= geometry.frame.y && geometry.box.bottom <= geometry.frame.bottom + 1);
+      assert.ok(geometry.box.y >= geometry.frame.y && geometry.box.bottom <= geometry.frame.bottom + 1, JSON.stringify(geometry));
       assert.ok(geometry.frame.right <= width);
     }
     await page.getByRole('button', { name: 'Enlarge image: Screenshot', exact: true }).click();
     await page.waitForFunction(() => document.images.length > 1);
-    assert.equal(await page.locator('.maka-markdown-image-preview > img').count(), 1);
+    assert.equal(await page.locator('.maka-markdown-image-preview img').count(), 1);
     const dialog = await page.getByRole('dialog').boundingBox();
     const frame = await page.locator('.maka-markdown-image-frame').boundingBox();
     assert.ok(dialog.height > frame.height);
-    assert.equal(await page.getByRole('dialog').locator('img').getAttribute('src'), await page.locator('.maka-markdown-image-preview > img').getAttribute('src'));
+    assert.equal(await page.getByRole('dialog').locator('img').getAttribute('src'), await page.locator('.maka-markdown-image-preview img').getAttribute('src'));
   } finally { await page.close(); }
 });
 
diff --git a/packages/ui/src/markdown-image.tsx b/packages/ui/src/markdown-image.tsx
index f332e0ff70..17af0c859b 100644
--- a/packages/ui/src/markdown-image.tsx
+++ b/packages/ui/src/markdown-image.tsx
@@ -21,7 +21,7 @@ import { createContext, useContext, useEffect, useMemo, useRef, useState, type R
 import { Button, IconButton, Spinner, Tooltip, useLightbox } from '@astryxdesign/core';
 import { createMarkdownPlugin, type MarkdownExtensionNode } from '@astryxdesign/core/Markdown/plugins';
 import type { MarkdownAstNode, MarkdownAstRoot } from '@astryxdesign/core/Markdown';
-import { Maximize2, RotateCw, AlertTriangle } from './icons.js';
+import { RotateCw, AlertTriangle } from './icons.js';
 import { Link } from '@astryxdesign/core/Link';
 import { parseAttachmentResourceRef } from '@maka/core/attachments';
 import { isRemoteImageSource } from '@maka/core/image-delivery';
@@ -158,14 +158,23 @@ function DisplayImage(props: { src: string; alt: string; onError(): void }) {
   const copy = getSharedUiCopy(useUiLocale()).markdown;
   const [loaded, setLoaded] = useState(false);
   const lightbox = useLightbox({ media: { src: props.src, alt: props.alt }, hasZoom: true });
+  const trigger = useRef<HTMLSpanElement>(null);
+  useEffect(() => {
+    if (lightbox.isOpen) return () => trigger.current?.focus();
+  }, [lightbox.isOpen]);
   return <>
-    <span className="maka-markdown-image-preview">
+    <span ref={trigger} className="maka-markdown-image-preview maka-markdown-image-trigger"
+        role="button" tabIndex={loaded ? 0 : -1} aria-label={copy.imageExpand(props.alt)}
+        aria-haspopup="dialog" aria-disabled={!loaded}
+        onClick={event => { event.preventDefault(); event.stopPropagation(); if (loaded) lightbox.open(); }}
+        onKeyDown={event => {
+          if (loaded && (event.key === 'Enter' || event.key === ' ')) {
+            event.preventDefault(); event.stopPropagation(); lightbox.open();
+          }
+        }}>
       {!loaded && <span className="maka-markdown-image-loading" role="status" aria-label={copy.imageLoading}><Spinner size="sm" shade="subtle" aria-hidden="true" /> <span className="maka-markdown-image-loading-label">{copy.imageLoading}</span></span>}
       <img src={props.src} alt={props.alt} loading="lazy" decoding="async" referrerPolicy="no-referrer"
           className="maka-markdown-attachment-image" onLoad={() => setLoaded(true)} onError={props.onError} />
-      {loaded && <span className="maka-markdown-image-expand">
-        <IconButton icon={<Maximize2 size={16} />} size="sm" label={copy.imageExpand(props.alt)} onClick={event => { event.preventDefault(); event.stopPropagation(); lightbox.open(); }} />
-      </span>}
     </span>
     {lightbox.isOpen && lightbox.element}
   </>;
diff --git a/packages/ui/src/styles.css b/packages/ui/src/styles.css
index d8e30dd5e8..c99151e943 100644
--- a/packages/ui/src/styles.css
+++ b/packages/ui/src/styles.css
@@ -677,20 +677,11 @@
 }
 .maka-markdown-image-inline .maka-markdown-image-placeholder { padding: 0; }
 .maka-markdown-image-inline .maka-markdown-image-loading-label { display: none; }
-.maka-markdown-image-expand {
-  position: absolute;
-  inset-block-end: var(--space-2);
-  inset-inline-end: var(--space-2);
-}
-/* Badge controls remain keyboard reachable without covering the badge at rest. */
-.maka-markdown-image-inline .maka-markdown-image-expand {
-  inset: auto 0 0 auto;
-  opacity: 0;
-  pointer-events: none;
-}
-.maka-markdown-image-inline:is(:hover, :focus-within) .maka-markdown-image-expand {
-  opacity: 1;
-  pointer-events: auto;
+/* The image is the lightbox trigger, including keyboard and touch activation. */
+.maka-markdown-image-trigger { cursor: default; }
+.maka-markdown-image-trigger:focus-visible {
+  outline: var(--focus-ring-width) solid var(--focus-ring);
+  outline-offset: calc(-1 * var(--focus-ring-width));
 }
 .maka-markdown-image-preview img { margin: 0; max-height: 100%; max-width: 100%; object-fit: contain; }
 .maka-markdown-image-loading {

From 824bd08e72cd93a0593de860fd73022891fe5c94 Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Wed, 7 Oct 2026 20:08:56 +0800
Subject: [PATCH 20/35] fix(desktop): automatically load remote images through
 app networking

Use application outbound policy and proxy routes for transcript media, permit named VPN fake DNS destinations, and retain private-source checks and archived replay.

Generated-by: Codex (GPT-6)
---
 .../pr/chat-image-delivery/remote-after.png   | Bin 0 -> 60327 bytes
 .../pr/chat-image-delivery/remote-before.png  | Bin 0 -> 19007 bytes
 packages/core/src/image-delivery.ts           |   2 +-
 .../src/__tests__/chat-image-delivery.test.ts | 206 +++++++++++++++++-
 .../__tests__/execution-composition.test.ts   | 143 +++++++++++-
 .../src/server/chat-image-delivery.ts         |   2 +-
 .../src/server/chat-image-source.ts           | 133 ++++++++---
 .../src/server/execution-composition.ts       |  29 ++-
 .../src/network/scoped-fetch-transport.ts     |   9 +
 .../scripts/markdown-images.browser.test.mjs  |  33 +--
 packages/ui/src/image-delivery.tsx            |  11 +-
 packages/ui/src/markdown-image.tsx            |  11 +-
 packages/ui/src/shared-ui-copy.ts             |  14 +-
 13 files changed, 501 insertions(+), 92 deletions(-)
 create mode 100644 docs/images/pr/chat-image-delivery/remote-after.png
 create mode 100644 docs/images/pr/chat-image-delivery/remote-before.png

diff --git a/docs/images/pr/chat-image-delivery/remote-after.png b/docs/images/pr/chat-image-delivery/remote-after.png
new file mode 100644
index 0000000000000000000000000000000000000000..b9d4268f04917a8f5007f42b3b00d5a744a77825
GIT binary patch
literal 60327
zcmY&fWmMGL+a0>Qhwkp~p}V`gL%Jk}?x8!R8>A(b?(P!l21x}(eU*Fff35e!e3@^*
zb<TcvJp06|tIDAv1Cap$0Gfilv?c%mJ@@CQj|lzepP?1mU;qFUpdc-w?U#S?(`9A9
z3!Ntl`ob6SyKTKS+4xo}6iuls6^4cm1?}eNw})y==x#GtqnWh9u}oC}%olPj3s$v^
z-}@oIzubKj_~lOe`w8<Y<acM#uRAq?;9pPAPD5V>qw1}q(pGLBR%^kHEd0$B-&t&f
zG)-t9LyzkWgBwT&k7w=Do6rSkBn%8{&QnjjjPZ!sq;)KcpLL%G<*XGNwB}TK9r5^l
zairw7mNm39ho9RB41V=JytStKeLNB_t~dQiB$`Ad;__33103#hO#1l574pkFbI(dg
zg!Ag`8<2-Tfh6zVGtdwJgdv&Uw)^YgyW<~YOwi>chho4Q(7SLc%@1pwG#x~O_nF5t
z>vt0Yra}8X&*Hz||DH4~WEwOiV>#ai`c>SyE93Sr<|P%NXat7hH{_h3<eR=v?c@2h
z<!I)1_(c9uct+J&j4fdZdnq4}E%{jjj{;RO#`|*iJtsD04d^89-5`8Nv8w!mdy#of
zhPNo*BnAUJczUl2XA7EP0%u?bKQj)=P72|z<eXZJ5y)A5>`0JrfvO?Yt<9G7ovmXB
z(&r;(KiH$)?+%Y|XgnY<LCE{HXVMl`N=&oKze>V}3hM6GR6hTD*F+6^Z$U(;p8yQj
z^UtOVb%$t{J{~l5HDh?r6zYk-|LARMFd1HMCP2n|ev_Mr*g$P1u^P~TZ&?2Y9<iTh
zZ}0OLoNF)~b*Kd=2Q@3;;D-Db+5AN)#~bPp2ZU?|NQz|yTLJRvMUu;D<#?M})B+Cr
z#9(YDCPUodg{XAEU(W{U84E$!YbYjM@ESZJ-a1|P3iA`r+4KXy<u!LZ8|_nVid$5r
z?}71i$zQJsP}JHOGJCX1--c54YeLP5|9*LXV#U^!n2kqA4?9xZMEp4X&W;gVBo*oQ
z{0>A6qsV=(Z$?7BU#dMbCUHDX7vcr&=6HW0Q+Ocy{?FN+_cUiBD1CAhF}$9*YA!uO
z8IzyOemN66m-ykYs{oHvL6Ag*l$&Qa<+fLnFgbK9T~1-3_>#@h1g|nUIFyC24_Fy=
z0G8A0%w=zB(H&7JwKTt|f=w3&cWKluYmwGe9}z;40khfMd6}cwRv{FGicXEfp;QE2
z*g2s|7aXW#f&rd23-U};kg68+1>zrKMXqX7^z;w`Hx4Ks1m`EXk}=W@l!v~vpTKoY
zv}jgxUie)zZ9@92-VKBulJD_T5O0h8#WIsj2YdUzE`qniH?N20^}j<KrH&X4G9U|z
zS*ML6yo@<Nr_rw`4=z0HB%O4P7~8q~v<~eC1yFvDiuT9;Vs3Bn&9sR630q`Cwgl+{
zC9G`XSCfBORDWPWl<S&DxU6%Z&o^%xp9z6Wg!z{zal-X5MUNftd;SwzFvQR*D6$0F
zA9<k{^JCZKiitFY8rRyJjP9!dlkb8Ix;tMIf6P8DcA^i>o#LLts$ZYPjsl(u3|$yK
zFkdPUAard__gm(>CRW0|Shn$F2VPf5?X>tXM(XmxNYQWIw1FbBx26w0&ny1Rx7Mcw
z5IK~-B~*BWQYi!dRNaLDF^LD*<tG-QYKo~6kUIBshUh!D&h+75_|J1FPC6WZ>3FWh
zp(%~>Kp|ZQayBZW)EgiV9qUG^q2o|xkhvsI@@mwgF!R6%Ak=CDLBdtTS2r<qq9<mR
zh7*SqSUhOa<{Q$u31wRc#QJ$v);%0u7dbmek^>QT<U}@0zXdzea;$UUXYt!-iqDmc
z8)fwgSxU6J7#u2Y-%(|Q6MKcF&}?`(5`AZx&;1{U?`jUK7uZRX@UxhC9>ds+4k&-I
zmvEq}s!>v?RB=3qrSH%X<?o`4+e4|$kCPzuLs33fMa4At^s*%QS;T!J7y<}~>08R^
zwCL>bm=&3M=HfzX%Y{9ZW4I>Ul=!s9j>>}U$1tyuVWDD&xZ8jaP87Pa%wTkHgy|PT
zOL`4BNt`1VwtW)wF!yZ;i6#Uh<V1XWju>!NmuR9QFl+XW^jPE?2n#VV&xqUz_mjdD
zzgDUeZEHE!nXP?OpvQ`l8NBP)VP6l-!4laP01z_rfs$eHyJA&wpRh0}sh0M5_Prmu
zpLz&xIO`7LlRpz0)2MQ#aBu=-UXYk95;Ux_UG;;r_ZZe2)?j_t`WKOJOh7_qlw&>S
z_@>i^a-qvi)sRrF0zcaqE&VJNQ~C;3qBJR{Zmv>1K_7ePskK(c<s*%1k<$$Dba(oe
zIk#;-fAr9tjW&WmstR=e&0>U^6p4Qv7L~eNBLR!;0P9y-Z>_{3m9PHGcW1)KI+JOC
zrdc8Dy>^-?&2CKKHFQ2p>Dmd{<QPZI9jov%a67ugpy3Q5h+(l><b5r$ffts1C`UY5
zT%Q6AP&F34qr&%hNsiTKL^@;;&wv+mXDm!1ODU%TOLuPaTRQoF%3&xzgD~0y?YTno
zz&!BtoVs6<Is_ABN`8Y5z}&?WQD;9)VXDw?zTOT|3#C|-C^nAeOT81=J2-iX#sWIR
z`MOaaR(TVd2JG5dyV0){b%P9^EgBjp-kk@p^HIHbgU8Z8qh^vg%fKt=A2|7O{Q2sC
zA9fg`KN(JYa)kREXE|G#CgD-Z88CH_Mqc!ms8ucgPBP}<#I8piW=K6*%`ZhI)JZ~^
zZ&!8;+SYgvSC2Y((v5{ox{9X^7mVev%}4#EKPak9R^oYNd%i&h;W|AxCgR&#B^nLe
z1as!$*5V8COrUIVk@pDHPT%zz9yVqK%a(dLg%T>E$Z}%X^N=(aG(z*mowkzf(T5E6
z=dIAmqkGsL^nTlSXk@2El}$kWx9Q>bV4^wkMJ8MIVX1=$pM1~LSO<8U4*`F1zWoR1
z#ttZ>rL>{eIke-&1NR`9k?Y3JwM|U#lpjPRTOzW0SJuH{4_`4SV<m7LFr@-tfM6E8
zr7kbnmGwmi*Kt0&%Nbo=<0|AF`}tg?ySltJ>M`<LD(g%-;_RdtHct}y31Zk;=RN>H
zSPxTn%q(B_u+AdP%Enndv8S&|W|N74DibG;Y2w6~`UEe21j6o!NN8%kbc)=!qx|W!
zz`YcFP*@2jc7b9M{ZBeCnCI}6-%Dml(`hNF45_)PpNN`-mlgPC<=S$QqryjVQU5>R
z7)^+>w)go4h@8xrbCnq6S_g%b3813v!Kkn`#-!)(jp%$wazzLK7ERe!r*p`Og!4IH
zGNW-f?#iT+VgRJrnlvW6N$>*4xXs(Y!ETO~zeIdMl5#DC(pNSPFU|ez+bBnx&7qAD
zkk?xXWta=O91kvAm@^-9Mt$@W8W==cwe}1@*3|Pr6!>OCPw=>Tv}Zd^p6Dms>_gOB
z@WEeoXzLII5uK1GOT-`?mA7XEtqWN(Hwe^nq`xHY7~$IyqD}ldjR*dn#vzh%^7hpf
z{m!EHG;})#Vsr{<1i$CQNn(Vl4|6$i2Mt}g<Wi~aX@j@&k1};w_FJe?2DSqwIneNJ
z0DA{Kk>riX$Q(Ec%W3*NPKb`5k$YFXwUB^~e3~>```EzvWWhXjMe``lSVc09L)1|l
zMAIqUq+)oOfiso_9_X7jvm<s6Q<o94oLd$HgX3zTBoM%w@$_3=`P3^3D8^$;g>1Hr
z9LBxgR(Ve9K&mow_MB}B?Ms?Q-q-tgs<FTOcdE5ZTfB?iLK8b;bkmuv?dCehypx_;
zm?oL>m%oMu_URiUG8|#?q333;<4Fi3^A;1sLi))S<O<Hw=S0@D_^}0ck}jOcxrOH8
zig#o?zr&3uw_=PhLRsy3h7UGlttq0o!J?bvs!|2bk1XjdHYMt1mNkCr%6I0Kt2Z|;
z4akp{RJi|EEDtvdb)>G9!T8O*)NWxh7sb<PydKwhDLHxsC%^Y)W0<Q=&~Uc4P|r;0
zecfUIA1ax}=U?asbK-(Tz$6^5LROzv)JlDH0H)GStl1z0P8RY>2_ais-MP%3xrA)B
zGHKM+ajUHyNkjEiMp#hLt#g(hQ32xc*HE<*L>Q-d1`-95X*0dXULgdI#GvsxOIQ|0
z*pH(~juKmKhF0>Mg5CfN&MaO(-i5=|?={T!wO=;V!W83P1X*^63kssXltfJk8d%9)
zD%Mq?_o1<6CSrSf&P)BsT~P+O35u^cv}(u4Ji9rPS=%%52eo4ehduP1`9EabP5e>M
zKL>97pe6}FJ$XY7O!c)i#Y&B#=T*!pjJh@mC&XCNY(968y|m%aAhsFveFcNz9Q7s0
z2fSED2`;A$)4$EGD+^U}8<nsJW^)~~F%WB2XG9UAFfy8xufg6U32wDef<L#SsbOw2
z+C#^c94LB<U>zqJ24bf_1Ofcy*nUt`G$ZVR2R`lx&EkIJD<`fw*2IgmhFOuKZ~EOM
z*Xo<*(n2*#CGol70R@MfMiwKzYvu?U)Xs*f+c;ubGKr`GimEDCtGL2z)@|gZL)*Bk
zIbP<UVRrIwyl-BUi(ktkB&uu7K?A5cB=;W5c>vrR<b_He+}lVX($Q1Q2J&?v4mnH#
zN*Kibur_TBn<H<l0`QVen<`8Lo|I=37yTK+O`0Fn{kxeAXa&QR{^)x3cUzM<K~=>s
z4zOxO-DVoXx{|)b63hx}Dkv1Z9azXc+;fUAAS#`n*(vD>lffy(erMKFg5qzIoNjc)
z{BzzjJo0*^d+RCIY(_yB2pWTL@>s~qh;SlSz&j_)YzC^*$2;nJ8I&8ZV4wL<dQFZM
z1+YU)C%6fj7ktyBMqDg)?hIBrzn7eGIL0V~r(DwiQaPD9ZZ2f2DSKP4bF@c>fBzzz
z(}rYJ>puu9)UZmE%GO@sGNWaeqV8KJE&p;fz)!zYh3Uo<*#)E1h$)T`TZ@Z5&{=!P
zbD>K65|L@njNanJphT0<Uj4n9yZ`VvVVMrg)~q;8%BS?Ju}6P9fntqVTXHlg$bn;>
zAGE$;gv6ns<NL-9xl+TiLvZ8GvAXJ_JjlitM)~vL^TO8MR&_?|j8!=mo`P%7_CKdo
zn|Z9*txd*?)9-!{pB9yk6o$h_5{3fJ{DsPQW#r}|-*PZAu%nHE{Q$m#V0kh*uhE|6
zGwM|QH#32ZAa*U>k<@obL_CLvf*vkuxiXzc_b>($%JbBzy0WPm@#1&%OB?dHq?QZT
z+1*(M_yX@2s%wWPnwx^PU7Zzx@dY(g?Na$BUUXWDN$yK@84}E*cn52>%!??=*FE9r
zWneG6I$3x9pLN0tMR<b|i~s_x?oPur)oW}2o)L>M`n1{ZY1uNfz;Az%)b>YU{+$X*
z_#bM^dFsL{Br~;0s_Cc4qf21<oC-Czl$oKh@F7yec~kNf)}wT4l4(&-Wykr_c=OhH
zrdjs9u(%*rDz*<fEb=^{RE{}&3Jim;`WepyDbSk~uD&qYc|nK&vVh9Dk0t;Y8!0yP
zW~*dLRvr#H3Ojp55++o;ii&s*%<;A0^?(feTxmVZghvQPVD^4^Q66k!yIG<s#e{fV
zRq_4Q_B8RSV{ln11?!pA_oayWa`-z})TR2P1GO}(^}k2sJ5!rU|LW2D1|_c}<Wkb9
z!jyi2>#zpe-Aqm%M~4{v?60{Kv$nXIrTQZ3h`gfWnt}A)N;K+h2a<A0`@3@W%yM&X
zM1C3@q13PpIFTMW7_{trSH=ij<Iwq{goHTmAFDD6L&xkPvhlHbu<Rbn7X}i21h>Mx
zMfcz)h(Rp69x=Rsn|7WRYKdcV;<|j}<-oaPH`}+YvT4|k9*g*9Ph;;pjxb{or8sOY
z*DqJ)O%s^3PjW8aHIa$0w7=Wq=-+(*N6Z`&^kJ$;I>)kwMIAe>wO4G6`(|oqKMPUD
zF9c^qaV20zfdVdKlV#|<Lbr;T%Cv`UHXSD`x2(@~Lt`U2V}nIZCQ8NLPo_{{%5x*S
zoQG^_glX8pOT)(507T;vmSMCBcI$r$Qo7f#-}O@4M-bkEHisq9yko+;UygO3(MZFC
z-ZnZO6DBD?*mqtePmlbx%%g%m8J2G8)wk*EKAyrPrA$EU#A~)F6?q;y*h?KerV-jt
z<=W87vo$WIzq$M?HJ$!w=zkJ{oLPc5cg6=t!x-1ipWJSJcY!1&YfRYcaLCd_uoo(8
z9@F>t=vOi+zn1VmU<4`=8pg!8L0bzy`CE3!Ca~ZLOuWC+Mgu|1uDq{+NGy034S2QT
zA=-qUXTX^2kp9@g%?g(YMtw{#?ipxRqca4^+5#?UwD4GCCb{(8v9mluSU)RdLOQ2m
zu`=kTT_dpQkon_JLgS8p<<u5$NiQiBIxL!z8g8clrrNQb+j${VPD<aOWttDH`&oyY
zr#R)(5mc?sRT;*mEWfA^sx@zHk_34DgP`75F6vc0oZs{EQ7f63To@N6xMv|&7{<*h
zd0NEzWU}q5=mFzFCl}G923HHE1M-lp{l=PrRI*saimWim)GB?O@4v<quJG30msk3X
z{O82af+$V_QdkV)6k+{~EiV)|{0ej{JgTir{i{Ajdf#RWC8hLQZJDR~{N2$oVc}nn
z$y|LLO(+_0)JUsS%vk603v@50a`e%|!^3O8_ZA$2AYX_`koIqz$B!)|)Ca<~Lj|Er
zhTOSCR^wC=HfAX%jXreg;tBAyd-9oMCy@5e{e{x%A1M8aJ21oy%}dcrfDG_CMBu1~
zOEfK1rAoOqQiqtwkhSPE?wqZ@l&4?U!ip6^Le^`;j#BEJTxH&vv1wd1)A_Kjgww-A
zN^A%0se@mKmLspyc1oI4vFXy)gnB=q;g1(Tp^?i=)8DerVSXYVkJZgl8SANdE+Qg@
z3)ewLRnT#d@wuQfAtBi7SwR~LZNk&U;COE=pKxJj5>96Pi8-(JJa>5{rIat6I3FD{
zy>~d3I#i{IIb${h7v9mkK&9~`wDd=Vx!6qJYtrFk+9sm^9Jzn0d1Y$ZjHkwdBQVhA
zB%=Y)w?sD&pb3PJ*(RXAFiT=f!8%&l5lcgk)eF~0>|g+Qct|4j_7uCkUvzhsg)M{8
zov}`(r3=F4m6nrhnwvH(V|rwDxvd5qMe(%GBT43{0@{5mLvwTcj5Pv><Mn;XvU<f&
zn||7^jFXgAWu(&yDV6q6%=+40XBaPzJwW<kP@ylE9d>NRWE@AOH<lP92V}5|8KV^u
zt5tLgXhH4~@d_(nUO&O@->{~THDC!fSa*?HnIb;?EmE{4H{~rACgcS=m@b}++<vjV
z5TdWeXgVIEs#KnroiL})W+)+rJBuj$jVKf|Mj)d@V_<5;bPXC@4_qVHKIe3F8-w7T
zKynFw95fu7s_1r?wxUT0*LhIkwJohV1p4Ihz_+PWS|Lr0CH{b&ae<!FB+?{vet%`j
z8@=pqy|X;xz1!t~kfdvFl!Lrf*%bo!&~bP6PA}tiqJ8;aaCYG06J`w-SCOq&xaNra
z4$z5|c$z~u<a9wD@P+mDR@{NXRL%)i!EBkVR(DrQql+VKCWNU*my8}6y=FE~$sNlu
zZH)nEoI#u1;W);dm*bF3F(A4U(k>{qKOg6xLO=1kI*w9gWxNykJ@v&s!H>nW*$~+7
zoq;ZaqW(myH7h*WFRnahTiM>K>F?0D{T*>P$zS*C^fb(aW*a>te56da(?d=!*wul;
z+ez>8V25y$F=O*D7_$C=p;GZr_GdIU$hCp8llLwZTI%Z)SVm~5Q}6yr%8#euTB{n$
zSi|1x5}YAkG@)=}<eg~A9ZB#swBK21?(@+>yI7u0o4ctKW@O&^8*@r}Ib4oq%y-1X
zd|{#SXUFUB6?X5~9I%<ML1>C-MUh(@I}(jEvy%FqRiwKi`f>D8$R>x8&e~Cs7TXjN
z^o<Q^WVcR3E(gdA#G<m+Vd~r@oNMJXu`|lnUh{%l8<Z0=2ty$sCNEL&D=0>@<bf(4
zeW+ptjWO}{8u|V~f^I;@M2ifajA-IjK$&g1#LDK+fL|WW(*X@l$><%n7MsYVQKDF>
z^mV@lxB5r?ench{1wzn(1vdsx61&pBEYp=hWEL62j4@Jg)sV>m9oJGTuq<A?wFbpm
zo+c87-xrZC_%#}%!gtgbA*MO1s5fF+1(}FB`AB|8TTr!rm7xo<P8Lm;$x_f*o*5D~
zO_rYRrAP{<^UAYD0~)yZ2xzNOIhib5<51<vekmznVV}}QpxyB=tabf4sS7`{1V_X|
zqjLcgkww5dB?zOg`r<F&82!sPg{)vQOLei@&KXopZ9av$PSlo(pSccv4TMb2JQ7ty
zN(mNNpgl5m3)^4)J3=kibaC&MOq+s#2->Yd-9XzMTLOA0cfTa_=E{u_;-K6R7(@C-
zG~43oKaZL2Wbr1W?9ubt+E5|Czx*^c<^qH7%`7|I)ojYv<0XYpealWA8@{n7>|pV*
z(_BQHP3yp{Gn-Ii7VBf2pik*UXntV@_vMr2g;H^5l$7_N^D(Rb8T0qcJVR#(FU`{X
zty5wrL>Oj#kF0O%Sz1}#x$MNEPB%L%X^wV(ecTt`_kXO<rKW!?;798%Ix0i&7)*>v
zOs4V)$vEy!D!b|-g}4_~HzptXQ!~Asy`B73OW(v871}1VHAwgl!Na7Wc5Yd-f&#uf
ze4FEGSFeV)As80ORiBJkN9ZXYuwG0p>E}qL1LDUc0m#0Le7r`@6y_33iNDz)<R2_N
zJgH;CQqrvp`G%hGj9`$$-mmpmxlWeHzLx=xu@Uag{<ZlM&S|F@lviHN`w{Mjq7&{r
z4kE%IJBhNWR<f*;Nc2sxQofP0_)AvBbeM+OYL&jPAN8L(RU<g=3KCguG+x0+9pa(?
zeoNY|)|`>!o1kk+@ZD`7K5W}c3xx`4a9$&sd;6UuC36i7h&ow`FunjYqNEW@(B=5l
zjg*t{y{R@wD-%YM#GVWt^K4IwAw10a8aDN#CNrR5a5;#H{I|?1Z!5YZGL5->Ih<T0
z^qG9LI|7R*T7TuVZhzk=j=Yb*HV|NkO!|{4S$Wf%k<g#GB^E$)mLGCCV|p@re&}vx
z_zDy6Sqv|^CoG1RCd=(*lWa1+^5*yHR}Y6Wx=71MLi93tUWH<PKnwZFOTOw-Sf>nr
zjA}_WIa{akp_!hDi@H1(Wt6{x$86}72oQfV7fkqWg%xYHhPze8k}z?2V(tMf7y%At
zDnF7$mTL>N&e^sDP72QoB2{vV*Hetyk7I0c;Lrn#6)I9q)f|YKH>OCXgXo(YMo^t;
z%b8M#I#UHRZK2>0AWk&VtyC!F$^}8~hRQ2mco|zeYu6CZee~|n`vR_fSLiunldlLO
z{$J`DdU89MDKE6whhV@SK9_LphNuZH_M*%>&DM*VFCWuPET|1LKVX<r2CE#k#=gU{
z9dic&Y`&^mTa-o~fxlI?6A7+jp49FQ*jnlsf)BmEC5D84W?%nK@e~fX5*N*QJ=<Xq
zYUGuj7ctDkkwVHdqHe(NOv6h>Qq@kP<m}(Mg|eSYD15u1Sg+0y{>z=)`Ab~asv`9?
z>(CbZwEkuhf_JSfQ<Xm_UdLMBq!y&%{;!`Y_%9i7R%j%0VyAg7jNcyXzx2BovD6}#
zD7&t%GV23$vyl!fD1&nWqXp^6L0Iq~zHw!@SYASbC>-2M5ZqCmab7SVv!WKO8F*??
zJ`AEbuLnv`(#PN(8xu4X;Fg)LV8jWaQsJs&6)6KdgLBI3>>1P^Ni5%95W0!N`?4Z@
zAk$`o(!U=N#ARbrn)3y|Ta|xYag->WnY0q}X$IAD>KjNI>}Ls!jc@a~@KENypRTUT
zREV&;_<@`l+d%mO2$JJcfcRgrHyjqcGU)y*gTB}FZ>Jf{#TKGI3ncx%!Ad3nm86^Y
zpe45|b7g4=y-ZFyVk$5$X0n;aX`B}!^O81rPk?MwFzl@ZyupN8y%Z06$B1Z&q<%`J
z<vJKd7Xql-;gaMXQy=in?OrD({^b1Y8&!AA0r|a@)ZKwD`Wi7zjrGwUXz)3(E1Xo=
zVrU*>Ifi(Rv#YY{TmzOEIc|og&voymu4Z)w0j73ylO%YvS==N$Iqal?quj?*=(cWs
z;a>dw)YGjHP>|cxT#VEw!gR$<fl@!3#5>tT+%D~JZ_@{s%g^69ue}D-#K#%`D75vx
zK)*!3O=~L!4)d`B+33pVJDNcbmN$7|Qi__%+|D#8yA;=Ev}3CRr3bI5!0I}_5@hbh
zRVajZ;qNu*>FJ5EGAOQ-xS$hrT=5WJgUWILRiaP6`JZr1#yssy;R?bfOW1BXiZRCv
z7x|c%8;j1ee7a$;h``%us-D_lFO1gR1<Q}4{YrwcNIWXz2w(`wrC?-oZ3R(;s;xFv
z9P>`1Z}vVeNg9RdR9tq97T;Sv=02NKh3K%UZk-0#x{Bm*0P?{9R#5tXS5WaRP3~)=
z7IScqp$*{16i3>h139g3N28(izL+7ISUh9h5s?RfJVPR<E8WM@EqLbXcbm3^0RA;E
z0wy@Ux_;QpalJZB^gzBed~4RUULL;A06SG^J6D?k+H072BuLH*MMU+{M8Qy7=s5-J
zwyF(>O*7xm=qAM_8r9Jy^}JT141#r@x<jfB<tp6H7;X;>@+edzFQM+Z2JitCH-BlF
zA0x`bj*A`t>A`Zg2~Z2aZ_d@@W4FDJ%TA$_DC*JoSLNXSM>*&TMeWb0zWITA2iXe=
zFqU%>&4JFdOXuHEFutAol9|M|3Wq4Z56$nFn|P&1VQI-IPr+E&OtM!BI8FR73+U%J
zM^>N1_Ub>PN~b=lqPwhXa;aa3xHz?)Q3$=cg=rZdmiZ}=*YsSjD*4vb&gPK<4MCY^
z8yP3wQ^LW9+`|k*Z<<5@y)dU!M_O`5UT($1b#Fa9*gq`94gz<xI#+PGR@bC8Lv<;J
zH~eOLIif7SdQZMxL-d0--s1#ekRw71+RZDp?*6me<rk%mZ^Ax;9$RVa_fS4A9zF>t
z&eMfupwG3!;4msf+;uGuyouFfs@+frwd0q64N0W$+60xar_Y<V+0gF*%t!%spIiH{
z`3T1c^PAjG?yS?kxe2VJrU`T}!m#xoe56bplb*uhOAIumuCVVRIffbnA}utdcw(R@
zw?N(XxQR>S3D(GF_I{n`aMjp_n|e!P{Jqk?jrE#!FPqMuC*gb6cZ+lV!!)1o;U8Q2
zfn9DyCG&pl?*m`cUH*U5-6Z_swB0811K7y7#ch!#Av`&<vb&tgq}qrm$9$&L#Q=b%
zGn-soa%C8#qrKPTF&VCZd1OlPf=%^|%ip%@c_2L}!4a4Hr{EjaYB;DrYPh?)Z7i$^
zIle107p_c!2idBEb|byTUy(ZzhLQ)_*2wrlm9Z=|Ow-%VGn#50#*rQmdq!HOY(RQJ
zo838b`Ra>iY11g_#7N!qdy5z@_N;(X7)n|9l>x_M?u_Oumz!aa&{8T_cz6i#^*Ap7
z^9sh&bojsE*X0aKB{=a5(Ylg8BfbCVj<^c&<7>C}69y#5MlDjIP1=a{d+rk;BOVDL
zJHqFJnmo`tpc`jw{IvM~gz|JaBq=SC8z)pw?u5P6ccg=yt~nG;*-$xPX-C2{GS15)
zV@<f$ftGlgfPTmFsDpF*7I^z+&e|rNL23SvoK+mr^RcUK_!3<RY;FWUEPrscj`R6i
zGH`TiC%JajbNO1G&rG!|SWo}%#D(Za#{qtsE)VR^T2#g2mXo}qf8jL+Et(IJ9D>0{
zRrq0^L93L#W*;}p(iq60(m$kw@`b5X_2PId#-}p~%BKhj*kwTQ$w_pvb%atU9_eX8
zBy`xFF4RcZ76tLkTXYzr!y+iHTSKkd>YKMglv9ROK1f=V%o{51Z-^|A0kk6I?UTDR
zijB^syW+D5b84Hu!wB`WS8T+gDi;nnnTWi#RGN%I%hrH$-#c@PDbj0%2Z$$iP2e8Q
z8Wm)zGhWG-Aps`|S_9KJAP3%()Q_Bx3eZYs-~SS8@9QQS9}=x}@(?1fz@hz1{%Rjg
zKi^ah?PJR^Nm_smzIj9;MWTW}jc6aH%YqUHXkaNLS;H7fJ+asMA}APFqSnFbAENTi
z7bs*mtx$YWzfKU@BuqXLj%&<~Eg%#&FbuuNV1V}(3WJVyJn?Ig0lN!Y*t2`OHK_(;
zbWNcl=;j?K!}0f?Ul|619X;9Am#{SzDbeW*<6cmapW_{~>`0*<A?a1zn-e0+h$oXV
zy)0Jh$L>9uj>_Ldo+*kxG`e~s=iez?c2zU+*)K#SVTTy8Hl6%u8?4IT%zmQa;*JZ)
ziamY<YotPI@>|sn5kwdx5lmQ;$hI>z_FE%T^*KO=?!cRb*eCvX|67$ZC<)3O<3svx
zE>L#g>|PfiMxWJ4vIyn`Ljw%rEH@5mDECM>h;64QO%ML^XoT=BmR-|)4Q?cK*Glk-
z{w2t8gvrGX>^P)??k}vs<cR5M)n^f87;WboMns_9zHdlJk~~Z*fJP=9zG7=4Mxw0U
zBPt+07fP*{#&vPc=QKn2_TdY9ZSd;|;QMz3U=Zx#TMYb^Ht?uaF^=d~ec_;}5E=EZ
zcAL9g6IZH4{u)cuID0ipSe~*Y-4<~g6E}_79gDsikis}`LpWLjKoNe%=d6Vj8EyaB
zd2LFPHnDq=Yc{dZZm|`-XmX*u9(Ir#T^js;uKSyLRt6Dcn^!W!l(>dp9ClQ!R?8=)
z_)JwxnY_tjRuP5=bxs(CtI_HbV-{Y^w@i{1Z;Sn7zlOX*qs!mspLRey00Z5;umv?;
zX!t(grcCrYbj<f9hFjrLK3Sf=ruo2Ott&PIQ?CpPzk>GRI*gNE(2L-_j<w?D1U6Jp
z=_p(T+5BvI5UoOrm5vSC0fVb6<jZ}E2{9sPDeW4cI9}Hcl{z&-0^6eK^ds^@QayL-
z=88F5#Ih%D>kGRgQbf%@0)65=Fyw>E&KzU2aH(Qb91}<G%PIzP_)w#Cq6?o72YYHK
zE}A4J{M*PMuOT!4?7tzi5kM<J*)w!;O*`Qc<rk0bN%=dqtDTY_Xw>0)g#4oz`mBrv
zXe=v<8k#jX9lKbHmX8N&;lz9bt0;hSK4wXpJPLvpy9^4g6ZA@YXhx&3Q^_TcmjO8(
zE;)CQJ0FXBUGgLOF=vtE<q{}3ONmTAHR0%O*4N;uuy2wZ2L$N=s@?d?l-X0C1Ekvb
zFpBh5)_qJ$?8`CFVx~eAwM0Fe{W#D_&7QTlBn2tXg_|D2Z#cEwxV3oGwU6?0V}A&e
zZ0+{^U1@&(Q`AVxFfG5eN2>LbbkF8!^TzETJJFm@q?Cf%mN<f<@m^e+d+VfnT&fxs
zdfy+~*b~^iE6it=T3m2X=r>>|0+k1_yHb|qz^23|4W4`Xp6_oB{E$cGyWa&<=5Eba
zb}B__DF`1=0mO}>LcMchitXIrjF5f~!s~aFBJqBYDDD;Lcj!h4)kpnl+rk5GMOuvB
zgIch?1nayR(UAd_VN_jSMFu)~HeJ2{QuIvq@Cb9g^2NgOGgNf$voqHRT0@;oXdLy*
zioCtCwc9B=gW!g_S6u&%pS4~KX|8=S<7@Xt`<oJ-)^qp9bXh#f_=_S_*<T;(xIxaM
zQ!p2(=|kfvTZA0wLtOqcFwC%U#!wwxJ4h4o@M9~TeSUcgEg4%lIB(sF8V;}0qgY!L
zJ{!2?%}|K;%OTdoo<#9Pc|yaEe`#O$buX&Ahv*~p?aedmy-CuYfi=c(z*@et{}>v8
zZ6Fnk<Ci6`T%eJ>q`ioa64dU5?QauOSuriKSQH*A9Lsm!7Q|v*MXmvV(EOwOVx7cc
z3%o&>@LRL=bzKwrX9|xmuw}?8Ndn|^W(|nhhAN2rw4pNxD~PtfRedvU9`9=#qZedN
zmnxE0Jt;DgaB4;2vT$VGY=p}^^H*mkv>-XAM(CrVqlw0PDh<Orqwh&lR%k`-?4vQ~
z@HNKF4;|;s;B{lEubt8!-=n{{1W{0#&xI?4$p&h-g7Yi9*G{y=De)Gt*0P*uCT&A{
zIklN3H;d>HFJ@#85};39sL*c=A(;|Z#e3uZNLbTQ?4b0>{4VyI@4S@BxqXvuMfh^3
zT^Cmyhp!zW_CHro?Qch@>!iAnLlXX?2?Sppak^aS?l{OdxvN%$5KfSg!ly%>n#<DL
znqI;ZrnSLm0bg#hnlldWL^;ruS)f~x!tuL;;EI<lr?)b(r|OV4B2hq711&=_!F8UU
zzp0w>GnUr)2WY2Rhf@M*k6O{@z|L}o&cY;fBztQ-m~g5&z0*wn1Iabayr9DPs07$W
z?K=IVQQ?@n>AnCaaJ{^5Dm}I?&dMS**b1hetJ<KBq;Jm7Y^2~)u=n>~-m7dm{G%cp
z{w{5XRa#3>r+NGue$y>dT;AD5`KW}p-+7tZdyF?k%pn)jQ!I9n93(?~6-!kEJScAa
zYxK9^#-n_H6d+qLBY_f%&?1~KV^Z3+;vHEP7iBzx5cqqymSVw9%4PcdySl>aJ5v-}
zE!D%i<x>J-NLxPT1#Ow3Xy}Zh6kLAfTibJj&f>ngW7Col(b{Y3R{0pqu;ozdE*|5u
z72-b&9x(MW+#*xa`)2OEtjst~EAM#dw|*KhuUD)5&(&)B+YiW0)c<k1ua()f=ZzXM
z3EfR`+Dwsmqc{;=f-1J8;j}VFWSz}h&W&pz)QIi3kKlYfq6!MIF<vp%ZoM>gQ6bXg
zv^TyTuqn>`?kmM*P+hY(484tgq3BIm+m_A248Q3emh~oB+UPCxd!}U>1I3HGoRXRm
zF>4$)e!g`=z9Toox9*hlZ%vEl`T-^tH(QlU*%VCeu13G}`T;T=GR|u4&QtqboE7l(
zw(@)+{(^8m&+ydOx%~Z4NPDb^kSJz^$$1E%r8Yd8{D{H|dPuP2C=nyH!EZny7si8)
z!Fn88!{8bCpzQuaRL6U66)Ja&T52M&XRb5Ip96(d+TZR*AHI)=n3X8=OJ)eVq_XkO
za0m`Lbmj&5eaKmQvAg<!G<KiyXL=tJ8&6W>_T)C|#c~TAH6J@i>m_cYgS!NS(t=4U
zP<zFrGvtM^Twxu*b=3~!Tb*M-ZAG?NQl~G9t(=BEyn(tlB(YQOP3JtN=|PBZ_)!9Z
z`a1<Hjqm17-26YG^S?<_sf_{FX!hZ!Rw`qqmBH95KMo)VW40Q?*0_^ic`=}g@{1eh
zg{SY=Y@a%%spHMouRN#?NW`(sp7oL>5m0HN8Ljb0ZoaJ2+QjoGjMB3ZK@HZC_k%D~
zejIw~g()Y++y-M|87Z-7t@3lo=q;n%l*V+2868c1Z?S7M)+~xmK520mo6oO<aKZ}Q
zA{UO=D45g}R`$)qOB{hPS*+xl0ro<Lsa7Lx#oG3$#6$Jz?FIVK0`#LiPPsz;iYU8B
z^P7MnJDIp+rQwyo-}P_H;SXAD;2hKl6@CVKL1jCv((nM^1%hL3h8_nJVSQ3XcW)^;
z>;PhubT{&l;w||Il8YM51?VP|HB+Sr>!Nc0!WfE}yReP^HBQ6f&)Tk2F5CFAiD#T8
zOHyk@57c9C*5Es=dp78B@r~xJbzL;YHF}V%{w!QBmw4n*jPE_TnAE#-^F(f5Y`yu1
zUY0^b+o17CvmPNl*u{{stSg@OQ8IvoX6{3O`1sdiJ*hw)=d2iVWt*KCPU-Sj%pd>3
ze4`iYXbUakM+Fmr8W*z=e|+Y-p!5cbh837aI%0l3#}4+p2b*uDpYqrNN<25o@CZvp
z)Dmb$HrX5Z7jYU*sR*Ay>?UEJ7p%LMhU2|GxikH5xh>QiR!g2Shp54yU|_?vv)a_t
zP*-P&ZacJ*sEtwR$L24<`}DM5LY{xN)cX5167AixiXFXdL_|%q#&X(jo1Pe=2fUJ$
zyu}#(4-g)Smc{7Hd_K2h5_!WDouL&+L45Ub&o3*JxROB%ht;50F*fmUTcc7*+PML|
z<G)bl^_&VJ!pwx9^=4A}z-C|8`5aLUT_efshN&rUjWa>|t`^mVs7r{G(S8n&S!1O9
zg*7JjD(|VEmfepQlg@|*VxMzKgoMt6IINbKsdc=aJ)F?*+Vmi`cZhmQR{BMZ!r&$5
zzbpXxOeQ{T#K~*;0MVzo3-oNB^U{5By{t6A&-!uHfbg^i%Kl^YCv8I+s_Vj?Z?wMb
z?F0y;@J|hINtcLU5Ll5lj2x>krCtgDzs@EZD<zIKCa*F>>L=9{IPP^%oI%S?Zz$)P
zDcL+X{pMH$)4Lb6O@nMweJ6swk~dmip(kQG&S2Mrb+PtxLDYGFNn3G?2x+vDFD23R
ztlr+|a_~69$X#60WM&$+mz@;LQYI}xapNWQjvU)9<lItxLLca?Gmpsq;%)WGWh{P^
zq!b{<*b<R_7`eK0iHEDEREBga?jpzSsCVS4^kXULr0s=6??lb?$2sAlsQPQI<ikJZ
zAC%FSNVOU#W|h4%`?z@$mSmuxGB>mn=FDS)9xMqaDIt})yYo*58j73vwDx}8=^)xw
zx(z2!_*OPaL5lbTKxbw+F`Bd%NH3dPo%2NE5<0KS1>Nri(rU6eKUFqXp|vdS#ZZ=e
zp{@*Oggwurey48TXX$+2eh1weOwAU`6^-XacdgdOn=AwRVI<&XF1w!yJEM-Qn3YBJ
zBLwOeEw|nLvt%MNw5#qw4w(E~s0B~YA0NCRH5Q4KXyQ2A`CIoji2dsqI~OEMlQNMR
ztsaRlYSYI3$JVZI-yIWFWM6c)uzVuky7QF<Lp?|yn<bP2dbtKm79I=qZm?z-G37EP
zj%2f8SqIKpByX5(c7-69?*MxzR6V0>t=!i1HrOMm3RYYWEbKJNcnEtEp3W61MHkIH
zS~3FrfXT>088mgpO!Cn}GLW{^fe04Is-ksjmFPF5!M)FHXtJ=anu2@zKJDaq^>BD;
z!pU}kZ9r*dZ!S`9RkoAib-ts^HDrG#jOF$!900HU@QU?^zgYjv@8uVxh}-CO$)&8F
z*hsLeN#mSorrL<b1ISu^F^Cf&xX`L1bhRKiMzMD;6szodjIzL34<gqOr2}Ih5UF_1
z<C2m|BlT06cr4PKKSuuAk-OgxQxy6(=Eh2C49g<gIiPj5*7j}OE4Mb<ayvzWtD5l#
z*&6oeD*QR-ZfDxA=O(%Iwcd%t%yM<{&Z5xotTADVkM`CZl+G{3@t?-0isU<bB<4Cl
zq79+B-S;UAI+oNdy_JfmtKvXtA)p9}Tm^=|rg)zJTO;F@Ov@$8ZYjGCnLh+3<fzQU
z6=lwTWq~PoH-gqu=I0bxL;?@@{puM*#-^&G$<Ie$LNcGA7m<*}OrL#<u|hJj<r(vV
zhxslwgbB#1x6Dd~0<tbSi)~&mN$BgzG5Zw9B{8Rm0tL;zQu#ZZF{?De^-a>uaXgJ?
zA8v)KiK3|*)0AxW5W>;NM*1dGVg;39^NqY?xwIDbeR93XgqW3$G9=BOCw^ZK{-oF8
zZpE=D1y1No*T>b-%niA+nBd;QeUu7+y>J<?(wOs4lc`cXv#fs%g*0#&-%&Xi_*6xw
zH}R>B5x2fXddhoY>L+t-jWS?}e&d=W%@Ls5w=`kcNrcv!Tr2cJCCOgcHfj$!T&<pC
zA|pN+k0<4KY&Moegq>lS{iXqNoqclRE@H@Vmn6Sn<CD#q9^8$D#etaNo>H4sWKFft
zNz8nAgD9KDIYI@Kuvb}>2itq=8KlW&qASZasxL)rBvNOMqOK*sYfyl$9vvsr>KJL!
zT6RC?eNxrpUk~QLih>yy$EURJ@h|6r-Tb8n9V@e=KDO^sk^|=YSmkH<Mi#h@DfI<_
z%5fycZhW_C5uYO1`C#F+xs%01RZW`T^^gU7Q)?)tqBLEyMcHJ^I<~LNaLbHG__^^Y
zVG!j-Ol8=s?P6YxK8l1$Ny*1Qwlky|mfT~0ueA?A|1h{U8(gXEh;&r8B~8X~p$U+9
zkTvb?Wcw=XOu`@L)G#Z*FA}BKMa{qAmiz|7=0mP=dxk7;J&XP><o_j+v-q4zffwd7
za11B?HrFCz8y1@A!EnF>MpGUvn`q820FD5u59ig80WK4aL59Ky|2=}OwlQ@ud~9OH
z=dO#7(GN!X8h+Ta!W_S_AEiRvnU=u@o%tU~`9{mw5}_-dSS;+V5105P>xf;}krJdn
zSF!=>6J5aVbI6h_W)6ANwI(85kR}W!Iq@-Wgv`90*ul_C!4DM^I)o`fM05p~n)yBq
z*vTsTTTZ%l7TN9sr>{)-UrE_6{!K-y8cq8~<`c)0Dc2xs4R8m0$c8u%Wt_}-mU~CB
zXI5Tv?5p`tn;s*}SPW>LWpit}NybUzc%>*LdJ{wjRMcH^^9|T>37i1gd6+Y<ZPYPi
z8Vq5hw8=V0ht+L&S9C(S5?Tjh)s@k-VYpcLqZh>m!7LA>-=3Hv%q>k+Fev~blme{b
z1!Y)_F2|a3W(M|JXkJ#Srt{30kM(z=+;3DH0EiB>p932zt~KC;E(#pg`6zh@IS>$<
zl|JmrN^SbT!lLbUAx6scY(H+da_YYA*OQ;?chz`AJ|*9O7K+J9V19e~ZuS7tqg*=N
zo0n>KD%%<SL;i{DfR0+}x?sm$f&wPp|Jh8=|E&zqEeKk$I4^f_%vRJ$5K9^1aM!pv
z+e8xcOW9F&Sw<h(nknn|Ws<gGZNfYLBDhjn_U=slQwBP1x7=b+eb(KaHq5PR<M}!6
z7-i4u7?Gz+Wv@agD2l#DqL#&-WSQB7;v^;8oZM+gDdd~=o$W7@##?78n{GLzd9D$%
zo-v;Wl{kB-m^9$;M_XMWuL~oi*M-r>z>Tv((LFU3{Z$#MNB@wy&!9CjIu)-1N5Y5#
zfeeVOFi_dasXXF*{8$%6t!1;o2r#k^6W@PBEg>Y@=|6)JGf#LP_9*YcP-3gifYcej
zwAe^`M8k!(u{a{!7m(^wqZ+<<ZK(|Pu?;sA!&aDz13}-qD*HjMn+05%2{E)uTte#f
z9Wf4vF-^b=TGB#ZuQd@rKu(s}vN@nj2I}t>)#rSmQId!kcz$F&t!WqKKbR$>vs7Z5
z^g@>k^|meB8_B>?pI+0*sN;?K%pt?P@dfYK>n`~prQ90%XWe4DiFrjc0FfbRlsO1X
z9IqR8H=q?r5N2BlRYc5_Nv$x)CxNMsPH0~s&2^;!nlmXVb~?UuyNU?9FcPKq<xkGQ
zaeIgO!M8a=A*<V)pg6_0*b*tCvN#Y1rB0<Q(HLLR$)rd3r{H)E0U~X@Rk`a#cyjQW
zLMn}?bCt_uHzASAgS$nJ%z-h)2j7BtLt{<TkSGviCimGsH<$j6WYq@6JAR@xjFl^I
zPXguwsSij7O~H;pf4h@1hA;tnz2YW6VVkZ0e`fZv({%V#b<=r7e0cganc5Vg5lOCn
zVoDxf`laK%;0jgG_W48>KWP&$CjwR74gn9Kpgq;8m87I$Oq!I6*l!vewis$=)<*g+
z;Z}6Q+5Cg#10hONxd#5Iftw|sK9mP2{nYVQ<~MAOCekTG5CGanwFe1O+B|dtoQ;fS
z-L^puC{>vtz(|AB9|<s}CH4a|HeE5)HbPTIFM)w<t<j4MZu!|IZXwh+cN}A9ivLnm
z3Eif5)tpO8Dxquje-_}is|mNFh6Cbip|sxTgHnC}#N&z_K4lF{2RSZA;?OPYoliiT
z^~k;`^JkR0@vpy^9P6H0*sb`CZetS$%Z;~L+WoN)>SxL6a$Bc$JJd0GI2K2C+I^8|
zcp}yeo&*oYx~=&5w(KzB(P4PcTuiGEsv#PC3xN<(na(?1K57pKF0p&93DiM}7f8^T
z5+QUG$tv3Jl>!7OKFYe&dzu{0Y=JX%V~Q9F^qE$;$VvZIPJx!=j6d&Y7XFvPF6}cF
zYUZOyTbxh%eU-+Kcz<jq9HE`!{@??BJByVa2Gj2@>B{P}YH+vpp~QUg@p=_OlDBW1
zaDaTk&z5H3Dc+<0y-p;S5L~+k!`J-<EukbB2QX+N`MJ?6tY1FfO%Swwy`Xvmb(1Tk
zlCX;S+0>Bo@e7rg!%$(w@P5UGTiC$cC0;7k{Ld1R>wSk`-lIu!R-O1`>3+)+!gmz#
zPS<)cm`<vq+;ZXx`<XGnF@|dr_wjFZ`M&VaYm5xYu3tOsmkpUB5rrt@)z*TA(oRj#
zZ}{=PI}$@JIcF#;RoJmfAr~68)5etsUHxP=?#3NQa0a+U`PdKuX6GUgSAz@XH~Bi#
z$C<*z&1S((G+W?k(H2SU9&3c(^}J0@`L^e*u*retRNvB+sQga*F<^hk<$TIubgD1A
zYV6yD6c!zDDLy!|zex>%UM;e_@95x~s*}0X#o;x%=2^ndaw@>$g&sIQ_6bj3-h`tP
zk!5LTjgZ_?T4VT2KNd;(M=TVgSIhrz>GDs{3>!XG1vga|dKULBg(nQbK+A-)aI2b8
zbGlbGRes^F&kLoz0b+SXceP{z-vXxdi{B8zZ38orP!_Qfnj7Ds$7m5jHVck<_KF%c
zuX07k4%M6Hy16_YyeM1tVid3eq9`@9bR7{faAY{H4lB>hMw{wBLyLc|Rao(N*#K}P
zA=dK^H|I{fFYI&o)NOfdRZ8pSw4n^<*n|4cv8J86h*w#+<FGDHIazQ6nK73<+F*6E
zFW@MUu%xp49k)z|2M4C^SO%itfTsAh*((uwzY>uPIG|m-nV5iZOn`}|HKNWK`WROK
zg}bA9#`;IP&C((zuyy$;Rm4qZM@npZhsfAo4Sn2B1cwzt5QB6rV#ayNFe{0)oePL+
zL*tyBVjE9HXG_71v~faNw;_Oj6c;*1%BTsY04LBEn_Q27nG>U#Ttb&-)Rusm#aBko
z1sq@RxM1ExF)=cq{z9^bDlY9mhqaDVN6KTkS)ku_k1(}m?^L6F<(t7uJZyf0&{<8@
zFJ7U;biRbDIcWM}m9u&4VZa>U?7Igq>*c)ujs@0m&^nU+&Z~Cw`nO&>k6q&Kw?&tB
zm&}~*6i|^tM5n<)T51O*p?vCNsGACNu;rtrsH<WT*$n*&Y~fny-NQjbvy?xe4?{Cl
z@wX_UlOPGi61Nbpr68ToKvWkA%aPVy;M?Otu%M5M;9j*Kw}~<GdpaRHtMHD7T}Nt-
ztigofb;bG;b8vSSF010hg?i$vEiqWkjaQ;EvDh{lvs;>MM^I(g)=ni1<w6xK`B%m1
z=NdBjE^L|b*9nbTry?FEF)2+6cYbxX|F@0x&+8g{_ciHI{in47Z<AoBuqYVd)CC7G
z&>?}SK3_NIaUsNrht11yA=<$2jaLK=*PRg8`~y*xDN1TSMM-uCHGr|tNZuq;&L2(C
zd_cubt%^~5;#-u0nsyw+l?PEb&~DE$m7U5=-{859lIFiGK<}rzZa)yET4KpoevBvb
zs{{8DU4gc0e*$#lJ9gzrbPr~Je&M7x3?LHJr>|qOb_G1|T7u4D-VBgIrJvO;!LD>z
zH%_TgeP2R+K8-yyPk$ZL|9iP@EPY0zmL3iR2*+m}LRaAGkv*DopCb)S*3jxV8=C4Q
zZI5sme51NaU&P%4)ir;dm!-yxQz6V+B9YeYhcUL}xJ5zczTV5UevLMSLX<fE02b8U
z8P<t6h4+J?XB!SsZT*lX=OiM@*$z8V=5mRSQ<7LJdc&04NlBm3(P&Dpf>zDV<BlJX
zr%DBZtbd?ZK1VW<BCjCJsoOVTM>M-g`FuhY$HBn{(GT_FLPM--SrgFlY~QLc5{chL
zp?rPoIPt%kolJB+uDAoFPz0rK^_*UBQfY^TPGAmWt?CPWm`a}{>b3|J?a%SnKTzdU
z#xY@0g#XzWHJ&VZ-`2A|<27SU{ze;~vjZ6Fb6ZwkB8Ef`bBb;KunfRVkqb=$#22+v
z@^6Zi85b#yWrSXu_ou}WJvLLinn*G?nx*5Oa|pb@bCV_Lx@?E9d)#rS?)yeHfvWOJ
zOw+IOl+-GkZMxb9Wy-jk&qi<G{CPhsXPF8dac6K5EKIOu%j9GTrCj)r5&iG+c_Hi8
zn+Zg5hqy8VZrXQaLD0#tZ*|{{@D3kS`3h#QS$Pn#&<AcfN%Y~WVp5@PMMO=F;laAq
zDMEF`KF${uctZ{8<pmc(kJuABw|t&L%!y(C;yJJ*S#Y}MIIxr|fvyOD)UI;!r-*x?
zD7hLkVnJyv^)-Sq7;PWM$LIg3dJDd&x9|O%7`nS*29WOV?vieh?rsothDK`W?naPq
z(4j$6I;D{=K@kCO<ec-pfB%Otulek~*Sgkqy%!vTrGc7{Be9DYWXr}2ncB!~6q)*H
zjMHulSTYc)E7ylA|K%kj`w(o8s(fE{eURrKtj#pb^dRV&?S==Fux8Z44nZ!C9n?~_
zWn1{4TbNOmGd84MErmH_imtdqir%Y<^`iQ!`g5s@0IGvZB(M4$ghD*Dklp{5h49k0
zIZz`#Q8k@TAmfOW)4Q)<&W=8ce56>~fHGQI#CBAhuzlz)7FNC^Y%odsgF~MJNlg(N
z{5}cKO*ScZbE>YM-DA?QC<?aYdwX1`Jp*h^nFvlEhFT?#9K=?lIQ85zj4;AraNb0V
z@}l8^km-WMAmOge5LhK|K(B^{2}^-p)wE)J5DHb+;UqfMNUn^C9|XTYI<?b;zKWAZ
zCTm_)d~WT8>x}dNrtUnJnH(vYLNm)@uI>Fv`NBUt*_>Xm*w}c`tEg#PL{xXsS}+mk
zMcO4%*y`0_f*A}!iwLsH`q91tODGf*6{BL2^=sM_)3un5qDc|aev7z1(2n{TFeo4P
zDtJW6g~4~L25?Z8UmTpP)KZL*=7?ABf9;H$904gEcGyBaVNHLnRJxt(l!Rf1_n_!%
z?L6#F@I$nP^krM<+e&mPHcf%6axV9Idd=8*;y?!ZDD!5cUcdMBmAEI9X@thS#m|L9
z?%x=vUzM2g=h<90V`0H~jGvZV*gcCFLoDF#gi#6%PZ4)21)Y4GAs@-ZmxJ2yLy>4=
z8NWo7nNKRiz|I!3F(fb)GJy`+3JM4m*{#XSyaU@K67$fh!F5>V<LRU!HwOk5Zv3vV
ziX#dfS?&RdYu^EhIj=({W=Rhj9+NKamCRENe+}(K9D<xGv$>9%td&`wBt=`=AIi$A
zs#iY@%%z9HnIIc1)D=CRk83v@$!<6VhyF?;-9YgU?Zv@;zS%DSojWx}6qf0^h7)cj
zCH>Aca*5u`Zmj<vBAJO&r9o7AbSe04<}H_$49GG94P>+hvw}ZclCv0JgS)(HAAYcy
zz8a@0b(mS#UjoVk)Ne{!l<iw`<f4z?xoec<<PqC472icS3ZnvJ>Zeu~82jci38zKE
zn!n=23lpNEo1fW2rDVFs>ec+J!0l)w<!365Q7}d9#xtb($Q++9@3v?v9dQsO)#}D)
z+QsL5e*5XfGP%6nO(-+<dCokx{gX5Ki`A%E!Q;l(z(*y(xgzFG;zbma<BG%r*6W{T
z9a_>`d$MJfU@cQ>%oa1Fjgf82H?f6G%2<Be6*dGN>#%M<_)6(S?8V2K_%nXS!z1g;
zFyNr!X-{?4z^Fbt>{6^Vb-NgEJ<z2$N7Uj7;N5@~Jg8%f?|OU?I4>G|O5{4nFZ|Lr
zmNxmwy$3oHUq$2X(z;1izi-~@LLPtb+eLk3Yz>7d1(Vinp*(gr35#v=6p7;7G|n=o
zFf&*Gzsars7c{<gw)O$#@soOj3IVQ<MZxmFnl-|c@=~Lw{Dbn+D3eIcm*6F*pyH%+
z=(l-FmD57KFKNFKCaOIaea8|a|M-h835oj{Mn0bgPJ`vGlS#pFtwpBEgTKTym2bov
zdQrG}nc;sWM-|i({icXnqXi#|ns`wK>J!rXG|EatKUx2>VlwNuLPu+pRCmY;y7I~R
zK%D1Bsnp^k=q*Hf$8o?6ar;yB{uA|tn>XZoS^<3TTYV+5v-^L<!7v3H4#}aZSEC@(
zd18fGrY+3Gqm_APL5~EkFWfG=6W?f5&-8W4nMkEIqUlMu`})+`YeGjy@mstFg`t+p
z*#SpzSw`?bK(p_`!7V5tZ?yn57I|d59NFxr@$agX4O#l^XjZ(3h|wpq>3n{n6us?T
zvT@zQNW;KVZUlXp@O1qt0H@}f_YW2-JrdOj;vqwP#u&;s-6lbd*t`-j27}D!fzcb>
zD8<|g6RLiZ+*qJjfI&H1Xbltf$;hW3pYIw$;h-1#QFOkD3yeZ%ssAT8?E2I$+yg@&
z6!vK|e(~eZaztMT+j;v+{6dLq4VG|~=JEQ*CB6fIH=g=|s|wB|^9aR&AS>wassY7v
zJt*ZV2xz8JO`Vst#Rjr(xjS+;VIAofY25Rn9du`qB47YP!p}LaNxk2dSoVPL6g6&M
zid=kHpAo6etzJFmd<#$Jcxh#-#uPzmc0!+K1c1p7b1}zf<>II?%z4FW!`ngAK_~=<
zJK(C<7XCHUKZxGb=A=!Fisr6+HLRk3s53S3?O%{=nRQ5*-h3#HU5{htQcd*O@EKsW
z3x4%nz5RDfyMRU!;{X;*gFDd>F>a$VHf?DzLh97ok&%h@Y|82Is1d_>CicBh?Wp;Q
zjhhO{xVKbQLsa-cg$cn;(;8OX*<}l-I8aztm7f1vaGUu@d8!$|AT!FN^(se6S6-x-
z144G4rLn>*Z&j{cmH}|4h($vVU1TQ1izpG&q2@8SwLFCOyh3Gjv?<A&^J!D7rDEqL
zC?+CDL~nkl*tW4G*Bi{`<$<)I&xH)U@q+2@BeXChn2Gfy@a-h}bg!<Xrmu^@jM(JB
z;qzDd*LZ656yDnMVuK^hcb$PVVRisX^-hdEnGj2Dl&!-IQ2BYa#Yf7~--ilqM_4q4
zPDfPUasiZz7|15-?1l1@e0UbEk1~v$31B$!im0CmE_yh2vctGM>9xwjj!BDNS}5cW
zLR~u@8=Wa$JL{6naUR1+ArrjO11MxPN=fYrHdkOkpK|W-mW`z@F+4H@>6(-((P2YZ
zikYGOLxKpIqIZeLH`-B{VYb@i<n(})9sM<hwcF|>rimct*Av_SD(mML)Bz1LbhmBI
z^T<BX8|Qp#u^Ca+$Wi;LL*D~0Tpjy@uf&j58)e)oZC6m{zDZ8*0*8bN-)&*B*O^VQ
z16Z$#Av7PJSgbC$QZucWidPcnlMYvBUS+A6BIPIV@jcarQG-*{#6lphux{w}h~lYJ
z$9!QFc%j8Kr4wplAjK*PZe)z8<g^fMKhJcd=wg>2D!{IV@uyf)Z2L~uoJ{Xd=KpS_
zalkk_k0VEACCUu%+{SuVM?d~A)y)8RX6}e0-LYR|k301!pmBu92bY$_IE{sY>%nLS
zEbJvXM$a5p5pIE>;{Ad+hT7irQ;Rl+I({Zg3|LP=Z*>=K8S8*;JfLhfY>X_p#M#KC
z*ljpXoWo#NoItayg9r^5$l4*?O-3i4ZyG1VO_PH01HxYiYzVpuADhs%)pWrfS;Ur4
zC%9<rs#YhrjlORgoE_2X{}AqCSz~qYqvIQX^ciPi?32dVQTVSBSSc+X2YfAQNt6G_
zMe|;lnj<L=Jl<=&zPHUk*c^t6DbWd1WhTyre1f@TOLpX2F46M7`-)$e=Zu2;Sj)I3
zP&R^yR-?r9@IC82Dakoo1}kN?6o4s?=nN^xFM4ZK_T%(h^!Bage5KsD?{Yt(_e?Ch
z8<$zC2=#K3{i{V;(Qm?SuIA950%q%=`E*&nhHcFsmU4s&zE)QB6-<I>Vb^&%K8WtP
zFkQiL!30L6`?;*e91H?JO2m%bO2Y5N7YbaU9|Nuyc<r3^kpynN)#B^xAAjd#Wnv1H
zo*n*|x78_Qr+k^AT)-qnJTR<&ujsr_E2t01M%6j6<d0P!)Q6D>rVpeY8<%QxJQ7u7
zKpRfS2~<Gv-uMJ~P8qM?bcWU9y?MujV9*U7GF3g;n%hVJ$R-?^gjs)5j`%0xLBO#+
zy(7n%A&Hs-;)Qquyh_w6q+F{TyQaw7kbP}-S8fcSO@2FG+X24lElc?&*p;pdQ2P<G
zdpvZpuc@6E2W2L07YSR$q8e54K16WY8#QKBcGZ#_bI$k)@85PMEh2~*<tO96X;`sL
zsZ;rk-1whKs2zxvxDAIU4fsg;F<>`&oF2hq*0rW!u^)T?3XwuGn#*sE+6dKk*iqAR
zj!X?^N+m_nXunL?JHC}g)sgDf8zmGya}IuC91WGzBQ&>gqxXc{K}ub2hhbycs;g5A
zkR2-o5Jm4r&<82O$4}%VjOG#7+E{$VIf>+0$y_hx8Ij9q^5gbbIP4&z!RY^*sTsSZ
z6er8uU;^kU`6VssnOI4jhn7@`G-||7;G9ytbIqT<R^(F&zo-o1uteLL=24DEQlKK|
z^UWOI4>e(Y{uo34ORV@5m1Ir#`FaEWVgTMbp%X0`1klM4>j*NxC#MMLyCn_xm~w))
z1-5z@(`SE?IM<U#<W@JEmL`{3Wl1SZ7>VNxzg|IjVP3&B9bu(f)P<pV`be!8akPDa
z%K@ONiiNEJJO_hXfNXxbg<2K{Qi?v($qs43lD;7$9HVXy0$k!gH)p6uzf|ZAk{gy%
z<x1?^D#_65DVbm*L{f%6Y7;$e@!ib?@6lJ$?}Cha*{e}VC!>2t^)%6P)V5}P{$D*b
z;)LFkZ*oUEfxwD79CAZg$0xr=7P^L8(37uY@i~{%7xETnlpm0OJ>#fj%dUV?dr9dK
z(GyldWyz*{{GS#u0FBdiWjyS+PvR8{YobwPL{h~I<r<rlhl%L%eb0u}D6jQ`aB-mZ
z%<*9NB<7gRN+VI|A_8hLZ`f^kuco1J@Xnk^Y0;e;tYE*)37>1$LQ>F{ATXck4^9Mp
z*@2d^t|EMg{3V;43PN_yBz#4OR4xg5XR3P@?D@s{Zx;83N5JjM6J;5U<-JcmyQ>lW
z9R<A|Ne3whc+C_6hz+*i(V;C^o8Vjij3>&v3=vARm7>9BDUYj+6u>+8C%|{s6<X0`
z8GxEilj#qg)z^o&jc>}yvVSlq2Wh=AUXBlAkyj=JA@l)r#;3f`VEj9udq(zfww*Zy
zkTdgl$4I$Bpco-3yvNJl*Wr`NNn<DO{BoTOe2vQ*gNHe1@fl|$eUW}&u4jx7>MuF!
zX{TMSPeN664Xyqy2L7SGBofQL$Fj7w84%vGkS?P+|IQbV-dU{HQ9jL4EZ<9xGzK3@
zX9kqEm)^}q350ipC;?MBc9$c2y0nGIWXN++@Jc8<pk}A?UwU8pyY(S_WW7<XQJL}#
zHM7~I2uLO|VC@DZ8?5_;8*mIm%_PaR2~l5zihe^}2jnj-Hgvu38fN#yC)zwHAwO?P
zKmT+o`!3@@mdi)|`Q^!KLV>yw3J)nT@>=_=Iq!^gHK;V7!Th)7`eNR5BCYGm#L4??
z;_MK(NdD2W8UJGwdP#=EVvs~O(e;b|<<y9$tj%k;H@?~w{dWOpVj!IFpDm%U--t@b
z!l75E=wV;U{3+8606hGHJ9Fp(m2`ZT`<N}1#4JoVOZt)qNyjBSi^*{7LlFNG>g9sV
zuW8!O&b31&zta^ka=0U}7jA_X3+?IG$+$FU*K$xigv`-Ro4Y|_GqADWxE(HdNdJ&r
zug~QSTZP4pDZAEqjM-ie>rH%D+LtBijVdI5No@j<f&UO<vP8CXumwJi;ksexGfAi}
z&tT!o;%_!+3}EW;YEUc^><;ir*_o3~$8GwkPT*w1POKJIQCA_{K$^IZ8{FBBg*v;r
zfS=OLh&zxD>mO-bQ}HG%Xc(MhAk#@jZBKSEja=)dc19#HV`$N+&b~Rnpmj3L&j>&U
zSh?frwrOORHo#g@Pv-W_t8fCCfAZPW@EBuv3Ba-GNXLoUGB<(5<lN;r445S)ABtl{
zkvaDTDE;{OcjFVFdepVy3EZ@Gq#`8<;NKm3OS?UwFoRP1=7vU1_Q?Zd=Yt{3;g>|%
zNq;7`R|4yw8|<e``<edMe2>t`@P!Oa$0PL97|hW`8(((uf>)E0VGE`|xgtD6bgIsm
z+0Hcz@as067PML+41iz5oA^|`)<2q5uGS0kQjYeT<LM|bAmq)FMr?~><r25iV<_x%
zE*K@f%7I%0v;^8P5i~hdhHhOAyam$7j&Nr~;-JSkeaHC4y!nY;K_YYN+H>254CcRP
zZ#T&C`O<qlK4^F}8ed~pQFPBa$^6C@9j=1p$OGgD9tvf_!c4mZ_Wr$}coPypSYg~K
zk>#6TQF03L8nb!-RTKXObVOjxBAx)GUHD)#ibsw2<Z2}_{N8PVwy;A<60+?Q1@$KC
z*?H}Gc#<4gF4(*P>9_lBKUwsr863logpgVrZ!bp3PcVFLbukxp_srOj_oq}fKzE~x
z<#+1QbNLpT)FtB=Na;6ofTdS_u6=yN#9Lk`!4t>GO*9&G?mxy&<-|+H(#qFA%9{<w
zrA!u+EITaTNtE1`fFzx4Qt&kf#kF@hh$_Xfnp1Q>K@Eo{bK)Dg0}<n@UvSzUuf3y_
zA+kV)x*;4@{Qb9{SbhI~i>f0>=ob?e#yCB*3yusJEH0%vRS{|<H>4<78CmzkrkKzv
zclPX!c~R@nN6L1>2)U#Cm~iB9iAt%Z-!+Lq_l-i(*zk9y5u_xgt;N20*8`lGX|tr{
zk(!k=R|qUIthcz4-yD7O4*eLiCeNf4(J0l|AzIni7$;brrA9thoWm7xgdzyd?)q6A
zy#6QBT%W?H$!;5H!X~9*Qm1%K`kB~)e)ETho28?xQLA<N&rj(8LZ1$xII#8HtR7Q+
z{-;+K9>ny1yYV1k$y*}@D+7fm&IEb!87`q@3j%C_m_UzIK*53I^>@^AI&^CX39-K2
ztQeuCSeZBe_*|t-^vyOUxdJ9L#NIQ#a}=0FyO}n*<SzS|Qtykbbig4F)zB4e%H0UW
zqQ|BH)5o{x7s@Ue(;Z0-5%5j!kwl$ydIDK5@w2NIM98?5s*eTgUHcSLWdmBt5osGE
z*G&ZjAKalg=&pDs6+z1(*2YS4GRTxO)f@kh>$6F|J}Q&H=Ycbk-4V?t5vB3s%L_`(
z!C^GPQH2^XE5_nEW28t;QEw@N^ntF289jLddd4>nv|m%ePD}*1Oj35sIZdvh29Er&
zuSa+_{d1x}U1gAYz7XJi<?je@tUT-V5Q;zbXx2%=T}c+8!-hG;L{yQ5Y*(JwmP(b+
zjAOC-*aDNQgqE9uZ;4{D<pRGl25r7$1yp9=mR;}@700ZUoZVpfA*MJ{&<|;czz)`k
zt>0}1R;hgm0gD#u$~-HE|K++9)3^2PK2ykf2}~TFezpBDJ|}`WqW%E|Uuh14W0IQ8
zFsnDlw`(V1C}ZA_#m=^VR4RCAPsQNPTD4eBeM|=b)ezsIINMwLQ>;+!!Urk_sZG>H
zV?9`GB(J{2oZ)=a`mgdn?CO?6HXTwBm!|n1mfYEO4Wg))8+ms}!X@cj-C<;_o>$y3
zC_+D6Y#kPZ=4U9tU*vMDA)gJN$)yEIaN+@cNsCOxH7V5N(nm<F%5Ia@aqr#o#)1+5
zzPSbv#zx8tD4r(u1OF?L{L_qn>5J0v+YNpc|1)7vBPX4pZb<Ik#5kr%a?1xV79eFN
zU{k~`4e~_TcZOq`xs?~6B~Z{B#?FG9Vp^g%8EaIq`o?FT_3`A!KNN^S?SPA{DEk`q
zt41<e2Qg1homkY;C2jp9o-tgv`l{ZPa%;HXgjTeiL|0695gyk^#Hf(TelN_;{IwoJ
ziSN?KJ*`;sMn#rZbV4IBXF8;;Sjl)E&G{*jjGf=0o?<C@UIl(E=(BPbsZXV3N=cZ(
z%d5w<V36SHID|S&QUx9PEaKTjP4X0O8U9PUFeimi$aKF`3A3T?-+Urlths=0H5Wh<
zvDb0L)=UbSK7)>_NGfr*fB2T<z6$~Qr3dY#Md}d~jG(%%c36OLVPoL2T5&zOX5~?Y
zL5#LGzU;}AcOv=;)fq7T<Uy$W5Mzq=XIW|yg@S7hp+}>obppe8^la~P3v}#k9e3ND
zdT&AaklQT@bNfFU-3o=$9UG1U8IHp9C=}roDItBWYuz12eKy#TVwWl%L#{IiPseE;
zH(;wZJ$niKg(!v9w5Yc3ZVP4T^B?x#oPnC%W13uiS&m~#aRSOzb<$Ssc^hs|rZ6rX
z0Rr*06%}KfxVtUJAVo2~E2XUh<<_;*b!S>@`3wrUWUEMZb(6lzmrUkDSBg%*;v%3i
zGW3$KJ)v_bjsR%-1!#D%-B0RM3Zo3y73Xr*%mz=0#b|sb@?ux*07b@Ul(%LM=Dg48
z2Ccx;C%h)na&X_xEIsEFqU(iyd^@Djc)ncS@Jn<U48dU$*<QjKsEQ6&#3~%b)*cIb
z?!EuX68=pRN9%?j8`2NO@2kjO$r#2k7OdaEC;9G~Xe=>Zh{mLo;o;IiH&7_7j|@>G
zTuRs=rqePlxLT{0+9s6tC3I5exa~|B)s-6MY4krBE42sLj)>*Fg9~ehfS64(+vSNe
zCdTn-DZ51@l0>u$WbZS@iGld!X4Xhzav2UA3w=^spvs*0=O(k$-Pq!U{45;VnU$Z(
zedOr>kg7Q*)n{<0C$9CR0-pNVG7jd!*}qrX|BwhfFZ@4p5b%UsFyu5HM<I#LhGX|F
z4y@mNuM6o)d#H3;wmV=(2;xR^mjW8a7zJP4Cc!90c;zg3oL<GA;oIbTC|y(S_0cGW
zI)Ih*R5TesX%oGFr33+v36xANOwC3G)DnTz${=<RGNf-4K&G%bsW>6rX|nN=>kLZr
z%<{zwq;H5{0w(q1EZnDA$M+0}%&!(Q`JL$eTgca%%{E09%0=I4*LtqKmg#n*T0pTX
zz-H#+6bJG`__qDvpQqTa&n`nwN}P;=HY$RtVSF%^d1B_`VH_Z*uiUHG7^xRY5+8_e
z*;9#uHQ&IjesNiD8(92??n5J}BghSgYC4BZp9qv!C#Vr@48g8*1s+kAqG>Y8?C|^v
z64|gm^Ff+sBRf>Y_krayLsFw_eH3QYZ7s*&=rC*1JQSW3TB!y_*QCQu`ifD_Lo9Qn
z={;g6m?u=YL$eedVMPf*3pi0%xQ5=oLup1|)d+sac0t{3*gmO`Q_c{kAdAY+@W@r+
zOzrjOLgw&kc<|S~()1z&fDq5fOoQ3<%j|Mz%l0llr5;eAwhw}1!)DcSGf#8=h4M2o
z(*{T+sBrF2%#-K*CHEe=3#c3S007)&rYxvuzq9=o`ODuamdQSIh43*!rWg(zzd2qx
zxha2xk7@QQ8(MAyC;jGN(<+=!)phXZ^}Q$DRt0YxVibMh{erJyH<+mptwqQtw?Yxd
zN{r3m!`416D^Ji?WHv&@-S+lt(vPDy-q~=06^nUGlQB&UJL>l<2HW4#CzMxW$|4Hq
z{2X>Eb9<>6O0AyH%F&ZfW%`TesiYZA71cnNnFg@bRrq4|a4Pitel3mGmJJwz!06LH
zM?^bgj4{(4vA8X)ymgU@;FId677q6+dO+Qg$mKBcDSQMPnNj#A1G5(<kUX&BhK?jl
z%#GOh(BWV-zwm2XQqF!65i!ZbK%nbJ=H@=e67o^v5H3dP6*rWmHCvqFCG5!FJyI72
zrCXHkVhV4!t|l4_3ZCin5+nFNnj|c*2Tl_{oq`WIvsNU8({eCNvLEW!p&ZB)C(?{!
zE_3e#UMO<myUrd|i*^!(yZ+-4{i}oOKRMnUl*2eYh9;Uta0R{q@H{@+=$2}QdzECQ
zT-UHANQVwJ3zxDrzmJ5jUXY3!u1no!CndFisp(imHQeoM4NvS57u3r0VJ2XnK~>9X
zL3_-FI0l*lA=*3?iM0>`m0o?5Gzw<=-&x~A>>og<R#N6V6DW0kBz1XQ$<tn#%W@v7
zHHbdR?0r88Z|F`3(+HHQVQ*r>Viv6zNt)Xe*P)-eLDmxI_K(U~xGg)CD~X;tHl03d
z?XW*wnaAninCD3G-^9`AU-n?eE-q|ft8JY&0QpB4GN*E6OO@KL{?t#WI;;P*fSc{}
zARwAZ!^Fq(mu^HN!{Tkye_FBT0$WKEY0X$&@v6hKa>JSve_NWQep#uMxVq+Rj%53M
zAdG|G#Z%i5<W&CFOnv546o?c!sxlF78m{S5loTI%=r3D{7e8C+&S=>mV8fz79?I{f
zA518Lz-SVgpJ{|?k`g|XM#!SYzf=NFG;S&WZL}!IN{U>`EY)Zrf-9PBWm)PT+x&t*
z_xU{iMF~8Iz>oq&Vq8}34iaj+9er!Q%`1YEh}e=N2{X5WwXH!mc_)L)$*8=g<`>yI
zD45^~%wn{?{`bD!EK1+@rBNKK`FU7r*-X9_!5XgpMDHTxe_i0>B-PNX)9c^~f(g&O
z|J2cg-@rYvM8;x5op?@^NG-HwvAxA_31xAO(nzh~?j08ezQ|gZ#muB>Fe9|zjC;yL
zwkVk}agoFBc}l&eLu?@WZN+YO(-t37dGhuS7|v18p3Aij;r}QC>7mv&KY1k@8XU<B
z)OvPbTCGUo_rteetvD;+I@|^WYb_6{#%DhiKth5)!wUi3mZpH2enFox)RSooQQ)+S
zGFkL;a9_H|f$if=>L1myq@8nv<bsFN;Nbh^_;+2tcRJKwMnz`TL`)zT^uI9()nzsL
zj!SY=+*;%|TKTCmzkz~mCff1_W7B$$GEW;_HMB8pJNz!2wt|?vxW=*Ee4M632Jt(s
zqGRR~-5g5I;W7$oAKu$xSN3`cszTNO(|>m2Dwdlc*!N*7sV?<?%}xBxW6dyIZ3-V|
zr@LKqZZn>wwa2<E>JO#`$spK>ENUVAnXx=7X0H-ZaFc}SMTEDEd-E+Z!LpJSDU732
z!%$y_slcTRS#9-^&K6WqU~a!xvn<DbLoA&DFtP_0D{GNL+;m^iXRxYxZdO42tWgrs
zZUts!RUgteY-ST^4-8*`TIKCr?}mFKp=XF33c%0`FUSl}Y2-K?+SZb#9OS3mtWiUp
zji11l1<GpJ8^f^e-A`zzbPi}rUk?$HkDtq#zx*zPCw^B+#Dc+C1*MxaF5>RX>y+Xo
z@h{kD-lt@_=gsDQv9W5(9bAcrAxa|g*VtpH4sZ52VQUspauBGU4-0crk#-%`k`#|A
z?~J#t0!|yV22(eaW}-EnORR#V4(WlmrvxwKwacGm2){*tWPbozFrvPzFW)T9tf9ox
zhTNSaA9a|lj4Kj<>J!<n6Q3g2N{(B%KPC)q2cEpgGtqy_Qow-5k&%)Arg`8c<5ocu
z@i7qwnwWW;LwsJ8GR8hlX*mn;$2qNPjw6Jfp>4cz3J8_z=G8NL{T~Ps`;(X7z+v^S
z@lgYc>mRY4@-5<#njW3_2*HgPBAhv993jx|jwH;$OAJ6WZQZ2T*9UJ?a4YaYZN#Ge
zr}~h-X&lMkHGH7(_(uDpDP<myKFae&eaw#V#EM2^W+7U&NE3A&ngT8CJ;HC3B1Yx$
zH5Aw3`Yq}ucNCLU-|XEw%sJ9GZo_Cj@-N?vQ1#4$vYN4keYUSsRbdT2v^xaI#osdF
zMBY(TSHI}uR<8NUJl)=%;;S=9z$yEq)5XQ4>CExD2NL}Y?0Rxd1TRm~-eze_F0zKW
zlq+x%b1&VpH*N!XN%^cPoPU|layY}um)MF#k5(do!VKZ%)^oyc=6zV<<5%>=``yFK
zDGFZU3DI`T?O`fo-Ar_Ok!tQBw3L(`TP@6n7s}2^hCz^Hwz&VpP@1#H5|?cC6)4a+
zi)>yIp|Y3BltSc|yIZ5Ht$LDD|J|<)YG3TdDtAmq1f4JDMoml9KE%PPJGMRxP4D&D
z1!Z_E;8TY!BKYtyv1+bmpJl}V@FG(g&HMyt%E}z+vNptUR>>5%7g{8-h-V%T2m!2i
z=^C#Lz&#_#g{}`&`b?G=b#{-4RLrJQl$qn}n3by}<hY5N*a2uRumNA+qRECds|W{s
zvv)e^bGfU6^@C+_GUdN_4ZW3!^Z+J-?_?QPw4^w1EM!FNV;4C;aph|Vo=n>CLFT3F
zEf+q65UPmM)HI?rEaFP5aAg^dyFQqA&K_PTF0Cc|C+k5Kka=AScpXQ-2Gu;@208!c
zjGO2BUs2G(JXA_(H%=IP89nh5Z{_rDmeV~$TrbD%Q<xMJl0?Omf`O9LBYLl;*;YuU
zDUrT$Stg&<o9pWo-C2%Ktg~-k-lQZOGb0!osK!!Ozp#*{QtJb=9OY_)9OBhi7hL^J
z@<X5o*?sXoi+Ba@a!)%~4jGMdBW^xfr=N|zv8CH}QfN>z-cvmHzNFW-Zmf{E&&p>;
zKf(Ip#ce%p#jEhxbZW|!WSJ~a;@Lqr6_)ZF+4`r2<iAS^{zW7m^0X_%$9HNaUa8zU
z%h`)%X{ecZ$&h$niMiq;jazt5ep?C0-n!=PH<D<cAP}hXLM{x`C*~dBykO?SO70Y6
zd`~6!hs(whUmD~ywvD;rr?hkO&>;h6_}zpz%~0|f=Bp)G%ZFMb#f^c9r--M#5UqnN
zfCIHHFLU%_M)7>TTlNuQXPLNy7?TLD(nOsctl(+l^Gf}j<a=n$8}80Gr%e&7TTTqp
z^CUG#Zq}()qEhB>-Ns2dKIH6&$dkzEpy!9hytgKJc)riPp7TfsPi`DkS-5RL?Gp9!
zO=?De&UpP-pgcSkQ^(E%Z3nO*SX0>`vy))NVw}FFn1L&4tsoS7v}QsvZjCB+puM;7
zb$ACSUeh*61ZEi~P|ti@&&VGcFn{OSkX0rAVSsOW3b)LwI^R@?jJzkJ2lIxviHgzQ
zww2oXcT5LsI7|ONwn}KYUcB?G_tWt}&YvfH^tkT^k}zg>vE$a_9}lsKnL;~Iitm@-
zchjX9m1&zrNA6Q`k;D)U`Y^Q6W4+X;$jP(cASvgyNltC~S5$lAD*Ro5F;Fg%5al}B
z=%hjSh{pnx!OW504-=^;&BwXlWH9Kkb2sBrAI;xd*fS^C)RykkI^K`Tl9Q{ONJiyf
zs^&%K&SkRg#6MoJxZcYas6@c$OkNu~L23fBLcV+xD-1W>N!fSX?wX!#pa$g#prBqg
z{2Y+-c(WuO!02N>(Awc$MB}`Eo$$uZ^hj*un?7*|(CTm;?YD;`8r|FBC<sNQYOWSy
zcNk2AL3{cWe61Kt2Xnf)44Su!Mf`s0sc{n>A)Eyx@VR9Bi;He};txc{&Q6hGzNt`5
zf!d>u!+%t;N$tS@);=cDoxToXhO)DxB1aCb<UXZtq#hf!=}mb$jNyqjn6eDvhiCM;
z!;E_kk$-e?^hIq7mY{Ef=(GrUMxm->9iaDgMag^p@)8}tkc`9QnezPBLO-=6+Bw`<
zkT+(vfel^A8!y)Morv-6ITf;-%(~Nq7#-&L_fzTPOC$S52BVFG8gd+Sj-7-KrH5aB
zs-)T3bZQ6cSU|cbDHmHVlJ3~6SX8L59CWO;Nc#3o=VqR}h3%(q;ja#Fk3nq}z^zEe
zq2A4ELCOv;rxQzJco$p?<diuw^0?1mLmb;<n0GfHc0fc*+T5XR0Ey(4!}Eg)5k^&D
zp2$iGm<vkT^eJ@^Tk;r+!dQE^W-o31foUY<-Wr+H!Y3MY9uJf|OX-x4K-4qFg~-Gq
z(`B+=L^Q5#DF}bfiQ$4|jJ}{mB&Sc5&D-Jy*q1NnUaZ;BYD4OSkA*+m>H5&Rm?t}o
z<nTq@E;Z%s+m~lkQ~{B)L|T`I*ayJ3L;GfpS<g1T4blIR{%Of@CkP`G>;-7*RPHcZ
z!?`-d<hhdnTr$<+u(sPoQy%dYEtN~7K;3usSK|ni{M?KT+ZNN+(z$k9najq9VI-FV
zK8t1^yQ@a$4CN(;t%b|EyH3ZEQeFr=Ow(I6?x~7o2f{5Wa%Phgw5C1p%ziJ#fqqMp
z(HpXwZG4C%W|h-F3?0r=rK#W|smAEU%^nainGh9K7K}Gu+-@hi+lhchtd41%4XQa)
z`j|Zb7eoI#3@TLn2xtcB<(2nIr}(o7m%A4x$VwX0fq1>iz3W(N0oh1+gQmI2-JuLx
ztRnIQShSt5wJ_;Gx%Yg%y18@EvK(++gV_hYkZqHan&$E{4?ddr#+J6oTk$-32uFSz
zjFNB_eltuQSS~z8dZ}S#Z#CbC`DKsr%oStIPg_;11}2C%DNe&!UGe*rYo(<s8XYg>
zhR@bm*h_xl&P{oat{R^Rc%0uW@%J(}p7~t$`5v~;o8UXo!81zyTzF0*$39K1y#G$E
zIKmn6+X0K{yoe7MuL8*%8ooZjXJZGbF-f;)$1QXD8}IQTxR3^~Ulp$;DR5yZjpLRo
z^sWF^UZ{M4zUGi6yo<f0htsG{#o#WknnCYV__Yafh|^?s@glajHK>SW>OXCbD#12O
zNZM}Q)Ro@#TQ=tK$ox$*dz<V(ADyMPZ6__-iT9~Wwrb18-J&6C)LsE$H~QrPTvY4G
zG~~!-{g!Bqi$zk~LHU4oZfT^yzE1B)L1$_fTB%1~cJ<$DjPogD@y|6TRKUS`SMNuN
z%E6_&_N%A6I%xWP#}oji144&O*~J<9n&~C5qu|mJIa8>S2BNjwi`b+k2Bg?G+$F$_
z$`EQ`N+x1w!W`<TN{%qHv+@PMYPMd@S_d?rg$|zVXf7Ww3Y#|9Uobje>_+OMC5h2l
zU!><>;c8K!&k_X35;hh_bc`D`*Us9}+G;dU7<;fO5?J2!9)zy3VEEhCTllay(d&JW
zU$J5bpaPVFK5SufYaeveY?=ku+SiXN8Q><U<@s=ACg}u45R<o^j@K+Te`tFApPsA#
zWG?!WT$q*Q<hM&)`am!=0$*Z_kE^h9nmP$IkXjy~xB@kW!MK$RlDNp@^84E+Nbh4S
zT_RW*RL=+-8vvcFDS@};+I;am2X3KipQVoUg#4nWWuym4_Kka9h2e@4L?qFonfTf1
z=tnx<G>nv)d}tm3T8X`x^12;EKE7dsp`Os&=-8-<OmxJ-<qZg|FGGspq>@#pN>P|{
zRG!T2lN*#I-}DsBC``+w(g0~-1uQ#Ap)uFYr%iBE+n#Kt$H3JU9cId>=bO6rzvh~F
zlO*g4%}t+J39lg7rH8gQPJbi#kyMZ|)(zBjkmi~4?mqB9Gg>yX5d(lW%knxCVH%!W
z?nkp|Kbo1LZ1V14^#YC$ob?8ZuWxZ{_>blQ#!DVf7KX`eeg*?C4h|@SCe*_9sPGSX
zZaH?7dcQRD<HQ&XYDQf6fRIo|mViH3z8N~5QqQQ}qJ=?Zl$!oT_L9qobj*@38+(L>
zZK7jnP)9+)%3*@Xt;>n%hhU`5{^kN5aiNqKBcw0$p5?>84pCy7PkH}o0ndPc6Uwm%
zL|_bI92d&#Uy^3vQdNi6v{OP%h|A39DXPXGE9}x6{}K9{3s%c+C+{mk&2&}OhI<al
z_g3F0q=}fAnzus#r0DAr)EZAPY!{4H-fN3wH7Cu>QDNVW9!J|E>|dWF^Y8#5IGFlQ
zfHNoS05fjIn<j)~E^3D2!xkP|wIc-s&5~rc>Sc_ps@za?X6K2u)P`d(>)+VoV{Mu+
z9w#lsB6YJZ%9oC=+;8rdOa7|}{=wbM4JkEupvMpJ*LakGvoF6PF(gxDD@K;8Ygb+%
z)DeVWRiRbnJJ-EKm0+-8rx2{48HrK~77PAf*lUv@M0eV0(@CNCg}kmWu!eNvOB*zT
z6n5J7!(?cI8Krk_vq<l#k6IR`@>gWY9K6^VwdQwr9giyYpi7iy^;(LWh0iNzUbKMM
zs_$H8M1WUU<0Rs{NS#}~yXcgt4&1g?EB^PPu;$tfvcl)%|Lm0hi|A4FO1rtInl!n>
zI}7SbApQfihZDoHyWM$vJE-LC0Mj7g>4=WTeyha_rsgvH99P>C?Nj}7D6ohfCR7r*
zNHjahnirS~ukM1Z={YM0V+JcZ<7Jp+Y}O8WDa8rducEpfwTT82x6|Ae7o~FMNs&?d
zGIyh%q7Ftsz-=LZc8tQ-_U+s^dtD`qI4#0{W4qT=ClGmB+fEi<C~67XK8&I=9uux_
zSt|UPgq7o~RB`aiNgdPZxqbQDg0b{ue4e!>h;@yfVDt<OOHuBimRETDA}AF7&dPGz
z^tco<@^+@Wa3Zxk(oajOC-x5}0jtU^Gmwxz4inwf%ZsGOmk3_%tu$`KpYWv7FVW~;
z{T7`r6QthnlFSO@7lX0`@`6;vrYME+;HOQButb~XkoW2cHV+uKyoIm6z<~J05x4g8
z^JAH3Wh31ydh_xghKok;l$J`++2N^TriDA<N1~}rj7VGGZ$AhQ;5Ry}KrEEL=Q@((
zx3naY1`2dJFvNoU@5OMC*Zykii~nJUOI{p6hEjT{2iEF?EDGS4nc-zL?C{V<y$RfQ
zAcCJdL?7z)quTS1=s#M#W@!-r@Paf{_T=71Mhx#$QXtOZ3BO!X6aQUuv#l?3ub+>b
zeLq8zNH2Crft&i&KD(M}h?RMXtT)@aXSr8jf)1%l$AkJM0y!7XO^C{<QR*yt^g)`0
zhzWzMzF0CH3YYxJ77I>QOF!VMVVN^hOb&Et(B{)-BHWFkv_&+0r{Dq_Qc3Pekx|u2
z->3arl9Up>{(LZ=5M)nctz*XLrWXQK{j+x_`g@JSv+rW^aKP+C_JMFXc_!K~uS##!
zu;C_K*OD(ljJy+5M)kZ5XCv*`6fO*qRWPsfceh-cLN|`YYixJ>M#dK*xx9jI9{ebe
zu5SdBB`PYu*5ejT-i_G4%Ti!g<z^!0RBugMiZD+o^OpX204x@W{=PkAXS!LykCeAX
z7jw08?!4)rU_y_xt7$J}a<DyacghrJ7-I>Zqy!eGC_F$s!z200&r=?XhINIm2wl1v
zi*#vF4?o6lVwd`Tm2$fN_htESC8jy{gj%TsAM=9An*hkSH<vFr+`bx?ekXg)%EpP(
zG5ScUu+e%zsLJ;+hSk!-i1<M;d2;DKRO#5^E9NODe2{hl!0}DyE9sWv&3I%>J56E&
z9z!*=AO5W3Tl(BV;VNv0D3=%@FIp<)6k>Y)w?#y#zMhS0yY1tbd^_0RX2i~lH;#;w
zMwsfnnPBnPFKg6)n+*vol~X{H6$U5p^tbj~J6ET>OMBg}_zP9F{HrP}wrQR#vj5mH
z!>STJ0guPbh`Zq)gGl5-$gZC!vOi5V>qp^2fmmJ49j_$5%mMVg^LaH0?M%`m1nAbg
zsehMr=<_j~><_LkIXwZLQU~<mj+=A6eDjDZq*)EHT{h~~5%}dSW%U%ZoNDi9&%DIK
zuD6`SiNG&1-uK7~n?{tnl}3^G3$2nEmj$kg&h2}*`8-gO8C&QnX}ViH(4!!(X^<<?
zaW!v+KQ=v(4F*(u%oqts5Fz^?XUqLVto8igeoIDKASf5%WAJt~>j+%)?0HuG;BjA?
zg&`0*ZY9wBcFj40Mit)1g_kF5kf|oMUl%I;&YjTCHlp936Q2(E23v~l6K@B$5Ox>H
znGG4dBu~h0YN80~o>AeeL!=~gaku?Z7S!KfrohZ)cTG*E8_k12?`;I%C}$mvt9d^2
z#8x`n6O3YzvHexhe{jZ|P}Cc+|3rcA`*YAEL0I`1{wO*z+@5n(2)RwD!8WS*$Ycfh
zg+@GoMXvwjbvQce$<TOTveyHI92Rj950Jj{Hir>{g<if|SY%EfuGj!<$O(v@&~l72
znw}6u4Z|J{2|mt;wS$#9(C93K<h2L)UNRJcfbivo_~qO$b$Si%3d~ghY)Me-1Bi+q
zhF&0i_GMb5x!&EuJmR9mYmP75Q$ykP3$^2FWj7lKcq6vLBRfV3l0eqXk4gJ33Ceqq
zZD4*8t**J8_P?jvHi}v)MjInrXRtNnGc74_xF>OU=0a>$@h?ztW{c`0oBzHjPsXQz
zd4r<?zi%WB>Pg@|;?`{X;Gs5ZXU)o!jedP1Js&j)8jZvksCl{(HuW3S3~>Rdr17>3
zxg1kLD)b+w_1_H)N)glcQ})-zS)YczSjR<x?zREkQ<!tHL(Za!h;3!QB?nJYG3Sy|
z&#Tb~UOQ#R-j@nMa)Jg4X=lF=@FO2zj|^g<<Iu02OWWVl+)4L2H6rsGY1c}OyGj*O
zJNrUt#!v;!7>{{tENk$VZTOVSY;)Rz8m2$))lbTvTK?uXA3^sZFuPxgnEIdh@vr*d
z^a2-ZZf7DE-b@vlFDFCD6l1OvHzlk-(ow|_mxYFLm`DXcAQf$jBeNYxirKV}gr=<$
zdBAHQ0dU_R!{8gt^P|rvMbJII!)2@xm_-}E|ImA_*tn(-7OS$pfNBiQLx}vV2B%po
z&PZX}Uei?^q$GE&D1aGCHcaZZ*5tKV(Hzm=Z4!^Pv^lP#d_=H2cb5&H?Gqmt1)^<-
zSsTo$Hw{rwt8>^7KbYynDrZQqYs&rzv1sFl{sc)4V<9<~ean4U_FSwyJ^atbN;7UG
z$```&&7!t9Z7M1QOS~0%$pRYkjajERKUJ+}QN+H-P08?=gkH)l@}O*Q<9b)%n3m!f
znKZv8X*JNLK3ym_#Ap}_pUQ4&C|;U(olmOGc9OSZN=DhklW{WIgr6>M<Qq!%&_+>u
zU-XNv=UbJ9*Fby6oNkWXJI4>LPDHI!Y6Rj6Ccp3uS`lIN!=991!nLID%3T-5YnscB
zsmHY`<F;4Ry$;l{6C-hbt;H)A!JU|Ab1Mw5B{qYer?z=d#c=P;Up5TFKH;)5=OH1T
za`!A1U>8je;)`<0MNXH;DEg&v^NFpEkHJlyr1YKupA`ZA5Dh*Oi)G9GX0|O}0qq(d
z-SG~2GyDq+rG=Z}H0Ru;_JH;DJ-`~i#1(4a6)YHY!~Nn#-Za4W?)NF2V6U;mFROg@
z96v%S5+yINm=j#Y!tqxRoT-)*_%THA2Ok>T(%7YvET^#Z*EXbZwFpYmeHA`|qQ+aL
z>nAj)^K3y6-?Ys9?{=ReVt>~U@BE7(nvKZR?UoX?K+&ubXq{B#GppT4Fd(H+CU67@
zAfV=L52>mX+AJt;mrS1n)t3lp9SJe>$&eLNqZ;%V!F@@oHhMC8tNGTPh59DbBOwWv
z@@tVPLiO*E^@xevAnzjquERA7^rP{|p!Md&VF}hxMn)rOfABmF3oK`%mX}mzi!9w5
zX`9|U#IyFo<&5M+!|Mx<Ubnu9H|>mBp9#z`?XjCWma;p=WW5?L$#U&|enVFN3#~R2
z?j&&=)m@<tdti4(Cv;3q^ywnx4(t*rHHItdPO+e6M=Z2QMJqtl<8cWH&*)FoJg6v(
zSB2z<KNp@_1nl!b7W+QAped1YXI!YRg-Q!JD-%aL^zsCmkfr`4b%em>gla>Es3Y7l
z1)89TA9WYsW!o20J?#j{R{#dDhHlLv%l9WM2k)fs9=bCMQtusc#1Czkv|H1<r8=4P
zMnb@HUwIoXnFYV<eT9ld|2EAS6hKzXu7Ca!|357OP6Q=sq$L4IsdE_&YQyo&DOzpL
zOO{E%^run7bLp#VmPf2ieMv5GqBnh>B~%vAfxe?8vsls5BCX#8#t%erv_i%ht?7@$
zlwFNtZFNicQ+~m-^x{LuSTIVAV}c&kdNrm)g9ock<6v^4+Yy4Zoz-ZsI9Tc!OsD1k
zFm%f6h4{fp>PX)rw{@2<k&X!7!`HY$G8H9HYOSD}#WTgRI}C@4?MpcppEIPG$aX?j
zXDHZyKZd2A)O}ZhwDEh6)g$*uI@F&zub<s>|34w7w?r~+Ls02s-)^5ePv#QrM8R-r
zN;YNc8o^+UF{@_M)_}kKvZ}qNo(D0-Raa-EAQTOwoEIh``$vHYhm_U_Iw}nJFb(P;
zoPm2~zO-|w&L~BehNw^9I1fSnW7^$*jp<*C&Y#q!&(Z#QsmFIK^B@ngEcEevv9ViP
z4BiCvfm}@G!yVV`WU05t^ee*jd*>)TaERX9WmuUPIL(Qh4naLLcn(XPsV96Fk6XS}
z*__OO6LoB?j3Vsac+U@{czE&$=Xm2cc4p5f=KSfzls>^zwh%sXklcwXtBI%)xXY))
znw9VvTNPyvDADAB0nWceM~V7T-Rb?03ygB;;pr$*DI)p$##6<>oqI{ccC#^DhT2h6
zfiBp%@|*syOlQp>8EjzXr!89pp;e<kpL2{aqmmvxm@(obZCtyF;52!)X{BhyudB8Y
z(4u(=AWcHq!^;F-j!UhJ?%v0W_;aOw#OTHSA%=g{*E(c^zepnTPl<-oWMm89BQvDj
zPfbuO8HiVL1tbJ`)vuz9Mnlgnj<6|+wu})DqYj^a!{`6ImtmNW;rP~9+v6q<*W8Ig
zL*Z(pE(xw!w*ZWSav>ENI+@|TXtV)%34|t#4+@5FLwVn!*zF#U_Yo2WzmzFXC!CpP
zQi<g=%5INI>0@!?_(f!_<^UfjS~RcJSN%PF>!cHhEOa^91;OQD4zCL_Qd2(EZaURv
zwV&Ntl26^`>Ohn>;ayl5wat>;XGfkvoh>b-4(D-it;*ZN!(m$?8u|sh-)H;kH!|DX
zK4<8Hn_EdfY4=cq^5+`hX^ra3zuI_nJ1*wS5bXx8Ra~2!+pXXtBQ=?NB&vD<Qt6MK
zK7MXKA{hYD2AQ7}G&aA=7Ea<WwrRhf{`x;Hz|j%)#n|!$D5$WPRg9DN^M$gv11JQ~
z5Jpdq3w{tHQ}ghIj1?rnZ`%uvRV-=02tw#+VN(5l=iMMxf@j_t`|8`8Gf*(6NvPy2
zSAF@$^cKGgVuN3!_3MXj(NMJnxe4`jMcdyJ?%b)H7a<p!T%m8;Uat%y{b}+EdLHim
zH!+_gt_W<8Ym=eOrv9}VQ>8`=UGDXj2`mwOO9-jvdR?D6O2q`z$YoT}-J_M1f;jWW
zU-~e-bmHcwEiUWID-=T~1$<%@i9I1a@t~ABDh3Z7vvtN;;!iH5X07<t=A@bmI1}p;
znMb9`eC|aS1vK4Q=|p>aBa>YDSp0%(j>>T2A|lB+FKSL6oU7H`NM4#+zndXPn{e*w
zFDkWU{!~ekdulD%+wq<u#`3u%7WsE58K8wA!E2<BczFpKc@6BdBW@oNP}`Nw#XIIW
zQ6C~eZ^F^8#6|Qn5DOgYN74QXS6>pm0aotwR`O(P-lfKX6PCQg3l$H>wNds3zsn|l
z;W`*StTWG-ToI~;hqs4C6P6KrRjoUQDzxp3dad4rIy5S(r?kL}JWO1bovI<as9)2W
z#EZa1Qf#>y7d@3B0Tr<f(Q8=yUZgale!iGzv~mFcabhXJTwmW;D)1(L(@VM9gR>g*
z@zn69q5G%s%>R*9{sOF(Zz&?xK?+G&F3V8hpyJBNKyHp65oK8JX%93GfY1$H6{o*@
z2q^xR%j#X=g+eB+;;?z0F^e0kQ~zD(<OU(^%W(`Z`jN>e7~{F02S{;ycbf@A3FbDE
z+&oM&Uh!!LnX0G^&fKs+v)hz6L;da$y=Iz}IGGMkQp(W=lX5e)_d6-!2`P6Gd!+|U
zU@?{M=Qd6<Svi25wLd!i0dQ_$ow4-Gg7|>2d61h~*Zp^(dw!c^a{t3nRXc{#`~YEU
zyY6e3dhvl9v3F*}(8tc_I_#g`_z6CUM3zLLjM~!t_5-~j;+I{%BP-^QekNQJ!=nU-
zh5#~!N7YCGgPfYcw77{bZEa^0^`@<B-W8iDsg_KiO=q4H8txK2l>>LBjhW=A7P}1<
zk?L3`PcV#oco5BqI8H8X%a<8gYQ?o=Da@t#F;r}``D?7F-Bc<Fz1(QdWbSn>C#u2T
zNYVvw>8BAGf3Zfs!RFLkrCD1ILD#Xo7WHJaN8KUo0{UUNTNmpDnR{%<2->>$8<@~A
zM);mpUmcKVnp|n4npui;;y-xXC#R|X^G>yPW<P})Mn$mrrB7;5GLb^#9zhITtF$3$
zoGylxo+X;)R5vlTh;q8e5Ch$iw4Il$3F+x4&>d<HSG8uG0hfySea7C9akvUN<1(xn
zQD%&cN&%MoMfU*XBY{HqD{RxjFJ;NeJ1dk8*3uV9D`7R-7+f^kBiV^9xE3v%sC*MB
zv&6l%l%LWNQhprZ(hSF6QeC@i>hUdip}+JSqW;Do+l*Ba^U;US*hW4xuZ%VbTq>v~
z_*QM+mW@k0;yZmj=bv-RkDCw2e-n6rtqcEbywq|qCU#g1>)P1+-r--Exr7^6%>_^L
zI=gf3T~wgQm&aD`7276OnV1|Vk_L;^Q{qf@Due*PL%4ce#M@mx>C{WB9FW_gt()FY
z%FS0Ra6TvzASADmAXCGVh*+>1<I`H%$HT5cqd?b9;qcPQ4f#V@y6p)=7gm*=u~(6T
zg;69AF0WdlnmX;9?(?kKI-HWOnuC*yBqX{$`fcRGfRWhvZob#q*GVGu-X!6M66eS{
zQ)(p7=jm^Q_D^;LZvCo6za1kxVkRhGHaE6Qc9W0Dn#ZoOUMYjOz|7E;_q7iPfa%zF
zB+|)KV&pJ){%cw_{CM4d$||xY|7<Ox8tNHAC)%*deE2L<w@F;k;=4Dyiu6--XMoZA
z$gMTqeuo<Q%0D1l`|jq#g1I!rJ>#p9H;!xwV?;}&dTBKRD#}$gOXE4!<=HQI>`~nP
z*d2CzhCU-WB*ht$>WA%A|9?DPg+o&h*A^5h0YyquLTbWjkd#JJT4Eq2-Q9vTNGKs7
z-Hh&@bc4hg-OWaKjBo1u`~HHv-Fwb?&hwm7ZJChktVUCv_^4d#Jo1+-|Lu+WqvaEF
z_;xg<w5cK9#*M-zzvn*`i<y6*-T#HlZT2#FXxO1d=2<Au&Z-e+40>>XhJ!9LzeG68
z{}}zHuA?jmHvmrp8RjI+H~W;9(LW_uz3$44ZeJ>z286k|G5wWXlk2O|NA3P%!PD;2
zm-cJioaE+Xlin7sFE97AvC3{JleXqix-hVBzBPpZnIJmnMb;e;m3(neZ`!#VQ}~w-
z1^GrbzHwT6vUl^B(^0dT0JoL*j&mHN(A<W|0Jg5bt6pYNwXlD;gSMKg=P@E!d=y8?
zDw4G}VhIuj*tKY%v(xuZ!JLxkl6yI@&Rrn7eK=`RW{<U5zUk`Bgs}m>o;oxu&R@s$
z#ed*<I*zFyQmSWQ!sHs*UB_4HfcCVfooqf4@m9c3E{<#mRLNZY=rc=`(t-qr)Z0?r
zK+4x?OVRVcS<PuTKTFUd$9@BC`LYbSGO|mWm~CHWDb6e3h!T>RKCAvnxQh|z?$9oj
zNFabWOlg{2^(BaKVc`Cg1CMD?fkAHIy3$xg`)9Skvs{4xE<BA%knySkKE{UH>BS$t
z7^RV1jjI<}nP}9*n3kai6(-F;;IZB>rqr^?LaXhN3wvRgt<wby_5fg*W|HXW<?uXQ
zCTpRezzKhrqL|kxC}#Ye(r7Wa>g9scL0M%6`1gx1E6Cg=(fA6%LOjCCMnI8*+(Oh{
zD%=Ep{UfLcnO)oPm_o>OOO}_THV$Lq-UzeSM6c3JHo!aaO$fGl60av}2~V<dhqK@_
zvUlcj!f~cZGO=vrP$CuH`J|-eJN9;?6`ZHd?8v`TEGeo!@$cxc=^+Nc!s*LdblLE3
zX@+ABcmkE;)0!`f4}QK4xpk;W<Oy}UculU1=Nj8H{OBSaOSrNy93!0G^?`?xgD+)7
zBE%;j>}pRvOm1O&MpgRBICYXF3j?E~jBw(~;Ddsw;q^%U_6KdLZ<7i)O$_QD*C%Mn
z<r@`7d<+#o3p(MHH+e%pPnJXaOL@9n91&t6Ak^6797})`#JvEG7wvfYMpNFj;-^Z1
zrYJG-MT`7hWE{3o7`tvl%QTaHz9j9+V{wS_4h9tP@5)8ee|tIf3C$DSF#E8+6d2sN
z&NB1_-u?h+$Bc2<;+Q!L-*^b7je2x^TAj{pBqOj}f1Lc0G}lU%Queg03LOvgyqvN>
z?7^eG)2|j5Z(}pd9!|6Ve1STh##fk(owl48Q^@>&P(m&685A>Rn5ycBW|)@FlZBW3
z-0NZbxq@;}@RUqmIM2q9e`xvbOA#ZUV(G+~xVij1oXuVGLc)<T0_#}u$4D01ucL=e
znj?3aV8Ou*0N@c0xm>&p3-LVAsxT_&?fZgFSG+i(qrdy&?0^1m&dEITVe&DHFy(8l
z*i0t8Oqmokjlv|~yxmTEn{^XOH;u=(d6m4jd8*JsjUqPo0IK3gA7yW9NE=>()YCi3
z<U@$mSoPlJ#!3tq&St&|nPV*DCBwf{C4GDrF8B1w(9Qrg@n?Q|sUj1-Y$ZRx`URe^
z29sD8hQs|Xauy`AmY3~?_=Dy6iZw8$-1wbjaZ}JI-+g6KqH?)aD=FVK5rQBgUCO8n
zGFqSwK9V)XfM@P61HJxVK=6NS`b5SqYptQt%{Yusa)g6_)ir(l^nO=&1^i-%AuQ^<
z!*<JB0ECyB_wCcD2o1(xvDjHoM`hwt?-1<?Hj@C07&9XMok(bq=PnK9SAicS{RD^p
zFCkU9<98Y&GUPImCGlZJ{p7(P`;0BZ5={kV9#~|t;SV_%fCmv=HC<1c1UQP->sPaX
zw2*nO?AWDjXI81KJibB+=OGypwhV$4KTj{W^D3(O6J(0F5@edTpxVR#jg@>X4C;6P
zcDdmwY$Ua+#8~rz?JX0!VwchkdY9Fc!Ns62be}gV4A#zVPvZI>#RUld{-va&5xyl#
z>bYb5Q6EF6CDaQ;&*+gy-h96)k0+W!te8L%UUThzvIOi`9`Oa!yY2P!pV4IPv7$MN
zx>;^^7^B-Rflf{5n5|>9PY9Ay;=Ir#gCuyUNR)^uO8SIA%n3gR2Jbo&p8J5M5055Z
zjy&f&B1*%>!X4VxVlX(e%3&P!ezU^%x2XUB2kOQGw-%+NgjXyFVt+)*?qStSl4d3Z
zxKc;m7BnV|9((<G_Vm-bZF^~UWPYZgdH4(oxv36HGw7FDPorA15E7}mWO4r%t@fg0
zn(oVT&N}K9@I@>Ae8ke#7Cij}b)zZc(^6?4v;Rn#M+r{Y;djyiPK<|(B2*`yybAAd
z`GArln1q7zzie@wUzCrjSqLJQl!QlqbkX8ARe72~AI!Z?Sov7I>av6P@`kF&?>N_J
zc4J=Zj<hk?OwYE9Jx}lJ-xBdZRjj#NRQK(pA)Kx!Z^9*!sv8{HS2H`y`j}+)G4|+=
zvf1lraxt-bWMo<KBOl3mA~x~AI?!S+N6k4frhZ^>3S7@TKEylIKau&y^YmS>TUV?>
zA9Gu)^+xW28^+@Bm!W4$eczrGVML@S6N}3XbE}hml&gyGf8hDKyt#orWUS$tOobEr
zeGu_nkQ3Mzz}7X%)$(#gi3iCO6gvLmja{??ZgC?wOk{QvIQIabG(ZMdt~DP0Sb}vq
z({3Go-w1Wv!PQH79rVD8U^|c*MD}-+y7qsY)N@{~JdQJbfc-5ua4_f-6BD*N5k;jB
z1zE77*N_n><4R6r{O@OyJwvqXM3h^i>Oq{#0yDG@L(>)O(kA3}o(x(Rpma|(OyOxr
zat7HjE}z{uKU$B`!B04MK>$tpcD+oO&rqObTJTcPhAWf@k6dD&k>ta-AC@nF$#z1!
z8@+<zxRm0d#bdK#i<H~csPg?+XXvl0ss;VC4?k(#qh@pT*BLg|u;p_4d&&Yg*+C?(
z7F;l-|9rkno*z2x-wWyrfBQ&4tTBoGnB0w&G_BLPkadgmSrtM?wf(M_m&(~jLPM<;
zi<WU+$*ioW(~rg3#+?;10TNhb3Lm&=fqm5NVn2W!+^@3Pgb29Eu-^htuo#3iA3pb+
z=2;Ot5+%I~R@}yrc8y9jrW&XgQ05q#SZ!X`%jxP9nDHutqqa2WWUAKO+pqRL)8U%_
z?x0%prgpa7G{xZ7X3A^yk!shvP@?Vrew7F5W(xTOKYOV0LafVci}bgzD!+_8%aBQ5
z_&WiF0+TIyJppRA`-%Jedr~i~(Dtr@Uh5JJS2QigV`;6=sA~5KfxsLQoqrm7majzn
zxFc#S*o%D2tjFRM*@{80(72|*p+Uu$BQkU}zccj9wS2ZUXkDwfeJv9BpB7N@mDXS;
z179;v*j?Ec*(j9#OT@2_JaI*oFF*Ay;G7wo!ySev@;D7&_iKLxTC0XUS)vKY#mjm8
zvZkI(;uHQb`qFDL8;{GDY{qwO)gjOym4cj7ha9HARVosyalX*%*PAe>KX{}XfcsZo
zn){z1o3r76w}j;PIYj(s9C~47dymUp;bedCWmP25QQz3?S{NT4r1Y|2$phuWmgA-`
znEm0CBA=ww4^wdsz-a8-9BN6`viwJ1BhMF6RsGVc5n3!hCq1tn$;Dp~?_wYnnBvo^
z-|2B4h}inQ)7FxRx)f}OIuX67kEe`=z;J5ShLK0c%kE%+!^QbNu!ro{Mw(^t*Zmb)
z{&c<m6<Kb9_b2zq{M;)PuYGaL?^j@e$HehRowyQcL}Da6S^<uvFFoDGS5qL;cWWB=
z4iR^u`}$+|Doh6W>0+%nxB2vrB1d_{Fhc}#Eucsvz1Py8EZ|0k#;&?)<L|rpbN{9a
zbqgbBV`4(DPSW2!P$0&ixjLGL$%A-9me%fuQ*`Xf&sT8dgwEy^1xYiL8E&f!(-402
zNl{~Y&Wc}iM~n*WyWxWd__&(}eD0OqwWYQ_Y>ZQ_CTG7vKR2Ms)uMhS*E;v+S+mOV
zD$LTc@z)44o%qW8bb<cQ)NF$9f5S{`8_~WP%%3^@MQEJ1Ufm3FljE8(Z!g$yfT%5f
zwRn;swl*!)P4Q&fZegr<7Gte=vf++jI-{I#T-asy168*?9XWRH0(MyzFAx~^K#o@0
z1HQJKU2lrr0vm<-==*TDlaanbU)C-#;pralKI}0_Z~6oWb<*r^5LIJn{4>o$^6k0b
zO1r?~&eCChJpsr@80fcF9^=)5kwYp-lH}G>(;zyBNh{^m(_=nu_>*`3#^rbEAWe))
za1JeTih0JIcg<GGCa8Z)wT$<@d(PW?vJ7|a44%{4kN&dY1I+TKVELEwh<R6Z;&sMA
zE4M#t&Q|+DvNqf3-!I)F0}H@8&ZLStHYZ!m1L1zXym>|Q$n=$6?>zkR(aq9H*Ov<Y
z<<)3UAWeO3Q#4JNysWC?nKGKaTaE#yeoxOke^{b7F*8rJF4nbuSrgxt#SKNK51NX<
z$mKqf>Uu?e!6%U8)Y!@HaV6?3I*P&<$Uz)#DXPX+mbrKU*ND)I!VrZrnt&4IO1v0l
z6#wG<rTzh;OKSH%F!G|9-XI!^)uq7cj_yk@$)w-2(N!HA)5mUjS32Z7tW)h9Yuvx@
zj<<Cl_cWs*?z)ZU5~6}y6xoX{QVti|)EqQHHPj)okLvYh{DJTtJWtQY^;-|lZ3ClU
zqGF@=Z@#x0;@m%ec^jj(ryyM}YcS9(=zn((7Dc+lTfDaUs|+z&7sdVbYvb>;5<y`b
zm}2iW8LkK%u0t~Hc<DoI5B3)13%8)6<0r++&3-q5sBG&gsx34WH{+0ALvKYt82xN5
zq&OyOB{0PvYg3ge*2n}Z`-7fHjkkp<@<!49talhGIizj0uxY>qU({6nDT{yB*}%KR
z%mnwL0yj{1_xs%-^Yf6!RmEL`LEMOqiS|hG$7_;%@LJ6#BXf`CXQ%E2iSfX{Z8xx4
z_!3GZjrrR@954Q2hTu6*tmAggVcSzWQmjSQ38YpkXJUHRvinV?d??mNJMVsw)ad>B
zLJx5ZeDySs^D1xn+Ib^2p?~{zN0}@>#}{5c<D7ZC8bqFM4M^P65lQ5z)d#j0@#3Bw
zC(!fm2`;nU7G^&ZI^1_&EZJ%)8l8q-iNt69SrqN1H<dJm3gGWhW5IflS`;c0(?^9o
z6OIBdZg}S@(3|O}Z!VCB^$@IOQL$zUho!8{NCphozPUg?kQ7>N=3xYv-9h2YCO3e9
zny1adnZg7gjnu~_o$R?vwr)o+`15lML)IF)G{@2p1&}A4<&AOY4Yh{?LP2YGH{Wtz
znUk)~hTrY^&iqv_?`cq`9utRBj_Yhvq;7?cLQQiHcUl;uzlQ;U1Xt)m*^XN|aC^~(
zM{}ZG0Owo^P@xjOF;X|t&}9%aex`-9jJSnu5NH3E8;NDP7Fh6l^9wnEx2BrMP(iq@
z>!?|a>Zd%GmvZ+dFLuy3u9iB9`Wb}HyQ22`Ya3Gd1@dR<j;EPOd7C$C0!I?1GSI|P
zVVu(_yFq9N6?RtzR#*srlKu?4qOMGPx=gzH<E#fzh;i@#j?h7f6AlC~2HD%oF6WJV
zG@hy#!5HuAxtFYCI?j`pRCsGeV0y9$x}~T^+<e373LIZs)kgH_6N7<2s*?PcZ||Q7
ziz+X>_a!{(;T1q2>TofIeVId?s%m^Wf=ssZ_)YeqI4zM*{!3rPaxg9iynx8wgAClB
z#|i$daUUUk&ml(Ht(L|}@4JoYeEa0&1?DtJyp_N3vGPFX-Tn41%<WI9G{Ict&tLnq
zX>G@eo0Np+*oVv7duXtFi&W~e0ueYTwC?8{;;QUp^~1i+nfgMgb*5+L!r`pn)q5TH
zI?PfV<E&uZpuCx9t6Q3Y9XY%1K6&7_vls4nSG(V-pm%_CTAZNSvzWDZCak$p|7|g2
z=47|^w52KI;_|=F-$C3GDc?wL&l9v){+Z-{!R29iifzEfUmt-#Jbv*2TUK13KEAwZ
zep<u-as`QYVHjgysLp-2+(vp*Ok>+-9g+P*d-ft9&#4+>IfuMBBlUm7out)dh_5+g
z@8H&X?3=)NpgGTNCY?~K;wiTD2<vZ!IN`r7Ocsrz1CErX=64d3rm@i~qf21k$)yL+
z1KJ68SLU1}Wp7)Wl&8<ISXl!)W-=+5)6!1%k`GwJ1Pw1W1ze(3jjpPGZ`NfMd@7Cx
z(M><4_1B4U=q=ZFI9vYxQ_ndV<XH1jkbUss5{aKx^GPC{j~ei7amzb;uONy155-%Z
zF+?fz=`5&mA&W*~5mI^W(QCY~htur<dD9s!CD;XQo5NcYucB;N%8T9OB#^gqOb4Q`
zAu+$#sWO{xm4oaNPK)NtME9q{_wMC1@ox&HIi9xmuY9*1m*)sGyzf@{O1p79#&s_^
z?PpR{Fi<TyH?wCOZW6?P-CK^=%&oly`CHdO^^pG?S{m*9N~y2(n^a26ZT&9xL{eY*
z<2%y83$-n(B}9yhix2ZEGIA(O)xzbS(hmrTBY$$h2v5`x!dyBCG?$#m@3?u~xQbsO
z%i<U?K|sE&wHR7m{lc$^Z_#k)yr{Sya#{4Vs^DhRprGrl_>X#rJRKC{``@Dv<n${D
zM(>bFnyw|P#%2$D5_r<={rd@Tjj#2XYk9BSr@y+F^4<t7c;EY$K0d4u))%!e^I&F$
zWSnE~Uw&UAXv5#dob_rwb`CRc5jyocL@Y0j?s=ZATpq1$9f*{Rf^P5k|C9((UL{7a
zt!3tM;_pn|xrkKjD4?gQSg(D2Ly+VraBx!VZ-D;PKO!O~>AN8?26F8&_SxlAM#R9V
z;nmT@m#cw#LUfDi=KhKsKEK=UIbt*R`%}3W#L`e0nHQa|ZNFidf&%A15v%1g^<g$H
ze~uYW=b{1owF>iH##3e_{R=7X@~^i(T<oz|SCBPIg}D#jcgr_4z%%DJM|o&T_<~P1
zkxto7=53wWi#j>?480Ov7fh5Xo4-zAsh&#TckD$G<@Voobw|M$ninlzjRVLclrJ%$
zpsRNfH+;o}P1e;&7OrlmJsmvm<0rSk4nVu=HJm*OeC&tkE5;6SD*6rdHx44!a0ggs
zWk57V%@5YDzdS*ud%}ZNVguo!A;F=Jg-xxjz-Z_b8*|GX54Lglt@;o_y6ZbHabFQN
zWtunDZh*YosQSVtFF8u+pR#grh!5<4x14YFR<*;1ReHa1K}21V=*nI51dQtfPvxI2
z2~n~~LLN-Caj<VY1~e5<gO_vg?$Kz9F&u-k3~Lh&y;lzgqu111oRw~_X!lFsN~KRq
zwz$Rms-<^n>kf1}ma>l&+fN<bqzqbTIU>GO<@iBkU@Kwu?vO2LTiF&A^4}=LePWmL
zL-^J=f1idf?;9$!5n~+0Mb_HVAg!^W_W8owVdbhX9(UF(_2jpUArCLy-fZbM-#O2d
zn^B~dFZhHGA@@(x%z6hgo9~bvf(OKUMqpf9-!E;3RxL76kV2C&hYIAmqyOD9rX&BH
zjHmY)E$QENe8PJhonk!yvuFE08O*s%kH;+#gJW!xi+0!@XZr_(QNIoLqhoj~<g0nP
zu^5qy2I#HJuit|@G`J1?TPN+8gN^o9t;Cx&(HS(>sv9e_(P8&mCN^{)y5&oihH3Q8
z?Ezarqi4YSx~+tfT~F6^vzwp(j;IK(iHhJ$v5)}Jtyse?LY2R{dYCkF4|8H8*zy`c
z@kVTsECKRyQGwQ&=ji;Wx9dIL7lXaq$YGx^wTRqr<*+3^50;$h%d@??9?$9C)IAtu
z+e+0@-O!%dffaJ_!2hNZMKA!~+9!s7_j9B7f1dc^FC3C8ScqKGP*+1B7mzHk^1ZEF
zNOm}A?WX2%Q4H#9;OS6%Vd2iXWni7RbrbXSd@2!H*W%IaZt;u-U;6wMq}4h2n09W}
z)~(f9^`4rkB|&JGCegN8<7~W<GzsaA0$-rm+HAV^{r3OZml$1^n3u(#x(_2)0rrWR
zbHT;2e8>D9w0o~S$wv-wJN3bL?j>pr=*S8E{pGEjts${z;8ZOeu<les+&G?w*BE=l
z`W5D8@6}dr!jY4vribCd(=7p#EwS@uuh3su_CDbf6%Bg<gNNi`V_*J-K{1hXI|P`{
z+W=984EP^p`AZsD^c=B>8lZ6%PMo6LQb}ZFe8~g4)}-~zaQD=`;sea!@H>sYc%VJ7
zBnGwy^J<-?sSKxUZ9VYqX&ZDo8flpH(6|n)65NNW-vQs&e^;fp#R;f;2=}!w*r`9)
zXZ6t;ax5)IzVUlP=Qj;9YBgvEdNBQAULs!qq4jZ-27H+1f}oe!F-z$Twboh1@hwTZ
z{Y5L*q1J9K%d`gzay*#zB9EItUhu;(_G`a~ZlJ-0SVy*Hvuc$%4d4SX-(42Mu6HrB
zUS@s)&3_D+Y*pasq(RcHMD>tB@Z3sWOz*hNQ&#a8sHG?O54{Bb*ND(G|GKi?e77k?
zw2Vog=GR0DoSIYsQccRyhgWXS2~)|ynh<*Z#%Ov;U-La(2a%Pl#^`OCJba|yp=<B`
z<CXqP1jSbbn=t65JHa;F?P1LCb0oh$<!{xaO&31Z2iJ`ZwKz|`Uq=g%VBL3ix6J+d
z->pPv2PpFKM|Qt`PRMi)@@rUOJgV#YPYd9Ri#hZX@24k6SPi!M-GZOFlX~14(O;(0
zED<~V%rw7SC~uzoRSxN$vsT8?cyA3XFlbot{B5|`P)>0>*$Sy@j!kS{P$k@86(ePn
zv6Lh>WaT-c;_zlGZ0kzRUpRvN$&0K0oF9q#=C^Xmzs?pmL&18Ep0IyWQKf>hH=dey
z1y#Ee{oek#L2N)a@KoO8UUzDcIAbFwoP4o3mA~LFN$&cdSxwuoh5%;`uX=v^KDnzA
za_6V%S?+bwu<Uep_I?zsGJdja`M*hy`v{`AFt3vN{ZW8$nzkX_PwLLDx~85G7J4nB
z*w&!<aGK(RF(YZ+6L}6xlKBByVc)%kc8myA3%XfOQ~bQM>8YKFvaWv|z<G~1ep~Bv
z@3ESNpG?AHcL6W}R?WHTHIR~;-!>h7+nI^^bd^e2`u9dm#D6v}b!%1QO5K!0`Z}8e
zzigVy{mV(Jmw}_u>SMQtI(ebXfh(wegWA|fzw}lBpEqJ~47<LRb=Ar!1`yRPYvN8-
zmggfdW5`;oGKC0(RqdwEDahoV?AeZO-h8{8G;=gi^SW5Y4;yS<)^W59o|IYmtnT=C
zXEW$;?;eoyJ_Kt6ivmLoX8s$fzw!b7;uClApe%%{65tcGz&sYb+l?{2fByafbY{FE
z$)R!Rz|{tF0$`?ibL9Bp1)U+$XclvJ;_+49zQP?0ycDmIQXwBr&R4G5`b4sY!jjSv
zuq|dJX17+SA_}ZiPu2L&>bK&Y`}S|M1V1W*1OB9BGfx>v+P9{b(1!@jg%8irYo({y
zA7sa<%4UBylRcapT%)WXHKIwIIr7>jEb{A~540AWyDp2(`TRXZny6yo!H&|4`cI!Z
z_EKkR(FAMibJP&_9v|l2AB0zDCgooiXdP%>>P*?0zH+E}o}H(#rq;z?u?6jwKz09h
zqQYGvDpASV2z<HKNpur8$Ix^BeAn?<&b!wfxy*MSX?fM8_!hPZJdcSzcUs|fU#GZ?
zx>517KYYA@x!mDfPv4!vAlq-x=24w64K4P8NGGZC-}hPD_jZci*0f)s_e$#`6gNEF
zu1N}?CLQN&L3NZz0XO-m&;MsO(qG0vRpyNw`}>Vb0;JCR{M~1%8@ZM#@A~}fR1Ev(
z7KJ<uME?dHw6^FQIf}`y3AySQOTR>=Bz%`o+}xYI>EZ87>c5{aG^*NeQWRD#b@Nld
zcxBLUsbO6-cE>AoG`!&Box259I9a@%JlS<x&BMGuKvB-W{>^>N{$n4b4|%@bR%v5!
zm+vTcg(Y|+No<cFbhFjd!kuTJ;vs2#VUHE<?u~nCKNtz2Jh{6_Zxd9(^DZAmenB?o
zNmP;gI!qGQmuH-g4MKTeHoW&=ZR>lx)mHSkBRL6t-}*m0mmPd%gW!-fh`y`eiUO|<
ziRKNwK{L*1@o!6XBe}^!gMDZbqF7sb9(a4#4dft~J?@fhzZFk7boY0c;1oJd?h@*_
z&G%fL@_{5^gWGh1r_#*rqb<s3*LBCK^_qd_^XX^aKrSSgowlLMvpR1S^`YGNJPSq{
zdE8&|Nc9;|%e|Z6Q3cJiS8%SPs=l;l)}<xPDgGUun{VO))(WY5X)7K%L=!Eu7KT3?
z5^=nS9s?4TU5M68wU_E&l~$m7_}pzpO}6mfRX^I9&Ol~Yt!3&Iid9YF^kK>5ut?xG
zXrFSqFHNw1Q7BGVDXcm|&%1c#CbCs?@63J_fJ%__{+|o6yq#86^@fGa<q*UCU36O5
z5{<NsjZ)V@4OA=QavPW*sfLXQ0!Y1F-P;UHDy(|*fz;4f<+iMRAE+IA9y*c)ZHBb&
z95g?>j2yjW=IuMsH#tMM49;+r+-&#;d(g~Q<rTQm-Hoj3IzS)u<E!L3J?e&+;<s59
zrE52bqcoq$&Hqiij}d0zU)|7*#tK55!oKH0pL+)+RFf%uW`05#MOiQ}aU(5xzLH8F
z#@`y|EpSa$wttK>*s_{F+HR=pMf+LXQ?}01lzr7h<7rX{5bx^wZ2Lyb!ZHaBI-;ZA
z`d$Jlp`EgjsFPS#xpvc5VYi)EslDTQR+foMGnP?)_ou5{jG_002u7bupZ?Z+<>`Tr
zuEDLuGu*mTH}@8?b=Z)29^)eLee-vXY6#_J=ZZl4vB32{gP5-FhZ{khaxAJ)aUtcm
z+Gs)-ad%lWet;7o9d}L0lHK~j>(jR%fq5rozrXzM?e)5tfzgYUFQ%hh0M#P%S5CZ-
zopi3-iGjqB+yEZ80;de0@vXXzD^NsF&>_{kfenXVnsyb3*!Fy%_SRv}i-|W`zX0~F
z#BJq*WbwUQcyHLruHVfs^4!G8=eI#z1d$qJ)&b=?&=XdFRJM4xk%2<6(RdVsF?E$^
z5NwCz1rXmN`6y#(ZY8s>4twrazi6bDbc~YUD>NT$wXSxs`L#OXw4A>}K3rTHIdVrF
z)_)E6zzwgL0KEPs7Ik_yx`%y))P~gl7IWu?=Tjm(5fwLq<LTONS37=PNFU`<FzeAD
zKubm$`+ZQ?-j+5dXLc7{s>!xVc%+e=QM==n@dEbugQ+@@LUSa|Jv5pB$GJNx2n#BM
zAV_7<ASP|_#MP+#vZhROk&k%W>!E(i4vM8Q@7Ka`x(IW>ZPf@g)O97HAiZ`A(oAPs
z?0m6%T@P2rf!k(y8~7IIqd0-c{|I(@ICs!KR2+VGOT)0IgpK(Vi%wi%)v5nT9eRjn
zc&l}d{zauR_%?0k1UloZPjwW6hFt=W7-}o`EG6^56-2)Xp(M>k^O)-Zo~e3YM&gG*
zHwGp!kYB6zhnJO0I=vScs(V!aS#AqwG-<EAB^9HKBF{T6U3=;zqT7EEWmZ2?W(8ra
zG|pc=o55hXTY{&BH<dJ%8RT8~Tf73#zpGLl_I*xRXdhKQn!>Z6*=65Pb{REa{I2B|
zT%>^z!IbQIC1y)z>L#6dCWKQu8xMuKvr5wC#j`9#M72)XR1N-4X;5O)J5x5wU^3@<
z4>D>~J;5FjuxdVC?D5xiOW+PXas2e`=BlU6we*@CGN)KqZapB}@!k(kWc9A6tO9IU
z3GjF=KncwJfz6NcIwXXZ``d@qfoYX45jsc*#SC~iHFN;6W4uo9XhxD%$1tN{I#Z<2
zZRSlvmBN@Mbc_k1E2^7f7}7Ut4JRQt@hhBqtp%OP)$30s+a>v7hrQ|rU(>*E)(k|G
zVx2i}t^~|P^pxF})z1<O6H!K!J_SM?yX!LP_MHtwe@bZShv?M6qOHEQSSc5SuA01_
zB=cgQm35i4=8esN*)Ht17p?-w*}hPm5+b@&4U(5Rh(}lI?^sfCSzx^QY`7p^HgJyr
ziZM3QcWdcABKB>>B`>0<jB+}me7)5TL*;Sk8n0=0EjY~>IXL-3$cCoTc=|naWjCZ$
zaSu&_b-vcL1^;D)^4yPjIb@$$7V1b(M5%I4)jszN+UCB9pBj-wq0dFR8gy)Pz7X9=
z?zsYs<#Iw>cJ=algTlS8AG&D<fLftt%l*p^EtqUm+AnMJT-IXzn5S9XUOQt%<?$6#
zrlS`YyFB}7_bX0!;Zz}Fbm0(5m{%hU(fEBFRjBI{Gt^e&<-+U+-PX8y_wsICD6L>(
zpf1<*$rT9_31;`acZ=v1bPEQxPX2q!11O!$IQ5lgQd1g#$<D`69@X&P^Q&h#3&$44
zS@qK@t{2TQ#?~8$g&5-YXPQmAl+na`Egx&|Y#)E#osx1cFm;K(+CL@Q&x1&}2(B%t
zMiMivKUdkcP~FWgftRQd*w|3j3=3~IlfmUBe5awnX=33Ql+jyjOsYGxj9mBk;TpOR
zRual%!mZf%Y3#W4e!e>ZBF~=fv9Nh_s1Gz|>>@?3n7w#~H@9a+M2(@^l4R>!w_A{`
z5-Zh?)CV<11^JJIOu-AF!P;W!Kf~9pYAWA7KWy~*T*mR-%1N86TJHBvs2o?lg5xw_
zziSRG2<$xaDS2O=^+kbpzIFY4+dK81D(K~|ec7^e<0qwae>R)FV1vR672+C>@;qcu
z;K1H2`7E58aC=3|1`$86p*f@F>RK?)Zf{yHO5atL?a9}6C11rA5*12yr@kf)nWZVT
zSx6>EP`MTuJZL7@lT57yzlQ-3IO#a}y(dMkJI3gZN}jmEKWu=?Q<-#(hU_zJ%#ORp
zBGNOnJmL<b{o8>=3Zb0F$v-Mt^%3*C&#p_mTscXecU6xQuqkKj84kkxLvGK1*JLQV
zn$H`@6@4y7J1bHak^%8`$N_LD3)D3(z7txtm&t%D0G{=r_O)Lt9-_V0@<~s-5yg4~
z#JUY)-NEcz1J}fMTkay%X5CCF-^|UDo(?$cZbRW@W#I}8qHUD^h`km3xCQ+2RfeWf
z&kB)hEh~el<a&P68QrgJl;ZPKPhd%Qo_XsoebWgF!Jx*4H|6odb7jkMD9a66O(9AZ
zZR<gNV)v!cA<5X4pN;(b#_NXht*)tIxXjb@+Fg_+<RZ4!_Hw;M9&5~0Q;O!M^duy&
zia0SHS3o1_8g^#an^4Rz32YX>Q@7`DdOnB$q<NR35)39+5&r$pa)WFc{Tmo<ahs;j
zAPh`qQzpL{E8&HgbK7;hi8;1*yE993@vGHzA(3XqQ69`~?K>|;>uR?$WoT0<vC~GZ
z@g)lyZj!isb|~g@&;)xRc|#hffE92mpac-uab*6}+EC8%cAqIK*hqU?(<;6N_22$@
zWyo=<mn8RO_z|_9%R=?w-1@5Knjxoh%oM{pEl8dHi`M1(=Gi%`Zm}T>sDo`E%Or+q
z$DAfxXu&jdlRQ6ZfUvFWDYENbXx^|F?<w8{1+HTDuVmyO^0R`6CADC*mu;{4JcP~2
ziTt!`W8Rr)7u7OVfMF=FA*PImy;s=N7$mtCc!ABz8zBJtZgPARMy_Pi$0teXe6sEy
zjtvU-eIaTP`f<a6KUrBt{kj%aM9G=N8T9O~7g(g9G7j=nFv-b7@J}mO=tO-><;iE4
zgo?Gq#=BBAU3vWWS!#*6c;h}G`k+}bJ_J;{>N}EFF!T4({0<H9j+f@Rz9FA4WEbk9
zRLRn!qPM1M40|@ghX=r2rvo16BGtCxpM;wvHb)<9GEx=I@6sL?`I8+8k+;U%;pBOX
z<Y-#aRt;i{il_FktOFh6sTXU@jI0{94l+)+riKyD{Ijpz*h=3|s6S#W3eaK{-0wwU
zOWMU8u`mf`G{1wx!rIVDY@NcaYOtRCNvaq+541-!OS*zEyP@t?Tb;T5Y4?u{f8x?9
zbwwp?!)tQs+{~%EZ(A=<d=~Ag0?SVY3sWmiOLF~Zjly<_yIG*6wXLa*tUCaz#s9Pb
zg|lgIUySAyyq+?rIv5IG$S9-TIeO*pBQfn!Me2sjTDc#QtYR%@y9saJ)d0#o5;MOg
z*$*+FQ5Gho4l`kk{G@oHjQJs``0k-zleU%Kz-Uh?Y^>BWl*C^1X1O|e*|p_$Q9T94
z365KB!LPDKEA2yl2Z6=*Z*zm-V~D<Yuj8o1aVHX_yQz5Jm{&klKa)^@_9Af#T(+vA
zPc_+3^A5f4u?N_6ZxPbad}2@p@TF2ee@*KCBAiL4Q<tpuPHL6j#L(1VK%%z`Z9y$a
z#$XD`Ujb$Vy1DAyEL~QE+P}1~cn~N0dVRGHmKrH>R)>)}>-hwboDeG=)>=@I*H@V3
z$LmY)$>>`ang8f)D08Kc-*Ysi#+=$s8*D2W;}H?#W!Z>I=<TZOsWV|OC@(fr%bdE?
zfo4u0<vz+W+Ej0vEbZLZ9Jsc&z1f2JVL>f;QCL$N4>8p~WOfipj}~kt3u@N`2HyF1
zn+Zimcr6fKan8q}nC$PnZw3)|gy;CKIIGk9GZ)i+`q+B!XLU0T2x0N9nbU&Jv65tY
zIlhiwNLGa}L_p5T50Qe>bu$uY$NPS9Gt^XIQNDv2{abS7G`2T}TTDN%Ib-+zu0B56
zW61L}KJPe*w45e(tDQYjK%qEB=-STo@5soxthHHgel)|Dfv<1nhX7u$nD}b_60?ma
zk|^dR_k0{?lOiRmr-thC_&x~cJ|pcRlwFWKXdbwBkXwD!rP*^I{ZeVGpc_=_T0c?O
zgzV9*@#1->z*k)qm0^u!kgR3f7;ry<5v=IyFjBox<FLu;ZAV$O=2ZDV5KQ{$#EB-f
zza6utLiH3l0Tp_rQbM~m9b4Aq?KR^nUZ0mB5&FdHeL~e%vg2IrWa)?0S2vhf-QiPk
zr4kD-La`&X$&yROaycJg(iw@HS_1i`0?o)JkomKfmNdHKmKo#2ND#Ig?{Ul0ztDwI
z{xFT`DoT3di^I(ztmNr3<dF#79&dme&r!p09RlzqN=OXI)#oJ)`JPNZ-z~2OV6(BX
zPCyT_3>Q_w$670FCebV#|MYZc)aW`{U(7PcclEljl*&@i>f)RNR8+oU2A6mGQVG`l
zG}iI00QDbHZmS*F&1+aZRl{ZYGj%pO(l@%Bre0g^jdd}g>~JMTe*B2!3~o#f8xFO1
zTY#&%T^#2rx-kp7iP7zRjV)_dtv0@qa;279^c2WTS}iWP<jUBo;y@vJv1d4_-2`RK
zc)BH|+7Mz^OK&u#2W&}Ou<@IS^GiD5?szTPa$_GCPgVpMZ*HGnF0&cn_9<gT5(ow$
zRw(*3+?_nfEr^)_n({TQ4>$92HZC*4NbR;~@%Grl6?j#=>IpA?)Xb`TOWho3j!GG9
zQW$(0%Vu=%;W*kG7Yb}oTF(c$3v=^UCvTe{_ddT$^*EPSqNw`(0|EMy0ydCT<qnWx
zQ(I`tDXmih6+68c*MTt`wgjuUx_$LtDO)`H{3TLOX@vh_75T;U{p;bG`pfwgFE&vB
zo%jLOY>VT|=8p1j6#$qMe769Ola7twTU~hs&rr{FsMNbWY2Sly$x}XGouU-flc#aM
z08d}vt7SsdC4}|Icd0R=yy{qoF`3Bilj?_e33C<i)RUd-2MYx;&JDRzOLg<|kU8$c
zZF&0|3Tcj~8u<X2)xxZsutG6-k)@j@a0xIqRc`^FxhPcQ@u2iQfbdX78>1j_^diy?
zBL?L;GZyh3HR>=3zJHwmdhSx3!ESX`g1hO-*}Sx6yuQIWg6eH+e`Am<PfjHEj8hTq
z<{ZiW8N+_`k>Wf=*uZx}S99P<Yw5^BGcMlqw&Up5R>;LwCufoJ+l=QYf0pIC7a@Mu
zgR;YT&9kJHU>X#);1Hl3?HM=h{c-7r45<b(6<5lMIHj=0a`bq;5pPwSVw><N{Y^tY
z4?g$o4ea-Mt%`$9p(0i0zmOBYCCLG1olRXQ;hh?<x6lPfs2e6wSutznd0m-JpJ_Ty
zGy^ICaCyI>vgLLZxIbay*~%J47fRZEq;TSDXP1*!es!64^uBz9yw*;U_|oS2&fZ(=
zy-0@M@O@gj@K*zx=8ob*Zz>b(HpoH;>xZi#b4`@EKnl3Yp*kt@4x|_e`YL6s!j9cs
z9O3^B)czf1u>?C-g8;*pn?1+*Hr=lubf0xdi$s4}0L$PN$&9c}Y4SFD)|G3;yzKdG
z0W9*d4zP$$+dQu+^H&`Zv?|flH(m5!Fi9vlIwDpaEs9Se{7^~U+)*}Lmr()m;1Zxb
z`1n|x&5iX-95HX1|CB35b|0wgcD{v<acKM+Si75|=09G}3fFKKu+CAw1ARYr**Gj^
zX^xf1iueUqQig98Sm^*2S2JtR__YtLnw34^hb}=OUKWma5UPv51il+Xws|v)t2)Qe
zn)yK?CMdJ8Irc`Swz&AcLLaiUQh(Nd`XoK(;;wd50askpPE?yt(eYz3S(CAObL8hj
z?hM6qZVIs?2JB)n!+xH=&<V~NJwv@A$OO}U;5xD-py45vI?^Q~sj<azx<#dryPrya
z?{0{AYovLY-T6TERyDWv=;a!H$cuY$!l-o+*Ttjhgsv**<Y{O#0*4v{zjtCs%{+Cw
zagS%|J3GBVOm{F?ufkwdb~a~7>5V>^#q<s4r#2?$!LMeah-#(H{JX0L8)560fN$v;
z(OgUh(jF;iC5c_5gGs{~Dm3IhG44Bz%}$Q78NGKJBTP(0#qXf9p%#taJ!OxYuWg$H
zw*oqkTtX&a>HI#DjclcNs1%XZQx+ffGI+_9rrz^Om<MAjsSK&6ZP;}y+QYAU6{%6U
zslmQ_)X$Lqor7_H<ik{d`VewHF<sF-X5FnOW2k2t0vC%ZCDcFjZYB569OLi({-y~p
zl_jlDPne&??W1-z5qwt`F8|kBvHbDstTj~l)1~XEn%L)g4S}Fbvk`XQcb>Lj7e!`n
z!yvqH4sGdI&Hix_zBM9PoAQZu?9g-088;$pr}-sQfS6DP5r?Z(5%<LVKyVwD6ZrR>
zzNGYOBrjNZUM3ExR|(dE6-aaH%tnCTCFIUt-=i|`KW-BC4C_fv)41}pB^>olKOv%L
zg8+$y{C)9dQI=utay#u2pkeZg4M~IUTm+$Jq}^I1z9G*hfsl*OyFIU(d7Dw)f?ET#
z!Rj5mgL_dXRbbV?Kp05#qjq^UAOQ1A=Mh~8b1}a3Z*|ixXDi2|lv|a+hjXh!XP{ry
zLo+P?F9+{!^oeG`o_5{}7kMdf7WaCp*4~!F+2*|)oP<HwF&fxbs@YmNCA&S-k>m_!
zFCeajh{MgEpLorL@LkM*W)k@!VDX0$?BKJvxNgTv!f;@wl#)=d4q$;#a2MwT{cuWW
zI#hq*SXS2tAo)T`0;|}s?Y>QKm++)?2}kUK-D+=@Euh?t4D1N;U*yWrJ-b^kbl%TU
zQs9TcbcmPOMM4vMx5ap?1i0W<xjkim?PbeZ%MQZn=Q{ar??#?>Rz=-5Cw9V$1{6j+
zy21N|XWB;%w_By^P$i5sDFHL*${+WH`G|Tu&2Rc(^`5EMuri15zBU8S3-xC1dl$?J
zBzCRV7K_u*oIcEo@Tb}owA|CBJ`MHW2#uZ0LtbQr3}qeYen;;`19w5dy-via@C^l`
z(pePo?wt@FoMi7Wn&gK6(DqF?Kc8uo2=cHUeGPq8%)U^dR!d|MwY97F)`AoN`51$T
zp8!n3{%61eVbIDf3v*6HUNM^wTSs|?{*$`ViDQ+MYgkR%^5br|X9#@`Rew6)%A7$P
z`wcg|H!_{OgO=ZlIltp?uzN{>T0f=A3fu^aWmFM5!>thQWom5~|9(*YZ_~<m(~vjU
z8DVUOXWW+-U^_DYq8wMe36It(SXpD{(D-@TYsq&vvQ=gPBOZrhFIv6~cf}D4#tj2i
z4WbW1eow4y>nI7%UKXV_-$qGjIp8ix>plVH4^Q%S3`31J>B|^gZ_^X?en;O-JXg3)
zF3D(Yt6IEWet4#y!GKB$&z#*bMp3ZF<|Ac}V~$&1M`rz)HWZx_v0Bf(rZoAD%dhDn
zn`|t<2%Z<0!RYp?yii2^*>8)QGP(TT5;bD$jn(3I>!v2g10xM6_x6;(929<D-5-)K
zYIm@x`=0b+i|WVXj&mmZ$&&4{rk1^_xA5X2)@jrficfRkA8TjziQ>W-xxXTKHC!m+
zgiTUk+g!e3@rl`SBKpirruXcNEqPUbXVs!bz2h)uO>1oAv5Ecar%BCc$69-Gjhd!;
zE{PN{#CBXE+@cu04LOBy*)F2h91R5-X^R<aAAWQYFbK56rSW={W%tWD_Za(v?CoHo
zQ)JGq?eTrY=4>thX?7u74cociwzmsx;k{g=HIAKVDeH}Cn<tYuU_v=Gdr1q*zPfOd
zKg9<No;)l6r4G6CnTF2CfbLL`MvsCt?0sEe-37QI^3%k?#<?|&&~--kJ!x>eK1m#h
z$na)E(Z~yPHW=ATA}76#7H81VW{AqkkoJpUncJ*nG5BZFT*|Rw%VXP-bd6lj6=>rJ
z;sR)^f|ya!D`{BOPBU@ZXX+a7pR?%`#-2$=cLfT2=a~gBpEe(V)b>5NLHRQ(JDL+%
zDofYSuzj;>JA1XCmOlT<;!`7`Bfr-I)HVmr`Pz4m%UDXi@=YV4PD)+r-G<bNmC?~+
zo&WsD@aSEvW6=nUlXrcBi@M&%u|=vguA%~&d*b3p#-!=y9I8U|0<b*f9MX;5weBMW
zH#U{(Dj7~>!=j*zRDpUFD#NawJv9FJEg3^(zJl%W<+O6TNORH+R9s>Tr`pm5i%_GR
zV&B=4DY?c1l`pvHK(;Xmk+9TVgCgo+hY`G?V_xJ{SnfT#bY8vE*8Eqbzw=#BQrVO<
zW^tA-U|{=Ikf=#*+5Q`ulLec*4<!xzioO~7CkV`(gOn4>h?$2k{zzL?|N8~wK3o?Y
ztoPTQjhtmS%*C=I8SO(Q;>rirxu?D&O$yJ<ifa!Xf%H|H4JuGO$i?PfR^h8n(rh&r
zttah6cum*Z+>->r*Ot77iPsbZz3Ig&i$X=m)X;=})+6GATfn`?O#qclLZ>}Y4>6rU
z+5VTr@;C@kN9UUfA!>ozsWRPtK-FD6sI4_2(dKx)lJA3RyIw7O<~9pcg7Ls}d1Bf+
z41o2a>P*7^55pQK9T|RCLjQaDz!OV*$$qb~&)^9+Pv)z;pF2Hnpa80ikJ^DC->SQi
zf813-{Y%Xg+EaO4HF0uny-Joi+s4-|in>;%yDR!u(%xb#nn$FQ@6KY6^$&5<!4~df
zzHGu@k7}UZ)PgKDcGPpk&D3L&Xd6HGvZoPSLWv<Dj0(Wji+`^Ue@e`?fa^akz?4PP
zA9J$jW6m6xnzGBjDr#T13tX?9sH7YTwiY0;D8{uhp4hahew|?=?uyYSEe(3!xtlJ4
z1J`KfWB!=~V##&E&CV@Zbx@vtv+WEA(<l4NOd1S690*-4C9{TjB?SA9xuZVZH^XXx
z2fF|zfw_U2<m9Sp)hMwJ9#4<B!H%FAy?@MN4<KG9c~e2otOua)J7d?bYcoz5T91BO
zEE-8OGhJ0Tv!ieWvQ5e8JaFHympqu$hD}nW#%z1Uw7A+D&~aDeB+)Z&7r-JOvD=?f
zMM{2gLTCmy;a0T%xSB6g_zb!luK*-1r=ddNqtLY#IM-96U#|h(TdQpL$Fl<^g4sdT
zf(>u(Syg?#uq*%#ik*2W$dRU$KrP+F@_@Qt9<xYUgl=A8eF^eoG(tBbcSvobMJ<H?
zB~&%9@%ty%tuX7bqJgL}EeANc-i97_O~wW7PS#H1_Z_YMOT{F7Xiu38Vj60X(wI=#
zbYZmW+GqXa6ks@HZF0#iWhsrVz_0lU^Qlya=Ft_tmKw3M|4nLKF?=nC&lavSU7xxv
z&96@B_NuveeVm+!z^T|{e(7Ro_gK_>le50)vFCBd>36<CeW=_RR@|9|M0sC=%Pxs`
zFC)Uo(jP5o&slqKp}n!L;qg~(0ez9L0iedoX{a?Spgh6v)ho0cR<4YzWUPHMTls#J
zaNtK4zz+;t&kO*0RB`F(h5><As&S3u%1Wi~jo#f(O2m(5EY1Yd67?uZwJ9zfIP$Tq
zS-+`lUoOYr4;OEqkyvu}LB8qStp`SLJ0>vR2r*Ow;KgM-wg13}DtBzNeDe7+qA9}j
zP4BM?KwIS8C#I*x@cxTB3uTMdarPn>7cGcwY*w?su+SR_)hUl6_k7MYvIudTC0|`C
zo8Xh(Q~Kyi&lyBU3XUl6n;-q<@vZYys~%=Bh>9P}4O;Ax@y~@Y-AKMgD!g9Ysj;dD
zX=l}02fQ*<@h<0Yj5~Urni8s)SK^J^C_#RgEdahzGgOr`B23WQW3GEwN3`xybHSr~
zR<M*pAv7dn6@M3GF`qHvztEsri|8mDsQaj$L{VQ{2fF7+QC8GDr1<Tcyx&3U%E|B}
z$<+65?!uw)iLh7XDP8Ni_wK5$Xo{(~qn@*kR+i4MPMa#F#bKuv^6%&4vg(kK3PJNb
zZ(pra>ISm=F214k9+`w3qoptr3*DdZ^a<(+cdnD`It`Oi?~oNZ!te*@82+eBby?l6
zEZ3mDQOan$iS=3>Lmt*Ml3%8_VQK=2A;lpD3xRL%aiv5JlN``nPC3HsOFOa7YFVW=
zOKK+PpY~o~j+1g3%V*^5t-xLK9ke76%DMj3?YEtNvwFyx3TtCe6Xf?vTO4omYqqIL
zDDqmrtoxGN*N+feHUxAwKMf^7r8LheqYEbTtM}X*`-ukG(G)1>a_utg^qbg<Cg_V+
zBb9JqPAus;ZU|kN22f$$X4kwMCWIt%M%T`NB_#c1y4vDe^o()bx%y1moJvQ%O{W`c
zR|a#L6(ll0)R5Nno9m=C-x>nu+;%#EYn7X=6zqHL`yG^OTZYEY3X5Kepgw|0k$HES
zUvJrRGAdPn!1Typj{JpsQ{bbKu8m&@el#w@<ZhZ<5frktYkbagd%^U;Xv{61O)l+0
zB8NeV55ejH@!y@TXjkuR{KIZD?bw<v*$bh@dI8l1`c$z5;h^#YE<<TfZvl$RiU=wm
zVQ7=pj7+8y15-Cj+FC-zGE^aufC+=s^MWtE@zr#Q3h=vs6_MU+#P+b7$Od1MU8~kd
z>jcuOb6JMIfeos=7E0%<m!mrei2(eqVhUFG;aH+5U3QD9>>}B?hbdhABDK)XHdFBS
zqJ3VV;yNUT(L~#6K?1&uD#ra0BUXOg@JBN?XR_s$y`PXjd_~Iaul|FYP3Kun)A6K;
z|H1d$qUhIgZ9(8)$Ioe#r>OMVN;aM4!|mF)-=qweJLAx`SbekBi0LMkK+<SvYi9(3
zx(O@5EoZWD9BOp@-p*vnlGO3!aO6zueV2Ah*E{ELDwWpvMX#yONO#Qu7eBQUdr(w9
zykoM?YwCmD%7+D02LdI;Z<nt}d19@4=}-w<^*Q4Nuu$Vuk+iD4k*M3edTYqRR7Tjk
zKvRiZV!rfM2#A>2L>pqMefSauqa&1jWo47Rg>&7!RSXKYtj8^OTY3cJO+euUegjg5
zDx5cpJr_Amb{x}FV-0T%`5t>T6Y9#d7cg_43oP*#EJ<cyls$tJne}|#jTV4im4~SV
z8E$mais#AU(Ao1#wM~a>eOMib-<)VcmcO|~XTXT?xU$nAmH8^F%mFP&8889LfKB}8
zn@2akow-JEaF2k0#s|6-4+SocqBsBYT`wcDs6M_?EGwj?D^}L>v9YrL-c#ayKRM6b
zK&SU)ry4)pT7~w!Oy!(J-ftlQD6zFJrEQYes66DIEI1Krs!LN)K6x$1<#)T-NFs@-
z9)Ly~X=iA{S=o@Wp!O3~t?ESzkFz?_eR&=tBQK^a1vp%XE)kca-I<6q{!&Jx>LLWH
zVXLhf$E!ZNlAT+3uyL~g5T@CHp+{J>Z%`Gj1b)FMwWzqd=IJQ~JL6~cEM6kp0;0Fr
zYAkK48Sc=$tAB5Npg^#@%gC84I=TA(Mxdpt7atYBD!?@VBott0;@c6t{bEGQa-w=M
zOXb?QEB$Z4#CT}3M<UN+(DHyaST7HgEk&Mkj(^Zz?S*<MF{xIbsYz|dXT(g<Z(rBA
zkvq-SLE;8posNL*wtlwW>a;qm5evHfC7#+ak4W~3TX|J1lq{ZSdQkIMv;oR=N}F3(
z6B&kJvBGj%Cy+$bya5pAgXah;no!7qhYWZ!kzc9xg|~j;2cm+i?0(<t)WL?@F&mW+
zALpV)z3qgsp}!j5oi%Ul7nQm11)u4q)1#OTuX7uUus5QJXUbk=lgG0WB3@k5(^-hD
z2Cci7`>#SK(@M4g-8|o;oNv_;vD})Xq+m>XS3n+?|1hi#!!!e{fByg4yUu^M+PL36
zs1AfuqpGxawY6#$rCN<GDQedqsS#Ql?p9S%wDwliN{Ct^2~xX8C=n}0QB)$d2sOfU
z+@9xec;4KvPLdbr`kb8W{C?kco$JAOE!Hj$n~W+y1NDaOa>ojji6^E80r03hCl)B^
zO^MoP`1e)isCqdx=c4#hV5(K4FTe+GOWg)aU9S)B>)K~^iE-~HbHdt;#9Kn~h_0<~
zE3M~ZRdo4J?Hgur)rJaq9cDh22Qy(?*5PE2+Q8t)!VB8|F>Q9P@cms7{(f7g&}5B}
z0T0L$Q3)~6pp%4bp$!15u3B!Vv+NQ8{^X)oBSj1;`DA4>qttX!E;WkHN@x?IfsMQB
zROtrlLw(Y)l9*32Fe#<I0x3zJjiqjig_fE*%_H+4j0Y<CnE|f>K|tMO8S@g={r;@<
zTb0xP&$Ey4^xoyU5wbfuKTo5UkBQZPor8J(feH-Tqh-<di{d4=(1>i{<{eVxi*1We
zKOx2g<8~4H^!D8kK4OWX<7sQs35IK$c-1x9%i)=RNpoh+;+!85>pQq1MekF3&O6Xr
z!5dgywkFJHo#DChg7?R>UwVsyGjb7*lU@z4L>C|d+c(HA#ayK+mL+jS@bWg6m*A^D
z?klwS0o&0KvRc?9eJK=RcvrM#33mUwNCMHx99DK&y64|;F1M6PtkZ5=las0%=Mq)!
zA?vZW`3tiPaj{0m3}m*@V>+S(%?VP{->vBL{>Bo)!u(<y<^Fj1!WO6c8CYID?a>yg
z_}1l;xm%-(CCt0_(MX!28rwzs_Yv(A;~8DF`lG5x*2W!?-s{Z`17qw%pEwQep=N=L
z)Y$_t(|3lA24&8>u?~5O9oE2X!vk~ds5h}CiH8bdZtnfZiK#VHlNJ}MKG;(7FgZ7|
zToG39+>%9XiY~dw&X)GL(AGWFD~gz|p>z<gDbU$<Hsf_&pF*R3KS!ndg^j+xfloJ-
zj^J59wotj{1Ms~3wNqP(MMu`9#1bQgQ|hjxOdPhAO^LU-|5HZ%cSPt*!(S*yNTJtA
z&PAwe0^#wK;CYRUlhsV!q&ipWek5C<BKOuL$Y}3ND_O-M_)iT7hTUIznCm#+qP6y6
zISLAR8Qg#sX!!E^r&!AZx<hp>6Q3{WrVuGUdv~^IS(?2Pwdm7bZ~wJ-#ppDHPk3SP
zk)IzVjW;va?tuqSSIqj)OB+~uX79Kr{M!uPGH99PWebabhS&<GXaf2(61FLZf87q)
z3}-R;p0sd?$dgPi1uWf&+u}C-j|PieA%D4~`9`0J^)_yIotU<?f_d%yd_*nd&*?J`
z754h(Ts{)=Xlc|PY5v4cP|y>VJB?JH!|G=U$&SLNb?D|v@7R%6_-8lcu~M{tsC&RB
z3(I0BD8>q4Rj2no&Uq8@CvYpoG2zJA=w<0ac2_m$A}`7G_W_zH?(E`^!Z{B=oaWI~
z#|-aaT96f!hS~L@6c{a4SvfMw-3iu`;^X9Vfv?aLH%e%?ney0u(DjlFOvub^8k=~t
zBEK`5>y?bAR`pVR$GzX1NhKFj2tsu0TmEFOFQ|FI+}&5DZaF81py5{RTvd<T(4OdB
zobF!Rdw#8~3l*PTx7{}gAy52nz6k~&yDfIY!WsAS#%ika>Qt}dj%fl>e*KFfGkXI0
z@avo`2KiEjd?$JBj6LYOlOvmK@q$^cQWQVJ!OYC#<6F%(?qTAPyAZ@|T;EfD1_-yZ
z;aS4=-7x?usbuk_BhcEG>`v@uUvA{7=_U)X4%vI2)<_7qjwpf+Oqg;++?pFy;~sG8
z*1o2fY6`hGy7dmyO6aw<aI?H{%i;--<CcO*1};k6&$lDJ>cmIVa7IH%-P`q&B$W7x
zd=z*!yIfsO?z~p7+4qWgdQ9y;vn7W73<r<~pkOE$HQklbo`JpS09~p4+yirO%#C%8
z)Lg7UC)D2UN^cOZ;FUWA9=h<cCs*CaJqQi~DW)MCx<?L;<4z1Ud+-w>FqQKtfhHAs
z7lZO_PP%7u=8Nm-x+q^YUvu-bK)2a!A=pBH>jH96sGCx$<Qp)F7&{dc`NVy2)M=ez
zUI`jm7;Gy0CA39pMZnqNObIjQv@Qp?LYl4-AXm)A80^Vr-KtV$SZnf~5p*t43zL4T
z`o_URPNoAkZqzM6Kc}wI6JgcSa2ju6ZsYYYnz8=+T-6>+qOwgvs-mM1v9g0Fz{mgI
z3v%O$V`NKjP{|M6v)_s+CzqC&&(gRwwdMDUJ5#ahq)BK3FE6*=@4}kQVu2g5(;J~T
zMp$U<m+*CeJsM}9F?lB^0>OI$l=oKo7<*{>w`2ge0PzTJ!;{8=FJ6^)S)roQE%})_
z_sVY4?Bw7<T5Hu9H~!qJV_>e^IvI2?T(<P!Y{9^gs*hU`gY#HsIs9Vq4RdFcc59-u
zZ_j0y(W1)BUk^X__&+Ux!uuhAR8ZF)PgYG&mvBYvY!qB0SM2#D)|5iL_5*N}Kr7hC
zz3nzeyMg3Q(5n=;-ce~XynL?8>P<EAPv=O`Q-)Z}0Q^)okvjAigM<imJ~RgVSLV8E
zNx`pDy=NBDw?RS;e@t${)t_bBJDPVx&#k^Ve-|#En$)Du`(qC<wi_}Lxzn8<O5R*X
zL!s5#-A!ddE}18~`hMRBN(glW;9Nk!sJWc99&3mxoOKLI&TT8vx|`Jh^B5EKKw6(S
zCsndlK`^=aZGE|`ueU1e4I8J+sHAd_9M>sZNbP4zLW9|wq~{`O{pN{DopiZ$lV4e#
z>gAVdd~ck&A_emX6fS+N4eVRuPr$6tS<ZP@y0;eF@*nm{k=W2~3>EvU9s~j~hsZ64
zGQgk#KPYM#RI4f_Q!$b4n=c8GF1s#zOh_7OT;poB`#>)42-<$|x;NKHGy97fnMeDr
ze>sq4^9`=*ZHIe-!ajS58mmcPymAxO<5~(6X0I`Ow{9Ekr7&rcJO(xA9NQKrBAzCy
z-3|%+6!=I%uNiG`h4!vrsT0Hp#vCA!!`_@V`m(bD1{<@yRduG<E9R(ANvBxd2>tmb
zP!9U)T`a%+QYU6%@72wncv#V(HgZR#45vdc)Qyz(_Sgu_inAoAA&6a@-3wc+i=D6*
zba3;(P^#__>gVNCX@o(>xe9NcP``Ivng1-A^iiFu$lW~CH%cj&I50bN#u-tHiM+`k
zXZ*@uF9x}WhqKMDnLh2_R*n9~`#olMFQ4KQ)>3!HBA}V3Vh>#vY(&QZ-(>*&DXz$8
zP$<z>7c*xzK64u!Xv<V)2R5uY?ScJWzQgl_E%6<Q$FrqSPiEEcIUIZ@eJk#5G*wtc
zO!-jy$!X(aKEVuHc)!-vd3yA^J5_0CF91Wj5x<+C-dXl)r4Ui=mMAx)+f}(S!}Hs0
zt@ykYP9Q%?$y58saH1`gW;2o$@)i9<11N@>YV$9x?=z7C$-4r&jLjcQ72{c4e&S#J
zp1#}0y+;%@rx6#0(rKcR0f$|(C(+>%*8UK6@F=@rh6&;3?qj2#Z)KIL5}xmIazDwB
zn>EIeXps{mXfW4CuY%%Edbl9xc)#nIHC!&pU47XA>RP%sd>A0E=ltc|Ul6PsP4;b4
zg!l`>O6Zlq-0Qk$2cKM(zj+e$<)N+v$o#|3ud4K6nENskR!9FjN(z|uF8EgdP?p*c
zF2UbxU85#Kp<<AssfV|1(2CLNV$L;1#RG=6Wb<ydu8k_;3_cP~t<X|ytGc4c{S{79
ze*0CuRx=tBX~gZ%a61SH3Y3JD3R!=+KOo^NBgA>lC{8Cr>&<{C9z8GYsP*D)3NeG%
zLRd?Ls2@k@fVix&V`BZ*mDe;Z9SpY~j10hjx`BwoW4y)zk7>*}TFxU{<owS;h8b@<
zJ*GIjN_yhKWKHig{=n}ax4L3r#_s_f=UCaW_#Am4&<M6ao(i>I9FvCXv0TL*8<S>n
z<0eEYJ-Gtz(7bom$?=nXCuM_pN~i2K7JSEKxqkq*W^`q8rgp65yJIScZ*)iZRsF_n
z@U!Sj?|#V1!2W=3y-PL2Uto+v>mhTs!78a)@niT%06oP5;0f^7m+yA9HVC!4d6N9g
zsk^Up_%wcPR*Xln+9d1Ozv?m@ua=_NCI1;r9_KBLkM7hu-k<l$Z$R9*8$&@2)$2sH
z7C&iu?|T1Fdh{nXkx1BdR&}@(2I~D+iUh>B_PzDK10^E#h1K!YU&s$KcS<$2w%5&D
zy<aK7sl3(gf)2+>+NsW}C3#6&_R)I0HAJ1WaEmKqON@6o3*UF25Mjc{*08Zxb8fSm
zBWI9a<*@-$UfQE9vEv2Ly*yE!`egG7Wx<ofZZ1;$@tR2>F(3*&Mc3HOwz|F~IV7%?
z&WlYgu;?3o<11qZh{S%N$1B_x>Ws`p|B+qwLQ#j`{jqmv^pUw{Qao-Acxd}DEOQOS
zpPHPRxe?sW6w{C+!~~MjCddt2{q={QX3C<hxCZ_9SKUb<?RS5**0q--<aVnS*_T%K
zZ8ie{DgubA&=<jNUitSYn?rvlsqWbn)w<vu@#@lG0#qyKj^NV)S)Pff5+N+4^AUY-
z{go-*P;|pY{MTNentv*)do!qWlJvVtpWW^lUlM7TzRC9i5-xV7eQL{_62yhs!tFLW
z#cz&BB#^oL3+3I0(?OHt-UhE+-8_&d@M*L5&=v6mFzGjFWwuv0Z1_V|L>ikv@@#HZ
zQfeuLIbqgKJ-LO9k&_v5_p-3u{`Cp#lV|;)e;sji>!Mzdy&{c~>m&Psc(S;DwxD8~
zs><L*C>$@P@~qPM?=P_P4z3p&#EE<4eLwl}2|U_$w?Up&aJn=8WZgQ>>;5#?kpBK%
z@V}?-@UQul6(d#bbHvt)Iyx$p*D7Y4bW~U!F^Sv|yWbj<x=IOMJ3mj%kK#Us6OA4n
zd|Z`w=~PzG%FzI$<#;Y)qc=!ZpY;YS;ztQu4UO(c#SHK4)J-R6c~mXc!d(AEMu1-*
z(PPPz0`ciz0U%DtzJ37!b>|uBB1uUbc$>|Ru~oE@B`r>7$rK-=&I)P$&`_5r;KJ@R
zBo9*O+{N0Y-^ob2K5?oBClohv&ya8QjyQiIaoq=#mrX}?ar_~j%hNBbgLpv$x>u8S
zxN_cRKc8q?4(d*nF)sqdM{4qc(pl*ZwZe_*-1RA@Y#I-INfJ*%amlCr8bUokreKkf
z)SQ2%Cefx*?VG+)xBvMxcJsutw6u#3B^BCo!G8l}Ze{je_%gR%62hGO&cQYRbP$_~
zpcFdB#Iz>ITET(*-sJYdFj3z@_tt2=($@eTj*}aLRSiru(Uh`FhcMm{kV>!8?L?=P
zLd)GOQ(ZmRRQI@~3X6Z%#e86~7nNGg#<wx_y4lqHJYl2ycihuDyJ>sT2G5FS4!1m0
z3{ns_Zdm}jx0%9J^Z|#{t~C^S$f!{<LhWQlc~+oTe!m|x{wUtGb8QpM(%MB3yzAAw
zJYvDP!s*b4Xm6v6_#x!+FW=apKzbq+F4Z#f%DwgzU63c~%P!gqGd&&GF8W0;#V@X(
zK87s*kYwpN9%>*Z$P(NK_&djk$v}i;A2O_tpoOB@%S8vl<{o{idVQ<Kx`ufOqv}(R
z9{An+-$~nS>75R$)zx7a6T+y-6yN;sZX06@(6Ko={p|Msp_i5G+Qkm)@opx`>V9w1
zxFj=vr-&-#KXRfrm|MWF-O)#N^J+t!vc2gk(ehFEFAtNGF5;<jom~f`llt-x(Wu<s
ztMzKK;AE|A+pzaq!`)FG$i_+YOnbC7ht=5-?O0a_lq&a7&|pc*0RP<}gS*@38Fw_j
z<J_#RldsFsY4_>+u{uH(7Ku%=F?YY)v*~$;Pv8Pn!sd@L-Kc|VeZ^-xthBNAQG=!7
z;`Xjfu|pGN=^=R7k#dPfbnrp2S%sg*oxwl%Ey%H`GGzCd>IRfyh=kYz3!z@;2Nv2E
z(itl`;QXfQ^|dMQ^15qRR}L4*G-r#&4{Y_dz9~ZK?cE7xg?S=-eZF@OGiuFBm2(?B
zDKl{27DPRva`<$MUuhq<5m}+GtJLhaC|+|K9|*ME{bbT%6Rp>A$Q=ed3HO!JGmo`0
z@WoYK|4Oyrm^Jx02i^TA!X<`!cEK2qzT|>*7NYv_I0yV?E{^7q)4IkuJi=AvU8y!L
zXQj&Bp4skc`~2l;>je@dqW*I0^#I2Lf+H%Kc~5sY^gK;A*7>aBaw~FGQ?{jlrS0NW
zb9Cc9b<!3aVb*_ThHDx(!4~JpE@M1`9ERpKe`L~K3r*Z6S8;s-eTXkF^fCg)D4k*!
z8#awV45xFJvvj*`=iGs9LlSFJW<Yn)$Mr7bOh+IIcvt?xyg`}*f>j&i<mp*#D%2}#
z!)rVqVFrCmuv;D-i&-Nucmu1w7?HD?uFuChcYG9O?eIjn#LbeQ#g53Oq;;EV)uHlQ
z`!?x)vre%3U(H9R<s~1xKw!M|kb{Q_?d1I2nOgJQOJ^7lljGPx()L{j_TX5yvyI-N
zJvZC3@-@d5_<h7Az!a*@v%g9r<cog<(&_QzbGRg_xX(|;c)^}>VkQ>dx5G$R7r!y@
z4I|S8x;)ewwfW=Aoi#9DqQj_WZ&brkAinZ&0w7jT0Sfn)T5IUprrq3I1E%EGeO7E+
zD}v?aK4}Zqc7OEq_ziUv=i+xDjfIC|3y%HDa}~cNMcVuuz9s}g^ZC?(9Y7NneUoZ9
zUf6G+*QE+TbQ_M)5sE>Xwcl6U@|L2j22B!}OYo?DgUT}me=s-LtUSSE98QSzN1&LG
zcMZF^aGNRZ;?=+7wniu-ifWOfGc4!MEnt^&k_FTAc4Jd$M=Lt9o3QH0HOhP?C+z_|
zMCPt|FZq{cCB_UEK$TJ$pP$Dc<7E$7^FegjvrONSx)ahxj-PFsNf#dc{02S{GW$%v
zT;iNR!yo_p8X)uWmJHjIy)J3ACS11qX!~Irm&OOLdI@<{Pk3isYH@S#+SQ)0k@@ov
z|Cp%C)r%RcbY~To*oD2oxzX{OA+n-^X&G&cj<MCuqmfKd3U-%1U|PX1+A&)|c2RZA
z>8OQB8CZTnnV$70UwY#4GUec+FOg>xrPn{(Y`1@2yZmf{9DK{097#}}Etsr9LZ+|!
zC;T7@CvjWSbKwti%plnVX@yIn8JJ{MQet}77NaC<n~Mm>FqV)evR*7tCtSiefSz~&
z5dh62ywa)+IDfkV>T2+^*bAn3P8C`l+Du?47tOyrIlandART<JS{|d*6Oty5g=f2S
zKcG|Q-GagKZAEY=-dD~-qh|H)&{HpbJ4^R6?QH&3dYJnXa#4T|XYg;9YCjHmZaz;t
zcglL>=?QgDyO?Z<MV@cxru9Ds-wnt037pO$bWf`^o|VlD9>g@$g!Kz(zJC@bGQ<O^
z9f9A;qwe|!zAJo{(Gea@&c$;IpM!J5Y|!ugOQwK~(3XXv3F=B82d^@o`FUg~zynh>
zwckK)GnxOJ67?%Be_2L38Ibf-ctX4y3!hZ*66(zvk9{;;r&l5b6M3Tl1rC)Zjh!pv
zuaZV-vwKjEo9F(TeTmRj^#`1V3NrUBfdk_|Ecm*JY*>b$TQ5ELvXGRMGtT{5iFbKu
zTNiW3OkOXarpQ)Y3XD8^X?bX$y_5rGCfy>jt*R#8NlMPoB9~XVGlbhWaIM!k6_Ut9
z`3P#Fn~W63KpSl-<%yF=xwmt#6i9e0W=Ln;%&n6y(5vtyPaORwQoUQ{@|PoBpdC?T
z0%K<=A3DTR_28a{=?#mUK{Y9&1vLpo(7;iecpjVC*^Nrd%1#?~P-NdjfdP^hJ73KG
zcy(v;fXta{$fFlU)h!WN!9;=L72$2%N}*l<1sB(mw-?vD9qYX+-Jized5C-~u|>{K
zO82Vqyu}HKY;!ROF<bXk(zpvFrzTARXR_z)ylht%cH8ew!<k9f)Rr%NK<YCXSi`kn
zR?~KFSZ}9%9mPL@H-|$}lG_4@Us}6*z~2lAV;gcCemG#MtiQT2WTpNjW>jlfv&P>k
zQ@r9Msb<+s+ElIa;4t!~*H9A+v6O16!)=MFc&|yM5AMRqJvgm|D<S}}VwN0GlRHZ5
zQFh}ON8U%A<Nj0-pfRMm==e>><6#jtwe_~orgHMR>luBy8`z?&qNI$Cfnv_7Ph2zz
zeNg@OJ!HJ3<({ndwyk3gyIWZpf^E<N3T*V~RVJ~>b}(ZWhFiCux0f?Cpx78M$$C~?
z*gcJ=COKv6ITKYo#mGO69T{DT(o7|RlHe|jhVzk1HH7;%WNz6(j!<pBYsrs4>cG|i
zA-k7ufi;~JzLzd77A-2t3{zF>#=oL(4c2=^MVCq+#&?PVtD*}3S0&KU$&*Jnk}C_<
z)vSN_&0l%U$5KN$Zg*AzmOqO5k(LIl?EUj2v1_aFQ&o)$pWR>O$t{(JUmvm}wz*4+
zC2X3N(!kk!vw0ig3Kl^Zcb0=%Hw^N3=Y;0Guh#F1za=^sF$H)ZQnsVVS}y8ujf#r_
zT9Jg9Ps8|uD<i0$_;7dS?zkZqBwi&p$rVNIqa+xX&6#A9ZuvI+_*9+8x$20%E{VCH
z_M;YGHFavphRKJ>7e|kH^9{c|KkQypj(z_sN!poBMF-Og`vSj)GrPgweJUi=@guU%
z{D)$1_%7089$A`i_P|@kUxeMKz{vr+jFEVL8Aw#m=Y22=nIYM+uSdK0(FXnw`bmgu
z8)=`P5+=U56{I_Fnt`qs&csoDBKF?6Q3D`h^eJ40$n^2s8^@I<3nx==E(Lr}Ga)$~
zbKhRy62-{KW{#VKU9z_Gf}Yn`EG(W!n^LA<w@LTRsZp{NzoISLuy3q3SEiek53sCq
z3hy+eeV)gOH(Ns{@+JYlqxM>2RdX_s9nOD0y7QN*aUv@2Z%KAwn3ZLXtYfMBrB^?x
z5u=3k#Z8h@j8md<1b#LP8AtH!GIO>sK5o~$b^TY!<$Fc4_e${B7dxFVEK+k@KGKf^
zaQ0~U4ES?02!Wn{K7yPKFf+zVf!#@_u94GDe*Td+P@`?>3F}vdnl3O&&By(Vh||{U
z&X*UqAVrDV%QH=*teC2N-Ga%Ji5qX%eyi|D{Oxnt)H#bc@Of{Q$$IuuIZBE$16<Sl
z-PyC34jnr5b?@~1XZuI`kN*z;{RRKcg8v?b|7yX1<?#QdBkafk!|v_Xfs=ZH4=48V
c>(N7pniF4D9*M~UemV3&TmK$f)AsfM0A6x;@c;k-

literal 0
HcmV?d00001

diff --git a/docs/images/pr/chat-image-delivery/remote-before.png b/docs/images/pr/chat-image-delivery/remote-before.png
new file mode 100644
index 0000000000000000000000000000000000000000..8ecc682abaf93f3c2e7dcc35da60939885685224
GIT binary patch
literal 19007
zcmeIaXH-+&_b!SR6@k|R2qH+64odH+D7{DxHS}H$y+%Yu0g)a$B29YlBoXPo6MCo#
zp@kA!AaM74&iH@1_nv#t80UODKgP(HJ$AxgYt8b^XFhX(d#9;Hd57T+85tR+it-yB
zGP0|~z{l{`Rp3hdq+$pe**|0|Z(iy7rEksOuy}}CINqDS)jEHl@5<|sx^sE_9og?p
zjemBSMJRl}+QCiL8gbK?cSnb>;l|Y(iS`elrVy9&(=K9)*;<2vvw_I0zP#q@YGM1q
z{`AuU$@oPJ5r*2S*9r=3tgL?re*O9-a^Cz%WZ?G|m8g|FJm=QYywcLrO2Xvi;j2CI
z&hP$MJeF9kMIw>o&EpN=!+qmxWQ)kuIkV0BX$X=Z_LqPgdwlmMr3%k8k58XJtITxA
zuqag7^oWp=U2wvK&%~ZS{ZMQfSACsI<#A|es8N;82pQQ))-eI6i^D$kWM>)s`b{qG
z^$Z!=OPHv$L8DM7wErG7joV|Ljhlgt?CUdGMxnZ2EZ?R+fB7;qJw4)lo$LcYCnsm4
zT(7>4f{w@6uU|bpJb>+c=>iE(D9-(oYeC1vw6nhc`wH2IDRz(U|900?4>Gctr;T#=
zCE_9!^z<Gg=PAfOoU9VN-RCrU-cXW}{bUTiMn=Y^v<RF)?>z}JvJa5!RR6cj!5)i#
z2bh70V$`bpcGhZpPkcBvGq9RJ@}uO}qq}}Ei@PuUou9Av-W0<iXXS#4dS~`iHSZ5*
zYMtfRdDUP7NMAhSCK=iI*@r(P&Aw;?PWXhl(BiQ)S89Ta=hPC=t%3g2Mm`|xH0}#3
z2TuSG5y1S9gn(I-X{{4Y5B<KBZEu3Gz2@a9_B~PQ%9ShdfI|Vj3gvJ2^AMLy1>N1s
z1LK<&g|4$cU@-Uw1?}k?j9zH%?~SZU*V)Fk0d(&BYU?gdLs*OB7)Hu_W33OgnC31e
z8+7t6OTwzXn_D-Z^0Am{fNrXYW1TxXBsf4>Ss9HW-Fe8x9{EJd=47_s-S(HZu<G0+
zX}k1rrR>qXK7RAczfHRoa&n{eD;udupY0}RgYsBzL30G3_Af6Bi=TYhcr7O<;B+df
zZ!wBGhY;JSbHq!~zvch1q_j<l{%DEu8$kps$s^AW;26?wn{S%9>my;i5_Rf30p9Dw
z_fCa9I|<J;82V1siVa-n4%SSNZW<k`Ycn;Dn^<2hJ88(O!w)97ajjErz+utXuiZYb
zv*DjV_jsj1CrhS{gzXQHz_FZKJLSloTx{}4PM2x3Pw?5%KwlF7bhR%&UD8uT7yHHX
zEIQ*}Y;3Usf4Odf0UjLej&9-@<3NbGPYQu{OdpGvxK1?L;^jyoXRcbnzlM^$wKv8K
z&j>i#V4@&krtkWfNcK<ULrmYid4qDB&-wL>2UIlPq)}`)kjilPW)=mVW~Pky;YMB*
zy>PFKfPg?8i->1=*g4#$hn1Xs%-F6!c`Z}^l3G4Uuv{&P&mYr2?Y%ik$tYog={JH0
z9-r^`)d>YJv`A)Vejdt{HP3!6>2FeEID#OZbw~dFOi^yyxY7PCK9LvH6tt$=5kWIQ
zKW|ICAO*IyY2e=6S1L1YRQ%4sBB++YRp~MvA#6W{_4PGxw#!H>-t_a->Q~~BCm#F=
z_r&y*wyIM*BI&B@>xVXz>OGcT|GT=aYgd&b9&+0aWlGxhuZM+Gl^%iT8$D5D1w-no
zA{T!<`Z6<_0%raJ>@!Jz|F6aH{#su_0cEB8WoVmH^xel&{SF~hR;V)c*4?9htK%JX
zZgCr0{?Fjx;3JwfJRXW0<?vjr;9bWRLP4GH?=)ZmPszL<Emmp*?7~X#T3^;g(e!Wa
z96qC}WXy9_uF8JCK5pZh?gP3Z(Xr>lc~xtwCgRyapR2%N3M;W5i}C;FI_K7v^g=cc
z=cm|(h2qZWQ^%e-j_mC0drM1HRMEHlc~%&|B$G?B{rzk6kgZvb3U~Fr&wC~*8|ATl
z^L6I60c<LpQuNkzwRCgC-6v8FhLu*SjbZJrFP>4;Z}Gi#9r<<o?SWDxjUd8rul(~J
znt4QUxUJfjRqxZ3Hj8Lc_qM<3ags&_oSt5Bdki@v4%}#RIeQ@FUt}I{FZrGBuc6F+
z<Cv)I?d^kA9X-VrZESMy2A!X*tjEOsgS#5b4ZS$s1$;N)aKk|{Y$TsNTPLwMMaXu2
zzE~-p15{*M8Boh$*5oycR%IBrj%YpaluF~~c++)_n)=5*wl6(d?&OrQ_fmkbZ&bGn
z`c(dU3za`;KHLV*Hj<Y6{*$mMq1U-r$jA;C>cbTj)jxjx7<h~;xZJsOde$|PWBY+k
zzetZm_2Ez=FZRO)8d&4&n@Un%>kZB*fq@`W{q{?Tsfvq*U~&UKbM6e*dbfEVP}wqp
zzS<_BkCy+Lda~cfI398;@3(6a&Dc1UAzff}U$KPgmURLS?=<0bmq|#SmNl5>2eWK1
zOt2gwkn_T4@j0>-gj@i86vk)t%wPHD2jFMMf9X?@Jcm9qAxTFj78Wr;_<VTwfhCcK
zH|filPY(qzv?ogjIaCw8Dm)DvhSh}SEh?QRdYgUm0Rgl?;4FC)Kav9-S9fGHxXxwz
zd$^^sx_~6qHZ5u25dkc)a4shhl(JA}HmjL|a769&0S4x~zB@2gX|0;X=SXa7wW#TN
zoWErmvTD_vphAAk+#SzZUhIrOm7}8=C0PT$Os%l_<kthoZ(1?ze3U*dAka8d6H603
zpG^W0vGdJ7vOWaAp13?wAeSUBjpQgzSKC7`1+SBnpPkP8diKQwfmnhW9zvRFZEfx8
z!Og4f9v{Q-Qc|74TPvprSm4AX(jMPuk$s@4*+VeDvoCk`>eaCVEjnnES3J8~lKM5W
zrz}61<u85~v)?~x1(Mi@%O}^PbN?b~DagnY*nqr8wswmV2*8q8$pKG}{sWx(|DMZd
z)a217^=@Vo_=6q)GIM0e>1g7~7_(eZ1CTtn%{M;|0k$USc*%q+GiwgQ?Vt72-@jjF
z+c!Bp{Ep=M&SLn2L{7ylS3&|!Romlplzxb`#E&@4!JUtbLFKEpL!TpI0;C7j-rTEY
z>#vsupGXI&8=Fy{G|N5p2)dl7-kdBQiyNO7wm;sPe*h&S;Afd~!9_^9kgfLEHl^hu
z&+XpY?b$k&_-vAJy0q^Fv33(Le>u{oq{%2>MhZ-q@LBeFEzOE3(8}DILj1ee#92J@
z>|(ezY{_yd)#~_s=ZSQZh&}@&BOmM+05c@UfUsWYI_<N9(Fo4WkbaPiHOFpDI1i+X
zq2dzKlfegcEkUO`U}ibUNqZ%9Ia}bf>7p(7D)jpScBoIo_#^Z7{DZMF1ofCvg(vLr
z7O-P&r6%?0%T4TH#@Wwj_bv~Cr9GnDhiY6=I9E}F@gsdN5#9re)_Ujua)qZo35B|M
zZ-yNWRX{H<bPF`$m*=v9hwG!Ykw=17erOL^m*~)(zb6FK&t0Au+6=vH{SbOh?v(IA
zqY~Iqx0x0dwL6e|acbIreseK4_V&kpQH~SE`eRt5<YAdhMV>)6Yp=kOV$jgw<(vX3
z3(^&*ceFDfxUq`6E^mwoIwb{C*BskPQP8$CE@2KXuN66?!H)N}oL`EZg<d1i*UTUW
z+a;!ryG&Qn@aS<3dYPM}PY+shz2!VHQSh*^VrQmcV%a=$;Ka5wf`)f6t2qWOYu@CA
zBjB2SFU6cOe0cqZaxgN<NAtB;hbm2}T6{g}jQZ~GF>K*%r7Ie0e4vYy{2CS2u)Qhm
zI#UB=aY+uX9Sr7~CvflqJ<ECe#Rjn`y5OK^S}DZMxV!?bte!+(drW_dtJ(<=$6ukT
ze0r9IEYClA+7Ia$8o!m&UORHW2r9Q$il*PX>wkbroL<FD1?C;64aeM;*P3b!wjWGy
z1S9-j_{=pV@)|54FO_hkd8<~|3k%W**q)n$5@%=h<VxW({_3;R#I6@GL9>=Xlsi5X
z&Y_m59{+40L)sS;=+B>w^~Q~^@ugJT^rUiV!b=S+_le&hf2N?53OR2tN?c&c&R(&F
zOZRUEpIY@NSMtIF(NGU`6S#3H^F?s}Lq#zbWMBwfZVh9-^sD0lJ2+eEs?-@ppGU#N
z$7hPZq4UB2K;x`Kk4*RWGVM#qT&k!uoq%aW$b3^^$T3AgfE0&s98TxEFMdwae|fwl
zMc8(Z)2vAZ$ZXE}XNeTCv9Y$jN%WEsy`lu}Lm8HQ;J4(T{*i@-Y{rpDfRCQk1spn6
z;q%o~X!kLPJ@K6Qvw0Za7;8k_994q}((xLoLz_LjqJh;W@qz}8i-4pJM7QcBr=9dh
zK`^2}OFm2PvilxewM}mvf1udrRRG;q10WP82xgM-c(-AG)VFKdmXV%L%V*f&Hxk#W
z!En4O|MNq0;Fr7fHW)fV@Lk5|>nmDL5>isC?5R@TMKILgYiHEGR0A+UbYnHPKr@YD
z|JmwPY>rl@-06DG50}mDGd!X%MsB4|iMpUS|MM3{*?=uvJSTJFd3Q}Zx2}yOIW;51
zBW7*&yY5mx{WC4I#afTci?Ay2=G{?US?I;p!Wd^%nf*{Eziz&|(EFnjNx^g5zyp(d
zanJnzDmYRA9Dt3+hmy$iwX(Ep97fbrgnChQ{pJ-8d-t;r<or!NHy?9NG`MX`N&c;O
zohP18NB(*nxvr%BF;g}$WOuREZXnHZ??=ppGp&GWO~^bk@YpIkrlO+49BRfBXw&vZ
z!`JPMR#4kiOv!w(#orU#pW?f*%3a^$c6PK=s^6T%_<Qu0DN-Ojz*2G?RJNNG=Cj=1
zv+rn=Ffu=16-p;a>`xK)UHbSIQSaUZKC_)6q>9Ra*JWa6&f<>eFYq5+A2Yqv=rdp}
zi2`EU{&}OV+Cahi&lb1SXIiNZ0RuCOKc7l=#dE0T)9Dz9xDT2((yFomp|*fdM@)6*
z`l-X&<hGDj?60?5+uN=vw}lPcD*wlm?gaR@32Q)cX)XZCd!?Uq`7M9C9jmRKnVIRk
zlREgys3eNZ_Qe=Bq4k+jY)xo33k$^FdvURKG*4CKa?Y0xS*}}OCpYvhzQBObM7vSd
z)<44{kfY9RTFkmLYGT3J4UE+O?UDVETPNybub>ZBuB=c4#mh-PTYEE%6{#%_Ccl3D
zM9tab{Nz2{?FW-AkH#@jrP$zYBIR~Vax+rI)?nf+5L(8-{gXW<4mH)W4Ag-4Sf|DT
zW)Nn!wSjr&8Vwd!OFEZwA8es~EIzka%SbJM@toM3$Qu$868J0a&Fp9Q`6_Qrlu<Dp
zgl>6X{Vw~X4y4acwQZx;0*@eF2%6Ih=omsO8jTUfy7kd{#+vD-l|hYqk%&k$Q&RxZ
zaG7!I7bTl`mw%>cX~{)v8|SiO%KJbzg8kyPpTKk)8t*YD8hhq(97wFb{*QFo|KbAf
z<BwQm8E<#Y0`3s~L|DMNu7nNwSi3af5HJqFrVNBdDd}LOrW&KZd~~q9s?YAwN+<5%
zGK6^C5lIW=;J}lwmQ{2dFWVcPHB*Gv{#+peHRpx@isF2L*O>Y-cm|KmdZGB1@`+Tg
z7j6`Yk)(qmdE0>Xv>2?Qdd3k%;5)r=nOlaGZh;23S<|YPb!Yc&i)MAlMJD+WzEYiP
zJB`^oXEylqSiUC3t-A>{q7LJWC=O(%Sl4chxVwN^V-R}CeK+QnZC@gQYBq`zd8NIH
z`R11h$V;`hTzCACb(d{VlJ|IbtbQ>lO*pVDh<!}j>zoIA<ygqJH|T8prKJ0{t5-vq
z#1}Z4558)%QP2_?<wMTnIo}5gUAuPG{Kk!*NT38aMFdUbcg)5D`jTQJ(Y<TDQobAG
z(4UTQNRtyrd)HPCCgwciHSWt+ZPz2^wq+R10(r69=#j099h40?oU3<7=GLIx7rMRF
zuB4kOMltR<^8ER9awDeNtjvVpq;3m^guZ;Yc=GMRAwu_bXR>s5G*3(1uiN5VGO%(O
zgE0P9j@*aDAyIs#br<2Y@{$&#ymqdK<t&GqfdBsLw|+isP*?O58&$j<{4sQ7%7=+s
zYbcDI%2=tL>WP%j&zD#Hm$tY0>5xgK#)o*cAQzX%GP_zK7(sy2FuIVMqEMe&C@akt
zIkSS!ahzGoq2yGIPwB3W$pE3sr0JJVM}$H+Wo-QqX1P0&Op~$q0UqLw`C0qz_$vE8
zIosaVI#&}xaKi~^AdM;W#td`<EVnUH00O9lmGLyw@2}fl%gV?goY3H;;bz~VfJ2P~
z^+)m})6+%)^D}jhwGJb{(lC~ECJ(x_dUw);_s4s-XKIaVhK1TbQ^-}@4V3BR?RUqr
zrJJSOmiO!*!gnzfo5_iC(4(VmlQF{255NZIs#woROF|k<35^ognEpF7ydmOFZ`@FG
zY)V0NE@gR?o8pWTe(S}8$gR=5NYerszga#!jAiM}VC)`b@h2lomEhH@*GkT;wr9Mn
z7Bb<1J%ucxE+Zc~QcwBfbus$yc4Jt=7(|`8Q0$wKk5|J8!JGwCYrL?v4S>MFYssD3
z;Nm!dWH`}3WUcW?US+@47YzmFI=uMy1ajWa9d#<g48YoqLZmvkZc{?bq?YIOs6seZ
zT3wAZiXxxitjI|7loQAeZnHamN87V%TrwWJALN4fb9>yuNCqLVio%!!j1de8S>x$B
zmXE%$T>Kd-Cr7vX@T)G_Z4XG<;nswjlfq#BTMD|a6c%>&)zOZ~D*yQ=-(tPOI2<FR
zv|M;~U$=G}1q~lp{R^U`gVQxS!P64E0n4`VUYRQKYou#70e){zRyco@s!>q-=TNIY
zn*{ej#9Zd4a+Hn%tLx5KC`qXn)m0b=?<nSGB*?v;C9`w_A)hR+CbX!;4>kLW*B0x5
z?mO{<N@ZSC$zZouI!PtWeg;gLkWWxsdnt;5N$24|LCM{}dpmV(Rr@MoVrIrY`bnuq
z)kkqd94Vy$cGcMq81Oo83TqAzEF8@{d^Y0KV;>@4ZP}(+nD^egYifFSD8-ehF+J`9
zr)I$3xj#TC&D6MZ@JHE<tvh{_e6;Z8)5ZjAv(AR+{LEp#0lc(OKTF0j;>{(3M67d0
z5l{B4iw#Og`>`V@FIF-JG~Q=_%#71quK#p$*}0@(C+4t6H2c9M$*R#3qTK@%M4JAn
zcb^3p>2Wu{2NItTz|z<T<ol!m&d++B0GZmJYs>+Y0&1P0cA4_%(zN<zKJ6Wz)w;HY
zK{>#w1F)eYpN*>RT<7y^Tap}*Q1k_0E!ghZHirnce0QLZ4QHROTI=mqnW!-u+Yl|{
z^b<x^hNVaB>@Od=nyU~fXaiJAV(ahct?d{i1RgusKlfUn(nbi><7eyfztKNK7jksV
zg6LItQgL<!<)jiL<j&NH-o^RpxjE5&wyD&nCr${Os^@4En76whJ6D4Bc<**>EA7uO
zz9zKGO>_8mOmG?HKrn}d7*964o*jLmeB48dQ0Fr*OV4V2>m&H|P_j!W%iMTFcR|%P
z=y;wh*iKv=<&MCWm`ejy*4Fa!`5Mf1;6}ILVGv<=NibEkw#;a72=GTLCYj$2r!!j{
zGv#X7GM!3@$+H`AFJhl*sGq*{X>GkmZu4}q<xW^g*Skv9yb<}RqzB-g727|Cz3IFl
z0e%*U$<rsA`?9!%QM_QOYSOu~z$1VSh)ZXYt%uMFxlFwqdvM>R9xA;)d%rHP$=gIo
zS6#!1SMX?r>$o{Z$X*qbppL$g?>b&X^mgte71!2LibXzGM75Cuk7sL~t#_{X^7$fk
zG#k-z&W(*^Wkfj0CBO2cUZKufKfUk|K5T0kIS_)X&7!w`)p-N{@qH^~7M(?eD2@wd
z-8(%{K_+Z93nCn>bQRU6zu(L`{fyZG|C|T85^xZ+5|jGO5EH&|-x(3d)j_SI;FV4d
zoh)MLNRIvSQk!D;$RljhyieFNClz-E-&~X6&4!~*#^6um#UKzBHQesw2FiR5ZVc{r
ziyPjmwLpXjI@r5&stg*N6PG!%dc5;Y>dPRj4b9DJ%x!r4!R`yGpcCbbAb;d}F9e|s
znp{9H%gxvZrb0)yBArBwdQMp><{B(lDwf&^{M(Mxqk@N0@l!<wQ}WC*5}rhtFd}7c
z41mC@X-6&W#T|d;#XtnXzdbA+4Ob5vvbs8;A_Z>nrtdlRO_puM(UfeCcR#*dxpuaB
z*kXG?YY*Gn{x#H^2BAuQe8rJ*L;QC+bJFNd;OyCXvRmwB4e)b~X#mtBLF4Rfe3fen
zxLN7$pkr3f92eszf@7(DsHQvU$<~u9yT1JTV(Ge_7?NSL0Y7}un%VCe<P)|VXH_Fh
zaW|EqxViETV3K3N>WxQz{-F90c&E8Y<+ys-&EgjLVO*|i3Xj>0*L&4ppxQT{jSu4E
zj=u{uK75&4cnUrsn8ow>_hxlQ0c`8%kg2IjHFX7x=XLnq#O6kQSkh|e_s0jAp^0W4
zA=|+c`K6GPVHPaoV3Go_`Lf1~3*<@6A4}!MD;l`w0|KD}k%(&c*%|K-HJ&lYZ3Pnv
zDP9%M`G4GqDK`MN8RE4etQM$U@l)vobl1Gppc*{1$_uHxPM(6alG^AOpF7>}Eww}<
zNIV8b?66AKw-N2kF-h#P!T~I!e7*3mQC92jYe{MW+ajJI)gu?9!wOcqYm#q;?RtL?
z#q;Q=l0nDfZ4rnNh_ka<$y`2O#J&8hkfM>+^~Qo0KU~C|z+(;9)Ms!xAD_Lh?$Ygw
zr1|OTCNO#6+1(VOH|64oYM$Fho4U)5wQ_5n+GTfkZp`J_YbHvA1cGBBXg=BENIHR$
zNOoBcpGrZo(X|J(3<iI4K3o_i38F>u8d}o>jh-f*9l0_BlId$cy6(f?H|{h5MG|Io
zO^rG6MA@wlVC!;&C2(H+pzOKAv4XX@-LsTxAS1;FK5HCHJoBSY(^0ARMhy+!mx!v|
zc)o=FY^@=(`jzQ;1kK<oxP*b}Y)=${(nKt+PWNe67rD*yz0!Zi4D(psv7!skO-a(N
z-S~9-0gvAA-4P`Yn_aF!h`O*|@iSOGzzok0E@FM_eKL$Er)6Yic9Plh!HTnq8@4~<
z##rpBHdg`mZe!1^fI3npfWRdpLICgt<Q1%}_4n`Yue%;Ny8aC5`lIO52#x5N`s~W1
zw{FvP7&dm`ghx#TGL}Z)2d{Ql{(Lz`NhFa|LsH6pi03zCDQ5U)f1>Krtw%SXIVxmr
zVK$D&gPQ$^hK3Z-9d@5(WLL<kBnLbjR=3dgSzcIWI(SHGU(%NrQCFNwBTk$_!-U};
zi-{A%*7HZDIU!|kWuyAm+%{#Vldn~~!n{vKi$Jil{Iif_n<W~agnFtgCPsBc;s7l4
ziV`*RgkXGS@$gfWm~&CQz$ab^m4NXt`E#G6IV1AGG0718LRiz`=Egy{HjAy_J|QLP
z>A{6o37p3qF_*-jMo!6O3LaHzteR9DP0)+FEgx%L^9_ga4VEv~9V2RoUS;wP#<QQ$
zq=|RVjX00!M(TaM9=)F0xWxRA-)i^B;^NPC+Mn^UV*_boeIJw?A!~h!^$Di?x`T`_
zx_&e(g?b#kD(+|;sW8hNiQ&!HKaSTH+x(+(MR=fvj@_Rx4*s<EzO8yLcjqN1vrsOp
zaF?{--?lbJMys1bPvRw&$DV;c0{I<a_)R-=$MRM9L2ou|Uq!QY86HT#6@Obv@3Lc_
z$J{2DpDrZX>%brPE$Sqi`O<T?&h;AjdeoD%1Ax?DzFX*E+z)D>t$5z3Y15mo-HBYo
z@7wnE4rGl8S=rDPJeo{o7;w*B^HHY_3}j;^;2B(g`TF_UM67ZP+4iJ!t9=2Srp{rc
zMCU5VcKXfO#_DFJ))j@Vfaj#+lW!|JS&*D~0W$`b+e8N4d{u7268T^rFfybRl{Q{I
zM{V1m{z~k*H707nM5J7Y!{Ca|%`kZDQ4&btT9x>r)pXYeYt@{IvskHqVsB!u5~z-J
z-gppqP~*3NJss_(;mwc?Rs<_M73xfg7(8L3bu(_(C`^yzprC*j3y##q<!&plJFZN<
zSBRY8u>UG-PB?R$Z&oD_gcR6N(DCm~=fDn?zz;}QxTZ};n5UUQLRY!0#e3qVRl@y$
z?8vTMu9uW3D-Ng&pEorq9WxQ{T3X)gaf#-drm$SH+(S7=$u+6N9yBKtzuo##0Y;Xp
zcOkXo%No>E)X6_Y`H8uY0Ff)f_}6_uyYU*qtu2@1&pBI>&&Lokp)G~F`Le+mrcDVE
zwEQk+g<gUkE?;w83;F6dA&k?~Qza?^T>YGtHf!SL3x=G1mW-EVabxG$J?q&T*G)Y0
zbGNM_p)x_|1V5h0q~@dk6d}98xSp20fkS>#`(WwKBV4$epJB4=nKh3MA%fjkGev58
zV89z_UX6x5x^z^Ml*!j1z5Vijtwz8!_uW-W&{o%mE#J$*SJOA>`?uABCISzTskm!%
z6t*Hp>1@AxcfU=^OcaM}l)!rvrBNkD)kUB}9=fv-paEynBtwkU{w8<DrTUKJ?<Y^J
zBVzks7)_azS`uqOJ~x}!Q8zbVv5B&EwH;suZRj3y8%s=z-{<*OxLR$mUv5C^o!})A
zjaA*65~di1A&WgQe(RrNYA+b>%k0^H;+T7pP1W*sw|kX4&R%Q+{6*bJsMcX&3qSvq
zMJ4DZbvPU+$FcJU=Ne!3decN6-RwVSy7qFqHqaM<C9^f6-@}yKnjB)+iW|)ilppeg
zTN>n$<>l_F<BrSaYWRTKmTy8c)0s0qFUTtoS7XyUc=U_Av+4xFg!M^XfqtNs_r3N_
z8pUrLuG~9@|HTCyh&Yaomz$$!n0g?D&z;kMrZggO8cg*v^=_T#7RhrD8k#V554#<{
zM%0{(e6RT%SHmFY@)I7W9Z>px<VMBzhWN~67-ARggO8Onq%RsL5KSG3dN-?c^W=io
zJ!Cx#Mrxf=OtK**&}N5NR>!e?$MN6VR=lt>>*=7zrFb{R0hy;f<!NG~KN=rdxi+3&
zM@8BXGh_aV%L-wT1$aUsNyu7v62J5L+G8tpI_GbP%3tLl%}*DO;QlL}AFhzp^LkSh
z7*ffP@mOJbKJL6GUwlZspgJi_lUv6y9I`fb>((9h3g(&LZ>J|ST_smlFIV@h;R>3>
zyiyQD;S%fH+`kcZ_$kZv;p}iKCa3A5JULm+(;Avhhw+kwWSI3RLg6f1A>0IJt;_l4
zmz_{sMRpqib;gVI)x_&%e0Sz}4f-L9-P5tCbM=~pqmh;5ZAt=lP4v}ix%U9cg+TbK
zCU9jVWqmJ#sOad%2E8kI^^0;t9v4kBDt~*<urmLk4-wPXM>;z`nB9sLOcjfz3q0OR
zT+J=_LN5e^1kDra{2^HI3f!34VXXh!l@~BAYeL@?JlAJLDT&bJK3kVFk!CRZgSBf4
zfUgf)-qvSggfh8ecZlE9gm?r~l$-LGT?*6L_IC2rd6VRr+|yn!B)*=}izIxlahg}X
z;4`f7n4K(LQ*SGw%`aVmD}5}KyUuMAyxl9xAHp%iH!$u9d*<5ahy57^S~xu92hZ&{
z)Zn+Jxph)+vc*Yrz@C&+>o{OI%MU-pbKr5BtpSu9eOW*t*US*AwJoN_lsyT1!4t~7
zSsf%y<h;lY#O*vmE{|xrq8m5UPy?c^f<`|)9LuBjtdhXO`729oeS01qK{ClGS{nM4
z-D!6Lf7w&d{ga*^Ok6YO{UMm9+IjU)yep8nftImW-fXWiztEgrlxLSCW&=}ab;_f=
zA?nN6dyf_ScDl+I=rr@yqADyEC@;yF3B$i%Jm*@ErJQaa<?uP&NCdj!J<jy6O{#t1
za(`iRt~1iUZhaXMUT5W|h|w9CSuJGka8tZHPkX1Y-W~n^tgbxioix`yL&Yl#$yrd5
z)HcK+n*xDjnt0xZ(=CwlIUyoWyBy40{OBE{AU=ak_MvqJ-<ktM8Z`xtYb2&z_E)*B
zyGSnc-O1Y%R%WM^81OCJ-IgE@yFgT_iFvJ)s9K6ArX^szw+|+m*O4$SaAGRsvG}3?
z8T?~#!0~*QZ6s~EdXmNurpHy&?dzbMeWD9`S@pq(L{pYSdNW6}W*;M<xsv-W-hLo`
zt=1ycD`1oV;}(npn@4tbc$Kg{>+ZRAwcCha1=@OkW7P9vW1^TN5|*o;*gM}QBlUph
zY++$=P>Rf*KSku@=;>)+4K9%fG;*P8MJMI>l2@<jIk9U5(g@@I4(4g3NXOR>>lAUQ
z>EvnZ|1sqeN67%pgc};cZ&EW8=xt-8ciy3zwUI^5)EoO#JT_moYWhA1R1dHpvVljY
z#87dUsh`k){`qIP$krK0o>Ur7IKX&+y*uQHdCuut?*(Tk=$0q#+)Lq130o<QFR)=U
z(%dv~jb^G9z}6xddB-A*J4)7p(-FYX7omP5Lgu9;*=(9uKg2Rw;CN8ZC(AebjsnW}
zqoX3CqH8Nt&wt35RlX-F;zY!tq{Wj;d9~71AGf?-pq~b-e9k?auaPG0bz+P^I@mY%
zkZDC<Sc%MJ&WwW7XaN@L<9cwV-`+A%D5{Frs>A3&<)-n@ZDD8BbuP8%0*ttB^^9i&
zA3sOh*wHhXG+MpwpFmkqPF4=Ka}7Wif&8L-mALpyfmXm!B53MXU|{%((f}^LK&q}@
za)6C3quO5By%6_&vfk?e!~bN)x5mqZ!CL-`bqLF6pz(9~@iWEYYXNh_-zEm!l6j5a
zw;)hm-(`my{aTG#a|xICh8_$M_|yk%CYA0{J0Bc%mW&5c5e*-Q0_jX;Ped1Qu?Eo3
zX7B)wCVQW)sStjmubqUnG^ZK{=zD3>zl<H2tM@Gj-~Lt$5;7D9Vm7Hh2{<AVT}(ew
zYe1RpsVsSb!oz}3qh*<ro(ArqJSEPfP~Xb*(?8X=l7DlCK1yiRBG7quI{BL3hsK1x
z3ftntTLT%ws9I;x3anjk-;#|GC+~m3?uk*)XP)WJ5>)s?pn%i%iuEoK_Kmr6;^Uaq
zCze-hti$t+skUaBFB?Ytwc2b3Q*9SoP9Z*h4F{_#x`XE-if9TsI;*4CS#l&ozM(O`
zC;nL%o+4a_nQ%AUGTi2qtMsq4wYxb=mroVWNW>$vCaaE?#)Hv(4U+=R($uV!&Kr3Y
zzJE_{ZzDHiSpD}kGo&*l{B_K~%;jI6?k-KeSb44RS~Zc|tl6Lx==Zgo>jOllL75@9
z_=`vwU)6T=m^!yKv5t#q!K>fowbl#DtBo7f2_$bWn{Rry%l1>OJkQ-{YS&U2khKsr
z>?KtIEHql+o^?{)vElRFaEE7&s?Z#X7}W&!2Bhe3>nT@kOaH3ew6+RpZUg<U3@Ps_
zQ~rSC4FFj88dYPucR!7*kcfw9?OflWpYDOxv;&+`SzO->A0j+qnw&YC)vr75j1H#@
zQ>)iGj@k9DatEv>-x+SkM$i=Z->4`*owlc3runIc5)iiUXOLJlDg4ypKmR4=%Qbba
zJbKE?fY%znYM7)Bkt0W8xK5(#0xz6bzhoEocrSW{rqOt7rm;BU)c(@Ttl6tBfk);q
zf7a~qy3Rx?2!;LI!4meRS2HOy8Q@LYk<Wl8t#Ux!s<Ol71gKV>TCu%%?1@wz>>kk3
zZ&qn=9BVpk^u&rD{0V{yWUNVv`wq%XH!x(4|F&UbiAxl77`HgBqQMH9K6?HWx^-wc
z>6}@Rtyh(MJ*7amz@0XLKW?pCi5a^8K5vRmBcH~55+njDLP;rnXAsR5G@e0x`16#`
z9tMU7;^Ytc;RZlYgGpw}OHbT+Qp7qxN-@WK{)MP<t?>kQC`%*lNDWYu5gZS3C?)xm
zW}i(Vpw_!WB1cdLZ^pIRcE_}i`lvNSFV6kBeE__)qL)EvJKmU<4hW~u%fg&7Bk@)<
zbi(9E%#ZHfOA*hStyoex3?3=;gaLe?+g!s7fd2D#LK!39hk+koLq2)#jB%0NwB>@E
z9J`HPeIqyoSxk=R4I9v`#AP!|I^{-{&jUH=p!2&8`Fy$vhvx0P#@}9R8$Vwu#7U~6
z8^id}O?krkLyv~tf8Let&ghKER^ZbbdSrFXz`)<UHS113m@H|c$)VCO)NRY3E20b7
z-dweFeH5EN?f%wylWzLeps~iWt(0nU_qk+IXCKFP_Ug`*)^VPh8hQxT5pK-+bU(4$
zexS0tzW5YZK*^9i_)7Qj3AXLMbspv2#4BF`Nr{ZG@4N~ce9SZt#|*&+X}(EM6ocf0
ziN5@MM@8@Bhiu!BJ15^=${CqP1#p{*$?Gegl>qrC^!g#z(M`9xDd_DG6P%78{BC81
zVaU8CS;Sv82KqBHQVqX;Z74|()Hd|E%n)Hpl?HVF+fT=5RK0fQ909@IWAX02m{QG*
znavz$#nd;FqRX&1s&by4QRUJ>{8!X&2Av(^3*0fomI{Ek?hT+a*xQvajeHNZxK(Sr
z5l5-`T7awKwy$-XAUKU!QU6rs0Hjwo`He|7N(p>M`^87*8-dwC;NvwYiMcN|B^?Ba
z0^r<94cxWtESU1F>DQw#4rKwEn%S9re46{WrT5QN4HE0vE~@t+Gs-pN?oQ~|8TgT0
z?u*3kl1s*}z&J3ir2Xnkl$`0u+2Rh~>W3<tGsox%-$?VUa4P1WMB(rY&(r(c&0ae~
zK_?!#=YE%0yEA@W{0Tn_oh$)+0&38EY)TH7<S;?=l;@VeV5k;}K$c3Ko`DpXzUJ9m
zr)6_%oMIoJ*0O_APvpDU&6Enq+B4iXK14^T62hhLr*gKgov%gIyovsOJPkJch~#-$
z^g2~<7N;}ro526-_727L#^O&4TuHR~kj{NcRe1;gQKETsfQCRQu|7$_%x4obFe3jw
zTHfBO!2g^-xW4_)>CPQ!mjN=+Y;WilcSVhSRTron9E`?a)Q2H!%|1s-w3};w+)iBJ
zc!1;&R$8IQ=Cr2@6(7q`+%HaPSB*35u@!#Ozbq)<>h$f>o7*YfJoXny4c)?}X^bX<
zy-}6bQQ%YRX=VAzgO&3tSaNNrbmsjujX-zEdeFO>;r>&zv*!EKZ&wl|9ie9G=R^W@
z&uZ`QTN)mNga=!5DZ)2oWMo}4kDyssr_vmmUn_DP;b)Nmn|-hCixU(k(jX0>diYs=
z=Xd!ZS*Q1TC(OU-k(%)*B9&q6t#y2Z4@z!F2oIUpefu^Lvv}`NZnjv>LrJZ5S^aXj
zCYz&5(5CpoYz*>!e_!Y}JYb+zA^Z+4pBD<h^W7PBM%d0+O#haF*{dha-%mT8r@4qO
zy%_dZ2|bi``zmace!_F#r93XBBkLl%Q+QAbulaZ;Fzd!Q8tKY7c7y%v;s+#Wxk>}s
z3-HNf?A41OaV6o`F1bNv-CwtBcXywI#8E&72zCfKd3<rQ@*|9#I*~`e$YKkiS5`50
z9aV|`2iV#tTCJCSIAe*RlkPE2Et{_uZ@w)P@ogvO9;BJ?e}0lldWxRwj<m(<{VUjF
zkN6X-x2_9F!v9Bl<o_;H_F?6zgyP5n-IpbF1$Myt!Y4X9`Zno6kBscRJbu&q+&m!~
z84k$4UjAieWxd6y(m@b3Qu_>Oa-WJdvS<}SgCF<+nhtS>@9t;>pgDdi(kRq>xOcff
z6!bR<XOs-+yMd;<18{q)DZQ{w_fM8@$ydW$En=jAC|n5W@kF+PujhWxwT-!8CFvU)
zCIeb=f{%oxq$BVIT5+)t;qGjJ?3*D@Q+@HDePbshDH+BmPo6L`uDXX@JR;jQ7v$mL
zk&%)4s}3Hk&wgF<C!2zjGLeB=e8u<U6|#%Xp849GlsT7!gx{>U|J7uF$nE%g`+rW#
zb`c-ihC=xQYTD4ySMT!yL4X|~KCOWw>+fl!m~Xr-ywu=q&Az7#ZN4D7wx9L$<)wNq
zP8JUzr_z&sU|-tJJeVld9cmr1+)NrU9&HRd?frU>Z4*_VCSYc~*$!yJfL`UN&&X2!
zO<_RrR)X%!b{0%;IS>j~?Gkrqb9&e>2G`)m61YV~&okkvN3#PnZ%yws<&yeRIA8?R
zfc%g>#=>|ce&Ldn>v&}cTmCmn(b_L}uQfrDfo#!y?V5n(%~SI@Rgd>nR8&~O^ofgs
z=((Uti;YKdOELe&1!QY~k8oMn*B96r3PV$w1ZMXF9&{6$&Z*0z5&Elf6rDD{dktZs
zylj@T`uZ;`TnimY!yr(u%jvoPP840JUCWvim8noqf3f$OoUHvAp}>=m{*XD`{b8s>
zZF?p-Q825kAZs#JHZa<on1UV}FEx?(bwgFz@~U6je(@#(34lTLT*h4P7?4{c14vS>
z-V;S;SeWD3S_dGGQ-ulmF1HstO%ydZu4PHQUk2(wlNyH<UYJSg(8e4*5R`R!j2==Z
zkMcL8fu_9ZYf6_5JQj5tmv9Fgf$9g+>JtQXFP7TEiFNA964^Q(JZ~duftDK7!=oZ8
z_Zhxvp(<$SqE_}$;8VY2I>v{K7kU{muD2K{2yUjH3Bc_1sahY|Y&9ZIx2%1$;G;+`
z@AH+UzR%(KZh61Wr}%?=u}KW&Qa<?nYN$xMkA!picXL4*|82{;SHG36u<V4@-)MPZ
zmdP>gB4eM~c>E=rLaQTdy5-rxvC3}OgJauu#Ki$Fy!@R0x7Nkv*?Ge@NQz%F5i#2|
z<_qplm?+rMKl3-ofFCnx$p6wZ3i(?;Ft<WHFW71EV6NGAeE0jppl<yW-qW9DMVhIt
z&VHj2u}5g5zV@1+WsacQtU2+D4oU01*q!~@=1chItckv~>Wob}bHi-Z`!5eVPhRyg
z@xi>^HL*^3wehC>rtZw6s_n^>o2!&$C*lF<KbB3UBJCQC)J*3iC61nr5kDA2e|Z(^
zw0-%WEbWd^r@nQ|VR-idP}2bF^g^q=J2{B6kiMkS)YI(mKHD=$zdgv}pNpH)ZR;b}
z_f1jr(jfqSCo0If3$(qhyP`=O#ezW5D{j|6bl)I?mRriEd$A8xM!<`|GY7SO$tqA!
zaRLMni9AV{ZmV29v_d4nAk6E|cqC3HhO@)sr8yo;xtwg9)c<YMpcaT?mUrCGbsR_&
zfAZX75fL1SJk9qUy$BP+o`VgJ`|YGV1}%OYKaCuch5A2Xy626ZE*@0VJTAml=J`&D
zXD<!dJqdnnNmSbJ1iD~b$>`i94orxV-EpE)*koqCUiSeCT_%aH`?Z<6LxYF=3A<!y
zrHd-Qp~uTmOfu8%1ztD}Z%}OWG?ncb;1&)*ZDJ?v@7{z>y5jIpc-Q8qk*V=v!SN|d
zVFN$BWT@_@v}`J3^fc4X^bS2Vo3Z;V(UF?<d})Ecmm4>#@*E{dyCgby)m2sG1UB3B
z!uDbw#ylUqxABK^Y%uP};6ktwpFOdZ4uGs@6Q8&Hm>z@2MiwqM-xjRua;LQ?bcJR+
zH-R=leb$Q`o@qlQma#Ae)+4jPpv9T^8|E-)ZLuG<AC%l=o){Kb;D_!I%5ZxcwLwWW
zFS0{}68OIt#d4E<kYW~zU_PE4oecz_UwI20WY-h-c7aHKT|JEm)E61sTU!7_xwEts
zE91YPuYsIuv_=8ifyZJl6_7k%8=KXpL+2{{A%O$vscoR=KQGuTSo=iA^j!(-%m6ty
z(&B$$+Gr}zV+3jMUJ}~72s<l=!$rsB_w13LSTQXvt%Ii2ow>%%lW*|=<~MDG<mKeF
z5f7aSP}>G)nA<`z$^m2l22hPkxva;?1qb$-h}X{ncg7m7?Cg|r+_*$pLT`S0=%qqu
z-=uB?#k?XM(IZMtD*UJC_93?Qs{S`!<U%%6Y!ddQ%UtlF(g-Dk6vWBqeq!fN%J3E&
zd7!RYkeO(f9FiRwpiABJRUyLW=-b2AUGIsOfqr4N;X-l#)|BtE@`ny4BN|{*DyPCl
z>#UD?z<7<ifJ)-pfgK~N<dfW34cd)x)}J%mm7mJJmb6!bR>LhkGA@6os&p1feO0bE
z{?*6V#|%5<Wpa+%&yM$IhkCKFlI6t%KtE|Rqq<{c<Ji}v=V!NbDS^d8=Z>edbQ#pj
zwK#k=nq=*^n<swTXdVcNmFyT8q5H4n*tmfiiY~>VA|UO#E=YSksy$KQ0SFpdihvDA
z1-(*Z|HF+5p^aEk=Se_iTWVf^(K+z=;v!TlQ|5MvErVzSpwnFX`}wejMecO<f#>2^
zbh8ES{jky|hk7@<P`AJb0)cqf&Rw@3OnAZG?!}>&Cib1rgVaQcayNx7M0aUrw%ie-
zj5S3-YJq77;8{fF%CgC$H&N~_!Dm2em5A_FhZ9>dDS~EA33{Py8jvm<Djz{}_;+E_
zbaB1WsFV@fz^7i%c;;dBTS)%FDce)~&V=$dR!}Bk)&X%y9r^W6<a03eA$wNu?CTM&
zFxsIE7IwbZO?T$1+Cv!IA9=P$iyq8&U$>i7mlYruuSOr`LF{9+X>K#>Y=4HdzsaMZ
zK5vGmqltB|FZ$_rPW$9e8$2eh>oZm8x(B*i)ui=L{LVv83GJo!%yc4$n<4@!o}<yl
zw$Q1G2ECmjwKXoAK``CU8S>6|#@fAKBjd$(Q_$_64*9Eu4%+V2XW2EDl05y6*3D75
z-J3VU-5-l86cn9`ko`dpoE>|x@BX8t+--sb0lnpy7MYI%fI=Urwd{N1Y8AgbHG1}$
zmE^UtiV$3Z@i!|>z5kQ&46}a2ABQZjbnjLMy8;pQu<4M&W*{yvpth(HlD6_S!!c8j
zTleC$i+S>MOUR*AQ-6N)@&+b#e%c7*>Ei>4%bbD9omzHQ)ZkyqQ8OajPsLWl93Bw!
zO<*vil{neMVs|Zr@yWuMx2p1=^eUW_#-n|{a2*hs<pf#Zvj<croodj;SeSnpcoQf+
zoAQ8xUx*=Ia)$PgoCx3REVR#bwq@*o?4c`!y!oF47f}jZwCCFUE7%(SJ2pLuFKi)7
zVdw*tlDllyNL@k@Pa4$ub(=mX$;UKE0una#Q|d;SsNkL=!eJbetK}$?95+Ij=UG>{
z?lc{K+t<}FKeOpzdGdrfx&May@}4!>hx_=)66)JQEfflsR&SwZ`_2vyznP>5vyg!M
z6J`7%mm+p9hK5tw3THaG%J*n!L<5gxNX4HiXiO1S9ckk3I{E6{?pl`@fmX%U=Q|N6
zKMdaBP|L}$V26*zKEZ<ncYoTNdD;z)$a5K0t(KWJ4`s<81I_2W=c9SqL*@-0uT-8>
zGKe^!%D($kcK-SE5-y{X7lcp;hwlXG@<V&qL+_#s%EdBBo~p%h#$NoHNUVAB@9LJX
zUq!$dY%diBWHQE74GT^B^Be{V#Cn$l{gMjU;#+Y${3FV5K^D>)of0xt1rsRNd1^}e
z-fXCa$(oP@<N|S7@R?s$2g`iY_t0NE$KnWIZ`u>joybn@e`a(KJAl1xINSH0Zb><m
ztj>MEVK%04QF2LoRqWq|bk|WQ8VeP8Z-8do1fB_{)(zH(HD9N2(0&26+id^+Df$**
zn19J-M2K5Gz|i5O$>quEsi@oeX<AGSlWahiJQQ5Eet-?Eb(+_)8%&iP1CXn2!z!Ts
zLx)HkmaP-Lf4$22^6FJ9z+%ZkR;SXZJptY`ZJqe5OK&-`EdcL!%Jr|<xeP#I-Ay+s
z8CW+*+f=cG=vCl?+x!;|260}aDzA+iN5UzGNzjFV4s*!)djMd&%{PhKbPu1O$`Z1`
zDm?O{+yeE>=7aJfgZR9ts4e(@!*qJiDE%;^3YT)56d@VZ*0D()c5WU{xhn_jUnqlw
z@(KMj_RDmKNo{B@b_DkIw@P!F?Pm4J__pQ3oM9zPYu1?Z)`I*}k55iLI5zzrBf|@)
z9IcnieqKe-X9P^8SUO#ikS&ZbcV`@%ua9}qT&|Zu%1)|eVoqxX;bdMbG8w^v&Zsy@
zy?Y<W#zq2V6bt#_`%sptxc4Z~=nd9+N!vLgTjj(Od_=V%7@jE4k70Bs^sxl%@{uGf
zX?jxxF5ckK$_M4dc@{FVVrmCOIl5tQKs=+=-F_f-Bwu3_5cdKznOzK`avE83X24(}
zl!25JG+w2@i9Xue9L-CE!-FrckYr^j)=_;B+dlP7k@x4Hz5xcxXV9_^$j)w3GbJrH
z@hR}!HZ}Y{a#?AbZ(Q$I3zTSpW%o7R>~4~gAsCJ3ssJOM2DfEV<>s5imGF^A-s_7j
zviZtAfQDkCaz#8&&(stG3^jF6Oz5jg;dG_kHuUp`BB~R+w!eS<8t1%P@HqqP%jInE
z$<J(1{_b$^ER!6`zZ&PG@k15YufTbL;F%3+?YYn9i}?1HFGh4be?h;5I<PZ>@-}th
zBP%(v^R@m?yqw^u$IMcAD9eqi0;7q%*GFDGhqY7FC4~xWEzlOfF{_=*t}EF))1!Qw
zI*2!JeZPk}KUY6#Ia0r@W!0y!3BE@-vK}fSDur#*IN`njHV$<@?Ae0YDA!gwzfIxF
zkTp5eBlT{+iAJRT&G{wApWy0<jYy(Y`~3+n&;9h<>OOO*SejkQMy$6_v(UeVQ+Euz
z{5^(${)rKDHJ&9Gd;`=9VPRoWUhP?E;EyO_ANLh0z?>BsPW8lXw$2+ErC4(<UkK(1
z2F7vYOn(jibMGEYM}^#8(Q604TrW_!;WyXu1`_*}b@$QFMhy=2>n*p3l6iK*_=LLe
zKTQ2YVCM{6xYU?BD^c#{=2kuXr)qmtD_-F3oICu^_lj!aTy=ty3mMsE#@)`#QSJBi
z9EAqkD+%1XdPRmfAc13t%ujFyBlFF^6BlDaS=Z?vHOV??j_GMe0mbeG=p1#EYGCe1
zmD@Z~+II)ww&0MpJ9(;!lNVQV>;G&HZzHn&C1wt^4zK=uvp9M5<*l>m1q}0_VW=TH
zkzQSap!-OXL|4Z!AXuXHd|kf6@<RJz7|Wz5W!(>nM>*&znbLc3!viHBOouUyzB*<-
zaYL6+o^;=x|2<Q|SIOsua;0*0^VAVythc5@|Ce>>EWH(tmU(Cft#FuK#c7#=fO+Q%
z+eOEv6*Jl5lm9+y7H|j*U;jS`sQ(9Z)&IHtzp_=sycs)WWVhS@eP6);$ME`pHu-;L
zlmD}^|L?Cv_>Wcn$EyBkUY+qDJNb{D{KroIf8H<iA1C=g+et2|fg<73#giNfz>S;#
d;<;;NhS=FAGphcVz!fr;x0-LtUR!+pzW~aJ)R6!H

literal 0
HcmV?d00001

diff --git a/packages/core/src/image-delivery.ts b/packages/core/src/image-delivery.ts
index d1193b9c3f..81f3b897be 100644
--- a/packages/core/src/image-delivery.ts
+++ b/packages/core/src/image-delivery.ts
@@ -68,7 +68,7 @@ export interface ImageDeliveryRequest {
   readonly messageId: string;
   readonly source: string;
   readonly retry?: boolean;
-  /** Explicit user action; the Host must also allow networking for this session. */
+  /** Client permits remote media loading; the Host also checks application outbound policy. */
   readonly loadRemote?: boolean;
 }
 export type ImageDeliveryResult =
diff --git a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
index 5e6d78afec..98c759453e 100644
--- a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
+++ b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
@@ -38,6 +38,7 @@ import {
 } from '../server/chat-image-delivery.js';
 import { chatImageSources } from '../server/chat-image-markdown.js';
 import { checkedChatImage, downloadChatImage } from '../server/chat-image-source.js';
+import { createProxiedFetchTransport } from '@maka/runtime/network/scoped-fetch-transport';
 import { IMAGE_DELIVERY_OPERATION_SPECS } from '../protocol/image-delivery.js';
 import { SessionAdmissionGate } from '../server/session-admission-gate.js';
 import { createHostExecutionArtifactServices } from '../server/execution-artifacts.js';
@@ -49,7 +50,12 @@ const PNG = Buffer.from(
 // Mock only Node's DNS/transport boundary. The production downloader still
 // checks public addresses, pins DNS, follows redirects and validates HTTP bytes.
 // Top-level tests in this file run serially; restore the ESM bindings at teardown.
-function publicImageOrigin(t: TestContext, localSource: string, protocol = 'http:'): string {
+function publicImageOrigin(
+  t: TestContext,
+  localSource: string,
+  protocol = 'http:',
+  address = '93.184.216.34',
+): string {
   const local = new URL(localSource);
   const source = new URL(localSource);
   source.hostname = 'image.example';
@@ -57,7 +63,7 @@ function publicImageOrigin(t: TestContext, localSource: string, protocol = 'http
   const request = http.request;
   t.mock.method(dns, 'lookup', async (host: string) => {
     assert.equal(host, source.hostname);
-    return [{ address: '93.184.216.34', family: 4 }];
+    return [{ address, family: address.includes(':') ? 6 : 4 }];
   });
   const transport = (
     url: URL,
@@ -68,7 +74,7 @@ function publicImageOrigin(t: TestContext, localSource: string, protocol = 'http
     assert.ok(options.lookup);
     options.lookup(url.hostname, { all: true }, (error, addresses) => {
       assert.equal(error, null);
-      assert.deepEqual(addresses, [{ address: '93.184.216.34', family: 4 }]);
+      assert.deepEqual(addresses, [{ address, family: address.includes(':') ? 6 : 4 }]);
     });
     return request(
       new URL(url.pathname + url.search, local),
@@ -899,6 +905,196 @@ test('DNS answers containing any private address are denied before a request', a
   }
 });
 
+for (const address of ['198.18.0.2', '198.19.255.254', '2001:2::6', '2001:2:0:1::2']) {
+  test(`named images load through VPN fake DNS ${address} with pinned lookup`, async (t) => {
+    const server = createServer((_req, res) => res.end(PNG));
+    await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+    try {
+      const local = `http://127.0.0.1:${(server.address() as import('node:net').AddressInfo).port}/image.png`;
+      const source = publicImageOrigin(t, local, 'https:', address);
+      assert.deepEqual(
+        await downloadChatImage(source, AbortSignal.timeout(2000)),
+        checkedChatImage(PNG),
+      );
+    } finally {
+      await new Promise<void>((resolve) => server.close(() => resolve()));
+    }
+  });
+}
+
+test('fake DNS never authorizes literal private addresses, local names or mixed private answers', async (t) => {
+  let answers = [{ address: '198.18.0.2', family: 4 }];
+  t.mock.method(dns, 'lookup', async () => answers);
+  const request = t.mock.method(http, 'request', () =>
+    assert.fail('blocked source reached transport'),
+  );
+  syncBuiltinESMExports();
+  try {
+    for (const source of [
+      'http://198.18.0.2/a.png',
+      'http://198.19.0.2/a.png',
+      'http://[2001:2::6]/a.png',
+      'http://localhost/a.png',
+      'http://localhost./a.png',
+      'http://app.localhost/a.png',
+      'http://router.lan/a.png',
+      'http://server.local/a.png',
+      'http://metadata.google.internal/a.png',
+      'http://metadata.goog/a.png',
+    ]) {
+      await assert.rejects(downloadChatImage(source, AbortSignal.timeout(1000)), /not_allowed/);
+    }
+    for (const address of ['127.0.0.1', '192.168.1.2', '169.254.169.254', '::1']) {
+      answers = [
+        { address: '198.18.0.2', family: 4 },
+        { address, family: address.includes(':') ? 6 : 4 },
+      ];
+      await assert.rejects(
+        downloadChatImage('http://image.example/a.png', AbortSignal.timeout(1000)),
+        /not_allowed/,
+      );
+    }
+    assert.equal(request.mock.callCount(), 0);
+  } finally {
+    t.mock.restoreAll();
+    syncBuiltinESMExports();
+  }
+});
+
+test('a configured HTTP proxy receives the original hostname despite fake DNS and checks redirects and limits', async (t) => {
+  const tunnels: string[] = [];
+  const imageRequests: string[] = [];
+  const server = createServer((request, response) => {
+    imageRequests.push(
+      `${request.method} ${request.url} HTTP/1.1\r\n${request.rawHeaders.map((value, index) => (index % 2 ? `${value}\r\n` : `${value}: `)).join('')}`,
+    );
+    const path = new URL(request.url!, 'http://image.example').pathname;
+    if (path === '/redirect')
+      response.writeHead(302, { location: 'http://127.0.0.1/private' }).end();
+    else if (path === '/length') response.writeHead(200, { 'content-length': 2097153 }).end();
+    else if (path === '/stream') {
+      response.writeHead(200);
+      response.write(Buffer.alloc(2097153));
+      response.end();
+    } else if (path === '/loop') response.writeHead(302, { location: '/loop' }).end();
+    else if (path === '/stalled') {
+      /* Abort must close this unfinished response. */
+    } else response.writeHead(200, { 'content-type': 'image/png', connection: 'close' }).end(PNG);
+  });
+  server.on('connect', (request, socket) => {
+    tunnels.push(request.url!);
+    socket.write('HTTP/1.1 200 Connection Established\r\n\r\n');
+    let data = '';
+    socket.on('data', (chunk) => {
+      data += chunk.toString();
+      if (!data.includes('\r\n\r\n')) return;
+      imageRequests.push(data);
+      const path = data.split(' ')[1];
+      if (path === '/redirect')
+        socket.end(
+          'HTTP/1.1 302 Found\r\nLocation: http://127.0.0.1/private\r\nContent-Length: 0\r\n\r\n',
+        );
+      else if (path === '/length') socket.end('HTTP/1.1 200 OK\r\nContent-Length: 2097153\r\n\r\n');
+      else if (path === '/stream')
+        socket.end(
+          Buffer.concat([
+            Buffer.from('HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n200001\r\n'),
+            Buffer.alloc(2097153),
+            Buffer.from('\r\n0\r\n\r\n'),
+          ]),
+        );
+      else if (path === '/loop')
+        socket.end('HTTP/1.1 302 Found\r\nLocation: /loop\r\nContent-Length: 0\r\n\r\n');
+      else if (path === '/stalled') {
+        /* The caller cancels this tunnel. */
+      } else
+        socket.end(
+          Buffer.concat([
+            Buffer.from(
+              `HTTP/1.1 200 OK\r\nContent-Type: image/png\r\nContent-Length: ${PNG.length}\r\nConnection: close\r\n\r\n`,
+            ),
+            PNG,
+          ]),
+        );
+      data = '';
+    });
+  });
+  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+  t.mock.method(dns, 'lookup', async (host: string) => {
+    assert.equal(host, 'image.example');
+    return [{ address: '198.18.0.2', family: 4 }];
+  });
+  syncBuiltinESMExports();
+  const transport = createProxiedFetchTransport({
+    enabled: true,
+    type: 'http',
+    host: '127.0.0.1',
+    port: (server.address() as import('node:net').AddressInfo).port,
+    bypassList: [],
+  });
+  try {
+    const options = { fetch: transport.fetch };
+    assert.deepEqual(
+      await downloadChatImage('http://image.example/image.png', AbortSignal.timeout(2000), options),
+      checkedChatImage(PNG),
+    );
+    await assert.rejects(
+      downloadChatImage('http://image.example/redirect', AbortSignal.timeout(2000), options),
+      /not_allowed/,
+    );
+    await assert.rejects(
+      downloadChatImage('http://image.example/length', AbortSignal.timeout(2000), options),
+      /too_large/,
+    );
+    await assert.rejects(
+      downloadChatImage('http://image.example/stream', AbortSignal.timeout(2000), options),
+      /too_large/,
+    );
+    await assert.rejects(
+      downloadChatImage('http://image.example/loop', AbortSignal.timeout(2000), options),
+      /download_failed/,
+    );
+    await assert.rejects(
+      downloadChatImage('http://image.example/stalled', AbortSignal.timeout(50), options),
+      { name: 'TimeoutError' },
+    );
+    assert.ok(tunnels.every((target) => target === 'image.example:80'));
+    assert.equal(imageRequests.length, 9);
+    assert.ok(imageRequests.every((request) => /host: image\.example/i.test(request)));
+    assert.ok(
+      imageRequests.every((request) => !/198\.18|cookie:|authorization:|referer:/i.test(request)),
+    );
+  } finally {
+    await transport.close();
+    t.mock.restoreAll();
+    syncBuiltinESMExports();
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+  }
+});
+
+test('proxy bypass preserves the checked and pinned direct image connection', async (t) => {
+  const server = createServer((_req, res) => res.end(PNG));
+  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+  const transport = createProxiedFetchTransport({
+    enabled: true,
+    type: 'http',
+    host: '127.0.0.1',
+    port: 1,
+    bypassList: ['image.example'],
+  });
+  try {
+    const local = `http://127.0.0.1:${(server.address() as import('node:net').AddressInfo).port}/image.png`;
+    const source = publicImageOrigin(t, local, 'http:', '198.18.0.2');
+    assert.deepEqual(
+      await downloadChatImage(source, AbortSignal.timeout(2000), { fetch: transport.fetch }),
+      checkedChatImage(PNG),
+    );
+  } finally {
+    await transport.close();
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+  }
+});
+
 test('resolver codec rejects excess fields and noncanonical artifact identities', () => {
   const spec = IMAGE_DELIVERY_OPERATION_SPECS['artifact.image.resolve'];
   assert.deepEqual(spec.decodeInput(REQUEST), REQUEST);
@@ -915,7 +1111,7 @@ test('resolver codec rejects excess fields and noncanonical artifact identities'
   assert.throws(() => spec.decodeOutput({ status: 'requires_confirmation', source: '/private' }));
 });
 
-test('remote capture requires a user action and current network authority, including on retry', async () => {
+test('remote capture requires client display authority and application network access, including on retry', async () => {
   let downloads = 0;
   const f = await fixture(undefined, undefined, undefined, async () => {
     downloads++;
@@ -967,7 +1163,7 @@ test('remote capture requires a user action and current network authority, inclu
   }
 });
 
-test('failed remote downloads issue one request and require explicit retry consent', async () => {
+test('failed remote downloads issue one request and require a client retry', async () => {
   let downloads = 0;
   const f = await fixture(undefined, undefined, undefined, async () => {
     downloads++;
diff --git a/packages/runtime-host/src/__tests__/execution-composition.test.ts b/packages/runtime-host/src/__tests__/execution-composition.test.ts
index 7cc077b347..4015b0f029 100644
--- a/packages/runtime-host/src/__tests__/execution-composition.test.ts
+++ b/packages/runtime-host/src/__tests__/execution-composition.test.ts
@@ -20,7 +20,9 @@
 import assert from 'node:assert/strict';
 import { execFileSync } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
-import { createServer } from 'node:http';
+import http, { createServer } from 'node:http';
+import dns from 'node:dns/promises';
+import { syncBuiltinESMExports } from 'node:module';
 import { WORKHUB_COORDINATION_SESSION_ID } from '@maka/core/session';
 import {
   TOOL_BOUNDARY_PROTOCOL_V1,
@@ -4728,7 +4730,7 @@ test('production Host automatically archives assistant Markdown images and serve
   });
 });
 
-test('production Host never downloads remote Markdown images in restricted session modes', async () => {
+test('production Host rejects loopback image destinations even when a restricted-session client permits media loading', async () => {
   await withCompositionRoot(async ({ root, owner }) => {
     let requests = 0;
     const server = createServer((_request, response) => {
@@ -4788,7 +4790,13 @@ test('production Host never downloads remote Markdown images in restricted sessi
           ).ok,
           true,
         );
-        const request = { sessionId: session.id, turnId, messageId: `message-${turnId}`, source };
+        const request = {
+          sessionId: session.id,
+          turnId,
+          messageId: `message-${turnId}`,
+          source,
+          loadRemote: true,
+        };
         await waitFor(async () => {
           const result = await captured.composition.handlers['artifact.image.resolve'](
             request,
@@ -4814,3 +4822,132 @@ test('production Host never downloads remote Markdown images in restricted sessi
     }
   });
 });
+
+test('production Host loads visible remote media independently of agent sandbox networking and respects app privacy', async (t) => {
+  const png = Buffer.from(
+    'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8DwHwAFBQIAX8jx0gAAAABJRU5ErkJggg==',
+    'base64',
+  );
+  let requests = 0;
+  const server = createServer((_request, response) => {
+    requests++;
+    response.end(png);
+  });
+  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+  const origin = `http://127.0.0.1:${(server.address() as import('node:net').AddressInfo).port}`;
+  const realRequest = http.request;
+  t.mock.method(dns, 'lookup', async (host: string) => {
+    assert.equal(host, 'image.example');
+    return [{ address: '198.18.0.2', family: 4 }];
+  });
+  t.mock.method(
+    http,
+    'request',
+    (
+      url: URL,
+      options: import('node:http').RequestOptions,
+      callback: (response: import('node:http').IncomingMessage) => void,
+    ) => {
+      assert.equal(url.hostname, 'image.example');
+      assert.ok(options.lookup);
+      options.lookup(url.hostname, { all: true }, (error, addresses) => {
+        assert.equal(error, null);
+        assert.deepEqual(addresses, [{ address: '198.18.0.2', family: 4 }]);
+      });
+      return realRequest(
+        new URL(url.pathname, origin),
+        { ...options, lookup: undefined },
+        callback,
+      );
+    },
+  );
+  syncBuiltinESMExports();
+  try {
+    await withCompositionRoot(async ({ root, owner }) => {
+      const captured = await createCapturedExecutionComposition(owner, {
+        primaryBackendFactory: (context) =>
+          new (class extends FakeBackend {
+            override async *send(input: BackendSendInput): AsyncIterable<SessionEvent> {
+              yield {
+                type: 'text_complete',
+                id: `text-${input.turnId}`,
+                turnId: input.turnId,
+                ts: Date.now(),
+                messageId: `message-${input.turnId}`,
+                text: `![](http://image.example/${input.turnId}.png)`,
+              };
+              yield {
+                type: 'complete',
+                id: `complete-${input.turnId}`,
+                turnId: input.turnId,
+                ts: Date.now(),
+                stopReason: 'end_turn',
+              };
+            }
+          })(context),
+      });
+      const context = {
+        hostEpoch: 'execution-composition-test',
+        connectionId: 'image-client',
+        principal: 'local_os_user',
+        acquireResidency: () => ({ release() {} }),
+      };
+      try {
+        for (const [permissionMode, privacy] of [
+          ['explore', false],
+          ['ask', false],
+          ['bypass', true],
+        ] as const) {
+          const policy = await captured.composition.handlers['runtime.policy.query']({}, context);
+          assert.ok(policy.ok);
+          const changed = await captured.composition.handlers['runtime.policy.mutate'](
+            {
+              expectedRevision: policy.result.revision,
+              operation: { kind: 'set_privacy', value: { incognitoActive: privacy } },
+            },
+            context,
+          );
+          assert.ok(changed.ok);
+          const session = await captured.manager.createSession({
+            cwd: root,
+            llmConnectionId: FAKE_CONNECTION_ID,
+            llmConnectionSlug: 'fake',
+            model: 'fake-model',
+            permissionMode,
+          });
+          const turnId = `media-${permissionMode}`;
+          const started = await captured.composition.handlers['turn.start'](
+            { sessionId: session.id, turnId, content: { text: 'display image' } },
+            context,
+          );
+          assert.ok(started.ok, JSON.stringify(started));
+          const request = {
+            sessionId: session.id,
+            turnId,
+            messageId: `message-${turnId}`,
+            source: `http://image.example/${turnId}.png`,
+            loadRemote: true,
+          };
+          await waitFor(async () => {
+            const result = await captured.composition.handlers['artifact.image.resolve'](
+              request,
+              context,
+            );
+            assert.ok(result.ok);
+            return privacy
+              ? result.result.status === 'failed' && result.result.reason === 'not_allowed'
+              : result.result.status === 'ready';
+          }, 5000);
+        }
+        assert.equal(requests, 2, 'privacy mode must not issue a third media request');
+      } finally {
+        captured.composition.beginDrain();
+        await captured.composition.close();
+      }
+    });
+  } finally {
+    t.mock.restoreAll();
+    syncBuiltinESMExports();
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+  }
+});
diff --git a/packages/runtime-host/src/server/chat-image-delivery.ts b/packages/runtime-host/src/server/chat-image-delivery.ts
index 10358d64c9..54f067b22d 100644
--- a/packages/runtime-host/src/server/chat-image-delivery.ts
+++ b/packages/runtime-host/src/server/chat-image-delivery.ts
@@ -86,7 +86,7 @@ export class ChatImageDeliveryService {
     )
       return;
     // Reference destinations can grow during streaming. Only settled text
-    // grants capture, and remote sources always require an explicit action.
+    // grants local capture. Remote media loads only when a client displays it.
     try {
       for (const source of chatImageSources(event.text)) {
         if (isRemoteImageSource(source)) continue;
diff --git a/packages/runtime-host/src/server/chat-image-source.ts b/packages/runtime-host/src/server/chat-image-source.ts
index 84364ca23a..760918926a 100644
--- a/packages/runtime-host/src/server/chat-image-source.ts
+++ b/packages/runtime-host/src/server/chat-image-source.ts
@@ -34,6 +34,7 @@ import {
   type ImageDeliveryFailure,
 } from '@maka/core/image-delivery';
 import { abortable } from '../client/wait-for-ready.js';
+import { usesFetchProxy } from '@maka/runtime/network/scoped-fetch-transport';
 export class ImageSourceError extends Error {
   constructor(readonly reason: ImageDeliveryFailure) {
     super(reason);
@@ -81,6 +82,7 @@ export function decodedLocalImagePath(source: string): string | undefined {
 export async function downloadChatImage(
   source: string,
   signal: AbortSignal,
+  options: { readonly fetch?: typeof globalThis.fetch } = {},
 ): Promise<ChatImageBytes> {
   let url = new URL(source);
   for (let redirect = 0; redirect <= 3; redirect++) {
@@ -88,49 +90,68 @@ export async function downloadChatImage(
     if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password)
       throw new ImageSourceError('not_allowed');
     const host = url.hostname.replace(/^\[|\]$/g, '');
+    // Fake DNS addresses are routing handles for a named destination, never
+    // authority to load a literal private address or a local/metadata hostname.
+    const namedHost = !isIP(host) && publicHostname(host);
+    if (!isIP(host) && !namedHost) throw new ImageSourceError('not_allowed');
     const addresses = isIP(host)
       ? [{ address: host, family: isIP(host) }]
       : await abortable(() => lookup(host, { all: true }), signal);
-    if (!addresses.length || addresses.some((a) => !publicAddress(a.address)))
+    if (
+      !addresses.length ||
+      addresses.some((a) => !publicAddress(a.address) && !(namedHost && fakeAddress(a.address)))
+    )
       throw new ImageSourceError('not_allowed');
     const target = addresses[0]!;
-    const response = await new Promise<import('node:http').IncomingMessage>((resolve, reject) => {
-      const req = (url.protocol === 'https:' ? httpsRequest : httpRequest)(
-        url,
-        {
-          signal,
-          headers: { accept: 'image/png,image/jpeg,image/webp,image/gif' },
-          lookup: (_host, options, callback) =>
-            options.all ? callback(null, [target]) : callback(null, target.address, target.family),
-        },
-        resolve,
-      );
-      req.on('error', reject);
-      req.end();
-    });
-    if ([301, 302, 303, 307, 308].includes(response.statusCode ?? 0) && response.headers.location) {
-      response.destroy();
-      const next = new URL(response.headers.location, url);
+    const headers = { accept: 'image/png,image/jpeg,image/webp,image/gif' };
+    const proxyFetch =
+      options.fetch && usesFetchProxy(options.fetch, url) ? options.fetch : undefined;
+    const response = proxyFetch
+      ? proxyImageResponse(
+          await proxyFetch(url, { signal, headers, redirect: 'manual', credentials: 'omit' }),
+        )
+      : directImageResponse(
+          await new Promise<import('node:http').IncomingMessage>((resolve, reject) => {
+            const req = (url.protocol === 'https:' ? httpsRequest : httpRequest)(
+              url,
+              {
+                signal,
+                headers,
+                lookup: (_host, options, callback) =>
+                  options.all
+                    ? callback(null, [target])
+                    : callback(null, target.address, target.family),
+              },
+              resolve,
+            );
+            req.on('error', reject);
+            req.end();
+          }),
+        );
+    const location = response.header('location');
+    if ([301, 302, 303, 307, 308].includes(response.status) && location) {
+      await response.close();
+      const next = new URL(location, url);
       if (url.protocol === 'https:' && next.protocol !== 'https:')
         throw new ImageSourceError('not_allowed');
       url = next;
       continue;
     }
-    if (response.statusCode !== 200) {
-      response.destroy();
+    if (response.status !== 200) {
+      await response.close();
       throw new ImageSourceError('download_failed');
     }
-    const length = Number(response.headers['content-length']);
+    const length = Number(response.header('content-length'));
     if (length > ARTIFACT_IMAGE_PREVIEW_MAX_BYTES) {
-      response.destroy();
+      await response.close();
       throw new ImageSourceError('too_large');
     }
     const chunks: Buffer[] = [];
     let size = 0;
-    for await (const chunk of response) {
+    for await (const chunk of response.chunks) {
       size += chunk.length;
       if (size > ARTIFACT_IMAGE_PREVIEW_MAX_BYTES) {
-        response.destroy();
+        await response.close();
         throw new ImageSourceError('too_large');
       }
       chunks.push(Buffer.from(chunk));
@@ -139,6 +160,68 @@ export async function downloadChatImage(
   }
   throw new ImageSourceError('download_failed');
 }
+interface ImageResponse {
+  readonly status: number;
+  readonly chunks: AsyncIterable<Uint8Array>;
+  header(name: string): string | undefined;
+  close(): void | Promise<void>;
+}
+function directImageResponse(response: import('node:http').IncomingMessage): ImageResponse {
+  return {
+    status: response.statusCode ?? 0,
+    chunks: response,
+    header: (name) => {
+      const value = response.headers[name];
+      return typeof value === 'string' ? value : undefined;
+    },
+    close: () => {
+      response.destroy();
+    },
+  };
+}
+function proxyImageResponse(response: Response): ImageResponse {
+  return {
+    status: response.status,
+    header: (name) => response.headers.get(name) ?? undefined,
+    close: async () => {
+      await response.body?.cancel().catch(() => {});
+    },
+    chunks: (async function* () {
+      const reader = response.body?.getReader();
+      if (!reader) return;
+      try {
+        while (true) {
+          const chunk = await reader.read();
+          if (chunk.done) break;
+          yield chunk.value;
+        }
+      } finally {
+        await reader.cancel().catch(() => {});
+        reader.releaseLock();
+      }
+    })(),
+  };
+}
+function publicHostname(host: string): boolean {
+  const name = host.toLowerCase().replace(/\.$/, '');
+  return (
+    name.includes('.') &&
+    !/(^|\.)(localhost|local|lan|internal|home|arpa|test|invalid)$/.test(name) &&
+    ![
+      'metadata.google.internal',
+      'metadata.goog',
+      'metadata.tencentyun.com',
+      'instance-data.ec2.internal',
+    ].includes(name)
+  );
+}
+function fakeAddress(address: string): boolean {
+  if (isIP(address) === 4) return /^198\.(18|19)\./.test(address);
+  if (isIP(address) !== 6) return false;
+  // RFC 5180's benchmarking prefix is also used by VPN fake DNS for IPv6.
+  const normalized = new URL(`http://[${address}]`).hostname;
+  return /^\[2001:2:(?::|0:)/i.test(normalized);
+}
 function publicAddress(address: string): boolean {
   if (isIP(address) === 4) {
     const [a = 0, b = 0] = address.split('.').map(Number);
@@ -155,5 +238,5 @@ function publicAddress(address: string): boolean {
     );
   }
   // Only global-unicast IPv6 is eligible. Mapped IPv4/ULA/link-local are excluded.
-  return /^[23][0-9a-f]{3}:/i.test(address);
+  return /^[23][0-9a-f]{3}:/i.test(address) && !fakeAddress(address);
 }
diff --git a/packages/runtime-host/src/server/execution-composition.ts b/packages/runtime-host/src/server/execution-composition.ts
index d0e4a3d506..0785a2d181 100644
--- a/packages/runtime-host/src/server/execution-composition.ts
+++ b/packages/runtime-host/src/server/execution-composition.ts
@@ -19,6 +19,7 @@
 
 import { createImageFileReader } from '@maka/runtime/image-file-reader';
 import { ChatImageDeliveryService } from './chat-image-delivery.js';
+import { downloadChatImage, ImageSourceError } from './chat-image-source.js';
 import { createGenesisExecutionBoundary } from '@maka/core/sandbox-boundary';
 import { createWorkHubResultRuntime } from './workhub-result-runtime.js';
 import { createWorkHubInspectionTool } from './workhub-inspection-tool.js';
@@ -594,16 +595,26 @@ export async function createExecutionRuntimeHostComposition(
       presentationFailed: (error) => {
         console.warn('[runtime-host] Image presentation failed', error);
       },
-      canLoadRemote: async (sessionId) => {
-        const [header, stored] = await Promise.all([
-          stores.sessionStore.readHeaderSnapshot(sessionId),
-          stores.sessionStore.readExecutionBoundary(sessionId),
-        ]);
-        const boundary = stored ?? createGenesisExecutionBoundary(header.permissionMode);
-        return (
-          boundary.kind === 'bypass' ||
-          (boundary.kind === 'managed' && boundary.profile.network.kind === 'enabled')
+      // Transcript media belongs to the application's outbound policy, rather
+      // than the agent's subprocess sandbox. Privacy mode still blocks capture.
+      canLoadRemote: async () => {
+        const resolved = await runtimePolicyStores.operations.resolveHostOutboundExecution();
+        return resolved.kind === 'ready';
+      },
+      download: async (source, signal) => {
+        const resolved = await runtimePolicyStores.operations.resolveHostOutboundExecution();
+        if (resolved.kind !== 'ready') throw new ImageSourceError('not_allowed');
+        const proxy = toRuntimePolicyProxy(
+          resolved.networkProxy,
+          resolved.secretMaterial.networkProxy?.secret,
         );
+        if (!proxy) return downloadChatImage(source, signal);
+        const transport = createProxiedFetchTransport(proxy);
+        try {
+          return await downloadChatImage(source, signal, { fetch: transport.fetch });
+        } finally {
+          await transport.close();
+        }
       },
       readLocalImage: async (sessionId, path, abortSignal) => {
         const [header, boundary] = await Promise.all([
diff --git a/packages/runtime/src/network/scoped-fetch-transport.ts b/packages/runtime/src/network/scoped-fetch-transport.ts
index ba992830f0..e9ee4bb920 100644
--- a/packages/runtime/src/network/scoped-fetch-transport.ts
+++ b/packages/runtime/src/network/scoped-fetch-transport.ts
@@ -45,6 +45,15 @@ export interface ConnectionEffectFetchTransport {
 
 export type ProxiedFetchProxy = ConnectionEffectProxySnapshot;
 
+/** Use the same immutable route decision when a caller also owns a pinned direct connection. */
+export function usesFetchProxy(fetch: typeof globalThis.fetch, url: URL): boolean {
+  const proxy = Object.getOwnPropertyDescriptor(fetch, FETCH_PROXY_SNAPSHOT)?.value as
+    | ProxySettings
+    | null
+    | undefined;
+  return !!proxy?.enabled && !matchesBypassList(url.hostname, proxy.bypassList);
+}
+
 export interface ProxiedFetchTransport {
   readonly fetch: typeof globalThis.fetch;
   close(): Promise<void>;
diff --git a/packages/ui/scripts/markdown-images.browser.test.mjs b/packages/ui/scripts/markdown-images.browser.test.mjs
index dcf12f870a..0374c29bad 100644
--- a/packages/ui/scripts/markdown-images.browser.test.mjs
+++ b/packages/ui/scripts/markdown-images.browser.test.mjs
@@ -174,7 +174,7 @@ before(async () => {
         window.deliverySources.push(request.source);
         if(canonicalSources[mode] && !canonicalSources[mode].includes(request.source)) return {status:'unavailable'};
         if(request.retry) window.deliveryRetries++;
-        if(mode==='restricted') return {status:'failed',reason:'not_allowed'};
+        if(mode==='privacy') return {status:'failed',reason:'not_allowed'};
         if(mode==='signed-failed') return {status:'failed',reason:'download_failed'};
         if(!seeded) {
           if(!request.loadRemote) return {status:'requires_confirmation'};
@@ -253,32 +253,25 @@ async function loaded(page) {
   await page.waitForFunction(() => [...document.images].some(image => image.naturalWidth === 1));
 }
 
-test('a remote image sends no request until clicked, then renders Host-owned bytes', async () => {
+test('a remote image loads automatically and renders Host-owned bytes', async () => {
   requests = [];
   const page = await pageFor('remote');
   try {
-    await page.getByRole('button', { name: 'Load image', exact: true }).waitFor();
-    assert.deepEqual(requests, []);
-    assert.equal(await page.locator('img').count(), 0);
-    await page.getByRole('button', { name: 'Load image', exact: true }).click();
     await loaded(page);
+    assert.equal(await page.getByRole('button', { name: 'Load image', exact: true }).count(), 0);
     assert.deepEqual(requests, [{ path: '/image.png', referer: undefined }]);
     assert.match(await page.locator('img').getAttribute('src'), /^data:/);
   } finally { await page.close(); }
 });
 
-test('remote consent belongs to one message, even when the next message reuses its URL', async () => {
+test('each message automatically resolves its own remote image identity', async () => {
   requests = [];
   const page = await pageFor('remote');
   try {
-    await page.getByRole('button', { name: 'Load image', exact: true }).click();
     await loaded(page);
     assert.equal(requests.length, 1);
     await page.evaluate(() => window.nextMessage());
-    await page.getByRole('button', { name: 'Load image', exact: true }).waitFor();
-    assert.equal(await page.locator('img').count(), 0);
-    assert.equal(requests.length, 1);
-    await page.getByRole('button', { name: 'Load image', exact: true }).click();
+    await page.waitForFunction(() => window.deliveryQueries >= 2);
     await loaded(page);
     assert.equal(requests.length, 2);
   } finally { await page.close(); }
@@ -333,22 +326,20 @@ test('redacting only image alt text does not disable a safe destination', async
   requests = [];
   const page = await pageFor('secret-alt');
   try {
-    await page.getByRole('button', {name: 'Load image', exact: true}).waitFor();
     assert.doesNotMatch(await page.locator('body').innerText(), /alt-secret/);
-    await page.getByRole('button', {name: 'Load image', exact: true}).click();
     await loaded(page);
     assert.equal(requests.length, 1);
   } finally { await page.close(); }
 });
 
-test('network-restricted images show denial before any load click and can recheck permissions', async () => {
+test('application privacy policy prevents automatic image loading and can be rechecked', async () => {
   requests = [];
-  const page = await pageFor('restricted');
+  const page = await pageFor('privacy');
   try {
-    await page.getByText('Image not saved: current permissions do not allow reading it or using the network.', {exact: true}).waitFor();
+    await page.getByText('Image not saved: permissions, network settings, or the source address block loading.', {exact: true}).waitFor();
     assert.equal(await page.getByRole('button', {name: 'Load image', exact: true}).count(), 0);
     await page.getByRole('button', {name: 'Retry', exact: true}).click();
-    await page.getByText('Image not saved: current permissions do not allow reading it or using the network.', {exact: true}).waitFor();
+    await page.getByText('Image not saved: permissions, network settings, or the source address block loading.', {exact: true}).waitFor();
     await page.getByText('Open in browser', {exact: true}).waitFor();
     assert.deepEqual(requests, []);
   } finally { await page.close(); }
@@ -387,7 +378,6 @@ test('failed remote image has a working retry control instead of a broken image
   failedOnce = false;
   const page = await pageFor('retry');
   try {
-    await page.getByRole('button', { name: 'Load image', exact: true }).click();
     await page.getByText('Image not saved: download failed. Try again.').waitFor();
     assert.equal(await page.locator('img').count(), 0);
     await page.getByRole('button', { name: 'Retry', exact: true }).click();
@@ -514,9 +504,6 @@ test('offscreen image performs no image request until it approaches the viewport
     assert.deepEqual(requests, []);
     assert.equal(await page.locator('img').count(), 0);
     await page.locator('[data-maka-image-state]').scrollIntoViewIfNeeded();
-    await page.getByRole('button', { name: 'Load image', exact: true }).waitFor();
-    assert.deepEqual(requests, []);
-    await page.getByRole('button', { name: 'Load image', exact: true }).click();
     await loaded(page);
     assert.deepEqual(requests, [{ path: '/image.png', referer: undefined }]);
   } finally { await page.close(); }
@@ -576,7 +563,6 @@ for (const scenario of ['geometry-remote', 'geometry-saved']) {
   test(`${scenario}: loading and ready images preserve the position of subsequent content`, async () => {
     const page = await pageFor(scenario);
     try {
-      if (scenario === 'geometry-remote') await page.getByRole('button', { name: 'Load image', exact: true }).click();
       await page.getByText('Loading image…', { exact: true }).waitFor();
       const before = await page.getByText('Following paragraph', { exact: true }).boundingBox();
       if (scenario === 'geometry-remote') releaseImage(); else releaseAttachment();
@@ -594,7 +580,6 @@ for (const scenario of ['geometry-remote', 'geometry-saved']) {
 test('image frames fit narrow viewports without distorting screenshots or limiting the enlarged preview', async () => {
   const page = await pageFor('screenshot');
   try {
-    await page.getByRole('button', { name: 'Load image', exact: true }).click();
     await page.waitForFunction(() => [...document.images].some(image => image.naturalWidth > 1));
     for (const width of [720, 360]) {
       await page.setViewportSize({ width, height: 600 });
diff --git a/packages/ui/src/image-delivery.tsx b/packages/ui/src/image-delivery.tsx
index 763539497e..4f814a177d 100644
--- a/packages/ui/src/image-delivery.tsx
+++ b/packages/ui/src/image-delivery.tsx
@@ -19,6 +19,7 @@
 
 import { createContext, useCallback, useContext, useEffect, useMemo, useState, type ReactNode } from 'react';
 import type { ImageDeliveryRequest, ImageDeliveryResult } from '@maka/core/image-delivery';
+import { isRemoteImageSource } from '@maka/core/image-delivery';
 export type ResolveImageDelivery = (sessionId: string, request: ImageDeliveryRequest) => Promise<ImageDeliveryResult>;
 export const ImageMessageScope = createContext<{ turnId: string; messageId: string; streaming?: boolean } | undefined>(undefined);
 const DeliveryContext = createContext<{ resolve(request: ImageDeliveryRequest): Promise<ImageDeliveryResult> } | undefined>(undefined);
@@ -45,19 +46,17 @@ export function ImageDeliveryProvider(props: { sessionId: string; resolve?: Reso
   }, [props.resolve, props.sessionId]);
   return <DeliveryContext.Provider value={value}>{props.children}</DeliveryContext.Provider>;
 }
-export function useImageDelivery(source: string, enabled: boolean) {
+export function useImageDelivery(source: string, enabled: boolean, allowRemote: boolean) {
   const scope = useContext(ImageMessageScope);
   const context = useContext(DeliveryContext);
   const [attempt, setAttempt] = useState(0);
-  const consentKey = JSON.stringify([scope?.turnId, scope?.messageId, source]);
-  const [consent, setConsent] = useState<{ context: typeof context; key: string }>();
-  const loadRemote = consent?.context === context && consent?.key === consentKey;
+  // Saved images can resolve even when display redaction forbids a source fetch.
+  const loadRemote = allowRemote && isRemoteImageSource(source);
   const identity = useMemo(() => context && scope?.turnId && scope.messageId && enabled
     ? { context, turnId: scope.turnId, messageId: scope.messageId, streaming: scope.streaming === true, source, attempt, loadRemote } : undefined,
     [context, scope?.turnId, scope?.messageId, scope?.streaming, source, attempt, loadRemote, enabled]);
   const [settled, setSettled] = useState<{ identity: typeof identity; result: ImageDeliveryResult }>();
   const retry = useCallback(() => setAttempt(a => a + 1), []);
-  const confirmRemote = useCallback(() => setConsent({ context, key: consentKey }), [context, consentKey]);
   useEffect(() => {
     if (!identity) return;
     let cancelled = false; let timer: ReturnType<typeof setTimeout> | undefined; let delay = 500; let unavailableRetries = 0;
@@ -76,5 +75,5 @@ export function useImageDelivery(source: string, enabled: boolean) {
   }, [identity, attempt]);
   const result: ImageDeliveryResult = !identity ? { status: 'unavailable' }
     : settled?.identity === identity ? settled.result : { status: 'pending' };
-  return { ...result, retry, confirmRemote, available: !!identity };
+  return { ...result, retry, available: !!identity };
 }
diff --git a/packages/ui/src/markdown-image.tsx b/packages/ui/src/markdown-image.tsx
index 17af0c859b..1b2f8270f2 100644
--- a/packages/ui/src/markdown-image.tsx
+++ b/packages/ui/src/markdown-image.tsx
@@ -99,7 +99,7 @@ function ImageResource(props: { src: string; redacted: boolean; alt: string; inl
     observer.observe(anchor.current); return () => observer.disconnect();
   }, [visible]);
   const explicit = parseAttachmentResourceRef(props.src);
-  const delivery = useImageDelivery(props.src, visible && !explicit);
+  const delivery = useImageDelivery(props.src, visible && !explicit, !props.redacted);
   const artifactId = explicit?.artifactId ?? (delivery.status === 'ready' ? delivery.artifactId : undefined);
   const image = useAttachmentImage(visible && artifactId ? { artifactId } : undefined);
   const [failedSource, setFailedSource] = useState<string>();
@@ -122,15 +122,13 @@ function ImageResource(props: { src: string; redacted: boolean; alt: string; inl
   </span>;
   let message: string | undefined;
   const remotePlaceholder = visible && remote && !artifactId;
-  const needsConsent = remotePlaceholder && !hiddenRemote && delivery.status === 'requires_confirmation';
-  const remoteUnavailable = remotePlaceholder && !hiddenRemote && !delivery.available;
-  const remoteNotice = remotePlaceholder && (hiddenRemote || remoteUnavailable || needsConsent || remoteBlocked);
+  const remoteUnavailable = remotePlaceholder && !hiddenRemote && (!delivery.available || delivery.status === 'requires_confirmation');
+  const remoteNotice = remotePlaceholder && (hiddenRemote || remoteUnavailable || remoteBlocked);
   if (failed) message = copy.imageLoadFailed;
   else if (!source) message = !visible ? copy.imageLoading
     : explicit && image.status === 'unavailable' ? copy.imageUnavailable
     : remotePlaceholder && hiddenRemote ? copy.imageRemoteRedacted
     : remoteUnavailable ? copy.imageRemoteUnavailable
-    : needsConsent ? copy.imageRemoteConsent
     : delivery.status === 'failed' ? copy.imageArchiveFailure(delivery.reason)
     : delivery.status === 'pending' || artifactId ? copy.imageLoading : copy.imageUnsupported;
   const hasFrame = props.inline || !visible || !!source || !!artifactId || delivery.status === 'pending';
@@ -148,8 +146,7 @@ function ImageResource(props: { src: string; redacted: boolean; alt: string; inl
       <span role="status">{hasFrame && !failed && !remoteNotice && delivery.status !== 'failed' && <Spinner size="sm" shade="subtle" aria-hidden="true" />} {message}</span>
       {(failed || delivery.status === 'failed') && sourceActions}
     </span> : source && <DisplayImage key={`${source}\0${attempt}`} src={source} alt={props.alt} onError={() => setFailedSource(source)} />}
-    {(needsConsent || remoteUnavailable) && <span className="maka-markdown-image-actions">
-      {needsConsent && <Button variant="ghost" size="sm" label={copy.imageLoad} onClick={delivery.confirmRemote} />}
+    {remoteUnavailable && <span className="maka-markdown-image-actions">
       <Link href={props.src} isExternalLink type="inherit" hasUnderline>{copy.imageOpen}</Link>
     </span>}
   </span>;
diff --git a/packages/ui/src/shared-ui-copy.ts b/packages/ui/src/shared-ui-copy.ts
index e3a4ec829c..c656c375ca 100644
--- a/packages/ui/src/shared-ui-copy.ts
+++ b/packages/ui/src/shared-ui-copy.ts
@@ -31,10 +31,8 @@ export interface SharedUiCopy {
     invalidInternalLink: string;
     unsafeLink: string;
     imageLoading: string;
-    imageRemoteConsent: string;
     imageRemoteRedacted: string;
     imageRemoteUnavailable: string;
-    imageLoad: string;
     imageExpand: (alt: string) => string;
     imageArchiveFailure: (reason: import('@maka/core/image-delivery').ImageDeliveryFailure) => string;
     imageUnavailable: string;
@@ -138,15 +136,13 @@ const SHARED_UI_COPY = {
       invalidInternalLink: '内部链接无效',
       unsafeLink: '链接不安全',
       imageLoading: '正在加载图片…',
-      imageRemoteConsent: '远程图片需要授权加载，图片来源会收到请求。',
       imageRemoteRedacted: '图片地址含已隐藏的敏感信息，无法加载或在浏览器中打开。',
       imageRemoteUnavailable: '此处无法加载远程图片，可在浏览器中打开。',
-      imageLoad: '加载图片',
       imageExpand: (alt) => alt ? `放大图片：${alt}` : '放大图片',
       imageArchiveFailure: (reason) => ({
         quota_exceeded: '图片未保存：存储配额已满（每个会话 100 MiB，工作区 1 GiB）。删除不再需要的会话可释放空间，仅归档不会释放。',
         too_large: '图片未保存：超过自动保存的大小或像素上限。',
-        not_allowed: '图片未保存：当前权限不允许读取或联网。',
+        not_allowed: '图片未保存：当前权限、联网设置或来源地址不允许加载。',
         not_found: '图片未保存：原文件已不存在。',
         unsupported_mime: '图片未保存：不是支持的有效图片。',
         download_failed: '图片未保存：下载失败，请重试。',
@@ -239,15 +235,13 @@ const SHARED_UI_COPY = {
       invalidInternalLink: '內部連結無效',
       unsafeLink: '連結不安全',
       imageLoading: '正在載入圖片…',
-      imageRemoteConsent: '遠端圖片需要授權載入，圖片來源會收到請求。',
       imageRemoteRedacted: '圖片位址含已隱藏的敏感資訊，無法載入或在瀏覽器中開啟。',
       imageRemoteUnavailable: '此處無法載入遠端圖片，可在瀏覽器中開啟。',
-      imageLoad: '載入圖片',
       imageExpand: (alt) => alt ? `放大圖片：${alt}` : '放大圖片',
       imageArchiveFailure: (reason) => ({
         quota_exceeded: '圖片未儲存：儲存配額已滿（每個對話 100 MiB，工作區 1 GiB）。刪除不再需要的對話可釋放空間，僅封存不會釋放。',
         too_large: '圖片未儲存：超過自動儲存的大小或像素上限。',
-        not_allowed: '圖片未儲存：目前權限不允許讀取或連線。',
+        not_allowed: '圖片未儲存：目前權限、連線設定或來源位址不允許載入。',
         not_found: '圖片未儲存：原檔案已不存在。',
         unsupported_mime: '圖片未儲存：不是支援的有效圖片。',
         download_failed: '圖片未儲存：下載失敗，請重試。',
@@ -340,15 +334,13 @@ const SHARED_UI_COPY = {
       invalidInternalLink: 'Invalid internal link',
       unsafeLink: 'Unsafe link',
       imageLoading: 'Loading image…',
-      imageRemoteConsent: 'Load this remote image only if you trust its source. Loading sends a request to that source.',
       imageRemoteRedacted: 'The image address contains hidden sensitive information. Loading and opening it are disabled.',
       imageRemoteUnavailable: 'Remote images cannot be loaded here. You can open this image in your browser.',
-      imageLoad: 'Load image',
       imageExpand: (alt) => alt ? `Enlarge image: ${alt}` : 'Enlarge image',
       imageArchiveFailure: (reason) => ({
         quota_exceeded: 'Image not saved: storage quota reached (100 MiB per session, 1 GiB per workspace). Delete unneeded sessions to free space; archiving does not free space.',
         too_large: 'Image not saved: exceeds the automatic save size or pixel limit.',
-        not_allowed: 'Image not saved: current permissions do not allow reading it or using the network.',
+        not_allowed: 'Image not saved: permissions, network settings, or the source address block loading.',
         not_found: 'Image not saved: the original file no longer exists.',
         unsupported_mime: 'Image not saved: not a supported valid image.',
         download_failed: 'Image not saved: download failed. Try again.',

From 4385ccd517ba717789a1399c5b4acc4671a74d88 Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Wed, 7 Oct 2026 21:47:12 +0800
Subject: [PATCH 21/35] fix(images): enforce copy quotas and restore UI checks

Apply archive budgets under the writer lock to conversation copies, including
linked child images and configured Host limits. Preserve content deduplication
and verified copy retries.

Use Astryx Button for image enlargement and update the legacy Host-unavailable
Storybook assertion. Document the retained application-media network boundary,
proxy DNS authority and trusted fake-DNS routing assumptions.

Generated-by: Codex (GPT-6)
---
 .../src/server/chat-image-source.ts           |  6 +-
 .../src/server/execution-composition.ts       |  3 +
 .../server/session-revision-coordinator.ts    |  4 +
 .../src/__tests__/artifact-store.test.ts      | 86 +++++++++++++++++++
 .../storage/src/artifact-image-storage.ts     | 34 ++++++--
 packages/storage/src/artifact-store.ts        | 10 ++-
 packages/storage/src/artifact-stores.ts       |  3 +
 packages/ui/src/image-delivery.tsx            |  2 +
 packages/ui/src/markdown-image.tsx            | 26 +++---
 packages/ui/src/styles.css                    |  9 +-
 packages/ui/stories/attachment.stories.tsx    |  6 +-
 11 files changed, 158 insertions(+), 31 deletions(-)

diff --git a/packages/runtime-host/src/server/chat-image-source.ts b/packages/runtime-host/src/server/chat-image-source.ts
index 760918926a..43aa34a999 100644
--- a/packages/runtime-host/src/server/chat-image-source.ts
+++ b/packages/runtime-host/src/server/chat-image-source.ts
@@ -78,7 +78,9 @@ export function decodedLocalImagePath(source: string): string | undefined {
     return undefined;
   }
 }
-/** Pin DNS at connection time and check each redirect; never send cookies, auth or referer. */
+/** Pin direct DNS and check each redirect; never send cookies, auth or referer.
+ * A configured proxy resolves the original hostname and is trusted to enforce
+ * its own egress boundary; local DNS checks cannot pin the proxy's destination. */
 export async function downloadChatImage(
   source: string,
   signal: AbortSignal,
@@ -92,6 +94,8 @@ export async function downloadChatImage(
     const host = url.hostname.replace(/^\[|\]$/g, '');
     // Fake DNS addresses are routing handles for a named destination, never
     // authority to load a literal private address or a local/metadata hostname.
+    // This compatibility exception assumes trusted VPN/TUN routing: a fake-IP
+    // answer alone does not prove that the eventual destination is public.
     const namedHost = !isIP(host) && publicHostname(host);
     if (!isIP(host) && !namedHost) throw new ImageSourceError('not_allowed');
     const addresses = isIP(host)
diff --git a/packages/runtime-host/src/server/execution-composition.ts b/packages/runtime-host/src/server/execution-composition.ts
index 0785a2d181..e33904dc1b 100644
--- a/packages/runtime-host/src/server/execution-composition.ts
+++ b/packages/runtime-host/src/server/execution-composition.ts
@@ -597,6 +597,8 @@ export async function createExecutionRuntimeHostComposition(
       },
       // Transcript media belongs to the application's outbound policy, rather
       // than the agent's subprocess sandbox. Privacy mode still blocks capture.
+      // Model-authored URLs can carry encoded data even when WebFetch is disabled;
+      // automatic media loading is not a Session network or DLP boundary.
       canLoadRemote: async () => {
         const resolved = await runtimePolicyStores.operations.resolveHostOutboundExecution();
         return resolved.kind === 'ready';
@@ -2900,6 +2902,7 @@ export async function createExecutionRuntimeHostComposition(
     });
     const executionInspect = new HostExecutionInspectCoordinator(stores);
     const sessionRevisions = new HostSessionRevisionCoordinator({
+      ...(options.imageArchiveLimits ? { imageArchiveLimits: options.imageArchiveLimits } : {}),
       stores,
       artifacts: openedArtifactStore,
       sessionTodo: sessionTodoStore,
diff --git a/packages/runtime-host/src/server/session-revision-coordinator.ts b/packages/runtime-host/src/server/session-revision-coordinator.ts
index e9702c052f..5dd4db49b5 100644
--- a/packages/runtime-host/src/server/session-revision-coordinator.ts
+++ b/packages/runtime-host/src/server/session-revision-coordinator.ts
@@ -100,6 +100,7 @@ type ConversationCopyCreateInput = CreateSessionInput & {
 };
 
 export interface HostSessionRevisionCoordinatorOptions {
+  readonly imageArchiveLimits?: import('@maka/core/image-delivery').ImageArchiveLimits;
   readonly stores: ExecutionStoresWriter<'interactive'>;
   readonly artifacts: InteractiveArtifactStoreWriter;
   readonly sessionTodo: InteractiveSessionTodoWriter;
@@ -534,6 +535,9 @@ export class HostSessionRevisionCoordinator {
         throw new Error(`Session context references could not be copied: ${contextCopy.reason}`);
       }
       const artifactCopy = await this.#artifacts.copyConversationArtifacts({
+        ...(this.options.imageArchiveLimits
+          ? { imageArchiveLimits: this.options.imageArchiveLimits }
+          : {}),
         sourceSessionId: input.sourceSessionId,
         targetSessionId: input.targetSessionId,
         turnIds: copyTurnIds,
diff --git a/packages/storage/src/__tests__/artifact-store.test.ts b/packages/storage/src/__tests__/artifact-store.test.ts
index d63d18f73e..a5553d007e 100644
--- a/packages/storage/src/__tests__/artifact-store.test.ts
+++ b/packages/storage/src/__tests__/artifact-store.test.ts
@@ -51,6 +51,7 @@ import {
   resolveArtifactPath,
   sanitizeArtifactName,
 } from '../artifact-store.js';
+import { ImageArchiveQuotaError } from '../artifact-image-storage.js';
 import { withArtifactWriterLock } from '../artifact-writer-lock.js';
 import { createSqliteArtifactMetadataRepository } from '../sqlite-artifact-metadata.js';
 
@@ -382,6 +383,91 @@ describe('SQLite Artifact store', () => {
     });
   });
 
+  test('conversation copies enforce the target image budget across root and linked child Sessions', async () => {
+    await withWorkspace(async (root) => {
+      const store = createArtifactStore(root);
+      const limits = { sessionBytes: 3, workspaceBytes: 6 };
+      const image = (id: string, sessionId: string, content: string): CreateArtifactInput => ({
+        ...artifactInput(id, content, 10),
+        sessionId,
+        turnId: 'image-turn',
+        mimeType: 'image/png',
+        imageArchiveLimits: limits,
+        imageDelivery: {
+          status: 'ready',
+          messageId: id,
+          source: '/tmp/image.png',
+          contentSha256: createHash('sha256').update(content).digest('hex'),
+        },
+      });
+      await store.create(image('root-image', 'session-1', 'one'));
+      await assert.rejects(
+        store.create(image('extra-image', 'session-1', 'two')),
+        ImageArchiveQuotaError,
+      );
+      await store.create(image('child-image', 'child-session', 'two'));
+      await assert.rejects(
+        store.copyConversationArtifacts({
+          sourceSessionId: 'session-1',
+          targetSessionId: 'session-copy',
+          turnIds: ['image-turn'],
+          linkedArtifacts: [{ sessionId: 'child-session', artifactIds: ['child-image'] }],
+          imageArchiveLimits: limits,
+        }),
+        ImageArchiveQuotaError,
+      );
+      const target = await listArtifacts(store, 'session-copy');
+      assert.equal(target.length, 1);
+      assert.equal(
+        target.reduce((sum, record) => sum + record.sizeBytes, 0),
+        limits.sessionBytes,
+      );
+      assert.deepEqual(await readArtifactText(store, 'root-image'), { ok: true, text: 'one' });
+      assert.deepEqual(await readArtifactText(store, 'child-image', 'child-session'), {
+        ok: true,
+        text: 'two',
+      });
+    });
+  });
+
+  test('conversation copies count identical image bytes once and allow verified retries at the limit', async () => {
+    await withWorkspace(async (root) => {
+      const store = createArtifactStore(root);
+      const limits = { sessionBytes: 3, workspaceBytes: 3 };
+      for (const [id, sessionId] of [
+        ['root-image', 'session-1'],
+        ['child-image', 'child-session'],
+      ]) {
+        await store.create({
+          ...artifactInput(id!, 'one', 10),
+          sessionId: sessionId!,
+          turnId: 'image-turn',
+          imageArchiveLimits: limits,
+          imageDelivery: {
+            status: 'ready',
+            messageId: id!,
+            source: '/tmp/image.png',
+            contentSha256: createHash('sha256').update('one').digest('hex'),
+          },
+        });
+      }
+      const input = {
+        sourceSessionId: 'session-1',
+        targetSessionId: 'session-copy',
+        turnIds: ['image-turn'],
+        linkedArtifacts: [{ sessionId: 'child-session', artifactIds: ['child-image'] }],
+        imageArchiveLimits: limits,
+      };
+      const copied = await store.copyConversationArtifacts(input);
+      assert.equal(copied.artifactIds.size, 2);
+      assert.equal((await listArtifacts(store, 'session-copy')).length, 2);
+      assert.deepEqual(
+        await store.copyConversationArtifacts({ ...input, existingTarget: 'reuse_verified' }),
+        copied,
+      );
+    });
+  });
+
   test('includes explicit same-Session Artifacts outside the copied turns', async () => {
     await withWorkspace(async (root) => {
       const authority = createArtifactStoreWriteAuthority(root);
diff --git a/packages/storage/src/artifact-image-storage.ts b/packages/storage/src/artifact-image-storage.ts
index a24ec5540d..c0c477e71f 100644
--- a/packages/storage/src/artifact-image-storage.ts
+++ b/packages/storage/src/artifact-image-storage.ts
@@ -41,6 +41,31 @@ export function planImageArchive(
   const digest =
     input.imageDelivery?.status === 'ready' ? input.imageDelivery.contentSha256 : undefined;
   const size = Buffer.byteLength(input.content);
+  assertImageArchiveQuota(records, { ...input, sizeBytes: size });
+  const sameContent = digest
+    ? records.find(
+        (r) =>
+          r.imageDelivery?.status === 'ready' &&
+          r.imageDelivery.contentSha256 === digest &&
+          r.sizeBytes === size,
+      )
+    : undefined;
+  return { digest, sameContent };
+}
+
+/** Checked under the Artifact writer lock before publishing captured or copied images. */
+export function assertImageArchiveQuota(
+  records: readonly ArtifactRecord[],
+  input: {
+    sessionId: string;
+    sizeBytes: number;
+    imageDelivery?: ImageDeliveryMetadata;
+    imageArchiveLimits?: ImageArchiveLimits;
+  },
+): void {
+  const digest =
+    input.imageDelivery?.status === 'ready' ? input.imageDelivery.contentSha256 : undefined;
+  const size = input.sizeBytes;
   const limits = input.imageArchiveLimits;
   if (digest && limits) {
     if (
@@ -62,13 +87,4 @@ export function planImageArchive(
     )
       throw new ImageArchiveQuotaError();
   }
-  const sameContent = digest
-    ? records.find(
-        (r) =>
-          r.imageDelivery?.status === 'ready' &&
-          r.imageDelivery.contentSha256 === digest &&
-          r.sizeBytes === size,
-      )
-    : undefined;
-  return { digest, sameContent };
 }
diff --git a/packages/storage/src/artifact-store.ts b/packages/storage/src/artifact-store.ts
index 13806e7616..df20d55b77 100644
--- a/packages/storage/src/artifact-store.ts
+++ b/packages/storage/src/artifact-store.ts
@@ -17,8 +17,9 @@
  * under the License.
  */
 
-import { planImageArchive } from './artifact-image-storage.js';
+import { assertImageArchiveQuota, planImageArchive } from './artifact-image-storage.js';
 import {
+  DEFAULT_IMAGE_ARCHIVE_LIMITS,
   isImageDeliveryMetadata,
   type ImageDeliveryMetadata,
   type ImageArchiveLimits,
@@ -140,6 +141,7 @@ export type ArtifactChunkReadResult =
   | { readonly ok: false; readonly reason: 'out_of_range' };
 
 export interface ConversationArtifactCopyInput {
+  readonly imageArchiveLimits?: ImageArchiveLimits;
   readonly sourceSessionId: string;
   readonly targetSessionId: string;
   readonly turnIds: readonly string[];
@@ -380,6 +382,9 @@ class SqliteArtifactStore implements ArtifactAuthorityStore {
     if (input.sourceSessionId === input.targetSessionId) {
       throw new Error('Artifact conversation copy requires distinct Sessions');
     }
+    const imageArchiveLimits = Object.freeze({
+      ...(input.imageArchiveLimits ?? DEFAULT_IMAGE_ARCHIVE_LIMITS),
+    });
     const turnIds = new Set(input.turnIds);
     const includedArtifactIds = new Set(input.includeArtifactIds ?? []);
     for (const turnId of turnIds) assertArtifactTurnKey(turnId);
@@ -448,6 +453,7 @@ class SqliteArtifactStore implements ArtifactAuthorityStore {
         input.targetSessionId,
         targetId,
         input.existingTarget === 'reuse_verified',
+        imageArchiveLimits,
       );
       artifactIds.set(record.id, created.id);
       relativePaths.set(record.relativePath, created.relativePath);
@@ -460,6 +466,7 @@ class SqliteArtifactStore implements ArtifactAuthorityStore {
     targetSessionId: string,
     targetId: string,
     reuseVerified: boolean,
+    imageArchiveLimits: ImageArchiveLimits,
   ): Promise<ArtifactRecord> {
     const source = prepared.record;
     const name = sanitizeArtifactName(source.name);
@@ -495,6 +502,7 @@ class SqliteArtifactStore implements ArtifactAuthorityStore {
         }
         return { ...existing };
       }
+      assertImageArchiveQuota(this.records, { ...expected, imageArchiveLimits });
       return this.publishNewArtifactUnlocked(
         expected,
         async (targetPath) => {
diff --git a/packages/storage/src/artifact-stores.ts b/packages/storage/src/artifact-stores.ts
index 86874feed7..383bef82e1 100644
--- a/packages/storage/src/artifact-stores.ts
+++ b/packages/storage/src/artifact-stores.ts
@@ -160,6 +160,9 @@ function createWriterFacade(
       const acceptedInput: ConversationArtifactCopyInput = Object.freeze({
         ...input,
         turnIds: Object.freeze([...input.turnIds]),
+        ...(input.imageArchiveLimits
+          ? { imageArchiveLimits: Object.freeze({ ...input.imageArchiveLimits }) }
+          : {}),
         ...(input.includeArtifactIds
           ? { includeArtifactIds: Object.freeze([...input.includeArtifactIds]) }
           : {}),
diff --git a/packages/ui/src/image-delivery.tsx b/packages/ui/src/image-delivery.tsx
index 4f814a177d..b2fd1c0a76 100644
--- a/packages/ui/src/image-delivery.tsx
+++ b/packages/ui/src/image-delivery.tsx
@@ -51,6 +51,8 @@ export function useImageDelivery(source: string, enabled: boolean, allowRemote:
   const context = useContext(DeliveryContext);
   const [attempt, setAttempt] = useState(0);
   // Saved images can resolve even when display redaction forbids a source fetch.
+  // Redaction protects display/retry UX for recognized secrets, not outbound data:
+  // an encoded value in a model-authored URL may still pass this presentation check.
   const loadRemote = allowRemote && isRemoteImageSource(source);
   const identity = useMemo(() => context && scope?.turnId && scope.messageId && enabled
     ? { context, turnId: scope.turnId, messageId: scope.messageId, streaming: scope.streaming === true, source, attempt, loadRemote } : undefined,
diff --git a/packages/ui/src/markdown-image.tsx b/packages/ui/src/markdown-image.tsx
index 1b2f8270f2..e4069cfd33 100644
--- a/packages/ui/src/markdown-image.tsx
+++ b/packages/ui/src/markdown-image.tsx
@@ -155,24 +155,22 @@ function DisplayImage(props: { src: string; alt: string; onError(): void }) {
   const copy = getSharedUiCopy(useUiLocale()).markdown;
   const [loaded, setLoaded] = useState(false);
   const lightbox = useLightbox({ media: { src: props.src, alt: props.alt }, hasZoom: true });
-  const trigger = useRef<HTMLSpanElement>(null);
+  const trigger = useRef<HTMLButtonElement>(null);
   useEffect(() => {
     if (lightbox.isOpen) return () => trigger.current?.focus();
   }, [lightbox.isOpen]);
+  const content = <>
+    {!loaded && <span className="maka-markdown-image-loading" role="status" aria-label={copy.imageLoading}><Spinner size="sm" shade="subtle" aria-hidden="true" /> <span className="maka-markdown-image-loading-label">{copy.imageLoading}</span></span>}
+    <img src={props.src} alt={props.alt} loading="lazy" decoding="async" referrerPolicy="no-referrer"
+        className="maka-markdown-attachment-image" onLoad={() => setLoaded(true)} onError={props.onError} />
+  </>;
   return <>
-    <span ref={trigger} className="maka-markdown-image-preview maka-markdown-image-trigger"
-        role="button" tabIndex={loaded ? 0 : -1} aria-label={copy.imageExpand(props.alt)}
-        aria-haspopup="dialog" aria-disabled={!loaded}
-        onClick={event => { event.preventDefault(); event.stopPropagation(); if (loaded) lightbox.open(); }}
-        onKeyDown={event => {
-          if (loaded && (event.key === 'Enter' || event.key === ' ')) {
-            event.preventDefault(); event.stopPropagation(); lightbox.open();
-          }
-        }}>
-      {!loaded && <span className="maka-markdown-image-loading" role="status" aria-label={copy.imageLoading}><Spinner size="sm" shade="subtle" aria-hidden="true" /> <span className="maka-markdown-image-loading-label">{copy.imageLoading}</span></span>}
-      <img src={props.src} alt={props.alt} loading="lazy" decoding="async" referrerPolicy="no-referrer"
-          className="maka-markdown-attachment-image" onLoad={() => setLoaded(true)} onError={props.onError} />
-    </span>
+    <Button ref={trigger} variant="ghost" className="maka-markdown-image-preview maka-markdown-image-trigger"
+        label={copy.imageExpand(props.alt)} aria-haspopup="dialog" isDisabled={!loaded}
+        style={{ width: '100%', height: '100%', padding: 0, background: 'transparent' }}
+        onClick={event => { event.preventDefault(); event.stopPropagation(); if (loaded) lightbox.open(); }}>
+      {content}
+    </Button>
     {lightbox.isOpen && lightbox.element}
   </>;
 }
diff --git a/packages/ui/src/styles.css b/packages/ui/src/styles.css
index c99151e943..1d5debe250 100644
--- a/packages/ui/src/styles.css
+++ b/packages/ui/src/styles.css
@@ -679,9 +679,12 @@
 .maka-markdown-image-inline .maka-markdown-image-loading-label { display: none; }
 /* The image is the lightbox trigger, including keyboard and touch activation. */
 .maka-markdown-image-trigger { cursor: default; }
-.maka-markdown-image-trigger:focus-visible {
-  outline: var(--focus-ring-width) solid var(--focus-ring);
-  outline-offset: calc(-1 * var(--focus-ring-width));
+.maka-markdown-image-trigger > span > span {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  width: 100%;
+  height: 100%;
 }
 .maka-markdown-image-preview img { margin: 0; max-height: 100%; max-width: 100%; object-fit: contain; }
 .maka-markdown-image-loading {
diff --git a/packages/ui/stories/attachment.stories.tsx b/packages/ui/stories/attachment.stories.tsx
index 5b7d03149c..e74aef2f2b 100644
--- a/packages/ui/stories/attachment.stories.tsx
+++ b/packages/ui/stories/attachment.stories.tsx
@@ -165,7 +165,7 @@ function imageDeliveryStory(result: ImageDeliveryResult): Story {
         const image = canvasElement.querySelector('.maka-markdown-image-resource');
         if (!image) throw new Error('assistant image has not mounted');
         if (result.status === 'ready') expect(image.querySelector('img')?.getAttribute('src')).toMatch(/^data:/);
-        else if (result.status === 'requires_confirmation') expect(image.textContent).toContain('Load image');
+        else if (result.status === 'requires_confirmation') expect(image.textContent).toContain('Remote images cannot be loaded here');
         else if (result.status === 'failed') expect(image.textContent).toContain('download failed');
         else expect(image.textContent).toContain('Loading image');
       });
@@ -173,8 +173,8 @@ function imageDeliveryStory(result: ImageDeliveryResult): Story {
   };
 }
 
-// Real path: assistant chat bubble → remote image awaits the user's Load image action.
-export const AssistantImageConsent = imageDeliveryStory({ status: 'requires_confirmation' });
+// Real path: assistant chat bubble → an older Host cannot deliver the remote image.
+export const AssistantImageUnavailable = imageDeliveryStory({ status: 'requires_confirmation' });
 // Real path: assistant chat bubble → Host is saving bytes; the image remains a placeholder.
 export const AssistantImageSaving = imageDeliveryStory({ status: 'pending' });
 // Real path: assistant chat bubble → saved attachment is read through the production byte reader.

From 7cfbf4ccc59fcc14d5bef37aa2fd2058a46491ee Mon Sep 17 00:00:00 2001
From: Sun-GLiang <81428141+Sun-GLiang@users.noreply.github.com>
Date: Fri, 9 Oct 2026 19:58:22 +0800
Subject: [PATCH 22/35] fix(images): align protocol guard with rebased main

Require an epoch beyond main 212 and remove the obsolete epoch-210 compatibility declaration.
---
 .../image-delivery-request-validator.json                    | 5 -----
 packages/runtime-host/src/__tests__/protocol.test.ts         | 4 ++--
 2 files changed, 2 insertions(+), 7 deletions(-)
 delete mode 100644 packages/runtime-host/protocol-compatible-changes/image-delivery-request-validator.json

diff --git a/packages/runtime-host/protocol-compatible-changes/image-delivery-request-validator.json b/packages/runtime-host/protocol-compatible-changes/image-delivery-request-validator.json
deleted file mode 100644
index f684e87575..0000000000
--- a/packages/runtime-host/protocol-compatible-changes/image-delivery-request-validator.json
+++ /dev/null
@@ -1,5 +0,0 @@
-{
-  "epoch": 210,
-  "files": ["packages/runtime-host/src/protocol/image-delivery.ts"],
-  "reason": "At epoch 210, replace duplicate image request validation with the core validator and existing shaped-record codec. Required and optional fields, identity/source bounds, control-character rejection, error codes, normalized boolean flags and output codecs remain unchanged. Differential checks against the epoch-210 implementation preserve all 443 tested input outcomes; no field or operation is added or removed."
-}
diff --git a/packages/runtime-host/src/__tests__/protocol.test.ts b/packages/runtime-host/src/__tests__/protocol.test.ts
index 707e1524e8..5b7cc244fc 100644
--- a/packages/runtime-host/src/__tests__/protocol.test.ts
+++ b/packages/runtime-host/src/__tests__/protocol.test.ts
@@ -133,8 +133,8 @@ describe('Runtime Host bootstrap protocol', () => {
     // field, so mixed-version peers must fail during the handshake instead.
     assert.ok(RUNTIME_HOST_COMPATIBILITY_EPOCH > 22);
   });
-  test('rejects peers predating remote image consent and image resolution', () => {
-    assert.ok(RUNTIME_HOST_COMPATIBILITY_EPOCH > 209);
+  test('rejects epoch-212 peers predating image resolution', () => {
+    assert.ok(RUNTIME_HOST_COMPATIBILITY_EPOCH > 212);
   });
 
   test('publishes a new compatibility epoch for Artifact invalidation frames', () => {

From 8be5c8b909502ed687f9ee44ffdbed3e2a970add Mon Sep 17 00:00:00 2001
From: Sun-GLiang <81428141+Sun-GLiang@users.noreply.github.com>
Date: Sat, 10 Oct 2026 11:21:33 +0800
Subject: [PATCH 23/35] refactor(images): separate capture attempts and
 presentation state

Store pending and failed attempts independently from archived artifacts, migrate existing state, and publish saved results atomically. Centralize canonical image ranges and UI resource transitions while preserving archive identities, redaction, and source authority.

Generated-by: Codex (GPT-6)
---
 .../pr/chat-image-delivery/click-after.png    |  Bin 60327 -> 0 bytes
 .../pr/chat-image-delivery/click-before.png   |  Bin 61189 -> 0 bytes
 .../pr/chat-image-delivery/click-enlarged.png |  Bin 4496 -> 0 bytes
 .../pr/chat-image-delivery/remote-after.png   |  Bin 60327 -> 0 bytes
 .../pr/chat-image-delivery/remote-before.png  |  Bin 19007 -> 0 bytes
 package-lock.json                             |    4 +-
 packages/cli/THIRD_PARTY_NOTICES.txt          | 1058 ++++++++++++++++-
 packages/core/package.json                    |    3 +-
 packages/core/src/__tests__/artifacts.test.ts |   23 -
 .../core/src/__tests__/image-markdown.test.ts |   35 +-
 packages/core/src/artifacts.ts                |    6 +-
 packages/core/src/image-delivery.ts           |   12 +
 packages/core/src/image-markdown.ts           |   29 +
 .../src/__tests__/chat-image-delivery.test.ts |   50 +-
 .../src/server/chat-image-delivery.ts         |   93 +-
 .../src/server/execution-composition.ts       |   66 +-
 .../src/server/session-transcript-reader.ts   |   60 +
 .../__tests__/image-delivery-storage.test.ts  |  219 ++++
 .../__tests__/session-bundle-policy.test.ts   |   31 +
 .../storage/src/artifact-image-storage.ts     |   10 +-
 packages/storage/src/artifact-store.ts        |   40 +-
 packages/storage/src/artifact-stores.ts       |    6 +
 .../storage/src/sqlite-artifact-metadata.ts   |   90 +-
 .../storage/src/sqlite-artifact-schema.ts     |    5 +-
 packages/storage/src/sqlite-image-delivery.ts |  144 +++
 packages/ui/package.json                      |    1 -
 packages/ui/src/chat-image-resource.ts        |   71 ++
 packages/ui/src/markdown-image-redaction.ts   |   52 +-
 packages/ui/src/markdown-image.tsx            |   71 +-
 29 files changed, 1900 insertions(+), 279 deletions(-)
 delete mode 100644 docs/images/pr/chat-image-delivery/click-after.png
 delete mode 100644 docs/images/pr/chat-image-delivery/click-before.png
 delete mode 100644 docs/images/pr/chat-image-delivery/click-enlarged.png
 delete mode 100644 docs/images/pr/chat-image-delivery/remote-after.png
 delete mode 100644 docs/images/pr/chat-image-delivery/remote-before.png
 create mode 100644 packages/storage/src/__tests__/image-delivery-storage.test.ts
 create mode 100644 packages/storage/src/sqlite-image-delivery.ts
 create mode 100644 packages/ui/src/chat-image-resource.ts

diff --git a/docs/images/pr/chat-image-delivery/click-after.png b/docs/images/pr/chat-image-delivery/click-after.png
deleted file mode 100644
index b9d4268f04917a8f5007f42b3b00d5a744a77825..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 60327
zcmY&fWmMGL+a0>Qhwkp~p}V`gL%Jk}?x8!R8>A(b?(P!l21x}(eU*Fff35e!e3@^*
zb<TcvJp06|tIDAv1Cap$0Gfilv?c%mJ@@CQj|lzepP?1mU;qFUpdc-w?U#S?(`9A9
z3!Ntl`ob6SyKTKS+4xo}6iuls6^4cm1?}eNw})y==x#GtqnWh9u}oC}%olPj3s$v^
z-}@oIzubKj_~lOe`w8<Y<acM#uRAq?;9pPAPD5V>qw1}q(pGLBR%^kHEd0$B-&t&f
zG)-t9LyzkWgBwT&k7w=Do6rSkBn%8{&QnjjjPZ!sq;)KcpLL%G<*XGNwB}TK9r5^l
zairw7mNm39ho9RB41V=JytStKeLNB_t~dQiB$`Ad;__33103#hO#1l574pkFbI(dg
zg!Ag`8<2-Tfh6zVGtdwJgdv&Uw)^YgyW<~YOwi>chho4Q(7SLc%@1pwG#x~O_nF5t
z>vt0Yra}8X&*Hz||DH4~WEwOiV>#ai`c>SyE93Sr<|P%NXat7hH{_h3<eR=v?c@2h
z<!I)1_(c9uct+J&j4fdZdnq4}E%{jjj{;RO#`|*iJtsD04d^89-5`8Nv8w!mdy#of
zhPNo*BnAUJczUl2XA7EP0%u?bKQj)=P72|z<eXZJ5y)A5>`0JrfvO?Yt<9G7ovmXB
z(&r;(KiH$)?+%Y|XgnY<LCE{HXVMl`N=&oKze>V}3hM6GR6hTD*F+6^Z$U(;p8yQj
z^UtOVb%$t{J{~l5HDh?r6zYk-|LARMFd1HMCP2n|ev_Mr*g$P1u^P~TZ&?2Y9<iTh
zZ}0OLoNF)~b*Kd=2Q@3;;D-Db+5AN)#~bPp2ZU?|NQz|yTLJRvMUu;D<#?M})B+Cr
z#9(YDCPUodg{XAEU(W{U84E$!YbYjM@ESZJ-a1|P3iA`r+4KXy<u!LZ8|_nVid$5r
z?}71i$zQJsP}JHOGJCX1--c54YeLP5|9*LXV#U^!n2kqA4?9xZMEp4X&W;gVBo*oQ
z{0>A6qsV=(Z$?7BU#dMbCUHDX7vcr&=6HW0Q+Ocy{?FN+_cUiBD1CAhF}$9*YA!uO
z8IzyOemN66m-ykYs{oHvL6Ag*l$&Qa<+fLnFgbK9T~1-3_>#@h1g|nUIFyC24_Fy=
z0G8A0%w=zB(H&7JwKTt|f=w3&cWKluYmwGe9}z;40khfMd6}cwRv{FGicXEfp;QE2
z*g2s|7aXW#f&rd23-U};kg68+1>zrKMXqX7^z;w`Hx4Ks1m`EXk}=W@l!v~vpTKoY
zv}jgxUie)zZ9@92-VKBulJD_T5O0h8#WIsj2YdUzE`qniH?N20^}j<KrH&X4G9U|z
zS*ML6yo@<Nr_rw`4=z0HB%O4P7~8q~v<~eC1yFvDiuT9;Vs3Bn&9sR630q`Cwgl+{
zC9G`XSCfBORDWPWl<S&DxU6%Z&o^%xp9z6Wg!z{zal-X5MUNftd;SwzFvQR*D6$0F
zA9<k{^JCZKiitFY8rRyJjP9!dlkb8Ix;tMIf6P8DcA^i>o#LLts$ZYPjsl(u3|$yK
zFkdPUAard__gm(>CRW0|Shn$F2VPf5?X>tXM(XmxNYQWIw1FbBx26w0&ny1Rx7Mcw
z5IK~-B~*BWQYi!dRNaLDF^LD*<tG-QYKo~6kUIBshUh!D&h+75_|J1FPC6WZ>3FWh
zp(%~>Kp|ZQayBZW)EgiV9qUG^q2o|xkhvsI@@mwgF!R6%Ak=CDLBdtTS2r<qq9<mR
zh7*SqSUhOa<{Q$u31wRc#QJ$v);%0u7dbmek^>QT<U}@0zXdzea;$UUXYt!-iqDmc
z8)fwgSxU6J7#u2Y-%(|Q6MKcF&}?`(5`AZx&;1{U?`jUK7uZRX@UxhC9>ds+4k&-I
zmvEq}s!>v?RB=3qrSH%X<?o`4+e4|$kCPzuLs33fMa4At^s*%QS;T!J7y<}~>08R^
zwCL>bm=&3M=HfzX%Y{9ZW4I>Ul=!s9j>>}U$1tyuVWDD&xZ8jaP87Pa%wTkHgy|PT
zOL`4BNt`1VwtW)wF!yZ;i6#Uh<V1XWju>!NmuR9QFl+XW^jPE?2n#VV&xqUz_mjdD
zzgDUeZEHE!nXP?OpvQ`l8NBP)VP6l-!4laP01z_rfs$eHyJA&wpRh0}sh0M5_Prmu
zpLz&xIO`7LlRpz0)2MQ#aBu=-UXYk95;Ux_UG;;r_ZZe2)?j_t`WKOJOh7_qlw&>S
z_@>i^a-qvi)sRrF0zcaqE&VJNQ~C;3qBJR{Zmv>1K_7ePskK(c<s*%1k<$$Dba(oe
zIk#;-fAr9tjW&WmstR=e&0>U^6p4Qv7L~eNBLR!;0P9y-Z>_{3m9PHGcW1)KI+JOC
zrdc8Dy>^-?&2CKKHFQ2p>Dmd{<QPZI9jov%a67ugpy3Q5h+(l><b5r$ffts1C`UY5
zT%Q6AP&F34qr&%hNsiTKL^@;;&wv+mXDm!1ODU%TOLuPaTRQoF%3&xzgD~0y?YTno
zz&!BtoVs6<Is_ABN`8Y5z}&?WQD;9)VXDw?zTOT|3#C|-C^nAeOT81=J2-iX#sWIR
z`MOaaR(TVd2JG5dyV0){b%P9^EgBjp-kk@p^HIHbgU8Z8qh^vg%fKt=A2|7O{Q2sC
zA9fg`KN(JYa)kREXE|G#CgD-Z88CH_Mqc!ms8ucgPBP}<#I8piW=K6*%`ZhI)JZ~^
zZ&!8;+SYgvSC2Y((v5{ox{9X^7mVev%}4#EKPak9R^oYNd%i&h;W|AxCgR&#B^nLe
z1as!$*5V8COrUIVk@pDHPT%zz9yVqK%a(dLg%T>E$Z}%X^N=(aG(z*mowkzf(T5E6
z=dIAmqkGsL^nTlSXk@2El}$kWx9Q>bV4^wkMJ8MIVX1=$pM1~LSO<8U4*`F1zWoR1
z#ttZ>rL>{eIke-&1NR`9k?Y3JwM|U#lpjPRTOzW0SJuH{4_`4SV<m7LFr@-tfM6E8
zr7kbnmGwmi*Kt0&%Nbo=<0|AF`}tg?ySltJ>M`<LD(g%-;_RdtHct}y31Zk;=RN>H
zSPxTn%q(B_u+AdP%Enndv8S&|W|N74DibG;Y2w6~`UEe21j6o!NN8%kbc)=!qx|W!
zz`YcFP*@2jc7b9M{ZBeCnCI}6-%Dml(`hNF45_)PpNN`-mlgPC<=S$QqryjVQU5>R
z7)^+>w)go4h@8xrbCnq6S_g%b3813v!Kkn`#-!)(jp%$wazzLK7ERe!r*p`Og!4IH
zGNW-f?#iT+VgRJrnlvW6N$>*4xXs(Y!ETO~zeIdMl5#DC(pNSPFU|ez+bBnx&7qAD
zkk?xXWta=O91kvAm@^-9Mt$@W8W==cwe}1@*3|Pr6!>OCPw=>Tv}Zd^p6Dms>_gOB
z@WEeoXzLII5uK1GOT-`?mA7XEtqWN(Hwe^nq`xHY7~$IyqD}ldjR*dn#vzh%^7hpf
z{m!EHG;})#Vsr{<1i$CQNn(Vl4|6$i2Mt}g<Wi~aX@j@&k1};w_FJe?2DSqwIneNJ
z0DA{Kk>riX$Q(Ec%W3*NPKb`5k$YFXwUB^~e3~>```EzvWWhXjMe``lSVc09L)1|l
zMAIqUq+)oOfiso_9_X7jvm<s6Q<o94oLd$HgX3zTBoM%w@$_3=`P3^3D8^$;g>1Hr
z9LBxgR(Ve9K&mow_MB}B?Ms?Q-q-tgs<FTOcdE5ZTfB?iLK8b;bkmuv?dCehypx_;
zm?oL>m%oMu_URiUG8|#?q333;<4Fi3^A;1sLi))S<O<Hw=S0@D_^}0ck}jOcxrOH8
zig#o?zr&3uw_=PhLRsy3h7UGlttq0o!J?bvs!|2bk1XjdHYMt1mNkCr%6I0Kt2Z|;
z4akp{RJi|EEDtvdb)>G9!T8O*)NWxh7sb<PydKwhDLHxsC%^Y)W0<Q=&~Uc4P|r;0
zecfUIA1ax}=U?asbK-(Tz$6^5LROzv)JlDH0H)GStl1z0P8RY>2_ais-MP%3xrA)B
zGHKM+ajUHyNkjEiMp#hLt#g(hQ32xc*HE<*L>Q-d1`-95X*0dXULgdI#GvsxOIQ|0
z*pH(~juKmKhF0>Mg5CfN&MaO(-i5=|?={T!wO=;V!W83P1X*^63kssXltfJk8d%9)
zD%Mq?_o1<6CSrSf&P)BsT~P+O35u^cv}(u4Ji9rPS=%%52eo4ehduP1`9EabP5e>M
zKL>97pe6}FJ$XY7O!c)i#Y&B#=T*!pjJh@mC&XCNY(968y|m%aAhsFveFcNz9Q7s0
z2fSED2`;A$)4$EGD+^U}8<nsJW^)~~F%WB2XG9UAFfy8xufg6U32wDef<L#SsbOw2
z+C#^c94LB<U>zqJ24bf_1Ofcy*nUt`G$ZVR2R`lx&EkIJD<`fw*2IgmhFOuKZ~EOM
z*Xo<*(n2*#CGol70R@MfMiwKzYvu?U)Xs*f+c;ubGKr`GimEDCtGL2z)@|gZL)*Bk
zIbP<UVRrIwyl-BUi(ktkB&uu7K?A5cB=;W5c>vrR<b_He+}lVX($Q1Q2J&?v4mnH#
zN*Kibur_TBn<H<l0`QVen<`8Lo|I=37yTK+O`0Fn{kxeAXa&QR{^)x3cUzM<K~=>s
z4zOxO-DVoXx{|)b63hx}Dkv1Z9azXc+;fUAAS#`n*(vD>lffy(erMKFg5qzIoNjc)
z{BzzjJo0*^d+RCIY(_yB2pWTL@>s~qh;SlSz&j_)YzC^*$2;nJ8I&8ZV4wL<dQFZM
z1+YU)C%6fj7ktyBMqDg)?hIBrzn7eGIL0V~r(DwiQaPD9ZZ2f2DSKP4bF@c>fBzzz
z(}rYJ>puu9)UZmE%GO@sGNWaeqV8KJE&p;fz)!zYh3Uo<*#)E1h$)T`TZ@Z5&{=!P
zbD>K65|L@njNanJphT0<Uj4n9yZ`VvVVMrg)~q;8%BS?Ju}6P9fntqVTXHlg$bn;>
zAGE$;gv6ns<NL-9xl+TiLvZ8GvAXJ_JjlitM)~vL^TO8MR&_?|j8!=mo`P%7_CKdo
zn|Z9*txd*?)9-!{pB9yk6o$h_5{3fJ{DsPQW#r}|-*PZAu%nHE{Q$m#V0kh*uhE|6
zGwM|QH#32ZAa*U>k<@obL_CLvf*vkuxiXzc_b>($%JbBzy0WPm@#1&%OB?dHq?QZT
z+1*(M_yX@2s%wWPnwx^PU7Zzx@dY(g?Na$BUUXWDN$yK@84}E*cn52>%!??=*FE9r
zWneG6I$3x9pLN0tMR<b|i~s_x?oPur)oW}2o)L>M`n1{ZY1uNfz;Az%)b>YU{+$X*
z_#bM^dFsL{Br~;0s_Cc4qf21<oC-Czl$oKh@F7yec~kNf)}wT4l4(&-Wykr_c=OhH
zrdjs9u(%*rDz*<fEb=^{RE{}&3Jim;`WepyDbSk~uD&qYc|nK&vVh9Dk0t;Y8!0yP
zW~*dLRvr#H3Ojp55++o;ii&s*%<;A0^?(feTxmVZghvQPVD^4^Q66k!yIG<s#e{fV
zRq_4Q_B8RSV{ln11?!pA_oayWa`-z})TR2P1GO}(^}k2sJ5!rU|LW2D1|_c}<Wkb9
z!jyi2>#zpe-Aqm%M~4{v?60{Kv$nXIrTQZ3h`gfWnt}A)N;K+h2a<A0`@3@W%yM&X
zM1C3@q13PpIFTMW7_{trSH=ij<Iwq{goHTmAFDD6L&xkPvhlHbu<Rbn7X}i21h>Mx
zMfcz)h(Rp69x=Rsn|7WRYKdcV;<|j}<-oaPH`}+YvT4|k9*g*9Ph;;pjxb{or8sOY
z*DqJ)O%s^3PjW8aHIa$0w7=Wq=-+(*N6Z`&^kJ$;I>)kwMIAe>wO4G6`(|oqKMPUD
zF9c^qaV20zfdVdKlV#|<Lbr;T%Cv`UHXSD`x2(@~Lt`U2V}nIZCQ8NLPo_{{%5x*S
zoQG^_glX8pOT)(507T;vmSMCBcI$r$Qo7f#-}O@4M-bkEHisq9yko+;UygO3(MZFC
z-ZnZO6DBD?*mqtePmlbx%%g%m8J2G8)wk*EKAyrPrA$EU#A~)F6?q;y*h?KerV-jt
z<=W87vo$WIzq$M?HJ$!w=zkJ{oLPc5cg6=t!x-1ipWJSJcY!1&YfRYcaLCd_uoo(8
z9@F>t=vOi+zn1VmU<4`=8pg!8L0bzy`CE3!Ca~ZLOuWC+Mgu|1uDq{+NGy034S2QT
zA=-qUXTX^2kp9@g%?g(YMtw{#?ipxRqca4^+5#?UwD4GCCb{(8v9mluSU)RdLOQ2m
zu`=kTT_dpQkon_JLgS8p<<u5$NiQiBIxL!z8g8clrrNQb+j${VPD<aOWttDH`&oyY
zr#R)(5mc?sRT;*mEWfA^sx@zHk_34DgP`75F6vc0oZs{EQ7f63To@N6xMv|&7{<*h
zd0NEzWU}q5=mFzFCl}G923HHE1M-lp{l=PrRI*saimWim)GB?O@4v<quJG30msk3X
z{O82af+$V_QdkV)6k+{~EiV)|{0ej{JgTir{i{Ajdf#RWC8hLQZJDR~{N2$oVc}nn
z$y|LLO(+_0)JUsS%vk603v@50a`e%|!^3O8_ZA$2AYX_`koIqz$B!)|)Ca<~Lj|Er
zhTOSCR^wC=HfAX%jXreg;tBAyd-9oMCy@5e{e{x%A1M8aJ21oy%}dcrfDG_CMBu1~
zOEfK1rAoOqQiqtwkhSPE?wqZ@l&4?U!ip6^Le^`;j#BEJTxH&vv1wd1)A_Kjgww-A
zN^A%0se@mKmLspyc1oI4vFXy)gnB=q;g1(Tp^?i=)8DerVSXYVkJZgl8SANdE+Qg@
z3)ewLRnT#d@wuQfAtBi7SwR~LZNk&U;COE=pKxJj5>96Pi8-(JJa>5{rIat6I3FD{
zy>~d3I#i{IIb${h7v9mkK&9~`wDd=Vx!6qJYtrFk+9sm^9Jzn0d1Y$ZjHkwdBQVhA
zB%=Y)w?sD&pb3PJ*(RXAFiT=f!8%&l5lcgk)eF~0>|g+Qct|4j_7uCkUvzhsg)M{8
zov}`(r3=F4m6nrhnwvH(V|rwDxvd5qMe(%GBT43{0@{5mLvwTcj5Pv><Mn;XvU<f&
zn||7^jFXgAWu(&yDV6q6%=+40XBaPzJwW<kP@ylE9d>NRWE@AOH<lP92V}5|8KV^u
zt5tLgXhH4~@d_(nUO&O@->{~THDC!fSa*?HnIb;?EmE{4H{~rACgcS=m@b}++<vjV
z5TdWeXgVIEs#KnroiL})W+)+rJBuj$jVKf|Mj)d@V_<5;bPXC@4_qVHKIe3F8-w7T
zKynFw95fu7s_1r?wxUT0*LhIkwJohV1p4Ihz_+PWS|Lr0CH{b&ae<!FB+?{vet%`j
z8@=pqy|X;xz1!t~kfdvFl!Lrf*%bo!&~bP6PA}tiqJ8;aaCYG06J`w-SCOq&xaNra
z4$z5|c$z~u<a9wD@P+mDR@{NXRL%)i!EBkVR(DrQql+VKCWNU*my8}6y=FE~$sNlu
zZH)nEoI#u1;W);dm*bF3F(A4U(k>{qKOg6xLO=1kI*w9gWxNykJ@v&s!H>nW*$~+7
zoq;ZaqW(myH7h*WFRnahTiM>K>F?0D{T*>P$zS*C^fb(aW*a>te56da(?d=!*wul;
z+ez>8V25y$F=O*D7_$C=p;GZr_GdIU$hCp8llLwZTI%Z)SVm~5Q}6yr%8#euTB{n$
zSi|1x5}YAkG@)=}<eg~A9ZB#swBK21?(@+>yI7u0o4ctKW@O&^8*@r}Ib4oq%y-1X
zd|{#SXUFUB6?X5~9I%<ML1>C-MUh(@I}(jEvy%FqRiwKi`f>D8$R>x8&e~Cs7TXjN
z^o<Q^WVcR3E(gdA#G<m+Vd~r@oNMJXu`|lnUh{%l8<Z0=2ty$sCNEL&D=0>@<bf(4
zeW+ptjWO}{8u|V~f^I;@M2ifajA-IjK$&g1#LDK+fL|WW(*X@l$><%n7MsYVQKDF>
z^mV@lxB5r?ench{1wzn(1vdsx61&pBEYp=hWEL62j4@Jg)sV>m9oJGTuq<A?wFbpm
zo+c87-xrZC_%#}%!gtgbA*MO1s5fF+1(}FB`AB|8TTr!rm7xo<P8Lm;$x_f*o*5D~
zO_rYRrAP{<^UAYD0~)yZ2xzNOIhib5<51<vekmznVV}}QpxyB=tabf4sS7`{1V_X|
zqjLcgkww5dB?zOg`r<F&82!sPg{)vQOLei@&KXopZ9av$PSlo(pSccv4TMb2JQ7ty
zN(mNNpgl5m3)^4)J3=kibaC&MOq+s#2->Yd-9XzMTLOA0cfTa_=E{u_;-K6R7(@C-
zG~43oKaZL2Wbr1W?9ubt+E5|Czx*^c<^qH7%`7|I)ojYv<0XYpealWA8@{n7>|pV*
z(_BQHP3yp{Gn-Ii7VBf2pik*UXntV@_vMr2g;H^5l$7_N^D(Rb8T0qcJVR#(FU`{X
zty5wrL>Oj#kF0O%Sz1}#x$MNEPB%L%X^wV(ecTt`_kXO<rKW!?;798%Ix0i&7)*>v
zOs4V)$vEy!D!b|-g}4_~HzptXQ!~Asy`B73OW(v871}1VHAwgl!Na7Wc5Yd-f&#uf
ze4FEGSFeV)As80ORiBJkN9ZXYuwG0p>E}qL1LDUc0m#0Le7r`@6y_33iNDz)<R2_N
zJgH;CQqrvp`G%hGj9`$$-mmpmxlWeHzLx=xu@Uag{<ZlM&S|F@lviHN`w{Mjq7&{r
z4kE%IJBhNWR<f*;Nc2sxQofP0_)AvBbeM+OYL&jPAN8L(RU<g=3KCguG+x0+9pa(?
zeoNY|)|`>!o1kk+@ZD`7K5W}c3xx`4a9$&sd;6UuC36i7h&ow`FunjYqNEW@(B=5l
zjg*t{y{R@wD-%YM#GVWt^K4IwAw10a8aDN#CNrR5a5;#H{I|?1Z!5YZGL5->Ih<T0
z^qG9LI|7R*T7TuVZhzk=j=Yb*HV|NkO!|{4S$Wf%k<g#GB^E$)mLGCCV|p@re&}vx
z_zDy6Sqv|^CoG1RCd=(*lWa1+^5*yHR}Y6Wx=71MLi93tUWH<PKnwZFOTOw-Sf>nr
zjA}_WIa{akp_!hDi@H1(Wt6{x$86}72oQfV7fkqWg%xYHhPze8k}z?2V(tMf7y%At
zDnF7$mTL>N&e^sDP72QoB2{vV*Hetyk7I0c;Lrn#6)I9q)f|YKH>OCXgXo(YMo^t;
z%b8M#I#UHRZK2>0AWk&VtyC!F$^}8~hRQ2mco|zeYu6CZee~|n`vR_fSLiunldlLO
z{$J`DdU89MDKE6whhV@SK9_LphNuZH_M*%>&DM*VFCWuPET|1LKVX<r2CE#k#=gU{
z9dic&Y`&^mTa-o~fxlI?6A7+jp49FQ*jnlsf)BmEC5D84W?%nK@e~fX5*N*QJ=<Xq
zYUGuj7ctDkkwVHdqHe(NOv6h>Qq@kP<m}(Mg|eSYD15u1Sg+0y{>z=)`Ab~asv`9?
z>(CbZwEkuhf_JSfQ<Xm_UdLMBq!y&%{;!`Y_%9i7R%j%0VyAg7jNcyXzx2BovD6}#
zD7&t%GV23$vyl!fD1&nWqXp^6L0Iq~zHw!@SYASbC>-2M5ZqCmab7SVv!WKO8F*??
zJ`AEbuLnv`(#PN(8xu4X;Fg)LV8jWaQsJs&6)6KdgLBI3>>1P^Ni5%95W0!N`?4Z@
zAk$`o(!U=N#ARbrn)3y|Ta|xYag->WnY0q}X$IAD>KjNI>}Ls!jc@a~@KENypRTUT
zREV&;_<@`l+d%mO2$JJcfcRgrHyjqcGU)y*gTB}FZ>Jf{#TKGI3ncx%!Ad3nm86^Y
zpe45|b7g4=y-ZFyVk$5$X0n;aX`B}!^O81rPk?MwFzl@ZyupN8y%Z06$B1Z&q<%`J
z<vJKd7Xql-;gaMXQy=in?OrD({^b1Y8&!AA0r|a@)ZKwD`Wi7zjrGwUXz)3(E1Xo=
zVrU*>Ifi(Rv#YY{TmzOEIc|og&voymu4Z)w0j73ylO%YvS==N$Iqal?quj?*=(cWs
z;a>dw)YGjHP>|cxT#VEw!gR$<fl@!3#5>tT+%D~JZ_@{s%g^69ue}D-#K#%`D75vx
zK)*!3O=~L!4)d`B+33pVJDNcbmN$7|Qi__%+|D#8yA;=Ev}3CRr3bI5!0I}_5@hbh
zRVajZ;qNu*>FJ5EGAOQ-xS$hrT=5WJgUWILRiaP6`JZr1#yssy;R?bfOW1BXiZRCv
z7x|c%8;j1ee7a$;h``%us-D_lFO1gR1<Q}4{YrwcNIWXz2w(`wrC?-oZ3R(;s;xFv
z9P>`1Z}vVeNg9RdR9tq97T;Sv=02NKh3K%UZk-0#x{Bm*0P?{9R#5tXS5WaRP3~)=
z7IScqp$*{16i3>h139g3N28(izL+7ISUh9h5s?RfJVPR<E8WM@EqLbXcbm3^0RA;E
z0wy@Ux_;QpalJZB^gzBed~4RUULL;A06SG^J6D?k+H072BuLH*MMU+{M8Qy7=s5-J
zwyF(>O*7xm=qAM_8r9Jy^}JT141#r@x<jfB<tp6H7;X;>@+edzFQM+Z2JitCH-BlF
zA0x`bj*A`t>A`Zg2~Z2aZ_d@@W4FDJ%TA$_DC*JoSLNXSM>*&TMeWb0zWITA2iXe=
zFqU%>&4JFdOXuHEFutAol9|M|3Wq4Z56$nFn|P&1VQI-IPr+E&OtM!BI8FR73+U%J
zM^>N1_Ub>PN~b=lqPwhXa;aa3xHz?)Q3$=cg=rZdmiZ}=*YsSjD*4vb&gPK<4MCY^
z8yP3wQ^LW9+`|k*Z<<5@y)dU!M_O`5UT($1b#Fa9*gq`94gz<xI#+PGR@bC8Lv<;J
zH~eOLIif7SdQZMxL-d0--s1#ekRw71+RZDp?*6me<rk%mZ^Ax;9$RVa_fS4A9zF>t
z&eMfupwG3!;4msf+;uGuyouFfs@+frwd0q64N0W$+60xar_Y<V+0gF*%t!%spIiH{
z`3T1c^PAjG?yS?kxe2VJrU`T}!m#xoe56bplb*uhOAIumuCVVRIffbnA}utdcw(R@
zw?N(XxQR>S3D(GF_I{n`aMjp_n|e!P{Jqk?jrE#!FPqMuC*gb6cZ+lV!!)1o;U8Q2
zfn9DyCG&pl?*m`cUH*U5-6Z_swB0811K7y7#ch!#Av`&<vb&tgq}qrm$9$&L#Q=b%
zGn-soa%C8#qrKPTF&VCZd1OlPf=%^|%ip%@c_2L}!4a4Hr{EjaYB;DrYPh?)Z7i$^
zIle107p_c!2idBEb|byTUy(ZzhLQ)_*2wrlm9Z=|Ow-%VGn#50#*rQmdq!HOY(RQJ
zo838b`Ra>iY11g_#7N!qdy5z@_N;(X7)n|9l>x_M?u_Oumz!aa&{8T_cz6i#^*Ap7
z^9sh&bojsE*X0aKB{=a5(Ylg8BfbCVj<^c&<7>C}69y#5MlDjIP1=a{d+rk;BOVDL
zJHqFJnmo`tpc`jw{IvM~gz|JaBq=SC8z)pw?u5P6ccg=yt~nG;*-$xPX-C2{GS15)
zV@<f$ftGlgfPTmFsDpF*7I^z+&e|rNL23SvoK+mr^RcUK_!3<RY;FWUEPrscj`R6i
zGH`TiC%JajbNO1G&rG!|SWo}%#D(Za#{qtsE)VR^T2#g2mXo}qf8jL+Et(IJ9D>0{
zRrq0^L93L#W*;}p(iq60(m$kw@`b5X_2PId#-}p~%BKhj*kwTQ$w_pvb%atU9_eX8
zBy`xFF4RcZ76tLkTXYzr!y+iHTSKkd>YKMglv9ROK1f=V%o{51Z-^|A0kk6I?UTDR
zijB^syW+D5b84Hu!wB`WS8T+gDi;nnnTWi#RGN%I%hrH$-#c@PDbj0%2Z$$iP2e8Q
z8Wm)zGhWG-Aps`|S_9KJAP3%()Q_Bx3eZYs-~SS8@9QQS9}=x}@(?1fz@hz1{%Rjg
zKi^ah?PJR^Nm_smzIj9;MWTW}jc6aH%YqUHXkaNLS;H7fJ+asMA}APFqSnFbAENTi
z7bs*mtx$YWzfKU@BuqXLj%&<~Eg%#&FbuuNV1V}(3WJVyJn?Ig0lN!Y*t2`OHK_(;
zbWNcl=;j?K!}0f?Ul|619X;9Am#{SzDbeW*<6cmapW_{~>`0*<A?a1zn-e0+h$oXV
zy)0Jh$L>9uj>_Ldo+*kxG`e~s=iez?c2zU+*)K#SVTTy8Hl6%u8?4IT%zmQa;*JZ)
ziamY<YotPI@>|sn5kwdx5lmQ;$hI>z_FE%T^*KO=?!cRb*eCvX|67$ZC<)3O<3svx
zE>L#g>|PfiMxWJ4vIyn`Ljw%rEH@5mDECM>h;64QO%ML^XoT=BmR-|)4Q?cK*Glk-
z{w2t8gvrGX>^P)??k}vs<cR5M)n^f87;WboMns_9zHdlJk~~Z*fJP=9zG7=4Mxw0U
zBPt+07fP*{#&vPc=QKn2_TdY9ZSd;|;QMz3U=Zx#TMYb^Ht?uaF^=d~ec_;}5E=EZ
zcAL9g6IZH4{u)cuID0ipSe~*Y-4<~g6E}_79gDsikis}`LpWLjKoNe%=d6Vj8EyaB
zd2LFPHnDq=Yc{dZZm|`-XmX*u9(Ir#T^js;uKSyLRt6Dcn^!W!l(>dp9ClQ!R?8=)
z_)JwxnY_tjRuP5=bxs(CtI_HbV-{Y^w@i{1Z;Sn7zlOX*qs!mspLRey00Z5;umv?;
zX!t(grcCrYbj<f9hFjrLK3Sf=ruo2Ott&PIQ?CpPzk>GRI*gNE(2L-_j<w?D1U6Jp
z=_p(T+5BvI5UoOrm5vSC0fVb6<jZ}E2{9sPDeW4cI9}Hcl{z&-0^6eK^ds^@QayL-
z=88F5#Ih%D>kGRgQbf%@0)65=Fyw>E&KzU2aH(Qb91}<G%PIzP_)w#Cq6?o72YYHK
zE}A4J{M*PMuOT!4?7tzi5kM<J*)w!;O*`Qc<rk0bN%=dqtDTY_Xw>0)g#4oz`mBrv
zXe=v<8k#jX9lKbHmX8N&;lz9bt0;hSK4wXpJPLvpy9^4g6ZA@YXhx&3Q^_TcmjO8(
zE;)CQJ0FXBUGgLOF=vtE<q{}3ONmTAHR0%O*4N;uuy2wZ2L$N=s@?d?l-X0C1Ekvb
zFpBh5)_qJ$?8`CFVx~eAwM0Fe{W#D_&7QTlBn2tXg_|D2Z#cEwxV3oGwU6?0V}A&e
zZ0+{^U1@&(Q`AVxFfG5eN2>LbbkF8!^TzETJJFm@q?Cf%mN<f<@m^e+d+VfnT&fxs
zdfy+~*b~^iE6it=T3m2X=r>>|0+k1_yHb|qz^23|4W4`Xp6_oB{E$cGyWa&<=5Eba
zb}B__DF`1=0mO}>LcMchitXIrjF5f~!s~aFBJqBYDDD;Lcj!h4)kpnl+rk5GMOuvB
zgIch?1nayR(UAd_VN_jSMFu)~HeJ2{QuIvq@Cb9g^2NgOGgNf$voqHRT0@;oXdLy*
zioCtCwc9B=gW!g_S6u&%pS4~KX|8=S<7@Xt`<oJ-)^qp9bXh#f_=_S_*<T;(xIxaM
zQ!p2(=|kfvTZA0wLtOqcFwC%U#!wwxJ4h4o@M9~TeSUcgEg4%lIB(sF8V;}0qgY!L
zJ{!2?%}|K;%OTdoo<#9Pc|yaEe`#O$buX&Ahv*~p?aedmy-CuYfi=c(z*@et{}>v8
zZ6Fnk<Ci6`T%eJ>q`ioa64dU5?QauOSuriKSQH*A9Lsm!7Q|v*MXmvV(EOwOVx7cc
z3%o&>@LRL=bzKwrX9|xmuw}?8Ndn|^W(|nhhAN2rw4pNxD~PtfRedvU9`9=#qZedN
zmnxE0Jt;DgaB4;2vT$VGY=p}^^H*mkv>-XAM(CrVqlw0PDh<Orqwh&lR%k`-?4vQ~
z@HNKF4;|;s;B{lEubt8!-=n{{1W{0#&xI?4$p&h-g7Yi9*G{y=De)Gt*0P*uCT&A{
zIklN3H;d>HFJ@#85};39sL*c=A(;|Z#e3uZNLbTQ?4b0>{4VyI@4S@BxqXvuMfh^3
zT^Cmyhp!zW_CHro?Qch@>!iAnLlXX?2?Sppak^aS?l{OdxvN%$5KfSg!ly%>n#<DL
znqI;ZrnSLm0bg#hnlldWL^;ruS)f~x!tuL;;EI<lr?)b(r|OV4B2hq711&=_!F8UU
zzp0w>GnUr)2WY2Rhf@M*k6O{@z|L}o&cY;fBztQ-m~g5&z0*wn1Iabayr9DPs07$W
z?K=IVQQ?@n>AnCaaJ{^5Dm}I?&dMS**b1hetJ<KBq;Jm7Y^2~)u=n>~-m7dm{G%cp
z{w{5XRa#3>r+NGue$y>dT;AD5`KW}p-+7tZdyF?k%pn)jQ!I9n93(?~6-!kEJScAa
zYxK9^#-n_H6d+qLBY_f%&?1~KV^Z3+;vHEP7iBzx5cqqymSVw9%4PcdySl>aJ5v-}
zE!D%i<x>J-NLxPT1#Ow3Xy}Zh6kLAfTibJj&f>ngW7Col(b{Y3R{0pqu;ozdE*|5u
z72-b&9x(MW+#*xa`)2OEtjst~EAM#dw|*KhuUD)5&(&)B+YiW0)c<k1ua()f=ZzXM
z3EfR`+Dwsmqc{;=f-1J8;j}VFWSz}h&W&pz)QIi3kKlYfq6!MIF<vp%ZoM>gQ6bXg
zv^TyTuqn>`?kmM*P+hY(484tgq3BIm+m_A248Q3emh~oB+UPCxd!}U>1I3HGoRXRm
zF>4$)e!g`=z9Toox9*hlZ%vEl`T-^tH(QlU*%VCeu13G}`T;T=GR|u4&QtqboE7l(
zw(@)+{(^8m&+ydOx%~Z4NPDb^kSJz^$$1E%r8Yd8{D{H|dPuP2C=nyH!EZny7si8)
z!Fn88!{8bCpzQuaRL6U66)Ja&T52M&XRb5Ip96(d+TZR*AHI)=n3X8=OJ)eVq_XkO
za0m`Lbmj&5eaKmQvAg<!G<KiyXL=tJ8&6W>_T)C|#c~TAH6J@i>m_cYgS!NS(t=4U
zP<zFrGvtM^Twxu*b=3~!Tb*M-ZAG?NQl~G9t(=BEyn(tlB(YQOP3JtN=|PBZ_)!9Z
z`a1<Hjqm17-26YG^S?<_sf_{FX!hZ!Rw`qqmBH95KMo)VW40Q?*0_^ic`=}g@{1eh
zg{SY=Y@a%%spHMouRN#?NW`(sp7oL>5m0HN8Ljb0ZoaJ2+QjoGjMB3ZK@HZC_k%D~
zejIw~g()Y++y-M|87Z-7t@3lo=q;n%l*V+2868c1Z?S7M)+~xmK520mo6oO<aKZ}Q
zA{UO=D45g}R`$)qOB{hPS*+xl0ro<Lsa7Lx#oG3$#6$Jz?FIVK0`#LiPPsz;iYU8B
z^P7MnJDIp+rQwyo-}P_H;SXAD;2hKl6@CVKL1jCv((nM^1%hL3h8_nJVSQ3XcW)^;
z>;PhubT{&l;w||Il8YM51?VP|HB+Sr>!Nc0!WfE}yReP^HBQ6f&)Tk2F5CFAiD#T8
zOHyk@57c9C*5Es=dp78B@r~xJbzL;YHF}V%{w!QBmw4n*jPE_TnAE#-^F(f5Y`yu1
zUY0^b+o17CvmPNl*u{{stSg@OQ8IvoX6{3O`1sdiJ*hw)=d2iVWt*KCPU-Sj%pd>3
ze4`iYXbUakM+Fmr8W*z=e|+Y-p!5cbh837aI%0l3#}4+p2b*uDpYqrNN<25o@CZvp
z)Dmb$HrX5Z7jYU*sR*Ay>?UEJ7p%LMhU2|GxikH5xh>QiR!g2Shp54yU|_?vv)a_t
zP*-P&ZacJ*sEtwR$L24<`}DM5LY{xN)cX5167AixiXFXdL_|%q#&X(jo1Pe=2fUJ$
zyu}#(4-g)Smc{7Hd_K2h5_!WDouL&+L45Ub&o3*JxROB%ht;50F*fmUTcc7*+PML|
z<G)bl^_&VJ!pwx9^=4A}z-C|8`5aLUT_efshN&rUjWa>|t`^mVs7r{G(S8n&S!1O9
zg*7JjD(|VEmfepQlg@|*VxMzKgoMt6IINbKsdc=aJ)F?*+Vmi`cZhmQR{BMZ!r&$5
zzbpXxOeQ{T#K~*;0MVzo3-oNB^U{5By{t6A&-!uHfbg^i%Kl^YCv8I+s_Vj?Z?wMb
z?F0y;@J|hINtcLU5Ll5lj2x>krCtgDzs@EZD<zIKCa*F>>L=9{IPP^%oI%S?Zz$)P
zDcL+X{pMH$)4Lb6O@nMweJ6swk~dmip(kQG&S2Mrb+PtxLDYGFNn3G?2x+vDFD23R
ztlr+|a_~69$X#60WM&$+mz@;LQYI}xapNWQjvU)9<lItxLLca?Gmpsq;%)WGWh{P^
zq!b{<*b<R_7`eK0iHEDEREBga?jpzSsCVS4^kXULr0s=6??lb?$2sAlsQPQI<ikJZ
zAC%FSNVOU#W|h4%`?z@$mSmuxGB>mn=FDS)9xMqaDIt})yYo*58j73vwDx}8=^)xw
zx(z2!_*OPaL5lbTKxbw+F`Bd%NH3dPo%2NE5<0KS1>Nri(rU6eKUFqXp|vdS#ZZ=e
zp{@*Oggwurey48TXX$+2eh1weOwAU`6^-XacdgdOn=AwRVI<&XF1w!yJEM-Qn3YBJ
zBLwOeEw|nLvt%MNw5#qw4w(E~s0B~YA0NCRH5Q4KXyQ2A`CIoji2dsqI~OEMlQNMR
ztsaRlYSYI3$JVZI-yIWFWM6c)uzVuky7QF<Lp?|yn<bP2dbtKm79I=qZm?z-G37EP
zj%2f8SqIKpByX5(c7-69?*MxzR6V0>t=!i1HrOMm3RYYWEbKJNcnEtEp3W61MHkIH
zS~3FrfXT>088mgpO!Cn}GLW{^fe04Is-ksjmFPF5!M)FHXtJ=anu2@zKJDaq^>BD;
z!pU}kZ9r*dZ!S`9RkoAib-ts^HDrG#jOF$!900HU@QU?^zgYjv@8uVxh}-CO$)&8F
z*hsLeN#mSorrL<b1ISu^F^Cf&xX`L1bhRKiMzMD;6szodjIzL34<gqOr2}Ih5UF_1
z<C2m|BlT06cr4PKKSuuAk-OgxQxy6(=Eh2C49g<gIiPj5*7j}OE4Mb<ayvzWtD5l#
z*&6oeD*QR-ZfDxA=O(%Iwcd%t%yM<{&Z5xotTADVkM`CZl+G{3@t?-0isU<bB<4Cl
zq79+B-S;UAI+oNdy_JfmtKvXtA)p9}Tm^=|rg)zJTO;F@Ov@$8ZYjGCnLh+3<fzQU
z6=lwTWq~PoH-gqu=I0bxL;?@@{puM*#-^&G$<Ie$LNcGA7m<*}OrL#<u|hJj<r(vV
zhxslwgbB#1x6Dd~0<tbSi)~&mN$BgzG5Zw9B{8Rm0tL;zQu#ZZF{?De^-a>uaXgJ?
zA8v)KiK3|*)0AxW5W>;NM*1dGVg;39^NqY?xwIDbeR93XgqW3$G9=BOCw^ZK{-oF8
zZpE=D1y1No*T>b-%niA+nBd;QeUu7+y>J<?(wOs4lc`cXv#fs%g*0#&-%&Xi_*6xw
zH}R>B5x2fXddhoY>L+t-jWS?}e&d=W%@Ls5w=`kcNrcv!Tr2cJCCOgcHfj$!T&<pC
zA|pN+k0<4KY&Moegq>lS{iXqNoqclRE@H@Vmn6Sn<CD#q9^8$D#etaNo>H4sWKFft
zNz8nAgD9KDIYI@Kuvb}>2itq=8KlW&qASZasxL)rBvNOMqOK*sYfyl$9vvsr>KJL!
zT6RC?eNxrpUk~QLih>yy$EURJ@h|6r-Tb8n9V@e=KDO^sk^|=YSmkH<Mi#h@DfI<_
z%5fycZhW_C5uYO1`C#F+xs%01RZW`T^^gU7Q)?)tqBLEyMcHJ^I<~LNaLbHG__^^Y
zVG!j-Ol8=s?P6YxK8l1$Ny*1Qwlky|mfT~0ueA?A|1h{U8(gXEh;&r8B~8X~p$U+9
zkTvb?Wcw=XOu`@L)G#Z*FA}BKMa{qAmiz|7=0mP=dxk7;J&XP><o_j+v-q4zffwd7
za11B?HrFCz8y1@A!EnF>MpGUvn`q820FD5u59ig80WK4aL59Ky|2=}OwlQ@ud~9OH
z=dO#7(GN!X8h+Ta!W_S_AEiRvnU=u@o%tU~`9{mw5}_-dSS;+V5105P>xf;}krJdn
zSF!=>6J5aVbI6h_W)6ANwI(85kR}W!Iq@-Wgv`90*ul_C!4DM^I)o`fM05p~n)yBq
z*vTsTTTZ%l7TN9sr>{)-UrE_6{!K-y8cq8~<`c)0Dc2xs4R8m0$c8u%Wt_}-mU~CB
zXI5Tv?5p`tn;s*}SPW>LWpit}NybUzc%>*LdJ{wjRMcH^^9|T>37i1gd6+Y<ZPYPi
z8Vq5hw8=V0ht+L&S9C(S5?Tjh)s@k-VYpcLqZh>m!7LA>-=3Hv%q>k+Fev~blme{b
z1!Y)_F2|a3W(M|JXkJ#Srt{30kM(z=+;3DH0EiB>p932zt~KC;E(#pg`6zh@IS>$<
zl|JmrN^SbT!lLbUAx6scY(H+da_YYA*OQ;?chz`AJ|*9O7K+J9V19e~ZuS7tqg*=N
zo0n>KD%%<SL;i{DfR0+}x?sm$f&wPp|Jh8=|E&zqEeKk$I4^f_%vRJ$5K9^1aM!pv
z+e8xcOW9F&Sw<h(nknn|Ws<gGZNfYLBDhjn_U=slQwBP1x7=b+eb(KaHq5PR<M}!6
z7-i4u7?Gz+Wv@agD2l#DqL#&-WSQB7;v^;8oZM+gDdd~=o$W7@##?78n{GLzd9D$%
zo-v;Wl{kB-m^9$;M_XMWuL~oi*M-r>z>Tv((LFU3{Z$#MNB@wy&!9CjIu)-1N5Y5#
zfeeVOFi_dasXXF*{8$%6t!1;o2r#k^6W@PBEg>Y@=|6)JGf#LP_9*YcP-3gifYcej
zwAe^`M8k!(u{a{!7m(^wqZ+<<ZK(|Pu?;sA!&aDz13}-qD*HjMn+05%2{E)uTte#f
z9Wf4vF-^b=TGB#ZuQd@rKu(s}vN@nj2I}t>)#rSmQId!kcz$F&t!WqKKbR$>vs7Z5
z^g@>k^|meB8_B>?pI+0*sN;?K%pt?P@dfYK>n`~prQ90%XWe4DiFrjc0FfbRlsO1X
z9IqR8H=q?r5N2BlRYc5_Nv$x)CxNMsPH0~s&2^;!nlmXVb~?UuyNU?9FcPKq<xkGQ
zaeIgO!M8a=A*<V)pg6_0*b*tCvN#Y1rB0<Q(HLLR$)rd3r{H)E0U~X@Rk`a#cyjQW
zLMn}?bCt_uHzASAgS$nJ%z-h)2j7BtLt{<TkSGviCimGsH<$j6WYq@6JAR@xjFl^I
zPXguwsSij7O~H;pf4h@1hA;tnz2YW6VVkZ0e`fZv({%V#b<=r7e0cganc5Vg5lOCn
zVoDxf`laK%;0jgG_W48>KWP&$CjwR74gn9Kpgq;8m87I$Oq!I6*l!vewis$=)<*g+
z;Z}6Q+5Cg#10hONxd#5Iftw|sK9mP2{nYVQ<~MAOCekTG5CGanwFe1O+B|dtoQ;fS
z-L^puC{>vtz(|AB9|<s}CH4a|HeE5)HbPTIFM)w<t<j4MZu!|IZXwh+cN}A9ivLnm
z3Eif5)tpO8Dxquje-_}is|mNFh6Cbip|sxTgHnC}#N&z_K4lF{2RSZA;?OPYoliiT
z^~k;`^JkR0@vpy^9P6H0*sb`CZetS$%Z;~L+WoN)>SxL6a$Bc$JJd0GI2K2C+I^8|
zcp}yeo&*oYx~=&5w(KzB(P4PcTuiGEsv#PC3xN<(na(?1K57pKF0p&93DiM}7f8^T
z5+QUG$tv3Jl>!7OKFYe&dzu{0Y=JX%V~Q9F^qE$;$VvZIPJx!=j6d&Y7XFvPF6}cF
zYUZOyTbxh%eU-+Kcz<jq9HE`!{@??BJByVa2Gj2@>B{P}YH+vpp~QUg@p=_OlDBW1
zaDaTk&z5H3Dc+<0y-p;S5L~+k!`J-<EukbB2QX+N`MJ?6tY1FfO%Swwy`Xvmb(1Tk
zlCX;S+0>Bo@e7rg!%$(w@P5UGTiC$cC0;7k{Ld1R>wSk`-lIu!R-O1`>3+)+!gmz#
zPS<)cm`<vq+;ZXx`<XGnF@|dr_wjFZ`M&VaYm5xYu3tOsmkpUB5rrt@)z*TA(oRj#
zZ}{=PI}$@JIcF#;RoJmfAr~68)5etsUHxP=?#3NQa0a+U`PdKuX6GUgSAz@XH~Bi#
z$C<*z&1S((G+W?k(H2SU9&3c(^}J0@`L^e*u*retRNvB+sQga*F<^hk<$TIubgD1A
zYV6yD6c!zDDLy!|zex>%UM;e_@95x~s*}0X#o;x%=2^ndaw@>$g&sIQ_6bj3-h`tP
zk!5LTjgZ_?T4VT2KNd;(M=TVgSIhrz>GDs{3>!XG1vga|dKULBg(nQbK+A-)aI2b8
zbGlbGRes^F&kLoz0b+SXceP{z-vXxdi{B8zZ38orP!_Qfnj7Ds$7m5jHVck<_KF%c
zuX07k4%M6Hy16_YyeM1tVid3eq9`@9bR7{faAY{H4lB>hMw{wBLyLc|Rao(N*#K}P
zA=dK^H|I{fFYI&o)NOfdRZ8pSw4n^<*n|4cv8J86h*w#+<FGDHIazQ6nK73<+F*6E
zFW@MUu%xp49k)z|2M4C^SO%itfTsAh*((uwzY>uPIG|m-nV5iZOn`}|HKNWK`WROK
zg}bA9#`;IP&C((zuyy$;Rm4qZM@npZhsfAo4Sn2B1cwzt5QB6rV#ayNFe{0)oePL+
zL*tyBVjE9HXG_71v~faNw;_Oj6c;*1%BTsY04LBEn_Q27nG>U#Ttb&-)Rusm#aBko
z1sq@RxM1ExF)=cq{z9^bDlY9mhqaDVN6KTkS)ku_k1(}m?^L6F<(t7uJZyf0&{<8@
zFJ7U;biRbDIcWM}m9u&4VZa>U?7Igq>*c)ujs@0m&^nU+&Z~Cw`nO&>k6q&Kw?&tB
zm&}~*6i|^tM5n<)T51O*p?vCNsGACNu;rtrsH<WT*$n*&Y~fny-NQjbvy?xe4?{Cl
z@wX_UlOPGi61Nbpr68ToKvWkA%aPVy;M?Otu%M5M;9j*Kw}~<GdpaRHtMHD7T}Nt-
ztigofb;bG;b8vSSF010hg?i$vEiqWkjaQ;EvDh{lvs;>MM^I(g)=ni1<w6xK`B%m1
z=NdBjE^L|b*9nbTry?FEF)2+6cYbxX|F@0x&+8g{_ciHI{in47Z<AoBuqYVd)CC7G
z&>?}SK3_NIaUsNrht11yA=<$2jaLK=*PRg8`~y*xDN1TSMM-uCHGr|tNZuq;&L2(C
zd_cubt%^~5;#-u0nsyw+l?PEb&~DE$m7U5=-{859lIFiGK<}rzZa)yET4KpoevBvb
zs{{8DU4gc0e*$#lJ9gzrbPr~Je&M7x3?LHJr>|qOb_G1|T7u4D-VBgIrJvO;!LD>z
zH%_TgeP2R+K8-yyPk$ZL|9iP@EPY0zmL3iR2*+m}LRaAGkv*DopCb)S*3jxV8=C4Q
zZI5sme51NaU&P%4)ir;dm!-yxQz6V+B9YeYhcUL}xJ5zczTV5UevLMSLX<fE02b8U
z8P<t6h4+J?XB!SsZT*lX=OiM@*$z8V=5mRSQ<7LJdc&04NlBm3(P&Dpf>zDV<BlJX
zr%DBZtbd?ZK1VW<BCjCJsoOVTM>M-g`FuhY$HBn{(GT_FLPM--SrgFlY~QLc5{chL
zp?rPoIPt%kolJB+uDAoFPz0rK^_*UBQfY^TPGAmWt?CPWm`a}{>b3|J?a%SnKTzdU
z#xY@0g#XzWHJ&VZ-`2A|<27SU{ze;~vjZ6Fb6ZwkB8Ef`bBb;KunfRVkqb=$#22+v
z@^6Zi85b#yWrSXu_ou}WJvLLinn*G?nx*5Oa|pb@bCV_Lx@?E9d)#rS?)yeHfvWOJ
zOw+IOl+-GkZMxb9Wy-jk&qi<G{CPhsXPF8dac6K5EKIOu%j9GTrCj)r5&iG+c_Hi8
zn+Zg5hqy8VZrXQaLD0#tZ*|{{@D3kS`3h#QS$Pn#&<AcfN%Y~WVp5@PMMO=F;laAq
zDMEF`KF${uctZ{8<pmc(kJuABw|t&L%!y(C;yJJ*S#Y}MIIxr|fvyOD)UI;!r-*x?
zD7hLkVnJyv^)-Sq7;PWM$LIg3dJDd&x9|O%7`nS*29WOV?vieh?rsothDK`W?naPq
z(4j$6I;D{=K@kCO<ec-pfB%Otulek~*Sgkqy%!vTrGc7{Be9DYWXr}2ncB!~6q)*H
zjMHulSTYc)E7ylA|K%kj`w(o8s(fE{eURrKtj#pb^dRV&?S==Fux8Z44nZ!C9n?~_
zWn1{4TbNOmGd84MErmH_imtdqir%Y<^`iQ!`g5s@0IGvZB(M4$ghD*Dklp{5h49k0
zIZz`#Q8k@TAmfOW)4Q)<&W=8ce56>~fHGQI#CBAhuzlz)7FNC^Y%odsgF~MJNlg(N
z{5}cKO*ScZbE>YM-DA?QC<?aYdwX1`Jp*h^nFvlEhFT?#9K=?lIQ85zj4;AraNb0V
z@}l8^km-WMAmOge5LhK|K(B^{2}^-p)wE)J5DHb+;UqfMNUn^C9|XTYI<?b;zKWAZ
zCTm_)d~WT8>x}dNrtUnJnH(vYLNm)@uI>Fv`NBUt*_>Xm*w}c`tEg#PL{xXsS}+mk
zMcO4%*y`0_f*A}!iwLsH`q91tODGf*6{BL2^=sM_)3un5qDc|aev7z1(2n{TFeo4P
zDtJW6g~4~L25?Z8UmTpP)KZL*=7?ABf9;H$904gEcGyBaVNHLnRJxt(l!Rf1_n_!%
z?L6#F@I$nP^krM<+e&mPHcf%6axV9Idd=8*;y?!ZDD!5cUcdMBmAEI9X@thS#m|L9
z?%x=vUzM2g=h<90V`0H~jGvZV*gcCFLoDF#gi#6%PZ4)21)Y4GAs@-ZmxJ2yLy>4=
z8NWo7nNKRiz|I!3F(fb)GJy`+3JM4m*{#XSyaU@K67$fh!F5>V<LRU!HwOk5Zv3vV
ziX#dfS?&RdYu^EhIj=({W=Rhj9+NKamCRENe+}(K9D<xGv$>9%td&`wBt=`=AIi$A
zs#iY@%%z9HnIIc1)D=CRk83v@$!<6VhyF?;-9YgU?Zv@;zS%DSojWx}6qf0^h7)cj
zCH>Aca*5u`Zmj<vBAJO&r9o7AbSe04<}H_$49GG94P>+hvw}ZclCv0JgS)(HAAYcy
zz8a@0b(mS#UjoVk)Ne{!l<iw`<f4z?xoec<<PqC472icS3ZnvJ>Zeu~82jci38zKE
zn!n=23lpNEo1fW2rDVFs>ec+J!0l)w<!365Q7}d9#xtb($Q++9@3v?v9dQsO)#}D)
z+QsL5e*5XfGP%6nO(-+<dCokx{gX5Ki`A%E!Q;l(z(*y(xgzFG;zbma<BG%r*6W{T
z9a_>`d$MJfU@cQ>%oa1Fjgf82H?f6G%2<Be6*dGN>#%M<_)6(S?8V2K_%nXS!z1g;
zFyNr!X-{?4z^Fbt>{6^Vb-NgEJ<z2$N7Uj7;N5@~Jg8%f?|OU?I4>G|O5{4nFZ|Lr
zmNxmwy$3oHUq$2X(z;1izi-~@LLPtb+eLk3Yz>7d1(Vinp*(gr35#v=6p7;7G|n=o
zFf&*Gzsars7c{<gw)O$#@soOj3IVQ<MZxmFnl-|c@=~Lw{Dbn+D3eIcm*6F*pyH%+
z=(l-FmD57KFKNFKCaOIaea8|a|M-h835oj{Mn0bgPJ`vGlS#pFtwpBEgTKTym2bov
zdQrG}nc;sWM-|i({icXnqXi#|ns`wK>J!rXG|EatKUx2>VlwNuLPu+pRCmY;y7I~R
zK%D1Bsnp^k=q*Hf$8o?6ar;yB{uA|tn>XZoS^<3TTYV+5v-^L<!7v3H4#}aZSEC@(
zd18fGrY+3Gqm_APL5~EkFWfG=6W?f5&-8W4nMkEIqUlMu`})+`YeGjy@mstFg`t+p
z*#SpzSw`?bK(p_`!7V5tZ?yn57I|d59NFxr@$agX4O#l^XjZ(3h|wpq>3n{n6us?T
zvT@zQNW;KVZUlXp@O1qt0H@}f_YW2-JrdOj;vqwP#u&;s-6lbd*t`-j27}D!fzcb>
zD8<|g6RLiZ+*qJjfI&H1Xbltf$;hW3pYIw$;h-1#QFOkD3yeZ%ssAT8?E2I$+yg@&
z6!vK|e(~eZaztMT+j;v+{6dLq4VG|~=JEQ*CB6fIH=g=|s|wB|^9aR&AS>wassY7v
zJt*ZV2xz8JO`Vst#Rjr(xjS+;VIAofY25Rn9du`qB47YP!p}LaNxk2dSoVPL6g6&M
zid=kHpAo6etzJFmd<#$Jcxh#-#uPzmc0!+K1c1p7b1}zf<>II?%z4FW!`ngAK_~=<
zJK(C<7XCHUKZxGb=A=!Fisr6+HLRk3s53S3?O%{=nRQ5*-h3#HU5{htQcd*O@EKsW
z3x4%nz5RDfyMRU!;{X;*gFDd>F>a$VHf?DzLh97ok&%h@Y|82Is1d_>CicBh?Wp;Q
zjhhO{xVKbQLsa-cg$cn;(;8OX*<}l-I8aztm7f1vaGUu@d8!$|AT!FN^(se6S6-x-
z144G4rLn>*Z&j{cmH}|4h($vVU1TQ1izpG&q2@8SwLFCOyh3Gjv?<A&^J!D7rDEqL
zC?+CDL~nkl*tW4G*Bi{`<$<)I&xH)U@q+2@BeXChn2Gfy@a-h}bg!<Xrmu^@jM(JB
z;qzDd*LZ656yDnMVuK^hcb$PVVRisX^-hdEnGj2Dl&!-IQ2BYa#Yf7~--ilqM_4q4
zPDfPUasiZz7|15-?1l1@e0UbEk1~v$31B$!im0CmE_yh2vctGM>9xwjj!BDNS}5cW
zLR~u@8=Wa$JL{6naUR1+ArrjO11MxPN=fYrHdkOkpK|W-mW`z@F+4H@>6(-((P2YZ
zikYGOLxKpIqIZeLH`-B{VYb@i<n(})9sM<hwcF|>rimct*Av_SD(mML)Bz1LbhmBI
z^T<BX8|Qp#u^Ca+$Wi;LL*D~0Tpjy@uf&j58)e)oZC6m{zDZ8*0*8bN-)&*B*O^VQ
z16Z$#Av7PJSgbC$QZucWidPcnlMYvBUS+A6BIPIV@jcarQG-*{#6lphux{w}h~lYJ
z$9!QFc%j8Kr4wplAjK*PZe)z8<g^fMKhJcd=wg>2D!{IV@uyf)Z2L~uoJ{Xd=KpS_
zalkk_k0VEACCUu%+{SuVM?d~A)y)8RX6}e0-LYR|k301!pmBu92bY$_IE{sY>%nLS
zEbJvXM$a5p5pIE>;{Ad+hT7irQ;Rl+I({Zg3|LP=Z*>=K8S8*;JfLhfY>X_p#M#KC
z*ljpXoWo#NoItayg9r^5$l4*?O-3i4ZyG1VO_PH01HxYiYzVpuADhs%)pWrfS;Ur4
zC%9<rs#YhrjlORgoE_2X{}AqCSz~qYqvIQX^ciPi?32dVQTVSBSSc+X2YfAQNt6G_
zMe|;lnj<L=Jl<=&zPHUk*c^t6DbWd1WhTyre1f@TOLpX2F46M7`-)$e=Zu2;Sj)I3
zP&R^yR-?r9@IC82Dakoo1}kN?6o4s?=nN^xFM4ZK_T%(h^!Bage5KsD?{Yt(_e?Ch
z8<$zC2=#K3{i{V;(Qm?SuIA950%q%=`E*&nhHcFsmU4s&zE)QB6-<I>Vb^&%K8WtP
zFkQiL!30L6`?;*e91H?JO2m%bO2Y5N7YbaU9|Nuyc<r3^kpynN)#B^xAAjd#Wnv1H
zo*n*|x78_Qr+k^AT)-qnJTR<&ujsr_E2t01M%6j6<d0P!)Q6D>rVpeY8<%QxJQ7u7
zKpRfS2~<Gv-uMJ~P8qM?bcWU9y?MujV9*U7GF3g;n%hVJ$R-?^gjs)5j`%0xLBO#+
zy(7n%A&Hs-;)Qquyh_w6q+F{TyQaw7kbP}-S8fcSO@2FG+X24lElc?&*p;pdQ2P<G
zdpvZpuc@6E2W2L07YSR$q8e54K16WY8#QKBcGZ#_bI$k)@85PMEh2~*<tO96X;`sL
zsZ;rk-1whKs2zxvxDAIU4fsg;F<>`&oF2hq*0rW!u^)T?3XwuGn#*sE+6dKk*iqAR
zj!X?^N+m_nXunL?JHC}g)sgDf8zmGya}IuC91WGzBQ&>gqxXc{K}ub2hhbycs;g5A
zkR2-o5Jm4r&<82O$4}%VjOG#7+E{$VIf>+0$y_hx8Ij9q^5gbbIP4&z!RY^*sTsSZ
z6er8uU;^kU`6VssnOI4jhn7@`G-||7;G9ytbIqT<R^(F&zo-o1uteLL=24DEQlKK|
z^UWOI4>e(Y{uo34ORV@5m1Ir#`FaEWVgTMbp%X0`1klM4>j*NxC#MMLyCn_xm~w))
z1-5z@(`SE?IM<U#<W@JEmL`{3Wl1SZ7>VNxzg|IjVP3&B9bu(f)P<pV`be!8akPDa
z%K@ONiiNEJJO_hXfNXxbg<2K{Qi?v($qs43lD;7$9HVXy0$k!gH)p6uzf|ZAk{gy%
z<x1?^D#_65DVbm*L{f%6Y7;$e@!ib?@6lJ$?}Cha*{e}VC!>2t^)%6P)V5}P{$D*b
z;)LFkZ*oUEfxwD79CAZg$0xr=7P^L8(37uY@i~{%7xETnlpm0OJ>#fj%dUV?dr9dK
z(GyldWyz*{{GS#u0FBdiWjyS+PvR8{YobwPL{h~I<r<rlhl%L%eb0u}D6jQ`aB-mZ
z%<*9NB<7gRN+VI|A_8hLZ`f^kuco1J@Xnk^Y0;e;tYE*)37>1$LQ>F{ATXck4^9Mp
z*@2d^t|EMg{3V;43PN_yBz#4OR4xg5XR3P@?D@s{Zx;83N5JjM6J;5U<-JcmyQ>lW
z9R<A|Ne3whc+C_6hz+*i(V;C^o8Vjij3>&v3=vARm7>9BDUYj+6u>+8C%|{s6<X0`
z8GxEilj#qg)z^o&jc>}yvVSlq2Wh=AUXBlAkyj=JA@l)r#;3f`VEj9udq(zfww*Zy
zkTdgl$4I$Bpco-3yvNJl*Wr`NNn<DO{BoTOe2vQ*gNHe1@fl|$eUW}&u4jx7>MuF!
zX{TMSPeN664Xyqy2L7SGBofQL$Fj7w84%vGkS?P+|IQbV-dU{HQ9jL4EZ<9xGzK3@
zX9kqEm)^}q350ipC;?MBc9$c2y0nGIWXN++@Jc8<pk}A?UwU8pyY(S_WW7<XQJL}#
zHM7~I2uLO|VC@DZ8?5_;8*mIm%_PaR2~l5zihe^}2jnj-Hgvu38fN#yC)zwHAwO?P
zKmT+o`!3@@mdi)|`Q^!KLV>yw3J)nT@>=_=Iq!^gHK;V7!Th)7`eNR5BCYGm#L4??
z;_MK(NdD2W8UJGwdP#=EVvs~O(e;b|<<y9$tj%k;H@?~w{dWOpVj!IFpDm%U--t@b
z!l75E=wV;U{3+8606hGHJ9Fp(m2`ZT`<N}1#4JoVOZt)qNyjBSi^*{7LlFNG>g9sV
zuW8!O&b31&zta^ka=0U}7jA_X3+?IG$+$FU*K$xigv`-Ro4Y|_GqADWxE(HdNdJ&r
zug~QSTZP4pDZAEqjM-ie>rH%D+LtBijVdI5No@j<f&UO<vP8CXumwJi;ksexGfAi}
z&tT!o;%_!+3}EW;YEUc^><;ir*_o3~$8GwkPT*w1POKJIQCA_{K$^IZ8{FBBg*v;r
zfS=OLh&zxD>mO-bQ}HG%Xc(MhAk#@jZBKSEja=)dc19#HV`$N+&b~Rnpmj3L&j>&U
zSh?frwrOORHo#g@Pv-W_t8fCCfAZPW@EBuv3Ba-GNXLoUGB<(5<lN;r445S)ABtl{
zkvaDTDE;{OcjFVFdepVy3EZ@Gq#`8<;NKm3OS?UwFoRP1=7vU1_Q?Zd=Yt{3;g>|%
zNq;7`R|4yw8|<e``<edMe2>t`@P!Oa$0PL97|hW`8(((uf>)E0VGE`|xgtD6bgIsm
z+0Hcz@as067PML+41iz5oA^|`)<2q5uGS0kQjYeT<LM|bAmq)FMr?~><r25iV<_x%
zE*K@f%7I%0v;^8P5i~hdhHhOAyam$7j&Nr~;-JSkeaHC4y!nY;K_YYN+H>254CcRP
zZ#T&C`O<qlK4^F}8ed~pQFPBa$^6C@9j=1p$OGgD9tvf_!c4mZ_Wr$}coPypSYg~K
zk>#6TQF03L8nb!-RTKXObVOjxBAx)GUHD)#ibsw2<Z2}_{N8PVwy;A<60+?Q1@$KC
z*?H}Gc#<4gF4(*P>9_lBKUwsr863logpgVrZ!bp3PcVFLbukxp_srOj_oq}fKzE~x
z<#+1QbNLpT)FtB=Na;6ofTdS_u6=yN#9Lk`!4t>GO*9&G?mxy&<-|+H(#qFA%9{<w
zrA!u+EITaTNtE1`fFzx4Qt&kf#kF@hh$_Xfnp1Q>K@Eo{bK)Dg0}<n@UvSzUuf3y_
zA+kV)x*;4@{Qb9{SbhI~i>f0>=ob?e#yCB*3yusJEH0%vRS{|<H>4<78CmzkrkKzv
zclPX!c~R@nN6L1>2)U#Cm~iB9iAt%Z-!+Lq_l-i(*zk9y5u_xgt;N20*8`lGX|tr{
zk(!k=R|qUIthcz4-yD7O4*eLiCeNf4(J0l|AzIni7$;brrA9thoWm7xgdzyd?)q6A
zy#6QBT%W?H$!;5H!X~9*Qm1%K`kB~)e)ETho28?xQLA<N&rj(8LZ1$xII#8HtR7Q+
z{-;+K9>ny1yYV1k$y*}@D+7fm&IEb!87`q@3j%C_m_UzIK*53I^>@^AI&^CX39-K2
ztQeuCSeZBe_*|t-^vyOUxdJ9L#NIQ#a}=0FyO}n*<SzS|Qtykbbig4F)zB4e%H0UW
zqQ|BH)5o{x7s@Ue(;Z0-5%5j!kwl$ydIDK5@w2NIM98?5s*eTgUHcSLWdmBt5osGE
z*G&ZjAKalg=&pDs6+z1(*2YS4GRTxO)f@kh>$6F|J}Q&H=Ycbk-4V?t5vB3s%L_`(
z!C^GPQH2^XE5_nEW28t;QEw@N^ntF289jLddd4>nv|m%ePD}*1Oj35sIZdvh29Er&
zuSa+_{d1x}U1gAYz7XJi<?je@tUT-V5Q;zbXx2%=T}c+8!-hG;L{yQ5Y*(JwmP(b+
zjAOC-*aDNQgqE9uZ;4{D<pRGl25r7$1yp9=mR;}@700ZUoZVpfA*MJ{&<|;czz)`k
zt>0}1R;hgm0gD#u$~-HE|K++9)3^2PK2ykf2}~TFezpBDJ|}`WqW%E|Uuh14W0IQ8
zFsnDlw`(V1C}ZA_#m=^VR4RCAPsQNPTD4eBeM|=b)ezsIINMwLQ>;+!!Urk_sZG>H
zV?9`GB(J{2oZ)=a`mgdn?CO?6HXTwBm!|n1mfYEO4Wg))8+ms}!X@cj-C<;_o>$y3
zC_+D6Y#kPZ=4U9tU*vMDA)gJN$)yEIaN+@cNsCOxH7V5N(nm<F%5Ia@aqr#o#)1+5
zzPSbv#zx8tD4r(u1OF?L{L_qn>5J0v+YNpc|1)7vBPX4pZb<Ik#5kr%a?1xV79eFN
zU{k~`4e~_TcZOq`xs?~6B~Z{B#?FG9Vp^g%8EaIq`o?FT_3`A!KNN^S?SPA{DEk`q
zt41<e2Qg1homkY;C2jp9o-tgv`l{ZPa%;HXgjTeiL|0695gyk^#Hf(TelN_;{IwoJ
ziSN?KJ*`;sMn#rZbV4IBXF8;;Sjl)E&G{*jjGf=0o?<C@UIl(E=(BPbsZXV3N=cZ(
z%d5w<V36SHID|S&QUx9PEaKTjP4X0O8U9PUFeimi$aKF`3A3T?-+Urlths=0H5Wh<
zvDb0L)=UbSK7)>_NGfr*fB2T<z6$~Qr3dY#Md}d~jG(%%c36OLVPoL2T5&zOX5~?Y
zL5#LGzU;}AcOv=;)fq7T<Uy$W5Mzq=XIW|yg@S7hp+}>obppe8^la~P3v}#k9e3ND
zdT&AaklQT@bNfFU-3o=$9UG1U8IHp9C=}roDItBWYuz12eKy#TVwWl%L#{IiPseE;
zH(;wZJ$niKg(!v9w5Yc3ZVP4T^B?x#oPnC%W13uiS&m~#aRSOzb<$Ssc^hs|rZ6rX
z0Rr*06%}KfxVtUJAVo2~E2XUh<<_;*b!S>@`3wrUWUEMZb(6lzmrUkDSBg%*;v%3i
zGW3$KJ)v_bjsR%-1!#D%-B0RM3Zo3y73Xr*%mz=0#b|sb@?ux*07b@Ul(%LM=Dg48
z2Ccx;C%h)na&X_xEIsEFqU(iyd^@Djc)ncS@Jn<U48dU$*<QjKsEQ6&#3~%b)*cIb
z?!EuX68=pRN9%?j8`2NO@2kjO$r#2k7OdaEC;9G~Xe=>Zh{mLo;o;IiH&7_7j|@>G
zTuRs=rqePlxLT{0+9s6tC3I5exa~|B)s-6MY4krBE42sLj)>*Fg9~ehfS64(+vSNe
zCdTn-DZ51@l0>u$WbZS@iGld!X4Xhzav2UA3w=^spvs*0=O(k$-Pq!U{45;VnU$Z(
zedOr>kg7Q*)n{<0C$9CR0-pNVG7jd!*}qrX|BwhfFZ@4p5b%UsFyu5HM<I#LhGX|F
z4y@mNuM6o)d#H3;wmV=(2;xR^mjW8a7zJP4Cc!90c;zg3oL<GA;oIbTC|y(S_0cGW
zI)Ih*R5TesX%oGFr33+v36xANOwC3G)DnTz${=<RGNf-4K&G%bsW>6rX|nN=>kLZr
z%<{zwq;H5{0w(q1EZnDA$M+0}%&!(Q`JL$eTgca%%{E09%0=I4*LtqKmg#n*T0pTX
zz-H#+6bJG`__qDvpQqTa&n`nwN}P;=HY$RtVSF%^d1B_`VH_Z*uiUHG7^xRY5+8_e
z*;9#uHQ&IjesNiD8(92??n5J}BghSgYC4BZp9qv!C#Vr@48g8*1s+kAqG>Y8?C|^v
z64|gm^Ff+sBRf>Y_krayLsFw_eH3QYZ7s*&=rC*1JQSW3TB!y_*QCQu`ifD_Lo9Qn
z={;g6m?u=YL$eedVMPf*3pi0%xQ5=oLup1|)d+sac0t{3*gmO`Q_c{kAdAY+@W@r+
zOzrjOLgw&kc<|S~()1z&fDq5fOoQ3<%j|Mz%l0llr5;eAwhw}1!)DcSGf#8=h4M2o
z(*{T+sBrF2%#-K*CHEe=3#c3S007)&rYxvuzq9=o`ODuamdQSIh43*!rWg(zzd2qx
zxha2xk7@QQ8(MAyC;jGN(<+=!)phXZ^}Q$DRt0YxVibMh{erJyH<+mptwqQtw?Yxd
zN{r3m!`416D^Ji?WHv&@-S+lt(vPDy-q~=06^nUGlQB&UJL>l<2HW4#CzMxW$|4Hq
z{2X>Eb9<>6O0AyH%F&ZfW%`TesiYZA71cnNnFg@bRrq4|a4Pitel3mGmJJwz!06LH
zM?^bgj4{(4vA8X)ymgU@;FId677q6+dO+Qg$mKBcDSQMPnNj#A1G5(<kUX&BhK?jl
z%#GOh(BWV-zwm2XQqF!65i!ZbK%nbJ=H@=e67o^v5H3dP6*rWmHCvqFCG5!FJyI72
zrCXHkVhV4!t|l4_3ZCin5+nFNnj|c*2Tl_{oq`WIvsNU8({eCNvLEW!p&ZB)C(?{!
zE_3e#UMO<myUrd|i*^!(yZ+-4{i}oOKRMnUl*2eYh9;Uta0R{q@H{@+=$2}QdzECQ
zT-UHANQVwJ3zxDrzmJ5jUXY3!u1no!CndFisp(imHQeoM4NvS57u3r0VJ2XnK~>9X
zL3_-FI0l*lA=*3?iM0>`m0o?5Gzw<=-&x~A>>og<R#N6V6DW0kBz1XQ$<tn#%W@v7
zHHbdR?0r88Z|F`3(+HHQVQ*r>Viv6zNt)Xe*P)-eLDmxI_K(U~xGg)CD~X;tHl03d
z?XW*wnaAninCD3G-^9`AU-n?eE-q|ft8JY&0QpB4GN*E6OO@KL{?t#WI;;P*fSc{}
zARwAZ!^Fq(mu^HN!{Tkye_FBT0$WKEY0X$&@v6hKa>JSve_NWQep#uMxVq+Rj%53M
zAdG|G#Z%i5<W&CFOnv546o?c!sxlF78m{S5loTI%=r3D{7e8C+&S=>mV8fz79?I{f
zA518Lz-SVgpJ{|?k`g|XM#!SYzf=NFG;S&WZL}!IN{U>`EY)Zrf-9PBWm)PT+x&t*
z_xU{iMF~8Iz>oq&Vq8}34iaj+9er!Q%`1YEh}e=N2{X5WwXH!mc_)L)$*8=g<`>yI
zD45^~%wn{?{`bD!EK1+@rBNKK`FU7r*-X9_!5XgpMDHTxe_i0>B-PNX)9c^~f(g&O
z|J2cg-@rYvM8;x5op?@^NG-HwvAxA_31xAO(nzh~?j08ezQ|gZ#muB>Fe9|zjC;yL
zwkVk}agoFBc}l&eLu?@WZN+YO(-t37dGhuS7|v18p3Aij;r}QC>7mv&KY1k@8XU<B
z)OvPbTCGUo_rteetvD;+I@|^WYb_6{#%DhiKth5)!wUi3mZpH2enFox)RSooQQ)+S
zGFkL;a9_H|f$if=>L1myq@8nv<bsFN;Nbh^_;+2tcRJKwMnz`TL`)zT^uI9()nzsL
zj!SY=+*;%|TKTCmzkz~mCff1_W7B$$GEW;_HMB8pJNz!2wt|?vxW=*Ee4M632Jt(s
zqGRR~-5g5I;W7$oAKu$xSN3`cszTNO(|>m2Dwdlc*!N*7sV?<?%}xBxW6dyIZ3-V|
zr@LKqZZn>wwa2<E>JO#`$spK>ENUVAnXx=7X0H-ZaFc}SMTEDEd-E+Z!LpJSDU732
z!%$y_slcTRS#9-^&K6WqU~a!xvn<DbLoA&DFtP_0D{GNL+;m^iXRxYxZdO42tWgrs
zZUts!RUgteY-ST^4-8*`TIKCr?}mFKp=XF33c%0`FUSl}Y2-K?+SZb#9OS3mtWiUp
zji11l1<GpJ8^f^e-A`zzbPi}rUk?$HkDtq#zx*zPCw^B+#Dc+C1*MxaF5>RX>y+Xo
z@h{kD-lt@_=gsDQv9W5(9bAcrAxa|g*VtpH4sZ52VQUspauBGU4-0crk#-%`k`#|A
z?~J#t0!|yV22(eaW}-EnORR#V4(WlmrvxwKwacGm2){*tWPbozFrvPzFW)T9tf9ox
zhTNSaA9a|lj4Kj<>J!<n6Q3g2N{(B%KPC)q2cEpgGtqy_Qow-5k&%)Arg`8c<5ocu
z@i7qwnwWW;LwsJ8GR8hlX*mn;$2qNPjw6Jfp>4cz3J8_z=G8NL{T~Ps`;(X7z+v^S
z@lgYc>mRY4@-5<#njW3_2*HgPBAhv993jx|jwH;$OAJ6WZQZ2T*9UJ?a4YaYZN#Ge
zr}~h-X&lMkHGH7(_(uDpDP<myKFae&eaw#V#EM2^W+7U&NE3A&ngT8CJ;HC3B1Yx$
zH5Aw3`Yq}ucNCLU-|XEw%sJ9GZo_Cj@-N?vQ1#4$vYN4keYUSsRbdT2v^xaI#osdF
zMBY(TSHI}uR<8NUJl)=%;;S=9z$yEq)5XQ4>CExD2NL}Y?0Rxd1TRm~-eze_F0zKW
zlq+x%b1&VpH*N!XN%^cPoPU|layY}um)MF#k5(do!VKZ%)^oyc=6zV<<5%>=``yFK
zDGFZU3DI`T?O`fo-Ar_Ok!tQBw3L(`TP@6n7s}2^hCz^Hwz&VpP@1#H5|?cC6)4a+
zi)>yIp|Y3BltSc|yIZ5Ht$LDD|J|<)YG3TdDtAmq1f4JDMoml9KE%PPJGMRxP4D&D
z1!Z_E;8TY!BKYtyv1+bmpJl}V@FG(g&HMyt%E}z+vNptUR>>5%7g{8-h-V%T2m!2i
z=^C#Lz&#_#g{}`&`b?G=b#{-4RLrJQl$qn}n3by}<hY5N*a2uRumNA+qRECds|W{s
zvv)e^bGfU6^@C+_GUdN_4ZW3!^Z+J-?_?QPw4^w1EM!FNV;4C;aph|Vo=n>CLFT3F
zEf+q65UPmM)HI?rEaFP5aAg^dyFQqA&K_PTF0Cc|C+k5Kka=AScpXQ-2Gu;@208!c
zjGO2BUs2G(JXA_(H%=IP89nh5Z{_rDmeV~$TrbD%Q<xMJl0?Omf`O9LBYLl;*;YuU
zDUrT$Stg&<o9pWo-C2%Ktg~-k-lQZOGb0!osK!!Ozp#*{QtJb=9OY_)9OBhi7hL^J
z@<X5o*?sXoi+Ba@a!)%~4jGMdBW^xfr=N|zv8CH}QfN>z-cvmHzNFW-Zmf{E&&p>;
zKf(Ip#ce%p#jEhxbZW|!WSJ~a;@Lqr6_)ZF+4`r2<iAS^{zW7m^0X_%$9HNaUa8zU
z%h`)%X{ecZ$&h$niMiq;jazt5ep?C0-n!=PH<D<cAP}hXLM{x`C*~dBykO?SO70Y6
zd`~6!hs(whUmD~ywvD;rr?hkO&>;h6_}zpz%~0|f=Bp)G%ZFMb#f^c9r--M#5UqnN
zfCIHHFLU%_M)7>TTlNuQXPLNy7?TLD(nOsctl(+l^Gf}j<a=n$8}80Gr%e&7TTTqp
z^CUG#Zq}()qEhB>-Ns2dKIH6&$dkzEpy!9hytgKJc)riPp7TfsPi`DkS-5RL?Gp9!
zO=?De&UpP-pgcSkQ^(E%Z3nO*SX0>`vy))NVw}FFn1L&4tsoS7v}QsvZjCB+puM;7
zb$ACSUeh*61ZEi~P|ti@&&VGcFn{OSkX0rAVSsOW3b)LwI^R@?jJzkJ2lIxviHgzQ
zww2oXcT5LsI7|ONwn}KYUcB?G_tWt}&YvfH^tkT^k}zg>vE$a_9}lsKnL;~Iitm@-
zchjX9m1&zrNA6Q`k;D)U`Y^Q6W4+X;$jP(cASvgyNltC~S5$lAD*Ro5F;Fg%5al}B
z=%hjSh{pnx!OW504-=^;&BwXlWH9Kkb2sBrAI;xd*fS^C)RykkI^K`Tl9Q{ONJiyf
zs^&%K&SkRg#6MoJxZcYas6@c$OkNu~L23fBLcV+xD-1W>N!fSX?wX!#pa$g#prBqg
z{2Y+-c(WuO!02N>(Awc$MB}`Eo$$uZ^hj*un?7*|(CTm;?YD;`8r|FBC<sNQYOWSy
zcNk2AL3{cWe61Kt2Xnf)44Su!Mf`s0sc{n>A)Eyx@VR9Bi;He};txc{&Q6hGzNt`5
zf!d>u!+%t;N$tS@);=cDoxToXhO)DxB1aCb<UXZtq#hf!=}mb$jNyqjn6eDvhiCM;
z!;E_kk$-e?^hIq7mY{Ef=(GrUMxm->9iaDgMag^p@)8}tkc`9QnezPBLO-=6+Bw`<
zkT+(vfel^A8!y)Morv-6ITf;-%(~Nq7#-&L_fzTPOC$S52BVFG8gd+Sj-7-KrH5aB
zs-)T3bZQ6cSU|cbDHmHVlJ3~6SX8L59CWO;Nc#3o=VqR}h3%(q;ja#Fk3nq}z^zEe
zq2A4ELCOv;rxQzJco$p?<diuw^0?1mLmb;<n0GfHc0fc*+T5XR0Ey(4!}Eg)5k^&D
zp2$iGm<vkT^eJ@^Tk;r+!dQE^W-o31foUY<-Wr+H!Y3MY9uJf|OX-x4K-4qFg~-Gq
z(`B+=L^Q5#DF}bfiQ$4|jJ}{mB&Sc5&D-Jy*q1NnUaZ;BYD4OSkA*+m>H5&Rm?t}o
z<nTq@E;Z%s+m~lkQ~{B)L|T`I*ayJ3L;GfpS<g1T4blIR{%Of@CkP`G>;-7*RPHcZ
z!?`-d<hhdnTr$<+u(sPoQy%dYEtN~7K;3usSK|ni{M?KT+ZNN+(z$k9najq9VI-FV
zK8t1^yQ@a$4CN(;t%b|EyH3ZEQeFr=Ow(I6?x~7o2f{5Wa%Phgw5C1p%ziJ#fqqMp
z(HpXwZG4C%W|h-F3?0r=rK#W|smAEU%^nainGh9K7K}Gu+-@hi+lhchtd41%4XQa)
z`j|Zb7eoI#3@TLn2xtcB<(2nIr}(o7m%A4x$VwX0fq1>iz3W(N0oh1+gQmI2-JuLx
ztRnIQShSt5wJ_;Gx%Yg%y18@EvK(++gV_hYkZqHan&$E{4?ddr#+J6oTk$-32uFSz
zjFNB_eltuQSS~z8dZ}S#Z#CbC`DKsr%oStIPg_;11}2C%DNe&!UGe*rYo(<s8XYg>
zhR@bm*h_xl&P{oat{R^Rc%0uW@%J(}p7~t$`5v~;o8UXo!81zyTzF0*$39K1y#G$E
zIKmn6+X0K{yoe7MuL8*%8ooZjXJZGbF-f;)$1QXD8}IQTxR3^~Ulp$;DR5yZjpLRo
z^sWF^UZ{M4zUGi6yo<f0htsG{#o#WknnCYV__Yafh|^?s@glajHK>SW>OXCbD#12O
zNZM}Q)Ro@#TQ=tK$ox$*dz<V(ADyMPZ6__-iT9~Wwrb18-J&6C)LsE$H~QrPTvY4G
zG~~!-{g!Bqi$zk~LHU4oZfT^yzE1B)L1$_fTB%1~cJ<$DjPogD@y|6TRKUS`SMNuN
z%E6_&_N%A6I%xWP#}oji144&O*~J<9n&~C5qu|mJIa8>S2BNjwi`b+k2Bg?G+$F$_
z$`EQ`N+x1w!W`<TN{%qHv+@PMYPMd@S_d?rg$|zVXf7Ww3Y#|9Uobje>_+OMC5h2l
zU!><>;c8K!&k_X35;hh_bc`D`*Us9}+G;dU7<;fO5?J2!9)zy3VEEhCTllay(d&JW
zU$J5bpaPVFK5SufYaeveY?=ku+SiXN8Q><U<@s=ACg}u45R<o^j@K+Te`tFApPsA#
zWG?!WT$q*Q<hM&)`am!=0$*Z_kE^h9nmP$IkXjy~xB@kW!MK$RlDNp@^84E+Nbh4S
zT_RW*RL=+-8vvcFDS@};+I;am2X3KipQVoUg#4nWWuym4_Kka9h2e@4L?qFonfTf1
z=tnx<G>nv)d}tm3T8X`x^12;EKE7dsp`Os&=-8-<OmxJ-<qZg|FGGspq>@#pN>P|{
zRG!T2lN*#I-}DsBC``+w(g0~-1uQ#Ap)uFYr%iBE+n#Kt$H3JU9cId>=bO6rzvh~F
zlO*g4%}t+J39lg7rH8gQPJbi#kyMZ|)(zBjkmi~4?mqB9Gg>yX5d(lW%knxCVH%!W
z?nkp|Kbo1LZ1V14^#YC$ob?8ZuWxZ{_>blQ#!DVf7KX`eeg*?C4h|@SCe*_9sPGSX
zZaH?7dcQRD<HQ&XYDQf6fRIo|mViH3z8N~5QqQQ}qJ=?Zl$!oT_L9qobj*@38+(L>
zZK7jnP)9+)%3*@Xt;>n%hhU`5{^kN5aiNqKBcw0$p5?>84pCy7PkH}o0ndPc6Uwm%
zL|_bI92d&#Uy^3vQdNi6v{OP%h|A39DXPXGE9}x6{}K9{3s%c+C+{mk&2&}OhI<al
z_g3F0q=}fAnzus#r0DAr)EZAPY!{4H-fN3wH7Cu>QDNVW9!J|E>|dWF^Y8#5IGFlQ
zfHNoS05fjIn<j)~E^3D2!xkP|wIc-s&5~rc>Sc_ps@za?X6K2u)P`d(>)+VoV{Mu+
z9w#lsB6YJZ%9oC=+;8rdOa7|}{=wbM4JkEupvMpJ*LakGvoF6PF(gxDD@K;8Ygb+%
z)DeVWRiRbnJJ-EKm0+-8rx2{48HrK~77PAf*lUv@M0eV0(@CNCg}kmWu!eNvOB*zT
z6n5J7!(?cI8Krk_vq<l#k6IR`@>gWY9K6^VwdQwr9giyYpi7iy^;(LWh0iNzUbKMM
zs_$H8M1WUU<0Rs{NS#}~yXcgt4&1g?EB^PPu;$tfvcl)%|Lm0hi|A4FO1rtInl!n>
zI}7SbApQfihZDoHyWM$vJE-LC0Mj7g>4=WTeyha_rsgvH99P>C?Nj}7D6ohfCR7r*
zNHjahnirS~ukM1Z={YM0V+JcZ<7Jp+Y}O8WDa8rducEpfwTT82x6|Ae7o~FMNs&?d
zGIyh%q7Ftsz-=LZc8tQ-_U+s^dtD`qI4#0{W4qT=ClGmB+fEi<C~67XK8&I=9uux_
zSt|UPgq7o~RB`aiNgdPZxqbQDg0b{ue4e!>h;@yfVDt<OOHuBimRETDA}AF7&dPGz
z^tco<@^+@Wa3Zxk(oajOC-x5}0jtU^Gmwxz4inwf%ZsGOmk3_%tu$`KpYWv7FVW~;
z{T7`r6QthnlFSO@7lX0`@`6;vrYME+;HOQButb~XkoW2cHV+uKyoIm6z<~J05x4g8
z^JAH3Wh31ydh_xghKok;l$J`++2N^TriDA<N1~}rj7VGGZ$AhQ;5Ry}KrEEL=Q@((
zx3naY1`2dJFvNoU@5OMC*Zykii~nJUOI{p6hEjT{2iEF?EDGS4nc-zL?C{V<y$RfQ
zAcCJdL?7z)quTS1=s#M#W@!-r@Paf{_T=71Mhx#$QXtOZ3BO!X6aQUuv#l?3ub+>b
zeLq8zNH2Crft&i&KD(M}h?RMXtT)@aXSr8jf)1%l$AkJM0y!7XO^C{<QR*yt^g)`0
zhzWzMzF0CH3YYxJ77I>QOF!VMVVN^hOb&Et(B{)-BHWFkv_&+0r{Dq_Qc3Pekx|u2
z->3arl9Up>{(LZ=5M)nctz*XLrWXQK{j+x_`g@JSv+rW^aKP+C_JMFXc_!K~uS##!
zu;C_K*OD(ljJy+5M)kZ5XCv*`6fO*qRWPsfceh-cLN|`YYixJ>M#dK*xx9jI9{ebe
zu5SdBB`PYu*5ejT-i_G4%Ti!g<z^!0RBugMiZD+o^OpX204x@W{=PkAXS!LykCeAX
z7jw08?!4)rU_y_xt7$J}a<DyacghrJ7-I>Zqy!eGC_F$s!z200&r=?XhINIm2wl1v
zi*#vF4?o6lVwd`Tm2$fN_htESC8jy{gj%TsAM=9An*hkSH<vFr+`bx?ekXg)%EpP(
zG5ScUu+e%zsLJ;+hSk!-i1<M;d2;DKRO#5^E9NODe2{hl!0}DyE9sWv&3I%>J56E&
z9z!*=AO5W3Tl(BV;VNv0D3=%@FIp<)6k>Y)w?#y#zMhS0yY1tbd^_0RX2i~lH;#;w
zMwsfnnPBnPFKg6)n+*vol~X{H6$U5p^tbj~J6ET>OMBg}_zP9F{HrP}wrQR#vj5mH
z!>STJ0guPbh`Zq)gGl5-$gZC!vOi5V>qp^2fmmJ49j_$5%mMVg^LaH0?M%`m1nAbg
zsehMr=<_j~><_LkIXwZLQU~<mj+=A6eDjDZq*)EHT{h~~5%}dSW%U%ZoNDi9&%DIK
zuD6`SiNG&1-uK7~n?{tnl}3^G3$2nEmj$kg&h2}*`8-gO8C&QnX}ViH(4!!(X^<<?
zaW!v+KQ=v(4F*(u%oqts5Fz^?XUqLVto8igeoIDKASf5%WAJt~>j+%)?0HuG;BjA?
zg&`0*ZY9wBcFj40Mit)1g_kF5kf|oMUl%I;&YjTCHlp936Q2(E23v~l6K@B$5Ox>H
znGG4dBu~h0YN80~o>AeeL!=~gaku?Z7S!KfrohZ)cTG*E8_k12?`;I%C}$mvt9d^2
z#8x`n6O3YzvHexhe{jZ|P}Cc+|3rcA`*YAEL0I`1{wO*z+@5n(2)RwD!8WS*$Ycfh
zg+@GoMXvwjbvQce$<TOTveyHI92Rj950Jj{Hir>{g<if|SY%EfuGj!<$O(v@&~l72
znw}6u4Z|J{2|mt;wS$#9(C93K<h2L)UNRJcfbivo_~qO$b$Si%3d~ghY)Me-1Bi+q
zhF&0i_GMb5x!&EuJmR9mYmP75Q$ykP3$^2FWj7lKcq6vLBRfV3l0eqXk4gJ33Ceqq
zZD4*8t**J8_P?jvHi}v)MjInrXRtNnGc74_xF>OU=0a>$@h?ztW{c`0oBzHjPsXQz
zd4r<?zi%WB>Pg@|;?`{X;Gs5ZXU)o!jedP1Js&j)8jZvksCl{(HuW3S3~>Rdr17>3
zxg1kLD)b+w_1_H)N)glcQ})-zS)YczSjR<x?zREkQ<!tHL(Za!h;3!QB?nJYG3Sy|
z&#Tb~UOQ#R-j@nMa)Jg4X=lF=@FO2zj|^g<<Iu02OWWVl+)4L2H6rsGY1c}OyGj*O
zJNrUt#!v;!7>{{tENk$VZTOVSY;)Rz8m2$))lbTvTK?uXA3^sZFuPxgnEIdh@vr*d
z^a2-ZZf7DE-b@vlFDFCD6l1OvHzlk-(ow|_mxYFLm`DXcAQf$jBeNYxirKV}gr=<$
zdBAHQ0dU_R!{8gt^P|rvMbJII!)2@xm_-}E|ImA_*tn(-7OS$pfNBiQLx}vV2B%po
z&PZX}Uei?^q$GE&D1aGCHcaZZ*5tKV(Hzm=Z4!^Pv^lP#d_=H2cb5&H?Gqmt1)^<-
zSsTo$Hw{rwt8>^7KbYynDrZQqYs&rzv1sFl{sc)4V<9<~ean4U_FSwyJ^atbN;7UG
z$```&&7!t9Z7M1QOS~0%$pRYkjajERKUJ+}QN+H-P08?=gkH)l@}O*Q<9b)%n3m!f
znKZv8X*JNLK3ym_#Ap}_pUQ4&C|;U(olmOGc9OSZN=DhklW{WIgr6>M<Qq!%&_+>u
zU-XNv=UbJ9*Fby6oNkWXJI4>LPDHI!Y6Rj6Ccp3uS`lIN!=991!nLID%3T-5YnscB
zsmHY`<F;4Ry$;l{6C-hbt;H)A!JU|Ab1Mw5B{qYer?z=d#c=P;Up5TFKH;)5=OH1T
za`!A1U>8je;)`<0MNXH;DEg&v^NFpEkHJlyr1YKupA`ZA5Dh*Oi)G9GX0|O}0qq(d
z-SG~2GyDq+rG=Z}H0Ru;_JH;DJ-`~i#1(4a6)YHY!~Nn#-Za4W?)NF2V6U;mFROg@
z96v%S5+yINm=j#Y!tqxRoT-)*_%THA2Ok>T(%7YvET^#Z*EXbZwFpYmeHA`|qQ+aL
z>nAj)^K3y6-?Ys9?{=ReVt>~U@BE7(nvKZR?UoX?K+&ubXq{B#GppT4Fd(H+CU67@
zAfV=L52>mX+AJt;mrS1n)t3lp9SJe>$&eLNqZ;%V!F@@oHhMC8tNGTPh59DbBOwWv
z@@tVPLiO*E^@xevAnzjquERA7^rP{|p!Md&VF}hxMn)rOfABmF3oK`%mX}mzi!9w5
zX`9|U#IyFo<&5M+!|Mx<Ubnu9H|>mBp9#z`?XjCWma;p=WW5?L$#U&|enVFN3#~R2
z?j&&=)m@<tdti4(Cv;3q^ywnx4(t*rHHItdPO+e6M=Z2QMJqtl<8cWH&*)FoJg6v(
zSB2z<KNp@_1nl!b7W+QAped1YXI!YRg-Q!JD-%aL^zsCmkfr`4b%em>gla>Es3Y7l
z1)89TA9WYsW!o20J?#j{R{#dDhHlLv%l9WM2k)fs9=bCMQtusc#1Czkv|H1<r8=4P
zMnb@HUwIoXnFYV<eT9ld|2EAS6hKzXu7Ca!|357OP6Q=sq$L4IsdE_&YQyo&DOzpL
zOO{E%^run7bLp#VmPf2ieMv5GqBnh>B~%vAfxe?8vsls5BCX#8#t%erv_i%ht?7@$
zlwFNtZFNicQ+~m-^x{LuSTIVAV}c&kdNrm)g9ock<6v^4+Yy4Zoz-ZsI9Tc!OsD1k
zFm%f6h4{fp>PX)rw{@2<k&X!7!`HY$G8H9HYOSD}#WTgRI}C@4?MpcppEIPG$aX?j
zXDHZyKZd2A)O}ZhwDEh6)g$*uI@F&zub<s>|34w7w?r~+Ls02s-)^5ePv#QrM8R-r
zN;YNc8o^+UF{@_M)_}kKvZ}qNo(D0-Raa-EAQTOwoEIh``$vHYhm_U_Iw}nJFb(P;
zoPm2~zO-|w&L~BehNw^9I1fSnW7^$*jp<*C&Y#q!&(Z#QsmFIK^B@ngEcEevv9ViP
z4BiCvfm}@G!yVV`WU05t^ee*jd*>)TaERX9WmuUPIL(Qh4naLLcn(XPsV96Fk6XS}
z*__OO6LoB?j3Vsac+U@{czE&$=Xm2cc4p5f=KSfzls>^zwh%sXklcwXtBI%)xXY))
znw9VvTNPyvDADAB0nWceM~V7T-Rb?03ygB;;pr$*DI)p$##6<>oqI{ccC#^DhT2h6
zfiBp%@|*syOlQp>8EjzXr!89pp;e<kpL2{aqmmvxm@(obZCtyF;52!)X{BhyudB8Y
z(4u(=AWcHq!^;F-j!UhJ?%v0W_;aOw#OTHSA%=g{*E(c^zepnTPl<-oWMm89BQvDj
zPfbuO8HiVL1tbJ`)vuz9Mnlgnj<6|+wu})DqYj^a!{`6ImtmNW;rP~9+v6q<*W8Ig
zL*Z(pE(xw!w*ZWSav>ENI+@|TXtV)%34|t#4+@5FLwVn!*zF#U_Yo2WzmzFXC!CpP
zQi<g=%5INI>0@!?_(f!_<^UfjS~RcJSN%PF>!cHhEOa^91;OQD4zCL_Qd2(EZaURv
zwV&Ntl26^`>Ohn>;ayl5wat>;XGfkvoh>b-4(D-it;*ZN!(m$?8u|sh-)H;kH!|DX
zK4<8Hn_EdfY4=cq^5+`hX^ra3zuI_nJ1*wS5bXx8Ra~2!+pXXtBQ=?NB&vD<Qt6MK
zK7MXKA{hYD2AQ7}G&aA=7Ea<WwrRhf{`x;Hz|j%)#n|!$D5$WPRg9DN^M$gv11JQ~
z5Jpdq3w{tHQ}ghIj1?rnZ`%uvRV-=02tw#+VN(5l=iMMxf@j_t`|8`8Gf*(6NvPy2
zSAF@$^cKGgVuN3!_3MXj(NMJnxe4`jMcdyJ?%b)H7a<p!T%m8;Uat%y{b}+EdLHim
zH!+_gt_W<8Ym=eOrv9}VQ>8`=UGDXj2`mwOO9-jvdR?D6O2q`z$YoT}-J_M1f;jWW
zU-~e-bmHcwEiUWID-=T~1$<%@i9I1a@t~ABDh3Z7vvtN;;!iH5X07<t=A@bmI1}p;
znMb9`eC|aS1vK4Q=|p>aBa>YDSp0%(j>>T2A|lB+FKSL6oU7H`NM4#+zndXPn{e*w
zFDkWU{!~ekdulD%+wq<u#`3u%7WsE58K8wA!E2<BczFpKc@6BdBW@oNP}`Nw#XIIW
zQ6C~eZ^F^8#6|Qn5DOgYN74QXS6>pm0aotwR`O(P-lfKX6PCQg3l$H>wNds3zsn|l
z;W`*StTWG-ToI~;hqs4C6P6KrRjoUQDzxp3dad4rIy5S(r?kL}JWO1bovI<as9)2W
z#EZa1Qf#>y7d@3B0Tr<f(Q8=yUZgale!iGzv~mFcabhXJTwmW;D)1(L(@VM9gR>g*
z@zn69q5G%s%>R*9{sOF(Zz&?xK?+G&F3V8hpyJBNKyHp65oK8JX%93GfY1$H6{o*@
z2q^xR%j#X=g+eB+;;?z0F^e0kQ~zD(<OU(^%W(`Z`jN>e7~{F02S{;ycbf@A3FbDE
z+&oM&Uh!!LnX0G^&fKs+v)hz6L;da$y=Iz}IGGMkQp(W=lX5e)_d6-!2`P6Gd!+|U
zU@?{M=Qd6<Svi25wLd!i0dQ_$ow4-Gg7|>2d61h~*Zp^(dw!c^a{t3nRXc{#`~YEU
zyY6e3dhvl9v3F*}(8tc_I_#g`_z6CUM3zLLjM~!t_5-~j;+I{%BP-^QekNQJ!=nU-
zh5#~!N7YCGgPfYcw77{bZEa^0^`@<B-W8iDsg_KiO=q4H8txK2l>>LBjhW=A7P}1<
zk?L3`PcV#oco5BqI8H8X%a<8gYQ?o=Da@t#F;r}``D?7F-Bc<Fz1(QdWbSn>C#u2T
zNYVvw>8BAGf3Zfs!RFLkrCD1ILD#Xo7WHJaN8KUo0{UUNTNmpDnR{%<2->>$8<@~A
zM);mpUmcKVnp|n4npui;;y-xXC#R|X^G>yPW<P})Mn$mrrB7;5GLb^#9zhITtF$3$
zoGylxo+X;)R5vlTh;q8e5Ch$iw4Il$3F+x4&>d<HSG8uG0hfySea7C9akvUN<1(xn
zQD%&cN&%MoMfU*XBY{HqD{RxjFJ;NeJ1dk8*3uV9D`7R-7+f^kBiV^9xE3v%sC*MB
zv&6l%l%LWNQhprZ(hSF6QeC@i>hUdip}+JSqW;Do+l*Ba^U;US*hW4xuZ%VbTq>v~
z_*QM+mW@k0;yZmj=bv-RkDCw2e-n6rtqcEbywq|qCU#g1>)P1+-r--Exr7^6%>_^L
zI=gf3T~wgQm&aD`7276OnV1|Vk_L;^Q{qf@Due*PL%4ce#M@mx>C{WB9FW_gt()FY
z%FS0Ra6TvzASADmAXCGVh*+>1<I`H%$HT5cqd?b9;qcPQ4f#V@y6p)=7gm*=u~(6T
zg;69AF0WdlnmX;9?(?kKI-HWOnuC*yBqX{$`fcRGfRWhvZob#q*GVGu-X!6M66eS{
zQ)(p7=jm^Q_D^;LZvCo6za1kxVkRhGHaE6Qc9W0Dn#ZoOUMYjOz|7E;_q7iPfa%zF
zB+|)KV&pJ){%cw_{CM4d$||xY|7<Ox8tNHAC)%*deE2L<w@F;k;=4Dyiu6--XMoZA
z$gMTqeuo<Q%0D1l`|jq#g1I!rJ>#p9H;!xwV?;}&dTBKRD#}$gOXE4!<=HQI>`~nP
z*d2CzhCU-WB*ht$>WA%A|9?DPg+o&h*A^5h0YyquLTbWjkd#JJT4Eq2-Q9vTNGKs7
z-Hh&@bc4hg-OWaKjBo1u`~HHv-Fwb?&hwm7ZJChktVUCv_^4d#Jo1+-|Lu+WqvaEF
z_;xg<w5cK9#*M-zzvn*`i<y6*-T#HlZT2#FXxO1d=2<Au&Z-e+40>>XhJ!9LzeG68
z{}}zHuA?jmHvmrp8RjI+H~W;9(LW_uz3$44ZeJ>z286k|G5wWXlk2O|NA3P%!PD;2
zm-cJioaE+Xlin7sFE97AvC3{JleXqix-hVBzBPpZnIJmnMb;e;m3(neZ`!#VQ}~w-
z1^GrbzHwT6vUl^B(^0dT0JoL*j&mHN(A<W|0Jg5bt6pYNwXlD;gSMKg=P@E!d=y8?
zDw4G}VhIuj*tKY%v(xuZ!JLxkl6yI@&Rrn7eK=`RW{<U5zUk`Bgs}m>o;oxu&R@s$
z#ed*<I*zFyQmSWQ!sHs*UB_4HfcCVfooqf4@m9c3E{<#mRLNZY=rc=`(t-qr)Z0?r
zK+4x?OVRVcS<PuTKTFUd$9@BC`LYbSGO|mWm~CHWDb6e3h!T>RKCAvnxQh|z?$9oj
zNFabWOlg{2^(BaKVc`Cg1CMD?fkAHIy3$xg`)9Skvs{4xE<BA%knySkKE{UH>BS$t
z7^RV1jjI<}nP}9*n3kai6(-F;;IZB>rqr^?LaXhN3wvRgt<wby_5fg*W|HXW<?uXQ
zCTpRezzKhrqL|kxC}#Ye(r7Wa>g9scL0M%6`1gx1E6Cg=(fA6%LOjCCMnI8*+(Oh{
zD%=Ep{UfLcnO)oPm_o>OOO}_THV$Lq-UzeSM6c3JHo!aaO$fGl60av}2~V<dhqK@_
zvUlcj!f~cZGO=vrP$CuH`J|-eJN9;?6`ZHd?8v`TEGeo!@$cxc=^+Nc!s*LdblLE3
zX@+ABcmkE;)0!`f4}QK4xpk;W<Oy}UculU1=Nj8H{OBSaOSrNy93!0G^?`?xgD+)7
zBE%;j>}pRvOm1O&MpgRBICYXF3j?E~jBw(~;Ddsw;q^%U_6KdLZ<7i)O$_QD*C%Mn
z<r@`7d<+#o3p(MHH+e%pPnJXaOL@9n91&t6Ak^6797})`#JvEG7wvfYMpNFj;-^Z1
zrYJG-MT`7hWE{3o7`tvl%QTaHz9j9+V{wS_4h9tP@5)8ee|tIf3C$DSF#E8+6d2sN
z&NB1_-u?h+$Bc2<;+Q!L-*^b7je2x^TAj{pBqOj}f1Lc0G}lU%Queg03LOvgyqvN>
z?7^eG)2|j5Z(}pd9!|6Ve1STh##fk(owl48Q^@>&P(m&685A>Rn5ycBW|)@FlZBW3
z-0NZbxq@;}@RUqmIM2q9e`xvbOA#ZUV(G+~xVij1oXuVGLc)<T0_#}u$4D01ucL=e
znj?3aV8Ou*0N@c0xm>&p3-LVAsxT_&?fZgFSG+i(qrdy&?0^1m&dEITVe&DHFy(8l
z*i0t8Oqmokjlv|~yxmTEn{^XOH;u=(d6m4jd8*JsjUqPo0IK3gA7yW9NE=>()YCi3
z<U@$mSoPlJ#!3tq&St&|nPV*DCBwf{C4GDrF8B1w(9Qrg@n?Q|sUj1-Y$ZRx`URe^
z29sD8hQs|Xauy`AmY3~?_=Dy6iZw8$-1wbjaZ}JI-+g6KqH?)aD=FVK5rQBgUCO8n
zGFqSwK9V)XfM@P61HJxVK=6NS`b5SqYptQt%{Yusa)g6_)ir(l^nO=&1^i-%AuQ^<
z!*<JB0ECyB_wCcD2o1(xvDjHoM`hwt?-1<?Hj@C07&9XMok(bq=PnK9SAicS{RD^p
zFCkU9<98Y&GUPImCGlZJ{p7(P`;0BZ5={kV9#~|t;SV_%fCmv=HC<1c1UQP->sPaX
zw2*nO?AWDjXI81KJibB+=OGypwhV$4KTj{W^D3(O6J(0F5@edTpxVR#jg@>X4C;6P
zcDdmwY$Ua+#8~rz?JX0!VwchkdY9Fc!Ns62be}gV4A#zVPvZI>#RUld{-va&5xyl#
z>bYb5Q6EF6CDaQ;&*+gy-h96)k0+W!te8L%UUThzvIOi`9`Oa!yY2P!pV4IPv7$MN
zx>;^^7^B-Rflf{5n5|>9PY9Ay;=Ir#gCuyUNR)^uO8SIA%n3gR2Jbo&p8J5M5055Z
zjy&f&B1*%>!X4VxVlX(e%3&P!ezU^%x2XUB2kOQGw-%+NgjXyFVt+)*?qStSl4d3Z
zxKc;m7BnV|9((<G_Vm-bZF^~UWPYZgdH4(oxv36HGw7FDPorA15E7}mWO4r%t@fg0
zn(oVT&N}K9@I@>Ae8ke#7Cij}b)zZc(^6?4v;Rn#M+r{Y;djyiPK<|(B2*`yybAAd
z`GArln1q7zzie@wUzCrjSqLJQl!QlqbkX8ARe72~AI!Z?Sov7I>av6P@`kF&?>N_J
zc4J=Zj<hk?OwYE9Jx}lJ-xBdZRjj#NRQK(pA)Kx!Z^9*!sv8{HS2H`y`j}+)G4|+=
zvf1lraxt-bWMo<KBOl3mA~x~AI?!S+N6k4frhZ^>3S7@TKEylIKau&y^YmS>TUV?>
zA9Gu)^+xW28^+@Bm!W4$eczrGVML@S6N}3XbE}hml&gyGf8hDKyt#orWUS$tOobEr
zeGu_nkQ3Mzz}7X%)$(#gi3iCO6gvLmja{??ZgC?wOk{QvIQIabG(ZMdt~DP0Sb}vq
z({3Go-w1Wv!PQH79rVD8U^|c*MD}-+y7qsY)N@{~JdQJbfc-5ua4_f-6BD*N5k;jB
z1zE77*N_n><4R6r{O@OyJwvqXM3h^i>Oq{#0yDG@L(>)O(kA3}o(x(Rpma|(OyOxr
zat7HjE}z{uKU$B`!B04MK>$tpcD+oO&rqObTJTcPhAWf@k6dD&k>ta-AC@nF$#z1!
z8@+<zxRm0d#bdK#i<H~csPg?+XXvl0ss;VC4?k(#qh@pT*BLg|u;p_4d&&Yg*+C?(
z7F;l-|9rkno*z2x-wWyrfBQ&4tTBoGnB0w&G_BLPkadgmSrtM?wf(M_m&(~jLPM<;
zi<WU+$*ioW(~rg3#+?;10TNhb3Lm&=fqm5NVn2W!+^@3Pgb29Eu-^htuo#3iA3pb+
z=2;Ot5+%I~R@}yrc8y9jrW&XgQ05q#SZ!X`%jxP9nDHutqqa2WWUAKO+pqRL)8U%_
z?x0%prgpa7G{xZ7X3A^yk!shvP@?Vrew7F5W(xTOKYOV0LafVci}bgzD!+_8%aBQ5
z_&WiF0+TIyJppRA`-%Jedr~i~(Dtr@Uh5JJS2QigV`;6=sA~5KfxsLQoqrm7majzn
zxFc#S*o%D2tjFRM*@{80(72|*p+Uu$BQkU}zccj9wS2ZUXkDwfeJv9BpB7N@mDXS;
z179;v*j?Ec*(j9#OT@2_JaI*oFF*Ay;G7wo!ySev@;D7&_iKLxTC0XUS)vKY#mjm8
zvZkI(;uHQb`qFDL8;{GDY{qwO)gjOym4cj7ha9HARVosyalX*%*PAe>KX{}XfcsZo
zn){z1o3r76w}j;PIYj(s9C~47dymUp;bedCWmP25QQz3?S{NT4r1Y|2$phuWmgA-`
znEm0CBA=ww4^wdsz-a8-9BN6`viwJ1BhMF6RsGVc5n3!hCq1tn$;Dp~?_wYnnBvo^
z-|2B4h}inQ)7FxRx)f}OIuX67kEe`=z;J5ShLK0c%kE%+!^QbNu!ro{Mw(^t*Zmb)
z{&c<m6<Kb9_b2zq{M;)PuYGaL?^j@e$HehRowyQcL}Da6S^<uvFFoDGS5qL;cWWB=
z4iR^u`}$+|Doh6W>0+%nxB2vrB1d_{Fhc}#Eucsvz1Py8EZ|0k#;&?)<L|rpbN{9a
zbqgbBV`4(DPSW2!P$0&ixjLGL$%A-9me%fuQ*`Xf&sT8dgwEy^1xYiL8E&f!(-402
zNl{~Y&Wc}iM~n*WyWxWd__&(}eD0OqwWYQ_Y>ZQ_CTG7vKR2Ms)uMhS*E;v+S+mOV
zD$LTc@z)44o%qW8bb<cQ)NF$9f5S{`8_~WP%%3^@MQEJ1Ufm3FljE8(Z!g$yfT%5f
zwRn;swl*!)P4Q&fZegr<7Gte=vf++jI-{I#T-asy168*?9XWRH0(MyzFAx~^K#o@0
z1HQJKU2lrr0vm<-==*TDlaanbU)C-#;pralKI}0_Z~6oWb<*r^5LIJn{4>o$^6k0b
zO1r?~&eCChJpsr@80fcF9^=)5kwYp-lH}G>(;zyBNh{^m(_=nu_>*`3#^rbEAWe))
za1JeTih0JIcg<GGCa8Z)wT$<@d(PW?vJ7|a44%{4kN&dY1I+TKVELEwh<R6Z;&sMA
zE4M#t&Q|+DvNqf3-!I)F0}H@8&ZLStHYZ!m1L1zXym>|Q$n=$6?>zkR(aq9H*Ov<Y
z<<)3UAWeO3Q#4JNysWC?nKGKaTaE#yeoxOke^{b7F*8rJF4nbuSrgxt#SKNK51NX<
z$mKqf>Uu?e!6%U8)Y!@HaV6?3I*P&<$Uz)#DXPX+mbrKU*ND)I!VrZrnt&4IO1v0l
z6#wG<rTzh;OKSH%F!G|9-XI!^)uq7cj_yk@$)w-2(N!HA)5mUjS32Z7tW)h9Yuvx@
zj<<Cl_cWs*?z)ZU5~6}y6xoX{QVti|)EqQHHPj)okLvYh{DJTtJWtQY^;-|lZ3ClU
zqGF@=Z@#x0;@m%ec^jj(ryyM}YcS9(=zn((7Dc+lTfDaUs|+z&7sdVbYvb>;5<y`b
zm}2iW8LkK%u0t~Hc<DoI5B3)13%8)6<0r++&3-q5sBG&gsx34WH{+0ALvKYt82xN5
zq&OyOB{0PvYg3ge*2n}Z`-7fHjkkp<@<!49talhGIizj0uxY>qU({6nDT{yB*}%KR
z%mnwL0yj{1_xs%-^Yf6!RmEL`LEMOqiS|hG$7_;%@LJ6#BXf`CXQ%E2iSfX{Z8xx4
z_!3GZjrrR@954Q2hTu6*tmAggVcSzWQmjSQ38YpkXJUHRvinV?d??mNJMVsw)ad>B
zLJx5ZeDySs^D1xn+Ib^2p?~{zN0}@>#}{5c<D7ZC8bqFM4M^P65lQ5z)d#j0@#3Bw
zC(!fm2`;nU7G^&ZI^1_&EZJ%)8l8q-iNt69SrqN1H<dJm3gGWhW5IflS`;c0(?^9o
z6OIBdZg}S@(3|O}Z!VCB^$@IOQL$zUho!8{NCphozPUg?kQ7>N=3xYv-9h2YCO3e9
zny1adnZg7gjnu~_o$R?vwr)o+`15lML)IF)G{@2p1&}A4<&AOY4Yh{?LP2YGH{Wtz
znUk)~hTrY^&iqv_?`cq`9utRBj_Yhvq;7?cLQQiHcUl;uzlQ;U1Xt)m*^XN|aC^~(
zM{}ZG0Owo^P@xjOF;X|t&}9%aex`-9jJSnu5NH3E8;NDP7Fh6l^9wnEx2BrMP(iq@
z>!?|a>Zd%GmvZ+dFLuy3u9iB9`Wb}HyQ22`Ya3Gd1@dR<j;EPOd7C$C0!I?1GSI|P
zVVu(_yFq9N6?RtzR#*srlKu?4qOMGPx=gzH<E#fzh;i@#j?h7f6AlC~2HD%oF6WJV
zG@hy#!5HuAxtFYCI?j`pRCsGeV0y9$x}~T^+<e373LIZs)kgH_6N7<2s*?PcZ||Q7
ziz+X>_a!{(;T1q2>TofIeVId?s%m^Wf=ssZ_)YeqI4zM*{!3rPaxg9iynx8wgAClB
z#|i$daUUUk&ml(Ht(L|}@4JoYeEa0&1?DtJyp_N3vGPFX-Tn41%<WI9G{Ict&tLnq
zX>G@eo0Np+*oVv7duXtFi&W~e0ueYTwC?8{;;QUp^~1i+nfgMgb*5+L!r`pn)q5TH
zI?PfV<E&uZpuCx9t6Q3Y9XY%1K6&7_vls4nSG(V-pm%_CTAZNSvzWDZCak$p|7|g2
z=47|^w52KI;_|=F-$C3GDc?wL&l9v){+Z-{!R29iifzEfUmt-#Jbv*2TUK13KEAwZ
zep<u-as`QYVHjgysLp-2+(vp*Ok>+-9g+P*d-ft9&#4+>IfuMBBlUm7out)dh_5+g
z@8H&X?3=)NpgGTNCY?~K;wiTD2<vZ!IN`r7Ocsrz1CErX=64d3rm@i~qf21k$)yL+
z1KJ68SLU1}Wp7)Wl&8<ISXl!)W-=+5)6!1%k`GwJ1Pw1W1ze(3jjpPGZ`NfMd@7Cx
z(M><4_1B4U=q=ZFI9vYxQ_ndV<XH1jkbUss5{aKx^GPC{j~ei7amzb;uONy155-%Z
zF+?fz=`5&mA&W*~5mI^W(QCY~htur<dD9s!CD;XQo5NcYucB;N%8T9OB#^gqOb4Q`
zAu+$#sWO{xm4oaNPK)NtME9q{_wMC1@ox&HIi9xmuY9*1m*)sGyzf@{O1p79#&s_^
z?PpR{Fi<TyH?wCOZW6?P-CK^=%&oly`CHdO^^pG?S{m*9N~y2(n^a26ZT&9xL{eY*
z<2%y83$-n(B}9yhix2ZEGIA(O)xzbS(hmrTBY$$h2v5`x!dyBCG?$#m@3?u~xQbsO
z%i<U?K|sE&wHR7m{lc$^Z_#k)yr{Sya#{4Vs^DhRprGrl_>X#rJRKC{``@Dv<n${D
zM(>bFnyw|P#%2$D5_r<={rd@Tjj#2XYk9BSr@y+F^4<t7c;EY$K0d4u))%!e^I&F$
zWSnE~Uw&UAXv5#dob_rwb`CRc5jyocL@Y0j?s=ZATpq1$9f*{Rf^P5k|C9((UL{7a
zt!3tM;_pn|xrkKjD4?gQSg(D2Ly+VraBx!VZ-D;PKO!O~>AN8?26F8&_SxlAM#R9V
z;nmT@m#cw#LUfDi=KhKsKEK=UIbt*R`%}3W#L`e0nHQa|ZNFidf&%A15v%1g^<g$H
ze~uYW=b{1owF>iH##3e_{R=7X@~^i(T<oz|SCBPIg}D#jcgr_4z%%DJM|o&T_<~P1
zkxto7=53wWi#j>?480Ov7fh5Xo4-zAsh&#TckD$G<@Voobw|M$ninlzjRVLclrJ%$
zpsRNfH+;o}P1e;&7OrlmJsmvm<0rSk4nVu=HJm*OeC&tkE5;6SD*6rdHx44!a0ggs
zWk57V%@5YDzdS*ud%}ZNVguo!A;F=Jg-xxjz-Z_b8*|GX54Lglt@;o_y6ZbHabFQN
zWtunDZh*YosQSVtFF8u+pR#grh!5<4x14YFR<*;1ReHa1K}21V=*nI51dQtfPvxI2
z2~n~~LLN-Caj<VY1~e5<gO_vg?$Kz9F&u-k3~Lh&y;lzgqu111oRw~_X!lFsN~KRq
zwz$Rms-<^n>kf1}ma>l&+fN<bqzqbTIU>GO<@iBkU@Kwu?vO2LTiF&A^4}=LePWmL
zL-^J=f1idf?;9$!5n~+0Mb_HVAg!^W_W8owVdbhX9(UF(_2jpUArCLy-fZbM-#O2d
zn^B~dFZhHGA@@(x%z6hgo9~bvf(OKUMqpf9-!E;3RxL76kV2C&hYIAmqyOD9rX&BH
zjHmY)E$QENe8PJhonk!yvuFE08O*s%kH;+#gJW!xi+0!@XZr_(QNIoLqhoj~<g0nP
zu^5qy2I#HJuit|@G`J1?TPN+8gN^o9t;Cx&(HS(>sv9e_(P8&mCN^{)y5&oihH3Q8
z?Ezarqi4YSx~+tfT~F6^vzwp(j;IK(iHhJ$v5)}Jtyse?LY2R{dYCkF4|8H8*zy`c
z@kVTsECKRyQGwQ&=ji;Wx9dIL7lXaq$YGx^wTRqr<*+3^50;$h%d@??9?$9C)IAtu
z+e+0@-O!%dffaJ_!2hNZMKA!~+9!s7_j9B7f1dc^FC3C8ScqKGP*+1B7mzHk^1ZEF
zNOm}A?WX2%Q4H#9;OS6%Vd2iXWni7RbrbXSd@2!H*W%IaZt;u-U;6wMq}4h2n09W}
z)~(f9^`4rkB|&JGCegN8<7~W<GzsaA0$-rm+HAV^{r3OZml$1^n3u(#x(_2)0rrWR
zbHT;2e8>D9w0o~S$wv-wJN3bL?j>pr=*S8E{pGEjts${z;8ZOeu<les+&G?w*BE=l
z`W5D8@6}dr!jY4vribCd(=7p#EwS@uuh3su_CDbf6%Bg<gNNi`V_*J-K{1hXI|P`{
z+W=984EP^p`AZsD^c=B>8lZ6%PMo6LQb}ZFe8~g4)}-~zaQD=`;sea!@H>sYc%VJ7
zBnGwy^J<-?sSKxUZ9VYqX&ZDo8flpH(6|n)65NNW-vQs&e^;fp#R;f;2=}!w*r`9)
zXZ6t;ax5)IzVUlP=Qj;9YBgvEdNBQAULs!qq4jZ-27H+1f}oe!F-z$Twboh1@hwTZ
z{Y5L*q1J9K%d`gzay*#zB9EItUhu;(_G`a~ZlJ-0SVy*Hvuc$%4d4SX-(42Mu6HrB
zUS@s)&3_D+Y*pasq(RcHMD>tB@Z3sWOz*hNQ&#a8sHG?O54{Bb*ND(G|GKi?e77k?
zw2Vog=GR0DoSIYsQccRyhgWXS2~)|ynh<*Z#%Ov;U-La(2a%Pl#^`OCJba|yp=<B`
z<CXqP1jSbbn=t65JHa;F?P1LCb0oh$<!{xaO&31Z2iJ`ZwKz|`Uq=g%VBL3ix6J+d
z->pPv2PpFKM|Qt`PRMi)@@rUOJgV#YPYd9Ri#hZX@24k6SPi!M-GZOFlX~14(O;(0
zED<~V%rw7SC~uzoRSxN$vsT8?cyA3XFlbot{B5|`P)>0>*$Sy@j!kS{P$k@86(ePn
zv6Lh>WaT-c;_zlGZ0kzRUpRvN$&0K0oF9q#=C^Xmzs?pmL&18Ep0IyWQKf>hH=dey
z1y#Ee{oek#L2N)a@KoO8UUzDcIAbFwoP4o3mA~LFN$&cdSxwuoh5%;`uX=v^KDnzA
za_6V%S?+bwu<Uep_I?zsGJdja`M*hy`v{`AFt3vN{ZW8$nzkX_PwLLDx~85G7J4nB
z*w&!<aGK(RF(YZ+6L}6xlKBByVc)%kc8myA3%XfOQ~bQM>8YKFvaWv|z<G~1ep~Bv
z@3ESNpG?AHcL6W}R?WHTHIR~;-!>h7+nI^^bd^e2`u9dm#D6v}b!%1QO5K!0`Z}8e
zzigVy{mV(Jmw}_u>SMQtI(ebXfh(wegWA|fzw}lBpEqJ~47<LRb=Ar!1`yRPYvN8-
zmggfdW5`;oGKC0(RqdwEDahoV?AeZO-h8{8G;=gi^SW5Y4;yS<)^W59o|IYmtnT=C
zXEW$;?;eoyJ_Kt6ivmLoX8s$fzw!b7;uClApe%%{65tcGz&sYb+l?{2fByafbY{FE
z$)R!Rz|{tF0$`?ibL9Bp1)U+$XclvJ;_+49zQP?0ycDmIQXwBr&R4G5`b4sY!jjSv
zuq|dJX17+SA_}ZiPu2L&>bK&Y`}S|M1V1W*1OB9BGfx>v+P9{b(1!@jg%8irYo({y
zA7sa<%4UBylRcapT%)WXHKIwIIr7>jEb{A~540AWyDp2(`TRXZny6yo!H&|4`cI!Z
z_EKkR(FAMibJP&_9v|l2AB0zDCgooiXdP%>>P*?0zH+E}o}H(#rq;z?u?6jwKz09h
zqQYGvDpASV2z<HKNpur8$Ix^BeAn?<&b!wfxy*MSX?fM8_!hPZJdcSzcUs|fU#GZ?
zx>517KYYA@x!mDfPv4!vAlq-x=24w64K4P8NGGZC-}hPD_jZci*0f)s_e$#`6gNEF
zu1N}?CLQN&L3NZz0XO-m&;MsO(qG0vRpyNw`}>Vb0;JCR{M~1%8@ZM#@A~}fR1Ev(
z7KJ<uME?dHw6^FQIf}`y3AySQOTR>=Bz%`o+}xYI>EZ87>c5{aG^*NeQWRD#b@Nld
zcxBLUsbO6-cE>AoG`!&Box259I9a@%JlS<x&BMGuKvB-W{>^>N{$n4b4|%@bR%v5!
zm+vTcg(Y|+No<cFbhFjd!kuTJ;vs2#VUHE<?u~nCKNtz2Jh{6_Zxd9(^DZAmenB?o
zNmP;gI!qGQmuH-g4MKTeHoW&=ZR>lx)mHSkBRL6t-}*m0mmPd%gW!-fh`y`eiUO|<
ziRKNwK{L*1@o!6XBe}^!gMDZbqF7sb9(a4#4dft~J?@fhzZFk7boY0c;1oJd?h@*_
z&G%fL@_{5^gWGh1r_#*rqb<s3*LBCK^_qd_^XX^aKrSSgowlLMvpR1S^`YGNJPSq{
zdE8&|Nc9;|%e|Z6Q3cJiS8%SPs=l;l)}<xPDgGUun{VO))(WY5X)7K%L=!Eu7KT3?
z5^=nS9s?4TU5M68wU_E&l~$m7_}pzpO}6mfRX^I9&Ol~Yt!3&Iid9YF^kK>5ut?xG
zXrFSqFHNw1Q7BGVDXcm|&%1c#CbCs?@63J_fJ%__{+|o6yq#86^@fGa<q*UCU36O5
z5{<NsjZ)V@4OA=QavPW*sfLXQ0!Y1F-P;UHDy(|*fz;4f<+iMRAE+IA9y*c)ZHBb&
z95g?>j2yjW=IuMsH#tMM49;+r+-&#;d(g~Q<rTQm-Hoj3IzS)u<E!L3J?e&+;<s59
zrE52bqcoq$&Hqiij}d0zU)|7*#tK55!oKH0pL+)+RFf%uW`05#MOiQ}aU(5xzLH8F
z#@`y|EpSa$wttK>*s_{F+HR=pMf+LXQ?}01lzr7h<7rX{5bx^wZ2Lyb!ZHaBI-;ZA
z`d$Jlp`EgjsFPS#xpvc5VYi)EslDTQR+foMGnP?)_ou5{jG_002u7bupZ?Z+<>`Tr
zuEDLuGu*mTH}@8?b=Z)29^)eLee-vXY6#_J=ZZl4vB32{gP5-FhZ{khaxAJ)aUtcm
z+Gs)-ad%lWet;7o9d}L0lHK~j>(jR%fq5rozrXzM?e)5tfzgYUFQ%hh0M#P%S5CZ-
zopi3-iGjqB+yEZ80;de0@vXXzD^NsF&>_{kfenXVnsyb3*!Fy%_SRv}i-|W`zX0~F
z#BJq*WbwUQcyHLruHVfs^4!G8=eI#z1d$qJ)&b=?&=XdFRJM4xk%2<6(RdVsF?E$^
z5NwCz1rXmN`6y#(ZY8s>4twrazi6bDbc~YUD>NT$wXSxs`L#OXw4A>}K3rTHIdVrF
z)_)E6zzwgL0KEPs7Ik_yx`%y))P~gl7IWu?=Tjm(5fwLq<LTONS37=PNFU`<FzeAD
zKubm$`+ZQ?-j+5dXLc7{s>!xVc%+e=QM==n@dEbugQ+@@LUSa|Jv5pB$GJNx2n#BM
zAV_7<ASP|_#MP+#vZhROk&k%W>!E(i4vM8Q@7Ka`x(IW>ZPf@g)O97HAiZ`A(oAPs
z?0m6%T@P2rf!k(y8~7IIqd0-c{|I(@ICs!KR2+VGOT)0IgpK(Vi%wi%)v5nT9eRjn
zc&l}d{zauR_%?0k1UloZPjwW6hFt=W7-}o`EG6^56-2)Xp(M>k^O)-Zo~e3YM&gG*
zHwGp!kYB6zhnJO0I=vScs(V!aS#AqwG-<EAB^9HKBF{T6U3=;zqT7EEWmZ2?W(8ra
zG|pc=o55hXTY{&BH<dJ%8RT8~Tf73#zpGLl_I*xRXdhKQn!>Z6*=65Pb{REa{I2B|
zT%>^z!IbQIC1y)z>L#6dCWKQu8xMuKvr5wC#j`9#M72)XR1N-4X;5O)J5x5wU^3@<
z4>D>~J;5FjuxdVC?D5xiOW+PXas2e`=BlU6we*@CGN)KqZapB}@!k(kWc9A6tO9IU
z3GjF=KncwJfz6NcIwXXZ``d@qfoYX45jsc*#SC~iHFN;6W4uo9XhxD%$1tN{I#Z<2
zZRSlvmBN@Mbc_k1E2^7f7}7Ut4JRQt@hhBqtp%OP)$30s+a>v7hrQ|rU(>*E)(k|G
zVx2i}t^~|P^pxF})z1<O6H!K!J_SM?yX!LP_MHtwe@bZShv?M6qOHEQSSc5SuA01_
zB=cgQm35i4=8esN*)Ht17p?-w*}hPm5+b@&4U(5Rh(}lI?^sfCSzx^QY`7p^HgJyr
ziZM3QcWdcABKB>>B`>0<jB+}me7)5TL*;Sk8n0=0EjY~>IXL-3$cCoTc=|naWjCZ$
zaSu&_b-vcL1^;D)^4yPjIb@$$7V1b(M5%I4)jszN+UCB9pBj-wq0dFR8gy)Pz7X9=
z?zsYs<#Iw>cJ=algTlS8AG&D<fLftt%l*p^EtqUm+AnMJT-IXzn5S9XUOQt%<?$6#
zrlS`YyFB}7_bX0!;Zz}Fbm0(5m{%hU(fEBFRjBI{Gt^e&<-+U+-PX8y_wsICD6L>(
zpf1<*$rT9_31;`acZ=v1bPEQxPX2q!11O!$IQ5lgQd1g#$<D`69@X&P^Q&h#3&$44
zS@qK@t{2TQ#?~8$g&5-YXPQmAl+na`Egx&|Y#)E#osx1cFm;K(+CL@Q&x1&}2(B%t
zMiMivKUdkcP~FWgftRQd*w|3j3=3~IlfmUBe5awnX=33Ql+jyjOsYGxj9mBk;TpOR
zRual%!mZf%Y3#W4e!e>ZBF~=fv9Nh_s1Gz|>>@?3n7w#~H@9a+M2(@^l4R>!w_A{`
z5-Zh?)CV<11^JJIOu-AF!P;W!Kf~9pYAWA7KWy~*T*mR-%1N86TJHBvs2o?lg5xw_
zziSRG2<$xaDS2O=^+kbpzIFY4+dK81D(K~|ec7^e<0qwae>R)FV1vR672+C>@;qcu
z;K1H2`7E58aC=3|1`$86p*f@F>RK?)Zf{yHO5atL?a9}6C11rA5*12yr@kf)nWZVT
zSx6>EP`MTuJZL7@lT57yzlQ-3IO#a}y(dMkJI3gZN}jmEKWu=?Q<-#(hU_zJ%#ORp
zBGNOnJmL<b{o8>=3Zb0F$v-Mt^%3*C&#p_mTscXecU6xQuqkKj84kkxLvGK1*JLQV
zn$H`@6@4y7J1bHak^%8`$N_LD3)D3(z7txtm&t%D0G{=r_O)Lt9-_V0@<~s-5yg4~
z#JUY)-NEcz1J}fMTkay%X5CCF-^|UDo(?$cZbRW@W#I}8qHUD^h`km3xCQ+2RfeWf
z&kB)hEh~el<a&P68QrgJl;ZPKPhd%Qo_XsoebWgF!Jx*4H|6odb7jkMD9a66O(9AZ
zZR<gNV)v!cA<5X4pN;(b#_NXht*)tIxXjb@+Fg_+<RZ4!_Hw;M9&5~0Q;O!M^duy&
zia0SHS3o1_8g^#an^4Rz32YX>Q@7`DdOnB$q<NR35)39+5&r$pa)WFc{Tmo<ahs;j
zAPh`qQzpL{E8&HgbK7;hi8;1*yE993@vGHzA(3XqQ69`~?K>|;>uR?$WoT0<vC~GZ
z@g)lyZj!isb|~g@&;)xRc|#hffE92mpac-uab*6}+EC8%cAqIK*hqU?(<;6N_22$@
zWyo=<mn8RO_z|_9%R=?w-1@5Knjxoh%oM{pEl8dHi`M1(=Gi%`Zm}T>sDo`E%Or+q
z$DAfxXu&jdlRQ6ZfUvFWDYENbXx^|F?<w8{1+HTDuVmyO^0R`6CADC*mu;{4JcP~2
ziTt!`W8Rr)7u7OVfMF=FA*PImy;s=N7$mtCc!ABz8zBJtZgPARMy_Pi$0teXe6sEy
zjtvU-eIaTP`f<a6KUrBt{kj%aM9G=N8T9O~7g(g9G7j=nFv-b7@J}mO=tO-><;iE4
zgo?Gq#=BBAU3vWWS!#*6c;h}G`k+}bJ_J;{>N}EFF!T4({0<H9j+f@Rz9FA4WEbk9
zRLRn!qPM1M40|@ghX=r2rvo16BGtCxpM;wvHb)<9GEx=I@6sL?`I8+8k+;U%;pBOX
z<Y-#aRt;i{il_FktOFh6sTXU@jI0{94l+)+riKyD{Ijpz*h=3|s6S#W3eaK{-0wwU
zOWMU8u`mf`G{1wx!rIVDY@NcaYOtRCNvaq+541-!OS*zEyP@t?Tb;T5Y4?u{f8x?9
zbwwp?!)tQs+{~%EZ(A=<d=~Ag0?SVY3sWmiOLF~Zjly<_yIG*6wXLa*tUCaz#s9Pb
zg|lgIUySAyyq+?rIv5IG$S9-TIeO*pBQfn!Me2sjTDc#QtYR%@y9saJ)d0#o5;MOg
z*$*+FQ5Gho4l`kk{G@oHjQJs``0k-zleU%Kz-Uh?Y^>BWl*C^1X1O|e*|p_$Q9T94
z365KB!LPDKEA2yl2Z6=*Z*zm-V~D<Yuj8o1aVHX_yQz5Jm{&klKa)^@_9Af#T(+vA
zPc_+3^A5f4u?N_6ZxPbad}2@p@TF2ee@*KCBAiL4Q<tpuPHL6j#L(1VK%%z`Z9y$a
z#$XD`Ujb$Vy1DAyEL~QE+P}1~cn~N0dVRGHmKrH>R)>)}>-hwboDeG=)>=@I*H@V3
z$LmY)$>>`ang8f)D08Kc-*Ysi#+=$s8*D2W;}H?#W!Z>I=<TZOsWV|OC@(fr%bdE?
zfo4u0<vz+W+Ej0vEbZLZ9Jsc&z1f2JVL>f;QCL$N4>8p~WOfipj}~kt3u@N`2HyF1
zn+Zimcr6fKan8q}nC$PnZw3)|gy;CKIIGk9GZ)i+`q+B!XLU0T2x0N9nbU&Jv65tY
zIlhiwNLGa}L_p5T50Qe>bu$uY$NPS9Gt^XIQNDv2{abS7G`2T}TTDN%Ib-+zu0B56
zW61L}KJPe*w45e(tDQYjK%qEB=-STo@5soxthHHgel)|Dfv<1nhX7u$nD}b_60?ma
zk|^dR_k0{?lOiRmr-thC_&x~cJ|pcRlwFWKXdbwBkXwD!rP*^I{ZeVGpc_=_T0c?O
zgzV9*@#1->z*k)qm0^u!kgR3f7;ry<5v=IyFjBox<FLu;ZAV$O=2ZDV5KQ{$#EB-f
zza6utLiH3l0Tp_rQbM~m9b4Aq?KR^nUZ0mB5&FdHeL~e%vg2IrWa)?0S2vhf-QiPk
zr4kD-La`&X$&yROaycJg(iw@HS_1i`0?o)JkomKfmNdHKmKo#2ND#Ig?{Ul0ztDwI
z{xFT`DoT3di^I(ztmNr3<dF#79&dme&r!p09RlzqN=OXI)#oJ)`JPNZ-z~2OV6(BX
zPCyT_3>Q_w$670FCebV#|MYZc)aW`{U(7PcclEljl*&@i>f)RNR8+oU2A6mGQVG`l
zG}iI00QDbHZmS*F&1+aZRl{ZYGj%pO(l@%Bre0g^jdd}g>~JMTe*B2!3~o#f8xFO1
zTY#&%T^#2rx-kp7iP7zRjV)_dtv0@qa;279^c2WTS}iWP<jUBo;y@vJv1d4_-2`RK
zc)BH|+7Mz^OK&u#2W&}Ou<@IS^GiD5?szTPa$_GCPgVpMZ*HGnF0&cn_9<gT5(ow$
zRw(*3+?_nfEr^)_n({TQ4>$92HZC*4NbR;~@%Grl6?j#=>IpA?)Xb`TOWho3j!GG9
zQW$(0%Vu=%;W*kG7Yb}oTF(c$3v=^UCvTe{_ddT$^*EPSqNw`(0|EMy0ydCT<qnWx
zQ(I`tDXmih6+68c*MTt`wgjuUx_$LtDO)`H{3TLOX@vh_75T;U{p;bG`pfwgFE&vB
zo%jLOY>VT|=8p1j6#$qMe769Ola7twTU~hs&rr{FsMNbWY2Sly$x}XGouU-flc#aM
z08d}vt7SsdC4}|Icd0R=yy{qoF`3Bilj?_e33C<i)RUd-2MYx;&JDRzOLg<|kU8$c
zZF&0|3Tcj~8u<X2)xxZsutG6-k)@j@a0xIqRc`^FxhPcQ@u2iQfbdX78>1j_^diy?
zBL?L;GZyh3HR>=3zJHwmdhSx3!ESX`g1hO-*}Sx6yuQIWg6eH+e`Am<PfjHEj8hTq
z<{ZiW8N+_`k>Wf=*uZx}S99P<Yw5^BGcMlqw&Up5R>;LwCufoJ+l=QYf0pIC7a@Mu
zgR;YT&9kJHU>X#);1Hl3?HM=h{c-7r45<b(6<5lMIHj=0a`bq;5pPwSVw><N{Y^tY
z4?g$o4ea-Mt%`$9p(0i0zmOBYCCLG1olRXQ;hh?<x6lPfs2e6wSutznd0m-JpJ_Ty
zGy^ICaCyI>vgLLZxIbay*~%J47fRZEq;TSDXP1*!es!64^uBz9yw*;U_|oS2&fZ(=
zy-0@M@O@gj@K*zx=8ob*Zz>b(HpoH;>xZi#b4`@EKnl3Yp*kt@4x|_e`YL6s!j9cs
z9O3^B)czf1u>?C-g8;*pn?1+*Hr=lubf0xdi$s4}0L$PN$&9c}Y4SFD)|G3;yzKdG
z0W9*d4zP$$+dQu+^H&`Zv?|flH(m5!Fi9vlIwDpaEs9Se{7^~U+)*}Lmr()m;1Zxb
z`1n|x&5iX-95HX1|CB35b|0wgcD{v<acKM+Si75|=09G}3fFKKu+CAw1ARYr**Gj^
zX^xf1iueUqQig98Sm^*2S2JtR__YtLnw34^hb}=OUKWma5UPv51il+Xws|v)t2)Qe
zn)yK?CMdJ8Irc`Swz&AcLLaiUQh(Nd`XoK(;;wd50askpPE?yt(eYz3S(CAObL8hj
z?hM6qZVIs?2JB)n!+xH=&<V~NJwv@A$OO}U;5xD-py45vI?^Q~sj<azx<#dryPrya
z?{0{AYovLY-T6TERyDWv=;a!H$cuY$!l-o+*Ttjhgsv**<Y{O#0*4v{zjtCs%{+Cw
zagS%|J3GBVOm{F?ufkwdb~a~7>5V>^#q<s4r#2?$!LMeah-#(H{JX0L8)560fN$v;
z(OgUh(jF;iC5c_5gGs{~Dm3IhG44Bz%}$Q78NGKJBTP(0#qXf9p%#taJ!OxYuWg$H
zw*oqkTtX&a>HI#DjclcNs1%XZQx+ffGI+_9rrz^Om<MAjsSK&6ZP;}y+QYAU6{%6U
zslmQ_)X$Lqor7_H<ik{d`VewHF<sF-X5FnOW2k2t0vC%ZCDcFjZYB569OLi({-y~p
zl_jlDPne&??W1-z5qwt`F8|kBvHbDstTj~l)1~XEn%L)g4S}Fbvk`XQcb>Lj7e!`n
z!yvqH4sGdI&Hix_zBM9PoAQZu?9g-088;$pr}-sQfS6DP5r?Z(5%<LVKyVwD6ZrR>
zzNGYOBrjNZUM3ExR|(dE6-aaH%tnCTCFIUt-=i|`KW-BC4C_fv)41}pB^>olKOv%L
zg8+$y{C)9dQI=utay#u2pkeZg4M~IUTm+$Jq}^I1z9G*hfsl*OyFIU(d7Dw)f?ET#
z!Rj5mgL_dXRbbV?Kp05#qjq^UAOQ1A=Mh~8b1}a3Z*|ixXDi2|lv|a+hjXh!XP{ry
zLo+P?F9+{!^oeG`o_5{}7kMdf7WaCp*4~!F+2*|)oP<HwF&fxbs@YmNCA&S-k>m_!
zFCeajh{MgEpLorL@LkM*W)k@!VDX0$?BKJvxNgTv!f;@wl#)=d4q$;#a2MwT{cuWW
zI#hq*SXS2tAo)T`0;|}s?Y>QKm++)?2}kUK-D+=@Euh?t4D1N;U*yWrJ-b^kbl%TU
zQs9TcbcmPOMM4vMx5ap?1i0W<xjkim?PbeZ%MQZn=Q{ar??#?>Rz=-5Cw9V$1{6j+
zy21N|XWB;%w_By^P$i5sDFHL*${+WH`G|Tu&2Rc(^`5EMuri15zBU8S3-xC1dl$?J
zBzCRV7K_u*oIcEo@Tb}owA|CBJ`MHW2#uZ0LtbQr3}qeYen;;`19w5dy-via@C^l`
z(pePo?wt@FoMi7Wn&gK6(DqF?Kc8uo2=cHUeGPq8%)U^dR!d|MwY97F)`AoN`51$T
zp8!n3{%61eVbIDf3v*6HUNM^wTSs|?{*$`ViDQ+MYgkR%^5br|X9#@`Rew6)%A7$P
z`wcg|H!_{OgO=ZlIltp?uzN{>T0f=A3fu^aWmFM5!>thQWom5~|9(*YZ_~<m(~vjU
z8DVUOXWW+-U^_DYq8wMe36It(SXpD{(D-@TYsq&vvQ=gPBOZrhFIv6~cf}D4#tj2i
z4WbW1eow4y>nI7%UKXV_-$qGjIp8ix>plVH4^Q%S3`31J>B|^gZ_^X?en;O-JXg3)
zF3D(Yt6IEWet4#y!GKB$&z#*bMp3ZF<|Ac}V~$&1M`rz)HWZx_v0Bf(rZoAD%dhDn
zn`|t<2%Z<0!RYp?yii2^*>8)QGP(TT5;bD$jn(3I>!v2g10xM6_x6;(929<D-5-)K
zYIm@x`=0b+i|WVXj&mmZ$&&4{rk1^_xA5X2)@jrficfRkA8TjziQ>W-xxXTKHC!m+
zgiTUk+g!e3@rl`SBKpirruXcNEqPUbXVs!bz2h)uO>1oAv5Ecar%BCc$69-Gjhd!;
zE{PN{#CBXE+@cu04LOBy*)F2h91R5-X^R<aAAWQYFbK56rSW={W%tWD_Za(v?CoHo
zQ)JGq?eTrY=4>thX?7u74cociwzmsx;k{g=HIAKVDeH}Cn<tYuU_v=Gdr1q*zPfOd
zKg9<No;)l6r4G6CnTF2CfbLL`MvsCt?0sEe-37QI^3%k?#<?|&&~--kJ!x>eK1m#h
z$na)E(Z~yPHW=ATA}76#7H81VW{AqkkoJpUncJ*nG5BZFT*|Rw%VXP-bd6lj6=>rJ
z;sR)^f|ya!D`{BOPBU@ZXX+a7pR?%`#-2$=cLfT2=a~gBpEe(V)b>5NLHRQ(JDL+%
zDofYSuzj;>JA1XCmOlT<;!`7`Bfr-I)HVmr`Pz4m%UDXi@=YV4PD)+r-G<bNmC?~+
zo&WsD@aSEvW6=nUlXrcBi@M&%u|=vguA%~&d*b3p#-!=y9I8U|0<b*f9MX;5weBMW
zH#U{(Dj7~>!=j*zRDpUFD#NawJv9FJEg3^(zJl%W<+O6TNORH+R9s>Tr`pm5i%_GR
zV&B=4DY?c1l`pvHK(;Xmk+9TVgCgo+hY`G?V_xJ{SnfT#bY8vE*8Eqbzw=#BQrVO<
zW^tA-U|{=Ikf=#*+5Q`ulLec*4<!xzioO~7CkV`(gOn4>h?$2k{zzL?|N8~wK3o?Y
ztoPTQjhtmS%*C=I8SO(Q;>rirxu?D&O$yJ<ifa!Xf%H|H4JuGO$i?PfR^h8n(rh&r
zttah6cum*Z+>->r*Ot77iPsbZz3Ig&i$X=m)X;=})+6GATfn`?O#qclLZ>}Y4>6rU
z+5VTr@;C@kN9UUfA!>ozsWRPtK-FD6sI4_2(dKx)lJA3RyIw7O<~9pcg7Ls}d1Bf+
z41o2a>P*7^55pQK9T|RCLjQaDz!OV*$$qb~&)^9+Pv)z;pF2Hnpa80ikJ^DC->SQi
zf813-{Y%Xg+EaO4HF0uny-Joi+s4-|in>;%yDR!u(%xb#nn$FQ@6KY6^$&5<!4~df
zzHGu@k7}UZ)PgKDcGPpk&D3L&Xd6HGvZoPSLWv<Dj0(Wji+`^Ue@e`?fa^akz?4PP
zA9J$jW6m6xnzGBjDr#T13tX?9sH7YTwiY0;D8{uhp4hahew|?=?uyYSEe(3!xtlJ4
z1J`KfWB!=~V##&E&CV@Zbx@vtv+WEA(<l4NOd1S690*-4C9{TjB?SA9xuZVZH^XXx
z2fF|zfw_U2<m9Sp)hMwJ9#4<B!H%FAy?@MN4<KG9c~e2otOua)J7d?bYcoz5T91BO
zEE-8OGhJ0Tv!ieWvQ5e8JaFHympqu$hD}nW#%z1Uw7A+D&~aDeB+)Z&7r-JOvD=?f
zMM{2gLTCmy;a0T%xSB6g_zb!luK*-1r=ddNqtLY#IM-96U#|h(TdQpL$Fl<^g4sdT
zf(>u(Syg?#uq*%#ik*2W$dRU$KrP+F@_@Qt9<xYUgl=A8eF^eoG(tBbcSvobMJ<H?
zB~&%9@%ty%tuX7bqJgL}EeANc-i97_O~wW7PS#H1_Z_YMOT{F7Xiu38Vj60X(wI=#
zbYZmW+GqXa6ks@HZF0#iWhsrVz_0lU^Qlya=Ft_tmKw3M|4nLKF?=nC&lavSU7xxv
z&96@B_NuveeVm+!z^T|{e(7Ro_gK_>le50)vFCBd>36<CeW=_RR@|9|M0sC=%Pxs`
zFC)Uo(jP5o&slqKp}n!L;qg~(0ez9L0iedoX{a?Spgh6v)ho0cR<4YzWUPHMTls#J
zaNtK4zz+;t&kO*0RB`F(h5><As&S3u%1Wi~jo#f(O2m(5EY1Yd67?uZwJ9zfIP$Tq
zS-+`lUoOYr4;OEqkyvu}LB8qStp`SLJ0>vR2r*Ow;KgM-wg13}DtBzNeDe7+qA9}j
zP4BM?KwIS8C#I*x@cxTB3uTMdarPn>7cGcwY*w?su+SR_)hUl6_k7MYvIudTC0|`C
zo8Xh(Q~Kyi&lyBU3XUl6n;-q<@vZYys~%=Bh>9P}4O;Ax@y~@Y-AKMgD!g9Ysj;dD
zX=l}02fQ*<@h<0Yj5~Urni8s)SK^J^C_#RgEdahzGgOr`B23WQW3GEwN3`xybHSr~
zR<M*pAv7dn6@M3GF`qHvztEsri|8mDsQaj$L{VQ{2fF7+QC8GDr1<Tcyx&3U%E|B}
z$<+65?!uw)iLh7XDP8Ni_wK5$Xo{(~qn@*kR+i4MPMa#F#bKuv^6%&4vg(kK3PJNb
zZ(pra>ISm=F214k9+`w3qoptr3*DdZ^a<(+cdnD`It`Oi?~oNZ!te*@82+eBby?l6
zEZ3mDQOan$iS=3>Lmt*Ml3%8_VQK=2A;lpD3xRL%aiv5JlN``nPC3HsOFOa7YFVW=
zOKK+PpY~o~j+1g3%V*^5t-xLK9ke76%DMj3?YEtNvwFyx3TtCe6Xf?vTO4omYqqIL
zDDqmrtoxGN*N+feHUxAwKMf^7r8LheqYEbTtM}X*`-ukG(G)1>a_utg^qbg<Cg_V+
zBb9JqPAus;ZU|kN22f$$X4kwMCWIt%M%T`NB_#c1y4vDe^o()bx%y1moJvQ%O{W`c
zR|a#L6(ll0)R5Nno9m=C-x>nu+;%#EYn7X=6zqHL`yG^OTZYEY3X5Kepgw|0k$HES
zUvJrRGAdPn!1Typj{JpsQ{bbKu8m&@el#w@<ZhZ<5frktYkbagd%^U;Xv{61O)l+0
zB8NeV55ejH@!y@TXjkuR{KIZD?bw<v*$bh@dI8l1`c$z5;h^#YE<<TfZvl$RiU=wm
zVQ7=pj7+8y15-Cj+FC-zGE^aufC+=s^MWtE@zr#Q3h=vs6_MU+#P+b7$Od1MU8~kd
z>jcuOb6JMIfeos=7E0%<m!mrei2(eqVhUFG;aH+5U3QD9>>}B?hbdhABDK)XHdFBS
zqJ3VV;yNUT(L~#6K?1&uD#ra0BUXOg@JBN?XR_s$y`PXjd_~Iaul|FYP3Kun)A6K;
z|H1d$qUhIgZ9(8)$Ioe#r>OMVN;aM4!|mF)-=qweJLAx`SbekBi0LMkK+<SvYi9(3
zx(O@5EoZWD9BOp@-p*vnlGO3!aO6zueV2Ah*E{ELDwWpvMX#yONO#Qu7eBQUdr(w9
zykoM?YwCmD%7+D02LdI;Z<nt}d19@4=}-w<^*Q4Nuu$Vuk+iD4k*M3edTYqRR7Tjk
zKvRiZV!rfM2#A>2L>pqMefSauqa&1jWo47Rg>&7!RSXKYtj8^OTY3cJO+euUegjg5
zDx5cpJr_Amb{x}FV-0T%`5t>T6Y9#d7cg_43oP*#EJ<cyls$tJne}|#jTV4im4~SV
z8E$mais#AU(Ao1#wM~a>eOMib-<)VcmcO|~XTXT?xU$nAmH8^F%mFP&8889LfKB}8
zn@2akow-JEaF2k0#s|6-4+SocqBsBYT`wcDs6M_?EGwj?D^}L>v9YrL-c#ayKRM6b
zK&SU)ry4)pT7~w!Oy!(J-ftlQD6zFJrEQYes66DIEI1Krs!LN)K6x$1<#)T-NFs@-
z9)Ly~X=iA{S=o@Wp!O3~t?ESzkFz?_eR&=tBQK^a1vp%XE)kca-I<6q{!&Jx>LLWH
zVXLhf$E!ZNlAT+3uyL~g5T@CHp+{J>Z%`Gj1b)FMwWzqd=IJQ~JL6~cEM6kp0;0Fr
zYAkK48Sc=$tAB5Npg^#@%gC84I=TA(Mxdpt7atYBD!?@VBott0;@c6t{bEGQa-w=M
zOXb?QEB$Z4#CT}3M<UN+(DHyaST7HgEk&Mkj(^Zz?S*<MF{xIbsYz|dXT(g<Z(rBA
zkvq-SLE;8posNL*wtlwW>a;qm5evHfC7#+ak4W~3TX|J1lq{ZSdQkIMv;oR=N}F3(
z6B&kJvBGj%Cy+$bya5pAgXah;no!7qhYWZ!kzc9xg|~j;2cm+i?0(<t)WL?@F&mW+
zALpV)z3qgsp}!j5oi%Ul7nQm11)u4q)1#OTuX7uUus5QJXUbk=lgG0WB3@k5(^-hD
z2Cci7`>#SK(@M4g-8|o;oNv_;vD})Xq+m>XS3n+?|1hi#!!!e{fByg4yUu^M+PL36
zs1AfuqpGxawY6#$rCN<GDQedqsS#Ql?p9S%wDwliN{Ct^2~xX8C=n}0QB)$d2sOfU
z+@9xec;4KvPLdbr`kb8W{C?kco$JAOE!Hj$n~W+y1NDaOa>ojji6^E80r03hCl)B^
zO^MoP`1e)isCqdx=c4#hV5(K4FTe+GOWg)aU9S)B>)K~^iE-~HbHdt;#9Kn~h_0<~
zE3M~ZRdo4J?Hgur)rJaq9cDh22Qy(?*5PE2+Q8t)!VB8|F>Q9P@cms7{(f7g&}5B}
z0T0L$Q3)~6pp%4bp$!15u3B!Vv+NQ8{^X)oBSj1;`DA4>qttX!E;WkHN@x?IfsMQB
zROtrlLw(Y)l9*32Fe#<I0x3zJjiqjig_fE*%_H+4j0Y<CnE|f>K|tMO8S@g={r;@<
zTb0xP&$Ey4^xoyU5wbfuKTo5UkBQZPor8J(feH-Tqh-<di{d4=(1>i{<{eVxi*1We
zKOx2g<8~4H^!D8kK4OWX<7sQs35IK$c-1x9%i)=RNpoh+;+!85>pQq1MekF3&O6Xr
z!5dgywkFJHo#DChg7?R>UwVsyGjb7*lU@z4L>C|d+c(HA#ayK+mL+jS@bWg6m*A^D
z?klwS0o&0KvRc?9eJK=RcvrM#33mUwNCMHx99DK&y64|;F1M6PtkZ5=las0%=Mq)!
zA?vZW`3tiPaj{0m3}m*@V>+S(%?VP{->vBL{>Bo)!u(<y<^Fj1!WO6c8CYID?a>yg
z_}1l;xm%-(CCt0_(MX!28rwzs_Yv(A;~8DF`lG5x*2W!?-s{Z`17qw%pEwQep=N=L
z)Y$_t(|3lA24&8>u?~5O9oE2X!vk~ds5h}CiH8bdZtnfZiK#VHlNJ}MKG;(7FgZ7|
zToG39+>%9XiY~dw&X)GL(AGWFD~gz|p>z<gDbU$<Hsf_&pF*R3KS!ndg^j+xfloJ-
zj^J59wotj{1Ms~3wNqP(MMu`9#1bQgQ|hjxOdPhAO^LU-|5HZ%cSPt*!(S*yNTJtA
z&PAwe0^#wK;CYRUlhsV!q&ipWek5C<BKOuL$Y}3ND_O-M_)iT7hTUIznCm#+qP6y6
zISLAR8Qg#sX!!E^r&!AZx<hp>6Q3{WrVuGUdv~^IS(?2Pwdm7bZ~wJ-#ppDHPk3SP
zk)IzVjW;va?tuqSSIqj)OB+~uX79Kr{M!uPGH99PWebabhS&<GXaf2(61FLZf87q)
z3}-R;p0sd?$dgPi1uWf&+u}C-j|PieA%D4~`9`0J^)_yIotU<?f_d%yd_*nd&*?J`
z754h(Ts{)=Xlc|PY5v4cP|y>VJB?JH!|G=U$&SLNb?D|v@7R%6_-8lcu~M{tsC&RB
z3(I0BD8>q4Rj2no&Uq8@CvYpoG2zJA=w<0ac2_m$A}`7G_W_zH?(E`^!Z{B=oaWI~
z#|-aaT96f!hS~L@6c{a4SvfMw-3iu`;^X9Vfv?aLH%e%?ney0u(DjlFOvub^8k=~t
zBEK`5>y?bAR`pVR$GzX1NhKFj2tsu0TmEFOFQ|FI+}&5DZaF81py5{RTvd<T(4OdB
zobF!Rdw#8~3l*PTx7{}gAy52nz6k~&yDfIY!WsAS#%ika>Qt}dj%fl>e*KFfGkXI0
z@avo`2KiEjd?$JBj6LYOlOvmK@q$^cQWQVJ!OYC#<6F%(?qTAPyAZ@|T;EfD1_-yZ
z;aS4=-7x?usbuk_BhcEG>`v@uUvA{7=_U)X4%vI2)<_7qjwpf+Oqg;++?pFy;~sG8
z*1o2fY6`hGy7dmyO6aw<aI?H{%i;--<CcO*1};k6&$lDJ>cmIVa7IH%-P`q&B$W7x
zd=z*!yIfsO?z~p7+4qWgdQ9y;vn7W73<r<~pkOE$HQklbo`JpS09~p4+yirO%#C%8
z)Lg7UC)D2UN^cOZ;FUWA9=h<cCs*CaJqQi~DW)MCx<?L;<4z1Ud+-w>FqQKtfhHAs
z7lZO_PP%7u=8Nm-x+q^YUvu-bK)2a!A=pBH>jH96sGCx$<Qp)F7&{dc`NVy2)M=ez
zUI`jm7;Gy0CA39pMZnqNObIjQv@Qp?LYl4-AXm)A80^Vr-KtV$SZnf~5p*t43zL4T
z`o_URPNoAkZqzM6Kc}wI6JgcSa2ju6ZsYYYnz8=+T-6>+qOwgvs-mM1v9g0Fz{mgI
z3v%O$V`NKjP{|M6v)_s+CzqC&&(gRwwdMDUJ5#ahq)BK3FE6*=@4}kQVu2g5(;J~T
zMp$U<m+*CeJsM}9F?lB^0>OI$l=oKo7<*{>w`2ge0PzTJ!;{8=FJ6^)S)roQE%})_
z_sVY4?Bw7<T5Hu9H~!qJV_>e^IvI2?T(<P!Y{9^gs*hU`gY#HsIs9Vq4RdFcc59-u
zZ_j0y(W1)BUk^X__&+Ux!uuhAR8ZF)PgYG&mvBYvY!qB0SM2#D)|5iL_5*N}Kr7hC
zz3nzeyMg3Q(5n=;-ce~XynL?8>P<EAPv=O`Q-)Z}0Q^)okvjAigM<imJ~RgVSLV8E
zNx`pDy=NBDw?RS;e@t${)t_bBJDPVx&#k^Ve-|#En$)Du`(qC<wi_}Lxzn8<O5R*X
zL!s5#-A!ddE}18~`hMRBN(glW;9Nk!sJWc99&3mxoOKLI&TT8vx|`Jh^B5EKKw6(S
zCsndlK`^=aZGE|`ueU1e4I8J+sHAd_9M>sZNbP4zLW9|wq~{`O{pN{DopiZ$lV4e#
z>gAVdd~ck&A_emX6fS+N4eVRuPr$6tS<ZP@y0;eF@*nm{k=W2~3>EvU9s~j~hsZ64
zGQgk#KPYM#RI4f_Q!$b4n=c8GF1s#zOh_7OT;poB`#>)42-<$|x;NKHGy97fnMeDr
ze>sq4^9`=*ZHIe-!ajS58mmcPymAxO<5~(6X0I`Ow{9Ekr7&rcJO(xA9NQKrBAzCy
z-3|%+6!=I%uNiG`h4!vrsT0Hp#vCA!!`_@V`m(bD1{<@yRduG<E9R(ANvBxd2>tmb
zP!9U)T`a%+QYU6%@72wncv#V(HgZR#45vdc)Qyz(_Sgu_inAoAA&6a@-3wc+i=D6*
zba3;(P^#__>gVNCX@o(>xe9NcP``Ivng1-A^iiFu$lW~CH%cj&I50bN#u-tHiM+`k
zXZ*@uF9x}WhqKMDnLh2_R*n9~`#olMFQ4KQ)>3!HBA}V3Vh>#vY(&QZ-(>*&DXz$8
zP$<z>7c*xzK64u!Xv<V)2R5uY?ScJWzQgl_E%6<Q$FrqSPiEEcIUIZ@eJk#5G*wtc
zO!-jy$!X(aKEVuHc)!-vd3yA^J5_0CF91Wj5x<+C-dXl)r4Ui=mMAx)+f}(S!}Hs0
zt@ykYP9Q%?$y58saH1`gW;2o$@)i9<11N@>YV$9x?=z7C$-4r&jLjcQ72{c4e&S#J
zp1#}0y+;%@rx6#0(rKcR0f$|(C(+>%*8UK6@F=@rh6&;3?qj2#Z)KIL5}xmIazDwB
zn>EIeXps{mXfW4CuY%%Edbl9xc)#nIHC!&pU47XA>RP%sd>A0E=ltc|Ul6PsP4;b4
zg!l`>O6Zlq-0Qk$2cKM(zj+e$<)N+v$o#|3ud4K6nENskR!9FjN(z|uF8EgdP?p*c
zF2UbxU85#Kp<<AssfV|1(2CLNV$L;1#RG=6Wb<ydu8k_;3_cP~t<X|ytGc4c{S{79
ze*0CuRx=tBX~gZ%a61SH3Y3JD3R!=+KOo^NBgA>lC{8Cr>&<{C9z8GYsP*D)3NeG%
zLRd?Ls2@k@fVix&V`BZ*mDe;Z9SpY~j10hjx`BwoW4y)zk7>*}TFxU{<owS;h8b@<
zJ*GIjN_yhKWKHig{=n}ax4L3r#_s_f=UCaW_#Am4&<M6ao(i>I9FvCXv0TL*8<S>n
z<0eEYJ-Gtz(7bom$?=nXCuM_pN~i2K7JSEKxqkq*W^`q8rgp65yJIScZ*)iZRsF_n
z@U!Sj?|#V1!2W=3y-PL2Uto+v>mhTs!78a)@niT%06oP5;0f^7m+yA9HVC!4d6N9g
zsk^Up_%wcPR*Xln+9d1Ozv?m@ua=_NCI1;r9_KBLkM7hu-k<l$Z$R9*8$&@2)$2sH
z7C&iu?|T1Fdh{nXkx1BdR&}@(2I~D+iUh>B_PzDK10^E#h1K!YU&s$KcS<$2w%5&D
zy<aK7sl3(gf)2+>+NsW}C3#6&_R)I0HAJ1WaEmKqON@6o3*UF25Mjc{*08Zxb8fSm
zBWI9a<*@-$UfQE9vEv2Ly*yE!`egG7Wx<ofZZ1;$@tR2>F(3*&Mc3HOwz|F~IV7%?
z&WlYgu;?3o<11qZh{S%N$1B_x>Ws`p|B+qwLQ#j`{jqmv^pUw{Qao-Acxd}DEOQOS
zpPHPRxe?sW6w{C+!~~MjCddt2{q={QX3C<hxCZ_9SKUb<?RS5**0q--<aVnS*_T%K
zZ8ie{DgubA&=<jNUitSYn?rvlsqWbn)w<vu@#@lG0#qyKj^NV)S)Pff5+N+4^AUY-
z{go-*P;|pY{MTNentv*)do!qWlJvVtpWW^lUlM7TzRC9i5-xV7eQL{_62yhs!tFLW
z#cz&BB#^oL3+3I0(?OHt-UhE+-8_&d@M*L5&=v6mFzGjFWwuv0Z1_V|L>ikv@@#HZ
zQfeuLIbqgKJ-LO9k&_v5_p-3u{`Cp#lV|;)e;sji>!Mzdy&{c~>m&Psc(S;DwxD8~
zs><L*C>$@P@~qPM?=P_P4z3p&#EE<4eLwl}2|U_$w?Up&aJn=8WZgQ>>;5#?kpBK%
z@V}?-@UQul6(d#bbHvt)Iyx$p*D7Y4bW~U!F^Sv|yWbj<x=IOMJ3mj%kK#Us6OA4n
zd|Z`w=~PzG%FzI$<#;Y)qc=!ZpY;YS;ztQu4UO(c#SHK4)J-R6c~mXc!d(AEMu1-*
z(PPPz0`ciz0U%DtzJ37!b>|uBB1uUbc$>|Ru~oE@B`r>7$rK-=&I)P$&`_5r;KJ@R
zBo9*O+{N0Y-^ob2K5?oBClohv&ya8QjyQiIaoq=#mrX}?ar_~j%hNBbgLpv$x>u8S
zxN_cRKc8q?4(d*nF)sqdM{4qc(pl*ZwZe_*-1RA@Y#I-INfJ*%amlCr8bUokreKkf
z)SQ2%Cefx*?VG+)xBvMxcJsutw6u#3B^BCo!G8l}Ze{je_%gR%62hGO&cQYRbP$_~
zpcFdB#Iz>ITET(*-sJYdFj3z@_tt2=($@eTj*}aLRSiru(Uh`FhcMm{kV>!8?L?=P
zLd)GOQ(ZmRRQI@~3X6Z%#e86~7nNGg#<wx_y4lqHJYl2ycihuDyJ>sT2G5FS4!1m0
z3{ns_Zdm}jx0%9J^Z|#{t~C^S$f!{<LhWQlc~+oTe!m|x{wUtGb8QpM(%MB3yzAAw
zJYvDP!s*b4Xm6v6_#x!+FW=apKzbq+F4Z#f%DwgzU63c~%P!gqGd&&GF8W0;#V@X(
zK87s*kYwpN9%>*Z$P(NK_&djk$v}i;A2O_tpoOB@%S8vl<{o{idVQ<Kx`ufOqv}(R
z9{An+-$~nS>75R$)zx7a6T+y-6yN;sZX06@(6Ko={p|Msp_i5G+Qkm)@opx`>V9w1
zxFj=vr-&-#KXRfrm|MWF-O)#N^J+t!vc2gk(ehFEFAtNGF5;<jom~f`llt-x(Wu<s
ztMzKK;AE|A+pzaq!`)FG$i_+YOnbC7ht=5-?O0a_lq&a7&|pc*0RP<}gS*@38Fw_j
z<J_#RldsFsY4_>+u{uH(7Ku%=F?YY)v*~$;Pv8Pn!sd@L-Kc|VeZ^-xthBNAQG=!7
z;`Xjfu|pGN=^=R7k#dPfbnrp2S%sg*oxwl%Ey%H`GGzCd>IRfyh=kYz3!z@;2Nv2E
z(itl`;QXfQ^|dMQ^15qRR}L4*G-r#&4{Y_dz9~ZK?cE7xg?S=-eZF@OGiuFBm2(?B
zDKl{27DPRva`<$MUuhq<5m}+GtJLhaC|+|K9|*ME{bbT%6Rp>A$Q=ed3HO!JGmo`0
z@WoYK|4Oyrm^Jx02i^TA!X<`!cEK2qzT|>*7NYv_I0yV?E{^7q)4IkuJi=AvU8y!L
zXQj&Bp4skc`~2l;>je@dqW*I0^#I2Lf+H%Kc~5sY^gK;A*7>aBaw~FGQ?{jlrS0NW
zb9Cc9b<!3aVb*_ThHDx(!4~JpE@M1`9ERpKe`L~K3r*Z6S8;s-eTXkF^fCg)D4k*!
z8#awV45xFJvvj*`=iGs9LlSFJW<Yn)$Mr7bOh+IIcvt?xyg`}*f>j&i<mp*#D%2}#
z!)rVqVFrCmuv;D-i&-Nucmu1w7?HD?uFuChcYG9O?eIjn#LbeQ#g53Oq;;EV)uHlQ
z`!?x)vre%3U(H9R<s~1xKw!M|kb{Q_?d1I2nOgJQOJ^7lljGPx()L{j_TX5yvyI-N
zJvZC3@-@d5_<h7Az!a*@v%g9r<cog<(&_QzbGRg_xX(|;c)^}>VkQ>dx5G$R7r!y@
z4I|S8x;)ewwfW=Aoi#9DqQj_WZ&brkAinZ&0w7jT0Sfn)T5IUprrq3I1E%EGeO7E+
zD}v?aK4}Zqc7OEq_ziUv=i+xDjfIC|3y%HDa}~cNMcVuuz9s}g^ZC?(9Y7NneUoZ9
zUf6G+*QE+TbQ_M)5sE>Xwcl6U@|L2j22B!}OYo?DgUT}me=s-LtUSSE98QSzN1&LG
zcMZF^aGNRZ;?=+7wniu-ifWOfGc4!MEnt^&k_FTAc4Jd$M=Lt9o3QH0HOhP?C+z_|
zMCPt|FZq{cCB_UEK$TJ$pP$Dc<7E$7^FegjvrONSx)ahxj-PFsNf#dc{02S{GW$%v
zT;iNR!yo_p8X)uWmJHjIy)J3ACS11qX!~Irm&OOLdI@<{Pk3isYH@S#+SQ)0k@@ov
z|Cp%C)r%RcbY~To*oD2oxzX{OA+n-^X&G&cj<MCuqmfKd3U-%1U|PX1+A&)|c2RZA
z>8OQB8CZTnnV$70UwY#4GUec+FOg>xrPn{(Y`1@2yZmf{9DK{097#}}Etsr9LZ+|!
zC;T7@CvjWSbKwti%plnVX@yIn8JJ{MQet}77NaC<n~Mm>FqV)evR*7tCtSiefSz~&
z5dh62ywa)+IDfkV>T2+^*bAn3P8C`l+Du?47tOyrIlandART<JS{|d*6Oty5g=f2S
zKcG|Q-GagKZAEY=-dD~-qh|H)&{HpbJ4^R6?QH&3dYJnXa#4T|XYg;9YCjHmZaz;t
zcglL>=?QgDyO?Z<MV@cxru9Ds-wnt037pO$bWf`^o|VlD9>g@$g!Kz(zJC@bGQ<O^
z9f9A;qwe|!zAJo{(Gea@&c$;IpM!J5Y|!ugOQwK~(3XXv3F=B82d^@o`FUg~zynh>
zwckK)GnxOJ67?%Be_2L38Ibf-ctX4y3!hZ*66(zvk9{;;r&l5b6M3Tl1rC)Zjh!pv
zuaZV-vwKjEo9F(TeTmRj^#`1V3NrUBfdk_|Ecm*JY*>b$TQ5ELvXGRMGtT{5iFbKu
zTNiW3OkOXarpQ)Y3XD8^X?bX$y_5rGCfy>jt*R#8NlMPoB9~XVGlbhWaIM!k6_Ut9
z`3P#Fn~W63KpSl-<%yF=xwmt#6i9e0W=Ln;%&n6y(5vtyPaORwQoUQ{@|PoBpdC?T
z0%K<=A3DTR_28a{=?#mUK{Y9&1vLpo(7;iecpjVC*^Nrd%1#?~P-NdjfdP^hJ73KG
zcy(v;fXta{$fFlU)h!WN!9;=L72$2%N}*l<1sB(mw-?vD9qYX+-Jized5C-~u|>{K
zO82Vqyu}HKY;!ROF<bXk(zpvFrzTARXR_z)ylht%cH8ew!<k9f)Rr%NK<YCXSi`kn
zR?~KFSZ}9%9mPL@H-|$}lG_4@Us}6*z~2lAV;gcCemG#MtiQT2WTpNjW>jlfv&P>k
zQ@r9Msb<+s+ElIa;4t!~*H9A+v6O16!)=MFc&|yM5AMRqJvgm|D<S}}VwN0GlRHZ5
zQFh}ON8U%A<Nj0-pfRMm==e>><6#jtwe_~orgHMR>luBy8`z?&qNI$Cfnv_7Ph2zz
zeNg@OJ!HJ3<({ndwyk3gyIWZpf^E<N3T*V~RVJ~>b}(ZWhFiCux0f?Cpx78M$$C~?
z*gcJ=COKv6ITKYo#mGO69T{DT(o7|RlHe|jhVzk1HH7;%WNz6(j!<pBYsrs4>cG|i
zA-k7ufi;~JzLzd77A-2t3{zF>#=oL(4c2=^MVCq+#&?PVtD*}3S0&KU$&*Jnk}C_<
z)vSN_&0l%U$5KN$Zg*AzmOqO5k(LIl?EUj2v1_aFQ&o)$pWR>O$t{(JUmvm}wz*4+
zC2X3N(!kk!vw0ig3Kl^Zcb0=%Hw^N3=Y;0Guh#F1za=^sF$H)ZQnsVVS}y8ujf#r_
zT9Jg9Ps8|uD<i0$_;7dS?zkZqBwi&p$rVNIqa+xX&6#A9ZuvI+_*9+8x$20%E{VCH
z_M;YGHFavphRKJ>7e|kH^9{c|KkQypj(z_sN!poBMF-Og`vSj)GrPgweJUi=@guU%
z{D)$1_%7089$A`i_P|@kUxeMKz{vr+jFEVL8Aw#m=Y22=nIYM+uSdK0(FXnw`bmgu
z8)=`P5+=U56{I_Fnt`qs&csoDBKF?6Q3D`h^eJ40$n^2s8^@I<3nx==E(Lr}Ga)$~
zbKhRy62-{KW{#VKU9z_Gf}Yn`EG(W!n^LA<w@LTRsZp{NzoISLuy3q3SEiek53sCq
z3hy+eeV)gOH(Ns{@+JYlqxM>2RdX_s9nOD0y7QN*aUv@2Z%KAwn3ZLXtYfMBrB^?x
z5u=3k#Z8h@j8md<1b#LP8AtH!GIO>sK5o~$b^TY!<$Fc4_e${B7dxFVEK+k@KGKf^
zaQ0~U4ES?02!Wn{K7yPKFf+zVf!#@_u94GDe*Td+P@`?>3F}vdnl3O&&By(Vh||{U
z&X*UqAVrDV%QH=*teC2N-Ga%Ji5qX%eyi|D{Oxnt)H#bc@Of{Q$$IuuIZBE$16<Sl
z-PyC34jnr5b?@~1XZuI`kN*z;{RRKcg8v?b|7yX1<?#QdBkafk!|v_Xfs=ZH4=48V
c>(N7pniF4D9*M~UemV3&TmK$f)AsfM0A6x;@c;k-

diff --git a/docs/images/pr/chat-image-delivery/click-before.png b/docs/images/pr/chat-image-delivery/click-before.png
deleted file mode 100644
index 25f98ff3b82703c12aba0db4ca0686ba1d92878c..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 61189
zcmY&fWmMGL+a0>Qhwkp~p}V`gL%Jk}?x8!R8>A(b?(P!l21x}(eU*Fff35e!e3@^*
zb<TcvJp06|tIDAv1Cap$0Gfilv?c%mJ@@CQj|lzepP?1mU;qFUpdc-w?U#S?(`9A9
z3!Ntl`ob6SyKTKS+4xo}6iuls6^4cm1?}eNw})y==x#GtqnWh9u}oC}%olPj3s$v^
z-}@oIzubKj_~lOe`w8<Y<acM#uRAq?;9pPAPD5V>qw1}q(pGLBR%^kHEd0$B-&t&f
zG)-t9LyzkWgBwT&k7w=Do6rSkBn%8{&QnjjjPZ!sq;)KcpLL%G<*XGNwB}TK9r5^l
zairw7mNm39ho9RB41V=JytStKeLNB_t~dQiB$`Ad;__33103#hO#1l574pkFbI(dg
zg!Ag`8<2-Tfh6zVGtdwJgdv&Uw)^YgyW<~YOwi>chho4Q(7SLc%@1pwG#x~O_nF5t
z>vt0Yra}8X&*Hz||DH4~WEwOiV>#ai`c>SyE93Sr<|P%NXat7hH{_h3<eR=v?c@2h
z<!I)1_(c9uct+J&j4fdZdnq4}E%{jjj{;RO#`|*iJtsD04d^89-5`8Nv8w!mdy#of
zhPNo*BnAUJczUl2XA7EP0%u?bKQj)=P72|z<eXZJ5y)A5>`0JrfvO?Yt<9G7ovmXB
z(&r;(KiH$)?+%Y|XgnY<LCE{HXVMl`N=&oKze>V}3hM6GR6hTD*F+6^Z$U(;p8yQj
z^UtOVb%$t{J{~l5HDh?r6zYk-|LARMFd1HMCP2n|ev_Mr*g$P1u^P~TZ&?2Y9<iTh
zZ}0OLoNF)~b*Kd=2Q@3;;D-Db+5AN)#~bPp2ZU?|NQz|yTLJRvMUu;D<#?M})B+Cr
z#9(YDCPUodg{XAEU(W{U84E$!YbYjM@ESZJ-a1|P3iA`r+4KXy<u!LZ8|_nVid$5r
z?}71i$zQJsP}JHOGJCX1--c54YeLP5|9*LXV#U^!n2kqA4?9xZMEp4X&W;gVBo*oQ
z{0>A6qsV=(Z$?7BU#dMbCUHDX7vcr&=6HW0Q+Ocy{?FN+_cUiBD1CAhF}$9*YA!uO
z8IzyOemN66m-ykYs{oHvL6Ag*l$&Qa<+fLnFgbK9T~1-3_>#@h1g|nUIFyC24_Fy=
z0G8A0%w=zB(H&7JwKTt|f=w3&cWKluYmwGe9}z;40khfMd6}cwRv{FGicXEfp;QE2
z*g2s|7aXW#f&rd23-U};kg68+1>zrKMXqX7^z;w`Hx4Ks1m`EXk}=W@l!v~vpTKoY
zv}jgxUie)zZ9@92-VKBulJD_T5O0h8#WIsj2YdUzE`qniH?N20^}j<KrH&X4G9U|z
zS*ML6yo@<Nr_rw`4=z0HB%O4P7~8q~v<~eC1yFvDiuT9;Vs3Bn&9sR630q`Cwgl+{
zC9G`XSCfBORDWPWl<S&DxU6%Z&o^%xp9z6Wg!z{zal-X5MUNftd;SwzFvQR*D6$0F
zA9<k{^JCZKiitFY8rRyJjP9!dlkb8Ix;tMIf6P8DcA^i>o#LLts$ZYPjsl(u3|$yK
zFkdPUAard__gm(>CRW0|Shn$F2VPf5?X>tXM(XmxNYQWIw1FbBx26w0&ny1Rx7Mcw
z5IK~-B~*BWQYi!dRNaLDF^LD*<tG-QYKo~6kUIBshUh!D&h+75_|J1FPC6WZ>3FWh
zp(%~>Kp|ZQayBZW)EgiV9qUG^q2o|xkhvsI@@mwgF!R6%Ak=CDLBdtTS2r<qq9<mR
zh7*SqSUhOa<{Q$u31wRc#QJ$v);%0u7dbmek^>QT<U}@0zXdzea;$UUXYt!-iqDmc
z8)fwgSxU6J7#u2Y-%(|Q6MKcF&}?`(5`AZx&;1{U?`jUK7uZRX@UxhC9>ds+4k&-I
zmvEq}s!>v?RB=3qrSH%X<?o`4+e4|$kCPzuLs33fMa4At^s*%QS;T!J7y<}~>08R^
zwCL>bm=&3M=HfzX%Y{9ZW4I>Ul=!s9j>>}U$1tyuVWDD&xZ8jaP87Pa%wTkHgy|PT
zOL`4BNt`1VwtW)wF!yZ;i6#Uh<V1XWju>!NmuR9QFl+XW^jPE?2n#VV&xqUz_mjdD
zzgDUeZEHE!nXP?OpvQ`l8NBP)VP6l-!4laP01z_rfs$eHyJA&wpRh0}sh0M5_Prmu
zpLz&xIO`7LlRpz0)2MQ#aBu=-UXYk95;Ux_UG;;r_ZZe2)?j_t`WKOJOh7_qlw&>S
z_@>i^a-qvi)sRrF0zcaqE&VJNQ~C;3qBJR{Zmv>1K_7ePskK(c<s*%1k<$$Dba(oe
zIk#;-fAr9tjW&WmstR=e&0>U^6p4Qv7L~eNBLR!;0P9y-Z>_{3m9PHGcW1)KI+JOC
zrdc8Dy>^-?&2CKKHFQ2p>Dmd{<QPZI9jov%a67ugpy3Q5h+(l><b5r$ffts1C`UY5
zT%Q6AP&F34qr&%hNsiTKL^@;;&wv+mXDm!1ODU%TOLuPaTRQoF%3&xzgD~0y?YTno
zz&!BtoVs6<Is_ABN`8Y5z}&?WQD;9)VXDw?zTOT|3#C|-C^nAeOT81=J2-iX#sWIR
z`MOaaR(TVd2JG5dyV0){b%P9^EgBjp-kk@p^HIHbgU8Z8qh^vg%fKt=A2|7O{Q2sC
zA9fg`KN(JYa)kREXE|G#CgD-Z88CH_Mqc!ms8ucgPBP}<#I8piW=K6*%`ZhI)JZ~^
zZ&!8;+SYgvSC2Y((v5{ox{9X^7mVev%}4#EKPak9R^oYNd%i&h;W|AxCgR&#B^nLe
z1as!$*5V8COrUIVk@pDHPT%zz9yVqK%a(dLg%T>E$Z}%X^N=(aG(z*mowkzf(T5E6
z=dIAmqkGsL^nTlSXk@2El}$kWx9Q>bV4^wkMJ8MIVX1=$pM1~LSO<8U4*`F1zWoR1
z#ttZ>rL>{eIke-&1NR`9k?Y3JwM|U#lpjPRTOzW0SJuH{4_`4SV<m7LFr@-tfM6E8
zr7kbnmGwmi*Kt0&%Nbo=<0|AF`}tg?ySltJ>M`<LD(g%-;_RdtHct}y31Zk;=RN>H
zSPxTn%q(B_u+AdP%Enndv8S&|W|N74DibG;Y2w6~`UEe21j6o!NN8%kbc)=!qx|W!
zz`YcFP*@2jc7b9M{ZBeCnCI}6-%Dml(`hNF45_)PpNN`-mlgPC<=S$QqryjVQU5>R
z7)^+>w)go4h@8xrbCnq6S_g%b3813v!Kkn`#-!)(jp%$wazzLK7ERe!r*p`Og!4IH
zGNW-f?#iT+VgRJrnlvW6N$>*4xXs(Y!ETO~zeIdMl5#DC(pNSPFU|ez+bBnx&7qAD
zkk?xXWta=O91kvAm@^-9Mt$@W8W==cwe}1@*3|Pr6!>OCPw=>Tv}Zd^p6Dms>_gOB
z@WEeoXzLII5uK1GOT-`?mA7XEtqWN(Hwe^nq`xHY7~$IyqD}ldjR*dn#vzh%^7hpf
z{m!EHG;})#Vsr{<1i$CQNn(Vl4|6$i2Mt}g<Wi~aX@j@&k1};w_FJe?2DSqwIneNJ
z0DA{Kk>riX$Q(Ec%W3*NPKb`5k$YFXwUB^~e3~>```EzvWWhXjMe``lSVc09L)1|l
zMAIqUq+)oOfiso_9_X7jvm<s6Q<o94oLd$HgX3zTBoM%w@$_3=`P3^3D8^$;g>1Hr
z9LBxgR(Ve9K&mow_MB}B?Ms?Q-q-tgs<FTOcdE5ZTfB?iLK8b;bkmuv?dCehypx_;
zm?oL>m%oMu_URiUG8|#?q333;<4Fi3^A;1sLi))S<O<Hw=S0@D_^}0ck}jOcxrOH8
zig#o?zr&3uw_=PhLRsy3h7UGlttq0o!J?bvs!|2bk1XjdHYMt1mNkCr%6I0Kt2Z|;
z4akp{RJi|EEDtvdb)>G9!T8O*)NWxh7sb<PydKwhDLHxsC%^Y)W0<Q=&~Uc4P|r;0
zecfUIA1ax}=U?asbK-(Tz$6^5LROzv)JlDH0H)GStl1z0P8RY>2_ais-MP%3xrA)B
zGHKM+ajUHyNkjEiMp#hLt#g(hQ32xc*HE<*L>Q-d1`-95X*0dXULgdI#GvsxOIQ|0
z*pH(~juKmKhF0>Mg5CfN&MaO(-i5=|?={T!wO=;V!W83P1X*^63kssXltfJk8d%9)
zD%Mq?_o1<6CSrSf&P)BsT~P+O35u^cv}(u4Ji9rPS=%%52eo4ehduP1`9EabP5e>M
zKL>97pe6}FJ$XY7O!c)i#Y&B#=T*!pjJh@mC&XCNY(968y|m%aAhsFveFcNz9Q7s0
z2fSED2`;A$)4$EGD+^U}8<nsJW^)~~F%WB2XG9UAFfy8xufg6U32wDef<L#SsbOw2
z+C#^c94LB<U>zqJ24bf_1Ofcy*nUt`G$ZVR2R`lx&EkIJD<`fw*2IgmhFOuKZ~EOM
z*Xo<*(n2*#CGol70R@MfMiwKzYvu?U)Xs*f+c;ubGKr`GimEDCtGL2z)@|gZL)*Bk
zIbP<UVRrIwyl-BUi(ktkB&uu7K?A5cB=;W5c>vrR<b_He+}lVX($Q1Q2J&?v4mnH#
zN*Kibur_TBn<H<l0`QVen<`8Lo|I=37yTK+O`0Fn{kxeAXa&QR{^)x3cUzM<K~=>s
z4zOxO-DVoXx{|)b63hx}Dkv1Z9azXc+;fUAAS#`n*(vD>lffy(erMKFg5qzIoNjc)
z{BzzjJo0*^d+RCIY(_yB2pWTL@>s~qh;SlSz&j_)YzC^*$2;nJ8I&8ZV4wL<dQFZM
z1+YU)C%6fj7ktyBMqDg)?hIBrzn7eGIL0V~r(DwiQaPD9ZZ2f2DSKP4bF@c>fBzzz
z(}rYJ>puu9)UZmE%GO@sGNWaeqV8KJE&p;fz)!zYh3Uo<*#)E1h$)T`TZ@Z5&{=!P
zbD>K65|L@njNanJphT0<Uj4n9yZ`VvVVMrg)~q;8%BS?Ju}6P9fntqVTXHlg$bn;>
zAGE$;gv6ns<NL-9xl+TiLvZ8GvAXJ_JjlitM)~vL^TO8MR&_?|j8!=mo`P%7_CKdo
zn|Z9*txd*?)9-!{pB9yk6o$h_5{3fJ{DsPQW#r}|-*PZAu%nHE{Q$m#V0kh*uhE|6
zGwM|QH#32ZAa*U>k<@obL_CLvf*vkuxiXzc_b>($%JbBzy0WPm@#1&%OB?dHq?QZT
z+1*(M_yX@2s%wWPnwx^PU7Zzx@dY(g?Na$BUUXWDN$yK@84}E*cn52>%!??=*FE9r
zWneG6I$3x9pLN0tMR<b|i~s_x?oPur)oW}2o)L>M`n1{ZY1uNfz;Az%)b>YU{+$X*
z_#bM^dFsL{Br~;0s_Cc4qf21<oC-Czl$oKh@F7yec~kNf)}wT4l4(&-Wykr_c=OhH
zrdjs9u(%*rDz*<fEb=^{RE{}&3Jim;`WepyDbSk~uD&qYc|nK&vVh9Dk0t;Y8!0yP
zW~*dLRvr#H3Ojp55++o;ii&s*%<;A0^?(feTxmVZghvQPVD^4^Q66k!yIG<s#e{fV
zRq_4Q_B8RSV{ln11?!pA_oayWa`-z})TR2P1GO}(^}k2sJ5!rU|LW2D1|_c}<Wkb9
z!jyi2>#zpe-Aqm%M~4{v?60{Kv$nXIrTQZ3h`gfWnt}A)N;K+h2a<A0`@3@W%yM&X
zM1C3@q13PpIFTMW7_{trSH=ij<Iwq{goHTmAFDD6L&xkPvhlHbu<Rbn7X}i21h>Mx
zMfcz)h(Rp69x=Rsn|7WRYKdcV;<|j}<-oaPH`}+YvT4|k9*g*9Ph;;pjxb{or8sOY
z*DqJ)O%s^3PjW8aHIa$0w7=Wq=-+(*N6Z`&^kJ$;I>)kwMIAe>wO4G6`(|oqKMPUD
zF9c^qaV20zfdVdKlV#|<Lbr;T%Cv`UHXSD`x2(@~Lt`U2V}nIZCQ8NLPo_{{%5x*S
zoQG^_glX8pOT)(507T;vmSMCBcI$r$Qo7f#-}O@4M-bkEHisq9yko+;UygO3(MZFC
z-ZnZO6DBD?*mqtePmlbx%%g%m8J2G8)wk*EKAyrPrA$EU#A~)F6?q;y*h?KerV-jt
z<=W87vo$WIzq$M?HJ$!w=zkJ{oLPc5cg6=t!x-1ipWJSJcY!1&YfRYcaLCd_uoo(8
z9@F>t=vOi+zn1VmU<4`=8pg!8L0bzy`CE3!Ca~ZLOuWC+Mgu|1uDq{+NGy034S2QT
zA=-qUXTX^2kp9@g%?g(YMtw{#?ipxRqca4^+5#?UwD4GCCb{(8v9mluSU)RdLOQ2m
zu`=kTT_dpQkon_JLgS8p<<u5$NiQiBIxL!z8g8clrrNQb+j${VPD<aOWttDH`&oyY
zr#R)(5mc?sRT;*mEWfA^sx@zHk_34DgP`75F6vc0oZs{EQ7f63To@N6xMv|&7{<*h
zd0NEzWU}q5=mFzFCl}G923HHE1M-lp{l=PrRI*saimWim)GB?O@4v<quJG30msk3X
z{O82af+$V_QdkV)6k+{~EiV)|{0ej{JgTir{i{Ajdf#RWC8hLQZJDR~{N2$oVc}nn
z$y|LLO(+_0)JUsS%vk603v@50a`e%|!^3O8_ZA$2AYX_`koIqz$B!)|)Ca<~Lj|Er
zhTOSCR^wC=HfAX%jXreg;tBAyd-9oMCy@5e{e{x%A1M8aJ21oy%}dcrfDG_CMBu1~
zOEfK1rAoOqQiqtwkhSPE?wqZ@l&4?U!ip6^Le^`;j#BEJTxH&vv1wd1)A_Kjgww-A
zN^A%0se@mKmLspyc1oI4vFXy)gnB=q;g1(Tp^?i=)8DerVSXYVkJZgl8SANdE+Qg@
z3)ewLRnT#d@wuQfAtBi7SwR~LZNk&U;COE=pKxJj5>96Pi8-(JJa>5{rIat6I3FD{
zy>~d3I#i{IIb${h7v9mkK&9~`wDd=Vx!6qJYtrFk+9sm^9Jzn0d1Y$ZjHkwdBQVhA
zB%=Y)w?sD&pb3PJ*(RXAFiT=f!8%&l5lcgk)eF~0>|g+Qct|4j_7uCkUvzhsg)M{8
zov}`(r3=F4m6nrhnwvH(V|rwDxvd5qMe(%GBT43{0@{5mLvwTcj5Pv><Mn;XvU<f&
zn||7^jFXgAWu(&yDV6q6%=+40XBaPzJwW<kP@ylE9d>NRWE@AOH<lP92V}5|8KV^u
zt5tLgXhH4~@d_(nUO&O@->{~THDC!fSa*?HnIb;?EmE{4H{~rACgcS=m@b}++<vjV
z5TdWeXgVIEs#KnroiL})W+)+rJBuj$jVKf|Mj)d@V_<5;bPXC@4_qVHKIe3F8-w7T
zKynFw95fu7s_1r?wxUT0*LhIkwJohV1p4Ihz_+PWS|Lr0CH{b&ae<!FB+?{vet%`j
z8@=pqy|X;xz1!t~kfdvFl!Lrf*%bo!&~bP6PA}tiqJ8;aaCYG06J`w-SCOq&xaNra
z4$z5|c$z~u<a9wD@P+mDR@{NXRL%)i!EBkVR(DrQql+VKCWNU*my8}6y=FE~$sNlu
zZH)nEoI#u1;W);dm*bF3F(A4U(k>{qKOg6xLO=1kI*w9gWxNykJ@v&s!H>nW*$~+7
zoq;ZaqW(myH7h*WFRnahTiM>K>F?0D{T*>P$zS*C^fb(aW*a>te56da(?d=!*wul;
z+ez>8V25y$F=O*D7_$C=p;GZr_GdIU$hCp8llLwZTI%Z)SVm~5Q}6yr%8#euTB{n$
zSi|1x5}YAkG@)=}<eg~A9ZB#swBK21?(@+>yI7u0o4ctKW@O&^8*@r}Ib4oq%y-1X
zd|{#SXUFUB6?X5~9I%<ML1>C-MUh(@I}(jEvy%FqRiwKi`f>D8$R>x8&e~Cs7TXjN
z^o<Q^WVcR3E(gdA#G<m+Vd~r@oNMJXu`|lnUh{%l8<Z0=2ty$sCNEL&D=0>@<bf(4
zeW+ptjWO}{8u|V~f^I;@M2ifajA-IjK$&g1#LDK+fL|WW(*X@l$><%n7MsYVQKDF>
z^mV@lxB5r?ench{1wzn(1vdsx61&pBEYp=hWEL62j4@Jg)sV>m9oJGTuq<A?wFbpm
zo+c87-xrZC_%#}%!gtgbA*MO1s5fF+1(}FB`AB|8TTr!rm7xo<P8Lm;$x_f*o*5D~
zO_rYRrAP{<^UAYD0~)yZ2xzNOIhib5<51<vekmznVV}}QpxyB=tabf4sS7`{1V_X|
zqjLcgkww5dB?zOg`r<F&82!sPg{)vQOLei@&KXopZ9av$PSlo(pSccv4TMb2JQ7ty
zN(mNNpgl5m3)^4)J3=kibaC&MOq+s#2->Yd-9XzMTLOA0cfTa_=E{u_;-K6R7(@C-
zG~43oKaZL2Wbr1W?9ubt+E5|Czx*^c<^qH7%`7|I)ojYv<0XYpealWA8@{n7>|pV*
z(_BQHP3yp{Gn-Ii7VBf2pik*UXntV@_vMr2g;H^5l$7_N^D(Rb8T0qcJVR#(FU`{X
zty5wrL>Oj#kF0O%Sz1}#x$MNEPB%L%X^wV(ecTt`_kXO<rKW!?;798%Ix0i&7)*>v
zOs4V)$vEy!D!b|-g}4_~HzptXQ!~Asy`B73OW(v871}1VHAwgl!Na7Wc5Yd-f&#uf
ze4FEGSFeV)As80ORiBJkN9ZXYuwG0p>E}qL1LDUc0m#0Le7r`@6y_33iNDz)<R2_N
zJgH;CQqrvp`G%hGj9`$$-mmpmxlWeHzLx=xu@Uag{<ZlM&S|F@lviHN`w{Mjq7&{r
z4kE%IJBhNWR<f*;Nc2sxQofP0_)AvBbeM+OYL&jPAN8L(RU<g=3KCguG+x0+9pa(?
zeoNY|)|`>!o1kk+@ZD`7K5W}c3xx`4a9$&sd;6UuC36i7h&ow`FunjYqNEW@(B=5l
zjg*t{y{R@wD-%YM#GVWt^K4IwAw10a8aDN#CNrR5a5;#H{I|?1Z!5YZGL5->Ih<T0
z^qG9LI|7R*T7TuVZhzk=j=Yb*HV|NkO!|{4S$Wf%k<g#GB^E$)mLGCCV|p@re&}vx
z_zDy6Sqv|^CoG1RCd=(*lWa1+^5*yHR}Y6Wx=71MLi93tUWH<PKnwZFOTOw-Sf>nr
zjA}_WIa{akp_!hDi@H1(Wt6{x$86}72oQfV7fkqWg%xYHhPze8k}z?2V(tMf7y%At
zDnF7$mTL>N&e^sDP72QoB2{vV*Hetyk7I0c;Lrn#6)I9q)f|YKH>OCXgXo(YMo^t;
z%b8M#I#UHRZK2>0AWk&VtyC!F$^}8~hRQ2mco|zeYu6CZee~|n`vR_fSLiunldlLO
z{$J`DdU89MDKE6whhV@SK9_LphNuZH_M*%>&DM*VFCWuPET|1LKVX<r2CE#k#=gU{
z9dic&Y`&^mTa-o~fxlI?6A7+jp49FQ*jnlsf)BmEC5D84W?%nK@e~fX5*N*QJ=<Xq
zYUGuj7ctDkkwVHdqHe(NOv6h>Qq@kP<m}(Mg|eSYD15u1Sg+0y{>z=)`Ab~asv`9?
z>(CbZwEkuhf_JSfQ<Xm_UdLMBq!y&%{;!`Y_%9i7R%j%0VyAg7jNcyXzx2BovD6}#
zD7&t%GV23$vyl!fD1&nWqXp^6L0Iq~zHw!@SYASbC>-2M5ZqCmab7SVv!WKO8F*??
zJ`AEbuLnv`(#PN(8xu4X;Fg)LV8jWaQsJs&6)6KdgLBI3>>1P^Ni5%95W0!N`?4Z@
zAk$`o(!U=N#ARbrn)3y|Ta|xYag->WnY0q}X$IAD>KjNI>}Ls!jc@a~@KENypRTUT
zREV&;_<@`l+d%mO2$JJcfcRgrHyjqcGU)y*gTB}FZ>Jf{#TKGI3ncx%!Ad3nm86^Y
zpe45|b7g4=y-ZFyVk$5$X0n;aX`B}!^O81rPk?MwFzl@ZyupN8y%Z06$B1Z&q<%`J
z<vJKd7Xql-;gaMXQy=in?OrD({^b1Y8&!AA0r|a@)ZKwD`Wi7zjrGwUXz)3(E1Xo=
zVrU*>Ifi(Rv#YY{TmzOEIc|og&voymu4Z)w0j73ylO%YvS==N$Iqal?quj?*=(cWs
z;a>dw)YGjHP>|cxT#VEw!gR$<fl@!3#5>tT+%D~JZ_@{s%g^69ue}D-#K#%`D75vx
zK)*!3O=~L!4)d`B+33pVJDNcbmN$7|Qi__%+|D#8yA;=Ev}3CRr3bI5!0I}_5@hbh
zRVajZ;qNu*>FJ5EGAOQ-xS$hrT=5WJgUWILRiaP6`JZr1#yssy;R?bfOW1BXiZRCv
z7x|c%8;j1ee7a$;h``%us-D_lFO1gR1<Q}4{YrwcNIWXz2w(`wrC?-oZ3R(;s;xFv
z9P>`1Z}vVeNg9RdR9tq97T;Sv=02NKh3K%UZk-0#x{Bm*0P?{9R#5tXS5WaRP3~)=
z7IScqp$*{16i3>h139g3N28(izL+7ISUh9h5s?RfJVPR<E8WM@EqLbXcbm3^0RA;E
z0wy@Ux_;QpalJZB^gzBed~4RUULL;A06SG^J6D?k+H072BuLH*MMU+{M8Qy7=s5-J
zwyF(>O*7xm=qAM_8r9Jy^}JT141#r@x<jfB<tp6H7;X;>@+edzFQM+Z2JitCH-BlF
zA0x`bj*A`t>A`Zg2~Z2aZ_d@@W4FDJ%TA$_DC*JoSLNXSM>*&TMeWb0zWITA2iXe=
zFqU%>&4JFdOXuHEFutAol9|M|3Wq4Z56$nFn|P&1VQI-IPr+E&OtM!BI8FR73+U%J
zM^>N1_Ub>PN~b=lqPwhXa;aa3xHz?)Q3$=cg=rZdmiZ}=*YsSjD*4vb&gPK<4MCY^
z8yP3wQ^LW9+`|k*Z<<5@y)dU!M_O`5UT($1b#Fa9*gq`94gz<xI#+PGR@bC8Lv<;J
zH~eOLIif7SdQZMxL-d0--s1#ekRw71+RZDp?*6me<rk%mZ^Ax;9$RVa_fS4A9zF>t
z&eMfupwG3!;4msf+;uGuyouFfs@+frwd0q64N0W$+60xar_Y<V+0gF*%t!%spIiH{
z`3T1c^PAjG?yS?kxe2VJrU`T}!m#xoe56bplb*uhOAIumuCVVRIffbnA}utdcw(R@
zw?N(XxQR>S3D(GF_I{n`aMjp_n|e!P{Jqk?jrE#!FPqMuC*gb6cZ+lV!!)1o;U8Q2
zfn9DyCG&pl?*m`cUH*U5-6Z_swB0811K7y7#ch!#Av`&<vb&tgq}qrm$9$&L#Q=b%
zGn-soa%C8#qrKPTF&VCZd1OlPf=%^|%ip%@c_2L}!4a4Hr{EjaYB;DrYPh?)Z7i$^
zIle107p_c!2idBEb|byTUy(ZzhLQ)_*2wrlm9Z=|Ow-%VGn#50#*rQmdq!HOY(RQJ
zo838b`Ra>iY11g_#7N!qdy5z@_N;(X7)n|9l>x_M?u_Oumz!aa&{8T_cz6i#^*Ap7
z^9sh&bojsE*X0aKB{=a5(Ylg8BfbCVj<^c&<7>C}69y#5MlDjIP1=a{d+rk;BOVDL
zJHqFJnmo`tpc`jw{IvM~gz|JaBq=SC8z)pw?u5P6ccg=yt~nG;*-$xPX-C2{GS15)
zV@<f$ftGlgfPTmFsDpF*7I^z+&e|rNL23SvoK+mr^RcUK_!3<RY;FWUEPrscj`R6i
zGH`TiC%JajbNO1G&rG!|SWo}%#D(Za#{qtsE)VR^T2#g2mXo}qf8jL+Et(IJ9D>0{
zRrq0^L93L#W*;}p(iq60(m$kw@`b5X_2PId#-}p~%BKhj*kwTQ$w_pvb%atU9_eX8
zBy`xFF4RcZ76tLkTXYzr!y+iHTSKkd>YKMglv9ROK1f=V%o{51Z-^|A0kk6I?UTDR
zijB^syW+D5b84Hu!wB`WS8T+gDi;nnnTWi#RGN%I%hrH$-#c@PDbj0%2Z$$iP2e8Q
z8Wm)zGhWG-Aps`|S_9KJAP3%()Q_Bx3eZYs-~SS8@9QQS9}=x}@(?1fz@hz1{%Rjg
zKi^ah?PJR^Nm_smzIj9;MWTW}jc6aH%YqUHXkaNLS;H7fJ+asMA}APFqSnFbAENTi
z7bs*mtx$YWzfKU@BuqXLj%&<~Eg%#&FbuuNV1V}(3WJVyJn?Ig0lN!Y*t2`OHK_(;
zbWNcl=;j?K!}0f?Ul|619X;9Am#{SzDbeW*<6cmapW_{~>`0*<A?a1zn-e0+h$oXV
zy)0Jh$L>9uj>_Ldo+*kxG`e~s=iez?c2zU+*)K#SVTTy8Hl6%u8?4IT%zmQa;*JZ)
ziamY<YotPI@>|sn5kwdx5lmQ;$hI>z_FE%T^*KO=?!cRb*eCvX|67$ZC<)3O<3svx
zE>L#g>|PfiMxWJ4vIyn`Ljw%rEH@5mDECM>h;64QO%ML^XoT=BmR-|)4Q?cK*Glk-
z{w2t8gvrGX>^P)??k}vs<cR5M)n^f87;WboMns_9zHdlJk~~Z*fJP=9zG7=4Mxw0U
zBPt+07fP*{#&vPc=QKn2_TdY9ZSd;|;QMz3U=Zx#TMYb^Ht?uaF^=d~ec_;}5E=EZ
zcAL9g6IZH4{u)cuID0ipSe~*Y-4<~g6E}_79gDsikis}`LpWLjKoNe%=d6Vj8EyaB
zd2LFPHnDq=Yc{dZZm|`-XmX*u9(Ir#T^js;uKSyLRt6Dcn^!W!l(>dp9ClQ!R?8=)
z_)JwxnY_tjRuP5=bxs(CtI_HbV-{Y^w@i{1Z;Sn7zlOX*qs!mspLRey00Z5;umv?;
zX!t(grcCrYbj<f9hFjrLK3Sf=ruo2Ott&PIQ?CpPzk>GRI*gNE(2L-_j<w?D1U6Jp
z=_p(T+5BvI5UoOrm5vSC0fVb6<jZ}E2{9sPDeW4cI9}Hcl{z&-0^6eK^ds^@QayL-
z=88F5#Ih%D>kGRgQbf%@0)65=Fyw>E&KzU2aH(Qb91}<G%PIzP_)w#Cq6?o72YYHK
zE}A4J{M*PMuOT!4?7tzi5kM<J*)w!;O*`Qc<rk0bN%=dqtDTY_Xw>0)g#4oz`mBrv
zXe=v<8k#jX9lKbHmX8N&;lz9bt0;hSK4wXpJPLvpy9^4g6ZA@YXhx&3Q^_TcmjO8(
zE;)CQJ0FXBUGgLOF=vtE<q{}3ONmTAHR0%O*4N;uuy2wZ2L$N=s@?d?l-X0C1Ekvb
zFpBh5)_qJ$?8`CFVx~eAwM0Fe{W#D_&7QTlBn2tXg_|D2Z#cEwxV3oGwU6?0V}A&e
zZ0+{^U1@&(Q`AVxFfG5eN2>LbbkF8!^TzETJJFm@q?Cf%mN<f<@m^e+d+VfnT&fxs
zdfy+~*b~^iE6it=T3m2X=r>>|0+k1_yHb|qz^23|4W4`Xp6_oB{E$cGyWa&<=5Eba
zb}B__DF`1=0mO}>LcMchitXIrjF5f~!s~aFBJqBYDDD;Lcj!h4)kpnl+rk5GMOuvB
zgIch?1nayR(UAd_VN_jSMFu)~HeJ2{QuIvq@Cb9g^2NgOGgNf$voqHRT0@;oXdLy*
zioCtCwc9B=gW!g_S6u&%pS4~KX|8=S<7@Xt`<oJ-)^qp9bXh#f_=_S_*<T;(xIxaM
zQ!p2(=|kfvTZA0wLtOqcFwC%U#!wwxJ4h4o@M9~TeSUcgEg4%lIB(sF8V;}0qgY!L
zJ{!2?%}|K;%OTdoo<#9Pc|yaEe`#O$buX&Ahv*~p?aedmy-CuYfi=c(z*@et{}>v8
zZ6Fnk<Ci6`T%eJ>q`ioa64dU5?QauOSuriKSQH*A9Lsm!7Q|v*MXmvV(EOwOVx7cc
z3%o&>@LRL=bzKwrX9|xmuw}?8Ndn|^W(|nhhAN2rw4pNxD~PtfRedvU9`9=#qZedN
zmnxE0Jt;DgaB4;2vT$VGY=p}^^H*mkv>-XAM(CrVqlw0PDh<Orqwh&lR%k`-?4vQ~
z@HNKF4;|;s;B{lEubt8!-=n{{1W{0#&xI?4$p&h-g7Yi9*G{y=De)Gt*0P*uCT&A{
zIklN3H;d>HFJ@#85};39sL*c=A(;|Z#e3uZNLbTQ?4b0>{4VyI@4S@BxqXvuMfh^3
zT^Cmyhp!zW_CHro?Qch@>!iAnLlXX?2?Sppak^aS?l{OdxvN%$5KfSg!ly%>n#<DL
znqI;ZrnSLm0bg#hnlldWL^;ruS)f~x!tuL;;EI<lr?)b(r|OV4B2hq711&=_!F8UU
zzp0w>GnUr)2WY2Rhf@M*k6O{@z|L}o&cY;fBztQ-m~g5&z0*wn1Iabayr9DPs07$W
z?K=IVQQ?@n>AnCaaJ{^5Dm}I?&dMS**b1hetJ<KBq;Jm7Y^2~)u=n>~-m7dm{G%cp
z{w{5XRa#3>r+NGue$y>dT;AD5`KW}p-+7tZdyF?k%pn)jQ!I9n93(?~6-!kEJScAa
zYxK9^#-n_H6d+qLBY_f%&?1~KV^Z3+;vHEP7iBzx5cqqymSVw9%4PcdySl>aJ5v-}
zE!D%i<x>J-NLxPT1#Ow3Xy}Zh6kLAfTibJj&f>ngW7Col(b{Y3R{0pqu;ozdE*|5u
z72-b&9x(MW+#*xa`)2OEtjst~EAM#dw|*KhuUD)5&(&)B+YiW0)c<k1ua()f=ZzXM
z3EfR`+Dwsmqc{;=f-1J8;j}VFWSz}h&W&pz)QIi3kKlYfq6!MIF<vp%ZoM>gQ6bXg
zv^TyTuqn>`?kmM*P+hY(484tgq3BIm+m_A248Q3emh~oB+UPCxd!}U>1I3HGoRXRm
zF>4$)e!g`=z9Toox9*hlZ%vEl`T-^tH(QlU*%VCeu13G}`T;T=GR|u4&QtqboE7l(
zw(@)+{(^8m&+ydOx%~Z4NPDb^kSJz^$$1E%r8Yd8{D{H|dPuP2C=nyH!EZny7si8)
z!Fn88!{8bCpzQuaRL6U66)Ja&T52M&XRb5Ip96(d+TZR*AHI)=n3X8=OJ)eVq_XkO
za0m`Lbmj&5eaKmQvAg<!G<KiyXL=tJ8&6W>_T)C|#c~TAH6J@i>m_cYgS!NS(t=4U
zP<zFrGvtM^Twxu*b=3~!Tb*M-ZAG?NQl~G9t(=BEyn(tlB(YQOP3JtN=|PBZ_)!9Z
z`a1<Hjqm17-26YG^S?<_sf_{FX!hZ!Rw`qqmBH95KMo)VW40Q?*0_^ic`=}g@{1eh
zg{SY=Y@a%%spHMouRN#?NW`(sp7oL>5m0HN8Ljb0ZoaJ2+QjoGjMB3ZK@HZC_k%D~
zejIw~g()Y++y-M|87Z-7t@3lo=q;n%l*V+2868c1Z?S7M)+~xmK520mo6oO<aKZ}Q
zA{UO=D45g}R`$)qOB{hPS*+xl0ro<Lsa7Lx#oG3$#6$Jz?FIVK0`#LiPPsz;iYU8B
z^P7MnJDIp+rQwyo-}P_H;SXAD;2hKl6@CVKL1jCv((nM^1%hL3h8_nJVSQ3XcW)^;
z>;PhubT{&l;w||Il8YM51?VP|HB+Sr>!Nc0!WfE}yReP^HBQ6f&)Tk2F5CFAiD#T8
zOHyk@57c9C*5Es=dp78B@r~xJbzL;YHF}V%{w!QBmw4n*jPE_TnAE#-^F(f5Y`yu1
zUY0^b+o17CvmPNl*u{{stSg@OQ8IvoX6{3O`1sdiJ*hw)=d2iVWt*KCPU-Sj%pd>3
ze4`iYXbUakM+Fmr8W*z=e|+Y-p!5cbh837aI%0l3#}4+p2b*uDpYqrNN<25o@CZvp
z)Dmb$HrX5Z7jYU*sR*Ay>?UEJ7p%LMhU2|GxikH5xh>QiR!g2Shp54yU|_?vv)a_t
zP*-P&ZacJ*sEtwR$L24<`}DM5LY{xN)cX5167AixiXFXdL_|%q#&X(jo1Pe=2fUJ$
zyu}#(4-g)Smc{7Hd_K2h5_!WDouL&+L45Ub&o3*JxROB%ht;50F*fmUTcc7*+PML|
z<G)bl^_&VJ!pwx9^=4A}z-C|8`5aLUT_efshN&rUjWa>|t`^mVs7r{G(S8n&S!1O9
zg*7JjD(|VEmfepQlg@|*VxMzKgoMt6IINbKsdc=aJ)F?*+Vmi`cZhmQR{BMZ!r&$5
zzbpXxOeQ{T#K~*;0MVzo3-oNB^U{5By{t6A&-!uHfbg^i%Kl^YCv8I+s_Vj?Z?wMb
z?F0y;@J|hINtcLU5Ll5lj2x>krCtgDzs@EZD<zIKCa*F>>L=9{IPP^%oI%S?Zz$)P
zDcL+X{pMH$)4Lb6O@nMweJ6swk~dmip(kQG&S2Mrb+PtxLDYGFNn3G?2x+vDFD23R
ztlr+|a_~69$X#60WM&$+mz@;LQYI}xapNWQjvU)9<lItxLLca?Gmpsq;%)WGWh{P^
zq!b{<*b<R_7`eK0iHEDEREBga?jpzSsCVS4^kXULr0s=6??lb?$2sAlsQPQI<ikJZ
zAC%FSNVOU#W|h4%`?z@$mSmuxGB>mn=FDS)9xMqaDIt})yYo*58j73vwDx}8=^)xw
zx(z2!_*OPaL5lbTKxbw+F`Bd%NH3dPo%2NE5<0KS1>Nri(rU6eKUFqXp|vdS#ZZ=e
zp{@*Oggwurey48TXX$+2eh1weOwAU`6^-XacdgdOn=AwRVI<&XF1w!yJEM-Qn3YBJ
zBLwOeEw|nLvt%MNw5#qw4w(E~s0B~YA0NCRH5Q4KXyQ2A`CIoji2dsqI~OEMlQNMR
ztsaRlYSYI3$JVZI-yIWFWM6c)uzVuky7QF<Lp?|yn<bP2dbtKm79I=qZm?z-G37EP
zj%2f8SqIKpByX5(c7-69?*MxzR6V0>t=!i1HrOMm3RYYWEbKJNcnEtEp3W61MHkIH
zS~3FrfXT>088mgpO!Cn}GLW{^fe04Is-ksjmFPF5!M)FHXtJ=anu2@zKJDaq^>BD;
z!pU}kZ9r*dZ!S`9RkoAib-ts^HDrG#jOF$!900HU@QU?^zgYjv@8uVxh}-CO$)&8F
z*hsLeN#mSorrL<b1ISu^F^Cf&xX`L1bhRKiMzMD;6szodjIzL34<gqOr2}Ih5UF_1
z<C2m|BlT06cr4PKKSuuAk-OgxQxy6(=Eh2C49g<gIiPj5*7j}OE4Mb<ayvzWtD5l#
z*&6oeD*QR-ZfDxA=O(%Iwcd%t%yM<{&Z5xotTADVkM`CZl+G{3@t?-0isU<bB<4Cl
zq79+B-S;UAI+oNdy_JfmtKvXtA)p9}Tm^=|rg)zJTO;F@Ov@$8ZYjGCnLh+3<fzQU
z6=lwTWq~PoH-gqu=I0bxL;?@@{puM*#-^&G$<Ie$LNcGA7m<*}OrL#<u|hJj<r(vV
zhxslwgbB#1x6Dd~0<tbSi)~&mN$BgzG5Zw9B{8Rm0tL;zQu#ZZF{?De^-a>uaXgJ?
zA8v)KiK3|*)0AxW5W>;NM*1dGVg;39^NqY?xwIDbeR93XgqW3$G9=BOCw^ZK{-oF8
zZpE=D1y1No*T>b-%niA+nBd;QeUu7+y>J<?(wOs4lc`cXv#fs%g*0#&-%&Xi_*6xw
zH}R>B5x2fXddhoY>L+t-jWS?}e&d=W%@Ls5w=`kcNrcv!Tr2cJCCOgcHfj$!T&<pC
zA|pN+k0<4KY&Moegq>lS{iXqNoqclRE@H@Vmn6Sn<CD#q9^8$D#etaNo>H4sWKFft
zNz8nAgD9KDIYI@Kuvb}>2itq=8KlW&qASZasxL)rBvNOMqOK*sYfyl$9vvsr>KJL!
zT6RC?eNxrpUk~QLih>yy$EURJ@h|6r-Tb8n9V@e=KDO^sk^|=YSmkH<Mi#h@DfI<_
z%5fycZhW_C5uYO1`C#F+xs%01RZW`T^^gU7Q)?)tqBLEyMcHJ^I<~LNaLbHG__^^Y
zVG!j-Ol8=s?P6YxK8l1$Ny*1Qwlky|mfT~0ueA?A|1h{U8(gXEh;&r8B~8X~p$U+9
zkTvb?Wcw=XOu`@L)G#Z*FA}BKMa{qAmiz|7=0mP=dxk7;J&XP><o_j+v-q4zffwd7
za11B?HrFCz8y1@A!EnF>MpGUvn`q820FD5u59ig80WK4aL59Ky|2=}OwlQ@ud~9OH
z=dO#7(GN!X8h+Ta!W_S_AEiRvnU=u@o%tU~`9{mw5}_-dSS;+V5105P>xf;}krJdn
zSF!=>6J5aVbI6h_W)6ANwI(85kR}W!Iq@-Wgv`90*ul_C!4DM^I)o`fM05p~n)yBq
z*vTsTTTZ%l7TN9sr>{)-UrE_6{!K-y8cq8~<`c)0Dc2xs4R8m0$c8u%Wt_}-mU~CB
zXI5Tv?5p`tn;s*}SPW>LWpit}NybUzc%>*LdJ{wjRMcH^^9|T>37i1gd6+Y<ZPYPi
z8Vq5hw8=V0ht+L&S9C(S5?Tjh)s@k-VYpcLqZh>m!7LA>-=3Hv%q>k+Fev~blme{b
z1!Y)_F2|a3W(M|JXkJ#Srt{30kM(z=+;3DH0EiB>p932zt~KC;E(#pg`6zh@IS>$<
zl|JmrN^SbT!lLbUAx6scY(H+da_YYA*OQ;?chz`AJ|*9O7K+J9V19e~ZuS7tqg*=N
zo0n>KD%%<SL;i{DfR0+}x?sm$f&wPp|Jh8=|E&zqEeKk$I4^f_%vRJ$5K9^1aM!pv
z+e8xcOW9F&Sw<h(nknn|Ws<gGZNfYLBDhjn_U=slQwBP1x7=b+eb(KaHq5PR<M}!6
z7-i4u7?Gz+Wv@agD2l#DqL#&-WSQB7;v^;8oZM+gDdd~=o$W7@##?78n{GLzd9D$%
zo-v;Wl{kB-m^9$;M_XMWuL~oi*M-r>z>Tv((LFU3{Z$#MNB@wy&!9CjIu)-1N5Y5#
zfeeVOFi_dasXXF*{8$%6t!1;o2r#k^6W@PBEg>Y@=|6)JGf#LP_9*YcP-3gifYcej
zwAe^`M8k!(u{a{!7m(^wqZ+<<ZK(|Pu?;sA!&aDz13}-qD*HjMn+05%2{E)uTte#f
z9Wf4vF-^b=TGB#ZuQd@rKu(s}vN@nj2I}t>)#rSmQId!kcz$F&t!WqKKbR$>vs7Z5
z^g@>k^|meB8_B>?pI+0*sN;?K%pt?P@dfYK>n`~prQ90%XWe4DiFrjc0FfbRlsO1X
z9IqR8H=q?r5N2BlRYc5_Nv$x)CxNMsPH0~s&2^;!nlmXVb~?UuyNU?9FcPKq<xkGQ
zaeIgO!M8a=A*<V)pg6_0*b*tCvN#Y1rB0<Q(HLLR$)rd3r{H)E0U~X@Rk`a#cyjQW
zLMn}?bCt_uHzASAgS$nJ%z-h)2j7BtLt{<TkSGviCimGsH<$j6WYq@6JAR@xjFl^I
zPXguwsSij7O~H;pf4h@1hA;tnz2YW6VVkZ0e`fZv({%V#b<=r7e0cganc5Vg5lOCn
zVoDxf`laK%;0jgG_W48>KWP&$CjwR74gn9Kpgq;8m87I$Oq!I6*l!vewis$=)<*g+
z;Z}6Q+5Cg#10hONxd#5Iftw|sK9mP2{nYVQ<~MAOCekTG5CGanwFe1O+B|dtoQ;fS
z-L^puC{>vtz(|AB9|<s}CH4a|HeE5)HbPTIFM)w<t<j4MZu!|IZXwh+cN}A9ivLnm
z3Eif5)tpO8Dxquje-_}is|mNFh6Cbip|sxTgHnC}#N&z_K4lF{2RSZA;?OPYoliiT
z^~k;`^JkR0@vpy^9P6H0*sb`CZetS$%Z;~L+WoN)>SxL6a$Bc$JJd0GI2K2C+I^8|
zcp}yeo&*oYx~=&5w(KzB(P4PcTuiGEsv#PC3xN<(na(?1K57pKF0p&93DiM}7f8^T
z5+QUG$tv3Jl>!7OKFYe&dzu{0Y=JX%V~Q9F^qE$;$VvZIPJx!=j6d&Y7XFvPF6}cF
zYUZOyTbxh%eU-+Kcz<jq9HE`!{@??BJByVa2Gj2@>B{P}YH+vpp~QUg@p=_OlDBW1
zaDaTk&z5H3Dc+<0y-p;S5L~+k!`J-<EukbB2QX+N`MJ?6tY1FfO%Swwy`Xvmb(1Tk
zlCX;S+0>Bo@e7rg!%$(w@P5UGTiC$cC0;7k{Ld1R>wSk`-lIu!R-O1`>3+)+!gmz#
zPS<)cm`<vq+;ZXx`<XGnF@|dr_wjFZ`M&VaYm5xYu3tOsmkpUB5rrt@)z*TA(oRj#
zZ}{=PI}$@JIcF#;RoJmfAr~68)5etsUHxP=?#3NQa0a+U`PdKuX6GUgSAz@XH~Bi#
z$C<*z&1S((G+W?k(H2SU9&3c(^}J0@`L^e*u*retRNvB+sQga*F<^hk<$TIubgD1A
zYV6yD6c!zDDLy!|zex>%UM;e_@95x~s*}0X#o;x%=2^ndaw@>$g&sIQ_6bj3-h`tP
zk!5LTjgZ_?T4VT2KNd;(M=TVgSIhrz>GDs{3>!XG1vga|dKULBg(nQbK+A-)aI2b8
zbGlbGRes^F&kLoz0b+SXceP{z-vXxdi{B8zZ38orP!_Qfnj7Ds$7m5jHVck<_KF%c
zuX07k4%M6Hy16_YyeM1tVid3eq9`@9bR7{faAY{H4lB>hMw{wBLyLc|Rao(N*#K}P
zA=dK^H|I{fFYI&o)NOfdRZ8pSw4n^<*n|4cv8J86h*w#+<FGDHIazQ6nK73<+F*6E
zFW@MUu%xp49k)z|2M4C^SO%itfTsAh*((uwzY>uPIG|m-nV5iZOn`}|HKNWK`WROK
zg}bA9#`;IP&C((zuyy$;Rm4qZM@npZhsfAo4Sn2B1cwzt5QB6rV#ayNFe{0)oePL+
zL*tyBVjE9HXG_71v~faNw;_Oj6c;*1%BTsY04LBEn_Q27nG>U#Ttb&-)Rusm#aBko
z1sq@RxM1ExF)=cq{z9^bDlY9mhqaDVN6KTkS)ku_k1(}m?^L6F<(t7uJZyf0&{<8@
zFJ7U;biRbDIcWM}m9u&4VZa>U?7Igq>*c)ujs@0m&^nU+&Z~Cw`nO&>k6q&Kw?&tB
zm&}~*6i|^tM5n<)T51O*p?vCNsGACNu;rtrsH<WT*$n*&Y~fny-NQjbvy?xe4?{Cl
z@wX_UlOPGi61Nbpr68ToKvWkA%aPVy;M?Otu%M5M;9j*Kw}~<GdpaRHtMHD7T}Nt-
ztigofb;bG;b8vSSF010hg?i$vEiqWkjaQ;EvDh{lvs;>MM^I(g)=ni1<w6xK`B%m1
z=NdBjE^L|b*9nbTry?FEF)2+6cYbxX|F@0x&+8g{_ciHI{in47Z<AoBuqYVd)CC7G
z&>?}SK3_NIaUsNrht11yA=<$2jaLK=*PRg8`~y*xDN1TSMM-uCHGr|tNZuq;&L2(C
zd_cubt%^~5;#-u0nsyw+l?PEb&~DE$m7U5=-{859lIFiGK<}rzZa)yET4KpoevBvb
zs{{8DU4gc0e*$#lJ9gzrbPr~Je&M7x3?LHJr>|qOb_G1|T7u4D-VBgIrJvO;!LD>z
zH%_TgeP2R+K8-yyPk$ZL|9iP@EPY0zmL3iR2*+m}LRaAGkv*DopCb)S*3jxV8=C4Q
zZI5sme51NaU&P%4)ir;dm!-yxQz6V+B9YeYhcUL}xJ5zczTV5UevLMSLX<fE02b8U
z8P<t6h4+J?XB!SsZT*lX=OiM@*$z8V=5mRSQ<7LJdc&04NlBm3(P&Dpf>zDV<BlJX
zr%DBZtbd?ZK1VW<BCjCJsoOVTM>M-g`FuhY$HBn{(GT_FLPM--SrgFlY~QLc5{chL
zp?rPoIPt%kolJB+uDAoFPz0rK^_*UBQfY^TPGAmWt?CPWm`a}{>b3|J?a%SnKTzdU
z#xY@0g#XzWHJ&VZ-`2A|<27SU{ze;~vjZ6Fb6ZwkB8Ef`bBb;KunfRVkqb=$#22+v
z@^6Zi85b#yWrSXu_ou}WJvLLinn*G?nx*5Oa|pb@bCV_Lx@?E9d)#rS?)yeHfvWOJ
zOw+IOl+-GkZMxb9Wy-jk&qi<G{CPhsXPF8dac6K5EKIOu%j9GTrCj)r5&iG+c_Hi8
zn+Zg5hqy8VZrXQaLD0#tZ*|{{@D3kS`3h#QS$Pn#&<AcfN%Y~WVp5@PMMO=F;laAq
zDMEF`KF${uctZ{8<pmc(kJuABw|t&L%!y(C;yJJ*S#Y}MIIxr|fvyOD)UI;!r-*x?
zD7hLkVnJyv^)-Sq7;PWM$LIg3dJDd&x9|O%7`nS*29WOV?vieh?rsothDK`W?naPq
z(4j$6I;D{=K@kCO<ec-pfB%Otulek~*Sgkqy%!vTrGc7{Be9DYWXr}2ncB!~6q)*H
zjMHulSTYc)E7ylA|K%kj`w(o8s(fE{eURrKtj#pb^dRV&?S==Fux8Z44nZ!C9n?~_
zWn1{4TbNOmGd84MErmH_imtdqir%Y<^`iQ!`g5s@0IGvZB(M4$ghD*Dklp{5h49k0
zIZz`#Q8k@TAmfOW)4Q)<&W=8ce56>~fHGQI#CBAhuzlz)7FNC^Y%odsgF~MJNlg(N
z{5}cKO*ScZbE>YM-DA?QC<?aYdwX1`Jp*h^nFvlEhFT?#9K=?lIQ85zj4;AraNb0V
z@}l8^km-WMAmOge5LhK|K(B^{2}^-p)wE)J5DHb+;UqfMNUn^C9|XTYI<?b;zKWAZ
zCTm_)d~WT8>x}dNrtUnJnH(vYLNm)@uI>Fv`NBUt*_>Xm*w}c`tEg#PL{xXsS}+mk
zMcO4%*y`0_f*A}!iwLsH`q91tODGf*6{BL2^=sM_)3un5qDc|aev7z1(2n{TFeo4P
zDtJW6g~4~L25?Z8UmTpP)KZL*=7?ABf9;H$904gEcGyBaVNHLnRJxt(l!Rf1_n_!%
z?L6#F@I$nP^krM<+e&mPHcf%6axV9Idd=8*;y?!ZDD!5cUcdMBmAEI9X@thS#m|L9
z?%x=vUzM2g=h<90V`0H~jGvZV*gcCFLoDF#gi#6%PZ4)21)Y4GAs@-ZmxJ2yLy>4=
z8NWo7nNKRiz|I!3F(fb)GJy`+3JM4m*{#XSyaU@K67$fh!F5>V<LRU!HwOk5Zv3vV
ziX#dfS?&RdYu^EhIj=({W=Rhj9+NKamCRENe+}(K9D<xGv$>9%td&`wBt=`=AIi$A
zs#iY@%%z9HnIIc1)D=CRk83v@$!<6VhyF?;-9YgU?Zv@;zS%DSojWx}6qf0^h7)cj
zCH>Aca*5u`Zmj<vBAJO&r9o7AbSe04<}H_$49GG94P>+hvw}ZclCv0JgS)(HAAYcy
zz8a@0b(mS#UjoVk)Ne{!l<iw`<f4z?xoec<<PqC472icS3ZnvJ>Zeu~82jci38zKE
zn!n=23lpNEo1fW2rDVFs>ec+J!0l)w<!365Q7}d9#xtb($Q++9@3v?v9dQsO)#}D)
z+QsL5e*5XfGP%6nO(-+<dCokx{gX5Ki`A%E!Q;l(z(*y(xgzFG;zbma<BG%r*6W{T
z9a_>`d$MJfU@cQ>%oa1Fjgf82H?f6G%2<Be6*dGN>#%M<_)6(S?8V2K_%nXS!z1g;
zFyNr!X-{?4z^Fbt>{6^Vb-NgEJ<z2$N7Uj7;N5@~Jg8%f?|OU?I4>G|O5{4nFZ|Lr
zmNxmwy$3oHUq$2X(z;1izi-~@LLPtb+eLk3Yz>7d1(Vinp*(gr35#v=6p7;7G|n=o
zFf&*Gzsars7c{<gw)O$#@soOj3IVQ<MZxmFnl-|c@=~Lw{Dbn+D3eIcm*6F*pyH%+
z=(l-FmD57KFKNFKCaOIaea8|a|M-h835oj{Mn0bgPJ`vGlS#pFtwpBEgTKTym2bov
zdQrG}nc;sWM-|i({icXnqXi#|ns`wK>J!rXG|EatKUx2>VlwNuLPu+pRCmY;y7I~R
zK%D1Bsnp^k=q*Hf$8o?6ar;yB{uA|tn>XZoS^<3TTYV+5v-^L<!7v3H4#}aZSEC@(
zd18fGrY+3Gqm_APL5~EkFWfG=6W?f5&-8W4nMkEIqUlMu`})+`YeGjy@mstFg`t+p
z*#SpzSw`?bK(p_`!7V5tZ?yn57I|d59NFxr@$agX4O#l^XjZ(3h|wpq>3n{n6us?T
zvT@zQNW;KVZUlXp@O1qt0H@}f_YW2-JrdOj;vqwP#u&;s-6lbd*t`-j27}D!fzcb>
zD8<|g6RLiZ+*qJjfI&H1Xbltf$;hW3pYIw$;h-1#QFOkD3yeZ%ssAT8?E2I$+yg@&
z6!vK|e(~eZaztMT+j;v+{6dLq4VG|~=JEQ*CB6fIH=g=|s|wB|^9aR&AS>wassY7v
zJt*ZV2xz8JO`Vst#Rjr(xjS+;VIAofY25Rn9du`qB47YP!p}LaNxk2dSoVPL6g6&M
zid=kHpAo6etzJFmd<#$Jcxh#-#uPzmc0!+K1c1p7b1}zf<>II?%z4FW!`ngAK_~=<
zJK(C<7XCHUKZxGb=A=!Fisr6+HLRk3s53S3?O%{=nRQ5*-h3#HU5{htQcd*O@EKsW
z3x4%nz5RDfyMRU!;{X;*gFDd>F>a$VHf?DzLh97ok&%h@Y|82Is1d_>CicBh?Wp;Q
zjhhO{xVKbQLsa-cg$cn;(;8OX*<}l-I8aztm7f1vaGUu@d8!$|AT!FN^(se6S6-x-
z144G4rLn>*Z&j{cmH}|4h($vVU1TQ1izpG&q2@8SwLFCOyh3Gjv?<A&^J!D7rDEqL
zC?+CDL~nkl*tW4G*Bi{`<$<)I&xH)U@q+2@BeXChn2Gfy@a-h}bg!<Xrmu^@jM(JB
z;qzDd*LZ656yDnMVuK^hcb$PVVRisX^-hdEnGj2Dl&!-IQ2BYa#Yf7~--ilqM_4q4
zPDfPUasiZz7|15-?1l1@e0UbEk1~v$31B$!im0CmE_yh2vctGM>9xwjj!BDNS}5cW
zLR~u@8=Wa$JL{6naUR1+ArrjO11MxPN=fYrHdkOkpK|W-mW`z@F+4H@>6(-((P2YZ
zikYGOLxKpIqIZeLH`-B{VYb@i<n(})9sM<hwcF|>rimct*Av_SD(mML)Bz1LbhmBI
z^T<BX8|Qp#u^Ca+$Wi;LL*D~0Tpjy@uf&j58)e)oZC6m{zDZ8*0*8bN-)&*B*O^VQ
z16Z$#Av7PJSgbC$QZucWidPcnlMYvBUS+A6BIPIV@jcarQG-*{#6lphux{w}h~lYJ
z$9!QFc%j8Kr4wplAjK*PZe)z8<g^fMKhJcd=wg>2D!{IV@uyf)Z2L~uoJ{Xd=KpS_
zalkk_k0VEACCUu%+{SuVM?d~A)y)8RX6}e0-LYR|k301!pmBu92bY$_IE{sY>%nLS
zEbJvXM$a5p5pIE>;{Ad+hT7irQ;Rl+I({Zg3|LP=Z*>=K8S8*;JfLhfY>X_p#M#KC
z*ljpXoWo#NoItayg9r^5$l4*?O-3i4ZyG1VO_PH01HxYiYzVpuADhs%)pWrfS;Ur4
zC%9<rs#YhrjlORgoE_2X{}AqCSz~qYqvIQX^ciPi?32dVQTVSBSSc+X2YfAQNt6G_
zMe|;lnj<L=Jl<=&zPHUk*c^t6DbWd1WhTyre1f@TOLpX2F46M7`-)$e=Zu2;Sj)I3
zP&R^yR-?r9@IC82Dakoo1}kN?6o4s?=nN^xFM4ZK_T%(h^!Bage5KsD?{Yt(_e?Ch
z8<$zC2=#K3{i{V;(Qm?SuIA950%q%=`E*&nhHcFsmU4s&zE)QB6-<I>Vb^&%K8WtP
zFkQiL!30L6`?;*e91H?JO2m%bO2Y5N7YbaU9|Nuyc<r3^kpynN)#B^xAAjd#Wnv1H
zo*n*|x78_Qr+k^AT)-qnJTR<&ujsr_E2t01M%6j6<d0P!)Q6D>rVpeY8<%QxJQ7u7
zKpRfS2~<Gv-uMJ~P8qM?bcWU9y?MujV9*U7GF3g;n%hVJ$R-?^gjs)5j`%0xLBO#+
zy(7n%A&Hs-;)Qquyh_w6q+F{TyQaw7kbP}-S8fcSO@2FG+X24lElc?&*p;pdQ2P<G
zdpvZpuc@6E2W2L07YSR$q8e54K16WY8#QKBcGZ#_bI$k)@85PMEh2~*<tO96X;`sL
zsZ;rk-1whKs2zxvxDAIU4fsg;F<>`&oF2hq*0rW!u^)T?3XwuGn#*sE+6dKk*iqAR
zj!X?^N+m_nXunL?JHC}g)sgDf8zmGya}IuC91WGzBQ&>gqxXc{K}ub2hhbycs;g5A
zkR2-o5Jm4r&<82O$4}%VjOG#7+E{$VIf>+0$y_hx8Ij9q^5gbbIP4&z!RY^*sTsSZ
z6er8uU;^kU`6VssnOI4jhn7@`G-||7;G9ytbIqT<R^(F&zo-o1uteLL=24DEQlKK|
z^UWOI4>e(Y{uo34ORV@5m1Ir#`FaEWVgTMbp%X0`1klM4>j*NxC#MMLyCn_xm~w))
z1-5z@(`SE?IM<U#<W@JEmL`{3Wl1SZ7>VNxzg|IjVP3&B9bu(f)P<pV`be!8akPDa
z%K@ONiiNEJJO_hXfNXxbg<2K{Qi?v($qs43lD;7$9HVXy0$k!gH)p6uzf|ZAk{gy%
z<x1?^D#_65DVbm*L{f%6Y7;$e@!ib?@6lJ$?}Cha*{e}VC!>2t^)%6P)V5}P{$D*b
z;)LFkZ*oUEfxwD79CAZg$0xr=7P^L8(37uY@i~{%7xETnlpm0OJ>#fj%dUV?dr9dK
z(GyldWyz*{{GS#u0FBdiWjyS+PvR8{YobwPL{h~I<r<rlhl%L%eb0u}D6jQ`aB-mZ
z%<*9NB<7gRN+VI|A_8hLZ`f^kuco1J@Xnk^Y0;e;tYE*)37>1$LQ>F{ATXck4^9Mp
z*@2d^t|EMg{3V;43PN_yBz#4OR4xg5XR3P@?D@s{Zx;83N5JjM6J;5U<-JcmyQ>lW
z9R<A|Ne3whc+C_6hz+*i(V;C^o8Vjij3>&v3=vARm7>9BDUYj+6u>+8C%|{s6<X0`
z8GxEilj#qg)z^o&jc>}yvVSlq2Wh=AUXBlAkyj=JA@l)r#;3f`VEj9udq(zfww*Zy
zkTdgl$4I$Bpco-3yvNJl*Wr`NNn<DO{BoTOe2vQ*gNHe1@fl|$eUW}&u4jx7>MuF!
zX{TMSPeN664Xyqy2L7SGBofQL$Fj7w84%vGkS?P+|IQbV-dU{HQ9jL4EZ<9xGzK3@
zX9kqEm)^}q350ipC;?MBc9$c2y0nGIWXN++@Jc8<pk}A?UwU8pyY(S_WW7<XQJL}#
zHM7~I2uLO|VC@DZ8?5_;8*mIm%_PaR2~l5zihe^}2jnj-Hgvu38fN#yC)zwHAwO?P
zKmT+o`!3@@mdi)|`Q^!KLV>yw3J)nT@>=_=Iq!^gHK;V7!Th)7`eNR5BCYGm#L4??
z;_MK(NdD2W8UJGwdP#=EVvs~O(e;b|<<y9$tj%k;H@?~w{dWOpVj!IFpDm%U--t@b
z!l75E=wV;U{3+8606hGHJ9Fp(m2`ZT`<N}1#4JoVOZt)qNyjBSi^*{7LlFNG>g9sV
zuW8!O&b31&zta^ka=0U}7jA_X3+?IG$+$FU*K$xigv`-Ro4Y|_GqADWxE(HdNdJ&r
zug~QSTZP4pDZAEqjM-ie>rH%D+LtBijVdI5No@j<f&UO<vP8CXumwJi;ksexGfAi}
z&tT!o;%_!+3}EW;YEUc^><;ir*_o3~$8GwkPT*w1POKJIQCA_{K$^IZ8{FBBg*v;r
zfS=OLh&zxD>mO-bQ}HG%Xc(MhAk#@jZBKSEja=)dc19#HV`$N+&b~Rnpmj3L&j>&U
zSh?frwrOORHo#g@Pv-W_t8fCCfAZPW@EBuv3Ba-GNXLoUGB<(5<lN;r445S)ABtl{
zkvaDTDE;{OcjFVFdepVy3EZ@Gq#`8<;NKm3OS?UwFoRP1=7vU1_Q?Zd=Yt{3;g>|%
zNq;7`R|4yw8|<e``<edMe2>t`@P!Oa$0PL97|hW`8(((uf>)E0VGE`|xgtD6bgIsm
z+0Hcz@as067PML+41iz5oA^|`)<2q5uGS0kQjYeT<LM|bAmq)FMr?~><r25iV<_x%
zE*K@f%7I%0v;^8P5i~hdhHhOAyam$7j&Nr~;-JSkeaHC4y!nY;K_YYN+H>254CcRP
zZ#T&C`O<qlK4^F}8ed~pQFPBa$^6C@9j=1p$OGgD9tvf_!c4mZ_Wr$}coPypSYg~K
zk>#6TQF03L8nb!-RTKXObVOjxBAx)GUHD)#ibsw2<Z2}_{N8PVwy;A<60+?Q1@$KC
z*?H}Gc#<4gF4(*P>9_lBKUwsr863logpgVrZ!bp3PcVFLbukxp_srOj_oq}fKzE~x
z<#+1QbNLpT)FtB=Na;6ofTdS_u6=yN#9Lk`!4t>GO*9&G?mxy&<-|+H(#qFA%9{<w
zrA!u+EITaTNtE1`fFzx4Qt&kf#kF@hh$_Xfnp1Q>K@Eo{bK)Dg0}<n@UvSzUuf3y_
zA+kV)x*;4@{Qb9{SbhI~i>f0>=ob?e#yCB*3yusJEH0%vRS{|<H>4<78CmzkrkKzv
zclPX!c~R@nN6L1>2)U#Cm~iB9iAt%Z-!+Lq_l-i(*zk9y5u_xgt;N20*8`lGX|tr{
zk(!k=R|qUIthcz4-yD7O4*eLiCeNf4(J0l|AzIni7$;brrA9thoWm7xgdzyd?)q6A
zy#6QBT%W?H$!;5H!X~9*Qm1%K`kB~)e)ETho28?xQLA<N&rj(8LZ1$xII#8HtR7Q+
z{-;+K9>ny1yYV1k$y*}@D+7fm&IEb!87`q@3j%C_m_UzIK*53I^>@^AI&^CX39-K2
ztQeuCSeZBe_*|t-^vyOUxdJ9L#NIQ#a}=0FyO}n*<SzS|Qtykbbig4F)zB4e%H0UW
zqQ|BH)5o{x7s@Ue(;Z0-5%5j!kwl$ydIDK5@w2NIM98?5s*eTgUHcSLWdmBt5osGE
z*G&ZjAKalg=&pDs6+z1(*2YS4GRTxO)f@kh>$6F|J}Q&H=Ycbk-4V?t5vB3s%L_`(
z!C^GPQH2^XE5_nEW28t;QEw@N^ntF289jLddd4>nv|m%ePD}*1Oj35sIZdvh29Er&
zuSa+_{d1x}U1gAYz7XJi<?je@tUT-V5Q;zbXx2%=T}c+8!-hG;L{yQ5Y*(JwmP(b+
zjAOC-*aDNQgqE9uZ;4{D<pRGl25r7$1yp9=mR;}@700ZUoZVpfA*MJ{&<|;czz)`k
zt>0}1R;hgm0gD#u$~-HE|K++9)3^2PK2ykf2}~TFezpBDJ|}`WqW%E|Uuh14W0IQ8
zFsnDlw`(V1C}ZA_#m=^VR4RCAPsQNPTD4eBeM|=b)ezsIINMwLQ>;+!!Urk_sZG>H
zV?9`GB(J{2oZ)=a`mgdn?CO?6HXTwBm!|n1mfYEO4Wg))8+ms}!X@cj-C<;_o>$y3
zC_+D6Y#kPZ=4U9tU*vMDA)gJN$)yEIaN+@cNsCOxH7V5N(nm<F%5Ia@aqr#o#)1+5
zzPSbv#zx8tD4r(u1OF?L{L_qn>5J0v+YNpc|1)7vBPX4pZb<Ik#5kr%a?1xV79eFN
zU{k~`4e~_TcZOq`xs?~6B~Z{B#?FG9Vp^g%8EaIq`o?FT_3`A!KNN^S?SPA{DEk`q
zt41<e2Qg1homkY;C2jp9o-tgv`l{ZPa%;HXgjTeiL|0695gyk^#Hf(TelN_;{IwoJ
ziSN?KJ*`;sMn#rZbV4IBXF8;;Sjl)E&G{*jjGf=0o?<C@UIl(E=(BPbsZXV3N=cZ(
z%d5w<V36SHID|S&QUx9PEaKTjP4X0O8U9PUFeimi$aKF`3A3T?-+Urlths=0H5Wh<
zvDb0L)=UbSK7)>_NGfr*fB2T<z6$~Qr3dY#Md}d~jG(%%c36OLVPoL2T5&zOX5~?Y
zL5#LGzU;}AcOv=;)fq7T<Uy$W5Mzq=XIW|yg@S7hp+}>obppe8^la~P3v}#k9e3ND
zdT&AaklQT@bNfFU-3o=$9UG1U8IHp9C=}roDItBWYuz12eKy#TVwWl%L#{IiPseE;
zH(;wZJ$niKg(!v9w5Yc3ZVP4T^B?x#oPnC%W13uiS&m~#aRSOzb<$Ssc^hs|rZ6rX
z0Rr*06%}KfxVtUJAVo2~E2XUh<<_;*b!S>@`3wrUWUEMZb(6lzmrUkDSBg%*;v%3i
zGW3$KJ)v_bjsR%-1!#D%-B0RM3Zo3y73Xr*%mz=0#b|sb@?ux*07b@Ul(%LM=Dg48
z2Ccx;C%h)na&X_xEIsEFqU(iyd^@Djc)ncS@Jn<U48dU$*<QjKsEQ6&#3~%b)*cIb
z?!EuX68=pRN9%?j8`2NO@2kjO$r#2k7OdaEC;9G~Xe=>Zh{mLo;o;IiH&7_7j|@>G
zTuRs=rqePlxLT{0+9s6tC3I5exa~|B)s-6MY4krBE42sLj)>*Fg9~ehfS64(+vSNe
zCdTn-DZ51@l0>u$WbZS@iGld!X4Xhzav2UA3w=^spvs*0=O(k$-Pq!U{45;VnU$Z(
zedOr>kg7Q*)n{<0C$9CR0-pNVG7jd!*}qrX|BwhfFZ@4p5b%UsFyu5HM<I#LhGX|F
z4y@mNuM6o)d#H3;wmV=(2;xR^mjW8a7zJP4Cc!90c;zg3oL<GA;oIbTC|y(S_0cGW
zI)Ih*R5TesX%oGFr33+v36xANOwC3G)DnTz${=<RGNf-4K&G%bsW>6rX|nN=>kLZr
z%<{zwq;H5{0w(q1EZnDA$M+0}%&!(Q`JL$eTgca%%{E09%0=I4*LtqKmg#n*T0pTX
zz-H#+6bJG`__qDvpQqTa&n`nwN}P;=HY$RtVSF%^d1B_`VH_Z*uiUHG7^xRY5+8_e
z*;9#uHQ&IjesNiD8(92??n5J}BghSgYC4BZp9qv!C#Vr@48g8*1s+kAqG>Y8?C|^v
z64|gm^Ff+sBRf>Y_krayLsFw_eH3QYZ7s*&=rC*1JQSW3TB!y_*QCQu`ifD_Lo9Qn
z={;g6m?u=YL$eedVMPf*3pi0%xQ5=oLup1|)d+sac0t{3*gmO`Q_c{kAdAY+@W@r+
zOzrjOLgw&kc<|S~()1z&fDq5fOoQ3<%j|Mz%l0llr5;eAwhw}1!)DcSGf#8=h4M2o
z(*{T+sBrF2%#-K*CHEe=3#c3S007)&rYxvuzq9=o`ODuamdQSIh43*!rWg(zzd2qx
zxha2xk7@QQ8(MAyC;jGN(<+=!)phXZ^}Q$DRt0YxVibMh{erJyH<+mptwqQtw?Yxd
zN{r3m!`416D^Ji?WHv&@-S+lt(vPDy-q~=06^nUGlQB&UJL>l<2HW4#CzMxW$|4Hq
z{2X>Eb9<>6O0AyH%F&ZfW%`TesiYZA71cnNnFg@bRrq4|a4Pitel3mGmJJwz!06LH
zM?^bgj4{(4vA8X)ymgU@;FId677q6+dO+Qg$mKBcDSQMPnNj#A1G5(<kUX&BhK?jl
z%#GOh(BWV-zwm2XQqF!65i!ZbK%nbJ=H@=e67o^v5H3dP6*rWmHCvqFCG5!FJyI72
zrCXHkVhV4!t|l4_3ZCin5+nFNnj|c*2Tl_{oq`WIvsNU8({eCNvLEW!p&ZB)C(?{!
zE_3e#UMO<myUrd|i*^!(yZ+-4{i}oOKRMnUl*2eYh9;Uta0R{q@H{@+=$2}QdzECQ
zT-UHANQVwJ3zxDrzmJ5jUXY3!u1no!CndFisp(imHQeoM4NvS57u3r0VJ2XnK~>9X
zL3_-FI0l*lA=*3?iM0>`m0o?5Gzw<=-&x~A>>og<R#N6V6DW0kBz1XQ$<tn#%W@v7
zHHbdR?0r88Z|F`3(+HHQVQ*r>Viv6zNt)Xe*P)-eLDmxI_K(U~xGg)CD~X;tHl03d
z?XW*wnaAninCD3G-^9`AU-n?eE-q|ft8JY&0QpB4GN*E6OO@KL{?t#WI;;P*fSc{}
zARwAZ!^Fq(mu^HN!{Tkye_FBT0$WKEY0X$&@v6hKa>JSve_NWQep#uMxVq+Rj%53M
zAdG|G#Z%i5<W&CFOnv546o?c!sxlF78m{S5loTI%=r3D{7e8C+&S=>mV8fz79?I{f
zA518Lz-SVgpJ{|?k`g|XM#!SYzf=NFG;S&WZL}!IN{U>`EY)Zrf-9PBWm)PT+x&t*
z_xU{iMF~8Iz>oq&Vq8}34iaj+9er!Q%`1YEh}e=N2{X5WwXH!mc_)L)$*8=g<`>yI
zD45^~%wn{?{`bD!EK1+@rBNKK`FU7r*-X9_!5XgpMDHTxe_i0>B-PNX)9c^~f(g&O
z|J2cg-@rYvM8;x5op?@^NG-HwvAxA_31xAO(nzh~?j08ezQ|gZ#muB>Fe9|zjC;yL
zwkVk}agoFBc}l&eLu?@WZN+YO(-t37dGhuS7|v18p3Aij;r}QC>7mv&KY1k@8XU<B
z)OvPbTCGUo_rteetvD;+I@|^WYb_6{#%DhiKth5)!wUi3mZpH2enFox)RSooQQ)+S
zGFkL;a9_H|f$if=>L1myq@8nv<bsFN;Nbh^_;+2tcRJKwMnz`TL`)zT^uI9()nzsL
zj!SY=+*;%|TKTCmzkz~mCff1_W7B$$GEW;_HMB8pJNz!2wt|?vxW=*Ee4M632Jt(s
zqGRR~-5g5I;W7$oAKu$xSN3`cszTNO(|>m2Dwdlc*!N*7sV?<?%}xBxW6dyIZ3-V|
zr@LKqZZn>wwa2<E>JO#`$spK>ENUVAnXx=7X0H-ZaFc}SMTEDEd-E+Z!LpJSDU732
z!%$y_slcTRS#9-^&K6WqU~a!xvn<DbLoA&DFtP_0D{GNL+;m^iXRxYxZdO42tWgrs
zZUts!RUgteY-ST^4-8*`TIKCr?}mFKp=XF33c%0`FUSl}Y2-K?+SZb#9OS3mtWiUp
zji11l1<GpJ8^f^e-A`zzbPi}rUk?$HkDtq#zx*zPCw^B+#Dc+C1*MxaF5>RX>y+Xo
z@h{kD-lt@_=gsDQv9W5(9bAcrAxa|g*VtpH4sZ52VQUspauBGU4-0crk#-%`k`#|A
z?~J#t0!|yV22(eaW}-EnORR#V4(WlmrvxwKwacGm2){*tWPbozFrvPzFW)T9tf9ox
zhTNSaA9a|lj4Kj<>J!<n6Q3g2N{(B%KPC)q2cEpgGtqy_Qow-5k&%)Arg`8c<5ocu
z@i7qwnwWW;LwsJ8GR8hlX*mn;$2qNPjw6Jfp>4cz3J8_z=G8NL{T~Ps`;(X7z+v^S
z@lgYc>mRY4@-5<#njW3_2*HgPBAhv993jx|jwH;$OAJ6WZQZ2T*9UJ?a4YaYZN#Ge
zr}~h-X&lMkHGH7(_(uDpDP<myKFae&eaw#V#EM2^W+7U&NE3A&ngT8CJ;HC3B1Yx$
zH5Aw3`Yq}ucNCLU-|XEw%sJ9GZo_Cj@-N?vQ1#4$vYN4keYUSsRbdT2v^xaI#osdF
zMBY(TSHI}uR<8NUJl)=%;;S=9z$yEq)5XQ4>CExD2NL}Y?0Rxd1TRm~-eze_F0zKW
zlq+x%b1&VpH*N!XN%^cPoPU|layY}um)MF#k5(do!VKZ%)^oyc=6zV<<5%>=``yFK
zDGFZU3DI`T?O`fo-Ar_Ok!tQBw3L(`TP@6n7s}2^hCz^Hwz&VpP@1#H5|?cC6)4a+
zi)>yIp|Y3BltSc|yIZ5Ht$LDD|J|<)YG3TdDtAmq1f4JDMoml9KE%PPJGMRxP4D&D
z1!Z_E;8TY!BKYtyv1+bmpJl}V@FG(g&HMyt%E}z+vNptUR>>5%7g{8-h-V%T2m!2i
z=^C#Lz&#_#g{}`&`b?G=b#{-4RLrJQl$qn}n3by}<hY5N*a2uRumNA+qRECds|W{s
zvv)e^bGfU6^@C+_GUdN_4ZW3!^Z+J-?_?QPw4^w1EM!FNV;4C;aph|Vo=n>CLFT3F
zEf+q65UPmM)HI?rEaFP5aAg^dyFQqA&K_PTF0Cc|C+k5Kka=AScpXQ-2Gu;@208!c
zjGO2BUs2G(JXA_(H%=IP89nh5Z{_rDmeV~$TrbD%Q<xMJl0?Omf`O9LBYLl;*;YuU
zDUrT$Stg&<o9pWo-C2%Ktg~-k-lQZOGb0!osK!!Ozp#*{QtJb=9OY_)9OBhi7hL^J
z@<X5o*?sXoi+Ba@a!)%~4jGMdBW^xfr=N|zv8CH}QfN>z-cvmHzNFW-Zmf{E&&p>;
zKf(Ip#ce%p#jEhxbZW|!WSJ~a;@Lqr6_)ZF+4`r2<iAS^{zW7m^0X_%$9HNaUa8zU
z%h`)%X{ecZ$&h$niMiq;jazt5ep?C0-n!=PH<D<cAP}hXLM{x`C*~dBykO?SO70Y6
zd`~6!hs(whUmD~ywvD;rr?hkO&>;h6_}zpz%~0|f=Bp)G%ZFMb#f^c9r--M#5UqnN
zfCIHHFLU%_M)7>TTlNuQXPLNy7?TLD(nOsctl(+l^Gf}j<a=n$8}80Gr%e&7TTTqp
z^CUG#Zq}()qEhB>-Ns2dKIH6&$dkzEpy!9hytgKJc)riPp7TfsPi`DkS-5RL?Gp9!
zO=?De&UpP-pgcSkQ^(E%Z3nO*SX0>`vy))NVw}FFn1L&4tsoS7v}QsvZjCB+puM;7
zb$ACSUeh*61ZEi~P|ti@&&VGcFn{OSkX0rAVSsOW3b)LwI^R@?jJzkJ2lIxviHgzQ
zww2oXcT5LsI7|ONwn}KYUcB?G_tWt}&YvfH^tkT^k}zg>vE$a_9}lsKnL;~Iitm@-
zchjX9m1&zrNA6Q`k;D)U`Y^Q6W4+X;$jP(cASvgyNltC~S5$lAD*Ro5F;Fg%5al}B
z=%hjSh{pnx!OW504-=^;&BwXlWH9Kkb2sBrAI;xd*fS^C)RykkI^K`Tl9Q{ONJiyf
zs^&%K&SkRg#6MoJxZcYas6@c$OkNu~L23fBLcV+xD-1W>N!fSX?wX!#pa$g#prBqg
z{2Y+-c(WuO!02N>(Awc$MB}`Eo$$uZ^hj*un?7*|(CTm;?YD;`8r|FBC<sNQYOWSy
zcNk2AL3{cWe61Kt2Xnf)44Su!Mf`s0sc{n>A)Eyx@VR9Bi;He};txc{&Q6hGzNt`5
zf!d>u!+%t;N$tS@);=cDoxToXhO)DxB1aCb<UXZtq#hf!=}mb$jNyqjn6eDvhiCM;
z!;E_kk$-e?^hIq7mY{Ef=(GrUMxm->9iaDgMag^p@)8}tkc`9QnezPBLO-=6+Bw`<
zkT+(vfel^A8!y)Morv-6ITf;-%(~Nq7#-&L_fzTPOC$S52BVFG8gd+Sj-7-KrH5aB
zs-)T3bZQ6cSU|cbDHmHVlJ3~6SX8L59CWO;Nc#3o=VqR}h3%(q;ja#Fk3nq}z^zEe
zq2A4ELCOv;rxQzJco$p?<diuw^0?1mLmb;<n0GfHc0fc*+T5XR0Ey(4!}Eg)5k^&D
zp2$iGm<vkT^eJ@^Tk;r+!dQE^W-o31foUY<-Wr+H!Y3MY9uJf|OX-x4K-4qFg~-Gq
z(`B+=L^Q5#DF}bfiQ$4|jJ}{mB&Sc5&D-Jy*q1NnUaZ;BYD4OSkA*+m>H5&Rm?t}o
z<nTq@E;Z%s+m~lkQ~{B)L|T`I*ayJ3L;GfpS<g1T4blIR{%Of@CkP`G>;-7*RPHcZ
z!?`-d<hhdnTr$<+u(sPoQy%dYEtN~7K;3usSK|ni{M?KT+ZNN+(z$k9najq9VI-FV
zK8t1^yQ@a$4CN(;t%b|EyH3ZEQeFr=Ow(I6?x~7o2f{5Wa%Phgw5C1p%ziJ#fqqMp
z(HpXwZG4C%W|h-F3?0r=rK#W|smAEU%^nainGh9K7K}Gu+-@hi+lhchtd41%4XQa)
z`j|Zb7eoI#3@TLn2xtcB<(2nIr}(o7m%A4x$VwX0fq1>iz3W(N0oh1+gQmI2-JuLx
ztRnIQShSt5wJ_;Gx%Yg%y18@EvK(++gV_hYkZqHan&$E{4?ddr#+J6oTk$-32uFSz
zjFNB_eltuQSS~z8dZ}S#Z#CbC`DKsr%oStIPg_;11}2C%DNe&!UGe*rYo(<s8XYg>
zhR@bm*h_xl&P{oat{R^Rc%0uW@%J(}p7~t$`5v~;o8UXo!81zyTzF0*$39K1y#G$E
zIKmn6+X0K{yoe7MuL8*%8ooZjXJZGbF-f;)$1QXD8}IQTxR3^~Ulp$;DR5yZjpLRo
z^sWF^UZ{M4zUGi6yo<f0htsG{#o#WknnCYV__Yafh|^?s@glajHK>SW>OXCbD#12O
zNZM}Q)Ro@#TQ=tK$ox$*dz<V(ADyMPZ6__-iT9~Wwrb18-J&6C)LsE$H~QrPTvY4G
zG~~!-{g!Bqi$zk~LHU4oZfT^yzE1B)L1$_fTB%1~cJ<$DjPogD@y|6TRKUS`SMNuN
z%E6_&_N%A6I%xWP#}oji144&O*~J<9n&~C5qu|mJIa8>S2BNjwi`b+k2Bg?G+$F$_
z$`EQ`N+x1w!W`<TN{%qHv+@PMYPMd@S_d?rg$|zVXf7Ww3Y#|9Uobje>_+OMC5h2l
zU!><>;c8K!&k_X35;hh_bc`D`*Us9}+G;dU7<;fO5?J2!9)zy3VEEhCTllay(d&JW
zU$J5bpaPVFK5SufYaeveY?=ku+SiXN8Q><U<@s=ACg}u45R<o^j@K+Te`tFApPsA#
zWG?!WT$q*Q<hM&)`am!=0$*Z_kE^h9nmP$IkXjy~xB@kW!MK$RlDNp@^84E+Nbh4S
zT_RW*RL=+-8vvcFDS@};+I;am2X3KipQVoUg#4nWWuym4_Kka9h2e@4L?qFonfTf1
z=tnx<G>nv)d}tm3T8X`x^12;EKE7dsp`Os&=-8-<OmxJ-<qZg|FGGspq>@#pN>P|{
zRG!T2lN*#I-}DsBC``+w(g0~-1uQ#Ap)uFYr%iBE+n#Kt$H3JU9cId>=bO6rzvh~F
zlO*g4%}t+J39lg7rH8gQPJbi#kyMZ|)(zBjkmi~4?mqB9Gg>yX5d(lW%knxCVH%!W
z?nkp|Kbo1LZ1V14^#YC$ob?8ZuWxZ{_>blQ#!DVf7KX`eeg*?C4h|@SCe*_9sPGSX
zZaH?7dcQRD<HQ&XYDQf6fRIo|mViH3z8N~5QqQQ}qJ=?Zl$!oT_L9qobj*@38+(L>
zZK7jnP)9+)%3*@Xt;>n%hhU`5{^kN5aiNqKBcw0$p5?>84pCy7PkH}o0ndPc6Uwm%
zL|_bI92d&#Uy^3vQdNi6v{OP%h|A39DXPXGE9}x6{}K9{3s%c+C+{mk&2&}OhI<al
z_g3F0q=}fAnzus#r0DAr)EZAPY!{4H-fN3wH7Cu>QDNVW9!J|E>|dWF^Y8#5IGFlQ
zfHNoS05fjIn<j)~E^3D2!xkP|wIc-s&5~rc>Sc_ps@za?X6K2u)P`d(>)+VoV{Mu+
z9w#lsB6YJZ%9oC=+;8rdOa7|}{=wbM4JkEupvMpJ*LakGvoF6PF(gxDD@K;8Ygb+%
z)DeVWRiRbnJJ-EKm0+-8rx2{48HrK~77PAf*lUv@M0eV0(@CNCg}kmWu!eNvOB*zT
z6n5J7!(?cI8Krk_vq<l#k6IR`@>gWY9K6^VwdQwr9giyYpi7iy^;(LWh0iNzUbKMM
zs_$H8M1WUU<0Rs{NS#}~yXcgt4&1g?EB^PPu;$tfvcl)%|Lm0hi|A4FO1rtInl!n>
zI}7SbApQfihZDoHyWM$vJE-LC0Mj7g>4=WTeyha_rsgvH99P>C?Nj}7D6ohfCR7r*
zNHjahnirS~ukM1Z={YM0V+JcZ<7Jp+Y}O8WDa8rducEpfwTT82x6|Ae7o~FMNs&?d
zGIyh%q7Ftsz-=LZc8tQ-_U+s^dtD`qI4#0{W4qT=ClGmB+fEi<C~67XK8&I=9uux_
zSt|UPgq7o~RB`aiNgdPZxqbQDg0b{ue4e!>h;@yfVDt<OOHuBimRETDA}AF7&dPGz
z^tco<@^+@Wa3Zxk(oajOC-x5}0jtU^Gmwxz4inwf%ZsGOmk3_%tu$`KpYWv7FVW~;
z{T7`r6QthnlFSO@7lX0`@`6;vrYME+;HOQButb~XkoW2cHV+uKyoIm6z<~J05x4g8
z^JAH3Wh31ydh_xghKok;l$J`++2N^TriDA<N1~}rj7VGGZ$AhQ;5Ry}KrEEL=Q@((
zx3naY1`2dJFvNoU@5OMC*Zykii~nJUOI{p6hEjT{2iEF?EDGS4nc-zL?C{V<y$RfQ
zAcCJdL?7z)quTS1=s#M#W@!-r@Paf{_T=71Mhx#$QXtOZ3BO!X6aQUuv#l?3ub+>b
zeLq8zNH2Crft&i&KD(M}h?RMXtT)@aXSr8jf)1%l$AkJM0y!7XO^C{<QR*yt^g)`0
zhzWzMzF0CH3YYxJ77I>QOF!VMVVN^hOb&Et(B{)-BHWFkv_&+0r{Dq_Qc3Pekx|u2
z->3arl9Up>{(LZ=5M)nctz*XLrWXQK{j+x_`g@JSv+rW^aKP+C_JMFXc_!K~uS##!
zu;C_K*OD(ljJy+5M)kZ5XCv*`6fO*qRWPsfceh-cLN|`YYixJ>M#dK*xx9jI9{ebe
zu5SdBB`PYu*5ejT-i_G4%Ti!g<z^!0RBugMiZD+o^OpX204x@W{=PkAXS!LykCeAX
z7jw08?!4)rU_y_xt7$J}a<DyacghrJ7-I>Zqy!eGC_F$s!z200&r=?XhINIm2wl1v
zi*#vF4?o6lVwd`Tm2$fN_htESC8jy{gj%TsAM=9An*hkSH<vFr+`bx?ekXg)%EpP(
zG5ScUu+e%zsLJ;+hSk!-i1<M;d2;DKRO#5^E9NODe2{hl!0}DyE9sWv&3I%>J56E&
z9z!*=AO5W3Tl(BV;VNv0D3=%@FIp<)6k>Y)w?#y#zMhS0yY1tbd^_0RX2i~lH;#;w
zMwsfnnPBnPFKg6)n+*vol~X{H6$U5p^tbj~J6ET>OMBg}_zP9F{HrP}wrQR#vj5mH
z!>STJ0guPbh`Zq)gGl5-$gZC!vOi5V>qp^2fmmJ49j_$5%mMVg^LaH0?M%`m1nAbg
zsehMr=<_j~><_LkIXwZLQU~<mj+=A6eDjDZq*)EHT{h~~5%}dSW%U%ZoNDi9&%DIK
zuD6`SiNG&1-uK7~n?{tnl}3^G3$2nEmj$kg&h2}*`8-gO8C&QnX}ViH(4!!(X^<<?
zaW!v+KQ=v(4F*(u%oqts5Fz^?XUqLVto8igeoIDKASf5%WAJt~>j+%)?0HuG;BjA?
zg&`0*ZY9wBcFj40Mit)1g_kF5kf|oMUl%I;&YjTCHlp936Q2(E23v~l6K@B$5Ox>H
znGG4dBu~h0YN80~o>AeeL!=~gaku?Z7S!KfrohZ)cTG*E8_k12?`;I%C}$mvt9d^2
z#8x`n6O3YzvHexhe{jZ|P}Cc+|3rcA`*YAEL0I`1{wO*z+@5n(2)RwD!8WS*$Ycfh
zg+@GoMXvwjbvQce$<TOTveyHI92Rj950Jj{Hir>{g<if|SY%EfuGj!<$O(v@&~l72
znw}6u4Z|J{2|mt;wS$#9(C93K<h2L)UNRJcfbivo_~qO$b$Si%3d~ghY)Me-1Bi+q
zhF&0i_GMb5x!&EuJmR9mYmP75Q$ykP3$^2FWj7lKcq6vLBRfV3l0eqXk4gJ33Ceqq
zZD4*8t**J8_P?jvHi}v)MjInrXRtNnGc74_xF>OU=0a>$@h?ztW{c`0oBzHjPsXQz
zd4r<?zi%WB>Pg@|;?`{X;Gs5ZXU)o!jedP1Js&j)8jZvksCl{(HuW3S3~>Rdr17>3
zxg1kLD)b+w_1_H)N)glcQ})-zS)YczSjR<x?zREkQ<!tHL(Za!h;3!QB?nJYG3Sy|
z&#Tb~UOQ#R-j@nMa)Jg4X=lF=@FO2zj|^g<<Iu02OWWVl+)4L2H6rsGY1c}OyGj*O
zJNrUt#!v;!7>{{tENk$VZTOVSY;)Rz8m2$))lbTvTK?uXA3^sZFuPxgnEIdh@vr*d
z^a2-ZZf7DE-b@vlFDFCD6l1OvHzlk-(ow|_mxYFLm`DXcAQf$jBeNYxirKV}gr=<$
zdBAHQ0dU_R!{8gt^P|rvMbJII!)2@xm_-}E|ImA_*tn(-7OS$pfNBiQLx}vV2B%po
z&PZX}Uei?^q$GE&D1aGCHcaZZ*5tKV(Hzm=Z4!^Pv^lP#d_=H2cb5&H?Gqmt1)^<-
zSsTo$Hw{rwt8>^7KbYynDrZQqYs&rzv1sFl{sc)4V<9<~ean4U_FSwyJ^atbN;7UG
z$```&&7!t9Z7M1QOS~0%$pRYkjajERKUJ+}QN+H-P08?=gkH)l@}O*Q<9b)%n3m!f
znKZv8X*JNLK3ym_#Ap}_pUQ4&C|;U(olmOGc9OSZN=DhklW{WIgr6>M<Qq!%&_+>u
zU-XNv=UbJ9*Fby6oNkWXJI4>LPDHI!Y6Rj6Ccp3uS`lIN!=991!nLID%3T-5YnscB
zsmHY`<F;4Ry$;l{6C-hbt;H)A!JU|Ab1Mw5B{qYer?z=d#c=P;Up5TFKH;)5=OH1T
za`!A1U>8je;)`<0MNXH;DEg&v^NFpEkHJlyr1YKupA`ZA5Dh*Oi)G9GX0|O}0qq(d
z-SG~2GyDq+rG=Z}H0Ru;_JH;DJ-`~i#1(4a6)YHY!~Nn#-Za4W?)NF2V6U;mFROg@
z96v%S5+yINm=j#Y!tqxRoT-)*_%THA2Ok>T(%7YvET^#Z*EXbZwFpYmeHA`|qQ+aL
z>nAj)^K3y6-?Ys9?{=ReVt>~U@BE7(nvKZR?UoX?K+&ubXq{B#GppT4Fd(H+CU67@
zAfV=L52>mX+AJt;mrS1n)t3lp9SJe>$&eLNqZ;%V!F@@oHhMC8tNGTPh59DbBOwWv
z@@tVPLiO*E^@xevAnzjquERA7^rP{|p!Md&VF}hxMn)rOfABmF3oK`%mX}mzi!9w5
zX`9|U#IyFo<&5M+!|Mx<Ubnu9H|>mBp9#z`?XjCWma;p=WW5?L$#U&|enVFN3#~R2
z?j&&=)m@<tdti4(Cv;3q^ywnx4(t*rHHItdPO+e6M=Z2QMJqtl<8cWH&*)FoJg6v(
zSB2z<KNp@_1nl!b7W+QAped1YXI!YRg-Q!JD-%aL^zsCmkfr`4b%em>gla>Es3Y7l
z1)89TA9WYsW!o20J?#j{R{#dDhHlLv%l9WM2k)fs9=bCMQtusc#1Czkv|H1<r8=4P
zMnb@HUwIoXnFYV<eT9ld|2EAS6hKzXu7Ca!|357OP6Q=sq$L4IsdE_&YQyo&DOzpL
zOO{E%^run7bLp#VmPf2ieMv5GqBnh>B~%vAfxe?8vsls5BCX#8#t%erv_i%ht?7@$
zlwFNtZFNicQ+~m-^x{LuSTIVAV}c&kdNrm)g9ock<6v^4+Yy4Zoz-ZsI9Tc!OsD1k
zFm%f6h4{fp>PX)rw{@2<k&X!7!`HY$G8H9HYOSD}#WTgRI}C@4?MpcppEIPG$aX?j
zXDHZyKZd2A)O}ZhwDEh6)g$*uI@F&zub<s>|34w7w?r~+Ls02s-)^5ePv#QrM8R-r
zN;YNc8o^+UF{@_M)_}kKvZ}qNo(D0-Raa-EAQTOwoEIh``$vHYhm_U_Iw}nJFb(P;
zoPm2~zO-|w&L~BehNw^9I1fSnW7^$*jp<*C&Y#q!&(Z#QsmFIK^B@ngEcEevv9ViP
z4BiCvfm}@G!yVV`WU05t^ee*jd*>)TaERX9WmuUPIL(Qh4naLLcn(XPsV96Fk6XS}
z*__OO6LoB?j3Vsac+U@{czE&$=Xm2cc4p5f=KSfzls>^zwh%sXklcwXtBI%)xXY))
znw9VvTNPyvDADAB0nWceM~V7T-Rb?03ygB;;pr$*DI)p$##6<>oqI{ccC#^DhT2h6
zfiBp%@|*syOlQp>8EjzXr!89pp;e<kpL2{aqmmvxm@(obZCtyF;52!)X{BhyudB8Y
z(4u(=AWcHq!^;F-j!UhJ?%v0W_;aOw#OTHSA%=g{*E(c^zepnTPl<-oWMm89BQvDj
zPfbuO8HiVL1tbJ`)vuz9Mnlgnj<6|+wu})DqYj^a!{`6ImtmNW;rP~9+v6q<*W8Ig
zL*Z(pE(xw!w*ZWSav>ENI+@|TXtV)%34|t#4+@5FLwVn!*zF#U_Yo2WzmzFXC!CpP
zQi<g=%5INI>0@!?_(f!_<^UfjS~RcJSN%PF>!cHhEOa^91;OQD4zCL_Qd2(EZaURv
zwV&Ntl26^`>Ohn>;ayl5wat>;XGfkvoh>b-4(D-it;*ZN!(m$?8u|sh-)H;kH!|DX
zK4<8Hn_EdfY4=cq^5+`hX^ra3zuI_nJ1*wS5bXx8Ra~2!+pXXtBQ=?NB&vD<Qt6MK
zK7MXKA{hYD2AQ7}G&aA=7Ea<WwrRhf{`x;Hz|j%)#n|!$D5$WPRg9DN^M$gv11JQ~
z5Jpdq3w{tHQ}ghIj1?rnZ`%uvRV-=02tw#+VN(5l=iMMxf@j_t`|8`8Gf*(6NvPy2
zSAF@$^cKGgVuN3!_3MXj(NMJnxe4`jMcdyJ?%b)H7a<p!T%m8;Uat%y{b}+EdLHim
zH!+_gt_W<8Ym=eOrv9}VQ>8`=UGDXj2`mwOO9-jvdR?D6O2q`z$YoT}-J_M1f;jWW
zU-~e-bmHcwEiUWID-=T~1$<%@i9I1a@t~ABDh3Z7vvtN;;!iH5X07<t=A@bmI1}p;
znMb9`eC|aS1vK4Q=|p>aBa>YDSp0%(j>>T2A|lB+FKSL6oU7H`NM4#+zndXPn{e*w
zFDkWU{!~ekdulD%+wq<u#`3u%7WsE58K8wA!E2<BczFpKc@6BdBW@oNP}`Nw#XIIW
zQ6C~eZ^F^8#6|Qn5DOgYN74QXS6>pm0aotwR`O(P-lfKX6PCQg3l$H>wNds3zsn|l
z;W`*StTWG-ToI~;hqs4C6P6KrRjoUQDzxp3dad4rIy5S(r?kL}JWO1bovI<as9)2W
z#EZa1Qf#>y7d@3B0Tr<f(Q8=yUZgale!iGzv~mFcabhXJTwmW;D)1(L(@VM9gR>g*
z@zn69q5G%s%>R*9{sOF(Zz&?xK?+G&F3V8hpyJBNKyHp65oK8JX%93GfY1$H6{o*@
z2q^xR%j#X=g+eB+;;?z0F^e0kQ~zD(<OU(^%W(`Z`jN>e7~{F02S{;ycbf@A3FbDE
z+&oM&Uh!!LnX0G^&fKs+v)hz6L;da$y=Iz}IGGMkQp(W=lX5e)_d6-!2`P6Gd!+|U
zU@?{M=Qd6<Svi25wLd!i0dQ_$ow4-Gg7|>2d61h~*Zp^(dw!c^a{t3nRXc{#`~YEU
zyY6e3dhvl9v3F*}(8tc_I_#g`_z6CUM3zLLjM~!t_5-~j;+I{%BP-^QekNQJ!=nU-
zh5#~!N7YCGgPfYcw77{bZEa^0^`@<B-W8iDsg_KiO=q4H8txK2l>>LBjhW=A7P}1<
zk?L3`PcV#oco5BqI8H8X%a<8gYQ?o=Da@t#F;r}``D?7F-Bc<Fz1(QdWbSn>C#u2T
zNYVvw>8BAGf3Zfs!RFLkrCD1ILD#Xo7WHJaN8KUo0{UUNTNmpDnR{%<2->>$8<@~A
zM);mpUmcKVnp|n4npui;;y-xXC#R|X^G>yPW<P})Mn$mrrB7;5GLb^#9zhITtF$3$
zoGylxo+X;)R5vlTh;q8e5Ch$iw4Il$3F+x4&>d<HSG8uG0hfySea7C9akvUN<1(xn
zQD%&cN&%MoMfU*XBY{HqD{RxjFJ;NeJ1dk8*3uV9D`7R-7+f^kBiV^9xE3v%sC*MB
zv&6l%l%LWNQhprZ(hSF6QeC@i>hUdip}+JSqW;Do+l*Ba^U;US*hW4xuZ%VbTq>v~
z_*QM+mW@k0;yZmj=bv-RkDCw2e-n6rtqcEbywq|qCU#g1>)P1+-r--Exr7^6%>_^L
zI=gf3T~wgQm&aD`7276OnV1|Vk_L;^Q{qf@Due*PL%4ce#M@mx>C{WB9FW_gt()FY
z%FS0Ra6TvzASADmAXCGVh*+>1<I`H%$HT5cqd?b9;qcPQ4f#V@y6p)=7gm*=u~(6T
zg;69AF0WdlnmX;9?(?kKI-HWOnuC*yBqX{$`fcRGfRWhvZob#q*GVGu-X!6M66eS{
zQ)(p7=jm^Q_D^;LZvCo6za1kxVkRhGHaE6Qc9W0Dn#ZoOUMYjOz|7E;_q7iPfa%zF
zB+|)KV&pJ){%cw_{CM4d$||xY|7<Ox8tNHAC)%*deE2L<w@F;k;=4Dyiu6--XMoZA
z$gMTqeuo<Q%0D1l`|jq#g1I!rJ>#p9H;!xwV?;}&dTBKRD#}$gOXE4!<=HQI>`~nP
z*d2CzhCU-WB*ht$>WA%A|9?DPWk3^L+ZL1-P&%bsx?4h0Kw4V5yIZ=uq`PBu!=xJ|
zMt67jV0=@b_xrmaJ3D80UDsWT?bA{{bufz4-{l(|$NysGzqK)cxO@y2@9x&LPNkDi
zaT9Yh2}Q4kW0qg34+XHfEZzr=j@ea6ybs|x*wjaefejkUw$p?ZRS4wzUc!=U+Do#q
zGoXq>LLCIS7T=Lk`=%8rH$E7XpNdD5=pd}_%tsNZvPJ2CS05_lyY8zbwcTQ8B`}?w
z@igloy+6%EtO66I>@7igVdlZ*j$rQhe6Xx{xz8NLGG+Y(nYS)9VFBH;GA&A6Q)ISy
z(#!Yrk&8JDE*oF%mslo11<etDjJ<zHy(~g=VgGgq?X}h|!-dm%eVM?kPF359MNj5o
zQX|7;q8ON+b4XoE9biGcbpmP*B4<V#!>iN9YicZnGBQM6+qHdJevBDR{KoQb3PC%#
zQcKs6#@WBGk*mfI=3Rdm-g5HECmtWEIJ^U$8rrfqKj>QJRz%^%KUJdm6Mf8Fi(dXs
zZ%VfNLzEmc`J36AD_55-JFlXZ)|x8!%d$LJ2m{CHecgAAL%29syDt7@bRN_(BBRvW
zfIy6u;TID-4x_+g-2(q@xykUZA4-3FxfuSp;b~G7k5h@^du)h}R^kQz1c}&YTocd6
zbc+_;yu=5cl9c6F9G0hLL~3TaFb&;Oq4+j=8ohHtZVYfnIXD_x`5dp;@!Bb-k;C4n
zeJO0=6E?sk(qAp8C0&s_tE$N^|BWB80VzlkO04E9LB*(PVJMZAT8Vs4KQ@Hj{;tyx
z$!lnaC*(KUljLM+h=W^s(MM=7)T%L-^z%&S4Mq}4;dF-%;Yl^<cI11HCv6%h5N8Cz
z6V8K-CKIFH&WMRgGj-{2Airy4g8ZdoaiRH%e@lmr&f&OauSpkSCBynYQ(meZClP;n
zS0AwYD&te|lU;Q(M~K7SM*?|N=h*(SH+Nx(0yQOJaA6eAuiW(Qyoth-fnG)B&bA-M
z2+XW+h$~GD(r0jT;oz#PFs9#*yef_y+m6ugdexc!DWzoBP`44jDM?MLNWUcfdx*$Q
z;1#QkAuq);UOw(G`FViINw66Ye@nk(EIM)^`wA#gsGF2mRmP|~L!nqz2pjvZUFJC=
z4v9aMNi(T^p2oIFjBEp51ZZ#o2V(fQ<s#*Ob2+pzOp{y?1`z{_b-~Vyl>PosKN-|x
zCRwbJjU5HRZhV;&ZrvuE^EoYe=r-H%so!x6EEI_(ud8ZdQ4wwdL_?vk-W**=nVEfx
z&8d1lPoIGgU7f~Nl8ThMUKmqC`*lQA$^ShFA#IGf_NQv7n#S7|Qf~I`Q0)Rfskf+d
zhWL()iBsR&e|r<gh@_c2P$%!MV}>!hirtCYQ->p7e)&0`3-jyZb*t+5b51$mNHzn*
z8)O2hL?=4zWoC<#$ox-Vi+7z-<M=QB&Wp3n_^;2&G~#vYC7l4#N43}-8q^$#G#HhV
z6z{^r9tx{%LopW>c<aI%PU}KN(1=PYBa<I-*_-c@;CkF<Djnsl9z2;~EG2p^>4I3%
zv696c-ryzbDo#AKXGL82n=q+&Z$}S?KVbjhrVuYR)XJ0d@o8G&h|--wG}9X!a*{H`
zku<;WDnT0opna*IlPgF(NEI>CG4Vc?7s3KaZCZ$XZwaCY@@o=B-r<okTcJVd({wqO
z{vy!F{|tifC!@C#Ho05PEiMM3<YMD2+?&o>``0grnj7W#2b7_a33mJKTYf-JTFy`J
zBEwavf5jr@I$TtVh)bVzC0Wfdn8g@lX&*#@0^JWuh@yCY;tZjm`;r1{QKp_%1SJS0
zA}SI?ONR)8z7HChg(e&ENxU-4WkefwEG{28VXN<bN5jKXrrfld_p=?(edE9;Z9k`0
zVFUgFN}LC0hg(zf5oTQ9?-y3raVJTX?IlUH?t#?D{?}IWy(DnRHU56bUO-=bQ;xd+
z8{;P$*e|_u3$VQwZ%0-G1IT~u66$W<T3^KtzKQeW`~6E!LnUla2-p3<;JY@QMtg_{
zoR<C@x5DKiBMx^M*;rwoQq;DFmsHWYUxnCrG}8Oqw;9oRU9m#>$(p$?HgFUBPW}$9
zw+J1RWN*<^(&9W|!~#V*h;ihw2rCBpb!d}*4v#!{Ct-S(e?GsMCLPCQyTHmsK|~on
zRHM|ru*j#L@Z{ZK{F~JO{{?lE{(GyRBLz0hhhu+6N**CLiQ(oX`8j`xd@629nz;1%
z`Tm{Bwslu!UPMt2pJ~_v4uO#dlrtET*v=&0GUFGlzo&DJk5<C(o+l4j&)<eV0avtK
z#v8ic&Y=09&>c<LCTo?0w7%n^ZWYL(=LxuetZ=Va1&OcRIc23$xR}KR5is~<epw?s
z;sYj?%=k{$<OIfl_L8Br*18*lUM+n}+W20!>2!cf3MMY~xh&9M+*uZX#%(Du*0Szp
zD%6Vln<D<lina9#X?}V$iro8_H%ttoxWkh7uyC-hjeutxV+(69nYVo-6%(t4hnJf;
z{+)m$d>1XsjtpTva><T5{Tro&|8~yhIqHq}l|($pJLv(J-dNp1+RhHkoq{tLxYe<M
z(f4wL@o!7v!n0DbMI^@9mGQny)g}(Ta{mEnYi0_bY<@3M?Ew1{h`ki(P;Sk@*gM14
zPC72f0pSP?nZoC_iIznvYhj-gT%2KEdWDATCxIf>kqCP!O23|CvkiNy58dtH>><Cc
z^U4B!-=9_o@9!ja_5V#$&!^gekJEdF6kp&!5@<q0gQSc_SmQ;A7xcwrRG*c4Bfll_
z_j|GaQL=3;qCFwyK-P7h1v0zQ`ReV@h6Ii7lxk)=S?(|h0`tJsY`ifPE}M8CGPj8l
z6XfSW2346ZtsJKxAZD@5ptZmqXAlP}f#@<d&bRoV=A^$Qdq90H9zn+_L?R(&lZ(Qu
zMEf70>H8>0(68Fs744gE86>Wei}~8yl)FkuQu#yuRsOq7IylZ|Y;zFb<szp-A6T-#
z8`Ne0){*GY$0QFSu(uGAbj+gwx6N)B6)>okPJ2o3<@5CUM?0!l&EtAg>FKZM;YApy
z9A$GDL=o|1zp;@q4}Rzp{>jY3PL;>VkIsgN^ojWjk&<8aHKxxz$A<8Q5bi_JmwmX;
z&XLIm#KUzw@+_m%n{De_`MrZY3m&D%&?$}iIg0f!wwr_RHQ448>=f&H8y35a(sZA!
zW<4g}DE4miCtIJM*1F;DrV+gIu>~2d#5#R6%lbrB6EOZhTOw=aZwC<6ne54E@qA!>
znSObB!Sz54>FOOGu&jV{hEb!w{H*o^n(e+q=UKuc_sxXO^%m`#vWHFu!!I(=g%=^r
z`w~b6!!{oe0}@#e&(=^)pd6BF|6#4$vDIY#QPBT?TtIacneIY1nrfVYtGqR&g+K3?
zpwA#d@`eysQTiu_TUsO**Ev){_)Ij-sG(+<4iy=^WJ8ua(q*)&*8Y3!EACK=%12=<
zxBK=yYU$3pV9?JRK34H_7Ng$^)k$^80c6@uhO}9)-YEK^{H2$c{v%}bcYL4MAlzQ(
zC%>sj@%61=P-v?iY|jEV1^w-{4U8WJ&|r1sNQ>9ppek%WWrR=bdpsj(@;U1~9Ywbs
zhH0NgDWy)5`ywjhb`_e{udE#>L*#PM@;DG%{RQ+aV+Jv&dG%=bxZV1n?EOCIY)^)6
z3bui+h+fr3m4`WjbLdc?BZx?pJb)_?6XE*C6nxkaVVup~_?Kk)Q}z0nWO-tKxq7+e
zX5S$E=#2t+*_dO1$4<QHK@o+)62>`D^Rve#b$1onOap#?-cot73x5td)t-D&pwUIk
z67B#$6;ap=UKEba>778f{7O}_2F!i&{J;t%Hg&B#f8XNI{+n9pE{y!0>1nM-F<)1I
zo)}-+x@Zy_H|!lrG8-_f(B#_;s$<Bs#_lX3P8*FeN{188C|dMYX$v5K!>6q~Mqw^N
z?^W~hl#9yo5|z!Pxw`G#B&$+={%NyzfnTe$S<^;=WdZnoo5JPhoVk6=uW?8g_Jim3
z3dNtU*(C4(H8XAPM0>;0{$TMHByrfI0*|s2pcvEcuh{PBd@%P`<46HoTeW{^O~g}o
z38jBFo9sZ946_gDiF5=zF-e^IEAF}5vm8A89n!7doxs^LvviQ1adm<ZJqZtstz?&@
zU&36j#s^2d>3hpDu8%lR=iqg;=C6>UE6tuqpgD$?Kiw=i@t8gvT|BD?Yv)Z(=sH#c
z%syLy7>{<id|W=96qok;W}zhnGI5Xoe$#oq49;b+)9=a=k{E@cd@}4b)9fYB`n`%>
zouNI&D$cL2`JZ0!vR&1)Ij$SN`%0FdAplx~WJqOBmYrd-x2gRtT>h{*dtGO#>WmYA
z|LJy#IX~pf9O9TuQ@qte9h9hhFcrxgBPyGL<zx5@@Y+>xK(+SzX0$sqNmD~>G)b?F
zq~ezwc^F%ld|d?X{(foSxnxglT8?N<#7EnzR;~v#Fky}tjDoM={VA5>c6C#+iH`m3
z<kjJ24RkF!6v7uv0qvd$YbQ6>**F*;PeSfWf@P~n{3;+DiNZvY+^fs?+Gi)d;)gH(
z5qD)2y3ruSURhRGSZ@k38twj_-n!VBK_<QD%2DqzjXLjGgP~Jb)V<rdciF{pkDVm<
zKn3Wa$N?llz%l=>>WCq<pbmm`(WEWm%Y1x*>h9jM{p7~FudDw{NO;1QH=#oh`30Wz
zDMsx`_A@|Icestu_xZM52;zF&?y=8ZtA{|pD&nKvkoc0DtP{F}ApBL8@&VoMF*w_X
zlOovq>}W-%WDg`XbyX(c<^%SJMqBToWuYM`+2<50S{vFyus2)5WigQ({%N*|yNWci
z`i3CMpA=Y1ob5Cb;4iK>17i@eQFZ;5U0s^vRaM0dNwk}uX3jNQnqx2G^5zeHLq1?g
zQ6Z$Pwyc*gko{z5x+_8ieoO4=xIwj5-_&jW{k1E4aw7BJvYWZZ<25Kp8uPb)I8g+D
z0UeVg)_%YKyz?D7F5;@<G(;_(H90GH-4$FT6N0$Y#d#ViKJjw9(vRJKym?*7`cOFb
z=(v-fG_?P*yGjy`C4iI5Ab%OP{-jW|UPr{;9)e}BHdt;e=)pcSg|6k<A5>+%FTixc
ze}3w?TCvw&Ix!D=5KPSdGbq|aYc^#RYQUwTZNXY^+GVSgvnKf6lP>)3z?{p3ux%9c
z;5*296A*D-NVtvAZY?(_f)dVoaLJ!bM;xXh=RBOv=B$LY)rEma$=&MgMs}KuMEv`j
zM&42lW1qdpG3KqA9(_G|rhVnNV&Gd=Kug?hbHh0gf8dr4I6j}s6nASe?D@!h;V*Of
zLIM@_m^dhN+-Q|1{v@CuVw8V=&`uql5X!)e{s0@8XTO(!Y%8?#W=W`*!Lfi)r$i3T
z0HT?!=QM(lxX{j8h273Lf_(bK4nZ{E@-P0l8$iIoSzpJYCo9m|d(oywoFRkgA>Vh;
zi4+*m*4`-Ev~Xf2UE0<3XoY)x2g#^Ba5okNbb3NNaKxZ214$e)+%1W`3y^F?_HdJD
zgAP3dHzV}nLrvzpb==*bH~kDHa4){n7<T-u$IRucfws1i>xENpE!WDWbJWjG>}!@W
z-M1-g3Y-msb6S!o<ZF?uC`Een)yUq~iY>6wSGvQ0SS6V~?}0xS7Mfmm9ZY)L&&hLg
z(ujf};7uFsP+RZK5@@(r$ZdEELT-<6@LdZK&WF1j_F#q#oMof*!zcOD$9)HKVFLB@
zI?N3qp3ghcMYgG_E3}!wL<?VmOZnlP=a>D%IhQ}F(j-&CKUe!RY3;y)9T$h>(u>W~
zb9AI`4_ExY`ow>Uf7{19*je7o;-_t=<A*!`j)ne(JG+}9XU}bv$53;1xSQfBT|gVh
zUf*YQCdlHp>&%(U!BLpcbHizmtkxOwby<>X|7z~mjezP-Q~YZ7!qs8Nb$e^}-TnV6
ze@9R%#JwZf-LGJ%d~*nVf&ihYUpkpre|=~E>Gq3*xqZX=9sE7G?Oi=L=>`PmPA|r`
zM4A10y%YDUjKsRrGCc36`r=&?szV*nd<k-QgX_!7o}$*Oho-t<Yv<B)>77J<rn<~-
z{5h#o!CiRm4dUMnank>$FqyRo4cik{nm&t)8O25`Osti2&aAz{^y@-D+*opqkbG)y
zm7l*sq^I}mUdSP&&CI+yN<E_w<<q-Y<#CEs)PJb`z1x^uY*H4jLq7kG%vU4EZUCTe
zceDOGL(4Hp$G-kMAJfR|H5?y{wyWf0t`7|FSNA-lkBU<W{y@CV1wAM;pG6047cy%R
z5X6;HpLj%#I-l=ikTF_NlbgGn+h_3<L#?hF6Zc?pyYlC(nbZJktB5Wi^(ZW6S>!|d
z1u~<#a$tRl(L4uO4SicfNG|6seQTum;|lHP^j`X8qsVqHC)r;3=6wuHi-+sPmKKhz
z!wdtN9tQxZZS3l6z`uD7Xbt(lrlpC&C?ajS-?-vxF5AzsS7O@o-=%T=@09k4*G^&-
zoV;i^ArYgwie^sIazBAOEJZWJ`lv!aK-$U?W>c|cv~Dnb%O+Z}B%QtAG&;e$+G<E$
z9llQ~*Q(yZZE0B(@V+#owivvtTikn7_J_TLT#pEI{de@4ly)`x#4`j!(z{07(&lE1
zbDXmH@^#u%C8`NwtB}fdKFYO{6U@Kj`Qlv(f8G?NEo58eMoSOOzC}8{Pgq0mL_0)S
z^ys*B3^i!yzxFskSzntta=+QQzu4M469fq9JiVO$NfAP|N|-`j&DibA*YQKoDnzNf
zn1ZBwy8#}Ip5nuEcGcjk3;WJDJUk{PL612G_~<tI!^tE&e0W0d;o>#vroR?H`D&J_
z@0T5~-<>ZkvDv3X>Fg`QnNS~D7@ehVyQ7x|b<Te*R{MSW>pT?hd}HLERb8e>1={EA
zceD@+d~tR_)RPw*Q|!Y7aEnNG>6_>CI+%p{#*z1;5GDnU@9i$cA+Oc6vj=HaBmaeR
zK(zOchA3_K*VSCQyIjJ7t<VX;HbGN!qWn(vuHB<$7*Yz=B}%C48W=$d+c0F5bk>(V
zR<==}51R7wky>G5fO#0uTfFjz_d)d*W&%2t{$}<y2*g%#WiZdp2C52~o^3q_yoH8)
z0wcA;!(k!8K_T`ftsV5t(V(|hrsnx>j8m?AO~HKRkIx<=-hxW<B)oMl424gTO(m@!
zQbeFXY2~0`uetwrIX`J_s)vp#48*emg`6R<^1aLG)Z0AoWZtjw6EQ^qUrl$iFzws>
zwU*77ujiw_z>t)|*$3w8H6-hKZk~-qZz;Ds%7GuqPAfl&XU&MUyTp1cW%a6S4)@qs
zGL4tn&YpqOMl5sfPZEgpeLyjD8=+0Ez&%iB)gB1=zgCEs<X-vL$9wU<Ud_FpU}EEO
z1LTvt+^w|{G6O#K+m%ma^0fhO&z5ve1W&8MukT!V_cYs{9hV7=2{QpJULm89)2mG5
zff0nZXGk~S8Mc;wIf}J+K&PHXy97u_w$*?|0f=eu`@D`|&%Gq!?m0<@`*$3lz|l^R
zFvoxLY&$4{u$1El-wxEhM8di2ntNvL`ldVKv%_?8d7KW6G6fh2V>zkld~*8rdqjf-
zrI~y0s_TBF#nz$&dzU0So5WIaXJaus^hM3kirh^TuvVj&NzvBjx5upip1G-UFKPVH
z-8st`oZ)K^wcx5y3%(W$^wW6~ZhksZ<Zi1Q!;LsXnBEC8e`Fx!6<)<l0)AhWB{Sf-
zxXti%enAb;J$i~5^9pD<DToKmt!cT@<wxJ&94+;`&kv*@%~5x5)Lt}>9vPomKt|4d
z!7WgL!QiQWrRVdqH1YE1#BYDyA+D^M;62HQIw0^4nCk&J+Is@#h3Ra8>(5t(LEgIV
zb`5uCuB>~ymW6xZn0L3c$&ki&w>DR^_jG8VZ?ARKdPd;MmNu<jIvf>WKG3u$@h_4j
zTeqp)Ots*qKs=$&msxmgF-!er|3CC4Or9(3VRoeKMa@=>bY<*Ve0M3+z5ER7I|8J5
zNijUle)C=;g|-1*IKY0re{!+b!*=(dZD3?>ycQKPNF?DjK-#gSLf9R6*egi7a8Ols
z(>r^&$Ahyce7o)u@(a<{D@?Sy`N(hNoS@vmn|ozMSP)=yQcmuvdr}MW`_E<his_p5
zU(gBZ!myQ0UqjVWPH=o`%?-5Gs`g9o@Y=Qd+nnxs0*S4Nzb$h`%-q(TN5>*bO&EDc
z$C-D3=ZMqAc=L>#%A<cR-|3w4GxMjW1jP^5$bOBlkG*Y+51MYZ>Af^Y?JLV5ygqNq
zedcxaJ9OKa-Dv(GFF}w0dF#tomE$qGJM;l;`&_vj=vZe3`%gGows#$f=W2%ybn|X>
zkf|X0yFzyEM80ohNFRM(yXcH0#o9Bj8`mkssW87P=X%aPu^Cv+X_8o8f$^P0!Q14y
zxM~)2sZcye=exB~7S_6~a+mz_OQ*fR;19fH{$C+N>+;8%Cey>#V4*4+ZIWNpX~!RM
zd4P4eEQ6>3Q`R|!Y{Y5)kG%TxYuc(`$-A*EoK+^Cs$`DGo9udzzQS(|-JcLfoiGaM
zkh-GpGd`Wi{Jw>7YZLueyx4W(QhfE;LfL@)&hulmz&PSdPhb1epL=&;-JC(e#~<4L
z2@`|nR>!A#gZiSe|9@NnTU^Y!hsY2G!HLC4r_WRQdskeyXMKwMbdoh}N3Vr8=@mfR
z(k}pTV98P*PUWj5bFpsoiu-T9qh<i%(@Y1jwk<ZfZAB4dhh7+$QNmmdTaTXOf|$jV
zv81y%y=dhE_$Mx|{j+`~Cf;Y`o_m`ybb*lm7B=bhuDVtM?r17K^8uvvAe7Jr-z+>V
z>3=Qb_M$mEf}On+6GpIFmd;)LoFeu3LaU_iQ;&|kg<7{f|B~9<0(|ySbq9FdHLp9|
z+<cuVSD3mwH2<%Y<0Tv`F4Uu9`E-IoAX8oM*hl=?rmnsTV=m-T@Jna&m)G-zchuP_
z+wPFtxfF??zzwFudr<c{PaU6&`8;99vsHh?bfjeyydUce>eN$%*NfX`E?O!Moy{GC
zE_3aYi&ir(uIW?jdHlgbjLAbfM&;ifG2#D{aq%aMdgl+V`M4kR2+^wMiCqJ((mizT
z`8VNRnj2;K?}r~iw#`bD-+i(=7`Qx7MkbM(D(N>Z^kWzz`y>rriK_~|coy{N8x&?w
zLg#7^)0bo=3a^f=CwIZ|&ojpMx=J2*n`ogU9qStQ=0P(OD?gO&|ITdI`CGfkO!N|r
zxPwRtCp>5Rn^}9~8|<A4d)bI2khq4yD{zH&GU%`mZtV2->nqU0RC9`5%jlW274V9I
zmXP<t{u@5I9@a!IZC>)_L*c3H^IZ8_qDoq|Of&%(K(XVkSUaIPkv+q{u)eU(R-=Lt
zbE9&)N&>ylhGW5}zr_;VPz%oRCnQ^VM~Tz5H@gNqif$@!egoU^d6wx_UW}q--VbBR
z^QDn3qNWLblFWq*k9~|%pT1>(OW~!*s@VJ=3BjMSs#jhe$l*7c{9rjsUub~gt8dCz
zI<a;8w(R;UtS%>|=)PF(OzmD{*2aj+t{yY5P<BhHm#KOWG$0DC{_BC7yAo)ilE33m
zy4QmRj$5Mazr{SXzm)PEFomph-A0%{w0`+Cx5|7Q6MO5h!Rfk9cpnK?@UcCIKfPb?
z_HLr+%chhZvSoCuOPU9jc>zDCD006HTG|fu2tU<#-N6og);#&L<L2^+Q}Qn5GJg-G
zAwR(YE`t93e|jT*C3F=fcwLyj?$n?|G`5$Ye~5#n+GjnRiXPM9Y}?vp3(Zc3c8+zn
zR=p!85SUbf4@1IP_t21p>;A2aYpW;4@z;u`gxi%CMeAL{lG?RC?hp7>x<lqFmZg)=
zoDvsfD_))jdm!1X)u)-OLx;^mgqJfY<ov7O?3YYGPvHh3xBHznR=Uqc_QDT{d|)wb
zTeLv%UVl4#p{|0Pn8BSbVzjF#%DwGK1d!<J`7W!IPXW~vFaimHv=oZg;(FW7U^D@;
zuO~-9oTSZPeK$J?Kkapv{;fz(DSzqsPtGMrsH{#{#B`&doAx5hw?>5uhk0QPvfF(-
zlU;DYxiE9z+W85$HZc94p8J?t2qZ6i#k!tElFnUyT}4^>uTy*ZyPt~OH)p+oNl4|L
z8bPy}rnb>$fW>XisSjFh%(u%~H=fLF5H=fiJ%#s;o>1sRbn1Q+1QqhQzvPkPduBD)
zKJ+)$B<mhQ1z!}kKda{6o6k8UN|U>IC!Zm1;3`*kpb`L8VR9Pg&=!NkFSlT0boeA!
zqP5a(#fLUO%M!oFblFgnEO~L(j&>y1l{i#tpS=bl))6{<TQfW_<#`G`C0ZZM<ZD{x
zkJFS3tqa%kEZYD_bf_NP*iJA&1LVU0$3k?U<`oq^=Yp5=vFCi9G};-H_0<gY)3<b*
zi8n-~b`ZW3j~NX6;d(f`cIs7BTMQI2e*jSdtm(PFeX#3)ZI2VU8{Bbl*7p8BV&a~b
zbMQ>t@CMdADBE6aw>f_9RU2cihyPArAEdVT40h6otA^wHqVKp8t<$13OT8@&%K1d>
z{@3k3iII)=04AA;<pVl|CKQ4&J^hmE@MM3`zQu?nDqa=^e-^vlNGAy8?g;hdc_gkn
zy+j^q-^`lm($n-H`=RbG*=TOWwCSeuE~T3p^#OCSYo~o>9ft(=q`S%TMHC{cp0<*#
zkz8A|1@5f2*)Ob7KXAXP%7KO%>rlP>Q`Id@IdFwFN0CmE^~rPN-I<1_?vv<yl*URI
z*LLCUxlxfq>Q&~iZ3!xMK%)De4W6z`p2t&4VNK0%U_N93B5{Zazx*e482-Ds=iCJ!
zhAU=r_WIy8o9(lY*Pp&K7hYBU4){GV;BmJwM<EDU&4Q``v_$4Fo%j+v<Jfo*1B}4|
zGr)H+&+5JB+H{$cC5)aXhbZ?kH=lc`+Ekw-*>ag2ZO=KbCWCW-G1zuscLMnE5(oBB
zd71DYrI%MZz%epKoj@l(h{~j;A0QueMehrZ7N2*rp&o1^5$eHcdI8z!`(dbl*iR5H
zq8O4VvD}CA{^!jAmCTCn34#~dwzIvC&2C1Y4hQ7+TPn!w)wS^p*OT+6s4zE_uqIK4
zkH3T?uWu%fkS-wVz=q$#uAIk3M3A17YOw!Qmb%Nsfln{QOMar9{^E~AON9#iOJMKO
zo;m_+UhlDZt97fucndqVdN-B93R1$^Y@?2BTLj4qD3$x?tt+k$B1qx{J)Keo8@JgV
zMWr!dOCIO0=;YIYoANc2PArM(kQ$uBU8w6*hl;<RrZWy9?xRbfY8K6E5B}j})3H4A
zv30hmu6J1x6cY&k2e1KQ?185sk>i^u63QbvB!mn^auJ?QhoK8)&^e6WliDL}fI>^q
zQ|7`IXu(^X_#zkvsp2?%v=iW7iRb&o2YVMxgj)dPw$#mhqv&}bffj~oz??)$@TfQx
zRs|4q_$tER_y+JpY7coL<p|K84%bUq=oy!#K6@43=Q{!ws|=`E0jX;YiZ*W+;3%Kh
zjx%-2x#ZN=ECt!a^GnvgzfIfbe<K;dLUZWHi;^WPMfpyga*YhnkdzrCUTmur#y(V$
zMXK|Mxa4b!XoOuScq567lq7Gxo5tBPRqvB$f$190EASZm-DyghD#*JMqF#A;csejx
zX?Bs~%av5txtBBI7N$VRmzo)844v3D#`XE8Axb7?Fn&1kBenMtN0}Ad3_a8IkV%W!
z{J_uwHkRS2nuUPKfuwcus^yEqRFQ+Y9oP6517WR&7AELU0oU^6ouf2kqTISO!XWMV
z3x=n|j(cov96lm$(o`hwH=`lJN)nW;+=VrIbi3~#@K+NXN*Y_rm(#{2h57(*G4qt;
zE5(bVhFQfLL(J71Hq$6P&)MV4ELFQ_@GMnT)bSg{8p=9LlBt(vbbG%h|8kOEpYtZ9
zF|N}JcYLKlz2w5}qlz<qpS0qv4)l)@4cUUf9|7pqaF(2dN9V{wVyRN}u})ej(kYoS
z5@eJ+i$3U>G&DPyZg%QUOIe8&q!@79Xn>?r-fHghW1T2Ai+UVk!H!`B0W<g8<#%C#
z?S2_Sm8jtgU(s$)e8nc^{NsB8`rJOozW`QbcQ*{pY)(8jVk+8#iyAXNseF0qCxR*H
zgcww6FHMUxIMr{qim0ERU+Fp>_UDN2Bze6nyS*gWJ7S@?6iV2rO<|*;iKFb>4ZM46
zqNZg_8qt||Tbm{`HAoGZ*Bs)~C(VZZ&@*0Fcl~$HX#nLB`#Vjgv<pdoEGw*~r3@Iu
zGE^ll1sJ2xX^1Rp-({<8E-CxAY}`D<l;$ZEkW1V>RCJ7@MzdyGxoJIA4!%Chlb&qz
z;}<JWw+6buy}*Gymdm^Qx`c!Ie1h~=W&rEMzc-p;$fYAG881heoL6jrPIqycw`1I$
zY*Ap<ZpVEUEw9Nuv~jiVQ=8sUboSRB8FAv|C6a6W)>Q^RdiyG_Fx*03+LmZ*<$!Ei
z**C$>xwowYOHO`}A}dih|F^jL;<vL8^WO-}h}~znSnpNscQ(||y8az2<bshjYF!xl
zB21n{@afx*rC}b%nD?(QCRgkSCw;=g27(2~s3uChP0B0TG-pMoecsVUE6)^a)}SB}
zmvP^xBP-*Gz7C{MWgapmKV-R%R_e8Dm5ksMp`_o<3>z8)ajL6ud@~81`A4>~6Zb{w
ztj<6^=;>2{^)l$Ch0;ni=DJGX?dm#sUw4eZxQMRbaO0deYv)rh0S_BF^AYH+lzAB=
zEps~*i!a%lTKUpL-e@-OSn^YHV<pY1ep%>R+=x0}FlqkQD3uWfXpAk1WZE*31kbol
zRW%~eTRIj=dwVYAV*dg>s;Qek4JSFv0{zRO;`+GV>crxw9n#KAp_z<J6QTT`QGscJ
zik1~Rjq0=J5{rnPz>t|g7HY_(A$~S1J5wvb8U5L0b2;+y4Wy!8>?&b@caBY~mI=tn
zVNIhvimz_VhBrtbn|)ZFpHe6oIn(=HIP<fSAYB#KQ`sCckpAwLp_#~ur)uIhEuK!?
zr)@CaAsA;@!67%rTmJ-k?z!zlQ>_6e>d<t(wB2najwa_)uw@@5Jy++k@6Ex6OPmgx
z(lcf2fctOGIwOm$$kaJ*+ym_!&SQ~fCDiF;CU@E4)7T4!1Y{svo8fA_gEi1!7J5r+
z$~mLS$pKuT4yXV?G16DW7k_JH7`d8-6ic~an)e}4kdZGY^uyRhC!-xNI|@_U=$HDM
zH35K@jAiad%MUsGT<^>?myA+P&h2XaMD+%j4&KR~U+3kG?}2>u_5*Ow$W?ENqtmNL
zw_WE7m_+8<A;sH)qqV5>;Y}ylzW6IR8V)mKs)9?N>7riAy>_cbi677(xOuF5B~u=)
zW(Gee2<A?@hw1OXa|J5}(^wmNb9{Qdca>(RItd3K?!G;W&#8Vn*jpr!j$V5TT*ZT`
zOOQ;GCm35BpO2`C%)4B7?k%f9dq0lc-Ss(_drjFzSL9?qZ&-)yT&!#{Hdl*ghhTW}
z<s50fy*{yDT<`{n(V9AK*O=;HgomBHzkAs_c%O4w@;1VNV45qJ^g+bno`&q{X1HuC
zwvPj`k?{)qR3Viwh~#sn;nclq$qCxiA(s!FdJx)x^<bfMi7~2oWF$}0A+^h#QTEen
zz63T&ZB(rIn81Uofwpq4LU7C;nOW=Hm!gD~L?3g{6Q!oKTvpo}&fB|CD*Rl%DKmii
zGiows#bN$7eN^tyyBc)nH^!MERa_rbmbetIxb|cg;n&p(E$=}bwvJWWWB+vKb^6FS
zs>AH>ViY&e8SA0_pvgfqUmLka<BCQ^FeH!qPJ+Fdpl@lEOuwQFBj({Tb;xOPmG|9Z
z2&6NARc0vfYi;thCDkE$+t2m)_2vs1Pju0RL9Pwvc$!QLV49N_PDk)))a_<^vW1E<
zu1LyP5jjljyDjy5(D3s!G7}1MG=KF$D>!wJ$vUCF5_vAsf?HS|f5Q8JT)-Q%k|;XS
z`0st6?VTfhttVpl16a?R!qu$lf{U7&y`3@1N<e*=ct#&4z++<7K_3vDDUz>)>J|8%
zSOv*>3u|W@IoTx}#TzT<l+Vi*^`GcX+A8(Bf^vK8(fjcZv^>rqk<*9zn5DbT=%3G%
z!&P@lC;PQ8KZ;N@Pv9vY3VoI3E|=TX<Y8wcLSsQvT|#IyVpK^<jERyhr;r74aq5OQ
zcA27fUAeUc&Q{q*GTejGV1cdWdR@+cPAFRbpqpgda@)9-6}H{>TwWiU3Ne(G)fhD~
zv^8hvs4$i58`u6YlcbLE#tQA+WN5eJ#o%;Yt8o0fL1AIq?34uq{W=`P;_(m`9u-+R
zbZZxQ9rn7mz%EJP<FoU+x~%TgVfFRgg$2+bMJ!}X&FpwOLQj^`!H76Lt-oZ!0JUr)
zMWrj5+}TWfB{{CPm)wHgpdu()|Ls=V;?38pK5u)XZ?&#WOUV-5*H2#yW2bRXF^`Cr
zZd)Qd!<(i3;+sr0g1mY#F|NZ)<;<1l;PbIHcJ(TkNM0Jm1|`a&F@i;rmx2#mia*)_
z=zTseF}IuL=jvzX7ON0Cz#L~BagX=DgbJ(%^Fisp=JINlygbp7AQ*?Rw5Iw^VFSDY
zmA(9eV>n|z(n6r()X`q?o`Tk9fm?X)y;3i2Z8Sl6lIvAO<fD{cLyh~0$)>vNq0{h#
zfbi+eouAXy2tUnF8oGMSeC!W;UwQ!N<r>*{+v;|z`*zyICm!~8{PlXC7S!vw<qm?e
z^cL8H37Ev1!WE%Q*W3LrbI=mE#+_cXnKZ?wuL!6iGh3pzH7P4Mouw71A>r9Sc&yvS
zW9hf1H~Xztk7p{2I#}Vxa4G|-h!+a3vn`(}bs9Lg!(FfT(Df}+sZa1lSt>gEx}ZP7
z{OC`}1T`hxA|qXItbqA~(ZWtS-%`g{$(jw(c){TuAf4$HRa_&DG`fP393E9^t*rM=
z&eA%ght*aj+sqR65|(+=pn!X9!cS5DclG|^jAx|j<-mH8gX?;k%eE1gjqxQW@|biG
z0`Ok73*eCj{%5*eyAD55hzofu8dEIaUaHEyx#tv7pu6Jqqbl8WNoQIz#oKok(lvT_
z<K{)fuF@Q)iqxRelv`ztykA7MD8Nd3oqrmS#akIgI+fLP&YtR`<oO(KPLbjfXq~${
zV(V1UNsw|;j=>PACzmdbs$8|HZl|$tw;WDeb)f_*OS;(9o{^V3uHyu*WJ&MP(lPV&
z1Y0WkN6(d*Vmkt>xV)yfEQ)K}7Maa!qs-Ty5;0a0&C>`K<r>k&`$c*))0I7Ft7;>d
zw^HS!Hq`G`$K{^>nuR6OArFTe%e?qjf)d!0$t)d|GX~AAh-O;lIj<k4<g)5PABVA0
z$ZhDtlKSqczkF14kt<L97!*&Hrd(Idji#ig(PX_sp1d&@RuhSDMGZ98=;62go<bY3
zcTtY@L|=O0{e)bFL>z6YOm)C&FSqw-n9@d{t!H7g-=LEvPsRBYv*C>3SYexaa{-6S
zDik)al?yem$j!b;0`@|avX(<q);y+Gd{|$qST4W9-MQG~^zg1*uH_j90W;2GVeM_G
z#j<>}Ik)7JfupQhgAsKTLI;=GR=<b_wvT2v;LF%Wx$BO)og7qP2~Q><_;3!mZLPxS
z72`rxy+UL*<GItN*Fvss;SJBsZ!~Y{ddH|3cNISYOzVET*?oRGxop+=;vZY;P49Tj
zh5tGDmyc9YzS^{=nXqP$p{0eq^AP)OvW)R=T0{C$qp7q}GJgS&__<}5(h^Q7)e=qv
zCHAT0+9ESj2*o|N59qQ(66iky_3w+JDc#k|yFhr)IN|MrmAI@!_PRn>qph1|@lq{$
z=7UGH9JL)Y{SR`s2HK5gpgymW&5-2YW!4X2ODO|&wwe)%PVFErfp~0{DFGLKPe?K`
zTY81A&D$X-;W}Y#I~^jiEYMEwZn$1$#65`rf}xoO8p1>c1A~PwtY1(~EeFc&=^h5n
zX>*!cXM2ziQ)`)0A1#A)6*tuC$ChyGBL^^K$@QPZ1|I<K9QMA5Wf~%uNuzo9N{cv1
zM`64*pAU)xjT(%Yflh5%^fqp;a8L)I<hrYFrw<j^w-g-U+=(|UTI~K*7kuh<ig$DE
zFXPP&>V{$Q>eMJ+$zj*-ISuunsrtiq$p$wWlk@vGe|R`}(K(NBp)pTzrQEE{9(;4t
z)F%u$OFQ2?GoZg$RZzJTm%WEB@RWhN@nEz8Z$x!1ZTG1*;SU4W<qM&O)MOcRhQjlL
zvREl)dqf7A*qG(TM;5n;dFY{PvIkly;l1<bR_I5U1cjsd{q6nIyEk(yI4y)E*<IH^
zW$4KKsI{O*w#>#8_utnG;&rJ;WlnuJl8Cy>c3)|wb--rj=VlH=%CGm4Vq`0xIlE>+
z;qN0FU#1oF-J=vt<+ZY&qNY?Vp*$~3z+8G5vY3s;7B;Iq83UCsj$@t@3LNC-T3HYs
z0hR=Jq|#3SyQge3UL!oe>NT|cpeGNjKXm%Q%|YW6!JoNmnHij>Chn6Qu1Z_g$5Mvs
zMN0b_8a}j!&k|OA7oFS$hM>2OY2h+B3^M4ndl}d7HCpmxc5cL-fs-^~|Lxlf5mto7
z;-{f^%$)Ae)$ZxB#Z+9h4L8b$;~B2Ra=VLp^ZAIL&mxbKZz*ooWwYn(xaQv6t6ntb
z%RL>g{^w-Om5L+gQ;#@S6XYp)A|8YCwW`%7JQpiRQF$}U$&3~dOd6@APCS-uz$FQ3
z=Du7^M-v2z_|h>7lBMqflmby6$+DYUJ0lho#i*#y18qieD-L$CF$2#9#|qKx^dcb7
zfRY;begLx1O(!%IMIeqYpDtt?^uHF4KR)q`sKP&VK=jzXf@MAU$;P#rOIAJGIxnkJ
z5q9AnX_|LQQ2GwqJJ@TOfbA>4{L@a*P?1K9&D&W=lMSCSenHWf?IhsE_}Se_lcf)^
z6aM1ov2?6pV$0=Jz(EdxESD_#>7hcy2mXt4SX`(mMODvz?~pKd-D*iR4jDyp9iKzN
z^+~Ifmiwx!gM5NHJd^gD>AgkxpwS(tQcZLte^<s(_iX7R7qwQjfqb-Qrd6LQLJ@3m
zFfE74=Et9#38dU89Uzr@tQUi^3aq-CL>jG&a>dzv2_cR7aJ{6D(v3GS`Tyb~3J=oX
zamO-CpS{?>;DenFyO(4|lgduz*FVsKaF|WhNA<GUx)*5eS{kWvKF6DEg`ttC>|*m5
z_(~tS)oVMCr4@VW8jaQM+gL(#fQo3f$*J#w!@mGFd+KmZ(CD6ULqf5T!T*??KV3Oq
zR&`_m3C$_&td|SMlBKxqDVp{r-$B<XX1Ar1Qzylt-wl92a{Ic$xN>8$yKw8E@L4J~
zhZ=`U`TKkJ{;b5WqR9{~gh>}$o5+Rpa(}%JF(^(E3E7eu{REh(wsiefNh-HdJzOOJ
zwY}(Mt0L6~pO_PVSE{bJ+Eh(F`6-KFDY+_AQyY=qrSqk=Z5wB+a_ueutE#?e<0Aur
z$$q&H(0i3FOS9(0h}rR&L=}Y_xTnF`s9TH9*fi-|V&q^1H33n29SHv@i_4h_Hju1C
zARdA7c2C1`r+kvG$03t0Yf4E+ICw|cCNumay%}XUZF*SWaSDrbhcg4!U<00U1&Hm&
zfqMa5#53ou!37=Dpj3J~+tz$|L(CKsykc0Fyp!0ZXY}5{72t&#pEg4R!Ax0b&~a4y
zF8rMia%NTY#Sd!3Z$A9PP9w^~BPz^8xib{Uc<SC6rnmFFVsCt{V?HiW(NnMFf1P}%
zd%bsP`Kd$*jp4KZ`oe}bLx&H1r}TQTWk}97c~RNyIVTcu*@10dNPYxi%u;Wf%l`;#
zNxa@rBw`-ZeC(FGt}|&##fT6!qCuHT)r<OIII}*GO>2xV#;)GkMaY<X_a3wypcmxz
zAFXmKn$$<HPqMo&Oy1}QidoOEO4DD?iC*OR@^q7?*Jk0*hPsqq>qKQuGQ<=Sq}!Ey
z7&b4k%F3IU8tW;csQcX+%v#c-VJI-;U*K`N$&Rep1>(fjpX5yCQ?f+oHVwd!;YpZ*
zcv@752%bvHYClaBoQyUkJ?tV7mYgjX`2QgX#sTZCP;vkTeG<Q0qo<szpFm`=|3@w~
zcs6bi*ZkTq=}3Bjc$rr$ukd(;FQ;9q6*q-LaI;7?WR%`uWWuSFLG?`zS9ymsa##~y
zV=*RPwGCorEFwzS#AVA_as{KyjTip=W(ZMHPP3l+tXAb6P^J#&iGH`U^PfI3SVgkE
z8HczB6uwtYG!uDl^tj_B9&^IMJ^2YR<scHCr)IL``DmTQMY!knNhgYE{;o1CRWarB
zplqq&j#6yVRH{uzQ@&?jeeTd(f#=GjgIJx<waMtfZoq2TzY{QxG~9lZBeK5E5=@e7
z?tc|8kt9oGY?}bY4l9%`-}ft}s+YShxAZgu>6lWkaK7QrQlmRE>a?fvtSN01i!&|H
zL%2BgQLaok7rneRU8kGy5qh#X9ssN+=yg#+aSY~YLzb1Tx;^GtSyJ5+vz%<N(V0jl
zE<C4(jQ#YqQ)K$^PkS}ToA;+vrh!r9t+5C5=OtN-<Q>1UJk2c7m-ON2B%BP>yfW+5
z*}8w8TWNDdOkd6xW>$YqC@|N!)=7}~#I?AhU_Da0x~l)}#cV1~c#sLP7x3|3b;;BB
zAM;>yY^xqqu8=~s#dYF#Cofw?!7=?!ij~`A3{=?xYxwBBGG!>9lxOIW0tgF?_a9EG
zRY$qGYdqP4S9TKjh`swNPOKohdojDb74YR^m}#pECKVkShr#949iA~Sop6s0<h!6Z
zQ5Z>ZZKSC!hBY7DUHEf$kyE@)IZ_Y%$zpb+-v{oGS<c)i00CNANmHXRNFqHn1>-pL
z(!iRBIn*Y3Pf}dQwIkxFd}AY_Mzbq(t`s)pmbtaq-K^X!!|E@4WbwBsSgEUOne5z;
z!lO4wdaY>_#G%aw&@!-(&0L1FOt!opH)B@bwv9h`zgVSHZ=E1?oDf_Q#V@>m|AY+m
z5dQBMAYKiPrj#Eap$|v^ZSqTSZUo@j^WpJ3V&bQ68}^yR6LV)82iha0itW?OR-rZh
zDN&_#y9jylbjj#lGjCfL)!DbvnZKB;TFM@y?pVu$sLxJR+@lVsj8gA$@}Jm!eZhV<
z5=kqzddX84<+X5s(JUyZ$KIau<B<(OsAaL2LBcCcX^GxMD~XglrPIdZ^-p)fWQWX$
zf_O$L$3?AL#2O|uP5-FjXeY^&yrPjpZe{+9CIIDp_AOuHM+9shKI@PWjI{}T8>>CI
zeHU~e)$?-6#=DKbahi5Uu1I|FJBI?euGo8!1y|1Gi_QPI0Lm$<l-3mK6zy_N9$X8>
zH3c^#2z0WJmC`Bd#5!+;%iOejk1~mZrH#w9)PkL(7W3LQ7BAk{=oYk5CgHVN0-v2<
zfZ?`(VdrUA#z!iHvmX{DRvcO$!+w#1<R;;1*WOo2{tqBuC)5ELIaa?Yz~WD9oSi!6
z(9vJqbS36_S~}3=6>*t5LXcs-76zS;e@Q$}4KK|NQ9bYNLR=(Qk0qcVW+%#Bu75E`
z*Em<<ni#64!=6_R%}h=_OykW3ttAgbMllR*gl5+P?S%)4w@-{7M}V(~Tp&$Eu4inf
z*+z}u1nD!qr<JcNO9nQ@xRNWJT^?tAl+$|m&X+R5JHMB17dRS*`zaPzDFAZmNrQv5
z-P`9#iw7V|zoB&R0R!dSZyw2{wy;i|>{<MrNaqZes6aNP(}RClBSRHF1GYq>&`rDj
zKu$L^^|MFfZ&3vHJ-u-CY#i9bw@f{DrGdcwin5$k9Iuj`DponoE!|clx=Y47K|I4Y
z0&+UgSI+XpQ&cH;mD1gU(nRlGP@l?h=%k6A6@B_nI#NOA9n(S8Awj~BL6dKhY^%kV
zdWX}~q4&dIWPB$U0U|5cFVuPXT*=ictdnSx$l|O#Z1yTc>L>Y!wJzkcyj@#QcBSNw
zm$<U16C|()rhvIge9yR%YkK<(a#R2j{pnqkH(Pr9K$iWebD2oSllr1GA(tsDRjD}L
z)nuSrY)!o-j#iJ_;Y0i_EaLR;_+okhyE7~HA;6BugWxrgt@NUN=@DBSkB`Wetc{bu
zx9GYdek8{xO0($e<6F54%N9*8g84ui`h;M(m&-f??9!UXa*NK9Wd^1JBazr!&AVyn
zCqDMG_NWNn$W7FRy_k!_JjT9t6&{rm@oz6DjG)VBNd-MJW``fqq@j8{EZYhtoc_{5
z-DX$Hmq_Ox+P%#g-rwi3)_Se;-`jm|+_u!Aq@FRDk}s8ZQp>WY)p6BxcQNo;*)L5u
zX_lxtQC_+bODdC%(A*3=Y{D2mDzoh7(M$CGyz2q~m_WogtV2NiWYLzpuHFy|hQ2fO
zYImRRL>=tH9{4lUPG+~r#nl;q=N#*wT~M>LeK1zuw6l~R(G_J%k;tMQx9aT0*;X>U
zkYRAg(xPgk>~*Ve;D~Q1o+vva9Obn5c!cyGC|u;*YENge5TsY=+yy}6X8O$7)`|HK
zln}?dr&e|EIZsmIr5O1<A6?neq6%n6ZIgD?dmi@9w5v<2JIXpcVUa2RTCuAAysDaS
ze<7WIqYEk~tBBNiQOo{Zi@@|K+=-T7IH_v{m}mDwA;6KunD!qNXY(!EIX5+dK4N$T
z#n2zThylfm(KESy?sSVfR}*;ARnyy4D0;mNHyFRft<RO_Q(DVfi&ru}`67yc&`V)~
z6}VvuZ5r>f+X0cw;MYxwI_nTwZpm5}3?y<%PWMdizug!OT+EOH3-~XFJQskTYV<+9
z*Zofvr3>4)(buvSbajx2mW&99smBv#A2GfU$YD$U>^ERN4H{4IIrFuBOwqzOSfKnK
zZkRb^J$)nFM9t};QhRR@*WHp4Zpy5aHmeGXz~C)={8qDbD?F6(E7g2h9^-Z6M~qH|
zj?nA*ipt4UNwp+ftjU1Z)mJ}7O;Nbnn2N_iU#!c`4{c?fT9*mh7A#7^rRiDeYo6w+
zhh%|#cM3jtjQ6T~78)1jP$KmYg|PgJ;tfFR@IbjW<4tt$!LKt95~pAS50%|W!nQb{
z^p?|x?)SLh0LM+oQaWSAW(l&<?$Xp>2OFAxZnRTE;+=|3X*yH{Wrh0&cJ+yMFtubg
z<~IeA>WYy#@}3_*e&#0lAd^}6k>a<e%$M*#5!D1>y%zccJY=C^Z7CO{R9$Rd9zUPr
zs21|{CCifsnVQm^t{PxvD=T6_!i78<yzTiUDc($k+xX8q4i6jJtYSMw1XOSG2~eYy
zDC=pB0|G}?6`W^V7!NpB7AwC?$-0Bh*nCu@EkpHI=Ked%0&<f-L~Vvr$}UcY`GkR*
zJV*B>BAEk8GfI$kVr_{MKu;l4&|ru4O^BQ_soifRNY#2go?MotHO6G?C?f-LB7T^a
zT<a<<7AWFu+$epY)bvBIukx%HuulHxCWfKTihLk)!0D>+CIiwYCF@Yn@iMTEs^dw#
z!wI@McDVbetEXUG`eO0~K?LV<dBoeQ+)|q|CZW#yV%H&dOIl}(bY=%G8iYI=F_*Da
zI)M4f;aOWfO<^w&AEV2+gx=0gb?L5q5cry*`Q0B^fX6jnHN#u7)C*##l69iJY_=KD
zLho+n{BV3T2baVaWktQUq^QG=S8-)Fn!$YXx?K*5lajfOcCv|Qg0px<j0AoU(Iu4a
zS%OuPXyoa;!5nhZO$C~26?UUVrKOifzun`vl-A$AOI*dd-ln3<e$fJjS=(t#6TN@P
z(z`=-JHbCxsrSyRGn0C%Ua=kfR>g3VN~}vz=`>is8fjVVRLM_G4me@-#rgev)>;EY
z<;?V6Q(|z)u16Q6aTuBPER#KymYTgzY6zz4JpGjx%gQ^M_|v@V{gsKbgh$Gk%dPq#
z3vlr@36QgD=qs4kq0!(TWQYw!jyM|xtb0Ho9Up_kQ4tFa2tJ7^4CyUvD2jkFRoX0D
zn$orUeccmblONU?oMzIRyD0op5<zq;w~LC>iCCATOy0LFo7`!xCe}7sj`QNCOEk%O
z5|zvY0>oU=z^t;B0Srqk>thPa>*g1yqFU3W-{zvK3eT*fGh5f_beuyo+r<CTv|`1d
zqEUCttkb?Hi<ObpJWp{_{AQn?35j$2c4#Zga(j5Fv@a16i~)W`1*_6~TQnJTm&H~9
z8ZoN{($~`f)KfJb!>;%NvPlvA?=-kmjeQ$?)WYx^u#!yE(!|@P6G~mESpOgpvIW6^
z=!}r!G;g}4g;Forj(#q$V+HbVUe!;y`Y!agF{X#ac$q@OA}T$2^;(cx<;$pa>f|=x
z^O%wLVM#0Xm*2*c>4HrefmYwOWpCU1cIlX1&4YF{vKXP@kJDilYLot89F758=S%Vo
zGK)i|{r_w4yWiRV{`b3dXi*fkwY6vMRaCXq2&J|LHA|?yN~o&6Y7?uaqDI7u739@g
zHA0P;wfBe}E6C^R{rbNDgzs<fpB~qh>&lgrbDi^e+>iUd&pGu$u|M8yZf|}xkL%9U
zywa~lJXPaTqZYR34G^@WQth(hx)p>=ZN6p`e^VW+{slxaNSm8g?W!}4Ay(K8fT!LS
z7sxlfz=!PHjvUcx)n%)WAK^@yt;sOE==T7p1_ss-j0tA5(`GIE#<FrSH{-qhY$^EU
zoUWyBsFdeVg_Tz!)%c0=E=PJ7jLmHHi8**L=8h($JoWpdiY5Pb@FvIr`jmfDd`#3g
z3DizVOL}mk)7v21*QOAZk%gapFk@8n7!W(RvWax32teK#c=Fz?_{><j34Y@7S<z9C
zmYM0%4ph0~3x{3)JH8ijpRS9dSj^ZAaPS+jg;z>X_=$ygQca6CqlFFDmeAj-D(8#K
z(2me*1q;56nv#;-V(!|OiF+@Dt`B@X-XTdTS=dF}YOh|F3-lmh+z;s`Q$)$;joy=C
z$QuET_x4j@0O@Y8dAQE-S0u09W1!y1&tNRp`dKp0Aq6rBJ+aBA@YjOzm9VE`v&uw$
zv?rR26vVFUWH-FiR}mm&1lG0eRpHrmt~yadqrfGN*D9PQaE7lm>u_KtEgXbjU8tQN
zYva*R^e#Ku`m23t9HC@WTIoE!Q8d`nH3QJ%e32O!2>D{xnFM&mS{n7TI6nJ!1c58S
zh3Cb?Un%6u7KHT(STb=?70+wMhJp<PC2;u~F)@~o&sP3e)4xU6?q%`{VB^qg`%5_j
zAAReKCuG|X<Y+Tqek+x$OMHvCF{gPiqhsgCQ)GAy_rU6san2U&JL<2_!YYyZtTl$#
zAg$16Pa`dCS9eM>0pWo`jwKBaF-EVk8)c%sU*B@AoGcr>N<o{{X@k8c6Y$#Xlkm%)
z#yg~?D2~W$>r5!Gl*od6)1M<GOe$5e#^_pU=KO-OLBj9GgK&xl`gbv?cD+GaGPiuh
zr<3pUs{VRCYHBK>e;00^cF}#bSo{mroQoBH116k`u;dJBue34C%f$Ae7g;Z@h14gm
zzx0bGe=^6xd~e(eKmE<DLDZU@u)B<H^I@yo0fXahx-y?9!JNNf>%Y_r<TYAF^ZB)&
zwoPdp3zi0!3(}uD!bC&ojB2<4gVZ;bcV~m8-ZR!5;ua3J5}QlF(kWfR$%y96ms;_a
zY0jIBR~1uhHF$~l)fIDAe)CG`%dxd2k4mKC36av9)(*Q%b`Rti&L<HlLXmWNnnt=5
zw8>c)NIk{QentS7dBLa}Z^~)1m<nyK>0>&b4jW$O7llyiMKIyFYq}ca%}-GxdoB}#
zv%)TtPkwcu%*Lo$t|W1Jbme`4RJuu-jJc_cRI^mHw>44s<WQHlY?lb(zs<QZ9>k&h
z%(YbbO%u_$F^9(lZ42dK3&we%?ri@{D-zV{gwbVepJv<Ch&~J+k@}f~bR%h~eV=F1
zbh+OW6u#Z#p)I%#oz9z|psD)ptpcs4w8Qk;Z+Z#{!(j*-XjevR$c&6rk_k!j+}(c9
zz|^kl<q_VKVX21yd+qEpy(rp-p2vAA#~}_{THK!_NNT8tbRHRi|3Q{*8M)d5t2aj!
zed>njPJUe2R<LEdwAL5B?-euJzqtB9GrdO1C+Mi-IS+Vc`T0|!&Zp}y8K~@@coa&V
zu7<N~t^TmSeY@@40o8TQiN#u|tNk^~?N%R$U9gqDAwyCzOK4_`lM8cIUO;Rs<En+F
zky%-Tv4M>&3Li6XR3&lR#aNHA_$dkS8Gfox2X*vb8tL>wq4kUe?FJjjn?w}fHFGx8
z2QQoohKn8f0^9%owf{680b8-*PfBJ?7?#ST-<cIpXIe{bjaf5l01@Gz!5#^r@45X_
z40+t=N(QBhaDP$_taUrTde%6c4jvK<uLrEiQh=09HX|5Li)W1Hb9dtaX$z2?{J(?-
z8%CW>?<Z<Lx6{a;Gz@vcJjkiKUtan}MtLB!S)p=`%M+BwmOwd3RgXi-VDB6hN1<f-
zIWz|?P16g$nRF3u<c+DMPmm+{hLav5Hf?QLqAGk`d)0(NcpzD%fKJ)|{iO+xL~Q|&
zw}UH7L{~Kp+2PW95Mi~-PP{UyAWSC#v|k%Vbm9a!pW@TD1XHcQKMFY8YDV90_*S!@
z$*O=~Bk4~qeU-$I`6M2!bF(CseozkF3$v<zhdjDvrF~jlnz>z)L0AHK2|xj+SV5|3
z`8YQJoQxU{tU!vk|K<4k5mXHq23Jmb*4rbsVZ>IU)v21JE;!Q6m2CBhr%K#i36AOG
z#ToRPl^53L6wyBxxiu2<r}938W<B!>$?4~;>lw?mxhaU~GZteJ+TiOaiT*DaFlRKi
z00OEiIlw4?xuNIo8;tD+R{|G;4r$x>7xx4hgL=#vpjbp=IIpB~3fT^|eN*Q9!f45Q
zb%IxH)|&YknX<npTNtZWsxGeCXl{%}{ARIK*W>S+WO@1%SBtzx8g0crxNynuruI1#
zYb@Z~4F-eQ3!+u=U)MskHImoAsp}}}qYlark+#-oY(38XOK;h?Z3A$|-q#hS_+?!+
ziYh}qG>H&PvPqhhC^9wDT#YpSD+3d_#T|t>{i9_<^(M^N;ojcZuP1ER?lNj{7i}Ms
zk1E~3gdyxRf5?bKv{+sYRa+8xULUT%cjW2yXg%Y*7{WQATmt_)Iv<Uv`c|sbokjph
z%~g3{&d{Kxtv2G!kSPkcv*m9duhVM96AYN6_e?(Sh=qu0u6C~#FHzcsX;x~jX2Qc!
z%{pt{_nlb1l1o*;neh`_pJgonqfqtb^nOvZLwsvnlsDw-_hIQNF=Qr4$UCgyM)~`)
zzqDjNWtODU7Z){&v1kjR6)v>k2!r7D!QFzM!(|q}Xn41Hl$&xyWO1t#EG_6&?AMQj
zJuF;t55<HUevXN9IEPL#;9rkFw{;8}LA1X74KMf}f4d<<tI7kmZWiC_#gstb6OVU<
zKoTb&(zYNFiKD7^t6+ltP5ueb7J$R)7E6JIcAOpIyntx{{3FaWYHoY?R02mlb;^`u
zH6tHt3YG~nebdI<H+&(y%Y(A;j$qpj#^}$czk~%XGCr(V=R<Z1!1dPo_|=m}Yt0m>
zIwec64R(tG3ley;KwIfKqpg;Ii_K+NXE3dVKcZW}#yVbRl{Zo1N~QLT?%bm8@pyge
zcFQsy<Gm8~3h9cfwX|v~PaTz$zvD}9TPpqe2bQ5Z@MPJqcsvF^CZ-xNrN`+Kw(Qr6
zY*!+~j5F={xy=0QR>+3mpO<4Y@`@hhTnVn(da3ozguDF3JoH%fpLKFRn9UGdu69$*
z;B1?Izq6y}oK#e7vc~wO6`8w98eIoJ>%Dn}?s@l{BQc*-Th4=QWhox5LSRKlOuYW%
z_6RtFTFo)5X{+y}P#!4sN55AsY-xxwc;1K%10$u{9$(<#n{q5hg;-hk5nXgKu>f;j
z&snjq-YKn+ES6l0b#+cr#5&WV3jPS)Z3l}4ZfY4=s_nMROWVZhe5yIRvD{j=uLK)i
zJ+>XPhZA&b>l)`YM<dLJtB*J)hSbl_cdmz1?QLi0L1bdPOUhIs&dX<=)rJV-^-GvF
zf547&VF9{W$;3bK#9D!AzPz^RXOTZ)k*y!>3a`L!6^T3~Ph`!Oq9uB5W-k(IS>HiV
zgcW-4%G&XLFsY32O5)8mFWv2`&hukz&of20z5Dx87WU$nVfN3`iu=x~&JO-EV}&CM
z+O>829=16n*F;S`tFJ;r!Yr`&ngmbRh5-U&agc2DSx|tvlV`!ig4ibtc8+nnNa;GP
zfso-{O<CS$YK{Y>L=m5Q*UdLt%JB>mMQf_NUI{`xhObBUmpjXghH}5Fb+OGBIkdM^
z3)6K{`LtRV4+xAytQTr(sL$xpFvm=58iY%3>GZUxgNh^H3&P6jdKIfqpwdN2a6sj3
z)D>I&<XOs`K3%Gnn?66N9h6{)?)MkU<(}_D<N>~8Gn`wK_K_+P3Y`op-wAohHJh<y
zu#yWZuFNxeV6eTRhUl)5y?<b(3oeyHOWUceTeTTE5qC{9Xm&JyR80+klI3YLtLZ#p
z&hMy-&D<MsdV;i;e;hf;e0talxypz3zK$W6<U7K#o{=kF7MYAj2A!>ou*Qvi513`1
zK5FmY)eN5(&pqzZWLR(zeqZ$Wsyf5Ob)~zLQivAJ`t2~QYi?hkmdN_-L|0jR*!nmR
zeqiY^)A5eZ)gHd>LzXP{jycX$L)~ry(bjF6_rXK$giXh3H<Q32#kuP;$5wzAinMVF
z)Wl6{T|eb7VGH!q!F-DUskt?aJYPea4^G@{wDIdSmS^v{fPV80?qdD=56nFu4KbD2
z>V8fM3^wv|Wa5I5bqVVK9oI#vEbfvYaqUc~a-row34+`j$tIbgYtFZmYp_dGG@tcw
zww-YT=(ee8R9!lYa?`{@A42#==x^~QRQt*NCCytX?u+yqcuGFiHGPVm4!}b!{09`K
z_Y!xwh|vl2HW%zu+9L+)#pVZX(<LbnW@pJMbtB?jL3Y0ney<nL*uL-?@y+$Cy@x_P
z52`?ot~f@zRSSv_Ey+|bxI|7BeW4Vs?jyFf&%b>TcR!Q;8!J3jFkJxhO)eUrL<TbB
zIeV&#rJ*etRjGlGw9b*n6I?BXE~tM%|94qlT>5Q6B3Pv9^h762X2k>Bro<zF!6fgf
zmBP8J8K>tn+vPYIX4kfr`o$<qmyt?LBlix{wnFK1QS@_Ui|;6Q`bYNS<~865;*~B_
zCCOsus-dg8;(LEmWuDhH**mac<T*MitCA~O%Ur_6W3e@5P36aKub(i!tD#s`vBybb
z^$gpjw?@f>9ez0RUdJ$b@07R;U_RCE5|BY)4DIrE+wbV2kZZsk^){9`<}$34zbR<t
zG?Hg78`XT>`p%6AIn)MT?R!@;Fj8tW!RId-Go<L?+^RmT{pY|->;t=IoRv%$isAEb
zWpPoVT3AUkqY<(we5LQDlr!V}IxCtm$8UHT0iq!<&HvNku`%w$WA&(LQ{|1@?nj*Y
z;Kn^n+fda-RZ__FnK#;2Z6+XGpfP^T@@urh=%yzH?p~f6Db$xxI>FA@mUeL6igl)*
zvC*xHd(wHgl70)+^iA?}D6}V>lNF_-MOYi3{?RW=8(xEharT5YHsZ$Iqhq-c=<wS+
zanYO01DWEuJxz)Qpry3eFWsac2|FI1({1C~qfPtN(=3~5+1h$g5jwDLD#4i>)*<WA
z5P!j%4I*cpS@x+6&sXBlk9-1`eb~>M;?MU<0XrRm8y!Ih_M{!h?bo>{`mk*3IEeMh
zhUn+SWm%m0+&XTwS`sUl=Ck;D_}MZ8NB#ph*~%*;mIWiAC{}W#TP`{)WS^O5VMd(A
zzV7e#eyAoDmH<x!tDU*~x2+(d(N%pVtKOm=Pu_QmP!|&;(T;}-jvMhInFlI<i+4{Q
z5jO)3x@<2NeP)<+^KJ@qczTJ7bjW@_>~eO%(7YWgiB+Zov@cY}q)$*i;p4)q+W7+B
z_d@p`8{(Y*Jk&wX!Jq0f;LiBuW$)qwBI=x&Xw_*N3~ohAbf<wpcjC$HB)ckFFeO-5
zRsVmO*2PJvOt5BpR+8?L`+-+>>KHRUgdO7u*cqDv_PQ}eI@a|Rn4u7hqtKuo6{Y>L
zY2xHGvA++x8LmiFfxtr8E?fi;#3SB~<g#gVY|)r#8QUKG*6p3saGT&1=s2T`yw!83
zYA#27rKDl>4x|ZxT>e88#J%kIIeA809Tqe#(Q9GlRQ?SD9rXTVl42=dhKW^k<vqLn
z+(!l?{#t{k5U{5jn1{-r&^5-+FKZYE?n#p-M9$|#&WNO=t-zyjQe0GXCkHT!x6kNA
zaDBVJh)RFTniRhjwEY4+%7%LBMki9wxb$@5^1{h!POpK$Gex^MK7v}|X~$z5`_zG*
zh7!iZTpw~uRwEDSgrn=_rgf9-+Ov|>9>3$C<R0tPvrVx4zLaXU`7^CDRdR`Clj<_Y
zeZ~lo)MetQ&+#Is10rYL7DN<jdr;{(DeuL;^H_$&2PmhxaeO9nk8&f+cx3()%u<`4
z`EuThT;#M!lyBR>F%kiy`mk0l%1GPXE`HsB3X161kOEU_M#+ApaVaLYZdTp$_FyhF
zl1_8ZsWe~SwSi@K3W$F=sI4uK{vsBZ-?Gt|!Oar&Qaus1Qk~m`lFi8ND8Dfk825hQ
zdaL#tPAlOKpBDE25o}qlX{6IWi*~8=y`W<q(soDCsV$)}@TBnhl$71h22C)=pn1PQ
zq;sgB2Dt#77jjPtpES&RHeReh!8eOH-0}GXT9}b>gu=cXG%@>cJi6*JW=t!R2IafC
zv-B!eKR?26ZKMb8-WKI9D!yB}eAA|JZN`hIX0mH!{!zM6(&u)0^_YuI_Xi1FS{wNN
zAG4!1Bh1N3s|aWS(z{J{K0^hcs0WflH5lEH@d){7Oqe(yKZ$%VQ@wKYQR^M`UdH)`
z=Ym}9YAM)VxVB>KtqR5GiG-=I?Fz!W@h*83{_s>Ogrv8#)7a2+{0`)%QB{@Td(Hcp
z+S;iq#irQKY~3BQm=Vh&_LRO}R8y{;SqW-DjIwsds7(6^2f&`*84=PhX*g78G&jG+
z?P^$<3|GqTxTcnS$X<4zHF{&oQ{C#RN7edn@AvT(qp$fOCNs|@;d}P5VETSk#Uj`I
zJIdT#@Z^wb9#-<F`)_E{=YxV3IJdV{u<&i`7MknhE$zrK&}s1&8fbcbJ}I5&iv;dO
z2kE5+kq$}AI;XA6q&boEyZ|epCC^6KG@t324T0xJ7Yyx3EH~@FY92ujWRgrdGd|o4
znXcQWcM^B~o7{6G`r=fZl>RZ<kNvD1)*xSS@?`6de41fp-QyZAN<^}-cj9;x-37Ag
z*VaSV?uwp~H`AV;xSX~Joe`#eO^&ij=SqQ_%jccQ(@cx=4SOXsMNyz&XwytZHq99c
z@gD3b6I1N-$>(a*@3iqx(n3ABA*j>_o8r6nNtqKU^++qH(M|}wm+*3W*ztFN!;%1#
zPuQ#*XfF*L={Dh23Q2s+O(jX2aO@s3(&`U?D{6Nl3=~lQE#OoPC?LJ~Y&Ih~=%g?3
zJdH%aoUG=abna$<1bSCp=J2}kDUGCc#Tvfj5D)9b(eiiKRS*NAHsH{t(cJ{&U)CXD
z*PgE)tJZy7Dm~Jyc_|t2_b3sWfUHEP7~fcI7{7x=dY3^-{bwP0hrK=0GG<MjVs>cG
zyVd)bGu^Ft+u_`X>4En?i|e)Z?V>{8mX!g&7cf(QCy_IVfPLKo3g6>;(neqN{+<%4
zFKE#y@R<Fqr!Tqo3zHL?{4aSz;J04;-yf7L7@YTZY3A;yAesrE@?r^5^tr#uXTH#T
zh4gZ-CG+_y*xnLJGS^Ld5k|*8VG{D-uvkMh;7x1osO$+|JOh~^C6svI<JVX&&3%+v
zc-3;GhY(U}%}^a7^kRIIZR9?nR<9kPi9i<KNAp;m@1~JvsLn^0l}N`*q}{Y2f)NRy
z8?d9(T`~rJS+LCpq+x|AG4f$Hlt{tomZ51Rv+4IWMHHtkEyck#kC^)Ao5~wLIVT5t
ze><|YW<>FsYt?E8rq4)Mu8@-7DoF6XkmfI)f1YkwxaJLyZqMQC*Y9!~{NCE2KCW_I
z9qMFYHg_@?w$mQ$<~YP!L2ndYFuCgzmmdGnRL$4skb3^oB}y9g=gRu5nN^V%Cfg<d
z8Mx=uIS-|SdiJB>Es}rG;Z~YU&=F(vE)JP&<nj2|Pk$L<Y#NYxcD)_1z1`A4&ZZ@0
zauG`co=x#;xrlS2k(N=7lMX%x__apI9EgZrB>P^v(m5ZfuSeW#vhmw&#g5-*{`jm>
z-$p$C2nRXtJ)zs0^%Ve+vUKwS3YoISGEHonCW5C4;MEJbOwn0$9J@v&D&BLH@`jm-
zIdnPhG!*__I5w0em+ThsdBSHeVjwgH8!m7%BlGF0Xgy$FpzD{w4|*1~#Wi;k%<SZ8
z<F%w}D4D(X&h7sT1{VuFTwQ4w5RK{M1StRsc2~VYjx9=d=+w%{j&k)`aNQd&kRrda
zCiuX^-E7pxl!BGDBdj2CKDSuIZgR==h2Ho<1(U^~4R=p8cF5&6XI^%SyiZ0`rb&`8
zgv4`fl3H2;PB3{ANZ{WtnK-5kxMSYVxnTW<?Y4-jxfUzug&Ty;bbmG|u~?N@D;zUB
zrUhA(celC4szG&6i(XV7pO|}w8uoI8cQ0?vr{13u93H3ev(PmuNqV6pWOBQ~5sF)J
z&|<T$QA|K&e<I9={m~xU?oR*Fv8Fw{3DTBC>AuE3>}Q>0MiaiT9@V-SB4+_)o}zzt
z4j|#h{CLHaoUP-W-AF%C_s7BcKyM%ig0LlRfKTnNuu<&Je)nD&u(61~f)D51U}@&#
z?N2Y7){ih~)3=i6Xy|YFL9bk%)Tc=&@<G&sS?@45A|k=50&cV7m|dZyJu=AQXgIW1
z27~Thou2iKC^-zaJm{JrNF@rXrWk~Htrk8Qq67Ac(<1&vep}$^e!!tm(4oEJUPin^
zuWpBwc?=5=kkOsp4VVUZr0d~KOhVK<)QjQKvQJJ5f5PpgpbB}<(xG|?GB@>@C*Fbw
znd|FGx4%Lus@Nh1QPj|3US#BIvQu_J?Im{&go4oA`B5>^4R~*J9~Lu=E!<g^v=I+8
zwam61D(l(|^aiJ%hX{jc0H<@43joIV2Ea$>TcmTHpc8CgSu@Z)`9Aith6}pBJ@IK!
z(|Wxz?^KCy4SSOQxCNXpUOhx(3vV@<v$E0uwO`gCnmL6O-spFIPL#{kFsxr^-`dFi
z8FTDEBwi`FY%4|0cIyLI4b<3?{;HIu^yL#jzpSX71FrA54a<VuB_7PwOW_Z^1tzE#
zzdz-dFYIZ6?}2BgZLoQZ*t|7y(c4~Naz$Sg?bpqJ<&O75bf9amJ8E?W0X-Ci{sMHh
z)ukG`avWeop&_F;NwA^-2F!!TZ=)goZwKLbtQ(TY2D_G;(csaS(NOAt`hyz=>CA*F
zI_N6Lr<LO&vc)h7{-(%DjQ3BM9T%@sB-B+XZc}W1Q~%<y5s@Hp)EclqBl(ElrRL4d
z_)+j5TW??HvHeJChOeJ}lr<B%8znmh1sypmV4V`XyB{doUyTmlFt;$$|HB>W=QGZ=
z{+cSW6jEbmuA7jUy`V;>lBvi1IHfeFZ2#1-jis~$8TS*}V{W}c`7ghZ>klEE$IYwV
z<g)cx>@~}o1^<!cbf;M=Gr`l&N}!5{>r(l=byM2!DOH#)?FPS!sXrqGaS<Q32Uxut
z_>lT&55kl{xD>^@P~(SvfUQ-FmX#NmOCDL7)!SUcU;mI*vGHD{r=I%a9LR3emiW|v
z87pnoCMlRSjf?-u**qB)RQpp~nd`dQ-FDYKD}yw$*9JkEO+9>pb}MyIat%}LBy|JE
z6vIB&o?sAC98fN1zA~D};}NHd>j>Ie!Os%Lg_nN{)&xULd_pC>kl1m8X!P58#$rsk
z3<QFvE?H?&H#6mK1Gc6?VwTV0f3%ab_|MFB$hy*TI(ac1-}D*?wc`Bphr!;r-q{RU
z$f$#JZQk%w%&!2b1|17%lYyaDz3XHbYSDT_U@o7R_FByV%0=7yYf-oE)!GESomf7%
zI_R>(&xq}16Jf3@={pB|jSk3x54{79rhE_LI*=M}vMQ*Z5`RFDx+}*rvi$9fdC=M5
z+cy0ANFJ`}9I@)i|6Eu7?%PLLH*vJ)@~bR3N+COaF0YO1ndH8F@vmK1uxXMNnM4hl
z=yd)hqu6_&&xtBH=(UpdgH!Gr)cxK~-gbk&(*()J9N-<fn`*^~K;;11LhD>%9hMm*
z$$8^n$WjH2D;4IG0H9H_-JuXIIorGQC>G0c13t8=jfuB(Vp}oOd<dWYoiM<h@@hfw
z`OtKhP~??vF}R?ggTj|AA>A{d1O<ONV!xI^MjgbdNbK0GhDDN_$#LeOdU(H1R72>%
zN%474ChuvN9YE9sx8>lk1GfASz>RoQMBu|4;0^{l^ww{^1|cm-(yMn7bE=*-(T}SJ
zPBN2+IfZ|XJu$_sn09Ku#*Fkb-fU>Tj~m*T6BfjlhY6{R`6>QrH2faAJo_?=RYABf
z;_ab!+)hc;+gfUjX(bqN&US6z6~A=pQWoVS79hCFdCCA`#&g9L2>-19nFYef!EY^>
zfmo;#eiaDX;gmOkkVVN#2?QBdx&M9ff0OgSmGi&d@xRpZzx4S3yLR-FfH@|SR+Zu{
hfuwu=qC32LiOAY`bQ7=Z27Gc!{e|}PvS*f`{tu63_k{oe

diff --git a/docs/images/pr/chat-image-delivery/click-enlarged.png b/docs/images/pr/chat-image-delivery/click-enlarged.png
deleted file mode 100644
index aee0afd560cf64ca31d5cf84b2cb2eac0a3e5cf3..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 4496
zcmd^DdpOi-8-B(iIqYaZq{F0k)4^dwT4p3^JGv-|8WkU<NI8sTk<)~-rL?UM<kV)Z
zwd7DSD9o4~3WF_&avCHuc1jKj&3x}WnYKRLxBLC~UDx-A%jNmK^ZuUazVGLLo^g8n
zw#}c(&65Lw&&;-L*a09>hkk5lN}$NS#!bNhv%qY_Ivc<Efwpzu&fhuDwDSimqWW_U
zdHNT+2UX7QlO6~wJ5V0KQ&;*_#&snw?V3@ZdPQnN^A9()sA<KX-xHnd;-4-l6m+Ch
zc?*Nb_Qk||&Dq8N@?7^=?ONgF+t(c-f;YXqrYzya_(&Z3HP(He;qV59I|MBRdP2kD
zk^0T5wT-nV{({M#Dpef^L2pmhm88H|_iwq>nvC})GlZl4k_TftT^`I0CT2!x>^bBP
zG&lXXrWAH9%XNkf3{*VzT`DC5`Ub`3#D{}scjm<Ch8%}&<r(S+O9^l#@cfmPod8Ee
zC81K52#c1HfgaCA0c%;J;^MZN$FB6DZ%32DQbV*y$FDqcSq}2I>uOmKWh(mVSvPZE
zX-Uym%pRxob!GWy_ei}AE?yib%hHoiehQ9_#wij|oK_V}16`L*%xK1&w|e+hOG&_O
zb=^h-_;G8^;~fMXdH76SnVDe6)>B1KvyUYqTvQzby(V}L!Ebt8l7b9KVO((JR2xQh
zmPM*|1ifx+atH|;iu4o?ws@8VO=O*N%0_Q9e_f?hVjLovjPoq^pBO^d_~-w6jv*X-
zXu0<7I4_H>H#6$A_ji(9HNkb`Gh1EUt~w1xGjem@bXm<L0{6F?XJij|g-}WQZvFO{
zNF%a=7VAP{#49Zs8Y4}$BHlzMtJYoN4yEF3o=u>m$#4Bafhv7>Y>h)lQ?A#7xfSlj
zy_!SU452S@q=71=&Ts0awBPmjz9_R3F`(Vn^6S`O#lnz@-x+ZZfh{D@OofU?WarYH
z<*>3uD3}N+3C=Jl&p_ynT0_igmY(F#^PxI{8zWOgU}oIt2)a18RZ@3vv0fb6Gg2Ck
zGV*NfK9ghq@P_0z5X#Qd2JdIyZe1Q*$sUtYlr{qM-U6Z0gI>q(u2<B-M2AYREFA*V
z{}shg%6H9dtv;|_nH08pm>EExRD<jTCNhdWT{_@g-B@lnphQ~fAvd`Kj8#G;7oLbL
zL6Z3D((YMJP#wpOSrrfs@iKcg!ITs3v_fGu#ONs@;kcCQxe_BKXlfQ>1?AZ|vrb#V
zvzqV^wADILOPd^Na$r9$$j|rl>OsUT0CL@0>Zzeu2pmOkXQaxf2(IsyNMMRZLSg+`
zppg4A)EXSq?>q_o8o(|Gkw5)Y*Hdi_YVRH2E)Dqy@U?{jWPnpuLFaSih;bUgT%Biw
zOH+YGd3%sbfr1P1@xSS9*!gm$KP+-GmxjvU^K6VO<lw;jx~8?tv_Si8d9W#OQ$$*R
zR{}=sVD1D9BXNV#OEHj@fLY|Sa3>PbH{Qaz8$@hsd8>TqYsjV@Sp)FME$!pVY0f|U
zEj)=E6TOXG*Qu|p<0%QmV`G=*;kR(m&75lGtl?Gv-ps8mmR?y)70~A|9oy%QQ0QG6
zY|-<@nxU6m-F~1iDG)pj*-}diRIKQ4v;^Qg<C+Uxm7%#JdDP&)C_2+X2KFSQ42_zy
zZmXi44i1$v>gS@ilESw%_8%_QBLbw1cm(vwx}WL2FVqM68T~1U3N%Rba$_aHg=3Ad
zIwA}p8{d}z<9PhsBk3!Z?$3bRxeJxblpXLt^e9Xnm~2d0L9A4SlR7e(3AZ#0$F*gb
ziBKJj6ziClX*g@#b09&C2QnIZic#n1W|-smE;o%j94Hu*hd#HCrY}+2oKXX7%pU)q
zQq*91E%ik)t@KVSf&MU{UpC?q(4}LTbBQ$wRSv3jk#Co5gzF5@z99Q40lNg;&!1wk
z(*7))j1W2bdqNWLQp;KbJqAk==cY(`k|QtH{pvy9a{_%X<w^9C=tP>|KUIMfCO#;#
z>S&Wy{X`oeEAravEf(^@wCu9nAN_Ow+m5!~M^X)eeidgmv_b{A_52nckr)4I{o*;$
zY7^RBtksO(z54Ce<R;h71uGz1IaM*Lf#4twoKP`$q7J>As0K6L6KB7_7CZYladA3-
zEg`DIWNv|J5b9(3T`~w%z~WycF8?DRXl#jFIm0qr0#q=KzPv6SYM2C6<jE6H65s&#
zzKanL7XZ`B&aUy^nss{oktGPtd|r?HjQJ>P{L(#Vj}$Z~RqQ9wTTPUR-3q|9`s)n;
zvtGn_iOBd<M15FT`qakt2miOt%41Y1>P3k#80g-w`y0~taWE5?8u%i+_b6IZn`1T$
z=uC~Jq;3H1t5}5$%Bm;))aDxm`pLaK0$daM#|Mbe_4UgpmQNWv^8_*JM?e4hK)c4y
zdZatG4Pb9eNuAa*L}HXi`#)zut1e6N2%?*8IOwFQ_&hd3Cc+Ah)B7XKgzJw#;|7p-
zF@hz4W+)m-Ta$rlqL$0p_xHvK&dWQO0(JAGWuUGgIHd?Rr)HdL@i`7Mmt~IVmfO3i
zN>N?_%WwF$XjvYzHntQb5x^#1Y%E(l>wc+G2C{b|68xTt4tA&6Y~)p<=g5@icmgOg
z@Q$_3v37m3nmPg0uv=HwsFO*H33N(}i}^u`35~pCXuq+Wlm>I3q7!u?PA?RuEQEua
zS-U~@{FbYq9ERd?$tiOHQ<sV2*{FAp<uPKP;N@yrBJHeUaPjfiCzaZJh!EdyZAtzK
zc@$HMLpy{}^~IGIC|Qy%^uh7;CwsxD#k?G0BpS>7{iJe?h}(-vyR24$EZh^1tH8?o
zD0{R@iCnDpw1cH0R9Ds~YR3+Tvxf?SrY1fp8rE^cKU(=-lVJMWzKC)jr^$e(XdqAd
zqu=cbK4;JBA_6=TW#x;sh|Dbb^faZ2>wmv4{QM8nYkL+N1<lVr=M`;}e?dd$PY$AG
z5XUruHv2tySf{-s!(e)7==OKwYcb%np0o!3wS)@ByRvGe`_l<vn{9+abwtCn?*sAw
zu~#$N+b`<*g{r_WF&OT>sv!mQkZAJkY0DL0k@t~OuVmwRK0s7g*UhDT*)w=sgFvRe
zj;DSzj-K$0Z1@tG0%NpVJROat&2d3s?Em{B|HwtB;q}QtraYE@{!KMaR3!JzM`K6q
zbgFAoZu&264ATVW670%NZEOPQ+VKO<?xZza5TISOoMGZ~8XjQf<GGzy6`gQLHsZ>C
zNtlZp*MpJLMcIW`uD@T>P@XMZTgeX=*$7SsPaMtkcWc-Gm02aQ!@C>OsgetCYgBD6
z>QMB^$y{zrb>W0}-+hy8&MLg_XrFMap}|@cx%T!wmWwpc)uZRi8Cr6Ywp9LyM%Jk=
z%{vq7vvJ?&ya%F1tTn*AELs~MZB&uw_2-Cft<p#oKxap6wGiuEsZrxq{f-9jKF%sU
zu8pN&7|qQN+9XQADn?lN1Y4cAdUA&T0eh=#oa5%~fyk1~uzH7CqzgV9(Lq|NPme-{
z#hl-Eh@Rg)kIkT}eTQD`PmZF`#MA6WtGZ`of^0|Y_Ni0i-hJ-?VnuVDa*!nkG+|#i
zYKh#9Wr)qrqj)`SgfE|&(rqQG?PO18dTJtVYzi(b+v>urXtN7BrGbD7TehwefIz|j
z3qYr<Y^h?;4D>a9SDh`t5PSUe@6kw@eQr8b74e=M={2VUjmhjHo?Fq;IJJPm>lPv;
z51)Bwjb4T=Tbp(j+mqFJ{a1Z_HZ(ST&FlXzDlb!95&vFRYSM!Bly~@-);Bi%w2Wk+
zj`Kvh_1?~OORK(6^7tLWdH4^OhKQB2%NV7&;qdiytVOUXb6o9j*c0U8QR4nmub}WP
zPe~nP?GBBDHYLs7=Y&P$A;z6Aa(q;7W@e;^`s8N#^wjlvou!6s@VF80HNoyF$q(3l
zPGHh)Ad*aH81FEZx=bPJR-nP*;mRiKTbN+w%SD+2833WMfAP^f05AiCC<$hqvzyrE
S!^m6!%r<V@kok>c=)V94XUhTr

diff --git a/docs/images/pr/chat-image-delivery/remote-after.png b/docs/images/pr/chat-image-delivery/remote-after.png
deleted file mode 100644
index b9d4268f04917a8f5007f42b3b00d5a744a77825..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 60327
zcmY&fWmMGL+a0>Qhwkp~p}V`gL%Jk}?x8!R8>A(b?(P!l21x}(eU*Fff35e!e3@^*
zb<TcvJp06|tIDAv1Cap$0Gfilv?c%mJ@@CQj|lzepP?1mU;qFUpdc-w?U#S?(`9A9
z3!Ntl`ob6SyKTKS+4xo}6iuls6^4cm1?}eNw})y==x#GtqnWh9u}oC}%olPj3s$v^
z-}@oIzubKj_~lOe`w8<Y<acM#uRAq?;9pPAPD5V>qw1}q(pGLBR%^kHEd0$B-&t&f
zG)-t9LyzkWgBwT&k7w=Do6rSkBn%8{&QnjjjPZ!sq;)KcpLL%G<*XGNwB}TK9r5^l
zairw7mNm39ho9RB41V=JytStKeLNB_t~dQiB$`Ad;__33103#hO#1l574pkFbI(dg
zg!Ag`8<2-Tfh6zVGtdwJgdv&Uw)^YgyW<~YOwi>chho4Q(7SLc%@1pwG#x~O_nF5t
z>vt0Yra}8X&*Hz||DH4~WEwOiV>#ai`c>SyE93Sr<|P%NXat7hH{_h3<eR=v?c@2h
z<!I)1_(c9uct+J&j4fdZdnq4}E%{jjj{;RO#`|*iJtsD04d^89-5`8Nv8w!mdy#of
zhPNo*BnAUJczUl2XA7EP0%u?bKQj)=P72|z<eXZJ5y)A5>`0JrfvO?Yt<9G7ovmXB
z(&r;(KiH$)?+%Y|XgnY<LCE{HXVMl`N=&oKze>V}3hM6GR6hTD*F+6^Z$U(;p8yQj
z^UtOVb%$t{J{~l5HDh?r6zYk-|LARMFd1HMCP2n|ev_Mr*g$P1u^P~TZ&?2Y9<iTh
zZ}0OLoNF)~b*Kd=2Q@3;;D-Db+5AN)#~bPp2ZU?|NQz|yTLJRvMUu;D<#?M})B+Cr
z#9(YDCPUodg{XAEU(W{U84E$!YbYjM@ESZJ-a1|P3iA`r+4KXy<u!LZ8|_nVid$5r
z?}71i$zQJsP}JHOGJCX1--c54YeLP5|9*LXV#U^!n2kqA4?9xZMEp4X&W;gVBo*oQ
z{0>A6qsV=(Z$?7BU#dMbCUHDX7vcr&=6HW0Q+Ocy{?FN+_cUiBD1CAhF}$9*YA!uO
z8IzyOemN66m-ykYs{oHvL6Ag*l$&Qa<+fLnFgbK9T~1-3_>#@h1g|nUIFyC24_Fy=
z0G8A0%w=zB(H&7JwKTt|f=w3&cWKluYmwGe9}z;40khfMd6}cwRv{FGicXEfp;QE2
z*g2s|7aXW#f&rd23-U};kg68+1>zrKMXqX7^z;w`Hx4Ks1m`EXk}=W@l!v~vpTKoY
zv}jgxUie)zZ9@92-VKBulJD_T5O0h8#WIsj2YdUzE`qniH?N20^}j<KrH&X4G9U|z
zS*ML6yo@<Nr_rw`4=z0HB%O4P7~8q~v<~eC1yFvDiuT9;Vs3Bn&9sR630q`Cwgl+{
zC9G`XSCfBORDWPWl<S&DxU6%Z&o^%xp9z6Wg!z{zal-X5MUNftd;SwzFvQR*D6$0F
zA9<k{^JCZKiitFY8rRyJjP9!dlkb8Ix;tMIf6P8DcA^i>o#LLts$ZYPjsl(u3|$yK
zFkdPUAard__gm(>CRW0|Shn$F2VPf5?X>tXM(XmxNYQWIw1FbBx26w0&ny1Rx7Mcw
z5IK~-B~*BWQYi!dRNaLDF^LD*<tG-QYKo~6kUIBshUh!D&h+75_|J1FPC6WZ>3FWh
zp(%~>Kp|ZQayBZW)EgiV9qUG^q2o|xkhvsI@@mwgF!R6%Ak=CDLBdtTS2r<qq9<mR
zh7*SqSUhOa<{Q$u31wRc#QJ$v);%0u7dbmek^>QT<U}@0zXdzea;$UUXYt!-iqDmc
z8)fwgSxU6J7#u2Y-%(|Q6MKcF&}?`(5`AZx&;1{U?`jUK7uZRX@UxhC9>ds+4k&-I
zmvEq}s!>v?RB=3qrSH%X<?o`4+e4|$kCPzuLs33fMa4At^s*%QS;T!J7y<}~>08R^
zwCL>bm=&3M=HfzX%Y{9ZW4I>Ul=!s9j>>}U$1tyuVWDD&xZ8jaP87Pa%wTkHgy|PT
zOL`4BNt`1VwtW)wF!yZ;i6#Uh<V1XWju>!NmuR9QFl+XW^jPE?2n#VV&xqUz_mjdD
zzgDUeZEHE!nXP?OpvQ`l8NBP)VP6l-!4laP01z_rfs$eHyJA&wpRh0}sh0M5_Prmu
zpLz&xIO`7LlRpz0)2MQ#aBu=-UXYk95;Ux_UG;;r_ZZe2)?j_t`WKOJOh7_qlw&>S
z_@>i^a-qvi)sRrF0zcaqE&VJNQ~C;3qBJR{Zmv>1K_7ePskK(c<s*%1k<$$Dba(oe
zIk#;-fAr9tjW&WmstR=e&0>U^6p4Qv7L~eNBLR!;0P9y-Z>_{3m9PHGcW1)KI+JOC
zrdc8Dy>^-?&2CKKHFQ2p>Dmd{<QPZI9jov%a67ugpy3Q5h+(l><b5r$ffts1C`UY5
zT%Q6AP&F34qr&%hNsiTKL^@;;&wv+mXDm!1ODU%TOLuPaTRQoF%3&xzgD~0y?YTno
zz&!BtoVs6<Is_ABN`8Y5z}&?WQD;9)VXDw?zTOT|3#C|-C^nAeOT81=J2-iX#sWIR
z`MOaaR(TVd2JG5dyV0){b%P9^EgBjp-kk@p^HIHbgU8Z8qh^vg%fKt=A2|7O{Q2sC
zA9fg`KN(JYa)kREXE|G#CgD-Z88CH_Mqc!ms8ucgPBP}<#I8piW=K6*%`ZhI)JZ~^
zZ&!8;+SYgvSC2Y((v5{ox{9X^7mVev%}4#EKPak9R^oYNd%i&h;W|AxCgR&#B^nLe
z1as!$*5V8COrUIVk@pDHPT%zz9yVqK%a(dLg%T>E$Z}%X^N=(aG(z*mowkzf(T5E6
z=dIAmqkGsL^nTlSXk@2El}$kWx9Q>bV4^wkMJ8MIVX1=$pM1~LSO<8U4*`F1zWoR1
z#ttZ>rL>{eIke-&1NR`9k?Y3JwM|U#lpjPRTOzW0SJuH{4_`4SV<m7LFr@-tfM6E8
zr7kbnmGwmi*Kt0&%Nbo=<0|AF`}tg?ySltJ>M`<LD(g%-;_RdtHct}y31Zk;=RN>H
zSPxTn%q(B_u+AdP%Enndv8S&|W|N74DibG;Y2w6~`UEe21j6o!NN8%kbc)=!qx|W!
zz`YcFP*@2jc7b9M{ZBeCnCI}6-%Dml(`hNF45_)PpNN`-mlgPC<=S$QqryjVQU5>R
z7)^+>w)go4h@8xrbCnq6S_g%b3813v!Kkn`#-!)(jp%$wazzLK7ERe!r*p`Og!4IH
zGNW-f?#iT+VgRJrnlvW6N$>*4xXs(Y!ETO~zeIdMl5#DC(pNSPFU|ez+bBnx&7qAD
zkk?xXWta=O91kvAm@^-9Mt$@W8W==cwe}1@*3|Pr6!>OCPw=>Tv}Zd^p6Dms>_gOB
z@WEeoXzLII5uK1GOT-`?mA7XEtqWN(Hwe^nq`xHY7~$IyqD}ldjR*dn#vzh%^7hpf
z{m!EHG;})#Vsr{<1i$CQNn(Vl4|6$i2Mt}g<Wi~aX@j@&k1};w_FJe?2DSqwIneNJ
z0DA{Kk>riX$Q(Ec%W3*NPKb`5k$YFXwUB^~e3~>```EzvWWhXjMe``lSVc09L)1|l
zMAIqUq+)oOfiso_9_X7jvm<s6Q<o94oLd$HgX3zTBoM%w@$_3=`P3^3D8^$;g>1Hr
z9LBxgR(Ve9K&mow_MB}B?Ms?Q-q-tgs<FTOcdE5ZTfB?iLK8b;bkmuv?dCehypx_;
zm?oL>m%oMu_URiUG8|#?q333;<4Fi3^A;1sLi))S<O<Hw=S0@D_^}0ck}jOcxrOH8
zig#o?zr&3uw_=PhLRsy3h7UGlttq0o!J?bvs!|2bk1XjdHYMt1mNkCr%6I0Kt2Z|;
z4akp{RJi|EEDtvdb)>G9!T8O*)NWxh7sb<PydKwhDLHxsC%^Y)W0<Q=&~Uc4P|r;0
zecfUIA1ax}=U?asbK-(Tz$6^5LROzv)JlDH0H)GStl1z0P8RY>2_ais-MP%3xrA)B
zGHKM+ajUHyNkjEiMp#hLt#g(hQ32xc*HE<*L>Q-d1`-95X*0dXULgdI#GvsxOIQ|0
z*pH(~juKmKhF0>Mg5CfN&MaO(-i5=|?={T!wO=;V!W83P1X*^63kssXltfJk8d%9)
zD%Mq?_o1<6CSrSf&P)BsT~P+O35u^cv}(u4Ji9rPS=%%52eo4ehduP1`9EabP5e>M
zKL>97pe6}FJ$XY7O!c)i#Y&B#=T*!pjJh@mC&XCNY(968y|m%aAhsFveFcNz9Q7s0
z2fSED2`;A$)4$EGD+^U}8<nsJW^)~~F%WB2XG9UAFfy8xufg6U32wDef<L#SsbOw2
z+C#^c94LB<U>zqJ24bf_1Ofcy*nUt`G$ZVR2R`lx&EkIJD<`fw*2IgmhFOuKZ~EOM
z*Xo<*(n2*#CGol70R@MfMiwKzYvu?U)Xs*f+c;ubGKr`GimEDCtGL2z)@|gZL)*Bk
zIbP<UVRrIwyl-BUi(ktkB&uu7K?A5cB=;W5c>vrR<b_He+}lVX($Q1Q2J&?v4mnH#
zN*Kibur_TBn<H<l0`QVen<`8Lo|I=37yTK+O`0Fn{kxeAXa&QR{^)x3cUzM<K~=>s
z4zOxO-DVoXx{|)b63hx}Dkv1Z9azXc+;fUAAS#`n*(vD>lffy(erMKFg5qzIoNjc)
z{BzzjJo0*^d+RCIY(_yB2pWTL@>s~qh;SlSz&j_)YzC^*$2;nJ8I&8ZV4wL<dQFZM
z1+YU)C%6fj7ktyBMqDg)?hIBrzn7eGIL0V~r(DwiQaPD9ZZ2f2DSKP4bF@c>fBzzz
z(}rYJ>puu9)UZmE%GO@sGNWaeqV8KJE&p;fz)!zYh3Uo<*#)E1h$)T`TZ@Z5&{=!P
zbD>K65|L@njNanJphT0<Uj4n9yZ`VvVVMrg)~q;8%BS?Ju}6P9fntqVTXHlg$bn;>
zAGE$;gv6ns<NL-9xl+TiLvZ8GvAXJ_JjlitM)~vL^TO8MR&_?|j8!=mo`P%7_CKdo
zn|Z9*txd*?)9-!{pB9yk6o$h_5{3fJ{DsPQW#r}|-*PZAu%nHE{Q$m#V0kh*uhE|6
zGwM|QH#32ZAa*U>k<@obL_CLvf*vkuxiXzc_b>($%JbBzy0WPm@#1&%OB?dHq?QZT
z+1*(M_yX@2s%wWPnwx^PU7Zzx@dY(g?Na$BUUXWDN$yK@84}E*cn52>%!??=*FE9r
zWneG6I$3x9pLN0tMR<b|i~s_x?oPur)oW}2o)L>M`n1{ZY1uNfz;Az%)b>YU{+$X*
z_#bM^dFsL{Br~;0s_Cc4qf21<oC-Czl$oKh@F7yec~kNf)}wT4l4(&-Wykr_c=OhH
zrdjs9u(%*rDz*<fEb=^{RE{}&3Jim;`WepyDbSk~uD&qYc|nK&vVh9Dk0t;Y8!0yP
zW~*dLRvr#H3Ojp55++o;ii&s*%<;A0^?(feTxmVZghvQPVD^4^Q66k!yIG<s#e{fV
zRq_4Q_B8RSV{ln11?!pA_oayWa`-z})TR2P1GO}(^}k2sJ5!rU|LW2D1|_c}<Wkb9
z!jyi2>#zpe-Aqm%M~4{v?60{Kv$nXIrTQZ3h`gfWnt}A)N;K+h2a<A0`@3@W%yM&X
zM1C3@q13PpIFTMW7_{trSH=ij<Iwq{goHTmAFDD6L&xkPvhlHbu<Rbn7X}i21h>Mx
zMfcz)h(Rp69x=Rsn|7WRYKdcV;<|j}<-oaPH`}+YvT4|k9*g*9Ph;;pjxb{or8sOY
z*DqJ)O%s^3PjW8aHIa$0w7=Wq=-+(*N6Z`&^kJ$;I>)kwMIAe>wO4G6`(|oqKMPUD
zF9c^qaV20zfdVdKlV#|<Lbr;T%Cv`UHXSD`x2(@~Lt`U2V}nIZCQ8NLPo_{{%5x*S
zoQG^_glX8pOT)(507T;vmSMCBcI$r$Qo7f#-}O@4M-bkEHisq9yko+;UygO3(MZFC
z-ZnZO6DBD?*mqtePmlbx%%g%m8J2G8)wk*EKAyrPrA$EU#A~)F6?q;y*h?KerV-jt
z<=W87vo$WIzq$M?HJ$!w=zkJ{oLPc5cg6=t!x-1ipWJSJcY!1&YfRYcaLCd_uoo(8
z9@F>t=vOi+zn1VmU<4`=8pg!8L0bzy`CE3!Ca~ZLOuWC+Mgu|1uDq{+NGy034S2QT
zA=-qUXTX^2kp9@g%?g(YMtw{#?ipxRqca4^+5#?UwD4GCCb{(8v9mluSU)RdLOQ2m
zu`=kTT_dpQkon_JLgS8p<<u5$NiQiBIxL!z8g8clrrNQb+j${VPD<aOWttDH`&oyY
zr#R)(5mc?sRT;*mEWfA^sx@zHk_34DgP`75F6vc0oZs{EQ7f63To@N6xMv|&7{<*h
zd0NEzWU}q5=mFzFCl}G923HHE1M-lp{l=PrRI*saimWim)GB?O@4v<quJG30msk3X
z{O82af+$V_QdkV)6k+{~EiV)|{0ej{JgTir{i{Ajdf#RWC8hLQZJDR~{N2$oVc}nn
z$y|LLO(+_0)JUsS%vk603v@50a`e%|!^3O8_ZA$2AYX_`koIqz$B!)|)Ca<~Lj|Er
zhTOSCR^wC=HfAX%jXreg;tBAyd-9oMCy@5e{e{x%A1M8aJ21oy%}dcrfDG_CMBu1~
zOEfK1rAoOqQiqtwkhSPE?wqZ@l&4?U!ip6^Le^`;j#BEJTxH&vv1wd1)A_Kjgww-A
zN^A%0se@mKmLspyc1oI4vFXy)gnB=q;g1(Tp^?i=)8DerVSXYVkJZgl8SANdE+Qg@
z3)ewLRnT#d@wuQfAtBi7SwR~LZNk&U;COE=pKxJj5>96Pi8-(JJa>5{rIat6I3FD{
zy>~d3I#i{IIb${h7v9mkK&9~`wDd=Vx!6qJYtrFk+9sm^9Jzn0d1Y$ZjHkwdBQVhA
zB%=Y)w?sD&pb3PJ*(RXAFiT=f!8%&l5lcgk)eF~0>|g+Qct|4j_7uCkUvzhsg)M{8
zov}`(r3=F4m6nrhnwvH(V|rwDxvd5qMe(%GBT43{0@{5mLvwTcj5Pv><Mn;XvU<f&
zn||7^jFXgAWu(&yDV6q6%=+40XBaPzJwW<kP@ylE9d>NRWE@AOH<lP92V}5|8KV^u
zt5tLgXhH4~@d_(nUO&O@->{~THDC!fSa*?HnIb;?EmE{4H{~rACgcS=m@b}++<vjV
z5TdWeXgVIEs#KnroiL})W+)+rJBuj$jVKf|Mj)d@V_<5;bPXC@4_qVHKIe3F8-w7T
zKynFw95fu7s_1r?wxUT0*LhIkwJohV1p4Ihz_+PWS|Lr0CH{b&ae<!FB+?{vet%`j
z8@=pqy|X;xz1!t~kfdvFl!Lrf*%bo!&~bP6PA}tiqJ8;aaCYG06J`w-SCOq&xaNra
z4$z5|c$z~u<a9wD@P+mDR@{NXRL%)i!EBkVR(DrQql+VKCWNU*my8}6y=FE~$sNlu
zZH)nEoI#u1;W);dm*bF3F(A4U(k>{qKOg6xLO=1kI*w9gWxNykJ@v&s!H>nW*$~+7
zoq;ZaqW(myH7h*WFRnahTiM>K>F?0D{T*>P$zS*C^fb(aW*a>te56da(?d=!*wul;
z+ez>8V25y$F=O*D7_$C=p;GZr_GdIU$hCp8llLwZTI%Z)SVm~5Q}6yr%8#euTB{n$
zSi|1x5}YAkG@)=}<eg~A9ZB#swBK21?(@+>yI7u0o4ctKW@O&^8*@r}Ib4oq%y-1X
zd|{#SXUFUB6?X5~9I%<ML1>C-MUh(@I}(jEvy%FqRiwKi`f>D8$R>x8&e~Cs7TXjN
z^o<Q^WVcR3E(gdA#G<m+Vd~r@oNMJXu`|lnUh{%l8<Z0=2ty$sCNEL&D=0>@<bf(4
zeW+ptjWO}{8u|V~f^I;@M2ifajA-IjK$&g1#LDK+fL|WW(*X@l$><%n7MsYVQKDF>
z^mV@lxB5r?ench{1wzn(1vdsx61&pBEYp=hWEL62j4@Jg)sV>m9oJGTuq<A?wFbpm
zo+c87-xrZC_%#}%!gtgbA*MO1s5fF+1(}FB`AB|8TTr!rm7xo<P8Lm;$x_f*o*5D~
zO_rYRrAP{<^UAYD0~)yZ2xzNOIhib5<51<vekmznVV}}QpxyB=tabf4sS7`{1V_X|
zqjLcgkww5dB?zOg`r<F&82!sPg{)vQOLei@&KXopZ9av$PSlo(pSccv4TMb2JQ7ty
zN(mNNpgl5m3)^4)J3=kibaC&MOq+s#2->Yd-9XzMTLOA0cfTa_=E{u_;-K6R7(@C-
zG~43oKaZL2Wbr1W?9ubt+E5|Czx*^c<^qH7%`7|I)ojYv<0XYpealWA8@{n7>|pV*
z(_BQHP3yp{Gn-Ii7VBf2pik*UXntV@_vMr2g;H^5l$7_N^D(Rb8T0qcJVR#(FU`{X
zty5wrL>Oj#kF0O%Sz1}#x$MNEPB%L%X^wV(ecTt`_kXO<rKW!?;798%Ix0i&7)*>v
zOs4V)$vEy!D!b|-g}4_~HzptXQ!~Asy`B73OW(v871}1VHAwgl!Na7Wc5Yd-f&#uf
ze4FEGSFeV)As80ORiBJkN9ZXYuwG0p>E}qL1LDUc0m#0Le7r`@6y_33iNDz)<R2_N
zJgH;CQqrvp`G%hGj9`$$-mmpmxlWeHzLx=xu@Uag{<ZlM&S|F@lviHN`w{Mjq7&{r
z4kE%IJBhNWR<f*;Nc2sxQofP0_)AvBbeM+OYL&jPAN8L(RU<g=3KCguG+x0+9pa(?
zeoNY|)|`>!o1kk+@ZD`7K5W}c3xx`4a9$&sd;6UuC36i7h&ow`FunjYqNEW@(B=5l
zjg*t{y{R@wD-%YM#GVWt^K4IwAw10a8aDN#CNrR5a5;#H{I|?1Z!5YZGL5->Ih<T0
z^qG9LI|7R*T7TuVZhzk=j=Yb*HV|NkO!|{4S$Wf%k<g#GB^E$)mLGCCV|p@re&}vx
z_zDy6Sqv|^CoG1RCd=(*lWa1+^5*yHR}Y6Wx=71MLi93tUWH<PKnwZFOTOw-Sf>nr
zjA}_WIa{akp_!hDi@H1(Wt6{x$86}72oQfV7fkqWg%xYHhPze8k}z?2V(tMf7y%At
zDnF7$mTL>N&e^sDP72QoB2{vV*Hetyk7I0c;Lrn#6)I9q)f|YKH>OCXgXo(YMo^t;
z%b8M#I#UHRZK2>0AWk&VtyC!F$^}8~hRQ2mco|zeYu6CZee~|n`vR_fSLiunldlLO
z{$J`DdU89MDKE6whhV@SK9_LphNuZH_M*%>&DM*VFCWuPET|1LKVX<r2CE#k#=gU{
z9dic&Y`&^mTa-o~fxlI?6A7+jp49FQ*jnlsf)BmEC5D84W?%nK@e~fX5*N*QJ=<Xq
zYUGuj7ctDkkwVHdqHe(NOv6h>Qq@kP<m}(Mg|eSYD15u1Sg+0y{>z=)`Ab~asv`9?
z>(CbZwEkuhf_JSfQ<Xm_UdLMBq!y&%{;!`Y_%9i7R%j%0VyAg7jNcyXzx2BovD6}#
zD7&t%GV23$vyl!fD1&nWqXp^6L0Iq~zHw!@SYASbC>-2M5ZqCmab7SVv!WKO8F*??
zJ`AEbuLnv`(#PN(8xu4X;Fg)LV8jWaQsJs&6)6KdgLBI3>>1P^Ni5%95W0!N`?4Z@
zAk$`o(!U=N#ARbrn)3y|Ta|xYag->WnY0q}X$IAD>KjNI>}Ls!jc@a~@KENypRTUT
zREV&;_<@`l+d%mO2$JJcfcRgrHyjqcGU)y*gTB}FZ>Jf{#TKGI3ncx%!Ad3nm86^Y
zpe45|b7g4=y-ZFyVk$5$X0n;aX`B}!^O81rPk?MwFzl@ZyupN8y%Z06$B1Z&q<%`J
z<vJKd7Xql-;gaMXQy=in?OrD({^b1Y8&!AA0r|a@)ZKwD`Wi7zjrGwUXz)3(E1Xo=
zVrU*>Ifi(Rv#YY{TmzOEIc|og&voymu4Z)w0j73ylO%YvS==N$Iqal?quj?*=(cWs
z;a>dw)YGjHP>|cxT#VEw!gR$<fl@!3#5>tT+%D~JZ_@{s%g^69ue}D-#K#%`D75vx
zK)*!3O=~L!4)d`B+33pVJDNcbmN$7|Qi__%+|D#8yA;=Ev}3CRr3bI5!0I}_5@hbh
zRVajZ;qNu*>FJ5EGAOQ-xS$hrT=5WJgUWILRiaP6`JZr1#yssy;R?bfOW1BXiZRCv
z7x|c%8;j1ee7a$;h``%us-D_lFO1gR1<Q}4{YrwcNIWXz2w(`wrC?-oZ3R(;s;xFv
z9P>`1Z}vVeNg9RdR9tq97T;Sv=02NKh3K%UZk-0#x{Bm*0P?{9R#5tXS5WaRP3~)=
z7IScqp$*{16i3>h139g3N28(izL+7ISUh9h5s?RfJVPR<E8WM@EqLbXcbm3^0RA;E
z0wy@Ux_;QpalJZB^gzBed~4RUULL;A06SG^J6D?k+H072BuLH*MMU+{M8Qy7=s5-J
zwyF(>O*7xm=qAM_8r9Jy^}JT141#r@x<jfB<tp6H7;X;>@+edzFQM+Z2JitCH-BlF
zA0x`bj*A`t>A`Zg2~Z2aZ_d@@W4FDJ%TA$_DC*JoSLNXSM>*&TMeWb0zWITA2iXe=
zFqU%>&4JFdOXuHEFutAol9|M|3Wq4Z56$nFn|P&1VQI-IPr+E&OtM!BI8FR73+U%J
zM^>N1_Ub>PN~b=lqPwhXa;aa3xHz?)Q3$=cg=rZdmiZ}=*YsSjD*4vb&gPK<4MCY^
z8yP3wQ^LW9+`|k*Z<<5@y)dU!M_O`5UT($1b#Fa9*gq`94gz<xI#+PGR@bC8Lv<;J
zH~eOLIif7SdQZMxL-d0--s1#ekRw71+RZDp?*6me<rk%mZ^Ax;9$RVa_fS4A9zF>t
z&eMfupwG3!;4msf+;uGuyouFfs@+frwd0q64N0W$+60xar_Y<V+0gF*%t!%spIiH{
z`3T1c^PAjG?yS?kxe2VJrU`T}!m#xoe56bplb*uhOAIumuCVVRIffbnA}utdcw(R@
zw?N(XxQR>S3D(GF_I{n`aMjp_n|e!P{Jqk?jrE#!FPqMuC*gb6cZ+lV!!)1o;U8Q2
zfn9DyCG&pl?*m`cUH*U5-6Z_swB0811K7y7#ch!#Av`&<vb&tgq}qrm$9$&L#Q=b%
zGn-soa%C8#qrKPTF&VCZd1OlPf=%^|%ip%@c_2L}!4a4Hr{EjaYB;DrYPh?)Z7i$^
zIle107p_c!2idBEb|byTUy(ZzhLQ)_*2wrlm9Z=|Ow-%VGn#50#*rQmdq!HOY(RQJ
zo838b`Ra>iY11g_#7N!qdy5z@_N;(X7)n|9l>x_M?u_Oumz!aa&{8T_cz6i#^*Ap7
z^9sh&bojsE*X0aKB{=a5(Ylg8BfbCVj<^c&<7>C}69y#5MlDjIP1=a{d+rk;BOVDL
zJHqFJnmo`tpc`jw{IvM~gz|JaBq=SC8z)pw?u5P6ccg=yt~nG;*-$xPX-C2{GS15)
zV@<f$ftGlgfPTmFsDpF*7I^z+&e|rNL23SvoK+mr^RcUK_!3<RY;FWUEPrscj`R6i
zGH`TiC%JajbNO1G&rG!|SWo}%#D(Za#{qtsE)VR^T2#g2mXo}qf8jL+Et(IJ9D>0{
zRrq0^L93L#W*;}p(iq60(m$kw@`b5X_2PId#-}p~%BKhj*kwTQ$w_pvb%atU9_eX8
zBy`xFF4RcZ76tLkTXYzr!y+iHTSKkd>YKMglv9ROK1f=V%o{51Z-^|A0kk6I?UTDR
zijB^syW+D5b84Hu!wB`WS8T+gDi;nnnTWi#RGN%I%hrH$-#c@PDbj0%2Z$$iP2e8Q
z8Wm)zGhWG-Aps`|S_9KJAP3%()Q_Bx3eZYs-~SS8@9QQS9}=x}@(?1fz@hz1{%Rjg
zKi^ah?PJR^Nm_smzIj9;MWTW}jc6aH%YqUHXkaNLS;H7fJ+asMA}APFqSnFbAENTi
z7bs*mtx$YWzfKU@BuqXLj%&<~Eg%#&FbuuNV1V}(3WJVyJn?Ig0lN!Y*t2`OHK_(;
zbWNcl=;j?K!}0f?Ul|619X;9Am#{SzDbeW*<6cmapW_{~>`0*<A?a1zn-e0+h$oXV
zy)0Jh$L>9uj>_Ldo+*kxG`e~s=iez?c2zU+*)K#SVTTy8Hl6%u8?4IT%zmQa;*JZ)
ziamY<YotPI@>|sn5kwdx5lmQ;$hI>z_FE%T^*KO=?!cRb*eCvX|67$ZC<)3O<3svx
zE>L#g>|PfiMxWJ4vIyn`Ljw%rEH@5mDECM>h;64QO%ML^XoT=BmR-|)4Q?cK*Glk-
z{w2t8gvrGX>^P)??k}vs<cR5M)n^f87;WboMns_9zHdlJk~~Z*fJP=9zG7=4Mxw0U
zBPt+07fP*{#&vPc=QKn2_TdY9ZSd;|;QMz3U=Zx#TMYb^Ht?uaF^=d~ec_;}5E=EZ
zcAL9g6IZH4{u)cuID0ipSe~*Y-4<~g6E}_79gDsikis}`LpWLjKoNe%=d6Vj8EyaB
zd2LFPHnDq=Yc{dZZm|`-XmX*u9(Ir#T^js;uKSyLRt6Dcn^!W!l(>dp9ClQ!R?8=)
z_)JwxnY_tjRuP5=bxs(CtI_HbV-{Y^w@i{1Z;Sn7zlOX*qs!mspLRey00Z5;umv?;
zX!t(grcCrYbj<f9hFjrLK3Sf=ruo2Ott&PIQ?CpPzk>GRI*gNE(2L-_j<w?D1U6Jp
z=_p(T+5BvI5UoOrm5vSC0fVb6<jZ}E2{9sPDeW4cI9}Hcl{z&-0^6eK^ds^@QayL-
z=88F5#Ih%D>kGRgQbf%@0)65=Fyw>E&KzU2aH(Qb91}<G%PIzP_)w#Cq6?o72YYHK
zE}A4J{M*PMuOT!4?7tzi5kM<J*)w!;O*`Qc<rk0bN%=dqtDTY_Xw>0)g#4oz`mBrv
zXe=v<8k#jX9lKbHmX8N&;lz9bt0;hSK4wXpJPLvpy9^4g6ZA@YXhx&3Q^_TcmjO8(
zE;)CQJ0FXBUGgLOF=vtE<q{}3ONmTAHR0%O*4N;uuy2wZ2L$N=s@?d?l-X0C1Ekvb
zFpBh5)_qJ$?8`CFVx~eAwM0Fe{W#D_&7QTlBn2tXg_|D2Z#cEwxV3oGwU6?0V}A&e
zZ0+{^U1@&(Q`AVxFfG5eN2>LbbkF8!^TzETJJFm@q?Cf%mN<f<@m^e+d+VfnT&fxs
zdfy+~*b~^iE6it=T3m2X=r>>|0+k1_yHb|qz^23|4W4`Xp6_oB{E$cGyWa&<=5Eba
zb}B__DF`1=0mO}>LcMchitXIrjF5f~!s~aFBJqBYDDD;Lcj!h4)kpnl+rk5GMOuvB
zgIch?1nayR(UAd_VN_jSMFu)~HeJ2{QuIvq@Cb9g^2NgOGgNf$voqHRT0@;oXdLy*
zioCtCwc9B=gW!g_S6u&%pS4~KX|8=S<7@Xt`<oJ-)^qp9bXh#f_=_S_*<T;(xIxaM
zQ!p2(=|kfvTZA0wLtOqcFwC%U#!wwxJ4h4o@M9~TeSUcgEg4%lIB(sF8V;}0qgY!L
zJ{!2?%}|K;%OTdoo<#9Pc|yaEe`#O$buX&Ahv*~p?aedmy-CuYfi=c(z*@et{}>v8
zZ6Fnk<Ci6`T%eJ>q`ioa64dU5?QauOSuriKSQH*A9Lsm!7Q|v*MXmvV(EOwOVx7cc
z3%o&>@LRL=bzKwrX9|xmuw}?8Ndn|^W(|nhhAN2rw4pNxD~PtfRedvU9`9=#qZedN
zmnxE0Jt;DgaB4;2vT$VGY=p}^^H*mkv>-XAM(CrVqlw0PDh<Orqwh&lR%k`-?4vQ~
z@HNKF4;|;s;B{lEubt8!-=n{{1W{0#&xI?4$p&h-g7Yi9*G{y=De)Gt*0P*uCT&A{
zIklN3H;d>HFJ@#85};39sL*c=A(;|Z#e3uZNLbTQ?4b0>{4VyI@4S@BxqXvuMfh^3
zT^Cmyhp!zW_CHro?Qch@>!iAnLlXX?2?Sppak^aS?l{OdxvN%$5KfSg!ly%>n#<DL
znqI;ZrnSLm0bg#hnlldWL^;ruS)f~x!tuL;;EI<lr?)b(r|OV4B2hq711&=_!F8UU
zzp0w>GnUr)2WY2Rhf@M*k6O{@z|L}o&cY;fBztQ-m~g5&z0*wn1Iabayr9DPs07$W
z?K=IVQQ?@n>AnCaaJ{^5Dm}I?&dMS**b1hetJ<KBq;Jm7Y^2~)u=n>~-m7dm{G%cp
z{w{5XRa#3>r+NGue$y>dT;AD5`KW}p-+7tZdyF?k%pn)jQ!I9n93(?~6-!kEJScAa
zYxK9^#-n_H6d+qLBY_f%&?1~KV^Z3+;vHEP7iBzx5cqqymSVw9%4PcdySl>aJ5v-}
zE!D%i<x>J-NLxPT1#Ow3Xy}Zh6kLAfTibJj&f>ngW7Col(b{Y3R{0pqu;ozdE*|5u
z72-b&9x(MW+#*xa`)2OEtjst~EAM#dw|*KhuUD)5&(&)B+YiW0)c<k1ua()f=ZzXM
z3EfR`+Dwsmqc{;=f-1J8;j}VFWSz}h&W&pz)QIi3kKlYfq6!MIF<vp%ZoM>gQ6bXg
zv^TyTuqn>`?kmM*P+hY(484tgq3BIm+m_A248Q3emh~oB+UPCxd!}U>1I3HGoRXRm
zF>4$)e!g`=z9Toox9*hlZ%vEl`T-^tH(QlU*%VCeu13G}`T;T=GR|u4&QtqboE7l(
zw(@)+{(^8m&+ydOx%~Z4NPDb^kSJz^$$1E%r8Yd8{D{H|dPuP2C=nyH!EZny7si8)
z!Fn88!{8bCpzQuaRL6U66)Ja&T52M&XRb5Ip96(d+TZR*AHI)=n3X8=OJ)eVq_XkO
za0m`Lbmj&5eaKmQvAg<!G<KiyXL=tJ8&6W>_T)C|#c~TAH6J@i>m_cYgS!NS(t=4U
zP<zFrGvtM^Twxu*b=3~!Tb*M-ZAG?NQl~G9t(=BEyn(tlB(YQOP3JtN=|PBZ_)!9Z
z`a1<Hjqm17-26YG^S?<_sf_{FX!hZ!Rw`qqmBH95KMo)VW40Q?*0_^ic`=}g@{1eh
zg{SY=Y@a%%spHMouRN#?NW`(sp7oL>5m0HN8Ljb0ZoaJ2+QjoGjMB3ZK@HZC_k%D~
zejIw~g()Y++y-M|87Z-7t@3lo=q;n%l*V+2868c1Z?S7M)+~xmK520mo6oO<aKZ}Q
zA{UO=D45g}R`$)qOB{hPS*+xl0ro<Lsa7Lx#oG3$#6$Jz?FIVK0`#LiPPsz;iYU8B
z^P7MnJDIp+rQwyo-}P_H;SXAD;2hKl6@CVKL1jCv((nM^1%hL3h8_nJVSQ3XcW)^;
z>;PhubT{&l;w||Il8YM51?VP|HB+Sr>!Nc0!WfE}yReP^HBQ6f&)Tk2F5CFAiD#T8
zOHyk@57c9C*5Es=dp78B@r~xJbzL;YHF}V%{w!QBmw4n*jPE_TnAE#-^F(f5Y`yu1
zUY0^b+o17CvmPNl*u{{stSg@OQ8IvoX6{3O`1sdiJ*hw)=d2iVWt*KCPU-Sj%pd>3
ze4`iYXbUakM+Fmr8W*z=e|+Y-p!5cbh837aI%0l3#}4+p2b*uDpYqrNN<25o@CZvp
z)Dmb$HrX5Z7jYU*sR*Ay>?UEJ7p%LMhU2|GxikH5xh>QiR!g2Shp54yU|_?vv)a_t
zP*-P&ZacJ*sEtwR$L24<`}DM5LY{xN)cX5167AixiXFXdL_|%q#&X(jo1Pe=2fUJ$
zyu}#(4-g)Smc{7Hd_K2h5_!WDouL&+L45Ub&o3*JxROB%ht;50F*fmUTcc7*+PML|
z<G)bl^_&VJ!pwx9^=4A}z-C|8`5aLUT_efshN&rUjWa>|t`^mVs7r{G(S8n&S!1O9
zg*7JjD(|VEmfepQlg@|*VxMzKgoMt6IINbKsdc=aJ)F?*+Vmi`cZhmQR{BMZ!r&$5
zzbpXxOeQ{T#K~*;0MVzo3-oNB^U{5By{t6A&-!uHfbg^i%Kl^YCv8I+s_Vj?Z?wMb
z?F0y;@J|hINtcLU5Ll5lj2x>krCtgDzs@EZD<zIKCa*F>>L=9{IPP^%oI%S?Zz$)P
zDcL+X{pMH$)4Lb6O@nMweJ6swk~dmip(kQG&S2Mrb+PtxLDYGFNn3G?2x+vDFD23R
ztlr+|a_~69$X#60WM&$+mz@;LQYI}xapNWQjvU)9<lItxLLca?Gmpsq;%)WGWh{P^
zq!b{<*b<R_7`eK0iHEDEREBga?jpzSsCVS4^kXULr0s=6??lb?$2sAlsQPQI<ikJZ
zAC%FSNVOU#W|h4%`?z@$mSmuxGB>mn=FDS)9xMqaDIt})yYo*58j73vwDx}8=^)xw
zx(z2!_*OPaL5lbTKxbw+F`Bd%NH3dPo%2NE5<0KS1>Nri(rU6eKUFqXp|vdS#ZZ=e
zp{@*Oggwurey48TXX$+2eh1weOwAU`6^-XacdgdOn=AwRVI<&XF1w!yJEM-Qn3YBJ
zBLwOeEw|nLvt%MNw5#qw4w(E~s0B~YA0NCRH5Q4KXyQ2A`CIoji2dsqI~OEMlQNMR
ztsaRlYSYI3$JVZI-yIWFWM6c)uzVuky7QF<Lp?|yn<bP2dbtKm79I=qZm?z-G37EP
zj%2f8SqIKpByX5(c7-69?*MxzR6V0>t=!i1HrOMm3RYYWEbKJNcnEtEp3W61MHkIH
zS~3FrfXT>088mgpO!Cn}GLW{^fe04Is-ksjmFPF5!M)FHXtJ=anu2@zKJDaq^>BD;
z!pU}kZ9r*dZ!S`9RkoAib-ts^HDrG#jOF$!900HU@QU?^zgYjv@8uVxh}-CO$)&8F
z*hsLeN#mSorrL<b1ISu^F^Cf&xX`L1bhRKiMzMD;6szodjIzL34<gqOr2}Ih5UF_1
z<C2m|BlT06cr4PKKSuuAk-OgxQxy6(=Eh2C49g<gIiPj5*7j}OE4Mb<ayvzWtD5l#
z*&6oeD*QR-ZfDxA=O(%Iwcd%t%yM<{&Z5xotTADVkM`CZl+G{3@t?-0isU<bB<4Cl
zq79+B-S;UAI+oNdy_JfmtKvXtA)p9}Tm^=|rg)zJTO;F@Ov@$8ZYjGCnLh+3<fzQU
z6=lwTWq~PoH-gqu=I0bxL;?@@{puM*#-^&G$<Ie$LNcGA7m<*}OrL#<u|hJj<r(vV
zhxslwgbB#1x6Dd~0<tbSi)~&mN$BgzG5Zw9B{8Rm0tL;zQu#ZZF{?De^-a>uaXgJ?
zA8v)KiK3|*)0AxW5W>;NM*1dGVg;39^NqY?xwIDbeR93XgqW3$G9=BOCw^ZK{-oF8
zZpE=D1y1No*T>b-%niA+nBd;QeUu7+y>J<?(wOs4lc`cXv#fs%g*0#&-%&Xi_*6xw
zH}R>B5x2fXddhoY>L+t-jWS?}e&d=W%@Ls5w=`kcNrcv!Tr2cJCCOgcHfj$!T&<pC
zA|pN+k0<4KY&Moegq>lS{iXqNoqclRE@H@Vmn6Sn<CD#q9^8$D#etaNo>H4sWKFft
zNz8nAgD9KDIYI@Kuvb}>2itq=8KlW&qASZasxL)rBvNOMqOK*sYfyl$9vvsr>KJL!
zT6RC?eNxrpUk~QLih>yy$EURJ@h|6r-Tb8n9V@e=KDO^sk^|=YSmkH<Mi#h@DfI<_
z%5fycZhW_C5uYO1`C#F+xs%01RZW`T^^gU7Q)?)tqBLEyMcHJ^I<~LNaLbHG__^^Y
zVG!j-Ol8=s?P6YxK8l1$Ny*1Qwlky|mfT~0ueA?A|1h{U8(gXEh;&r8B~8X~p$U+9
zkTvb?Wcw=XOu`@L)G#Z*FA}BKMa{qAmiz|7=0mP=dxk7;J&XP><o_j+v-q4zffwd7
za11B?HrFCz8y1@A!EnF>MpGUvn`q820FD5u59ig80WK4aL59Ky|2=}OwlQ@ud~9OH
z=dO#7(GN!X8h+Ta!W_S_AEiRvnU=u@o%tU~`9{mw5}_-dSS;+V5105P>xf;}krJdn
zSF!=>6J5aVbI6h_W)6ANwI(85kR}W!Iq@-Wgv`90*ul_C!4DM^I)o`fM05p~n)yBq
z*vTsTTTZ%l7TN9sr>{)-UrE_6{!K-y8cq8~<`c)0Dc2xs4R8m0$c8u%Wt_}-mU~CB
zXI5Tv?5p`tn;s*}SPW>LWpit}NybUzc%>*LdJ{wjRMcH^^9|T>37i1gd6+Y<ZPYPi
z8Vq5hw8=V0ht+L&S9C(S5?Tjh)s@k-VYpcLqZh>m!7LA>-=3Hv%q>k+Fev~blme{b
z1!Y)_F2|a3W(M|JXkJ#Srt{30kM(z=+;3DH0EiB>p932zt~KC;E(#pg`6zh@IS>$<
zl|JmrN^SbT!lLbUAx6scY(H+da_YYA*OQ;?chz`AJ|*9O7K+J9V19e~ZuS7tqg*=N
zo0n>KD%%<SL;i{DfR0+}x?sm$f&wPp|Jh8=|E&zqEeKk$I4^f_%vRJ$5K9^1aM!pv
z+e8xcOW9F&Sw<h(nknn|Ws<gGZNfYLBDhjn_U=slQwBP1x7=b+eb(KaHq5PR<M}!6
z7-i4u7?Gz+Wv@agD2l#DqL#&-WSQB7;v^;8oZM+gDdd~=o$W7@##?78n{GLzd9D$%
zo-v;Wl{kB-m^9$;M_XMWuL~oi*M-r>z>Tv((LFU3{Z$#MNB@wy&!9CjIu)-1N5Y5#
zfeeVOFi_dasXXF*{8$%6t!1;o2r#k^6W@PBEg>Y@=|6)JGf#LP_9*YcP-3gifYcej
zwAe^`M8k!(u{a{!7m(^wqZ+<<ZK(|Pu?;sA!&aDz13}-qD*HjMn+05%2{E)uTte#f
z9Wf4vF-^b=TGB#ZuQd@rKu(s}vN@nj2I}t>)#rSmQId!kcz$F&t!WqKKbR$>vs7Z5
z^g@>k^|meB8_B>?pI+0*sN;?K%pt?P@dfYK>n`~prQ90%XWe4DiFrjc0FfbRlsO1X
z9IqR8H=q?r5N2BlRYc5_Nv$x)CxNMsPH0~s&2^;!nlmXVb~?UuyNU?9FcPKq<xkGQ
zaeIgO!M8a=A*<V)pg6_0*b*tCvN#Y1rB0<Q(HLLR$)rd3r{H)E0U~X@Rk`a#cyjQW
zLMn}?bCt_uHzASAgS$nJ%z-h)2j7BtLt{<TkSGviCimGsH<$j6WYq@6JAR@xjFl^I
zPXguwsSij7O~H;pf4h@1hA;tnz2YW6VVkZ0e`fZv({%V#b<=r7e0cganc5Vg5lOCn
zVoDxf`laK%;0jgG_W48>KWP&$CjwR74gn9Kpgq;8m87I$Oq!I6*l!vewis$=)<*g+
z;Z}6Q+5Cg#10hONxd#5Iftw|sK9mP2{nYVQ<~MAOCekTG5CGanwFe1O+B|dtoQ;fS
z-L^puC{>vtz(|AB9|<s}CH4a|HeE5)HbPTIFM)w<t<j4MZu!|IZXwh+cN}A9ivLnm
z3Eif5)tpO8Dxquje-_}is|mNFh6Cbip|sxTgHnC}#N&z_K4lF{2RSZA;?OPYoliiT
z^~k;`^JkR0@vpy^9P6H0*sb`CZetS$%Z;~L+WoN)>SxL6a$Bc$JJd0GI2K2C+I^8|
zcp}yeo&*oYx~=&5w(KzB(P4PcTuiGEsv#PC3xN<(na(?1K57pKF0p&93DiM}7f8^T
z5+QUG$tv3Jl>!7OKFYe&dzu{0Y=JX%V~Q9F^qE$;$VvZIPJx!=j6d&Y7XFvPF6}cF
zYUZOyTbxh%eU-+Kcz<jq9HE`!{@??BJByVa2Gj2@>B{P}YH+vpp~QUg@p=_OlDBW1
zaDaTk&z5H3Dc+<0y-p;S5L~+k!`J-<EukbB2QX+N`MJ?6tY1FfO%Swwy`Xvmb(1Tk
zlCX;S+0>Bo@e7rg!%$(w@P5UGTiC$cC0;7k{Ld1R>wSk`-lIu!R-O1`>3+)+!gmz#
zPS<)cm`<vq+;ZXx`<XGnF@|dr_wjFZ`M&VaYm5xYu3tOsmkpUB5rrt@)z*TA(oRj#
zZ}{=PI}$@JIcF#;RoJmfAr~68)5etsUHxP=?#3NQa0a+U`PdKuX6GUgSAz@XH~Bi#
z$C<*z&1S((G+W?k(H2SU9&3c(^}J0@`L^e*u*retRNvB+sQga*F<^hk<$TIubgD1A
zYV6yD6c!zDDLy!|zex>%UM;e_@95x~s*}0X#o;x%=2^ndaw@>$g&sIQ_6bj3-h`tP
zk!5LTjgZ_?T4VT2KNd;(M=TVgSIhrz>GDs{3>!XG1vga|dKULBg(nQbK+A-)aI2b8
zbGlbGRes^F&kLoz0b+SXceP{z-vXxdi{B8zZ38orP!_Qfnj7Ds$7m5jHVck<_KF%c
zuX07k4%M6Hy16_YyeM1tVid3eq9`@9bR7{faAY{H4lB>hMw{wBLyLc|Rao(N*#K}P
zA=dK^H|I{fFYI&o)NOfdRZ8pSw4n^<*n|4cv8J86h*w#+<FGDHIazQ6nK73<+F*6E
zFW@MUu%xp49k)z|2M4C^SO%itfTsAh*((uwzY>uPIG|m-nV5iZOn`}|HKNWK`WROK
zg}bA9#`;IP&C((zuyy$;Rm4qZM@npZhsfAo4Sn2B1cwzt5QB6rV#ayNFe{0)oePL+
zL*tyBVjE9HXG_71v~faNw;_Oj6c;*1%BTsY04LBEn_Q27nG>U#Ttb&-)Rusm#aBko
z1sq@RxM1ExF)=cq{z9^bDlY9mhqaDVN6KTkS)ku_k1(}m?^L6F<(t7uJZyf0&{<8@
zFJ7U;biRbDIcWM}m9u&4VZa>U?7Igq>*c)ujs@0m&^nU+&Z~Cw`nO&>k6q&Kw?&tB
zm&}~*6i|^tM5n<)T51O*p?vCNsGACNu;rtrsH<WT*$n*&Y~fny-NQjbvy?xe4?{Cl
z@wX_UlOPGi61Nbpr68ToKvWkA%aPVy;M?Otu%M5M;9j*Kw}~<GdpaRHtMHD7T}Nt-
ztigofb;bG;b8vSSF010hg?i$vEiqWkjaQ;EvDh{lvs;>MM^I(g)=ni1<w6xK`B%m1
z=NdBjE^L|b*9nbTry?FEF)2+6cYbxX|F@0x&+8g{_ciHI{in47Z<AoBuqYVd)CC7G
z&>?}SK3_NIaUsNrht11yA=<$2jaLK=*PRg8`~y*xDN1TSMM-uCHGr|tNZuq;&L2(C
zd_cubt%^~5;#-u0nsyw+l?PEb&~DE$m7U5=-{859lIFiGK<}rzZa)yET4KpoevBvb
zs{{8DU4gc0e*$#lJ9gzrbPr~Je&M7x3?LHJr>|qOb_G1|T7u4D-VBgIrJvO;!LD>z
zH%_TgeP2R+K8-yyPk$ZL|9iP@EPY0zmL3iR2*+m}LRaAGkv*DopCb)S*3jxV8=C4Q
zZI5sme51NaU&P%4)ir;dm!-yxQz6V+B9YeYhcUL}xJ5zczTV5UevLMSLX<fE02b8U
z8P<t6h4+J?XB!SsZT*lX=OiM@*$z8V=5mRSQ<7LJdc&04NlBm3(P&Dpf>zDV<BlJX
zr%DBZtbd?ZK1VW<BCjCJsoOVTM>M-g`FuhY$HBn{(GT_FLPM--SrgFlY~QLc5{chL
zp?rPoIPt%kolJB+uDAoFPz0rK^_*UBQfY^TPGAmWt?CPWm`a}{>b3|J?a%SnKTzdU
z#xY@0g#XzWHJ&VZ-`2A|<27SU{ze;~vjZ6Fb6ZwkB8Ef`bBb;KunfRVkqb=$#22+v
z@^6Zi85b#yWrSXu_ou}WJvLLinn*G?nx*5Oa|pb@bCV_Lx@?E9d)#rS?)yeHfvWOJ
zOw+IOl+-GkZMxb9Wy-jk&qi<G{CPhsXPF8dac6K5EKIOu%j9GTrCj)r5&iG+c_Hi8
zn+Zg5hqy8VZrXQaLD0#tZ*|{{@D3kS`3h#QS$Pn#&<AcfN%Y~WVp5@PMMO=F;laAq
zDMEF`KF${uctZ{8<pmc(kJuABw|t&L%!y(C;yJJ*S#Y}MIIxr|fvyOD)UI;!r-*x?
zD7hLkVnJyv^)-Sq7;PWM$LIg3dJDd&x9|O%7`nS*29WOV?vieh?rsothDK`W?naPq
z(4j$6I;D{=K@kCO<ec-pfB%Otulek~*Sgkqy%!vTrGc7{Be9DYWXr}2ncB!~6q)*H
zjMHulSTYc)E7ylA|K%kj`w(o8s(fE{eURrKtj#pb^dRV&?S==Fux8Z44nZ!C9n?~_
zWn1{4TbNOmGd84MErmH_imtdqir%Y<^`iQ!`g5s@0IGvZB(M4$ghD*Dklp{5h49k0
zIZz`#Q8k@TAmfOW)4Q)<&W=8ce56>~fHGQI#CBAhuzlz)7FNC^Y%odsgF~MJNlg(N
z{5}cKO*ScZbE>YM-DA?QC<?aYdwX1`Jp*h^nFvlEhFT?#9K=?lIQ85zj4;AraNb0V
z@}l8^km-WMAmOge5LhK|K(B^{2}^-p)wE)J5DHb+;UqfMNUn^C9|XTYI<?b;zKWAZ
zCTm_)d~WT8>x}dNrtUnJnH(vYLNm)@uI>Fv`NBUt*_>Xm*w}c`tEg#PL{xXsS}+mk
zMcO4%*y`0_f*A}!iwLsH`q91tODGf*6{BL2^=sM_)3un5qDc|aev7z1(2n{TFeo4P
zDtJW6g~4~L25?Z8UmTpP)KZL*=7?ABf9;H$904gEcGyBaVNHLnRJxt(l!Rf1_n_!%
z?L6#F@I$nP^krM<+e&mPHcf%6axV9Idd=8*;y?!ZDD!5cUcdMBmAEI9X@thS#m|L9
z?%x=vUzM2g=h<90V`0H~jGvZV*gcCFLoDF#gi#6%PZ4)21)Y4GAs@-ZmxJ2yLy>4=
z8NWo7nNKRiz|I!3F(fb)GJy`+3JM4m*{#XSyaU@K67$fh!F5>V<LRU!HwOk5Zv3vV
ziX#dfS?&RdYu^EhIj=({W=Rhj9+NKamCRENe+}(K9D<xGv$>9%td&`wBt=`=AIi$A
zs#iY@%%z9HnIIc1)D=CRk83v@$!<6VhyF?;-9YgU?Zv@;zS%DSojWx}6qf0^h7)cj
zCH>Aca*5u`Zmj<vBAJO&r9o7AbSe04<}H_$49GG94P>+hvw}ZclCv0JgS)(HAAYcy
zz8a@0b(mS#UjoVk)Ne{!l<iw`<f4z?xoec<<PqC472icS3ZnvJ>Zeu~82jci38zKE
zn!n=23lpNEo1fW2rDVFs>ec+J!0l)w<!365Q7}d9#xtb($Q++9@3v?v9dQsO)#}D)
z+QsL5e*5XfGP%6nO(-+<dCokx{gX5Ki`A%E!Q;l(z(*y(xgzFG;zbma<BG%r*6W{T
z9a_>`d$MJfU@cQ>%oa1Fjgf82H?f6G%2<Be6*dGN>#%M<_)6(S?8V2K_%nXS!z1g;
zFyNr!X-{?4z^Fbt>{6^Vb-NgEJ<z2$N7Uj7;N5@~Jg8%f?|OU?I4>G|O5{4nFZ|Lr
zmNxmwy$3oHUq$2X(z;1izi-~@LLPtb+eLk3Yz>7d1(Vinp*(gr35#v=6p7;7G|n=o
zFf&*Gzsars7c{<gw)O$#@soOj3IVQ<MZxmFnl-|c@=~Lw{Dbn+D3eIcm*6F*pyH%+
z=(l-FmD57KFKNFKCaOIaea8|a|M-h835oj{Mn0bgPJ`vGlS#pFtwpBEgTKTym2bov
zdQrG}nc;sWM-|i({icXnqXi#|ns`wK>J!rXG|EatKUx2>VlwNuLPu+pRCmY;y7I~R
zK%D1Bsnp^k=q*Hf$8o?6ar;yB{uA|tn>XZoS^<3TTYV+5v-^L<!7v3H4#}aZSEC@(
zd18fGrY+3Gqm_APL5~EkFWfG=6W?f5&-8W4nMkEIqUlMu`})+`YeGjy@mstFg`t+p
z*#SpzSw`?bK(p_`!7V5tZ?yn57I|d59NFxr@$agX4O#l^XjZ(3h|wpq>3n{n6us?T
zvT@zQNW;KVZUlXp@O1qt0H@}f_YW2-JrdOj;vqwP#u&;s-6lbd*t`-j27}D!fzcb>
zD8<|g6RLiZ+*qJjfI&H1Xbltf$;hW3pYIw$;h-1#QFOkD3yeZ%ssAT8?E2I$+yg@&
z6!vK|e(~eZaztMT+j;v+{6dLq4VG|~=JEQ*CB6fIH=g=|s|wB|^9aR&AS>wassY7v
zJt*ZV2xz8JO`Vst#Rjr(xjS+;VIAofY25Rn9du`qB47YP!p}LaNxk2dSoVPL6g6&M
zid=kHpAo6etzJFmd<#$Jcxh#-#uPzmc0!+K1c1p7b1}zf<>II?%z4FW!`ngAK_~=<
zJK(C<7XCHUKZxGb=A=!Fisr6+HLRk3s53S3?O%{=nRQ5*-h3#HU5{htQcd*O@EKsW
z3x4%nz5RDfyMRU!;{X;*gFDd>F>a$VHf?DzLh97ok&%h@Y|82Is1d_>CicBh?Wp;Q
zjhhO{xVKbQLsa-cg$cn;(;8OX*<}l-I8aztm7f1vaGUu@d8!$|AT!FN^(se6S6-x-
z144G4rLn>*Z&j{cmH}|4h($vVU1TQ1izpG&q2@8SwLFCOyh3Gjv?<A&^J!D7rDEqL
zC?+CDL~nkl*tW4G*Bi{`<$<)I&xH)U@q+2@BeXChn2Gfy@a-h}bg!<Xrmu^@jM(JB
z;qzDd*LZ656yDnMVuK^hcb$PVVRisX^-hdEnGj2Dl&!-IQ2BYa#Yf7~--ilqM_4q4
zPDfPUasiZz7|15-?1l1@e0UbEk1~v$31B$!im0CmE_yh2vctGM>9xwjj!BDNS}5cW
zLR~u@8=Wa$JL{6naUR1+ArrjO11MxPN=fYrHdkOkpK|W-mW`z@F+4H@>6(-((P2YZ
zikYGOLxKpIqIZeLH`-B{VYb@i<n(})9sM<hwcF|>rimct*Av_SD(mML)Bz1LbhmBI
z^T<BX8|Qp#u^Ca+$Wi;LL*D~0Tpjy@uf&j58)e)oZC6m{zDZ8*0*8bN-)&*B*O^VQ
z16Z$#Av7PJSgbC$QZucWidPcnlMYvBUS+A6BIPIV@jcarQG-*{#6lphux{w}h~lYJ
z$9!QFc%j8Kr4wplAjK*PZe)z8<g^fMKhJcd=wg>2D!{IV@uyf)Z2L~uoJ{Xd=KpS_
zalkk_k0VEACCUu%+{SuVM?d~A)y)8RX6}e0-LYR|k301!pmBu92bY$_IE{sY>%nLS
zEbJvXM$a5p5pIE>;{Ad+hT7irQ;Rl+I({Zg3|LP=Z*>=K8S8*;JfLhfY>X_p#M#KC
z*ljpXoWo#NoItayg9r^5$l4*?O-3i4ZyG1VO_PH01HxYiYzVpuADhs%)pWrfS;Ur4
zC%9<rs#YhrjlORgoE_2X{}AqCSz~qYqvIQX^ciPi?32dVQTVSBSSc+X2YfAQNt6G_
zMe|;lnj<L=Jl<=&zPHUk*c^t6DbWd1WhTyre1f@TOLpX2F46M7`-)$e=Zu2;Sj)I3
zP&R^yR-?r9@IC82Dakoo1}kN?6o4s?=nN^xFM4ZK_T%(h^!Bage5KsD?{Yt(_e?Ch
z8<$zC2=#K3{i{V;(Qm?SuIA950%q%=`E*&nhHcFsmU4s&zE)QB6-<I>Vb^&%K8WtP
zFkQiL!30L6`?;*e91H?JO2m%bO2Y5N7YbaU9|Nuyc<r3^kpynN)#B^xAAjd#Wnv1H
zo*n*|x78_Qr+k^AT)-qnJTR<&ujsr_E2t01M%6j6<d0P!)Q6D>rVpeY8<%QxJQ7u7
zKpRfS2~<Gv-uMJ~P8qM?bcWU9y?MujV9*U7GF3g;n%hVJ$R-?^gjs)5j`%0xLBO#+
zy(7n%A&Hs-;)Qquyh_w6q+F{TyQaw7kbP}-S8fcSO@2FG+X24lElc?&*p;pdQ2P<G
zdpvZpuc@6E2W2L07YSR$q8e54K16WY8#QKBcGZ#_bI$k)@85PMEh2~*<tO96X;`sL
zsZ;rk-1whKs2zxvxDAIU4fsg;F<>`&oF2hq*0rW!u^)T?3XwuGn#*sE+6dKk*iqAR
zj!X?^N+m_nXunL?JHC}g)sgDf8zmGya}IuC91WGzBQ&>gqxXc{K}ub2hhbycs;g5A
zkR2-o5Jm4r&<82O$4}%VjOG#7+E{$VIf>+0$y_hx8Ij9q^5gbbIP4&z!RY^*sTsSZ
z6er8uU;^kU`6VssnOI4jhn7@`G-||7;G9ytbIqT<R^(F&zo-o1uteLL=24DEQlKK|
z^UWOI4>e(Y{uo34ORV@5m1Ir#`FaEWVgTMbp%X0`1klM4>j*NxC#MMLyCn_xm~w))
z1-5z@(`SE?IM<U#<W@JEmL`{3Wl1SZ7>VNxzg|IjVP3&B9bu(f)P<pV`be!8akPDa
z%K@ONiiNEJJO_hXfNXxbg<2K{Qi?v($qs43lD;7$9HVXy0$k!gH)p6uzf|ZAk{gy%
z<x1?^D#_65DVbm*L{f%6Y7;$e@!ib?@6lJ$?}Cha*{e}VC!>2t^)%6P)V5}P{$D*b
z;)LFkZ*oUEfxwD79CAZg$0xr=7P^L8(37uY@i~{%7xETnlpm0OJ>#fj%dUV?dr9dK
z(GyldWyz*{{GS#u0FBdiWjyS+PvR8{YobwPL{h~I<r<rlhl%L%eb0u}D6jQ`aB-mZ
z%<*9NB<7gRN+VI|A_8hLZ`f^kuco1J@Xnk^Y0;e;tYE*)37>1$LQ>F{ATXck4^9Mp
z*@2d^t|EMg{3V;43PN_yBz#4OR4xg5XR3P@?D@s{Zx;83N5JjM6J;5U<-JcmyQ>lW
z9R<A|Ne3whc+C_6hz+*i(V;C^o8Vjij3>&v3=vARm7>9BDUYj+6u>+8C%|{s6<X0`
z8GxEilj#qg)z^o&jc>}yvVSlq2Wh=AUXBlAkyj=JA@l)r#;3f`VEj9udq(zfww*Zy
zkTdgl$4I$Bpco-3yvNJl*Wr`NNn<DO{BoTOe2vQ*gNHe1@fl|$eUW}&u4jx7>MuF!
zX{TMSPeN664Xyqy2L7SGBofQL$Fj7w84%vGkS?P+|IQbV-dU{HQ9jL4EZ<9xGzK3@
zX9kqEm)^}q350ipC;?MBc9$c2y0nGIWXN++@Jc8<pk}A?UwU8pyY(S_WW7<XQJL}#
zHM7~I2uLO|VC@DZ8?5_;8*mIm%_PaR2~l5zihe^}2jnj-Hgvu38fN#yC)zwHAwO?P
zKmT+o`!3@@mdi)|`Q^!KLV>yw3J)nT@>=_=Iq!^gHK;V7!Th)7`eNR5BCYGm#L4??
z;_MK(NdD2W8UJGwdP#=EVvs~O(e;b|<<y9$tj%k;H@?~w{dWOpVj!IFpDm%U--t@b
z!l75E=wV;U{3+8606hGHJ9Fp(m2`ZT`<N}1#4JoVOZt)qNyjBSi^*{7LlFNG>g9sV
zuW8!O&b31&zta^ka=0U}7jA_X3+?IG$+$FU*K$xigv`-Ro4Y|_GqADWxE(HdNdJ&r
zug~QSTZP4pDZAEqjM-ie>rH%D+LtBijVdI5No@j<f&UO<vP8CXumwJi;ksexGfAi}
z&tT!o;%_!+3}EW;YEUc^><;ir*_o3~$8GwkPT*w1POKJIQCA_{K$^IZ8{FBBg*v;r
zfS=OLh&zxD>mO-bQ}HG%Xc(MhAk#@jZBKSEja=)dc19#HV`$N+&b~Rnpmj3L&j>&U
zSh?frwrOORHo#g@Pv-W_t8fCCfAZPW@EBuv3Ba-GNXLoUGB<(5<lN;r445S)ABtl{
zkvaDTDE;{OcjFVFdepVy3EZ@Gq#`8<;NKm3OS?UwFoRP1=7vU1_Q?Zd=Yt{3;g>|%
zNq;7`R|4yw8|<e``<edMe2>t`@P!Oa$0PL97|hW`8(((uf>)E0VGE`|xgtD6bgIsm
z+0Hcz@as067PML+41iz5oA^|`)<2q5uGS0kQjYeT<LM|bAmq)FMr?~><r25iV<_x%
zE*K@f%7I%0v;^8P5i~hdhHhOAyam$7j&Nr~;-JSkeaHC4y!nY;K_YYN+H>254CcRP
zZ#T&C`O<qlK4^F}8ed~pQFPBa$^6C@9j=1p$OGgD9tvf_!c4mZ_Wr$}coPypSYg~K
zk>#6TQF03L8nb!-RTKXObVOjxBAx)GUHD)#ibsw2<Z2}_{N8PVwy;A<60+?Q1@$KC
z*?H}Gc#<4gF4(*P>9_lBKUwsr863logpgVrZ!bp3PcVFLbukxp_srOj_oq}fKzE~x
z<#+1QbNLpT)FtB=Na;6ofTdS_u6=yN#9Lk`!4t>GO*9&G?mxy&<-|+H(#qFA%9{<w
zrA!u+EITaTNtE1`fFzx4Qt&kf#kF@hh$_Xfnp1Q>K@Eo{bK)Dg0}<n@UvSzUuf3y_
zA+kV)x*;4@{Qb9{SbhI~i>f0>=ob?e#yCB*3yusJEH0%vRS{|<H>4<78CmzkrkKzv
zclPX!c~R@nN6L1>2)U#Cm~iB9iAt%Z-!+Lq_l-i(*zk9y5u_xgt;N20*8`lGX|tr{
zk(!k=R|qUIthcz4-yD7O4*eLiCeNf4(J0l|AzIni7$;brrA9thoWm7xgdzyd?)q6A
zy#6QBT%W?H$!;5H!X~9*Qm1%K`kB~)e)ETho28?xQLA<N&rj(8LZ1$xII#8HtR7Q+
z{-;+K9>ny1yYV1k$y*}@D+7fm&IEb!87`q@3j%C_m_UzIK*53I^>@^AI&^CX39-K2
ztQeuCSeZBe_*|t-^vyOUxdJ9L#NIQ#a}=0FyO}n*<SzS|Qtykbbig4F)zB4e%H0UW
zqQ|BH)5o{x7s@Ue(;Z0-5%5j!kwl$ydIDK5@w2NIM98?5s*eTgUHcSLWdmBt5osGE
z*G&ZjAKalg=&pDs6+z1(*2YS4GRTxO)f@kh>$6F|J}Q&H=Ycbk-4V?t5vB3s%L_`(
z!C^GPQH2^XE5_nEW28t;QEw@N^ntF289jLddd4>nv|m%ePD}*1Oj35sIZdvh29Er&
zuSa+_{d1x}U1gAYz7XJi<?je@tUT-V5Q;zbXx2%=T}c+8!-hG;L{yQ5Y*(JwmP(b+
zjAOC-*aDNQgqE9uZ;4{D<pRGl25r7$1yp9=mR;}@700ZUoZVpfA*MJ{&<|;czz)`k
zt>0}1R;hgm0gD#u$~-HE|K++9)3^2PK2ykf2}~TFezpBDJ|}`WqW%E|Uuh14W0IQ8
zFsnDlw`(V1C}ZA_#m=^VR4RCAPsQNPTD4eBeM|=b)ezsIINMwLQ>;+!!Urk_sZG>H
zV?9`GB(J{2oZ)=a`mgdn?CO?6HXTwBm!|n1mfYEO4Wg))8+ms}!X@cj-C<;_o>$y3
zC_+D6Y#kPZ=4U9tU*vMDA)gJN$)yEIaN+@cNsCOxH7V5N(nm<F%5Ia@aqr#o#)1+5
zzPSbv#zx8tD4r(u1OF?L{L_qn>5J0v+YNpc|1)7vBPX4pZb<Ik#5kr%a?1xV79eFN
zU{k~`4e~_TcZOq`xs?~6B~Z{B#?FG9Vp^g%8EaIq`o?FT_3`A!KNN^S?SPA{DEk`q
zt41<e2Qg1homkY;C2jp9o-tgv`l{ZPa%;HXgjTeiL|0695gyk^#Hf(TelN_;{IwoJ
ziSN?KJ*`;sMn#rZbV4IBXF8;;Sjl)E&G{*jjGf=0o?<C@UIl(E=(BPbsZXV3N=cZ(
z%d5w<V36SHID|S&QUx9PEaKTjP4X0O8U9PUFeimi$aKF`3A3T?-+Urlths=0H5Wh<
zvDb0L)=UbSK7)>_NGfr*fB2T<z6$~Qr3dY#Md}d~jG(%%c36OLVPoL2T5&zOX5~?Y
zL5#LGzU;}AcOv=;)fq7T<Uy$W5Mzq=XIW|yg@S7hp+}>obppe8^la~P3v}#k9e3ND
zdT&AaklQT@bNfFU-3o=$9UG1U8IHp9C=}roDItBWYuz12eKy#TVwWl%L#{IiPseE;
zH(;wZJ$niKg(!v9w5Yc3ZVP4T^B?x#oPnC%W13uiS&m~#aRSOzb<$Ssc^hs|rZ6rX
z0Rr*06%}KfxVtUJAVo2~E2XUh<<_;*b!S>@`3wrUWUEMZb(6lzmrUkDSBg%*;v%3i
zGW3$KJ)v_bjsR%-1!#D%-B0RM3Zo3y73Xr*%mz=0#b|sb@?ux*07b@Ul(%LM=Dg48
z2Ccx;C%h)na&X_xEIsEFqU(iyd^@Djc)ncS@Jn<U48dU$*<QjKsEQ6&#3~%b)*cIb
z?!EuX68=pRN9%?j8`2NO@2kjO$r#2k7OdaEC;9G~Xe=>Zh{mLo;o;IiH&7_7j|@>G
zTuRs=rqePlxLT{0+9s6tC3I5exa~|B)s-6MY4krBE42sLj)>*Fg9~ehfS64(+vSNe
zCdTn-DZ51@l0>u$WbZS@iGld!X4Xhzav2UA3w=^spvs*0=O(k$-Pq!U{45;VnU$Z(
zedOr>kg7Q*)n{<0C$9CR0-pNVG7jd!*}qrX|BwhfFZ@4p5b%UsFyu5HM<I#LhGX|F
z4y@mNuM6o)d#H3;wmV=(2;xR^mjW8a7zJP4Cc!90c;zg3oL<GA;oIbTC|y(S_0cGW
zI)Ih*R5TesX%oGFr33+v36xANOwC3G)DnTz${=<RGNf-4K&G%bsW>6rX|nN=>kLZr
z%<{zwq;H5{0w(q1EZnDA$M+0}%&!(Q`JL$eTgca%%{E09%0=I4*LtqKmg#n*T0pTX
zz-H#+6bJG`__qDvpQqTa&n`nwN}P;=HY$RtVSF%^d1B_`VH_Z*uiUHG7^xRY5+8_e
z*;9#uHQ&IjesNiD8(92??n5J}BghSgYC4BZp9qv!C#Vr@48g8*1s+kAqG>Y8?C|^v
z64|gm^Ff+sBRf>Y_krayLsFw_eH3QYZ7s*&=rC*1JQSW3TB!y_*QCQu`ifD_Lo9Qn
z={;g6m?u=YL$eedVMPf*3pi0%xQ5=oLup1|)d+sac0t{3*gmO`Q_c{kAdAY+@W@r+
zOzrjOLgw&kc<|S~()1z&fDq5fOoQ3<%j|Mz%l0llr5;eAwhw}1!)DcSGf#8=h4M2o
z(*{T+sBrF2%#-K*CHEe=3#c3S007)&rYxvuzq9=o`ODuamdQSIh43*!rWg(zzd2qx
zxha2xk7@QQ8(MAyC;jGN(<+=!)phXZ^}Q$DRt0YxVibMh{erJyH<+mptwqQtw?Yxd
zN{r3m!`416D^Ji?WHv&@-S+lt(vPDy-q~=06^nUGlQB&UJL>l<2HW4#CzMxW$|4Hq
z{2X>Eb9<>6O0AyH%F&ZfW%`TesiYZA71cnNnFg@bRrq4|a4Pitel3mGmJJwz!06LH
zM?^bgj4{(4vA8X)ymgU@;FId677q6+dO+Qg$mKBcDSQMPnNj#A1G5(<kUX&BhK?jl
z%#GOh(BWV-zwm2XQqF!65i!ZbK%nbJ=H@=e67o^v5H3dP6*rWmHCvqFCG5!FJyI72
zrCXHkVhV4!t|l4_3ZCin5+nFNnj|c*2Tl_{oq`WIvsNU8({eCNvLEW!p&ZB)C(?{!
zE_3e#UMO<myUrd|i*^!(yZ+-4{i}oOKRMnUl*2eYh9;Uta0R{q@H{@+=$2}QdzECQ
zT-UHANQVwJ3zxDrzmJ5jUXY3!u1no!CndFisp(imHQeoM4NvS57u3r0VJ2XnK~>9X
zL3_-FI0l*lA=*3?iM0>`m0o?5Gzw<=-&x~A>>og<R#N6V6DW0kBz1XQ$<tn#%W@v7
zHHbdR?0r88Z|F`3(+HHQVQ*r>Viv6zNt)Xe*P)-eLDmxI_K(U~xGg)CD~X;tHl03d
z?XW*wnaAninCD3G-^9`AU-n?eE-q|ft8JY&0QpB4GN*E6OO@KL{?t#WI;;P*fSc{}
zARwAZ!^Fq(mu^HN!{Tkye_FBT0$WKEY0X$&@v6hKa>JSve_NWQep#uMxVq+Rj%53M
zAdG|G#Z%i5<W&CFOnv546o?c!sxlF78m{S5loTI%=r3D{7e8C+&S=>mV8fz79?I{f
zA518Lz-SVgpJ{|?k`g|XM#!SYzf=NFG;S&WZL}!IN{U>`EY)Zrf-9PBWm)PT+x&t*
z_xU{iMF~8Iz>oq&Vq8}34iaj+9er!Q%`1YEh}e=N2{X5WwXH!mc_)L)$*8=g<`>yI
zD45^~%wn{?{`bD!EK1+@rBNKK`FU7r*-X9_!5XgpMDHTxe_i0>B-PNX)9c^~f(g&O
z|J2cg-@rYvM8;x5op?@^NG-HwvAxA_31xAO(nzh~?j08ezQ|gZ#muB>Fe9|zjC;yL
zwkVk}agoFBc}l&eLu?@WZN+YO(-t37dGhuS7|v18p3Aij;r}QC>7mv&KY1k@8XU<B
z)OvPbTCGUo_rteetvD;+I@|^WYb_6{#%DhiKth5)!wUi3mZpH2enFox)RSooQQ)+S
zGFkL;a9_H|f$if=>L1myq@8nv<bsFN;Nbh^_;+2tcRJKwMnz`TL`)zT^uI9()nzsL
zj!SY=+*;%|TKTCmzkz~mCff1_W7B$$GEW;_HMB8pJNz!2wt|?vxW=*Ee4M632Jt(s
zqGRR~-5g5I;W7$oAKu$xSN3`cszTNO(|>m2Dwdlc*!N*7sV?<?%}xBxW6dyIZ3-V|
zr@LKqZZn>wwa2<E>JO#`$spK>ENUVAnXx=7X0H-ZaFc}SMTEDEd-E+Z!LpJSDU732
z!%$y_slcTRS#9-^&K6WqU~a!xvn<DbLoA&DFtP_0D{GNL+;m^iXRxYxZdO42tWgrs
zZUts!RUgteY-ST^4-8*`TIKCr?}mFKp=XF33c%0`FUSl}Y2-K?+SZb#9OS3mtWiUp
zji11l1<GpJ8^f^e-A`zzbPi}rUk?$HkDtq#zx*zPCw^B+#Dc+C1*MxaF5>RX>y+Xo
z@h{kD-lt@_=gsDQv9W5(9bAcrAxa|g*VtpH4sZ52VQUspauBGU4-0crk#-%`k`#|A
z?~J#t0!|yV22(eaW}-EnORR#V4(WlmrvxwKwacGm2){*tWPbozFrvPzFW)T9tf9ox
zhTNSaA9a|lj4Kj<>J!<n6Q3g2N{(B%KPC)q2cEpgGtqy_Qow-5k&%)Arg`8c<5ocu
z@i7qwnwWW;LwsJ8GR8hlX*mn;$2qNPjw6Jfp>4cz3J8_z=G8NL{T~Ps`;(X7z+v^S
z@lgYc>mRY4@-5<#njW3_2*HgPBAhv993jx|jwH;$OAJ6WZQZ2T*9UJ?a4YaYZN#Ge
zr}~h-X&lMkHGH7(_(uDpDP<myKFae&eaw#V#EM2^W+7U&NE3A&ngT8CJ;HC3B1Yx$
zH5Aw3`Yq}ucNCLU-|XEw%sJ9GZo_Cj@-N?vQ1#4$vYN4keYUSsRbdT2v^xaI#osdF
zMBY(TSHI}uR<8NUJl)=%;;S=9z$yEq)5XQ4>CExD2NL}Y?0Rxd1TRm~-eze_F0zKW
zlq+x%b1&VpH*N!XN%^cPoPU|layY}um)MF#k5(do!VKZ%)^oyc=6zV<<5%>=``yFK
zDGFZU3DI`T?O`fo-Ar_Ok!tQBw3L(`TP@6n7s}2^hCz^Hwz&VpP@1#H5|?cC6)4a+
zi)>yIp|Y3BltSc|yIZ5Ht$LDD|J|<)YG3TdDtAmq1f4JDMoml9KE%PPJGMRxP4D&D
z1!Z_E;8TY!BKYtyv1+bmpJl}V@FG(g&HMyt%E}z+vNptUR>>5%7g{8-h-V%T2m!2i
z=^C#Lz&#_#g{}`&`b?G=b#{-4RLrJQl$qn}n3by}<hY5N*a2uRumNA+qRECds|W{s
zvv)e^bGfU6^@C+_GUdN_4ZW3!^Z+J-?_?QPw4^w1EM!FNV;4C;aph|Vo=n>CLFT3F
zEf+q65UPmM)HI?rEaFP5aAg^dyFQqA&K_PTF0Cc|C+k5Kka=AScpXQ-2Gu;@208!c
zjGO2BUs2G(JXA_(H%=IP89nh5Z{_rDmeV~$TrbD%Q<xMJl0?Omf`O9LBYLl;*;YuU
zDUrT$Stg&<o9pWo-C2%Ktg~-k-lQZOGb0!osK!!Ozp#*{QtJb=9OY_)9OBhi7hL^J
z@<X5o*?sXoi+Ba@a!)%~4jGMdBW^xfr=N|zv8CH}QfN>z-cvmHzNFW-Zmf{E&&p>;
zKf(Ip#ce%p#jEhxbZW|!WSJ~a;@Lqr6_)ZF+4`r2<iAS^{zW7m^0X_%$9HNaUa8zU
z%h`)%X{ecZ$&h$niMiq;jazt5ep?C0-n!=PH<D<cAP}hXLM{x`C*~dBykO?SO70Y6
zd`~6!hs(whUmD~ywvD;rr?hkO&>;h6_}zpz%~0|f=Bp)G%ZFMb#f^c9r--M#5UqnN
zfCIHHFLU%_M)7>TTlNuQXPLNy7?TLD(nOsctl(+l^Gf}j<a=n$8}80Gr%e&7TTTqp
z^CUG#Zq}()qEhB>-Ns2dKIH6&$dkzEpy!9hytgKJc)riPp7TfsPi`DkS-5RL?Gp9!
zO=?De&UpP-pgcSkQ^(E%Z3nO*SX0>`vy))NVw}FFn1L&4tsoS7v}QsvZjCB+puM;7
zb$ACSUeh*61ZEi~P|ti@&&VGcFn{OSkX0rAVSsOW3b)LwI^R@?jJzkJ2lIxviHgzQ
zww2oXcT5LsI7|ONwn}KYUcB?G_tWt}&YvfH^tkT^k}zg>vE$a_9}lsKnL;~Iitm@-
zchjX9m1&zrNA6Q`k;D)U`Y^Q6W4+X;$jP(cASvgyNltC~S5$lAD*Ro5F;Fg%5al}B
z=%hjSh{pnx!OW504-=^;&BwXlWH9Kkb2sBrAI;xd*fS^C)RykkI^K`Tl9Q{ONJiyf
zs^&%K&SkRg#6MoJxZcYas6@c$OkNu~L23fBLcV+xD-1W>N!fSX?wX!#pa$g#prBqg
z{2Y+-c(WuO!02N>(Awc$MB}`Eo$$uZ^hj*un?7*|(CTm;?YD;`8r|FBC<sNQYOWSy
zcNk2AL3{cWe61Kt2Xnf)44Su!Mf`s0sc{n>A)Eyx@VR9Bi;He};txc{&Q6hGzNt`5
zf!d>u!+%t;N$tS@);=cDoxToXhO)DxB1aCb<UXZtq#hf!=}mb$jNyqjn6eDvhiCM;
z!;E_kk$-e?^hIq7mY{Ef=(GrUMxm->9iaDgMag^p@)8}tkc`9QnezPBLO-=6+Bw`<
zkT+(vfel^A8!y)Morv-6ITf;-%(~Nq7#-&L_fzTPOC$S52BVFG8gd+Sj-7-KrH5aB
zs-)T3bZQ6cSU|cbDHmHVlJ3~6SX8L59CWO;Nc#3o=VqR}h3%(q;ja#Fk3nq}z^zEe
zq2A4ELCOv;rxQzJco$p?<diuw^0?1mLmb;<n0GfHc0fc*+T5XR0Ey(4!}Eg)5k^&D
zp2$iGm<vkT^eJ@^Tk;r+!dQE^W-o31foUY<-Wr+H!Y3MY9uJf|OX-x4K-4qFg~-Gq
z(`B+=L^Q5#DF}bfiQ$4|jJ}{mB&Sc5&D-Jy*q1NnUaZ;BYD4OSkA*+m>H5&Rm?t}o
z<nTq@E;Z%s+m~lkQ~{B)L|T`I*ayJ3L;GfpS<g1T4blIR{%Of@CkP`G>;-7*RPHcZ
z!?`-d<hhdnTr$<+u(sPoQy%dYEtN~7K;3usSK|ni{M?KT+ZNN+(z$k9najq9VI-FV
zK8t1^yQ@a$4CN(;t%b|EyH3ZEQeFr=Ow(I6?x~7o2f{5Wa%Phgw5C1p%ziJ#fqqMp
z(HpXwZG4C%W|h-F3?0r=rK#W|smAEU%^nainGh9K7K}Gu+-@hi+lhchtd41%4XQa)
z`j|Zb7eoI#3@TLn2xtcB<(2nIr}(o7m%A4x$VwX0fq1>iz3W(N0oh1+gQmI2-JuLx
ztRnIQShSt5wJ_;Gx%Yg%y18@EvK(++gV_hYkZqHan&$E{4?ddr#+J6oTk$-32uFSz
zjFNB_eltuQSS~z8dZ}S#Z#CbC`DKsr%oStIPg_;11}2C%DNe&!UGe*rYo(<s8XYg>
zhR@bm*h_xl&P{oat{R^Rc%0uW@%J(}p7~t$`5v~;o8UXo!81zyTzF0*$39K1y#G$E
zIKmn6+X0K{yoe7MuL8*%8ooZjXJZGbF-f;)$1QXD8}IQTxR3^~Ulp$;DR5yZjpLRo
z^sWF^UZ{M4zUGi6yo<f0htsG{#o#WknnCYV__Yafh|^?s@glajHK>SW>OXCbD#12O
zNZM}Q)Ro@#TQ=tK$ox$*dz<V(ADyMPZ6__-iT9~Wwrb18-J&6C)LsE$H~QrPTvY4G
zG~~!-{g!Bqi$zk~LHU4oZfT^yzE1B)L1$_fTB%1~cJ<$DjPogD@y|6TRKUS`SMNuN
z%E6_&_N%A6I%xWP#}oji144&O*~J<9n&~C5qu|mJIa8>S2BNjwi`b+k2Bg?G+$F$_
z$`EQ`N+x1w!W`<TN{%qHv+@PMYPMd@S_d?rg$|zVXf7Ww3Y#|9Uobje>_+OMC5h2l
zU!><>;c8K!&k_X35;hh_bc`D`*Us9}+G;dU7<;fO5?J2!9)zy3VEEhCTllay(d&JW
zU$J5bpaPVFK5SufYaeveY?=ku+SiXN8Q><U<@s=ACg}u45R<o^j@K+Te`tFApPsA#
zWG?!WT$q*Q<hM&)`am!=0$*Z_kE^h9nmP$IkXjy~xB@kW!MK$RlDNp@^84E+Nbh4S
zT_RW*RL=+-8vvcFDS@};+I;am2X3KipQVoUg#4nWWuym4_Kka9h2e@4L?qFonfTf1
z=tnx<G>nv)d}tm3T8X`x^12;EKE7dsp`Os&=-8-<OmxJ-<qZg|FGGspq>@#pN>P|{
zRG!T2lN*#I-}DsBC``+w(g0~-1uQ#Ap)uFYr%iBE+n#Kt$H3JU9cId>=bO6rzvh~F
zlO*g4%}t+J39lg7rH8gQPJbi#kyMZ|)(zBjkmi~4?mqB9Gg>yX5d(lW%knxCVH%!W
z?nkp|Kbo1LZ1V14^#YC$ob?8ZuWxZ{_>blQ#!DVf7KX`eeg*?C4h|@SCe*_9sPGSX
zZaH?7dcQRD<HQ&XYDQf6fRIo|mViH3z8N~5QqQQ}qJ=?Zl$!oT_L9qobj*@38+(L>
zZK7jnP)9+)%3*@Xt;>n%hhU`5{^kN5aiNqKBcw0$p5?>84pCy7PkH}o0ndPc6Uwm%
zL|_bI92d&#Uy^3vQdNi6v{OP%h|A39DXPXGE9}x6{}K9{3s%c+C+{mk&2&}OhI<al
z_g3F0q=}fAnzus#r0DAr)EZAPY!{4H-fN3wH7Cu>QDNVW9!J|E>|dWF^Y8#5IGFlQ
zfHNoS05fjIn<j)~E^3D2!xkP|wIc-s&5~rc>Sc_ps@za?X6K2u)P`d(>)+VoV{Mu+
z9w#lsB6YJZ%9oC=+;8rdOa7|}{=wbM4JkEupvMpJ*LakGvoF6PF(gxDD@K;8Ygb+%
z)DeVWRiRbnJJ-EKm0+-8rx2{48HrK~77PAf*lUv@M0eV0(@CNCg}kmWu!eNvOB*zT
z6n5J7!(?cI8Krk_vq<l#k6IR`@>gWY9K6^VwdQwr9giyYpi7iy^;(LWh0iNzUbKMM
zs_$H8M1WUU<0Rs{NS#}~yXcgt4&1g?EB^PPu;$tfvcl)%|Lm0hi|A4FO1rtInl!n>
zI}7SbApQfihZDoHyWM$vJE-LC0Mj7g>4=WTeyha_rsgvH99P>C?Nj}7D6ohfCR7r*
zNHjahnirS~ukM1Z={YM0V+JcZ<7Jp+Y}O8WDa8rducEpfwTT82x6|Ae7o~FMNs&?d
zGIyh%q7Ftsz-=LZc8tQ-_U+s^dtD`qI4#0{W4qT=ClGmB+fEi<C~67XK8&I=9uux_
zSt|UPgq7o~RB`aiNgdPZxqbQDg0b{ue4e!>h;@yfVDt<OOHuBimRETDA}AF7&dPGz
z^tco<@^+@Wa3Zxk(oajOC-x5}0jtU^Gmwxz4inwf%ZsGOmk3_%tu$`KpYWv7FVW~;
z{T7`r6QthnlFSO@7lX0`@`6;vrYME+;HOQButb~XkoW2cHV+uKyoIm6z<~J05x4g8
z^JAH3Wh31ydh_xghKok;l$J`++2N^TriDA<N1~}rj7VGGZ$AhQ;5Ry}KrEEL=Q@((
zx3naY1`2dJFvNoU@5OMC*Zykii~nJUOI{p6hEjT{2iEF?EDGS4nc-zL?C{V<y$RfQ
zAcCJdL?7z)quTS1=s#M#W@!-r@Paf{_T=71Mhx#$QXtOZ3BO!X6aQUuv#l?3ub+>b
zeLq8zNH2Crft&i&KD(M}h?RMXtT)@aXSr8jf)1%l$AkJM0y!7XO^C{<QR*yt^g)`0
zhzWzMzF0CH3YYxJ77I>QOF!VMVVN^hOb&Et(B{)-BHWFkv_&+0r{Dq_Qc3Pekx|u2
z->3arl9Up>{(LZ=5M)nctz*XLrWXQK{j+x_`g@JSv+rW^aKP+C_JMFXc_!K~uS##!
zu;C_K*OD(ljJy+5M)kZ5XCv*`6fO*qRWPsfceh-cLN|`YYixJ>M#dK*xx9jI9{ebe
zu5SdBB`PYu*5ejT-i_G4%Ti!g<z^!0RBugMiZD+o^OpX204x@W{=PkAXS!LykCeAX
z7jw08?!4)rU_y_xt7$J}a<DyacghrJ7-I>Zqy!eGC_F$s!z200&r=?XhINIm2wl1v
zi*#vF4?o6lVwd`Tm2$fN_htESC8jy{gj%TsAM=9An*hkSH<vFr+`bx?ekXg)%EpP(
zG5ScUu+e%zsLJ;+hSk!-i1<M;d2;DKRO#5^E9NODe2{hl!0}DyE9sWv&3I%>J56E&
z9z!*=AO5W3Tl(BV;VNv0D3=%@FIp<)6k>Y)w?#y#zMhS0yY1tbd^_0RX2i~lH;#;w
zMwsfnnPBnPFKg6)n+*vol~X{H6$U5p^tbj~J6ET>OMBg}_zP9F{HrP}wrQR#vj5mH
z!>STJ0guPbh`Zq)gGl5-$gZC!vOi5V>qp^2fmmJ49j_$5%mMVg^LaH0?M%`m1nAbg
zsehMr=<_j~><_LkIXwZLQU~<mj+=A6eDjDZq*)EHT{h~~5%}dSW%U%ZoNDi9&%DIK
zuD6`SiNG&1-uK7~n?{tnl}3^G3$2nEmj$kg&h2}*`8-gO8C&QnX}ViH(4!!(X^<<?
zaW!v+KQ=v(4F*(u%oqts5Fz^?XUqLVto8igeoIDKASf5%WAJt~>j+%)?0HuG;BjA?
zg&`0*ZY9wBcFj40Mit)1g_kF5kf|oMUl%I;&YjTCHlp936Q2(E23v~l6K@B$5Ox>H
znGG4dBu~h0YN80~o>AeeL!=~gaku?Z7S!KfrohZ)cTG*E8_k12?`;I%C}$mvt9d^2
z#8x`n6O3YzvHexhe{jZ|P}Cc+|3rcA`*YAEL0I`1{wO*z+@5n(2)RwD!8WS*$Ycfh
zg+@GoMXvwjbvQce$<TOTveyHI92Rj950Jj{Hir>{g<if|SY%EfuGj!<$O(v@&~l72
znw}6u4Z|J{2|mt;wS$#9(C93K<h2L)UNRJcfbivo_~qO$b$Si%3d~ghY)Me-1Bi+q
zhF&0i_GMb5x!&EuJmR9mYmP75Q$ykP3$^2FWj7lKcq6vLBRfV3l0eqXk4gJ33Ceqq
zZD4*8t**J8_P?jvHi}v)MjInrXRtNnGc74_xF>OU=0a>$@h?ztW{c`0oBzHjPsXQz
zd4r<?zi%WB>Pg@|;?`{X;Gs5ZXU)o!jedP1Js&j)8jZvksCl{(HuW3S3~>Rdr17>3
zxg1kLD)b+w_1_H)N)glcQ})-zS)YczSjR<x?zREkQ<!tHL(Za!h;3!QB?nJYG3Sy|
z&#Tb~UOQ#R-j@nMa)Jg4X=lF=@FO2zj|^g<<Iu02OWWVl+)4L2H6rsGY1c}OyGj*O
zJNrUt#!v;!7>{{tENk$VZTOVSY;)Rz8m2$))lbTvTK?uXA3^sZFuPxgnEIdh@vr*d
z^a2-ZZf7DE-b@vlFDFCD6l1OvHzlk-(ow|_mxYFLm`DXcAQf$jBeNYxirKV}gr=<$
zdBAHQ0dU_R!{8gt^P|rvMbJII!)2@xm_-}E|ImA_*tn(-7OS$pfNBiQLx}vV2B%po
z&PZX}Uei?^q$GE&D1aGCHcaZZ*5tKV(Hzm=Z4!^Pv^lP#d_=H2cb5&H?Gqmt1)^<-
zSsTo$Hw{rwt8>^7KbYynDrZQqYs&rzv1sFl{sc)4V<9<~ean4U_FSwyJ^atbN;7UG
z$```&&7!t9Z7M1QOS~0%$pRYkjajERKUJ+}QN+H-P08?=gkH)l@}O*Q<9b)%n3m!f
znKZv8X*JNLK3ym_#Ap}_pUQ4&C|;U(olmOGc9OSZN=DhklW{WIgr6>M<Qq!%&_+>u
zU-XNv=UbJ9*Fby6oNkWXJI4>LPDHI!Y6Rj6Ccp3uS`lIN!=991!nLID%3T-5YnscB
zsmHY`<F;4Ry$;l{6C-hbt;H)A!JU|Ab1Mw5B{qYer?z=d#c=P;Up5TFKH;)5=OH1T
za`!A1U>8je;)`<0MNXH;DEg&v^NFpEkHJlyr1YKupA`ZA5Dh*Oi)G9GX0|O}0qq(d
z-SG~2GyDq+rG=Z}H0Ru;_JH;DJ-`~i#1(4a6)YHY!~Nn#-Za4W?)NF2V6U;mFROg@
z96v%S5+yINm=j#Y!tqxRoT-)*_%THA2Ok>T(%7YvET^#Z*EXbZwFpYmeHA`|qQ+aL
z>nAj)^K3y6-?Ys9?{=ReVt>~U@BE7(nvKZR?UoX?K+&ubXq{B#GppT4Fd(H+CU67@
zAfV=L52>mX+AJt;mrS1n)t3lp9SJe>$&eLNqZ;%V!F@@oHhMC8tNGTPh59DbBOwWv
z@@tVPLiO*E^@xevAnzjquERA7^rP{|p!Md&VF}hxMn)rOfABmF3oK`%mX}mzi!9w5
zX`9|U#IyFo<&5M+!|Mx<Ubnu9H|>mBp9#z`?XjCWma;p=WW5?L$#U&|enVFN3#~R2
z?j&&=)m@<tdti4(Cv;3q^ywnx4(t*rHHItdPO+e6M=Z2QMJqtl<8cWH&*)FoJg6v(
zSB2z<KNp@_1nl!b7W+QAped1YXI!YRg-Q!JD-%aL^zsCmkfr`4b%em>gla>Es3Y7l
z1)89TA9WYsW!o20J?#j{R{#dDhHlLv%l9WM2k)fs9=bCMQtusc#1Czkv|H1<r8=4P
zMnb@HUwIoXnFYV<eT9ld|2EAS6hKzXu7Ca!|357OP6Q=sq$L4IsdE_&YQyo&DOzpL
zOO{E%^run7bLp#VmPf2ieMv5GqBnh>B~%vAfxe?8vsls5BCX#8#t%erv_i%ht?7@$
zlwFNtZFNicQ+~m-^x{LuSTIVAV}c&kdNrm)g9ock<6v^4+Yy4Zoz-ZsI9Tc!OsD1k
zFm%f6h4{fp>PX)rw{@2<k&X!7!`HY$G8H9HYOSD}#WTgRI}C@4?MpcppEIPG$aX?j
zXDHZyKZd2A)O}ZhwDEh6)g$*uI@F&zub<s>|34w7w?r~+Ls02s-)^5ePv#QrM8R-r
zN;YNc8o^+UF{@_M)_}kKvZ}qNo(D0-Raa-EAQTOwoEIh``$vHYhm_U_Iw}nJFb(P;
zoPm2~zO-|w&L~BehNw^9I1fSnW7^$*jp<*C&Y#q!&(Z#QsmFIK^B@ngEcEevv9ViP
z4BiCvfm}@G!yVV`WU05t^ee*jd*>)TaERX9WmuUPIL(Qh4naLLcn(XPsV96Fk6XS}
z*__OO6LoB?j3Vsac+U@{czE&$=Xm2cc4p5f=KSfzls>^zwh%sXklcwXtBI%)xXY))
znw9VvTNPyvDADAB0nWceM~V7T-Rb?03ygB;;pr$*DI)p$##6<>oqI{ccC#^DhT2h6
zfiBp%@|*syOlQp>8EjzXr!89pp;e<kpL2{aqmmvxm@(obZCtyF;52!)X{BhyudB8Y
z(4u(=AWcHq!^;F-j!UhJ?%v0W_;aOw#OTHSA%=g{*E(c^zepnTPl<-oWMm89BQvDj
zPfbuO8HiVL1tbJ`)vuz9Mnlgnj<6|+wu})DqYj^a!{`6ImtmNW;rP~9+v6q<*W8Ig
zL*Z(pE(xw!w*ZWSav>ENI+@|TXtV)%34|t#4+@5FLwVn!*zF#U_Yo2WzmzFXC!CpP
zQi<g=%5INI>0@!?_(f!_<^UfjS~RcJSN%PF>!cHhEOa^91;OQD4zCL_Qd2(EZaURv
zwV&Ntl26^`>Ohn>;ayl5wat>;XGfkvoh>b-4(D-it;*ZN!(m$?8u|sh-)H;kH!|DX
zK4<8Hn_EdfY4=cq^5+`hX^ra3zuI_nJ1*wS5bXx8Ra~2!+pXXtBQ=?NB&vD<Qt6MK
zK7MXKA{hYD2AQ7}G&aA=7Ea<WwrRhf{`x;Hz|j%)#n|!$D5$WPRg9DN^M$gv11JQ~
z5Jpdq3w{tHQ}ghIj1?rnZ`%uvRV-=02tw#+VN(5l=iMMxf@j_t`|8`8Gf*(6NvPy2
zSAF@$^cKGgVuN3!_3MXj(NMJnxe4`jMcdyJ?%b)H7a<p!T%m8;Uat%y{b}+EdLHim
zH!+_gt_W<8Ym=eOrv9}VQ>8`=UGDXj2`mwOO9-jvdR?D6O2q`z$YoT}-J_M1f;jWW
zU-~e-bmHcwEiUWID-=T~1$<%@i9I1a@t~ABDh3Z7vvtN;;!iH5X07<t=A@bmI1}p;
znMb9`eC|aS1vK4Q=|p>aBa>YDSp0%(j>>T2A|lB+FKSL6oU7H`NM4#+zndXPn{e*w
zFDkWU{!~ekdulD%+wq<u#`3u%7WsE58K8wA!E2<BczFpKc@6BdBW@oNP}`Nw#XIIW
zQ6C~eZ^F^8#6|Qn5DOgYN74QXS6>pm0aotwR`O(P-lfKX6PCQg3l$H>wNds3zsn|l
z;W`*StTWG-ToI~;hqs4C6P6KrRjoUQDzxp3dad4rIy5S(r?kL}JWO1bovI<as9)2W
z#EZa1Qf#>y7d@3B0Tr<f(Q8=yUZgale!iGzv~mFcabhXJTwmW;D)1(L(@VM9gR>g*
z@zn69q5G%s%>R*9{sOF(Zz&?xK?+G&F3V8hpyJBNKyHp65oK8JX%93GfY1$H6{o*@
z2q^xR%j#X=g+eB+;;?z0F^e0kQ~zD(<OU(^%W(`Z`jN>e7~{F02S{;ycbf@A3FbDE
z+&oM&Uh!!LnX0G^&fKs+v)hz6L;da$y=Iz}IGGMkQp(W=lX5e)_d6-!2`P6Gd!+|U
zU@?{M=Qd6<Svi25wLd!i0dQ_$ow4-Gg7|>2d61h~*Zp^(dw!c^a{t3nRXc{#`~YEU
zyY6e3dhvl9v3F*}(8tc_I_#g`_z6CUM3zLLjM~!t_5-~j;+I{%BP-^QekNQJ!=nU-
zh5#~!N7YCGgPfYcw77{bZEa^0^`@<B-W8iDsg_KiO=q4H8txK2l>>LBjhW=A7P}1<
zk?L3`PcV#oco5BqI8H8X%a<8gYQ?o=Da@t#F;r}``D?7F-Bc<Fz1(QdWbSn>C#u2T
zNYVvw>8BAGf3Zfs!RFLkrCD1ILD#Xo7WHJaN8KUo0{UUNTNmpDnR{%<2->>$8<@~A
zM);mpUmcKVnp|n4npui;;y-xXC#R|X^G>yPW<P})Mn$mrrB7;5GLb^#9zhITtF$3$
zoGylxo+X;)R5vlTh;q8e5Ch$iw4Il$3F+x4&>d<HSG8uG0hfySea7C9akvUN<1(xn
zQD%&cN&%MoMfU*XBY{HqD{RxjFJ;NeJ1dk8*3uV9D`7R-7+f^kBiV^9xE3v%sC*MB
zv&6l%l%LWNQhprZ(hSF6QeC@i>hUdip}+JSqW;Do+l*Ba^U;US*hW4xuZ%VbTq>v~
z_*QM+mW@k0;yZmj=bv-RkDCw2e-n6rtqcEbywq|qCU#g1>)P1+-r--Exr7^6%>_^L
zI=gf3T~wgQm&aD`7276OnV1|Vk_L;^Q{qf@Due*PL%4ce#M@mx>C{WB9FW_gt()FY
z%FS0Ra6TvzASADmAXCGVh*+>1<I`H%$HT5cqd?b9;qcPQ4f#V@y6p)=7gm*=u~(6T
zg;69AF0WdlnmX;9?(?kKI-HWOnuC*yBqX{$`fcRGfRWhvZob#q*GVGu-X!6M66eS{
zQ)(p7=jm^Q_D^;LZvCo6za1kxVkRhGHaE6Qc9W0Dn#ZoOUMYjOz|7E;_q7iPfa%zF
zB+|)KV&pJ){%cw_{CM4d$||xY|7<Ox8tNHAC)%*deE2L<w@F;k;=4Dyiu6--XMoZA
z$gMTqeuo<Q%0D1l`|jq#g1I!rJ>#p9H;!xwV?;}&dTBKRD#}$gOXE4!<=HQI>`~nP
z*d2CzhCU-WB*ht$>WA%A|9?DPg+o&h*A^5h0YyquLTbWjkd#JJT4Eq2-Q9vTNGKs7
z-Hh&@bc4hg-OWaKjBo1u`~HHv-Fwb?&hwm7ZJChktVUCv_^4d#Jo1+-|Lu+WqvaEF
z_;xg<w5cK9#*M-zzvn*`i<y6*-T#HlZT2#FXxO1d=2<Au&Z-e+40>>XhJ!9LzeG68
z{}}zHuA?jmHvmrp8RjI+H~W;9(LW_uz3$44ZeJ>z286k|G5wWXlk2O|NA3P%!PD;2
zm-cJioaE+Xlin7sFE97AvC3{JleXqix-hVBzBPpZnIJmnMb;e;m3(neZ`!#VQ}~w-
z1^GrbzHwT6vUl^B(^0dT0JoL*j&mHN(A<W|0Jg5bt6pYNwXlD;gSMKg=P@E!d=y8?
zDw4G}VhIuj*tKY%v(xuZ!JLxkl6yI@&Rrn7eK=`RW{<U5zUk`Bgs}m>o;oxu&R@s$
z#ed*<I*zFyQmSWQ!sHs*UB_4HfcCVfooqf4@m9c3E{<#mRLNZY=rc=`(t-qr)Z0?r
zK+4x?OVRVcS<PuTKTFUd$9@BC`LYbSGO|mWm~CHWDb6e3h!T>RKCAvnxQh|z?$9oj
zNFabWOlg{2^(BaKVc`Cg1CMD?fkAHIy3$xg`)9Skvs{4xE<BA%knySkKE{UH>BS$t
z7^RV1jjI<}nP}9*n3kai6(-F;;IZB>rqr^?LaXhN3wvRgt<wby_5fg*W|HXW<?uXQ
zCTpRezzKhrqL|kxC}#Ye(r7Wa>g9scL0M%6`1gx1E6Cg=(fA6%LOjCCMnI8*+(Oh{
zD%=Ep{UfLcnO)oPm_o>OOO}_THV$Lq-UzeSM6c3JHo!aaO$fGl60av}2~V<dhqK@_
zvUlcj!f~cZGO=vrP$CuH`J|-eJN9;?6`ZHd?8v`TEGeo!@$cxc=^+Nc!s*LdblLE3
zX@+ABcmkE;)0!`f4}QK4xpk;W<Oy}UculU1=Nj8H{OBSaOSrNy93!0G^?`?xgD+)7
zBE%;j>}pRvOm1O&MpgRBICYXF3j?E~jBw(~;Ddsw;q^%U_6KdLZ<7i)O$_QD*C%Mn
z<r@`7d<+#o3p(MHH+e%pPnJXaOL@9n91&t6Ak^6797})`#JvEG7wvfYMpNFj;-^Z1
zrYJG-MT`7hWE{3o7`tvl%QTaHz9j9+V{wS_4h9tP@5)8ee|tIf3C$DSF#E8+6d2sN
z&NB1_-u?h+$Bc2<;+Q!L-*^b7je2x^TAj{pBqOj}f1Lc0G}lU%Queg03LOvgyqvN>
z?7^eG)2|j5Z(}pd9!|6Ve1STh##fk(owl48Q^@>&P(m&685A>Rn5ycBW|)@FlZBW3
z-0NZbxq@;}@RUqmIM2q9e`xvbOA#ZUV(G+~xVij1oXuVGLc)<T0_#}u$4D01ucL=e
znj?3aV8Ou*0N@c0xm>&p3-LVAsxT_&?fZgFSG+i(qrdy&?0^1m&dEITVe&DHFy(8l
z*i0t8Oqmokjlv|~yxmTEn{^XOH;u=(d6m4jd8*JsjUqPo0IK3gA7yW9NE=>()YCi3
z<U@$mSoPlJ#!3tq&St&|nPV*DCBwf{C4GDrF8B1w(9Qrg@n?Q|sUj1-Y$ZRx`URe^
z29sD8hQs|Xauy`AmY3~?_=Dy6iZw8$-1wbjaZ}JI-+g6KqH?)aD=FVK5rQBgUCO8n
zGFqSwK9V)XfM@P61HJxVK=6NS`b5SqYptQt%{Yusa)g6_)ir(l^nO=&1^i-%AuQ^<
z!*<JB0ECyB_wCcD2o1(xvDjHoM`hwt?-1<?Hj@C07&9XMok(bq=PnK9SAicS{RD^p
zFCkU9<98Y&GUPImCGlZJ{p7(P`;0BZ5={kV9#~|t;SV_%fCmv=HC<1c1UQP->sPaX
zw2*nO?AWDjXI81KJibB+=OGypwhV$4KTj{W^D3(O6J(0F5@edTpxVR#jg@>X4C;6P
zcDdmwY$Ua+#8~rz?JX0!VwchkdY9Fc!Ns62be}gV4A#zVPvZI>#RUld{-va&5xyl#
z>bYb5Q6EF6CDaQ;&*+gy-h96)k0+W!te8L%UUThzvIOi`9`Oa!yY2P!pV4IPv7$MN
zx>;^^7^B-Rflf{5n5|>9PY9Ay;=Ir#gCuyUNR)^uO8SIA%n3gR2Jbo&p8J5M5055Z
zjy&f&B1*%>!X4VxVlX(e%3&P!ezU^%x2XUB2kOQGw-%+NgjXyFVt+)*?qStSl4d3Z
zxKc;m7BnV|9((<G_Vm-bZF^~UWPYZgdH4(oxv36HGw7FDPorA15E7}mWO4r%t@fg0
zn(oVT&N}K9@I@>Ae8ke#7Cij}b)zZc(^6?4v;Rn#M+r{Y;djyiPK<|(B2*`yybAAd
z`GArln1q7zzie@wUzCrjSqLJQl!QlqbkX8ARe72~AI!Z?Sov7I>av6P@`kF&?>N_J
zc4J=Zj<hk?OwYE9Jx}lJ-xBdZRjj#NRQK(pA)Kx!Z^9*!sv8{HS2H`y`j}+)G4|+=
zvf1lraxt-bWMo<KBOl3mA~x~AI?!S+N6k4frhZ^>3S7@TKEylIKau&y^YmS>TUV?>
zA9Gu)^+xW28^+@Bm!W4$eczrGVML@S6N}3XbE}hml&gyGf8hDKyt#orWUS$tOobEr
zeGu_nkQ3Mzz}7X%)$(#gi3iCO6gvLmja{??ZgC?wOk{QvIQIabG(ZMdt~DP0Sb}vq
z({3Go-w1Wv!PQH79rVD8U^|c*MD}-+y7qsY)N@{~JdQJbfc-5ua4_f-6BD*N5k;jB
z1zE77*N_n><4R6r{O@OyJwvqXM3h^i>Oq{#0yDG@L(>)O(kA3}o(x(Rpma|(OyOxr
zat7HjE}z{uKU$B`!B04MK>$tpcD+oO&rqObTJTcPhAWf@k6dD&k>ta-AC@nF$#z1!
z8@+<zxRm0d#bdK#i<H~csPg?+XXvl0ss;VC4?k(#qh@pT*BLg|u;p_4d&&Yg*+C?(
z7F;l-|9rkno*z2x-wWyrfBQ&4tTBoGnB0w&G_BLPkadgmSrtM?wf(M_m&(~jLPM<;
zi<WU+$*ioW(~rg3#+?;10TNhb3Lm&=fqm5NVn2W!+^@3Pgb29Eu-^htuo#3iA3pb+
z=2;Ot5+%I~R@}yrc8y9jrW&XgQ05q#SZ!X`%jxP9nDHutqqa2WWUAKO+pqRL)8U%_
z?x0%prgpa7G{xZ7X3A^yk!shvP@?Vrew7F5W(xTOKYOV0LafVci}bgzD!+_8%aBQ5
z_&WiF0+TIyJppRA`-%Jedr~i~(Dtr@Uh5JJS2QigV`;6=sA~5KfxsLQoqrm7majzn
zxFc#S*o%D2tjFRM*@{80(72|*p+Uu$BQkU}zccj9wS2ZUXkDwfeJv9BpB7N@mDXS;
z179;v*j?Ec*(j9#OT@2_JaI*oFF*Ay;G7wo!ySev@;D7&_iKLxTC0XUS)vKY#mjm8
zvZkI(;uHQb`qFDL8;{GDY{qwO)gjOym4cj7ha9HARVosyalX*%*PAe>KX{}XfcsZo
zn){z1o3r76w}j;PIYj(s9C~47dymUp;bedCWmP25QQz3?S{NT4r1Y|2$phuWmgA-`
znEm0CBA=ww4^wdsz-a8-9BN6`viwJ1BhMF6RsGVc5n3!hCq1tn$;Dp~?_wYnnBvo^
z-|2B4h}inQ)7FxRx)f}OIuX67kEe`=z;J5ShLK0c%kE%+!^QbNu!ro{Mw(^t*Zmb)
z{&c<m6<Kb9_b2zq{M;)PuYGaL?^j@e$HehRowyQcL}Da6S^<uvFFoDGS5qL;cWWB=
z4iR^u`}$+|Doh6W>0+%nxB2vrB1d_{Fhc}#Eucsvz1Py8EZ|0k#;&?)<L|rpbN{9a
zbqgbBV`4(DPSW2!P$0&ixjLGL$%A-9me%fuQ*`Xf&sT8dgwEy^1xYiL8E&f!(-402
zNl{~Y&Wc}iM~n*WyWxWd__&(}eD0OqwWYQ_Y>ZQ_CTG7vKR2Ms)uMhS*E;v+S+mOV
zD$LTc@z)44o%qW8bb<cQ)NF$9f5S{`8_~WP%%3^@MQEJ1Ufm3FljE8(Z!g$yfT%5f
zwRn;swl*!)P4Q&fZegr<7Gte=vf++jI-{I#T-asy168*?9XWRH0(MyzFAx~^K#o@0
z1HQJKU2lrr0vm<-==*TDlaanbU)C-#;pralKI}0_Z~6oWb<*r^5LIJn{4>o$^6k0b
zO1r?~&eCChJpsr@80fcF9^=)5kwYp-lH}G>(;zyBNh{^m(_=nu_>*`3#^rbEAWe))
za1JeTih0JIcg<GGCa8Z)wT$<@d(PW?vJ7|a44%{4kN&dY1I+TKVELEwh<R6Z;&sMA
zE4M#t&Q|+DvNqf3-!I)F0}H@8&ZLStHYZ!m1L1zXym>|Q$n=$6?>zkR(aq9H*Ov<Y
z<<)3UAWeO3Q#4JNysWC?nKGKaTaE#yeoxOke^{b7F*8rJF4nbuSrgxt#SKNK51NX<
z$mKqf>Uu?e!6%U8)Y!@HaV6?3I*P&<$Uz)#DXPX+mbrKU*ND)I!VrZrnt&4IO1v0l
z6#wG<rTzh;OKSH%F!G|9-XI!^)uq7cj_yk@$)w-2(N!HA)5mUjS32Z7tW)h9Yuvx@
zj<<Cl_cWs*?z)ZU5~6}y6xoX{QVti|)EqQHHPj)okLvYh{DJTtJWtQY^;-|lZ3ClU
zqGF@=Z@#x0;@m%ec^jj(ryyM}YcS9(=zn((7Dc+lTfDaUs|+z&7sdVbYvb>;5<y`b
zm}2iW8LkK%u0t~Hc<DoI5B3)13%8)6<0r++&3-q5sBG&gsx34WH{+0ALvKYt82xN5
zq&OyOB{0PvYg3ge*2n}Z`-7fHjkkp<@<!49talhGIizj0uxY>qU({6nDT{yB*}%KR
z%mnwL0yj{1_xs%-^Yf6!RmEL`LEMOqiS|hG$7_;%@LJ6#BXf`CXQ%E2iSfX{Z8xx4
z_!3GZjrrR@954Q2hTu6*tmAggVcSzWQmjSQ38YpkXJUHRvinV?d??mNJMVsw)ad>B
zLJx5ZeDySs^D1xn+Ib^2p?~{zN0}@>#}{5c<D7ZC8bqFM4M^P65lQ5z)d#j0@#3Bw
zC(!fm2`;nU7G^&ZI^1_&EZJ%)8l8q-iNt69SrqN1H<dJm3gGWhW5IflS`;c0(?^9o
z6OIBdZg}S@(3|O}Z!VCB^$@IOQL$zUho!8{NCphozPUg?kQ7>N=3xYv-9h2YCO3e9
zny1adnZg7gjnu~_o$R?vwr)o+`15lML)IF)G{@2p1&}A4<&AOY4Yh{?LP2YGH{Wtz
znUk)~hTrY^&iqv_?`cq`9utRBj_Yhvq;7?cLQQiHcUl;uzlQ;U1Xt)m*^XN|aC^~(
zM{}ZG0Owo^P@xjOF;X|t&}9%aex`-9jJSnu5NH3E8;NDP7Fh6l^9wnEx2BrMP(iq@
z>!?|a>Zd%GmvZ+dFLuy3u9iB9`Wb}HyQ22`Ya3Gd1@dR<j;EPOd7C$C0!I?1GSI|P
zVVu(_yFq9N6?RtzR#*srlKu?4qOMGPx=gzH<E#fzh;i@#j?h7f6AlC~2HD%oF6WJV
zG@hy#!5HuAxtFYCI?j`pRCsGeV0y9$x}~T^+<e373LIZs)kgH_6N7<2s*?PcZ||Q7
ziz+X>_a!{(;T1q2>TofIeVId?s%m^Wf=ssZ_)YeqI4zM*{!3rPaxg9iynx8wgAClB
z#|i$daUUUk&ml(Ht(L|}@4JoYeEa0&1?DtJyp_N3vGPFX-Tn41%<WI9G{Ict&tLnq
zX>G@eo0Np+*oVv7duXtFi&W~e0ueYTwC?8{;;QUp^~1i+nfgMgb*5+L!r`pn)q5TH
zI?PfV<E&uZpuCx9t6Q3Y9XY%1K6&7_vls4nSG(V-pm%_CTAZNSvzWDZCak$p|7|g2
z=47|^w52KI;_|=F-$C3GDc?wL&l9v){+Z-{!R29iifzEfUmt-#Jbv*2TUK13KEAwZ
zep<u-as`QYVHjgysLp-2+(vp*Ok>+-9g+P*d-ft9&#4+>IfuMBBlUm7out)dh_5+g
z@8H&X?3=)NpgGTNCY?~K;wiTD2<vZ!IN`r7Ocsrz1CErX=64d3rm@i~qf21k$)yL+
z1KJ68SLU1}Wp7)Wl&8<ISXl!)W-=+5)6!1%k`GwJ1Pw1W1ze(3jjpPGZ`NfMd@7Cx
z(M><4_1B4U=q=ZFI9vYxQ_ndV<XH1jkbUss5{aKx^GPC{j~ei7amzb;uONy155-%Z
zF+?fz=`5&mA&W*~5mI^W(QCY~htur<dD9s!CD;XQo5NcYucB;N%8T9OB#^gqOb4Q`
zAu+$#sWO{xm4oaNPK)NtME9q{_wMC1@ox&HIi9xmuY9*1m*)sGyzf@{O1p79#&s_^
z?PpR{Fi<TyH?wCOZW6?P-CK^=%&oly`CHdO^^pG?S{m*9N~y2(n^a26ZT&9xL{eY*
z<2%y83$-n(B}9yhix2ZEGIA(O)xzbS(hmrTBY$$h2v5`x!dyBCG?$#m@3?u~xQbsO
z%i<U?K|sE&wHR7m{lc$^Z_#k)yr{Sya#{4Vs^DhRprGrl_>X#rJRKC{``@Dv<n${D
zM(>bFnyw|P#%2$D5_r<={rd@Tjj#2XYk9BSr@y+F^4<t7c;EY$K0d4u))%!e^I&F$
zWSnE~Uw&UAXv5#dob_rwb`CRc5jyocL@Y0j?s=ZATpq1$9f*{Rf^P5k|C9((UL{7a
zt!3tM;_pn|xrkKjD4?gQSg(D2Ly+VraBx!VZ-D;PKO!O~>AN8?26F8&_SxlAM#R9V
z;nmT@m#cw#LUfDi=KhKsKEK=UIbt*R`%}3W#L`e0nHQa|ZNFidf&%A15v%1g^<g$H
ze~uYW=b{1owF>iH##3e_{R=7X@~^i(T<oz|SCBPIg}D#jcgr_4z%%DJM|o&T_<~P1
zkxto7=53wWi#j>?480Ov7fh5Xo4-zAsh&#TckD$G<@Voobw|M$ninlzjRVLclrJ%$
zpsRNfH+;o}P1e;&7OrlmJsmvm<0rSk4nVu=HJm*OeC&tkE5;6SD*6rdHx44!a0ggs
zWk57V%@5YDzdS*ud%}ZNVguo!A;F=Jg-xxjz-Z_b8*|GX54Lglt@;o_y6ZbHabFQN
zWtunDZh*YosQSVtFF8u+pR#grh!5<4x14YFR<*;1ReHa1K}21V=*nI51dQtfPvxI2
z2~n~~LLN-Caj<VY1~e5<gO_vg?$Kz9F&u-k3~Lh&y;lzgqu111oRw~_X!lFsN~KRq
zwz$Rms-<^n>kf1}ma>l&+fN<bqzqbTIU>GO<@iBkU@Kwu?vO2LTiF&A^4}=LePWmL
zL-^J=f1idf?;9$!5n~+0Mb_HVAg!^W_W8owVdbhX9(UF(_2jpUArCLy-fZbM-#O2d
zn^B~dFZhHGA@@(x%z6hgo9~bvf(OKUMqpf9-!E;3RxL76kV2C&hYIAmqyOD9rX&BH
zjHmY)E$QENe8PJhonk!yvuFE08O*s%kH;+#gJW!xi+0!@XZr_(QNIoLqhoj~<g0nP
zu^5qy2I#HJuit|@G`J1?TPN+8gN^o9t;Cx&(HS(>sv9e_(P8&mCN^{)y5&oihH3Q8
z?Ezarqi4YSx~+tfT~F6^vzwp(j;IK(iHhJ$v5)}Jtyse?LY2R{dYCkF4|8H8*zy`c
z@kVTsECKRyQGwQ&=ji;Wx9dIL7lXaq$YGx^wTRqr<*+3^50;$h%d@??9?$9C)IAtu
z+e+0@-O!%dffaJ_!2hNZMKA!~+9!s7_j9B7f1dc^FC3C8ScqKGP*+1B7mzHk^1ZEF
zNOm}A?WX2%Q4H#9;OS6%Vd2iXWni7RbrbXSd@2!H*W%IaZt;u-U;6wMq}4h2n09W}
z)~(f9^`4rkB|&JGCegN8<7~W<GzsaA0$-rm+HAV^{r3OZml$1^n3u(#x(_2)0rrWR
zbHT;2e8>D9w0o~S$wv-wJN3bL?j>pr=*S8E{pGEjts${z;8ZOeu<les+&G?w*BE=l
z`W5D8@6}dr!jY4vribCd(=7p#EwS@uuh3su_CDbf6%Bg<gNNi`V_*J-K{1hXI|P`{
z+W=984EP^p`AZsD^c=B>8lZ6%PMo6LQb}ZFe8~g4)}-~zaQD=`;sea!@H>sYc%VJ7
zBnGwy^J<-?sSKxUZ9VYqX&ZDo8flpH(6|n)65NNW-vQs&e^;fp#R;f;2=}!w*r`9)
zXZ6t;ax5)IzVUlP=Qj;9YBgvEdNBQAULs!qq4jZ-27H+1f}oe!F-z$Twboh1@hwTZ
z{Y5L*q1J9K%d`gzay*#zB9EItUhu;(_G`a~ZlJ-0SVy*Hvuc$%4d4SX-(42Mu6HrB
zUS@s)&3_D+Y*pasq(RcHMD>tB@Z3sWOz*hNQ&#a8sHG?O54{Bb*ND(G|GKi?e77k?
zw2Vog=GR0DoSIYsQccRyhgWXS2~)|ynh<*Z#%Ov;U-La(2a%Pl#^`OCJba|yp=<B`
z<CXqP1jSbbn=t65JHa;F?P1LCb0oh$<!{xaO&31Z2iJ`ZwKz|`Uq=g%VBL3ix6J+d
z->pPv2PpFKM|Qt`PRMi)@@rUOJgV#YPYd9Ri#hZX@24k6SPi!M-GZOFlX~14(O;(0
zED<~V%rw7SC~uzoRSxN$vsT8?cyA3XFlbot{B5|`P)>0>*$Sy@j!kS{P$k@86(ePn
zv6Lh>WaT-c;_zlGZ0kzRUpRvN$&0K0oF9q#=C^Xmzs?pmL&18Ep0IyWQKf>hH=dey
z1y#Ee{oek#L2N)a@KoO8UUzDcIAbFwoP4o3mA~LFN$&cdSxwuoh5%;`uX=v^KDnzA
za_6V%S?+bwu<Uep_I?zsGJdja`M*hy`v{`AFt3vN{ZW8$nzkX_PwLLDx~85G7J4nB
z*w&!<aGK(RF(YZ+6L}6xlKBByVc)%kc8myA3%XfOQ~bQM>8YKFvaWv|z<G~1ep~Bv
z@3ESNpG?AHcL6W}R?WHTHIR~;-!>h7+nI^^bd^e2`u9dm#D6v}b!%1QO5K!0`Z}8e
zzigVy{mV(Jmw}_u>SMQtI(ebXfh(wegWA|fzw}lBpEqJ~47<LRb=Ar!1`yRPYvN8-
zmggfdW5`;oGKC0(RqdwEDahoV?AeZO-h8{8G;=gi^SW5Y4;yS<)^W59o|IYmtnT=C
zXEW$;?;eoyJ_Kt6ivmLoX8s$fzw!b7;uClApe%%{65tcGz&sYb+l?{2fByafbY{FE
z$)R!Rz|{tF0$`?ibL9Bp1)U+$XclvJ;_+49zQP?0ycDmIQXwBr&R4G5`b4sY!jjSv
zuq|dJX17+SA_}ZiPu2L&>bK&Y`}S|M1V1W*1OB9BGfx>v+P9{b(1!@jg%8irYo({y
zA7sa<%4UBylRcapT%)WXHKIwIIr7>jEb{A~540AWyDp2(`TRXZny6yo!H&|4`cI!Z
z_EKkR(FAMibJP&_9v|l2AB0zDCgooiXdP%>>P*?0zH+E}o}H(#rq;z?u?6jwKz09h
zqQYGvDpASV2z<HKNpur8$Ix^BeAn?<&b!wfxy*MSX?fM8_!hPZJdcSzcUs|fU#GZ?
zx>517KYYA@x!mDfPv4!vAlq-x=24w64K4P8NGGZC-}hPD_jZci*0f)s_e$#`6gNEF
zu1N}?CLQN&L3NZz0XO-m&;MsO(qG0vRpyNw`}>Vb0;JCR{M~1%8@ZM#@A~}fR1Ev(
z7KJ<uME?dHw6^FQIf}`y3AySQOTR>=Bz%`o+}xYI>EZ87>c5{aG^*NeQWRD#b@Nld
zcxBLUsbO6-cE>AoG`!&Box259I9a@%JlS<x&BMGuKvB-W{>^>N{$n4b4|%@bR%v5!
zm+vTcg(Y|+No<cFbhFjd!kuTJ;vs2#VUHE<?u~nCKNtz2Jh{6_Zxd9(^DZAmenB?o
zNmP;gI!qGQmuH-g4MKTeHoW&=ZR>lx)mHSkBRL6t-}*m0mmPd%gW!-fh`y`eiUO|<
ziRKNwK{L*1@o!6XBe}^!gMDZbqF7sb9(a4#4dft~J?@fhzZFk7boY0c;1oJd?h@*_
z&G%fL@_{5^gWGh1r_#*rqb<s3*LBCK^_qd_^XX^aKrSSgowlLMvpR1S^`YGNJPSq{
zdE8&|Nc9;|%e|Z6Q3cJiS8%SPs=l;l)}<xPDgGUun{VO))(WY5X)7K%L=!Eu7KT3?
z5^=nS9s?4TU5M68wU_E&l~$m7_}pzpO}6mfRX^I9&Ol~Yt!3&Iid9YF^kK>5ut?xG
zXrFSqFHNw1Q7BGVDXcm|&%1c#CbCs?@63J_fJ%__{+|o6yq#86^@fGa<q*UCU36O5
z5{<NsjZ)V@4OA=QavPW*sfLXQ0!Y1F-P;UHDy(|*fz;4f<+iMRAE+IA9y*c)ZHBb&
z95g?>j2yjW=IuMsH#tMM49;+r+-&#;d(g~Q<rTQm-Hoj3IzS)u<E!L3J?e&+;<s59
zrE52bqcoq$&Hqiij}d0zU)|7*#tK55!oKH0pL+)+RFf%uW`05#MOiQ}aU(5xzLH8F
z#@`y|EpSa$wttK>*s_{F+HR=pMf+LXQ?}01lzr7h<7rX{5bx^wZ2Lyb!ZHaBI-;ZA
z`d$Jlp`EgjsFPS#xpvc5VYi)EslDTQR+foMGnP?)_ou5{jG_002u7bupZ?Z+<>`Tr
zuEDLuGu*mTH}@8?b=Z)29^)eLee-vXY6#_J=ZZl4vB32{gP5-FhZ{khaxAJ)aUtcm
z+Gs)-ad%lWet;7o9d}L0lHK~j>(jR%fq5rozrXzM?e)5tfzgYUFQ%hh0M#P%S5CZ-
zopi3-iGjqB+yEZ80;de0@vXXzD^NsF&>_{kfenXVnsyb3*!Fy%_SRv}i-|W`zX0~F
z#BJq*WbwUQcyHLruHVfs^4!G8=eI#z1d$qJ)&b=?&=XdFRJM4xk%2<6(RdVsF?E$^
z5NwCz1rXmN`6y#(ZY8s>4twrazi6bDbc~YUD>NT$wXSxs`L#OXw4A>}K3rTHIdVrF
z)_)E6zzwgL0KEPs7Ik_yx`%y))P~gl7IWu?=Tjm(5fwLq<LTONS37=PNFU`<FzeAD
zKubm$`+ZQ?-j+5dXLc7{s>!xVc%+e=QM==n@dEbugQ+@@LUSa|Jv5pB$GJNx2n#BM
zAV_7<ASP|_#MP+#vZhROk&k%W>!E(i4vM8Q@7Ka`x(IW>ZPf@g)O97HAiZ`A(oAPs
z?0m6%T@P2rf!k(y8~7IIqd0-c{|I(@ICs!KR2+VGOT)0IgpK(Vi%wi%)v5nT9eRjn
zc&l}d{zauR_%?0k1UloZPjwW6hFt=W7-}o`EG6^56-2)Xp(M>k^O)-Zo~e3YM&gG*
zHwGp!kYB6zhnJO0I=vScs(V!aS#AqwG-<EAB^9HKBF{T6U3=;zqT7EEWmZ2?W(8ra
zG|pc=o55hXTY{&BH<dJ%8RT8~Tf73#zpGLl_I*xRXdhKQn!>Z6*=65Pb{REa{I2B|
zT%>^z!IbQIC1y)z>L#6dCWKQu8xMuKvr5wC#j`9#M72)XR1N-4X;5O)J5x5wU^3@<
z4>D>~J;5FjuxdVC?D5xiOW+PXas2e`=BlU6we*@CGN)KqZapB}@!k(kWc9A6tO9IU
z3GjF=KncwJfz6NcIwXXZ``d@qfoYX45jsc*#SC~iHFN;6W4uo9XhxD%$1tN{I#Z<2
zZRSlvmBN@Mbc_k1E2^7f7}7Ut4JRQt@hhBqtp%OP)$30s+a>v7hrQ|rU(>*E)(k|G
zVx2i}t^~|P^pxF})z1<O6H!K!J_SM?yX!LP_MHtwe@bZShv?M6qOHEQSSc5SuA01_
zB=cgQm35i4=8esN*)Ht17p?-w*}hPm5+b@&4U(5Rh(}lI?^sfCSzx^QY`7p^HgJyr
ziZM3QcWdcABKB>>B`>0<jB+}me7)5TL*;Sk8n0=0EjY~>IXL-3$cCoTc=|naWjCZ$
zaSu&_b-vcL1^;D)^4yPjIb@$$7V1b(M5%I4)jszN+UCB9pBj-wq0dFR8gy)Pz7X9=
z?zsYs<#Iw>cJ=algTlS8AG&D<fLftt%l*p^EtqUm+AnMJT-IXzn5S9XUOQt%<?$6#
zrlS`YyFB}7_bX0!;Zz}Fbm0(5m{%hU(fEBFRjBI{Gt^e&<-+U+-PX8y_wsICD6L>(
zpf1<*$rT9_31;`acZ=v1bPEQxPX2q!11O!$IQ5lgQd1g#$<D`69@X&P^Q&h#3&$44
zS@qK@t{2TQ#?~8$g&5-YXPQmAl+na`Egx&|Y#)E#osx1cFm;K(+CL@Q&x1&}2(B%t
zMiMivKUdkcP~FWgftRQd*w|3j3=3~IlfmUBe5awnX=33Ql+jyjOsYGxj9mBk;TpOR
zRual%!mZf%Y3#W4e!e>ZBF~=fv9Nh_s1Gz|>>@?3n7w#~H@9a+M2(@^l4R>!w_A{`
z5-Zh?)CV<11^JJIOu-AF!P;W!Kf~9pYAWA7KWy~*T*mR-%1N86TJHBvs2o?lg5xw_
zziSRG2<$xaDS2O=^+kbpzIFY4+dK81D(K~|ec7^e<0qwae>R)FV1vR672+C>@;qcu
z;K1H2`7E58aC=3|1`$86p*f@F>RK?)Zf{yHO5atL?a9}6C11rA5*12yr@kf)nWZVT
zSx6>EP`MTuJZL7@lT57yzlQ-3IO#a}y(dMkJI3gZN}jmEKWu=?Q<-#(hU_zJ%#ORp
zBGNOnJmL<b{o8>=3Zb0F$v-Mt^%3*C&#p_mTscXecU6xQuqkKj84kkxLvGK1*JLQV
zn$H`@6@4y7J1bHak^%8`$N_LD3)D3(z7txtm&t%D0G{=r_O)Lt9-_V0@<~s-5yg4~
z#JUY)-NEcz1J}fMTkay%X5CCF-^|UDo(?$cZbRW@W#I}8qHUD^h`km3xCQ+2RfeWf
z&kB)hEh~el<a&P68QrgJl;ZPKPhd%Qo_XsoebWgF!Jx*4H|6odb7jkMD9a66O(9AZ
zZR<gNV)v!cA<5X4pN;(b#_NXht*)tIxXjb@+Fg_+<RZ4!_Hw;M9&5~0Q;O!M^duy&
zia0SHS3o1_8g^#an^4Rz32YX>Q@7`DdOnB$q<NR35)39+5&r$pa)WFc{Tmo<ahs;j
zAPh`qQzpL{E8&HgbK7;hi8;1*yE993@vGHzA(3XqQ69`~?K>|;>uR?$WoT0<vC~GZ
z@g)lyZj!isb|~g@&;)xRc|#hffE92mpac-uab*6}+EC8%cAqIK*hqU?(<;6N_22$@
zWyo=<mn8RO_z|_9%R=?w-1@5Knjxoh%oM{pEl8dHi`M1(=Gi%`Zm}T>sDo`E%Or+q
z$DAfxXu&jdlRQ6ZfUvFWDYENbXx^|F?<w8{1+HTDuVmyO^0R`6CADC*mu;{4JcP~2
ziTt!`W8Rr)7u7OVfMF=FA*PImy;s=N7$mtCc!ABz8zBJtZgPARMy_Pi$0teXe6sEy
zjtvU-eIaTP`f<a6KUrBt{kj%aM9G=N8T9O~7g(g9G7j=nFv-b7@J}mO=tO-><;iE4
zgo?Gq#=BBAU3vWWS!#*6c;h}G`k+}bJ_J;{>N}EFF!T4({0<H9j+f@Rz9FA4WEbk9
zRLRn!qPM1M40|@ghX=r2rvo16BGtCxpM;wvHb)<9GEx=I@6sL?`I8+8k+;U%;pBOX
z<Y-#aRt;i{il_FktOFh6sTXU@jI0{94l+)+riKyD{Ijpz*h=3|s6S#W3eaK{-0wwU
zOWMU8u`mf`G{1wx!rIVDY@NcaYOtRCNvaq+541-!OS*zEyP@t?Tb;T5Y4?u{f8x?9
zbwwp?!)tQs+{~%EZ(A=<d=~Ag0?SVY3sWmiOLF~Zjly<_yIG*6wXLa*tUCaz#s9Pb
zg|lgIUySAyyq+?rIv5IG$S9-TIeO*pBQfn!Me2sjTDc#QtYR%@y9saJ)d0#o5;MOg
z*$*+FQ5Gho4l`kk{G@oHjQJs``0k-zleU%Kz-Uh?Y^>BWl*C^1X1O|e*|p_$Q9T94
z365KB!LPDKEA2yl2Z6=*Z*zm-V~D<Yuj8o1aVHX_yQz5Jm{&klKa)^@_9Af#T(+vA
zPc_+3^A5f4u?N_6ZxPbad}2@p@TF2ee@*KCBAiL4Q<tpuPHL6j#L(1VK%%z`Z9y$a
z#$XD`Ujb$Vy1DAyEL~QE+P}1~cn~N0dVRGHmKrH>R)>)}>-hwboDeG=)>=@I*H@V3
z$LmY)$>>`ang8f)D08Kc-*Ysi#+=$s8*D2W;}H?#W!Z>I=<TZOsWV|OC@(fr%bdE?
zfo4u0<vz+W+Ej0vEbZLZ9Jsc&z1f2JVL>f;QCL$N4>8p~WOfipj}~kt3u@N`2HyF1
zn+Zimcr6fKan8q}nC$PnZw3)|gy;CKIIGk9GZ)i+`q+B!XLU0T2x0N9nbU&Jv65tY
zIlhiwNLGa}L_p5T50Qe>bu$uY$NPS9Gt^XIQNDv2{abS7G`2T}TTDN%Ib-+zu0B56
zW61L}KJPe*w45e(tDQYjK%qEB=-STo@5soxthHHgel)|Dfv<1nhX7u$nD}b_60?ma
zk|^dR_k0{?lOiRmr-thC_&x~cJ|pcRlwFWKXdbwBkXwD!rP*^I{ZeVGpc_=_T0c?O
zgzV9*@#1->z*k)qm0^u!kgR3f7;ry<5v=IyFjBox<FLu;ZAV$O=2ZDV5KQ{$#EB-f
zza6utLiH3l0Tp_rQbM~m9b4Aq?KR^nUZ0mB5&FdHeL~e%vg2IrWa)?0S2vhf-QiPk
zr4kD-La`&X$&yROaycJg(iw@HS_1i`0?o)JkomKfmNdHKmKo#2ND#Ig?{Ul0ztDwI
z{xFT`DoT3di^I(ztmNr3<dF#79&dme&r!p09RlzqN=OXI)#oJ)`JPNZ-z~2OV6(BX
zPCyT_3>Q_w$670FCebV#|MYZc)aW`{U(7PcclEljl*&@i>f)RNR8+oU2A6mGQVG`l
zG}iI00QDbHZmS*F&1+aZRl{ZYGj%pO(l@%Bre0g^jdd}g>~JMTe*B2!3~o#f8xFO1
zTY#&%T^#2rx-kp7iP7zRjV)_dtv0@qa;279^c2WTS}iWP<jUBo;y@vJv1d4_-2`RK
zc)BH|+7Mz^OK&u#2W&}Ou<@IS^GiD5?szTPa$_GCPgVpMZ*HGnF0&cn_9<gT5(ow$
zRw(*3+?_nfEr^)_n({TQ4>$92HZC*4NbR;~@%Grl6?j#=>IpA?)Xb`TOWho3j!GG9
zQW$(0%Vu=%;W*kG7Yb}oTF(c$3v=^UCvTe{_ddT$^*EPSqNw`(0|EMy0ydCT<qnWx
zQ(I`tDXmih6+68c*MTt`wgjuUx_$LtDO)`H{3TLOX@vh_75T;U{p;bG`pfwgFE&vB
zo%jLOY>VT|=8p1j6#$qMe769Ola7twTU~hs&rr{FsMNbWY2Sly$x}XGouU-flc#aM
z08d}vt7SsdC4}|Icd0R=yy{qoF`3Bilj?_e33C<i)RUd-2MYx;&JDRzOLg<|kU8$c
zZF&0|3Tcj~8u<X2)xxZsutG6-k)@j@a0xIqRc`^FxhPcQ@u2iQfbdX78>1j_^diy?
zBL?L;GZyh3HR>=3zJHwmdhSx3!ESX`g1hO-*}Sx6yuQIWg6eH+e`Am<PfjHEj8hTq
z<{ZiW8N+_`k>Wf=*uZx}S99P<Yw5^BGcMlqw&Up5R>;LwCufoJ+l=QYf0pIC7a@Mu
zgR;YT&9kJHU>X#);1Hl3?HM=h{c-7r45<b(6<5lMIHj=0a`bq;5pPwSVw><N{Y^tY
z4?g$o4ea-Mt%`$9p(0i0zmOBYCCLG1olRXQ;hh?<x6lPfs2e6wSutznd0m-JpJ_Ty
zGy^ICaCyI>vgLLZxIbay*~%J47fRZEq;TSDXP1*!es!64^uBz9yw*;U_|oS2&fZ(=
zy-0@M@O@gj@K*zx=8ob*Zz>b(HpoH;>xZi#b4`@EKnl3Yp*kt@4x|_e`YL6s!j9cs
z9O3^B)czf1u>?C-g8;*pn?1+*Hr=lubf0xdi$s4}0L$PN$&9c}Y4SFD)|G3;yzKdG
z0W9*d4zP$$+dQu+^H&`Zv?|flH(m5!Fi9vlIwDpaEs9Se{7^~U+)*}Lmr()m;1Zxb
z`1n|x&5iX-95HX1|CB35b|0wgcD{v<acKM+Si75|=09G}3fFKKu+CAw1ARYr**Gj^
zX^xf1iueUqQig98Sm^*2S2JtR__YtLnw34^hb}=OUKWma5UPv51il+Xws|v)t2)Qe
zn)yK?CMdJ8Irc`Swz&AcLLaiUQh(Nd`XoK(;;wd50askpPE?yt(eYz3S(CAObL8hj
z?hM6qZVIs?2JB)n!+xH=&<V~NJwv@A$OO}U;5xD-py45vI?^Q~sj<azx<#dryPrya
z?{0{AYovLY-T6TERyDWv=;a!H$cuY$!l-o+*Ttjhgsv**<Y{O#0*4v{zjtCs%{+Cw
zagS%|J3GBVOm{F?ufkwdb~a~7>5V>^#q<s4r#2?$!LMeah-#(H{JX0L8)560fN$v;
z(OgUh(jF;iC5c_5gGs{~Dm3IhG44Bz%}$Q78NGKJBTP(0#qXf9p%#taJ!OxYuWg$H
zw*oqkTtX&a>HI#DjclcNs1%XZQx+ffGI+_9rrz^Om<MAjsSK&6ZP;}y+QYAU6{%6U
zslmQ_)X$Lqor7_H<ik{d`VewHF<sF-X5FnOW2k2t0vC%ZCDcFjZYB569OLi({-y~p
zl_jlDPne&??W1-z5qwt`F8|kBvHbDstTj~l)1~XEn%L)g4S}Fbvk`XQcb>Lj7e!`n
z!yvqH4sGdI&Hix_zBM9PoAQZu?9g-088;$pr}-sQfS6DP5r?Z(5%<LVKyVwD6ZrR>
zzNGYOBrjNZUM3ExR|(dE6-aaH%tnCTCFIUt-=i|`KW-BC4C_fv)41}pB^>olKOv%L
zg8+$y{C)9dQI=utay#u2pkeZg4M~IUTm+$Jq}^I1z9G*hfsl*OyFIU(d7Dw)f?ET#
z!Rj5mgL_dXRbbV?Kp05#qjq^UAOQ1A=Mh~8b1}a3Z*|ixXDi2|lv|a+hjXh!XP{ry
zLo+P?F9+{!^oeG`o_5{}7kMdf7WaCp*4~!F+2*|)oP<HwF&fxbs@YmNCA&S-k>m_!
zFCeajh{MgEpLorL@LkM*W)k@!VDX0$?BKJvxNgTv!f;@wl#)=d4q$;#a2MwT{cuWW
zI#hq*SXS2tAo)T`0;|}s?Y>QKm++)?2}kUK-D+=@Euh?t4D1N;U*yWrJ-b^kbl%TU
zQs9TcbcmPOMM4vMx5ap?1i0W<xjkim?PbeZ%MQZn=Q{ar??#?>Rz=-5Cw9V$1{6j+
zy21N|XWB;%w_By^P$i5sDFHL*${+WH`G|Tu&2Rc(^`5EMuri15zBU8S3-xC1dl$?J
zBzCRV7K_u*oIcEo@Tb}owA|CBJ`MHW2#uZ0LtbQr3}qeYen;;`19w5dy-via@C^l`
z(pePo?wt@FoMi7Wn&gK6(DqF?Kc8uo2=cHUeGPq8%)U^dR!d|MwY97F)`AoN`51$T
zp8!n3{%61eVbIDf3v*6HUNM^wTSs|?{*$`ViDQ+MYgkR%^5br|X9#@`Rew6)%A7$P
z`wcg|H!_{OgO=ZlIltp?uzN{>T0f=A3fu^aWmFM5!>thQWom5~|9(*YZ_~<m(~vjU
z8DVUOXWW+-U^_DYq8wMe36It(SXpD{(D-@TYsq&vvQ=gPBOZrhFIv6~cf}D4#tj2i
z4WbW1eow4y>nI7%UKXV_-$qGjIp8ix>plVH4^Q%S3`31J>B|^gZ_^X?en;O-JXg3)
zF3D(Yt6IEWet4#y!GKB$&z#*bMp3ZF<|Ac}V~$&1M`rz)HWZx_v0Bf(rZoAD%dhDn
zn`|t<2%Z<0!RYp?yii2^*>8)QGP(TT5;bD$jn(3I>!v2g10xM6_x6;(929<D-5-)K
zYIm@x`=0b+i|WVXj&mmZ$&&4{rk1^_xA5X2)@jrficfRkA8TjziQ>W-xxXTKHC!m+
zgiTUk+g!e3@rl`SBKpirruXcNEqPUbXVs!bz2h)uO>1oAv5Ecar%BCc$69-Gjhd!;
zE{PN{#CBXE+@cu04LOBy*)F2h91R5-X^R<aAAWQYFbK56rSW={W%tWD_Za(v?CoHo
zQ)JGq?eTrY=4>thX?7u74cociwzmsx;k{g=HIAKVDeH}Cn<tYuU_v=Gdr1q*zPfOd
zKg9<No;)l6r4G6CnTF2CfbLL`MvsCt?0sEe-37QI^3%k?#<?|&&~--kJ!x>eK1m#h
z$na)E(Z~yPHW=ATA}76#7H81VW{AqkkoJpUncJ*nG5BZFT*|Rw%VXP-bd6lj6=>rJ
z;sR)^f|ya!D`{BOPBU@ZXX+a7pR?%`#-2$=cLfT2=a~gBpEe(V)b>5NLHRQ(JDL+%
zDofYSuzj;>JA1XCmOlT<;!`7`Bfr-I)HVmr`Pz4m%UDXi@=YV4PD)+r-G<bNmC?~+
zo&WsD@aSEvW6=nUlXrcBi@M&%u|=vguA%~&d*b3p#-!=y9I8U|0<b*f9MX;5weBMW
zH#U{(Dj7~>!=j*zRDpUFD#NawJv9FJEg3^(zJl%W<+O6TNORH+R9s>Tr`pm5i%_GR
zV&B=4DY?c1l`pvHK(;Xmk+9TVgCgo+hY`G?V_xJ{SnfT#bY8vE*8Eqbzw=#BQrVO<
zW^tA-U|{=Ikf=#*+5Q`ulLec*4<!xzioO~7CkV`(gOn4>h?$2k{zzL?|N8~wK3o?Y
ztoPTQjhtmS%*C=I8SO(Q;>rirxu?D&O$yJ<ifa!Xf%H|H4JuGO$i?PfR^h8n(rh&r
zttah6cum*Z+>->r*Ot77iPsbZz3Ig&i$X=m)X;=})+6GATfn`?O#qclLZ>}Y4>6rU
z+5VTr@;C@kN9UUfA!>ozsWRPtK-FD6sI4_2(dKx)lJA3RyIw7O<~9pcg7Ls}d1Bf+
z41o2a>P*7^55pQK9T|RCLjQaDz!OV*$$qb~&)^9+Pv)z;pF2Hnpa80ikJ^DC->SQi
zf813-{Y%Xg+EaO4HF0uny-Joi+s4-|in>;%yDR!u(%xb#nn$FQ@6KY6^$&5<!4~df
zzHGu@k7}UZ)PgKDcGPpk&D3L&Xd6HGvZoPSLWv<Dj0(Wji+`^Ue@e`?fa^akz?4PP
zA9J$jW6m6xnzGBjDr#T13tX?9sH7YTwiY0;D8{uhp4hahew|?=?uyYSEe(3!xtlJ4
z1J`KfWB!=~V##&E&CV@Zbx@vtv+WEA(<l4NOd1S690*-4C9{TjB?SA9xuZVZH^XXx
z2fF|zfw_U2<m9Sp)hMwJ9#4<B!H%FAy?@MN4<KG9c~e2otOua)J7d?bYcoz5T91BO
zEE-8OGhJ0Tv!ieWvQ5e8JaFHympqu$hD}nW#%z1Uw7A+D&~aDeB+)Z&7r-JOvD=?f
zMM{2gLTCmy;a0T%xSB6g_zb!luK*-1r=ddNqtLY#IM-96U#|h(TdQpL$Fl<^g4sdT
zf(>u(Syg?#uq*%#ik*2W$dRU$KrP+F@_@Qt9<xYUgl=A8eF^eoG(tBbcSvobMJ<H?
zB~&%9@%ty%tuX7bqJgL}EeANc-i97_O~wW7PS#H1_Z_YMOT{F7Xiu38Vj60X(wI=#
zbYZmW+GqXa6ks@HZF0#iWhsrVz_0lU^Qlya=Ft_tmKw3M|4nLKF?=nC&lavSU7xxv
z&96@B_NuveeVm+!z^T|{e(7Ro_gK_>le50)vFCBd>36<CeW=_RR@|9|M0sC=%Pxs`
zFC)Uo(jP5o&slqKp}n!L;qg~(0ez9L0iedoX{a?Spgh6v)ho0cR<4YzWUPHMTls#J
zaNtK4zz+;t&kO*0RB`F(h5><As&S3u%1Wi~jo#f(O2m(5EY1Yd67?uZwJ9zfIP$Tq
zS-+`lUoOYr4;OEqkyvu}LB8qStp`SLJ0>vR2r*Ow;KgM-wg13}DtBzNeDe7+qA9}j
zP4BM?KwIS8C#I*x@cxTB3uTMdarPn>7cGcwY*w?su+SR_)hUl6_k7MYvIudTC0|`C
zo8Xh(Q~Kyi&lyBU3XUl6n;-q<@vZYys~%=Bh>9P}4O;Ax@y~@Y-AKMgD!g9Ysj;dD
zX=l}02fQ*<@h<0Yj5~Urni8s)SK^J^C_#RgEdahzGgOr`B23WQW3GEwN3`xybHSr~
zR<M*pAv7dn6@M3GF`qHvztEsri|8mDsQaj$L{VQ{2fF7+QC8GDr1<Tcyx&3U%E|B}
z$<+65?!uw)iLh7XDP8Ni_wK5$Xo{(~qn@*kR+i4MPMa#F#bKuv^6%&4vg(kK3PJNb
zZ(pra>ISm=F214k9+`w3qoptr3*DdZ^a<(+cdnD`It`Oi?~oNZ!te*@82+eBby?l6
zEZ3mDQOan$iS=3>Lmt*Ml3%8_VQK=2A;lpD3xRL%aiv5JlN``nPC3HsOFOa7YFVW=
zOKK+PpY~o~j+1g3%V*^5t-xLK9ke76%DMj3?YEtNvwFyx3TtCe6Xf?vTO4omYqqIL
zDDqmrtoxGN*N+feHUxAwKMf^7r8LheqYEbTtM}X*`-ukG(G)1>a_utg^qbg<Cg_V+
zBb9JqPAus;ZU|kN22f$$X4kwMCWIt%M%T`NB_#c1y4vDe^o()bx%y1moJvQ%O{W`c
zR|a#L6(ll0)R5Nno9m=C-x>nu+;%#EYn7X=6zqHL`yG^OTZYEY3X5Kepgw|0k$HES
zUvJrRGAdPn!1Typj{JpsQ{bbKu8m&@el#w@<ZhZ<5frktYkbagd%^U;Xv{61O)l+0
zB8NeV55ejH@!y@TXjkuR{KIZD?bw<v*$bh@dI8l1`c$z5;h^#YE<<TfZvl$RiU=wm
zVQ7=pj7+8y15-Cj+FC-zGE^aufC+=s^MWtE@zr#Q3h=vs6_MU+#P+b7$Od1MU8~kd
z>jcuOb6JMIfeos=7E0%<m!mrei2(eqVhUFG;aH+5U3QD9>>}B?hbdhABDK)XHdFBS
zqJ3VV;yNUT(L~#6K?1&uD#ra0BUXOg@JBN?XR_s$y`PXjd_~Iaul|FYP3Kun)A6K;
z|H1d$qUhIgZ9(8)$Ioe#r>OMVN;aM4!|mF)-=qweJLAx`SbekBi0LMkK+<SvYi9(3
zx(O@5EoZWD9BOp@-p*vnlGO3!aO6zueV2Ah*E{ELDwWpvMX#yONO#Qu7eBQUdr(w9
zykoM?YwCmD%7+D02LdI;Z<nt}d19@4=}-w<^*Q4Nuu$Vuk+iD4k*M3edTYqRR7Tjk
zKvRiZV!rfM2#A>2L>pqMefSauqa&1jWo47Rg>&7!RSXKYtj8^OTY3cJO+euUegjg5
zDx5cpJr_Amb{x}FV-0T%`5t>T6Y9#d7cg_43oP*#EJ<cyls$tJne}|#jTV4im4~SV
z8E$mais#AU(Ao1#wM~a>eOMib-<)VcmcO|~XTXT?xU$nAmH8^F%mFP&8889LfKB}8
zn@2akow-JEaF2k0#s|6-4+SocqBsBYT`wcDs6M_?EGwj?D^}L>v9YrL-c#ayKRM6b
zK&SU)ry4)pT7~w!Oy!(J-ftlQD6zFJrEQYes66DIEI1Krs!LN)K6x$1<#)T-NFs@-
z9)Ly~X=iA{S=o@Wp!O3~t?ESzkFz?_eR&=tBQK^a1vp%XE)kca-I<6q{!&Jx>LLWH
zVXLhf$E!ZNlAT+3uyL~g5T@CHp+{J>Z%`Gj1b)FMwWzqd=IJQ~JL6~cEM6kp0;0Fr
zYAkK48Sc=$tAB5Npg^#@%gC84I=TA(Mxdpt7atYBD!?@VBott0;@c6t{bEGQa-w=M
zOXb?QEB$Z4#CT}3M<UN+(DHyaST7HgEk&Mkj(^Zz?S*<MF{xIbsYz|dXT(g<Z(rBA
zkvq-SLE;8posNL*wtlwW>a;qm5evHfC7#+ak4W~3TX|J1lq{ZSdQkIMv;oR=N}F3(
z6B&kJvBGj%Cy+$bya5pAgXah;no!7qhYWZ!kzc9xg|~j;2cm+i?0(<t)WL?@F&mW+
zALpV)z3qgsp}!j5oi%Ul7nQm11)u4q)1#OTuX7uUus5QJXUbk=lgG0WB3@k5(^-hD
z2Cci7`>#SK(@M4g-8|o;oNv_;vD})Xq+m>XS3n+?|1hi#!!!e{fByg4yUu^M+PL36
zs1AfuqpGxawY6#$rCN<GDQedqsS#Ql?p9S%wDwliN{Ct^2~xX8C=n}0QB)$d2sOfU
z+@9xec;4KvPLdbr`kb8W{C?kco$JAOE!Hj$n~W+y1NDaOa>ojji6^E80r03hCl)B^
zO^MoP`1e)isCqdx=c4#hV5(K4FTe+GOWg)aU9S)B>)K~^iE-~HbHdt;#9Kn~h_0<~
zE3M~ZRdo4J?Hgur)rJaq9cDh22Qy(?*5PE2+Q8t)!VB8|F>Q9P@cms7{(f7g&}5B}
z0T0L$Q3)~6pp%4bp$!15u3B!Vv+NQ8{^X)oBSj1;`DA4>qttX!E;WkHN@x?IfsMQB
zROtrlLw(Y)l9*32Fe#<I0x3zJjiqjig_fE*%_H+4j0Y<CnE|f>K|tMO8S@g={r;@<
zTb0xP&$Ey4^xoyU5wbfuKTo5UkBQZPor8J(feH-Tqh-<di{d4=(1>i{<{eVxi*1We
zKOx2g<8~4H^!D8kK4OWX<7sQs35IK$c-1x9%i)=RNpoh+;+!85>pQq1MekF3&O6Xr
z!5dgywkFJHo#DChg7?R>UwVsyGjb7*lU@z4L>C|d+c(HA#ayK+mL+jS@bWg6m*A^D
z?klwS0o&0KvRc?9eJK=RcvrM#33mUwNCMHx99DK&y64|;F1M6PtkZ5=las0%=Mq)!
zA?vZW`3tiPaj{0m3}m*@V>+S(%?VP{->vBL{>Bo)!u(<y<^Fj1!WO6c8CYID?a>yg
z_}1l;xm%-(CCt0_(MX!28rwzs_Yv(A;~8DF`lG5x*2W!?-s{Z`17qw%pEwQep=N=L
z)Y$_t(|3lA24&8>u?~5O9oE2X!vk~ds5h}CiH8bdZtnfZiK#VHlNJ}MKG;(7FgZ7|
zToG39+>%9XiY~dw&X)GL(AGWFD~gz|p>z<gDbU$<Hsf_&pF*R3KS!ndg^j+xfloJ-
zj^J59wotj{1Ms~3wNqP(MMu`9#1bQgQ|hjxOdPhAO^LU-|5HZ%cSPt*!(S*yNTJtA
z&PAwe0^#wK;CYRUlhsV!q&ipWek5C<BKOuL$Y}3ND_O-M_)iT7hTUIznCm#+qP6y6
zISLAR8Qg#sX!!E^r&!AZx<hp>6Q3{WrVuGUdv~^IS(?2Pwdm7bZ~wJ-#ppDHPk3SP
zk)IzVjW;va?tuqSSIqj)OB+~uX79Kr{M!uPGH99PWebabhS&<GXaf2(61FLZf87q)
z3}-R;p0sd?$dgPi1uWf&+u}C-j|PieA%D4~`9`0J^)_yIotU<?f_d%yd_*nd&*?J`
z754h(Ts{)=Xlc|PY5v4cP|y>VJB?JH!|G=U$&SLNb?D|v@7R%6_-8lcu~M{tsC&RB
z3(I0BD8>q4Rj2no&Uq8@CvYpoG2zJA=w<0ac2_m$A}`7G_W_zH?(E`^!Z{B=oaWI~
z#|-aaT96f!hS~L@6c{a4SvfMw-3iu`;^X9Vfv?aLH%e%?ney0u(DjlFOvub^8k=~t
zBEK`5>y?bAR`pVR$GzX1NhKFj2tsu0TmEFOFQ|FI+}&5DZaF81py5{RTvd<T(4OdB
zobF!Rdw#8~3l*PTx7{}gAy52nz6k~&yDfIY!WsAS#%ika>Qt}dj%fl>e*KFfGkXI0
z@avo`2KiEjd?$JBj6LYOlOvmK@q$^cQWQVJ!OYC#<6F%(?qTAPyAZ@|T;EfD1_-yZ
z;aS4=-7x?usbuk_BhcEG>`v@uUvA{7=_U)X4%vI2)<_7qjwpf+Oqg;++?pFy;~sG8
z*1o2fY6`hGy7dmyO6aw<aI?H{%i;--<CcO*1};k6&$lDJ>cmIVa7IH%-P`q&B$W7x
zd=z*!yIfsO?z~p7+4qWgdQ9y;vn7W73<r<~pkOE$HQklbo`JpS09~p4+yirO%#C%8
z)Lg7UC)D2UN^cOZ;FUWA9=h<cCs*CaJqQi~DW)MCx<?L;<4z1Ud+-w>FqQKtfhHAs
z7lZO_PP%7u=8Nm-x+q^YUvu-bK)2a!A=pBH>jH96sGCx$<Qp)F7&{dc`NVy2)M=ez
zUI`jm7;Gy0CA39pMZnqNObIjQv@Qp?LYl4-AXm)A80^Vr-KtV$SZnf~5p*t43zL4T
z`o_URPNoAkZqzM6Kc}wI6JgcSa2ju6ZsYYYnz8=+T-6>+qOwgvs-mM1v9g0Fz{mgI
z3v%O$V`NKjP{|M6v)_s+CzqC&&(gRwwdMDUJ5#ahq)BK3FE6*=@4}kQVu2g5(;J~T
zMp$U<m+*CeJsM}9F?lB^0>OI$l=oKo7<*{>w`2ge0PzTJ!;{8=FJ6^)S)roQE%})_
z_sVY4?Bw7<T5Hu9H~!qJV_>e^IvI2?T(<P!Y{9^gs*hU`gY#HsIs9Vq4RdFcc59-u
zZ_j0y(W1)BUk^X__&+Ux!uuhAR8ZF)PgYG&mvBYvY!qB0SM2#D)|5iL_5*N}Kr7hC
zz3nzeyMg3Q(5n=;-ce~XynL?8>P<EAPv=O`Q-)Z}0Q^)okvjAigM<imJ~RgVSLV8E
zNx`pDy=NBDw?RS;e@t${)t_bBJDPVx&#k^Ve-|#En$)Du`(qC<wi_}Lxzn8<O5R*X
zL!s5#-A!ddE}18~`hMRBN(glW;9Nk!sJWc99&3mxoOKLI&TT8vx|`Jh^B5EKKw6(S
zCsndlK`^=aZGE|`ueU1e4I8J+sHAd_9M>sZNbP4zLW9|wq~{`O{pN{DopiZ$lV4e#
z>gAVdd~ck&A_emX6fS+N4eVRuPr$6tS<ZP@y0;eF@*nm{k=W2~3>EvU9s~j~hsZ64
zGQgk#KPYM#RI4f_Q!$b4n=c8GF1s#zOh_7OT;poB`#>)42-<$|x;NKHGy97fnMeDr
ze>sq4^9`=*ZHIe-!ajS58mmcPymAxO<5~(6X0I`Ow{9Ekr7&rcJO(xA9NQKrBAzCy
z-3|%+6!=I%uNiG`h4!vrsT0Hp#vCA!!`_@V`m(bD1{<@yRduG<E9R(ANvBxd2>tmb
zP!9U)T`a%+QYU6%@72wncv#V(HgZR#45vdc)Qyz(_Sgu_inAoAA&6a@-3wc+i=D6*
zba3;(P^#__>gVNCX@o(>xe9NcP``Ivng1-A^iiFu$lW~CH%cj&I50bN#u-tHiM+`k
zXZ*@uF9x}WhqKMDnLh2_R*n9~`#olMFQ4KQ)>3!HBA}V3Vh>#vY(&QZ-(>*&DXz$8
zP$<z>7c*xzK64u!Xv<V)2R5uY?ScJWzQgl_E%6<Q$FrqSPiEEcIUIZ@eJk#5G*wtc
zO!-jy$!X(aKEVuHc)!-vd3yA^J5_0CF91Wj5x<+C-dXl)r4Ui=mMAx)+f}(S!}Hs0
zt@ykYP9Q%?$y58saH1`gW;2o$@)i9<11N@>YV$9x?=z7C$-4r&jLjcQ72{c4e&S#J
zp1#}0y+;%@rx6#0(rKcR0f$|(C(+>%*8UK6@F=@rh6&;3?qj2#Z)KIL5}xmIazDwB
zn>EIeXps{mXfW4CuY%%Edbl9xc)#nIHC!&pU47XA>RP%sd>A0E=ltc|Ul6PsP4;b4
zg!l`>O6Zlq-0Qk$2cKM(zj+e$<)N+v$o#|3ud4K6nENskR!9FjN(z|uF8EgdP?p*c
zF2UbxU85#Kp<<AssfV|1(2CLNV$L;1#RG=6Wb<ydu8k_;3_cP~t<X|ytGc4c{S{79
ze*0CuRx=tBX~gZ%a61SH3Y3JD3R!=+KOo^NBgA>lC{8Cr>&<{C9z8GYsP*D)3NeG%
zLRd?Ls2@k@fVix&V`BZ*mDe;Z9SpY~j10hjx`BwoW4y)zk7>*}TFxU{<owS;h8b@<
zJ*GIjN_yhKWKHig{=n}ax4L3r#_s_f=UCaW_#Am4&<M6ao(i>I9FvCXv0TL*8<S>n
z<0eEYJ-Gtz(7bom$?=nXCuM_pN~i2K7JSEKxqkq*W^`q8rgp65yJIScZ*)iZRsF_n
z@U!Sj?|#V1!2W=3y-PL2Uto+v>mhTs!78a)@niT%06oP5;0f^7m+yA9HVC!4d6N9g
zsk^Up_%wcPR*Xln+9d1Ozv?m@ua=_NCI1;r9_KBLkM7hu-k<l$Z$R9*8$&@2)$2sH
z7C&iu?|T1Fdh{nXkx1BdR&}@(2I~D+iUh>B_PzDK10^E#h1K!YU&s$KcS<$2w%5&D
zy<aK7sl3(gf)2+>+NsW}C3#6&_R)I0HAJ1WaEmKqON@6o3*UF25Mjc{*08Zxb8fSm
zBWI9a<*@-$UfQE9vEv2Ly*yE!`egG7Wx<ofZZ1;$@tR2>F(3*&Mc3HOwz|F~IV7%?
z&WlYgu;?3o<11qZh{S%N$1B_x>Ws`p|B+qwLQ#j`{jqmv^pUw{Qao-Acxd}DEOQOS
zpPHPRxe?sW6w{C+!~~MjCddt2{q={QX3C<hxCZ_9SKUb<?RS5**0q--<aVnS*_T%K
zZ8ie{DgubA&=<jNUitSYn?rvlsqWbn)w<vu@#@lG0#qyKj^NV)S)Pff5+N+4^AUY-
z{go-*P;|pY{MTNentv*)do!qWlJvVtpWW^lUlM7TzRC9i5-xV7eQL{_62yhs!tFLW
z#cz&BB#^oL3+3I0(?OHt-UhE+-8_&d@M*L5&=v6mFzGjFWwuv0Z1_V|L>ikv@@#HZ
zQfeuLIbqgKJ-LO9k&_v5_p-3u{`Cp#lV|;)e;sji>!Mzdy&{c~>m&Psc(S;DwxD8~
zs><L*C>$@P@~qPM?=P_P4z3p&#EE<4eLwl}2|U_$w?Up&aJn=8WZgQ>>;5#?kpBK%
z@V}?-@UQul6(d#bbHvt)Iyx$p*D7Y4bW~U!F^Sv|yWbj<x=IOMJ3mj%kK#Us6OA4n
zd|Z`w=~PzG%FzI$<#;Y)qc=!ZpY;YS;ztQu4UO(c#SHK4)J-R6c~mXc!d(AEMu1-*
z(PPPz0`ciz0U%DtzJ37!b>|uBB1uUbc$>|Ru~oE@B`r>7$rK-=&I)P$&`_5r;KJ@R
zBo9*O+{N0Y-^ob2K5?oBClohv&ya8QjyQiIaoq=#mrX}?ar_~j%hNBbgLpv$x>u8S
zxN_cRKc8q?4(d*nF)sqdM{4qc(pl*ZwZe_*-1RA@Y#I-INfJ*%amlCr8bUokreKkf
z)SQ2%Cefx*?VG+)xBvMxcJsutw6u#3B^BCo!G8l}Ze{je_%gR%62hGO&cQYRbP$_~
zpcFdB#Iz>ITET(*-sJYdFj3z@_tt2=($@eTj*}aLRSiru(Uh`FhcMm{kV>!8?L?=P
zLd)GOQ(ZmRRQI@~3X6Z%#e86~7nNGg#<wx_y4lqHJYl2ycihuDyJ>sT2G5FS4!1m0
z3{ns_Zdm}jx0%9J^Z|#{t~C^S$f!{<LhWQlc~+oTe!m|x{wUtGb8QpM(%MB3yzAAw
zJYvDP!s*b4Xm6v6_#x!+FW=apKzbq+F4Z#f%DwgzU63c~%P!gqGd&&GF8W0;#V@X(
zK87s*kYwpN9%>*Z$P(NK_&djk$v}i;A2O_tpoOB@%S8vl<{o{idVQ<Kx`ufOqv}(R
z9{An+-$~nS>75R$)zx7a6T+y-6yN;sZX06@(6Ko={p|Msp_i5G+Qkm)@opx`>V9w1
zxFj=vr-&-#KXRfrm|MWF-O)#N^J+t!vc2gk(ehFEFAtNGF5;<jom~f`llt-x(Wu<s
ztMzKK;AE|A+pzaq!`)FG$i_+YOnbC7ht=5-?O0a_lq&a7&|pc*0RP<}gS*@38Fw_j
z<J_#RldsFsY4_>+u{uH(7Ku%=F?YY)v*~$;Pv8Pn!sd@L-Kc|VeZ^-xthBNAQG=!7
z;`Xjfu|pGN=^=R7k#dPfbnrp2S%sg*oxwl%Ey%H`GGzCd>IRfyh=kYz3!z@;2Nv2E
z(itl`;QXfQ^|dMQ^15qRR}L4*G-r#&4{Y_dz9~ZK?cE7xg?S=-eZF@OGiuFBm2(?B
zDKl{27DPRva`<$MUuhq<5m}+GtJLhaC|+|K9|*ME{bbT%6Rp>A$Q=ed3HO!JGmo`0
z@WoYK|4Oyrm^Jx02i^TA!X<`!cEK2qzT|>*7NYv_I0yV?E{^7q)4IkuJi=AvU8y!L
zXQj&Bp4skc`~2l;>je@dqW*I0^#I2Lf+H%Kc~5sY^gK;A*7>aBaw~FGQ?{jlrS0NW
zb9Cc9b<!3aVb*_ThHDx(!4~JpE@M1`9ERpKe`L~K3r*Z6S8;s-eTXkF^fCg)D4k*!
z8#awV45xFJvvj*`=iGs9LlSFJW<Yn)$Mr7bOh+IIcvt?xyg`}*f>j&i<mp*#D%2}#
z!)rVqVFrCmuv;D-i&-Nucmu1w7?HD?uFuChcYG9O?eIjn#LbeQ#g53Oq;;EV)uHlQ
z`!?x)vre%3U(H9R<s~1xKw!M|kb{Q_?d1I2nOgJQOJ^7lljGPx()L{j_TX5yvyI-N
zJvZC3@-@d5_<h7Az!a*@v%g9r<cog<(&_QzbGRg_xX(|;c)^}>VkQ>dx5G$R7r!y@
z4I|S8x;)ewwfW=Aoi#9DqQj_WZ&brkAinZ&0w7jT0Sfn)T5IUprrq3I1E%EGeO7E+
zD}v?aK4}Zqc7OEq_ziUv=i+xDjfIC|3y%HDa}~cNMcVuuz9s}g^ZC?(9Y7NneUoZ9
zUf6G+*QE+TbQ_M)5sE>Xwcl6U@|L2j22B!}OYo?DgUT}me=s-LtUSSE98QSzN1&LG
zcMZF^aGNRZ;?=+7wniu-ifWOfGc4!MEnt^&k_FTAc4Jd$M=Lt9o3QH0HOhP?C+z_|
zMCPt|FZq{cCB_UEK$TJ$pP$Dc<7E$7^FegjvrONSx)ahxj-PFsNf#dc{02S{GW$%v
zT;iNR!yo_p8X)uWmJHjIy)J3ACS11qX!~Irm&OOLdI@<{Pk3isYH@S#+SQ)0k@@ov
z|Cp%C)r%RcbY~To*oD2oxzX{OA+n-^X&G&cj<MCuqmfKd3U-%1U|PX1+A&)|c2RZA
z>8OQB8CZTnnV$70UwY#4GUec+FOg>xrPn{(Y`1@2yZmf{9DK{097#}}Etsr9LZ+|!
zC;T7@CvjWSbKwti%plnVX@yIn8JJ{MQet}77NaC<n~Mm>FqV)evR*7tCtSiefSz~&
z5dh62ywa)+IDfkV>T2+^*bAn3P8C`l+Du?47tOyrIlandART<JS{|d*6Oty5g=f2S
zKcG|Q-GagKZAEY=-dD~-qh|H)&{HpbJ4^R6?QH&3dYJnXa#4T|XYg;9YCjHmZaz;t
zcglL>=?QgDyO?Z<MV@cxru9Ds-wnt037pO$bWf`^o|VlD9>g@$g!Kz(zJC@bGQ<O^
z9f9A;qwe|!zAJo{(Gea@&c$;IpM!J5Y|!ugOQwK~(3XXv3F=B82d^@o`FUg~zynh>
zwckK)GnxOJ67?%Be_2L38Ibf-ctX4y3!hZ*66(zvk9{;;r&l5b6M3Tl1rC)Zjh!pv
zuaZV-vwKjEo9F(TeTmRj^#`1V3NrUBfdk_|Ecm*JY*>b$TQ5ELvXGRMGtT{5iFbKu
zTNiW3OkOXarpQ)Y3XD8^X?bX$y_5rGCfy>jt*R#8NlMPoB9~XVGlbhWaIM!k6_Ut9
z`3P#Fn~W63KpSl-<%yF=xwmt#6i9e0W=Ln;%&n6y(5vtyPaORwQoUQ{@|PoBpdC?T
z0%K<=A3DTR_28a{=?#mUK{Y9&1vLpo(7;iecpjVC*^Nrd%1#?~P-NdjfdP^hJ73KG
zcy(v;fXta{$fFlU)h!WN!9;=L72$2%N}*l<1sB(mw-?vD9qYX+-Jized5C-~u|>{K
zO82Vqyu}HKY;!ROF<bXk(zpvFrzTARXR_z)ylht%cH8ew!<k9f)Rr%NK<YCXSi`kn
zR?~KFSZ}9%9mPL@H-|$}lG_4@Us}6*z~2lAV;gcCemG#MtiQT2WTpNjW>jlfv&P>k
zQ@r9Msb<+s+ElIa;4t!~*H9A+v6O16!)=MFc&|yM5AMRqJvgm|D<S}}VwN0GlRHZ5
zQFh}ON8U%A<Nj0-pfRMm==e>><6#jtwe_~orgHMR>luBy8`z?&qNI$Cfnv_7Ph2zz
zeNg@OJ!HJ3<({ndwyk3gyIWZpf^E<N3T*V~RVJ~>b}(ZWhFiCux0f?Cpx78M$$C~?
z*gcJ=COKv6ITKYo#mGO69T{DT(o7|RlHe|jhVzk1HH7;%WNz6(j!<pBYsrs4>cG|i
zA-k7ufi;~JzLzd77A-2t3{zF>#=oL(4c2=^MVCq+#&?PVtD*}3S0&KU$&*Jnk}C_<
z)vSN_&0l%U$5KN$Zg*AzmOqO5k(LIl?EUj2v1_aFQ&o)$pWR>O$t{(JUmvm}wz*4+
zC2X3N(!kk!vw0ig3Kl^Zcb0=%Hw^N3=Y;0Guh#F1za=^sF$H)ZQnsVVS}y8ujf#r_
zT9Jg9Ps8|uD<i0$_;7dS?zkZqBwi&p$rVNIqa+xX&6#A9ZuvI+_*9+8x$20%E{VCH
z_M;YGHFavphRKJ>7e|kH^9{c|KkQypj(z_sN!poBMF-Og`vSj)GrPgweJUi=@guU%
z{D)$1_%7089$A`i_P|@kUxeMKz{vr+jFEVL8Aw#m=Y22=nIYM+uSdK0(FXnw`bmgu
z8)=`P5+=U56{I_Fnt`qs&csoDBKF?6Q3D`h^eJ40$n^2s8^@I<3nx==E(Lr}Ga)$~
zbKhRy62-{KW{#VKU9z_Gf}Yn`EG(W!n^LA<w@LTRsZp{NzoISLuy3q3SEiek53sCq
z3hy+eeV)gOH(Ns{@+JYlqxM>2RdX_s9nOD0y7QN*aUv@2Z%KAwn3ZLXtYfMBrB^?x
z5u=3k#Z8h@j8md<1b#LP8AtH!GIO>sK5o~$b^TY!<$Fc4_e${B7dxFVEK+k@KGKf^
zaQ0~U4ES?02!Wn{K7yPKFf+zVf!#@_u94GDe*Td+P@`?>3F}vdnl3O&&By(Vh||{U
z&X*UqAVrDV%QH=*teC2N-Ga%Ji5qX%eyi|D{Oxnt)H#bc@Of{Q$$IuuIZBE$16<Sl
z-PyC34jnr5b?@~1XZuI`kN*z;{RRKcg8v?b|7yX1<?#QdBkafk!|v_Xfs=ZH4=48V
c>(N7pniF4D9*M~UemV3&TmK$f)AsfM0A6x;@c;k-

diff --git a/docs/images/pr/chat-image-delivery/remote-before.png b/docs/images/pr/chat-image-delivery/remote-before.png
deleted file mode 100644
index 8ecc682abaf93f3c2e7dcc35da60939885685224..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 19007
zcmeIaXH-+&_b!SR6@k|R2qH+64odH+D7{DxHS}H$y+%Yu0g)a$B29YlBoXPo6MCo#
zp@kA!AaM74&iH@1_nv#t80UODKgP(HJ$AxgYt8b^XFhX(d#9;Hd57T+85tR+it-yB
zGP0|~z{l{`Rp3hdq+$pe**|0|Z(iy7rEksOuy}}CINqDS)jEHl@5<|sx^sE_9og?p
zjemBSMJRl}+QCiL8gbK?cSnb>;l|Y(iS`elrVy9&(=K9)*;<2vvw_I0zP#q@YGM1q
z{`AuU$@oPJ5r*2S*9r=3tgL?re*O9-a^Cz%WZ?G|m8g|FJm=QYywcLrO2Xvi;j2CI
z&hP$MJeF9kMIw>o&EpN=!+qmxWQ)kuIkV0BX$X=Z_LqPgdwlmMr3%k8k58XJtITxA
zuqag7^oWp=U2wvK&%~ZS{ZMQfSACsI<#A|es8N;82pQQ))-eI6i^D$kWM>)s`b{qG
z^$Z!=OPHv$L8DM7wErG7joV|Ljhlgt?CUdGMxnZ2EZ?R+fB7;qJw4)lo$LcYCnsm4
zT(7>4f{w@6uU|bpJb>+c=>iE(D9-(oYeC1vw6nhc`wH2IDRz(U|900?4>Gctr;T#=
zCE_9!^z<Gg=PAfOoU9VN-RCrU-cXW}{bUTiMn=Y^v<RF)?>z}JvJa5!RR6cj!5)i#
z2bh70V$`bpcGhZpPkcBvGq9RJ@}uO}qq}}Ei@PuUou9Av-W0<iXXS#4dS~`iHSZ5*
zYMtfRdDUP7NMAhSCK=iI*@r(P&Aw;?PWXhl(BiQ)S89Ta=hPC=t%3g2Mm`|xH0}#3
z2TuSG5y1S9gn(I-X{{4Y5B<KBZEu3Gz2@a9_B~PQ%9ShdfI|Vj3gvJ2^AMLy1>N1s
z1LK<&g|4$cU@-Uw1?}k?j9zH%?~SZU*V)Fk0d(&BYU?gdLs*OB7)Hu_W33OgnC31e
z8+7t6OTwzXn_D-Z^0Am{fNrXYW1TxXBsf4>Ss9HW-Fe8x9{EJd=47_s-S(HZu<G0+
zX}k1rrR>qXK7RAczfHRoa&n{eD;udupY0}RgYsBzL30G3_Af6Bi=TYhcr7O<;B+df
zZ!wBGhY;JSbHq!~zvch1q_j<l{%DEu8$kps$s^AW;26?wn{S%9>my;i5_Rf30p9Dw
z_fCa9I|<J;82V1siVa-n4%SSNZW<k`Ycn;Dn^<2hJ88(O!w)97ajjErz+utXuiZYb
zv*DjV_jsj1CrhS{gzXQHz_FZKJLSloTx{}4PM2x3Pw?5%KwlF7bhR%&UD8uT7yHHX
zEIQ*}Y;3Usf4Odf0UjLej&9-@<3NbGPYQu{OdpGvxK1?L;^jyoXRcbnzlM^$wKv8K
z&j>i#V4@&krtkWfNcK<ULrmYid4qDB&-wL>2UIlPq)}`)kjilPW)=mVW~Pky;YMB*
zy>PFKfPg?8i->1=*g4#$hn1Xs%-F6!c`Z}^l3G4Uuv{&P&mYr2?Y%ik$tYog={JH0
z9-r^`)d>YJv`A)Vejdt{HP3!6>2FeEID#OZbw~dFOi^yyxY7PCK9LvH6tt$=5kWIQ
zKW|ICAO*IyY2e=6S1L1YRQ%4sBB++YRp~MvA#6W{_4PGxw#!H>-t_a->Q~~BCm#F=
z_r&y*wyIM*BI&B@>xVXz>OGcT|GT=aYgd&b9&+0aWlGxhuZM+Gl^%iT8$D5D1w-no
zA{T!<`Z6<_0%raJ>@!Jz|F6aH{#su_0cEB8WoVmH^xel&{SF~hR;V)c*4?9htK%JX
zZgCr0{?Fjx;3JwfJRXW0<?vjr;9bWRLP4GH?=)ZmPszL<Emmp*?7~X#T3^;g(e!Wa
z96qC}WXy9_uF8JCK5pZh?gP3Z(Xr>lc~xtwCgRyapR2%N3M;W5i}C;FI_K7v^g=cc
z=cm|(h2qZWQ^%e-j_mC0drM1HRMEHlc~%&|B$G?B{rzk6kgZvb3U~Fr&wC~*8|ATl
z^L6I60c<LpQuNkzwRCgC-6v8FhLu*SjbZJrFP>4;Z}Gi#9r<<o?SWDxjUd8rul(~J
znt4QUxUJfjRqxZ3Hj8Lc_qM<3ags&_oSt5Bdki@v4%}#RIeQ@FUt}I{FZrGBuc6F+
z<Cv)I?d^kA9X-VrZESMy2A!X*tjEOsgS#5b4ZS$s1$;N)aKk|{Y$TsNTPLwMMaXu2
zzE~-p15{*M8Boh$*5oycR%IBrj%YpaluF~~c++)_n)=5*wl6(d?&OrQ_fmkbZ&bGn
z`c(dU3za`;KHLV*Hj<Y6{*$mMq1U-r$jA;C>cbTj)jxjx7<h~;xZJsOde$|PWBY+k
zzetZm_2Ez=FZRO)8d&4&n@Un%>kZB*fq@`W{q{?Tsfvq*U~&UKbM6e*dbfEVP}wqp
zzS<_BkCy+Lda~cfI398;@3(6a&Dc1UAzff}U$KPgmURLS?=<0bmq|#SmNl5>2eWK1
zOt2gwkn_T4@j0>-gj@i86vk)t%wPHD2jFMMf9X?@Jcm9qAxTFj78Wr;_<VTwfhCcK
zH|filPY(qzv?ogjIaCw8Dm)DvhSh}SEh?QRdYgUm0Rgl?;4FC)Kav9-S9fGHxXxwz
zd$^^sx_~6qHZ5u25dkc)a4shhl(JA}HmjL|a769&0S4x~zB@2gX|0;X=SXa7wW#TN
zoWErmvTD_vphAAk+#SzZUhIrOm7}8=C0PT$Os%l_<kthoZ(1?ze3U*dAka8d6H603
zpG^W0vGdJ7vOWaAp13?wAeSUBjpQgzSKC7`1+SBnpPkP8diKQwfmnhW9zvRFZEfx8
z!Og4f9v{Q-Qc|74TPvprSm4AX(jMPuk$s@4*+VeDvoCk`>eaCVEjnnES3J8~lKM5W
zrz}61<u85~v)?~x1(Mi@%O}^PbN?b~DagnY*nqr8wswmV2*8q8$pKG}{sWx(|DMZd
z)a217^=@Vo_=6q)GIM0e>1g7~7_(eZ1CTtn%{M;|0k$USc*%q+GiwgQ?Vt72-@jjF
z+c!Bp{Ep=M&SLn2L{7ylS3&|!Romlplzxb`#E&@4!JUtbLFKEpL!TpI0;C7j-rTEY
z>#vsupGXI&8=Fy{G|N5p2)dl7-kdBQiyNO7wm;sPe*h&S;Afd~!9_^9kgfLEHl^hu
z&+XpY?b$k&_-vAJy0q^Fv33(Le>u{oq{%2>MhZ-q@LBeFEzOE3(8}DILj1ee#92J@
z>|(ezY{_yd)#~_s=ZSQZh&}@&BOmM+05c@UfUsWYI_<N9(Fo4WkbaPiHOFpDI1i+X
zq2dzKlfegcEkUO`U}ibUNqZ%9Ia}bf>7p(7D)jpScBoIo_#^Z7{DZMF1ofCvg(vLr
z7O-P&r6%?0%T4TH#@Wwj_bv~Cr9GnDhiY6=I9E}F@gsdN5#9re)_Ujua)qZo35B|M
zZ-yNWRX{H<bPF`$m*=v9hwG!Ykw=17erOL^m*~)(zb6FK&t0Au+6=vH{SbOh?v(IA
zqY~Iqx0x0dwL6e|acbIreseK4_V&kpQH~SE`eRt5<YAdhMV>)6Yp=kOV$jgw<(vX3
z3(^&*ceFDfxUq`6E^mwoIwb{C*BskPQP8$CE@2KXuN66?!H)N}oL`EZg<d1i*UTUW
z+a;!ryG&Qn@aS<3dYPM}PY+shz2!VHQSh*^VrQmcV%a=$;Ka5wf`)f6t2qWOYu@CA
zBjB2SFU6cOe0cqZaxgN<NAtB;hbm2}T6{g}jQZ~GF>K*%r7Ie0e4vYy{2CS2u)Qhm
zI#UB=aY+uX9Sr7~CvflqJ<ECe#Rjn`y5OK^S}DZMxV!?bte!+(drW_dtJ(<=$6ukT
ze0r9IEYClA+7Ia$8o!m&UORHW2r9Q$il*PX>wkbroL<FD1?C;64aeM;*P3b!wjWGy
z1S9-j_{=pV@)|54FO_hkd8<~|3k%W**q)n$5@%=h<VxW({_3;R#I6@GL9>=Xlsi5X
z&Y_m59{+40L)sS;=+B>w^~Q~^@ugJT^rUiV!b=S+_le&hf2N?53OR2tN?c&c&R(&F
zOZRUEpIY@NSMtIF(NGU`6S#3H^F?s}Lq#zbWMBwfZVh9-^sD0lJ2+eEs?-@ppGU#N
z$7hPZq4UB2K;x`Kk4*RWGVM#qT&k!uoq%aW$b3^^$T3AgfE0&s98TxEFMdwae|fwl
zMc8(Z)2vAZ$ZXE}XNeTCv9Y$jN%WEsy`lu}Lm8HQ;J4(T{*i@-Y{rpDfRCQk1spn6
z;q%o~X!kLPJ@K6Qvw0Za7;8k_994q}((xLoLz_LjqJh;W@qz}8i-4pJM7QcBr=9dh
zK`^2}OFm2PvilxewM}mvf1udrRRG;q10WP82xgM-c(-AG)VFKdmXV%L%V*f&Hxk#W
z!En4O|MNq0;Fr7fHW)fV@Lk5|>nmDL5>isC?5R@TMKILgYiHEGR0A+UbYnHPKr@YD
z|JmwPY>rl@-06DG50}mDGd!X%MsB4|iMpUS|MM3{*?=uvJSTJFd3Q}Zx2}yOIW;51
zBW7*&yY5mx{WC4I#afTci?Ay2=G{?US?I;p!Wd^%nf*{Eziz&|(EFnjNx^g5zyp(d
zanJnzDmYRA9Dt3+hmy$iwX(Ep97fbrgnChQ{pJ-8d-t;r<or!NHy?9NG`MX`N&c;O
zohP18NB(*nxvr%BF;g}$WOuREZXnHZ??=ppGp&GWO~^bk@YpIkrlO+49BRfBXw&vZ
z!`JPMR#4kiOv!w(#orU#pW?f*%3a^$c6PK=s^6T%_<Qu0DN-Ojz*2G?RJNNG=Cj=1
zv+rn=Ffu=16-p;a>`xK)UHbSIQSaUZKC_)6q>9Ra*JWa6&f<>eFYq5+A2Yqv=rdp}
zi2`EU{&}OV+Cahi&lb1SXIiNZ0RuCOKc7l=#dE0T)9Dz9xDT2((yFomp|*fdM@)6*
z`l-X&<hGDj?60?5+uN=vw}lPcD*wlm?gaR@32Q)cX)XZCd!?Uq`7M9C9jmRKnVIRk
zlREgys3eNZ_Qe=Bq4k+jY)xo33k$^FdvURKG*4CKa?Y0xS*}}OCpYvhzQBObM7vSd
z)<44{kfY9RTFkmLYGT3J4UE+O?UDVETPNybub>ZBuB=c4#mh-PTYEE%6{#%_Ccl3D
zM9tab{Nz2{?FW-AkH#@jrP$zYBIR~Vax+rI)?nf+5L(8-{gXW<4mH)W4Ag-4Sf|DT
zW)Nn!wSjr&8Vwd!OFEZwA8es~EIzka%SbJM@toM3$Qu$868J0a&Fp9Q`6_Qrlu<Dp
zgl>6X{Vw~X4y4acwQZx;0*@eF2%6Ih=omsO8jTUfy7kd{#+vD-l|hYqk%&k$Q&RxZ
zaG7!I7bTl`mw%>cX~{)v8|SiO%KJbzg8kyPpTKk)8t*YD8hhq(97wFb{*QFo|KbAf
z<BwQm8E<#Y0`3s~L|DMNu7nNwSi3af5HJqFrVNBdDd}LOrW&KZd~~q9s?YAwN+<5%
zGK6^C5lIW=;J}lwmQ{2dFWVcPHB*Gv{#+peHRpx@isF2L*O>Y-cm|KmdZGB1@`+Tg
z7j6`Yk)(qmdE0>Xv>2?Qdd3k%;5)r=nOlaGZh;23S<|YPb!Yc&i)MAlMJD+WzEYiP
zJB`^oXEylqSiUC3t-A>{q7LJWC=O(%Sl4chxVwN^V-R}CeK+QnZC@gQYBq`zd8NIH
z`R11h$V;`hTzCACb(d{VlJ|IbtbQ>lO*pVDh<!}j>zoIA<ygqJH|T8prKJ0{t5-vq
z#1}Z4558)%QP2_?<wMTnIo}5gUAuPG{Kk!*NT38aMFdUbcg)5D`jTQJ(Y<TDQobAG
z(4UTQNRtyrd)HPCCgwciHSWt+ZPz2^wq+R10(r69=#j099h40?oU3<7=GLIx7rMRF
zuB4kOMltR<^8ER9awDeNtjvVpq;3m^guZ;Yc=GMRAwu_bXR>s5G*3(1uiN5VGO%(O
zgE0P9j@*aDAyIs#br<2Y@{$&#ymqdK<t&GqfdBsLw|+isP*?O58&$j<{4sQ7%7=+s
zYbcDI%2=tL>WP%j&zD#Hm$tY0>5xgK#)o*cAQzX%GP_zK7(sy2FuIVMqEMe&C@akt
zIkSS!ahzGoq2yGIPwB3W$pE3sr0JJVM}$H+Wo-QqX1P0&Op~$q0UqLw`C0qz_$vE8
zIosaVI#&}xaKi~^AdM;W#td`<EVnUH00O9lmGLyw@2}fl%gV?goY3H;;bz~VfJ2P~
z^+)m})6+%)^D}jhwGJb{(lC~ECJ(x_dUw);_s4s-XKIaVhK1TbQ^-}@4V3BR?RUqr
zrJJSOmiO!*!gnzfo5_iC(4(VmlQF{255NZIs#woROF|k<35^ognEpF7ydmOFZ`@FG
zY)V0NE@gR?o8pWTe(S}8$gR=5NYerszga#!jAiM}VC)`b@h2lomEhH@*GkT;wr9Mn
z7Bb<1J%ucxE+Zc~QcwBfbus$yc4Jt=7(|`8Q0$wKk5|J8!JGwCYrL?v4S>MFYssD3
z;Nm!dWH`}3WUcW?US+@47YzmFI=uMy1ajWa9d#<g48YoqLZmvkZc{?bq?YIOs6seZ
zT3wAZiXxxitjI|7loQAeZnHamN87V%TrwWJALN4fb9>yuNCqLVio%!!j1de8S>x$B
zmXE%$T>Kd-Cr7vX@T)G_Z4XG<;nswjlfq#BTMD|a6c%>&)zOZ~D*yQ=-(tPOI2<FR
zv|M;~U$=G}1q~lp{R^U`gVQxS!P64E0n4`VUYRQKYou#70e){zRyco@s!>q-=TNIY
zn*{ej#9Zd4a+Hn%tLx5KC`qXn)m0b=?<nSGB*?v;C9`w_A)hR+CbX!;4>kLW*B0x5
z?mO{<N@ZSC$zZouI!PtWeg;gLkWWxsdnt;5N$24|LCM{}dpmV(Rr@MoVrIrY`bnuq
z)kkqd94Vy$cGcMq81Oo83TqAzEF8@{d^Y0KV;>@4ZP}(+nD^egYifFSD8-ehF+J`9
zr)I$3xj#TC&D6MZ@JHE<tvh{_e6;Z8)5ZjAv(AR+{LEp#0lc(OKTF0j;>{(3M67d0
z5l{B4iw#Og`>`V@FIF-JG~Q=_%#71quK#p$*}0@(C+4t6H2c9M$*R#3qTK@%M4JAn
zcb^3p>2Wu{2NItTz|z<T<ol!m&d++B0GZmJYs>+Y0&1P0cA4_%(zN<zKJ6Wz)w;HY
zK{>#w1F)eYpN*>RT<7y^Tap}*Q1k_0E!ghZHirnce0QLZ4QHROTI=mqnW!-u+Yl|{
z^b<x^hNVaB>@Od=nyU~fXaiJAV(ahct?d{i1RgusKlfUn(nbi><7eyfztKNK7jksV
zg6LItQgL<!<)jiL<j&NH-o^RpxjE5&wyD&nCr${Os^@4En76whJ6D4Bc<**>EA7uO
zz9zKGO>_8mOmG?HKrn}d7*964o*jLmeB48dQ0Fr*OV4V2>m&H|P_j!W%iMTFcR|%P
z=y;wh*iKv=<&MCWm`ejy*4Fa!`5Mf1;6}ILVGv<=NibEkw#;a72=GTLCYj$2r!!j{
zGv#X7GM!3@$+H`AFJhl*sGq*{X>GkmZu4}q<xW^g*Skv9yb<}RqzB-g727|Cz3IFl
z0e%*U$<rsA`?9!%QM_QOYSOu~z$1VSh)ZXYt%uMFxlFwqdvM>R9xA;)d%rHP$=gIo
zS6#!1SMX?r>$o{Z$X*qbppL$g?>b&X^mgte71!2LibXzGM75Cuk7sL~t#_{X^7$fk
zG#k-z&W(*^Wkfj0CBO2cUZKufKfUk|K5T0kIS_)X&7!w`)p-N{@qH^~7M(?eD2@wd
z-8(%{K_+Z93nCn>bQRU6zu(L`{fyZG|C|T85^xZ+5|jGO5EH&|-x(3d)j_SI;FV4d
zoh)MLNRIvSQk!D;$RljhyieFNClz-E-&~X6&4!~*#^6um#UKzBHQesw2FiR5ZVc{r
ziyPjmwLpXjI@r5&stg*N6PG!%dc5;Y>dPRj4b9DJ%x!r4!R`yGpcCbbAb;d}F9e|s
znp{9H%gxvZrb0)yBArBwdQMp><{B(lDwf&^{M(Mxqk@N0@l!<wQ}WC*5}rhtFd}7c
z41mC@X-6&W#T|d;#XtnXzdbA+4Ob5vvbs8;A_Z>nrtdlRO_puM(UfeCcR#*dxpuaB
z*kXG?YY*Gn{x#H^2BAuQe8rJ*L;QC+bJFNd;OyCXvRmwB4e)b~X#mtBLF4Rfe3fen
zxLN7$pkr3f92eszf@7(DsHQvU$<~u9yT1JTV(Ge_7?NSL0Y7}un%VCe<P)|VXH_Fh
zaW|EqxViETV3K3N>WxQz{-F90c&E8Y<+ys-&EgjLVO*|i3Xj>0*L&4ppxQT{jSu4E
zj=u{uK75&4cnUrsn8ow>_hxlQ0c`8%kg2IjHFX7x=XLnq#O6kQSkh|e_s0jAp^0W4
zA=|+c`K6GPVHPaoV3Go_`Lf1~3*<@6A4}!MD;l`w0|KD}k%(&c*%|K-HJ&lYZ3Pnv
zDP9%M`G4GqDK`MN8RE4etQM$U@l)vobl1Gppc*{1$_uHxPM(6alG^AOpF7>}Eww}<
zNIV8b?66AKw-N2kF-h#P!T~I!e7*3mQC92jYe{MW+ajJI)gu?9!wOcqYm#q;?RtL?
z#q;Q=l0nDfZ4rnNh_ka<$y`2O#J&8hkfM>+^~Qo0KU~C|z+(;9)Ms!xAD_Lh?$Ygw
zr1|OTCNO#6+1(VOH|64oYM$Fho4U)5wQ_5n+GTfkZp`J_YbHvA1cGBBXg=BENIHR$
zNOoBcpGrZo(X|J(3<iI4K3o_i38F>u8d}o>jh-f*9l0_BlId$cy6(f?H|{h5MG|Io
zO^rG6MA@wlVC!;&C2(H+pzOKAv4XX@-LsTxAS1;FK5HCHJoBSY(^0ARMhy+!mx!v|
zc)o=FY^@=(`jzQ;1kK<oxP*b}Y)=${(nKt+PWNe67rD*yz0!Zi4D(psv7!skO-a(N
z-S~9-0gvAA-4P`Yn_aF!h`O*|@iSOGzzok0E@FM_eKL$Er)6Yic9Plh!HTnq8@4~<
z##rpBHdg`mZe!1^fI3npfWRdpLICgt<Q1%}_4n`Yue%;Ny8aC5`lIO52#x5N`s~W1
zw{FvP7&dm`ghx#TGL}Z)2d{Ql{(Lz`NhFa|LsH6pi03zCDQ5U)f1>Krtw%SXIVxmr
zVK$D&gPQ$^hK3Z-9d@5(WLL<kBnLbjR=3dgSzcIWI(SHGU(%NrQCFNwBTk$_!-U};
zi-{A%*7HZDIU!|kWuyAm+%{#Vldn~~!n{vKi$Jil{Iif_n<W~agnFtgCPsBc;s7l4
ziV`*RgkXGS@$gfWm~&CQz$ab^m4NXt`E#G6IV1AGG0718LRiz`=Egy{HjAy_J|QLP
z>A{6o37p3qF_*-jMo!6O3LaHzteR9DP0)+FEgx%L^9_ga4VEv~9V2RoUS;wP#<QQ$
zq=|RVjX00!M(TaM9=)F0xWxRA-)i^B;^NPC+Mn^UV*_boeIJw?A!~h!^$Di?x`T`_
zx_&e(g?b#kD(+|;sW8hNiQ&!HKaSTH+x(+(MR=fvj@_Rx4*s<EzO8yLcjqN1vrsOp
zaF?{--?lbJMys1bPvRw&$DV;c0{I<a_)R-=$MRM9L2ou|Uq!QY86HT#6@Obv@3Lc_
z$J{2DpDrZX>%brPE$Sqi`O<T?&h;AjdeoD%1Ax?DzFX*E+z)D>t$5z3Y15mo-HBYo
z@7wnE4rGl8S=rDPJeo{o7;w*B^HHY_3}j;^;2B(g`TF_UM67ZP+4iJ!t9=2Srp{rc
zMCU5VcKXfO#_DFJ))j@Vfaj#+lW!|JS&*D~0W$`b+e8N4d{u7268T^rFfybRl{Q{I
zM{V1m{z~k*H707nM5J7Y!{Ca|%`kZDQ4&btT9x>r)pXYeYt@{IvskHqVsB!u5~z-J
z-gppqP~*3NJss_(;mwc?Rs<_M73xfg7(8L3bu(_(C`^yzprC*j3y##q<!&plJFZN<
zSBRY8u>UG-PB?R$Z&oD_gcR6N(DCm~=fDn?zz;}QxTZ};n5UUQLRY!0#e3qVRl@y$
z?8vTMu9uW3D-Ng&pEorq9WxQ{T3X)gaf#-drm$SH+(S7=$u+6N9yBKtzuo##0Y;Xp
zcOkXo%No>E)X6_Y`H8uY0Ff)f_}6_uyYU*qtu2@1&pBI>&&Lokp)G~F`Le+mrcDVE
zwEQk+g<gUkE?;w83;F6dA&k?~Qza?^T>YGtHf!SL3x=G1mW-EVabxG$J?q&T*G)Y0
zbGNM_p)x_|1V5h0q~@dk6d}98xSp20fkS>#`(WwKBV4$epJB4=nKh3MA%fjkGev58
zV89z_UX6x5x^z^Ml*!j1z5Vijtwz8!_uW-W&{o%mE#J$*SJOA>`?uABCISzTskm!%
z6t*Hp>1@AxcfU=^OcaM}l)!rvrBNkD)kUB}9=fv-paEynBtwkU{w8<DrTUKJ?<Y^J
zBVzks7)_azS`uqOJ~x}!Q8zbVv5B&EwH;suZRj3y8%s=z-{<*OxLR$mUv5C^o!})A
zjaA*65~di1A&WgQe(RrNYA+b>%k0^H;+T7pP1W*sw|kX4&R%Q+{6*bJsMcX&3qSvq
zMJ4DZbvPU+$FcJU=Ne!3decN6-RwVSy7qFqHqaM<C9^f6-@}yKnjB)+iW|)ilppeg
zTN>n$<>l_F<BrSaYWRTKmTy8c)0s0qFUTtoS7XyUc=U_Av+4xFg!M^XfqtNs_r3N_
z8pUrLuG~9@|HTCyh&Yaomz$$!n0g?D&z;kMrZggO8cg*v^=_T#7RhrD8k#V554#<{
zM%0{(e6RT%SHmFY@)I7W9Z>px<VMBzhWN~67-ARggO8Onq%RsL5KSG3dN-?c^W=io
zJ!Cx#Mrxf=OtK**&}N5NR>!e?$MN6VR=lt>>*=7zrFb{R0hy;f<!NG~KN=rdxi+3&
zM@8BXGh_aV%L-wT1$aUsNyu7v62J5L+G8tpI_GbP%3tLl%}*DO;QlL}AFhzp^LkSh
z7*ffP@mOJbKJL6GUwlZspgJi_lUv6y9I`fb>((9h3g(&LZ>J|ST_smlFIV@h;R>3>
zyiyQD;S%fH+`kcZ_$kZv;p}iKCa3A5JULm+(;Avhhw+kwWSI3RLg6f1A>0IJt;_l4
zmz_{sMRpqib;gVI)x_&%e0Sz}4f-L9-P5tCbM=~pqmh;5ZAt=lP4v}ix%U9cg+TbK
zCU9jVWqmJ#sOad%2E8kI^^0;t9v4kBDt~*<urmLk4-wPXM>;z`nB9sLOcjfz3q0OR
zT+J=_LN5e^1kDra{2^HI3f!34VXXh!l@~BAYeL@?JlAJLDT&bJK3kVFk!CRZgSBf4
zfUgf)-qvSggfh8ecZlE9gm?r~l$-LGT?*6L_IC2rd6VRr+|yn!B)*=}izIxlahg}X
z;4`f7n4K(LQ*SGw%`aVmD}5}KyUuMAyxl9xAHp%iH!$u9d*<5ahy57^S~xu92hZ&{
z)Zn+Jxph)+vc*Yrz@C&+>o{OI%MU-pbKr5BtpSu9eOW*t*US*AwJoN_lsyT1!4t~7
zSsf%y<h;lY#O*vmE{|xrq8m5UPy?c^f<`|)9LuBjtdhXO`729oeS01qK{ClGS{nM4
z-D!6Lf7w&d{ga*^Ok6YO{UMm9+IjU)yep8nftImW-fXWiztEgrlxLSCW&=}ab;_f=
zA?nN6dyf_ScDl+I=rr@yqADyEC@;yF3B$i%Jm*@ErJQaa<?uP&NCdj!J<jy6O{#t1
za(`iRt~1iUZhaXMUT5W|h|w9CSuJGka8tZHPkX1Y-W~n^tgbxioix`yL&Yl#$yrd5
z)HcK+n*xDjnt0xZ(=CwlIUyoWyBy40{OBE{AU=ak_MvqJ-<ktM8Z`xtYb2&z_E)*B
zyGSnc-O1Y%R%WM^81OCJ-IgE@yFgT_iFvJ)s9K6ArX^szw+|+m*O4$SaAGRsvG}3?
z8T?~#!0~*QZ6s~EdXmNurpHy&?dzbMeWD9`S@pq(L{pYSdNW6}W*;M<xsv-W-hLo`
zt=1ycD`1oV;}(npn@4tbc$Kg{>+ZRAwcCha1=@OkW7P9vW1^TN5|*o;*gM}QBlUph
zY++$=P>Rf*KSku@=;>)+4K9%fG;*P8MJMI>l2@<jIk9U5(g@@I4(4g3NXOR>>lAUQ
z>EvnZ|1sqeN67%pgc};cZ&EW8=xt-8ciy3zwUI^5)EoO#JT_moYWhA1R1dHpvVljY
z#87dUsh`k){`qIP$krK0o>Ur7IKX&+y*uQHdCuut?*(Tk=$0q#+)Lq130o<QFR)=U
z(%dv~jb^G9z}6xddB-A*J4)7p(-FYX7omP5Lgu9;*=(9uKg2Rw;CN8ZC(AebjsnW}
zqoX3CqH8Nt&wt35RlX-F;zY!tq{Wj;d9~71AGf?-pq~b-e9k?auaPG0bz+P^I@mY%
zkZDC<Sc%MJ&WwW7XaN@L<9cwV-`+A%D5{Frs>A3&<)-n@ZDD8BbuP8%0*ttB^^9i&
zA3sOh*wHhXG+MpwpFmkqPF4=Ka}7Wif&8L-mALpyfmXm!B53MXU|{%((f}^LK&q}@
za)6C3quO5By%6_&vfk?e!~bN)x5mqZ!CL-`bqLF6pz(9~@iWEYYXNh_-zEm!l6j5a
zw;)hm-(`my{aTG#a|xICh8_$M_|yk%CYA0{J0Bc%mW&5c5e*-Q0_jX;Ped1Qu?Eo3
zX7B)wCVQW)sStjmubqUnG^ZK{=zD3>zl<H2tM@Gj-~Lt$5;7D9Vm7Hh2{<AVT}(ew
zYe1RpsVsSb!oz}3qh*<ro(ArqJSEPfP~Xb*(?8X=l7DlCK1yiRBG7quI{BL3hsK1x
z3ftntTLT%ws9I;x3anjk-;#|GC+~m3?uk*)XP)WJ5>)s?pn%i%iuEoK_Kmr6;^Uaq
zCze-hti$t+skUaBFB?Ytwc2b3Q*9SoP9Z*h4F{_#x`XE-if9TsI;*4CS#l&ozM(O`
zC;nL%o+4a_nQ%AUGTi2qtMsq4wYxb=mroVWNW>$vCaaE?#)Hv(4U+=R($uV!&Kr3Y
zzJE_{ZzDHiSpD}kGo&*l{B_K~%;jI6?k-KeSb44RS~Zc|tl6Lx==Zgo>jOllL75@9
z_=`vwU)6T=m^!yKv5t#q!K>fowbl#DtBo7f2_$bWn{Rry%l1>OJkQ-{YS&U2khKsr
z>?KtIEHql+o^?{)vElRFaEE7&s?Z#X7}W&!2Bhe3>nT@kOaH3ew6+RpZUg<U3@Ps_
zQ~rSC4FFj88dYPucR!7*kcfw9?OflWpYDOxv;&+`SzO->A0j+qnw&YC)vr75j1H#@
zQ>)iGj@k9DatEv>-x+SkM$i=Z->4`*owlc3runIc5)iiUXOLJlDg4ypKmR4=%Qbba
zJbKE?fY%znYM7)Bkt0W8xK5(#0xz6bzhoEocrSW{rqOt7rm;BU)c(@Ttl6tBfk);q
zf7a~qy3Rx?2!;LI!4meRS2HOy8Q@LYk<Wl8t#Ux!s<Ol71gKV>TCu%%?1@wz>>kk3
zZ&qn=9BVpk^u&rD{0V{yWUNVv`wq%XH!x(4|F&UbiAxl77`HgBqQMH9K6?HWx^-wc
z>6}@Rtyh(MJ*7amz@0XLKW?pCi5a^8K5vRmBcH~55+njDLP;rnXAsR5G@e0x`16#`
z9tMU7;^Ytc;RZlYgGpw}OHbT+Qp7qxN-@WK{)MP<t?>kQC`%*lNDWYu5gZS3C?)xm
zW}i(Vpw_!WB1cdLZ^pIRcE_}i`lvNSFV6kBeE__)qL)EvJKmU<4hW~u%fg&7Bk@)<
zbi(9E%#ZHfOA*hStyoex3?3=;gaLe?+g!s7fd2D#LK!39hk+koLq2)#jB%0NwB>@E
z9J`HPeIqyoSxk=R4I9v`#AP!|I^{-{&jUH=p!2&8`Fy$vhvx0P#@}9R8$Vwu#7U~6
z8^id}O?krkLyv~tf8Let&ghKER^ZbbdSrFXz`)<UHS113m@H|c$)VCO)NRY3E20b7
z-dweFeH5EN?f%wylWzLeps~iWt(0nU_qk+IXCKFP_Ug`*)^VPh8hQxT5pK-+bU(4$
zexS0tzW5YZK*^9i_)7Qj3AXLMbspv2#4BF`Nr{ZG@4N~ce9SZt#|*&+X}(EM6ocf0
ziN5@MM@8@Bhiu!BJ15^=${CqP1#p{*$?Gegl>qrC^!g#z(M`9xDd_DG6P%78{BC81
zVaU8CS;Sv82KqBHQVqX;Z74|()Hd|E%n)Hpl?HVF+fT=5RK0fQ909@IWAX02m{QG*
znavz$#nd;FqRX&1s&by4QRUJ>{8!X&2Av(^3*0fomI{Ek?hT+a*xQvajeHNZxK(Sr
z5l5-`T7awKwy$-XAUKU!QU6rs0Hjwo`He|7N(p>M`^87*8-dwC;NvwYiMcN|B^?Ba
z0^r<94cxWtESU1F>DQw#4rKwEn%S9re46{WrT5QN4HE0vE~@t+Gs-pN?oQ~|8TgT0
z?u*3kl1s*}z&J3ir2Xnkl$`0u+2Rh~>W3<tGsox%-$?VUa4P1WMB(rY&(r(c&0ae~
zK_?!#=YE%0yEA@W{0Tn_oh$)+0&38EY)TH7<S;?=l;@VeV5k;}K$c3Ko`DpXzUJ9m
zr)6_%oMIoJ*0O_APvpDU&6Enq+B4iXK14^T62hhLr*gKgov%gIyovsOJPkJch~#-$
z^g2~<7N;}ro526-_727L#^O&4TuHR~kj{NcRe1;gQKETsfQCRQu|7$_%x4obFe3jw
zTHfBO!2g^-xW4_)>CPQ!mjN=+Y;WilcSVhSRTron9E`?a)Q2H!%|1s-w3};w+)iBJ
zc!1;&R$8IQ=Cr2@6(7q`+%HaPSB*35u@!#Ozbq)<>h$f>o7*YfJoXny4c)?}X^bX<
zy-}6bQQ%YRX=VAzgO&3tSaNNrbmsjujX-zEdeFO>;r>&zv*!EKZ&wl|9ie9G=R^W@
z&uZ`QTN)mNga=!5DZ)2oWMo}4kDyssr_vmmUn_DP;b)Nmn|-hCixU(k(jX0>diYs=
z=Xd!ZS*Q1TC(OU-k(%)*B9&q6t#y2Z4@z!F2oIUpefu^Lvv}`NZnjv>LrJZ5S^aXj
zCYz&5(5CpoYz*>!e_!Y}JYb+zA^Z+4pBD<h^W7PBM%d0+O#haF*{dha-%mT8r@4qO
zy%_dZ2|bi``zmace!_F#r93XBBkLl%Q+QAbulaZ;Fzd!Q8tKY7c7y%v;s+#Wxk>}s
z3-HNf?A41OaV6o`F1bNv-CwtBcXywI#8E&72zCfKd3<rQ@*|9#I*~`e$YKkiS5`50
z9aV|`2iV#tTCJCSIAe*RlkPE2Et{_uZ@w)P@ogvO9;BJ?e}0lldWxRwj<m(<{VUjF
zkN6X-x2_9F!v9Bl<o_;H_F?6zgyP5n-IpbF1$Myt!Y4X9`Zno6kBscRJbu&q+&m!~
z84k$4UjAieWxd6y(m@b3Qu_>Oa-WJdvS<}SgCF<+nhtS>@9t;>pgDdi(kRq>xOcff
z6!bR<XOs-+yMd;<18{q)DZQ{w_fM8@$ydW$En=jAC|n5W@kF+PujhWxwT-!8CFvU)
zCIeb=f{%oxq$BVIT5+)t;qGjJ?3*D@Q+@HDePbshDH+BmPo6L`uDXX@JR;jQ7v$mL
zk&%)4s}3Hk&wgF<C!2zjGLeB=e8u<U6|#%Xp849GlsT7!gx{>U|J7uF$nE%g`+rW#
zb`c-ihC=xQYTD4ySMT!yL4X|~KCOWw>+fl!m~Xr-ywu=q&Az7#ZN4D7wx9L$<)wNq
zP8JUzr_z&sU|-tJJeVld9cmr1+)NrU9&HRd?frU>Z4*_VCSYc~*$!yJfL`UN&&X2!
zO<_RrR)X%!b{0%;IS>j~?Gkrqb9&e>2G`)m61YV~&okkvN3#PnZ%yws<&yeRIA8?R
zfc%g>#=>|ce&Ldn>v&}cTmCmn(b_L}uQfrDfo#!y?V5n(%~SI@Rgd>nR8&~O^ofgs
z=((Uti;YKdOELe&1!QY~k8oMn*B96r3PV$w1ZMXF9&{6$&Z*0z5&Elf6rDD{dktZs
zylj@T`uZ;`TnimY!yr(u%jvoPP840JUCWvim8noqf3f$OoUHvAp}>=m{*XD`{b8s>
zZF?p-Q825kAZs#JHZa<on1UV}FEx?(bwgFz@~U6je(@#(34lTLT*h4P7?4{c14vS>
z-V;S;SeWD3S_dGGQ-ulmF1HstO%ydZu4PHQUk2(wlNyH<UYJSg(8e4*5R`R!j2==Z
zkMcL8fu_9ZYf6_5JQj5tmv9Fgf$9g+>JtQXFP7TEiFNA964^Q(JZ~duftDK7!=oZ8
z_Zhxvp(<$SqE_}$;8VY2I>v{K7kU{muD2K{2yUjH3Bc_1sahY|Y&9ZIx2%1$;G;+`
z@AH+UzR%(KZh61Wr}%?=u}KW&Qa<?nYN$xMkA!picXL4*|82{;SHG36u<V4@-)MPZ
zmdP>gB4eM~c>E=rLaQTdy5-rxvC3}OgJauu#Ki$Fy!@R0x7Nkv*?Ge@NQz%F5i#2|
z<_qplm?+rMKl3-ofFCnx$p6wZ3i(?;Ft<WHFW71EV6NGAeE0jppl<yW-qW9DMVhIt
z&VHj2u}5g5zV@1+WsacQtU2+D4oU01*q!~@=1chItckv~>Wob}bHi-Z`!5eVPhRyg
z@xi>^HL*^3wehC>rtZw6s_n^>o2!&$C*lF<KbB3UBJCQC)J*3iC61nr5kDA2e|Z(^
zw0-%WEbWd^r@nQ|VR-idP}2bF^g^q=J2{B6kiMkS)YI(mKHD=$zdgv}pNpH)ZR;b}
z_f1jr(jfqSCo0If3$(qhyP`=O#ezW5D{j|6bl)I?mRriEd$A8xM!<`|GY7SO$tqA!
zaRLMni9AV{ZmV29v_d4nAk6E|cqC3HhO@)sr8yo;xtwg9)c<YMpcaT?mUrCGbsR_&
zfAZX75fL1SJk9qUy$BP+o`VgJ`|YGV1}%OYKaCuch5A2Xy626ZE*@0VJTAml=J`&D
zXD<!dJqdnnNmSbJ1iD~b$>`i94orxV-EpE)*koqCUiSeCT_%aH`?Z<6LxYF=3A<!y
zrHd-Qp~uTmOfu8%1ztD}Z%}OWG?ncb;1&)*ZDJ?v@7{z>y5jIpc-Q8qk*V=v!SN|d
zVFN$BWT@_@v}`J3^fc4X^bS2Vo3Z;V(UF?<d})Ecmm4>#@*E{dyCgby)m2sG1UB3B
z!uDbw#ylUqxABK^Y%uP};6ktwpFOdZ4uGs@6Q8&Hm>z@2MiwqM-xjRua;LQ?bcJR+
zH-R=leb$Q`o@qlQma#Ae)+4jPpv9T^8|E-)ZLuG<AC%l=o){Kb;D_!I%5ZxcwLwWW
zFS0{}68OIt#d4E<kYW~zU_PE4oecz_UwI20WY-h-c7aHKT|JEm)E61sTU!7_xwEts
zE91YPuYsIuv_=8ifyZJl6_7k%8=KXpL+2{{A%O$vscoR=KQGuTSo=iA^j!(-%m6ty
z(&B$$+Gr}zV+3jMUJ}~72s<l=!$rsB_w13LSTQXvt%Ii2ow>%%lW*|=<~MDG<mKeF
z5f7aSP}>G)nA<`z$^m2l22hPkxva;?1qb$-h}X{ncg7m7?Cg|r+_*$pLT`S0=%qqu
z-=uB?#k?XM(IZMtD*UJC_93?Qs{S`!<U%%6Y!ddQ%UtlF(g-Dk6vWBqeq!fN%J3E&
zd7!RYkeO(f9FiRwpiABJRUyLW=-b2AUGIsOfqr4N;X-l#)|BtE@`ny4BN|{*DyPCl
z>#UD?z<7<ifJ)-pfgK~N<dfW34cd)x)}J%mm7mJJmb6!bR>LhkGA@6os&p1feO0bE
z{?*6V#|%5<Wpa+%&yM$IhkCKFlI6t%KtE|Rqq<{c<Ji}v=V!NbDS^d8=Z>edbQ#pj
zwK#k=nq=*^n<swTXdVcNmFyT8q5H4n*tmfiiY~>VA|UO#E=YSksy$KQ0SFpdihvDA
z1-(*Z|HF+5p^aEk=Se_iTWVf^(K+z=;v!TlQ|5MvErVzSpwnFX`}wejMecO<f#>2^
zbh8ES{jky|hk7@<P`AJb0)cqf&Rw@3OnAZG?!}>&Cib1rgVaQcayNx7M0aUrw%ie-
zj5S3-YJq77;8{fF%CgC$H&N~_!Dm2em5A_FhZ9>dDS~EA33{Py8jvm<Djz{}_;+E_
zbaB1WsFV@fz^7i%c;;dBTS)%FDce)~&V=$dR!}Bk)&X%y9r^W6<a03eA$wNu?CTM&
zFxsIE7IwbZO?T$1+Cv!IA9=P$iyq8&U$>i7mlYruuSOr`LF{9+X>K#>Y=4HdzsaMZ
zK5vGmqltB|FZ$_rPW$9e8$2eh>oZm8x(B*i)ui=L{LVv83GJo!%yc4$n<4@!o}<yl
zw$Q1G2ECmjwKXoAK``CU8S>6|#@fAKBjd$(Q_$_64*9Eu4%+V2XW2EDl05y6*3D75
z-J3VU-5-l86cn9`ko`dpoE>|x@BX8t+--sb0lnpy7MYI%fI=Urwd{N1Y8AgbHG1}$
zmE^UtiV$3Z@i!|>z5kQ&46}a2ABQZjbnjLMy8;pQu<4M&W*{yvpth(HlD6_S!!c8j
zTleC$i+S>MOUR*AQ-6N)@&+b#e%c7*>Ei>4%bbD9omzHQ)ZkyqQ8OajPsLWl93Bw!
zO<*vil{neMVs|Zr@yWuMx2p1=^eUW_#-n|{a2*hs<pf#Zvj<croodj;SeSnpcoQf+
zoAQ8xUx*=Ia)$PgoCx3REVR#bwq@*o?4c`!y!oF47f}jZwCCFUE7%(SJ2pLuFKi)7
zVdw*tlDllyNL@k@Pa4$ub(=mX$;UKE0una#Q|d;SsNkL=!eJbetK}$?95+Ij=UG>{
z?lc{K+t<}FKeOpzdGdrfx&May@}4!>hx_=)66)JQEfflsR&SwZ`_2vyznP>5vyg!M
z6J`7%mm+p9hK5tw3THaG%J*n!L<5gxNX4HiXiO1S9ckk3I{E6{?pl`@fmX%U=Q|N6
zKMdaBP|L}$V26*zKEZ<ncYoTNdD;z)$a5K0t(KWJ4`s<81I_2W=c9SqL*@-0uT-8>
zGKe^!%D($kcK-SE5-y{X7lcp;hwlXG@<V&qL+_#s%EdBBo~p%h#$NoHNUVAB@9LJX
zUq!$dY%diBWHQE74GT^B^Be{V#Cn$l{gMjU;#+Y${3FV5K^D>)of0xt1rsRNd1^}e
z-fXCa$(oP@<N|S7@R?s$2g`iY_t0NE$KnWIZ`u>joybn@e`a(KJAl1xINSH0Zb><m
ztj>MEVK%04QF2LoRqWq|bk|WQ8VeP8Z-8do1fB_{)(zH(HD9N2(0&26+id^+Df$**
zn19J-M2K5Gz|i5O$>quEsi@oeX<AGSlWahiJQQ5Eet-?Eb(+_)8%&iP1CXn2!z!Ts
zLx)HkmaP-Lf4$22^6FJ9z+%ZkR;SXZJptY`ZJqe5OK&-`EdcL!%Jr|<xeP#I-Ay+s
z8CW+*+f=cG=vCl?+x!;|260}aDzA+iN5UzGNzjFV4s*!)djMd&%{PhKbPu1O$`Z1`
zDm?O{+yeE>=7aJfgZR9ts4e(@!*qJiDE%;^3YT)56d@VZ*0D()c5WU{xhn_jUnqlw
z@(KMj_RDmKNo{B@b_DkIw@P!F?Pm4J__pQ3oM9zPYu1?Z)`I*}k55iLI5zzrBf|@)
z9IcnieqKe-X9P^8SUO#ikS&ZbcV`@%ua9}qT&|Zu%1)|eVoqxX;bdMbG8w^v&Zsy@
zy?Y<W#zq2V6bt#_`%sptxc4Z~=nd9+N!vLgTjj(Od_=V%7@jE4k70Bs^sxl%@{uGf
zX?jxxF5ckK$_M4dc@{FVVrmCOIl5tQKs=+=-F_f-Bwu3_5cdKznOzK`avE83X24(}
zl!25JG+w2@i9Xue9L-CE!-FrckYr^j)=_;B+dlP7k@x4Hz5xcxXV9_^$j)w3GbJrH
z@hR}!HZ}Y{a#?AbZ(Q$I3zTSpW%o7R>~4~gAsCJ3ssJOM2DfEV<>s5imGF^A-s_7j
zviZtAfQDkCaz#8&&(stG3^jF6Oz5jg;dG_kHuUp`BB~R+w!eS<8t1%P@HqqP%jInE
z$<J(1{_b$^ER!6`zZ&PG@k15YufTbL;F%3+?YYn9i}?1HFGh4be?h;5I<PZ>@-}th
zBP%(v^R@m?yqw^u$IMcAD9eqi0;7q%*GFDGhqY7FC4~xWEzlOfF{_=*t}EF))1!Qw
zI*2!JeZPk}KUY6#Ia0r@W!0y!3BE@-vK}fSDur#*IN`njHV$<@?Ae0YDA!gwzfIxF
zkTp5eBlT{+iAJRT&G{wApWy0<jYy(Y`~3+n&;9h<>OOO*SejkQMy$6_v(UeVQ+Euz
z{5^(${)rKDHJ&9Gd;`=9VPRoWUhP?E;EyO_ANLh0z?>BsPW8lXw$2+ErC4(<UkK(1
z2F7vYOn(jibMGEYM}^#8(Q604TrW_!;WyXu1`_*}b@$QFMhy=2>n*p3l6iK*_=LLe
zKTQ2YVCM{6xYU?BD^c#{=2kuXr)qmtD_-F3oICu^_lj!aTy=ty3mMsE#@)`#QSJBi
z9EAqkD+%1XdPRmfAc13t%ujFyBlFF^6BlDaS=Z?vHOV??j_GMe0mbeG=p1#EYGCe1
zmD@Z~+II)ww&0MpJ9(;!lNVQV>;G&HZzHn&C1wt^4zK=uvp9M5<*l>m1q}0_VW=TH
zkzQSap!-OXL|4Z!AXuXHd|kf6@<RJz7|Wz5W!(>nM>*&znbLc3!viHBOouUyzB*<-
zaYL6+o^;=x|2<Q|SIOsua;0*0^VAVythc5@|Ce>>EWH(tmU(Cft#FuK#c7#=fO+Q%
z+eOEv6*Jl5lm9+y7H|j*U;jS`sQ(9Z)&IHtzp_=sycs)WWVhS@eP6);$ME`pHu-;L
zlmD}^|L?Cv_>Wcn$EyBkUY+qDJNb{D{KroIf8H<iA1C=g+et2|fg<73#giNfz>S;#
d;<;;NhS=FAGphcVz!fr;x0-LtUR!+pzW~aJ)R6!H

diff --git a/package-lock.json b/package-lock.json
index 171b7645a5..e3aef6ac2f 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -17727,7 +17727,8 @@
       "license": "Apache-2.0",
       "dependencies": {
         "intl-messageformat": "11.2.15",
-        "marked": "18.0.11"
+        "marked": "18.0.11",
+        "mdast-util-from-markdown": "^2.1.0"
       }
     },
     "packages/core/node_modules/@formatjs/icu-messageformat-parser": {
@@ -17933,7 +17934,6 @@
         "clsx": "^2.1.1",
         "katex": "0.18.9",
         "lucide-react": "^1.48.0",
-        "mdast-util-from-markdown": "^2.1.0",
         "mermaid": "^11.17.2",
         "react": "^19.3.0",
         "react-dom": "^19.3.0",
diff --git a/packages/cli/THIRD_PARTY_NOTICES.txt b/packages/cli/THIRD_PARTY_NOTICES.txt
index c127e54002..009d0f561c 100644
--- a/packages/cli/THIRD_PARTY_NOTICES.txt
+++ b/packages/cli/THIRD_PARTY_NOTICES.txt
@@ -1723,6 +1723,96 @@ SOFTWARE.
 
 ================================================================================
 
+Package: @types/debug@4.1.13
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/DefinitelyTyped/DefinitelyTyped.git#types/debug
+
+--- LICENSE ---
+MIT License
+
+    Copyright (c) Microsoft Corporation.
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE
+
+================================================================================
+
+Package: @types/mdast@4.0.4
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/DefinitelyTyped/DefinitelyTyped.git#types/mdast
+
+--- LICENSE ---
+MIT License
+
+    Copyright (c) Microsoft Corporation.
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE
+
+================================================================================
+
+Package: @types/ms@2.1.0
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/DefinitelyTyped/DefinitelyTyped.git#types/ms
+
+--- LICENSE ---
+MIT License
+
+    Copyright (c) Microsoft Corporation.
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE
+
+================================================================================
+
 Package: @types/node@26.6.3
 Declared license: MIT
 Selected license: MIT
@@ -1813,6 +1903,36 @@ MIT License
 
 ================================================================================
 
+Package: @types/unist@3.0.3
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/DefinitelyTyped/DefinitelyTyped.git#types/unist
+
+--- LICENSE ---
+MIT License
+
+    Copyright (c) Microsoft Corporation.
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE
+
+================================================================================
+
 Package: @vercel/oidc@3.2.0
 Declared license: Apache-2.0
 Selected license: Apache-2.0
@@ -3114,6 +3234,37 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 
 ================================================================================
 
+Package: character-entities@2.0.2
+Declared license: MIT
+Selected license: MIT
+Repository: wooorm/character-entities
+
+--- license ---
+(The MIT License)
+
+Copyright (c) 2015 Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
 Package: cliui@6.0.0
 Declared license: ISC
 Selected license: ISC
@@ -3368,6 +3519,37 @@ THE SOFTWARE.
 
 ================================================================================
 
+Package: decode-named-character-reference@1.3.0
+Declared license: MIT
+Selected license: MIT
+Repository: wooorm/decode-named-character-reference
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
 Package: delayed-stream@1.0.0
 Declared license: MIT
 Selected license: MIT
@@ -3396,6 +3578,67 @@ THE SOFTWARE.
 
 ================================================================================
 
+Package: dequal@2.0.3
+Declared license: MIT
+Selected license: MIT
+Repository: lukeed/dequal
+
+--- license ---
+The MIT License (MIT)
+
+Copyright (c) Luke Edwards <luke.edwards05@gmail.com> (lukeed.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+
+================================================================================
+
+Package: devlop@1.1.0
+Declared license: MIT
+Selected license: MIT
+Repository: wooorm/devlop
+
+--- license ---
+(The MIT License)
+
+Copyright (c) 2023 Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
 Package: dijkstrajs@1.0.3
 Declared license: MIT
 Selected license: MIT
@@ -5657,16 +5900,15 @@ SOFTWARE.
 
 ================================================================================
 
-Package: mime-db@1.52.0
+Package: mdast-util-from-markdown@2.1.0
 Declared license: MIT
 Selected license: MIT
-Repository: jshttp/mime-db
+Repository: syntax-tree/mdast-util-from-markdown
 
---- LICENSE ---
+--- license ---
 (The MIT License)
 
-Copyright (c) 2014 Jonathan Ong <me@jongleberry.com>
-Copyright (c) 2015-2022 Douglas Christopher Wilson <doug@somethingdoug.com>
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the
@@ -5689,16 +5931,15 @@ SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ================================================================================
 
-Package: mime-types@2.1.35
+Package: mdast-util-to-string@4.0.0
 Declared license: MIT
 Selected license: MIT
-Repository: jshttp/mime-types
+Repository: syntax-tree/mdast-util-to-string
 
---- LICENSE ---
+--- license ---
 (The MIT License)
 
-Copyright (c) 2014 Jonathan Ong <me@jongleberry.com>
-Copyright (c) 2015 Douglas Christopher Wilson <doug@somethingdoug.com>
+Copyright (c) 2015 Titus Wormer <tituswormer@gmail.com>
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the
@@ -5721,20 +5962,766 @@ SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ================================================================================
 
-Package: minimatch@10.2.5
-Declared license: BlueOak-1.0.0
-Selected license: BlueOak-1.0.0
-Repository: git@github.com:isaacs/minimatch
+Package: micromark@4.0.3
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark
 
---- LICENSE.md ---
-# Blue Oak Model License
+--- license ---
+(The MIT License)
 
-Version 1.0.0
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
 
-## Purpose
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
 
-This license gives everyone as much permission to work with
-this software as possible, while protecting contributors
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-core-commonmark@2.0.4
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-core-commonmark
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-factory-destination@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-factory-destination
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-factory-label@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-factory-label
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-factory-space@2.1.0
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-factory-space
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-factory-title@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-factory-title
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-factory-whitespace@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-factory-whitespace
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-character@2.1.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-character
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-chunked@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-chunked
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-classify-character@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-classify-character
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-combine-extensions@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-combine-extensions
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-decode-numeric-character-reference@2.0.2
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-decode-numeric-character-reference
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-decode-string@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-decode-string
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-edit-map@1.0.0
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-edit-map
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-encode@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-encode
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-html-tag-name@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-html-tag-name
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-normalize-identifier@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-normalize-identifier
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-resolve-all@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-resolve-all
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-sanitize-uri@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-sanitize-uri
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-subtokenize@2.1.0
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-subtokenize
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-symbol@2.0.1
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-symbol
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: micromark-util-types@2.0.3
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-types
+
+--- license ---
+(The MIT License)
+
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: mime-db@1.52.0
+Declared license: MIT
+Selected license: MIT
+Repository: jshttp/mime-db
+
+--- LICENSE ---
+(The MIT License)
+
+Copyright (c) 2014 Jonathan Ong <me@jongleberry.com>
+Copyright (c) 2015-2022 Douglas Christopher Wilson <doug@somethingdoug.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: mime-types@2.1.35
+Declared license: MIT
+Selected license: MIT
+Repository: jshttp/mime-types
+
+--- LICENSE ---
+(The MIT License)
+
+Copyright (c) 2014 Jonathan Ong <me@jongleberry.com>
+Copyright (c) 2015 Douglas Christopher Wilson <doug@somethingdoug.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
+Package: minimatch@10.2.5
+Declared license: BlueOak-1.0.0
+Selected license: BlueOak-1.0.0
+Repository: git@github.com:isaacs/minimatch
+
+--- LICENSE.md ---
+# Blue Oak Model License
+
+Version 1.0.0
+
+## Purpose
+
+This license gives everyone as much permission to work with
+this software as possible, while protecting contributors
 from liability.
 
 ## Acceptance
@@ -7534,6 +8521,37 @@ SOFTWARE.
 
 ================================================================================
 
+Package: unist-util-stringify-position@4.0.0
+Declared license: MIT
+Selected license: MIT
+Repository: syntax-tree/unist-util-stringify-position
+
+--- license ---
+(The MIT License)
+
+Copyright (c) 2016 Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+
 Package: which@2.0.2
 Declared license: ISC
 Selected license: ISC
diff --git a/packages/core/package.json b/packages/core/package.json
index cdfa244469..f0b1c42e00 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -2,7 +2,7 @@
   "name": "@maka/core",
   "version": "0.1.0",
   "license": "Apache-2.0",
-  "description": "Pure types for Maka — events, session, permission, connections.",
+  "description": "Pure types for Maka \u2014 events, session, permission, connections.",
   "type": "module",
   "sideEffects": false,
   "private": true,
@@ -182,6 +182,7 @@
   },
   "dependencies": {
     "intl-messageformat": "11.2.15",
+    "mdast-util-from-markdown": "^2.1.0",
     "marked": "18.0.11"
   }
 }
diff --git a/packages/core/src/__tests__/artifacts.test.ts b/packages/core/src/__tests__/artifacts.test.ts
index b2489ad63a..66fd52cb00 100644
--- a/packages/core/src/__tests__/artifacts.test.ts
+++ b/packages/core/src/__tests__/artifacts.test.ts
@@ -59,29 +59,6 @@ describe('Artifact turn key', () => {
 });
 
 describe('Artifact source policy', () => {
-  test('image delivery placeholders are not child-result outputs', () => {
-    for (const status of ['pending', 'failed'] as const) {
-      assert.equal(
-        isArtifactChildResultOutput({
-          source: 'tool_result_projection',
-          imageDelivery: { messageId: 'message', source: '/tmp/image.png', status },
-        }),
-        false,
-      );
-    }
-    assert.equal(
-      isArtifactChildResultOutput({
-        source: 'tool_result_projection',
-        imageDelivery: {
-          messageId: 'message',
-          source: '/tmp/image.png',
-          status: 'ready',
-          contentSha256: 'a'.repeat(64),
-        },
-      }),
-      true,
-    );
-  });
   test('keeps workflow-owned evidence out of independent user deletion', () => {
     for (const source of ARTIFACT_SOURCES) {
       assert.equal(
diff --git a/packages/core/src/__tests__/image-markdown.test.ts b/packages/core/src/__tests__/image-markdown.test.ts
index c983b397ab..b383995701 100644
--- a/packages/core/src/__tests__/image-markdown.test.ts
+++ b/packages/core/src/__tests__/image-markdown.test.ts
@@ -19,7 +19,11 @@
 
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
-import { markdownImageSources, parseMarkdownImageDestination } from '../image-markdown.js';
+import {
+  positionedMarkdownImages,
+  markdownImageSources,
+  parseMarkdownImageDestination,
+} from '../image-markdown.js';
 import { IMAGE_MARKDOWN_MAX_LENGTH } from '../image-delivery.js';
 
 test('canonical destinations retain document order, references and explicit attachments', () => {
@@ -68,3 +72,32 @@ test('inline destinations require one complete image token with no trailing synt
   ])
     assert.equal(parseMarkdownImageDestination(source), undefined);
 });
+
+test('canonical image ranges address exact occurrences without touching shared definitions or examples', () => {
+  const text =
+    '`![code][p]`\n\n> ![one][p]\n\n![two][p]\n\n[p]: <https://example.com/a.png?token=secret>\n';
+  const refs = positionedMarkdownImages(text);
+  assert.deepEqual(
+    refs.map((ref) => ref.raw),
+    ['![one][p]', '![two][p]'],
+  );
+  assert.deepEqual(
+    refs.map((ref) => text.slice(ref.start, ref.end)),
+    refs.map((ref) => ref.raw),
+  );
+  assert.deepEqual(
+    refs.map((ref) => ref.alt),
+    ['one', 'two'],
+  );
+  assert.ok(refs.every((ref) => ref.source === 'https://example.com/a.png?token=secret'));
+});
+
+test('position adapters preserve existing GFM exclusions and archived entity identities', () => {
+  for (const text of ['https://example.com/![x](/tmp/a.png)', 'www.example.com/![x](/tmp/a.png)']) {
+    assert.deepEqual(markdownImageSources(text), []);
+    assert.deepEqual(positionedMarkdownImages(text), []);
+  }
+  const text = '![x](https://example.com/a?token=secret&amp;v=1)';
+  assert.deepEqual(markdownImageSources(text), ['https://example.com/a?token=secret&amp;v=1']);
+  assert.equal(positionedMarkdownImages(text)[0]?.source, markdownImageSources(text)[0]);
+});
diff --git a/packages/core/src/artifacts.ts b/packages/core/src/artifacts.ts
index 6a0e99e102..1cd87adc5c 100644
--- a/packages/core/src/artifacts.ts
+++ b/packages/core/src/artifacts.ts
@@ -186,11 +186,7 @@ export function isArtifactSharedSessionReadable(record: Pick<ArtifactRecord, 'so
   return ARTIFACT_SOURCE_POLICIES[record.source].sharedReadable;
 }
 
-export function isArtifactChildResultOutput(
-  record: Pick<ArtifactRecord, 'source'> & Partial<Pick<ArtifactRecord, 'imageDelivery'>>,
-): boolean {
-  if (record.imageDelivery?.status === 'pending' || record.imageDelivery?.status === 'failed')
-    return false;
+export function isArtifactChildResultOutput(record: Pick<ArtifactRecord, 'source'>): boolean {
   return CHILD_RESULT_OUTPUT_SOURCES.has(record.source);
 }
 
diff --git a/packages/core/src/image-delivery.ts b/packages/core/src/image-delivery.ts
index 81f3b897be..da283ea307 100644
--- a/packages/core/src/image-delivery.ts
+++ b/packages/core/src/image-delivery.ts
@@ -71,7 +71,19 @@ export interface ImageDeliveryRequest {
   /** Client permits remote media loading; the Host also checks application outbound policy. */
   readonly loadRemote?: boolean;
 }
+/** Stable source identity, independent of retry or display authority. */
+export interface ImageDeliveryIdentity {
+  readonly sessionId: string;
+  readonly turnId: string;
+  readonly messageId: string;
+  readonly source: string;
+}
+/** Attempts are workflow state; only successful captures become Artifacts. */
+export type ImageDeliveryAttempt =
+  | { readonly status: 'pending' }
+  | { readonly status: 'failed'; readonly reason: ImageDeliveryFailure };
 export type ImageDeliveryResult =
+  // Legacy wire spelling: the client has not granted remote display authority.
   | { readonly status: 'requires_confirmation' }
   | { readonly status: 'pending' }
   | { readonly status: 'ready'; readonly artifactId: string }
diff --git a/packages/core/src/image-markdown.ts b/packages/core/src/image-markdown.ts
index 5d823080c6..ae27460cfe 100644
--- a/packages/core/src/image-markdown.ts
+++ b/packages/core/src/image-markdown.ts
@@ -18,6 +18,8 @@
  */
 
 import { Lexer, Marked } from 'marked';
+import { fromMarkdown } from 'mdast-util-from-markdown';
+import type { Nodes } from 'mdast';
 import { IMAGE_MARKDOWN_MAX_LENGTH } from './image-delivery.js';
 
 const parser = new Marked({ gfm: true });
@@ -45,3 +47,30 @@ export function parseMarkdownImageDestination(source: string): string | undefine
   const [token] = Lexer.lexInline(markdown, { gfm: true });
   return token?.type === 'image' && token.raw === markdown ? token.href : undefined;
 }
+
+/** Source ranges are an adapter detail; canonical destinations retain Marked's
+ * existing GFM and entity semantics, including identities saved by older Hosts. */
+export function positionedMarkdownImages(text: string) {
+  const images = markdownImages(text);
+  if (!images.length) return [];
+  const destinations = new Map(images.map((image) => [image.raw, image.source]));
+  const canonical = new Set(images.map((image) => image.source));
+  const positioned: { raw: string; source: string; alt: string; start: number; end: number }[] = [];
+  const pending: Nodes[] = [fromMarkdown(text)];
+  while (pending.length) {
+    const node = pending.pop()!;
+    if (node.type === 'image' || node.type === 'imageReference') {
+      const start = node.position?.start.offset;
+      const end = node.position?.end.offset;
+      if (start === undefined || end === undefined) continue;
+      const raw = text.slice(start, end);
+      const source =
+        destinations.get(raw) ??
+        (node.type === 'image' && canonical.has(node.url) ? node.url : undefined);
+      if (source !== undefined) positioned.push({ raw, source, alt: node.alt ?? '', start, end });
+    } else if ('children' in node) {
+      for (let i = node.children.length - 1; i >= 0; i--) pending.push(node.children[i]!);
+    }
+  }
+  return positioned;
+}
diff --git a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
index 98c759453e..94be54d8e3 100644
--- a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
+++ b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
@@ -125,7 +125,7 @@ async function fixture(
         return authority.store.create(input);
       },
       findImageDelivery: authority.store.findImageDelivery,
-      deleteOwnedArtifactInSession: authority.store.deleteOwnedArtifactInSession,
+      setImageDeliveryAttempt: authority.store.setImageDeliveryAttempt,
     },
     admission: new SessionAdmissionGate(),
     limits,
@@ -278,7 +278,7 @@ test('automatically saves a local delivery without any UI request; deletion and
         input.messageId,
         source,
       );
-      assert.equal(record?.imageDelivery?.status, 'ready');
+      assert.equal(record?.status, 'ready');
       const bytes = await reopened.store.readBinaryInSession(input.sessionId, result.artifactId);
       assert.equal(bytes.ok, true);
       if (bytes.ok) assert.equal(bytes.base64, PNG.toString('base64'));
@@ -570,8 +570,7 @@ test('truncated HTTP images are rejected, and an explicit retry archives the rep
     });
     assert.equal(requests, 1);
     const failed = await f.authority.store.listPage(REQUEST.sessionId, { offset: 0, limit: 10 });
-    assert.equal(failed.total, 1);
-    assert.equal(failed.records[0]?.imageDelivery?.status, 'failed');
+    assert.equal(failed.total, 0, 'failed delivery is not a file');
     content = PNG;
     assert.equal((await f.service.resolve({ ...identity, retry: true })).status, 'pending');
     await f.service.waitForIdle();
@@ -678,8 +677,16 @@ test('pending capture survives persistence failure and is removed only after a d
     observe(f.service, REQUEST.source);
     await f.service.waitForIdle();
     const pending = await f.authority.store.listPage(REQUEST.sessionId, { offset: 0, limit: 10 });
-    assert.equal(pending.total, 1);
-    assert.equal(pending.records[0]?.imageDelivery?.status, 'pending');
+    assert.equal(pending.total, 0, 'pending capture is not an artifact');
+    assert.deepEqual(
+      await f.authority.store.findImageDelivery(
+        REQUEST.sessionId,
+        REQUEST.turnId,
+        REQUEST.messageId,
+        REQUEST.source,
+      ),
+      { status: 'pending' },
+    );
     assert.equal(f.errors.length, 1);
     failPublication = false;
     assert.equal((await f.service.resolve(REQUEST)).status, 'pending');
@@ -1397,3 +1404,34 @@ test('automatic capture and PublishImage share content quota without merging the
     await f.close();
   }
 });
+
+test('a queued retry reports pending instead of replaying the previous failure', async () => {
+  let release!: () => void;
+  const blocked = new Promise<void>((resolve) => {
+    release = resolve;
+  });
+  let fail = true;
+  const f = await fixture(undefined, async (_sessionId, path) => {
+    if (path !== REQUEST.source) await blocked;
+    else if (fail) throw Object.assign(new Error('missing'), { code: 'ENOENT' });
+    return checkedChatImage(PNG);
+  });
+  try {
+    observe(f.service, REQUEST.source);
+    await f.service.waitForIdle();
+    assert.deepEqual(await f.service.resolve(REQUEST), { status: 'failed', reason: 'not_found' });
+    observe(f.service, '/tmp/blocker-one.png');
+    observe(f.service, '/tmp/blocker-two.png');
+    while (f.reads < 3) await new Promise((resolve) => setImmediate(resolve));
+    fail = false;
+    assert.deepEqual(await f.service.resolve({ ...REQUEST, retry: true }), { status: 'pending' });
+    assert.deepEqual(await f.service.resolve(REQUEST), { status: 'pending' });
+    release();
+    await f.service.waitForIdle();
+    assert.equal((await f.service.resolve(REQUEST)).status, 'ready');
+    assert.deepEqual(f.errors, []);
+  } finally {
+    release();
+    await f.close();
+  }
+});
diff --git a/packages/runtime-host/src/server/chat-image-delivery.ts b/packages/runtime-host/src/server/chat-image-delivery.ts
index 54f067b22d..5de026cccb 100644
--- a/packages/runtime-host/src/server/chat-image-delivery.ts
+++ b/packages/runtime-host/src/server/chat-image-delivery.ts
@@ -27,6 +27,8 @@ import {
   type ImageDeliveryRequest,
   type ImageDeliveryResult,
   type ImageDeliveryFailure,
+  type ImageDeliveryIdentity,
+  type ImageDeliveryAttempt,
 } from '@maka/core/image-delivery';
 import {
   ImageArchiveQuotaError,
@@ -44,9 +46,7 @@ import {
   type ChatImageBytes,
 } from './chat-image-source.js';
 
-interface DeliveryIdentity extends ImageDeliveryRequest {
-  readonly sessionId: string;
-}
+type DeliveryIdentity = ImageDeliveryIdentity & ImageDeliveryRequest;
 interface DeliveryJob {
   readonly done: Promise<void>;
   run(): Promise<void>;
@@ -55,7 +55,7 @@ interface DeliveryJob {
 export interface ChatImageDeliveryPorts {
   readonly artifacts: Pick<
     InteractiveArtifactStoreWriter,
-    'create' | 'findImageDelivery' | 'deleteOwnedArtifactInSession'
+    'create' | 'findImageDelivery' | 'setImageDeliveryAttempt'
   >;
   readonly admission: SessionAdmissionGate;
   isPresent(sessionId: string): Promise<boolean>;
@@ -99,18 +99,16 @@ export class ChatImageDeliveryService {
 
   async resolve(identity: DeliveryIdentity): Promise<ImageDeliveryResult> {
     if (this.#closed) return { status: 'unavailable' };
-    const record = await this.ports.artifacts.findImageDelivery(
+    const metadata = await this.ports.artifacts.findImageDelivery(
       identity.sessionId,
       identity.turnId,
       identity.messageId,
       identity.source,
     );
-    const metadata = record?.imageDelivery;
     // A browser decode/read failure is not authority to destroy saved history.
-    if (metadata?.status === 'ready') return { status: 'ready', artifactId: record!.id };
-    if (metadata?.status === 'failed' && !identity.retry)
-      return { status: 'failed', reason: metadata.reason! };
+    if (metadata?.status === 'ready') return metadata;
     if (this.#jobs.has(deliveryKey(identity))) return { status: 'pending' };
+    if (metadata?.status === 'failed' && !identity.retry) return metadata;
     // A client-provided path is never a read grant. Legacy/restarted deliveries
     // must be found in canonical assistant text before any source is opened.
     if (!metadata) {
@@ -123,22 +121,6 @@ export class ChatImageDeliveryService {
         return { status: 'failed', reason: 'not_allowed' };
       if (!identity.loadRemote) return { status: 'requires_confirmation' };
     }
-    if (metadata?.status === 'failed') {
-      return this.ports.admission.runOrJoin(identity.sessionId, async () => {
-        if (this.#closed) return { status: 'unavailable' };
-        if (this.#jobs.has(deliveryKey(identity))) return { status: 'pending' };
-        if (this.#jobs.size >= 128) return { status: 'failed', reason: 'queue_full' };
-        await this.ports.artifacts.deleteOwnedArtifactInSession(
-          identity.sessionId,
-          record!.id,
-          'tool_result_projection',
-        );
-        // Capture outlives this admission and takes its own write admissions.
-        return this.ports.admission.detach(() => this.#enqueue(identity))
-          ? { status: 'pending' }
-          : { status: 'failed', reason: 'queue_full' };
-      });
-    }
     return this.#enqueue(identity)
       ? { status: 'pending' }
       : { status: 'failed', reason: 'queue_full' };
@@ -197,49 +179,24 @@ export class ChatImageDeliveryService {
       messageId,
       source,
     );
-    if (existing?.imageDelivery?.status !== 'pending' && existing) return;
+    if (existing?.status === 'ready' || (existing?.status === 'failed' && !identity.retry)) return;
     const metadata = { messageId, source };
     const resultId = `chat_image_result_${deliveryKey(identity)}`;
-    const pendingId = existing?.id ?? `chat_image_request_${deliveryKey(identity)}`;
-    const base = {
-      sessionId,
-      turnId,
-      name: 'chat-image',
-      source: 'tool_result_projection' as const,
-    };
-    const publish = async (input: Parameters<InteractiveArtifactStoreWriter['create']>[0]) =>
+    const publish = async (write: () => Promise<unknown>) =>
       this.ports.admission.runOrJoin(sessionId, async () => {
         if (this.#abort.signal.aborted || !(await this.ports.isPresent(sessionId))) return;
         try {
-          await this.ports.artifacts.create(input);
-          // Retain a pending request only until a terminal record is durable.
-          // A crash between these writes still replays the terminal record.
-          if (input.imageDelivery?.status !== 'pending')
-            await this.ports.artifacts.deleteOwnedArtifactInSession(
-              sessionId,
-              pendingId,
-              'tool_result_projection',
-            );
+          await write();
         } catch (error) {
           if (error instanceof ImageArchiveQuotaError) throw error;
           throw new ImagePersistenceError('Image persistence failed', { cause: error });
         }
       });
+    const publishAttempt = (attempt: ImageDeliveryAttempt) =>
+      publish(() => this.ports.artifacts.setImageDeliveryAttempt(identity, attempt));
     const publishFailure = (reason: ImageDeliveryFailure) =>
-      publish({
-        ...base,
-        id: resultId,
-        kind: 'file',
-        content: '',
-        imageDelivery: { ...metadata, status: 'failed', reason },
-      });
-    await publish({
-      ...base,
-      id: pendingId,
-      kind: 'file',
-      content: '',
-      imageDelivery: { ...metadata, status: 'pending' },
-    });
+      publishAttempt({ status: 'failed', reason });
+    await publishAttempt({ status: 'pending' });
     if (this.#abort.signal.aborted || !(await this.ports.isPresent(sessionId))) return;
     const readAbort = new AbortController();
     // Keep the read deadline alive even when a source has no active handles.
@@ -285,16 +242,18 @@ export class ChatImageDeliveryService {
       return;
     }
     try {
-      await publish(
-        readyChatImageArtifact({
-          id: resultId,
-          sessionId,
-          turnId,
-          name: base.name,
-          ...metadata,
-          image,
-          limits: this.ports.limits,
-        }),
+      await publish(() =>
+        this.ports.artifacts.create(
+          readyChatImageArtifact({
+            id: resultId,
+            sessionId,
+            turnId,
+            name: 'chat-image',
+            ...metadata,
+            image,
+            limits: this.ports.limits,
+          }),
+        ),
       );
     } catch (error) {
       if (!(error instanceof ImageArchiveQuotaError)) throw error;
diff --git a/packages/runtime-host/src/server/execution-composition.ts b/packages/runtime-host/src/server/execution-composition.ts
index e33904dc1b..330f1a5104 100644
--- a/packages/runtime-host/src/server/execution-composition.ts
+++ b/packages/runtime-host/src/server/execution-composition.ts
@@ -17,6 +17,7 @@
  * under the License.
  */
 
+import { createAssistantMessageReader } from './session-transcript-reader.js';
 import { createImageFileReader } from '@maka/runtime/image-file-reader';
 import { ChatImageDeliveryService } from './chat-image-delivery.js';
 import { downloadChatImage, ImageSourceError } from './chat-image-source.js';
@@ -632,52 +633,11 @@ export async function createExecutionRuntimeHostComposition(
         });
         return result;
       },
-      readMessage: async (identity) => {
-        await requireSessionManager(manager).ensureTranscriptLedgerForRead(identity.sessionId);
-        const [turn] = await stores.runtimeEventStore.readTranscriptTurns(identity.sessionId, {
-          turnId: identity.turnId,
-        });
-        if (!turn) return undefined;
-        for (
-          let position = turn.firstOrdinal, runs = 0;
-          position <= turn.lastOrdinal && runs < 16;
-          runs++
-        ) {
-          const found = await stores.runtimeEventStore.readTranscriptRun(
-            identity.sessionId,
-            {
-              direction: 'newer',
-              throughOrdinal: turn.lastOrdinal,
-              position,
-              maxEvents: 4096,
-              maxBytes: 16 * 1024 * 1024,
-              maxRecordBytes: 8 * 1024 * 1024,
-            },
-            (run, events) => {
-              let text: string | undefined;
-              for (const { event } of events) {
-                if (
-                  event.partial ||
-                  event.turnId !== identity.turnId ||
-                  event.role !== 'model' ||
-                  event.content?.kind !== 'text'
-                )
-                  continue;
-                if (
-                  (event.refs?.storedMessageId ?? event.refs?.providerEventId ?? event.id) ===
-                  identity.messageId
-                )
-                  text = event.content.text;
-              }
-              return { text, next: run.lastOrdinal + 1 };
-            },
-          );
-          if (!found) break;
-          if (found.text !== undefined) return found.text;
-          position = found.next;
-        }
-        return undefined;
-      },
+      readMessage: createAssistantMessageReader({
+        events: stores.runtimeEventStore,
+        ensureTranscriptLedger: (sessionId) =>
+          requireSessionManager(manager).ensureTranscriptLedgerForRead(sessionId),
+      }),
     });
     // Shared with recall's material fetch, so a file brought in from another
     // Session is answered by the same reader that answers one stored here.
@@ -820,13 +780,9 @@ export async function createExecutionRuntimeHostComposition(
         return Uint8Array.from(Buffer.from(result.base64, 'base64'));
       },
       list: async (invocation) =>
-        (await openedArtifactStore.listTurnArtifacts(invocation.sessionId, invocation.turnId))
-          .filter(
-            (record) =>
-              record.imageDelivery?.status !== 'pending' &&
-              record.imageDelivery?.status !== 'failed',
-          )
-          .map(pluginAttachmentRef),
+        (await openedArtifactStore.listTurnArtifacts(invocation.sessionId, invocation.turnId)).map(
+          pluginAttachmentRef,
+        ),
     });
     const webSearchService = createHostWebSearchService({
       policy: runtimePolicyStores.operations,
@@ -1942,7 +1898,9 @@ export async function createExecutionRuntimeHostComposition(
       // Fresh WorkHub Turns use the coordinating Agent directly. Persisted
       // routing decisions remain readable for recovery of historical Turns.
       undefined,
-      (sessionId, event) => imageDelivery?.observe(sessionId, event),
+      (sessionId, event) => {
+        if (event.type === 'text_complete') imageDelivery?.observe(sessionId, event);
+      },
     );
     const coordinator = rootCoordinator;
     const pluginModel = createHostPluginModel({
diff --git a/packages/runtime-host/src/server/session-transcript-reader.ts b/packages/runtime-host/src/server/session-transcript-reader.ts
index 2749bf1372..abce9aa095 100644
--- a/packages/runtime-host/src/server/session-transcript-reader.ts
+++ b/packages/runtime-host/src/server/session-transcript-reader.ts
@@ -650,3 +650,63 @@ function createTranscriptProjection(invocations: readonly RuntimeInvocationRecor
     },
   };
 }
+
+/** Resolves only settled canonical assistant text; presentation cannot grant a file read. */
+export function createAssistantMessageReader(input: {
+  events: Pick<
+    ExecutionStoresWriter<'interactive'>['runtimeEventStore'],
+    'readTranscriptTurns' | 'readTranscriptRun'
+  >;
+  ensureTranscriptLedger(sessionId: string): Promise<void>;
+}) {
+  return async (identity: {
+    sessionId: string;
+    turnId: string;
+    messageId: string;
+  }): Promise<string | undefined> => {
+    await input.ensureTranscriptLedger(identity.sessionId);
+    const [turn] = await input.events.readTranscriptTurns(identity.sessionId, {
+      turnId: identity.turnId,
+    });
+    if (!turn) return undefined;
+    for (
+      let position = turn.firstOrdinal, runs = 0;
+      position <= turn.lastOrdinal && runs < 16;
+      runs++
+    ) {
+      const found = await input.events.readTranscriptRun(
+        identity.sessionId,
+        {
+          direction: 'newer',
+          throughOrdinal: turn.lastOrdinal,
+          position,
+          maxEvents: 4096,
+          maxBytes: 16 * 1024 * 1024,
+          maxRecordBytes: 8 * 1024 * 1024,
+        },
+        (run, events) => {
+          let text: string | undefined;
+          for (const { event } of events) {
+            if (
+              event.partial ||
+              event.turnId !== identity.turnId ||
+              event.role !== 'model' ||
+              event.content?.kind !== 'text'
+            )
+              continue;
+            if (
+              (event.refs?.storedMessageId ?? event.refs?.providerEventId ?? event.id) ===
+              identity.messageId
+            )
+              text = event.content.text;
+          }
+          return { text, next: run.lastOrdinal + 1 };
+        },
+      );
+      if (!found) break;
+      if (found.text !== undefined) return found.text;
+      position = found.next;
+    }
+    return undefined;
+  };
+}
diff --git a/packages/storage/src/__tests__/image-delivery-storage.test.ts b/packages/storage/src/__tests__/image-delivery-storage.test.ts
new file mode 100644
index 0000000000..86972386ad
--- /dev/null
+++ b/packages/storage/src/__tests__/image-delivery-storage.test.ts
@@ -0,0 +1,219 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { DatabaseSync } from 'node:sqlite';
+import { mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createHash } from 'node:crypto';
+import { createSqliteArtifactStoreWriteAuthority } from '../artifact-store.js';
+import { migrateSqliteArtifactDatabase } from '../sqlite-artifact-schema.js';
+import { assertImageArchiveQuota, ImageArchiveQuotaError } from '../artifact-image-storage.js';
+import { DEFAULT_IMAGE_ARCHIVE_LIMITS } from '@maka/core/image-delivery';
+import { readImageDeliveryAttempt } from '../sqlite-image-delivery.js';
+
+const identity = {
+  sessionId: 'session-1',
+  turnId: 'turn-1',
+  messageId: 'message-1',
+  source: '/tmp/image.png',
+};
+const lookup = (
+  store: ReturnType<typeof createSqliteArtifactStoreWriteAuthority>['store'],
+  i = identity,
+) => store.findImageDelivery(i.sessionId, i.turnId, i.messageId, i.source);
+
+test('attempts survive reopen and copy, never appear as files, and purge without an artifact', async () => {
+  const root = await mkdtemp(join(tmpdir(), 'maka-image-attempt-'));
+  let authority = createSqliteArtifactStoreWriteAuthority(root);
+  try {
+    await authority.store.setImageDeliveryAttempt(identity, {
+      status: 'failed',
+      reason: 'not_found',
+    });
+    assert.equal(
+      (await authority.store.listPage(identity.sessionId, { offset: 0, limit: 10 })).total,
+      0,
+    );
+    assert.deepEqual(
+      await authority.store.listTurnArtifacts(identity.sessionId, identity.turnId),
+      [],
+    );
+    authority.close();
+    authority = createSqliteArtifactStoreWriteAuthority(root);
+    assert.deepEqual(await lookup(authority.store), { status: 'failed', reason: 'not_found' });
+    await authority.store.copyConversationArtifacts({
+      sourceSessionId: identity.sessionId,
+      targetSessionId: 'session-2',
+      turnIds: [identity.turnId],
+    });
+    const copied = { ...identity, sessionId: 'session-2' };
+    assert.deepEqual(await lookup(authority.store, copied), {
+      status: 'failed',
+      reason: 'not_found',
+    });
+    await authority.store.purgeSessionArtifacts(identity.sessionId);
+    assert.equal(await lookup(authority.store), undefined);
+    assert.deepEqual(await lookup(authority.store, copied), {
+      status: 'failed',
+      reason: 'not_found',
+    });
+  } finally {
+    authority.close();
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test('successful publication atomically supersedes attempts and cannot be downgraded by retries', async () => {
+  const root = await mkdtemp(join(tmpdir(), 'maka-image-publish-'));
+  const authority = createSqliteArtifactStoreWriteAuthority(root);
+  try {
+    await authority.store.setImageDeliveryAttempt(identity, { status: 'pending' });
+    const content = new Uint8Array([1, 2, 3]);
+    const record = await authority.store.create({
+      ...identity,
+      id: 'image-result',
+      name: 'image',
+      source: 'tool_result_projection',
+      kind: 'image',
+      content,
+      imageDelivery: {
+        messageId: identity.messageId,
+        source: identity.source,
+        status: 'ready',
+        contentSha256: createHash('sha256').update(content).digest('hex'),
+      },
+    });
+    await authority.store.setImageDeliveryAttempt(identity, {
+      status: 'failed',
+      reason: 'read_failed',
+    });
+    assert.deepEqual(await lookup(authority.store), { status: 'ready', artifactId: record.id });
+    const db = new DatabaseSync(join(root, 'runtime.sqlite'), { readOnly: true });
+    try {
+      assert.equal(readImageDeliveryAttempt(db, identity), undefined);
+    } finally {
+      db.close();
+    }
+    await assert.rejects(
+      authority.store.create({
+        ...identity,
+        id: 'empty-placeholder',
+        name: 'image',
+        kind: 'file',
+        source: 'tool_result_projection',
+        content: '',
+        imageDelivery: {
+          messageId: identity.messageId,
+          source: identity.source,
+          status: 'pending',
+        },
+      }),
+      /Invalid image delivery metadata/,
+    );
+  } finally {
+    authority.close();
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test('v4 placeholder migration preserves terminal precedence and schedules safe file cleanup', () => {
+  const db = new DatabaseSync(':memory:');
+  try {
+    migrateSqliteArtifactDatabase(db);
+    for (const status of ['pending', 'failed'] as const) {
+      const record = {
+        sessionId: identity.sessionId,
+        turnId: identity.turnId,
+        id: status,
+        name: 'chat-image',
+        kind: 'file',
+        sizeBytes: 0,
+        createdAt: 1,
+        relativePath: `session-1/${status}-chat-image`,
+        source: 'tool_result_projection',
+        imageDelivery: {
+          messageId: identity.messageId,
+          source: identity.source,
+          status,
+          ...(status === 'failed' ? { reason: 'not_found' } : {}),
+        },
+      };
+      db.prepare('INSERT INTO artifact_records VALUES (?, ?, ?, ?, ?)').run(
+        record.id,
+        record.sessionId,
+        record.createdAt,
+        record.relativePath,
+        JSON.stringify(record),
+      );
+    }
+    migrateSqliteArtifactDatabase(db);
+    assert.deepEqual(readImageDeliveryAttempt(db, identity), {
+      status: 'failed',
+      reason: 'not_found',
+    });
+    assert.equal(db.prepare('SELECT COUNT(*) AS n FROM artifact_records').get()?.n, 0);
+    assert.equal(db.prepare('SELECT COUNT(*) AS n FROM artifact_upgrade_orphan_paths').get()?.n, 2);
+    migrateSqliteArtifactDatabase(db);
+    assert.deepEqual(readImageDeliveryAttempt(db, identity), {
+      status: 'failed',
+      reason: 'not_found',
+    });
+  } finally {
+    db.close();
+  }
+});
+
+test('archive policy enforces defaults even when a caller omits its limits', () => {
+  const existing = {
+    id: 'existing',
+    sessionId: identity.sessionId,
+    turnId: identity.turnId,
+    name: 'image',
+    kind: 'image' as const,
+    source: 'tool_result_projection' as const,
+    createdAt: 1,
+    relativePath: 'session-1/existing-image',
+    sizeBytes: DEFAULT_IMAGE_ARCHIVE_LIMITS.sessionBytes,
+    imageDelivery: {
+      messageId: identity.messageId,
+      source: identity.source,
+      status: 'ready' as const,
+      contentSha256: 'a'.repeat(64),
+    },
+  };
+  assert.throws(
+    () =>
+      assertImageArchiveQuota([existing], {
+        sessionId: identity.sessionId,
+        sizeBytes: 1,
+        imageDelivery: { ...existing.imageDelivery, contentSha256: 'b'.repeat(64) },
+      }),
+    ImageArchiveQuotaError,
+  );
+  assert.doesNotThrow(() =>
+    assertImageArchiveQuota([existing], {
+      sessionId: identity.sessionId,
+      sizeBytes: existing.sizeBytes,
+      imageDelivery: existing.imageDelivery,
+    }),
+  );
+});
diff --git a/packages/storage/src/__tests__/session-bundle-policy.test.ts b/packages/storage/src/__tests__/session-bundle-policy.test.ts
index 6caaad0f43..ab3035a348 100644
--- a/packages/storage/src/__tests__/session-bundle-policy.test.ts
+++ b/packages/storage/src/__tests__/session-bundle-policy.test.ts
@@ -32,6 +32,7 @@ import {
   importSessionBundleState,
   listSessionBundleMergeTables,
 } from '../session-bundle-policy.js';
+import { writeImageDeliveryAttempt, readImageDeliveryAttempt } from '../sqlite-image-delivery.js';
 import { createSqliteRuntimeStore } from '../sqlite-runtime-store.js';
 
 test('exports one Session as filtered SQLite', async () => {
@@ -51,6 +52,13 @@ test('exports one Session as filtered SQLite', async () => {
     sourceDatabase
       .prepare('INSERT INTO usage_pricing_overrides(model_key, record_json) VALUES (?, ?)')
       .run('private-model', '{}');
+    for (const sessionId of [selected.id, excluded.id]) {
+      writeImageDeliveryAttempt(
+        sourceDatabase,
+        { sessionId, turnId: 'turn-1', messageId: 'image-message', source: '/tmp/image.png' },
+        { status: 'failed', reason: 'not_found' },
+      );
+    }
     sourceDatabase.close();
 
     const plan = await exportSessionBundleState({
@@ -67,6 +75,13 @@ test('exports one Session as filtered SQLite', async () => {
         .all()
         .map((row) => (row as { session_id: string }).session_id);
       assert.deepEqual(ids, [selected.id]);
+      assert.deepEqual(
+        database
+          .prepare('SELECT session_id FROM image_delivery_attempts')
+          .all()
+          .map((row) => row.session_id),
+        [selected.id],
+      );
       assert.equal(
         (
           database.prepare('SELECT COUNT(*) AS count FROM session_messages').get() as {
@@ -86,6 +101,22 @@ test('exports one Session as filtered SQLite', async () => {
     } finally {
       database.close();
     }
+    const targetRoot = join(base, 'imported');
+    await importSessionBundleState({ stateRoot: targetRoot, bundleStateRoot: destinationRoot });
+    const imported = new DatabaseSync(join(targetRoot, 'runtime.sqlite'), { readOnly: true });
+    try {
+      assert.deepEqual(
+        readImageDeliveryAttempt(imported, {
+          sessionId: selected.id,
+          turnId: 'turn-1',
+          messageId: 'image-message',
+          source: '/tmp/image.png',
+        }),
+        { status: 'failed', reason: 'not_found' },
+      );
+    } finally {
+      imported.close();
+    }
   } finally {
     await rm(base, { recursive: true, force: true });
   }
diff --git a/packages/storage/src/artifact-image-storage.ts b/packages/storage/src/artifact-image-storage.ts
index c0c477e71f..16c33498a6 100644
--- a/packages/storage/src/artifact-image-storage.ts
+++ b/packages/storage/src/artifact-image-storage.ts
@@ -18,7 +18,11 @@
  */
 
 import type { ArtifactRecord } from '@maka/core/artifacts';
-import type { ImageArchiveLimits, ImageDeliveryMetadata } from '@maka/core/image-delivery';
+import {
+  DEFAULT_IMAGE_ARCHIVE_LIMITS,
+  type ImageArchiveLimits,
+  type ImageDeliveryMetadata,
+} from '@maka/core/image-delivery';
 
 export class ImageArchiveQuotaError extends Error {
   readonly name = 'ImageArchiveQuotaError';
@@ -66,8 +70,8 @@ export function assertImageArchiveQuota(
   const digest =
     input.imageDelivery?.status === 'ready' ? input.imageDelivery.contentSha256 : undefined;
   const size = input.sizeBytes;
-  const limits = input.imageArchiveLimits;
-  if (digest && limits) {
+  const limits = input.imageArchiveLimits ?? DEFAULT_IMAGE_ARCHIVE_LIMITS;
+  if (digest) {
     if (
       ![limits.sessionBytes, limits.workspaceBytes].every((v) => Number.isSafeInteger(v) && v >= 0)
     )
diff --git a/packages/storage/src/artifact-store.ts b/packages/storage/src/artifact-store.ts
index df20d55b77..8202c1b6c7 100644
--- a/packages/storage/src/artifact-store.ts
+++ b/packages/storage/src/artifact-store.ts
@@ -22,6 +22,9 @@ import {
   DEFAULT_IMAGE_ARCHIVE_LIMITS,
   isImageDeliveryMetadata,
   type ImageDeliveryMetadata,
+  type ImageDeliveryIdentity,
+  type ImageDeliveryAttempt,
+  type ImageDeliveryResult,
   type ImageArchiveLimits,
 } from '@maka/core/image-delivery';
 import { createHash, randomUUID } from 'node:crypto';
@@ -205,7 +208,11 @@ export interface ArtifactAuthorityStore extends DurableArtifactAttachmentReader
     turnId: string,
     messageId: string,
     source: string,
-  ): Promise<ArtifactRecord | undefined>;
+  ): Promise<ImageDeliveryResult | undefined>;
+  setImageDeliveryAttempt(
+    identity: ImageDeliveryIdentity,
+    attempt: ImageDeliveryAttempt,
+  ): Promise<void>;
   close(): void;
   copyConversationArtifacts(
     input: ConversationArtifactCopyInput,
@@ -291,12 +298,25 @@ class SqliteArtifactStore implements ArtifactAuthorityStore {
     turnId: string,
     messageId: string,
     source: string,
-  ): Promise<ArtifactRecord | undefined> {
+  ): Promise<ImageDeliveryResult | undefined> {
     return this.enqueue(async () =>
       this.metadataRepository.findImageDelivery(sessionId, turnId, messageId, source),
     );
   }
 
+  setImageDeliveryAttempt(
+    identity: ImageDeliveryIdentity,
+    attempt: ImageDeliveryAttempt,
+  ): Promise<void> {
+    assertCanonicalArtifactEntityId(identity.sessionId, 'sessionId');
+    assertArtifactTurnKey(identity.turnId);
+    const acceptedIdentity = Object.freeze({ ...identity });
+    const acceptedAttempt = Object.freeze({ ...attempt });
+    return this.enqueueMutation(async () =>
+      this.metadataRepository.setImageDeliveryAttempt(acceptedIdentity, acceptedAttempt),
+    );
+  }
+
   async create(input: CreateArtifactInput): Promise<ArtifactRecord> {
     const acceptedInput: CreateArtifactInput = Object.freeze({
       ...input,
@@ -308,7 +328,8 @@ class SqliteArtifactStore implements ArtifactAuthorityStore {
     });
     if (
       acceptedInput.imageDelivery !== undefined &&
-      !isImageDeliveryMetadata(acceptedInput.imageDelivery)
+      (!isImageDeliveryMetadata(acceptedInput.imageDelivery) ||
+        acceptedInput.imageDelivery.status !== 'ready')
     )
       throw new Error('Invalid image delivery metadata');
     if (
@@ -402,7 +423,7 @@ class SqliteArtifactStore implements ArtifactAuthorityStore {
       }
       requestedLinkedArtifactIds.set(linked.sessionId, artifactIds);
     }
-    const records = await this.enqueue(async () => {
+    const { records, attempts } = await this.enqueue(async () => {
       await this.load();
       const selected = this.records
         .filter(
@@ -433,7 +454,12 @@ class SqliteArtifactStore implements ArtifactAuthorityStore {
           selectedIds.add(record.id);
         }
       }
-      return selected;
+      return {
+        records: selected,
+        attempts: this.metadataRepository.readImageDeliveryAttempts(input.sourceSessionId, [
+          ...turnIds,
+        ]),
+      };
     });
 
     const artifactIds = new Map<string, string>();
@@ -458,6 +484,9 @@ class SqliteArtifactStore implements ArtifactAuthorityStore {
       artifactIds.set(record.id, created.id);
       relativePaths.set(record.relativePath, created.relativePath);
     }
+    await this.enqueueMutation(async () =>
+      this.metadataRepository.copyImageDeliveryAttempts(attempts, input.targetSessionId),
+    );
     return { artifactIds, relativePaths };
   }
 
@@ -561,6 +590,7 @@ class SqliteArtifactStore implements ArtifactAuthorityStore {
       await this.purgeRecordsUnlocked(
         this.records.filter((record) => record.sessionId === sessionId),
       );
+      this.metadataRepository.purgeImageDeliveryAttempts(sessionId);
     });
   }
 
diff --git a/packages/storage/src/artifact-stores.ts b/packages/storage/src/artifact-stores.ts
index 383bef82e1..7f9246392e 100644
--- a/packages/storage/src/artifact-stores.ts
+++ b/packages/storage/src/artifact-stores.ts
@@ -59,6 +59,7 @@ export interface InteractiveArtifactStoreWriter extends DurableArtifactAttachmen
   readonly [writerBrand]: true;
   create(input: CreateArtifactInput): Promise<ArtifactRecord>;
   findImageDelivery: ArtifactAuthorityStore['findImageDelivery'];
+  setImageDeliveryAttempt: ArtifactAuthorityStore['setImageDeliveryAttempt'];
   /**
    * Narrow system delete for one Session-owned artifact of a declared source.
    *
@@ -140,6 +141,11 @@ function createWriterFacade(
     [writerBrand]: true,
     findImageDelivery: (sessionId, turnId, messageId, source) =>
       run(() => store.findImageDelivery(sessionId, turnId, messageId, source)),
+    setImageDeliveryAttempt: (identity, attempt) => {
+      const acceptedIdentity = Object.freeze({ ...identity });
+      const acceptedAttempt = Object.freeze({ ...attempt });
+      return run(() => store.setImageDeliveryAttempt(acceptedIdentity, acceptedAttempt));
+    },
     listPage: (sessionId, options) => run(() => store.listPage(sessionId, options)),
     listTurnArtifacts: (sessionId, turnId) => run(() => store.listTurnArtifacts(sessionId, turnId)),
     getInSession: (sessionId, artifactId) => run(() => store.getInSession(sessionId, artifactId)),
diff --git a/packages/storage/src/sqlite-artifact-metadata.ts b/packages/storage/src/sqlite-artifact-metadata.ts
index c29e65abeb..2184a1617b 100644
--- a/packages/storage/src/sqlite-artifact-metadata.ts
+++ b/packages/storage/src/sqlite-artifact-metadata.ts
@@ -18,6 +18,18 @@
  */
 
 import { resolve } from 'node:path';
+import type {
+  ImageDeliveryIdentity,
+  ImageDeliveryAttempt,
+  ImageDeliveryResult,
+} from '@maka/core/image-delivery';
+import {
+  readImageDeliveryAttempt,
+  writeImageDeliveryAttempt,
+  removeImageDeliveryAttempt,
+  readImageDeliveryAttempts,
+  type StoredImageDeliveryAttempt,
+} from './sqlite-image-delivery.js';
 import type { ArtifactRecord } from '@maka/core/artifacts';
 import { decodeArtifactRecordJsons } from './artifact-metadata-codec.js';
 import {
@@ -47,7 +59,7 @@ class SqliteArtifactMetadataRepository {
     turnId: string,
     messageId: string,
     source: string,
-  ): ArtifactRecord | undefined {
+  ): ImageDeliveryResult | undefined {
     this.assertOpen();
     const rows = this.#lease.database
       .prepare(`
@@ -57,11 +69,74 @@ class SqliteArtifactMetadataRepository {
         AND json_extract(record_json, '$.turnId') = ?
         AND json_extract(record_json, '$.imageDelivery.messageId') = ?
         AND json_extract(record_json, '$.imageDelivery.source') = ?
-      ORDER BY CASE json_extract(record_json, '$.imageDelivery.status') WHEN 'pending' THEN 1 ELSE 0 END,
-        created_at DESC, artifact_id DESC LIMIT 1
+        AND json_extract(record_json, '$.imageDelivery.status') = 'ready'
+      ORDER BY created_at DESC, artifact_id DESC LIMIT 1
     `)
       .all(sessionId, turnId, messageId, source) as Array<{ record_json: string }>;
-    return decodeRows(rows)[0];
+    const record = decodeRows(rows)[0];
+    if (record?.imageDelivery?.status === 'ready')
+      return { status: 'ready', artifactId: record.id };
+    return readImageDeliveryAttempt(this.#lease.database, { sessionId, turnId, messageId, source });
+  }
+
+  setImageDeliveryAttempt(identity: ImageDeliveryIdentity, attempt: ImageDeliveryAttempt): void {
+    this.assertOpen();
+    this.#lease.transaction('write', () => {
+      // Saved history is immutable, including when a retry races publication.
+      if (
+        this.findImageDelivery(
+          identity.sessionId,
+          identity.turnId,
+          identity.messageId,
+          identity.source,
+        )?.status === 'ready'
+      )
+        return;
+      writeImageDeliveryAttempt(this.#lease.database, identity, attempt);
+    });
+  }
+
+  readImageDeliveryAttempts(
+    sessionId: string,
+    turnIds: readonly string[],
+  ): StoredImageDeliveryAttempt[] {
+    this.assertOpen();
+    return readImageDeliveryAttempts(this.#lease.database, sessionId, turnIds);
+  }
+
+  copyImageDeliveryAttempts(
+    attempts: readonly StoredImageDeliveryAttempt[],
+    targetSessionId: string,
+  ): void {
+    this.assertOpen();
+    this.#lease.transaction('write', () => {
+      for (const record of attempts) {
+        const identity = { ...record.identity, sessionId: targetSessionId };
+        if (
+          !this.findImageDelivery(
+            identity.sessionId,
+            identity.turnId,
+            identity.messageId,
+            identity.source,
+          )
+        )
+          writeImageDeliveryAttempt(
+            this.#lease.database,
+            identity,
+            record.attempt,
+            record.createdAt,
+          );
+      }
+    });
+  }
+
+  purgeImageDeliveryAttempts(sessionId: string): void {
+    this.assertOpen();
+    this.#lease.transaction('write', () => {
+      this.#lease.database
+        .prepare('DELETE FROM image_delivery_attempts WHERE session_id = ?')
+        .run(sessionId);
+    });
   }
 
   readAll(): ArtifactRecord[] {
@@ -103,6 +178,13 @@ class SqliteArtifactMetadataRepository {
            OR record_json IS NOT excluded.record_json
       `);
       for (const record of changes.upserts ?? []) {
+        if (record.imageDelivery?.status === 'ready')
+          removeImageDeliveryAttempt(this.#lease.database, {
+            sessionId: record.sessionId,
+            turnId: record.turnId,
+            messageId: record.imageDelivery.messageId,
+            source: record.imageDelivery.source,
+          });
         upsert.run(
           record.id,
           record.sessionId,
diff --git a/packages/storage/src/sqlite-artifact-schema.ts b/packages/storage/src/sqlite-artifact-schema.ts
index 9d90a4eb44..f272553be6 100644
--- a/packages/storage/src/sqlite-artifact-schema.ts
+++ b/packages/storage/src/sqlite-artifact-schema.ts
@@ -23,7 +23,9 @@ import {
   isSafeRelativeArtifactPath,
 } from './artifact-metadata-codec.js';
 
-export const SQLITE_ARTIFACT_SCHEMA_VERSION = 4;
+import { migrateImageDeliveryAttempts } from './sqlite-image-delivery.js';
+
+export const SQLITE_ARTIFACT_SCHEMA_VERSION = 5;
 
 export function migrateSqliteArtifactDatabase(db: DatabaseSync): void {
   const columns = db.prepare('PRAGMA table_info(artifact_records)').all() as Array<{
@@ -107,4 +109,5 @@ export function migrateSqliteArtifactDatabase(db: DatabaseSync): void {
       JSON.stringify(record),
     );
   }
+  migrateImageDeliveryAttempts(db);
 }
diff --git a/packages/storage/src/sqlite-image-delivery.ts b/packages/storage/src/sqlite-image-delivery.ts
new file mode 100644
index 0000000000..0b846653ec
--- /dev/null
+++ b/packages/storage/src/sqlite-image-delivery.ts
@@ -0,0 +1,144 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import type { DatabaseSync } from 'node:sqlite';
+import type { ImageDeliveryIdentity, ImageDeliveryAttempt } from '@maka/core/image-delivery';
+import { isImageDeliveryMetadata, IMAGE_DELIVERY_FAILURES } from '@maka/core/image-delivery';
+import { decodeArtifactRecordJsons } from './artifact-metadata-codec.js';
+
+/** Shares the Artifact writer's transaction and lock; no payload files for attempts. */
+export function migrateImageDeliveryAttempts(db: DatabaseSync): void {
+  db.exec(`CREATE TABLE IF NOT EXISTS image_delivery_attempts (
+    session_id TEXT NOT NULL, turn_id TEXT NOT NULL, message_id TEXT NOT NULL,
+    source TEXT NOT NULL, status TEXT NOT NULL CHECK (status IN ('pending', 'failed')),
+    reason TEXT, created_at INTEGER NOT NULL CHECK (created_at >= 0),
+    CHECK ((status = 'pending' AND reason IS NULL) OR (status = 'failed' AND reason IS NOT NULL)),
+    PRIMARY KEY (session_id, turn_id, message_id, source)
+  )`);
+  const rows = db
+    .prepare(`SELECT record_json FROM artifact_records
+    WHERE json_valid(record_json) AND json_extract(record_json, '$.imageDelivery.status') IN ('pending', 'failed')
+    ORDER BY CASE json_extract(record_json, '$.imageDelivery.status') WHEN 'pending' THEN 1 ELSE 0 END,
+      created_at DESC, artifact_id DESC`)
+    .all() as { record_json: string }[];
+  for (const record of decodeArtifactRecordJsons(rows.map((row) => row.record_json))) {
+    const metadata = record.imageDelivery!;
+    const identity = { sessionId: record.sessionId, turnId: record.turnId, ...metadata };
+    // An interrupted older capture can leave both a pending and a terminal row.
+    if (!readImageDeliveryAttempt(db, identity)) {
+      writeImageDeliveryAttempt(db, identity, metadata as ImageDeliveryAttempt, record.createdAt);
+    }
+    db.prepare('INSERT OR IGNORE INTO artifact_upgrade_orphan_paths VALUES (?)').run(
+      record.relativePath,
+    );
+    db.prepare('DELETE FROM artifact_records WHERE artifact_id = ?').run(record.id);
+  }
+}
+
+export function readImageDeliveryAttempt(
+  db: DatabaseSync,
+  identity: ImageDeliveryIdentity,
+): ImageDeliveryAttempt | undefined {
+  const row = db
+    .prepare(`SELECT status, reason FROM image_delivery_attempts
+    WHERE session_id = ? AND turn_id = ? AND message_id = ? AND source = ?`)
+    .get(...identityValues(identity)) as { status: string; reason: unknown } | undefined;
+  return row ? decodeAttempt(row) : undefined;
+}
+
+function decodeAttempt(row: { status: string; reason: unknown }): ImageDeliveryAttempt {
+  if (row.status === 'pending' && row.reason === null) return { status: 'pending' };
+  if (row.status === 'failed' && IMAGE_DELIVERY_FAILURES.includes(row.reason as never))
+    return {
+      status: 'failed',
+      reason: row.reason as Extract<ImageDeliveryAttempt, { status: 'failed' }>['reason'],
+    };
+  throw new Error('Invalid image delivery attempt');
+}
+
+export function writeImageDeliveryAttempt(
+  db: DatabaseSync,
+  identity: ImageDeliveryIdentity,
+  attempt: ImageDeliveryAttempt,
+  now = Date.now(),
+): void {
+  if (
+    !isImageDeliveryMetadata({
+      messageId: identity.messageId,
+      source: identity.source,
+      ...attempt,
+    }) ||
+    (attempt.status !== 'pending' && attempt.status !== 'failed')
+  )
+    throw new Error('Invalid image delivery attempt');
+  db.prepare(`INSERT INTO image_delivery_attempts VALUES (?, ?, ?, ?, ?, ?, ?)
+    ON CONFLICT(session_id, turn_id, message_id, source) DO UPDATE SET status = excluded.status, reason = excluded.reason`).run(
+    ...identityValues(identity),
+    attempt.status,
+    attempt.status === 'failed' ? attempt.reason : null,
+    now,
+  );
+}
+
+export function removeImageDeliveryAttempt(
+  db: DatabaseSync,
+  identity: ImageDeliveryIdentity,
+): void {
+  db.prepare(
+    'DELETE FROM image_delivery_attempts WHERE session_id = ? AND turn_id = ? AND message_id = ? AND source = ?',
+  ).run(...identityValues(identity));
+}
+
+export interface StoredImageDeliveryAttempt {
+  readonly identity: ImageDeliveryIdentity;
+  readonly attempt: ImageDeliveryAttempt;
+  readonly createdAt: number;
+}
+
+export function readImageDeliveryAttempts(
+  db: DatabaseSync,
+  sessionId: string,
+  turnIds: readonly string[],
+): StoredImageDeliveryAttempt[] {
+  const query = db.prepare(
+    'SELECT message_id, source, status, reason, created_at FROM image_delivery_attempts WHERE session_id = ? AND turn_id = ?',
+  );
+  return turnIds.flatMap((turnId) =>
+    (
+      query.all(sessionId, turnId) as {
+        message_id: string;
+        source: string;
+        status: string;
+        reason: unknown;
+        created_at: number;
+      }[]
+    ).map((row) => {
+      const identity = { sessionId, turnId, messageId: row.message_id, source: row.source };
+      return {
+        identity,
+        attempt: decodeAttempt(row),
+        createdAt: row.created_at,
+      };
+    }),
+  );
+}
+
+function identityValues(identity: ImageDeliveryIdentity): [string, string, string, string] {
+  return [identity.sessionId, identity.turnId, identity.messageId, identity.source];
+}
diff --git a/packages/ui/package.json b/packages/ui/package.json
index a1d61c248b..8de5e24cdb 100644
--- a/packages/ui/package.json
+++ b/packages/ui/package.json
@@ -33,7 +33,6 @@
     "clsx": "^2.1.1",
     "katex": "0.18.9",
     "lucide-react": "^1.48.0",
-    "mdast-util-from-markdown": "^2.1.0",
     "mermaid": "^11.17.2",
     "react": "^19.3.0",
     "react-dom": "^19.3.0",
diff --git a/packages/ui/src/chat-image-resource.ts b/packages/ui/src/chat-image-resource.ts
new file mode 100644
index 0000000000..c2fc49bf2c
--- /dev/null
+++ b/packages/ui/src/chat-image-resource.ts
@@ -0,0 +1,71 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { useState } from 'react';
+import { parseAttachmentResourceRef } from '@maka/core/attachments';
+import { isRemoteImageSource, type ImageDeliveryFailure } from '@maka/core/image-delivery';
+import { useAttachmentImage } from './attachment-image.js';
+import { useImageDelivery } from './image-delivery.js';
+
+export type ChatImagePresentation =
+  | { readonly kind: 'loading' }
+  | { readonly kind: 'ready'; readonly src: string }
+  | { readonly kind: 'unavailable'; readonly reason: 'attachment' | 'remote' | 'redacted' | 'unsupported' }
+  | { readonly kind: 'failed'; readonly reason: 'saved_bytes' | ImageDeliveryFailure };
+
+/** Owns delivery, saved-byte and decode transitions. The component only renders this view. */
+export function useChatImageResource(input: { source: string; redacted: boolean; visible: boolean }) {
+  const explicit = parseAttachmentResourceRef(input.source);
+  const delivery = useImageDelivery(input.source, input.visible && !explicit, !input.redacted);
+  const artifactId = explicit?.artifactId ?? (delivery.status === 'ready' ? delivery.artifactId : undefined);
+  const image = useAttachmentImage(input.visible && artifactId ? { artifactId } : undefined);
+  const [failedSource, setFailedSource] = useState<string>();
+  const [attempt, setAttempt] = useState(0);
+  const source = artifactId ? image.src : undefined;
+  const remote = isRemoteImageSource(input.source);
+  const hiddenRemote = remote && input.redacted;
+  const remotePlaceholder = input.visible && remote && !artifactId;
+  let presentation: ChatImagePresentation;
+  if ((source && failedSource === source) || (artifactId && image.status === 'failed'))
+    presentation = { kind: 'failed', reason: 'saved_bytes' };
+  else if (source) presentation = { kind: 'ready', src: source };
+  else if (!input.visible) presentation = { kind: 'loading' };
+  else if (explicit && image.status === 'unavailable') presentation = { kind: 'unavailable', reason: 'attachment' };
+  else if (remotePlaceholder && hiddenRemote) presentation = { kind: 'unavailable', reason: 'redacted' };
+  else if (remotePlaceholder && (!delivery.available || delivery.status === 'requires_confirmation'))
+    presentation = { kind: 'unavailable', reason: 'remote' };
+  else if (delivery.status === 'failed') presentation = { kind: 'failed', reason: delivery.reason };
+  else if (delivery.status === 'pending' || artifactId) presentation = { kind: 'loading' };
+  else presentation = { kind: 'unavailable', reason: 'unsupported' };
+
+  const retry = presentation.kind === 'failed' && (!hiddenRemote || artifactId) ? () => {
+    setFailedSource(undefined);
+    setAttempt(value => value + 1);
+    // Once saved, only reread archived bytes; never recapture an expired/deleted source.
+    if (artifactId) image.retry();
+    else delivery.retry();
+  } : undefined;
+  const openSource = remote && !hiddenRemote && (presentation.kind === 'failed' ||
+    presentation.kind === 'unavailable' && presentation.reason === 'remote') ? input.source : undefined;
+  return {
+    presentation, attempt, retry, openSource,
+    framed: !input.visible || !!source || !!artifactId || delivery.status === 'pending',
+    onDecodeError: () => { if (source) setFailedSource(source); },
+  };
+}
diff --git a/packages/ui/src/markdown-image-redaction.ts b/packages/ui/src/markdown-image-redaction.ts
index efaebe2b3a..d274ed9e3d 100644
--- a/packages/ui/src/markdown-image-redaction.ts
+++ b/packages/ui/src/markdown-image-redaction.ts
@@ -17,23 +17,11 @@
  * under the License.
  */
 
-import { fromMarkdown } from 'mdast-util-from-markdown';
-import { markdownImages } from '@maka/core/image-markdown';
+import { positionedMarkdownImages } from '@maka/core/image-markdown';
 import { redactSecrets } from './redact.js';
 
-interface PositionedNode {
-  type: string;
-  position?: { start: { offset?: number }; end: { offset?: number } };
-  children?: readonly PositionedNode[];
-  url?: string;
-  alt?: string | null;
-}
-
-/** Hide destinations behind opaque image-only aliases before redacting prose.
- * Source positions keep identical examples in code, links and HTML untouched.
- * Marked remains the authority for the destinations sent to the Host; mdast
- * supplies only source ranges, which Marked does not expose.
- */
+/** Preserve resource identities using the canonical parser's exact source ranges.
+ * The alias map is presentation-only and never grants source loading. */
 export function redactMarkdownImages(text: string, settledText?: string) {
   let prefix = 'maka-image-display:';
   while (text.includes(prefix) || settledText?.includes(prefix)) prefix += 'x';
@@ -42,33 +30,19 @@ export function redactMarkdownImages(text: string, settledText?: string) {
   const prepare = (original: string): string => {
     const redacted = redactSecrets(original);
     if (redacted === original) return redacted;
-    const images = markdownImages(original).filter(image =>
+    const images = positionedMarkdownImages(original).filter(image =>
       redactSecrets(image.source) !== image.source || redactSecrets(image.raw) !== image.raw);
     if (!images.length) return redacted;
-    const destinations = new Map(images.map(image => [image.raw, image.source]));
-    const canonical = new Set(images.map(image => image.source));
-    const replacements: { start: number; end: number; value: string }[] = [];
-    const visit = (node: PositionedNode) => {
-      if (node.type === 'image' || node.type === 'imageReference') {
-        const start = node.position?.start.offset;
-        const end = node.position?.end.offset;
-        if (start === undefined || end === undefined) return;
-        const raw = original.slice(start, end);
-        const source = destinations.get(raw) ?? (node.url && canonical.has(node.url) ? node.url : undefined);
-        if (!source || (redactSecrets(source) === source && redactSecrets(raw) === raw)) return;
-        let alias = aliases.get(source);
-        if (!alias) {
-          alias = `${prefix}${aliases.size}`;
-          aliases.set(source, alias);
-          sources.set(alias, source);
-        }
-        const alt = redactSecrets(node.alt ?? '').replace(/[\\[\]`*_<>|]/g, '\\$&');
-        replacements.push({ start, end, value: `![${alt}](${alias})` });
-        return;
+    const replacements = images.map(image => {
+      let alias = aliases.get(image.source);
+      if (!alias) {
+        alias = `${prefix}${aliases.size}`;
+        aliases.set(image.source, alias);
+        sources.set(alias, image.source);
       }
-      node.children?.forEach(visit);
-    };
-    visit(fromMarkdown(original));
+      const alt = redactSecrets(image.alt).replace(/[\\[\]`*_<>|]/g, '\\$&');
+      return { start: image.start, end: image.end, value: `![${alt}](${alias})` };
+    });
     let protectedText = original;
     for (const replacement of replacements.sort((a, b) => b.start - a.start)) {
       protectedText = protectedText.slice(0, replacement.start) + replacement.value + protectedText.slice(replacement.end);
diff --git a/packages/ui/src/markdown-image.tsx b/packages/ui/src/markdown-image.tsx
index e4069cfd33..fdba5971dd 100644
--- a/packages/ui/src/markdown-image.tsx
+++ b/packages/ui/src/markdown-image.tsx
@@ -23,10 +23,7 @@ import { createMarkdownPlugin, type MarkdownExtensionNode } from '@astryxdesign/
 import type { MarkdownAstNode, MarkdownAstRoot } from '@astryxdesign/core/Markdown';
 import { RotateCw, AlertTriangle } from './icons.js';
 import { Link } from '@astryxdesign/core/Link';
-import { parseAttachmentResourceRef } from '@maka/core/attachments';
-import { isRemoteImageSource } from '@maka/core/image-delivery';
-import { useAttachmentImage } from './attachment-image.js';
-import { useImageDelivery } from './image-delivery.js';
+import { useChatImageResource } from './chat-image-resource.js';
 import { getSharedUiCopy } from './shared-ui-copy.js';
 import { useUiLocale } from './locale-context.js';
 import { createMarkdownImageSourceResolver } from './markdown-image-source.js';
@@ -98,59 +95,39 @@ function ImageResource(props: { src: string; redacted: boolean; alt: string; inl
     }, { rootMargin: '300px' });
     observer.observe(anchor.current); return () => observer.disconnect();
   }, [visible]);
-  const explicit = parseAttachmentResourceRef(props.src);
-  const delivery = useImageDelivery(props.src, visible && !explicit, !props.redacted);
-  const artifactId = explicit?.artifactId ?? (delivery.status === 'ready' ? delivery.artifactId : undefined);
-  const image = useAttachmentImage(visible && artifactId ? { artifactId } : undefined);
-  const [failedSource, setFailedSource] = useState<string>();
-  const [attempt, setAttempt] = useState(0);
-  const remote = isRemoteImageSource(props.src);
-  const source = artifactId ? image.src : undefined;
-  const failed = !!source && failedSource === source || !!artifactId && image.status === 'failed';
-  const retry = () => {
-    setFailedSource(undefined); setAttempt(a => a + 1);
-    if (artifactId) image.retry();
-    if (!artifactId) delivery.retry();
-  };
-  // Redaction preserves the original identity for saved replay, never for a
-  // network action whose destination the user cannot inspect.
-  const hiddenRemote = remote && props.redacted;
-  const remoteBlocked = remote && delivery.status === 'failed' && delivery.reason === 'not_allowed';
-  const sourceActions = <span className="maka-markdown-image-actions">
-    {(!hiddenRemote || artifactId) && <Button variant="ghost" size="sm" label={copy.imageRetry} onClick={retry} />}
-    {remote && !hiddenRemote && <Link href={props.src} isExternalLink type="inherit" hasUnderline>{copy.imageOpen}</Link>}
+  const resource = useChatImageResource({ source: props.src, redacted: props.redacted, visible });
+  const state = resource.presentation;
+  const message = state.kind === 'loading' ? copy.imageLoading
+    : state.kind === 'failed' ? state.reason === 'saved_bytes' ? copy.imageLoadFailed : copy.imageArchiveFailure(state.reason)
+    : state.kind === 'unavailable' ? {
+      attachment: copy.imageUnavailable,
+      remote: copy.imageRemoteUnavailable,
+      redacted: copy.imageRemoteRedacted,
+      unsupported: copy.imageUnsupported,
+    }[state.reason] : undefined;
+  const hasFrame = props.inline || resource.framed;
+  const actions = <span className="maka-markdown-image-actions">
+    {resource.retry && <Button variant="ghost" size="sm" label={copy.imageRetry} onClick={resource.retry} />}
+    {resource.openSource && <Link href={resource.openSource} isExternalLink type="inherit" hasUnderline>{copy.imageOpen}</Link>}
   </span>;
-  let message: string | undefined;
-  const remotePlaceholder = visible && remote && !artifactId;
-  const remoteUnavailable = remotePlaceholder && !hiddenRemote && (!delivery.available || delivery.status === 'requires_confirmation');
-  const remoteNotice = remotePlaceholder && (hiddenRemote || remoteUnavailable || remoteBlocked);
-  if (failed) message = copy.imageLoadFailed;
-  else if (!source) message = !visible ? copy.imageLoading
-    : explicit && image.status === 'unavailable' ? copy.imageUnavailable
-    : remotePlaceholder && hiddenRemote ? copy.imageRemoteRedacted
-    : remoteUnavailable ? copy.imageRemoteUnavailable
-    : delivery.status === 'failed' ? copy.imageArchiveFailure(delivery.reason)
-    : delivery.status === 'pending' || artifactId ? copy.imageLoading : copy.imageUnsupported;
-  const hasFrame = props.inline || !visible || !!source || !!artifactId || delivery.status === 'pending';
   return <span ref={anchor} className={`maka-markdown-image-resource${hasFrame ? props.inline ? ' maka-markdown-image-inline' : ' maka-markdown-image-frame' : ''}`}
-    data-maka-image-state={message ? failed ? 'failed' : 'loading' : 'ready'}>
+    data-maka-image-state={state.kind === 'failed' ? 'failed' : state.kind === 'ready' ? 'ready' : 'loading'}>
     {message && props.inline ? <Tooltip content={message}>
       <span className="maka-markdown-image-placeholder" role="status" aria-label={message}>
-        {(failed || delivery.status === 'failed') && (!hiddenRemote || artifactId)
-          ? <IconButton icon={<RotateCw size={14} />} size="sm" label={copy.imageRetry} onClick={retry} />
-          : remoteNotice || delivery.status === 'unavailable' && visible
+        {resource.retry
+          ? <IconButton icon={<RotateCw size={14} />} size="sm" label={copy.imageRetry} onClick={resource.retry} />
+          : state.kind === 'unavailable'
             ? <AlertTriangle size={14} aria-hidden="true" /> : <Spinner size="sm" shade="subtle" aria-hidden="true" />}
       </span>
     </Tooltip> : message ? <span className="maka-markdown-image-placeholder">
       {props.alt && <span className="maka-markdown-image-caption">{props.alt}</span>}
-      <span role="status">{hasFrame && !failed && !remoteNotice && delivery.status !== 'failed' && <Spinner size="sm" shade="subtle" aria-hidden="true" />} {message}</span>
-      {(failed || delivery.status === 'failed') && sourceActions}
-    </span> : source && <DisplayImage key={`${source}\0${attempt}`} src={source} alt={props.alt} onError={() => setFailedSource(source)} />}
-    {remoteUnavailable && <span className="maka-markdown-image-actions">
-      <Link href={props.src} isExternalLink type="inherit" hasUnderline>{copy.imageOpen}</Link>
-    </span>}
+      <span role="status">{hasFrame && state.kind === 'loading' && <Spinner size="sm" shade="subtle" aria-hidden="true" />} {message}</span>
+      {state.kind === 'failed' && actions}
+    </span> : state.kind === 'ready' && <DisplayImage key={`${state.src}\0${resource.attempt}`} src={state.src} alt={props.alt} onError={resource.onDecodeError} />}
+    {state.kind === 'unavailable' && resource.openSource && actions}
   </span>;
 }
+
 function DisplayImage(props: { src: string; alt: string; onError(): void }) {
   const copy = getSharedUiCopy(useUiLocale()).markdown;
   const [loaded, setLoaded] = useState(false);

From 8b6fc35332e63ed295b9d80dc9bfbcca2081265f Mon Sep 17 00:00:00 2001
From: Sun-GLiang <81428141+Sun-GLiang@users.noreply.github.com>
Date: Sat, 10 Oct 2026 13:38:37 +0800
Subject: [PATCH 24/35] fix(release): tolerate Linux profile cleanup races

The packaged Runtime Host can still write into its temporary profile after Desktop exits. Match Windows verification's bounded fs.rm retry policy so transient ENOTEMPTY and EBUSY errors do not fail Linux package validation.

Generated-by: Codex (GPT-6)
---
 scripts/verify-linux.mjs | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/scripts/verify-linux.mjs b/scripts/verify-linux.mjs
index 77129fcad2..b7add8afdd 100644
--- a/scripts/verify-linux.mjs
+++ b/scripts/verify-linux.mjs
@@ -226,7 +226,15 @@ export async function verifyLinuxRelease(
 
     return { appImagePath, debPath, checksums };
   } finally {
-    await rm(workingDirectory, { recursive: true, force: true });
+    // The Runtime Host outlives Desktop for its idle grace period and can still
+    // write into the profile during cleanup. Use the same bounded filesystem
+    // retries as Windows verification for transient ENOTEMPTY/EBUSY errors.
+    await rm(workingDirectory, {
+      recursive: true,
+      force: true,
+      maxRetries: 20,
+      retryDelay: 250,
+    });
   }
 }
 

From fef72334a039bbec4cd04a6361e9f143a0ecbf02 Mon Sep 17 00:00:00 2001
From: Sun-GLiang <81428141+Sun-GLiang@users.noreply.github.com>
Date: Sat, 10 Oct 2026 15:13:38 +0800
Subject: [PATCH 25/35] fix(runtime): align image guidance with automatic
 loading

Describe remote image loading under application outbound/privacy and proxy policy, independently of session subprocess network restrictions.

Generated-by: Codex (GPT-6)
---
 packages/runtime/src/system-prompt/main-session-prompt.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/runtime/src/system-prompt/main-session-prompt.ts b/packages/runtime/src/system-prompt/main-session-prompt.ts
index c9f8914b73..517e984f9b 100644
--- a/packages/runtime/src/system-prompt/main-session-prompt.ts
+++ b/packages/runtime/src/system-prompt/main-session-prompt.ts
@@ -52,7 +52,7 @@ Keep simple answers simple; do not add headings or lists to simple answers.
 Use short headings and flat lists to organize longer answers.
 Use fenced code blocks for multiline code and backticks for inline commands, paths, identifiers, and literal values.
 Prefer descriptive link text for external sources when it is available.
-To deliver a generated screenshot or local image, include a Markdown image with its absolute path. The Host automatically saves supported local images after the assistant message completes. Remote images require the user to choose Load image and the session to allow network access; include them only when relevant to the user's request. Reading an image for your own inspection does not deliver it.
+To deliver a generated screenshot or local image, include a Markdown image with its absolute path. The Host automatically saves supported local images after the assistant message completes. Supported remote images in completed assistant messages load automatically near the viewport, subject to the application's outbound/privacy policy and proxy settings. This media loading is independent of session subprocess network restrictions; include remote images only when relevant to the user's request. Reading an image for your own inspection does not deliver it.
 If you need to delete or replace the source file immediately, use PublishImage when available first and include its returned Markdown. Keep source files available until capture finishes. Images above the save limits cannot be previewed automatically.
 Only claim an image was saved after publication succeeds. Saving does not confirm that the client displayed it.
 Follow a more specific format requested by the user or task.`;

From 711fa6e02be7cd6e32f63fcec6ffd54f4ce2ee73 Mon Sep 17 00:00:00 2001
From: Sun-GLiang <81428141+Sun-GLiang@users.noreply.github.com>
Date: Sat, 10 Oct 2026 15:31:11 +0800
Subject: [PATCH 26/35] refactor(network): scope image connection policy per
 request

Move destination validation and direct DNS pinning into the existing fetch transport. Image downloads opt in; ordinary callers retain their defaults. Let configured proxies resolve original hostnames and remove VPN fake-DNS exceptions.

Generated-by: Codex (GPT-6)
---
 .../src/__tests__/chat-image-delivery.test.ts |  76 ++--
 .../__tests__/execution-composition.test.ts   |  37 +-
 .../src/server/chat-image-source.ts           | 219 ++++--------
 .../src/server/execution-composition.ts       |   1 -
 .../__tests__/public-network-policy.test.ts   | 327 ++++++++++++++++++
 .../__tests__/scoped-fetch-transport.test.ts  |  44 ++-
 .../src/network/public-network-policy.ts      | 107 ++++++
 .../src/network/scoped-fetch-transport.ts     |  92 ++++-
 8 files changed, 652 insertions(+), 251 deletions(-)
 create mode 100644 packages/runtime/src/network/__tests__/public-network-policy.test.ts
 create mode 100644 packages/runtime/src/network/public-network-policy.ts

diff --git a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
index 94be54d8e3..5b720eeeae 100644
--- a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
+++ b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
@@ -23,8 +23,9 @@ import { mkdtemp, mkdir, readFile, writeFile, rm, stat } from 'node:fs/promises'
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { pathToFileURL } from 'node:url';
-import http, { createServer, type RequestOptions, type IncomingMessage } from 'node:http';
-import https from 'node:https';
+import { createServer } from 'node:http';
+import net from 'node:net';
+import tls from 'node:tls';
 import dns from 'node:dns/promises';
 import { syncBuiltinESMExports } from 'node:module';
 import { createHash } from 'node:crypto';
@@ -60,30 +61,28 @@ function publicImageOrigin(
   const source = new URL(localSource);
   source.hostname = 'image.example';
   source.protocol = protocol;
-  const request = http.request;
+  const connect = net.connect;
   t.mock.method(dns, 'lookup', async (host: string) => {
     assert.equal(host, source.hostname);
     return [{ address, family: address.includes(':') ? 6 : 4 }];
   });
-  const transport = (
-    url: URL,
-    options: RequestOptions,
-    callback: (res: IncomingMessage) => void,
-  ) => {
-    assert.equal(url.origin, source.origin);
+  const transport = (options: net.TcpNetConnectOpts & { servername?: string }) => {
+    assert.equal(options.host, source.hostname);
     assert.ok(options.lookup);
-    options.lookup(url.hostname, { all: true }, (error, addresses) => {
+    options.lookup(source.hostname, { all: true }, (error, addresses) => {
       assert.equal(error, null);
       assert.deepEqual(addresses, [{ address, family: address.includes(':') ? 6 : 4 }]);
     });
-    return request(
-      new URL(url.pathname + url.search, local),
-      { ...options, lookup: undefined },
-      callback,
-    );
+    const socket = connect({ host: local.hostname, port: Number(local.port) });
+    if (protocol === 'https:') {
+      assert.equal(options.servername, source.hostname);
+      // This HTTP fixture exercises HTTPS redirect policy, not TLS verification.
+      socket.once('connect', () => socket.emit('secureConnect'));
+    }
+    return socket;
   };
-  t.mock.method(http, 'request', transport);
-  t.mock.method(https, 'request', transport);
+  t.mock.method(net, 'connect', transport);
+  t.mock.method(tls, 'connect', transport);
   syncBuiltinESMExports();
   t.after(() => {
     t.mock.restoreAll();
@@ -860,7 +859,7 @@ test('HTTP download enforces header/stream limits, redirect budget and cancellat
       );
     }
     await assert.rejects(downloadChatImage(source + 'stalled', AbortSignal.timeout(50)), {
-      name: 'AbortError',
+      name: 'TimeoutError',
     });
   } finally {
     server.closeAllConnections();
@@ -895,7 +894,7 @@ test('DNS answers containing any private address are denied before a request', a
     { address: '127.0.0.1', family: 4 },
   ];
   const lookup = t.mock.method(dns, 'lookup', async () => answers);
-  const request = t.mock.method(http, 'request', () => {
+  const request = t.mock.method(net, 'connect', () => {
     assert.fail('unsafe DNS must not reach transport');
   });
   syncBuiltinESMExports();
@@ -912,27 +911,10 @@ test('DNS answers containing any private address are denied before a request', a
   }
 });
 
-for (const address of ['198.18.0.2', '198.19.255.254', '2001:2::6', '2001:2:0:1::2']) {
-  test(`named images load through VPN fake DNS ${address} with pinned lookup`, async (t) => {
-    const server = createServer((_req, res) => res.end(PNG));
-    await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
-    try {
-      const local = `http://127.0.0.1:${(server.address() as import('node:net').AddressInfo).port}/image.png`;
-      const source = publicImageOrigin(t, local, 'https:', address);
-      assert.deepEqual(
-        await downloadChatImage(source, AbortSignal.timeout(2000)),
-        checkedChatImage(PNG),
-      );
-    } finally {
-      await new Promise<void>((resolve) => server.close(() => resolve()));
-    }
-  });
-}
-
-test('fake DNS never authorizes literal private addresses, local names or mixed private answers', async (t) => {
-  let answers = [{ address: '198.18.0.2', family: 4 }];
+test('literal benchmark addresses, local names and mixed private answers are denied', async (t) => {
+  let answers = [{ address: '93.184.216.34', family: 4 }];
   t.mock.method(dns, 'lookup', async () => answers);
-  const request = t.mock.method(http, 'request', () =>
+  const request = t.mock.method(net, 'connect', () =>
     assert.fail('blocked source reached transport'),
   );
   syncBuiltinESMExports();
@@ -953,7 +935,7 @@ test('fake DNS never authorizes literal private addresses, local names or mixed
     }
     for (const address of ['127.0.0.1', '192.168.1.2', '169.254.169.254', '::1']) {
       answers = [
-        { address: '198.18.0.2', family: 4 },
+        { address: '93.184.216.34', family: 4 },
         { address, family: address.includes(':') ? 6 : 4 },
       ];
       await assert.rejects(
@@ -968,7 +950,7 @@ test('fake DNS never authorizes literal private addresses, local names or mixed
   }
 });
 
-test('a configured HTTP proxy receives the original hostname despite fake DNS and checks redirects and limits', async (t) => {
+test('a configured HTTP proxy receives the original hostname and checks redirects and limits', async (t) => {
   const tunnels: string[] = [];
   const imageRequests: string[] = [];
   const server = createServer((request, response) => {
@@ -1027,9 +1009,8 @@ test('a configured HTTP proxy receives the original hostname despite fake DNS an
     });
   });
   await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
-  t.mock.method(dns, 'lookup', async (host: string) => {
-    assert.equal(host, 'image.example');
-    return [{ address: '198.18.0.2', family: 4 }];
+  const lookup = t.mock.method(dns, 'lookup', async () => {
+    throw Object.assign(new Error('local DNS is unavailable'), { code: 'ENOTFOUND' });
   });
   syncBuiltinESMExports();
   const transport = createProxiedFetchTransport({
@@ -1065,11 +1046,14 @@ test('a configured HTTP proxy receives the original hostname despite fake DNS an
       downloadChatImage('http://image.example/stalled', AbortSignal.timeout(50), options),
       { name: 'TimeoutError' },
     );
+    assert.equal(lookup.mock.callCount(), 0);
     assert.ok(tunnels.every((target) => target === 'image.example:80'));
     assert.equal(imageRequests.length, 9);
     assert.ok(imageRequests.every((request) => /host: image\.example/i.test(request)));
     assert.ok(
-      imageRequests.every((request) => !/198\.18|cookie:|authorization:|referer:/i.test(request)),
+      imageRequests.every(
+        (request) => !/93\.184\.216\.34|cookie:|authorization:|referer:/i.test(request),
+      ),
     );
   } finally {
     await transport.close();
@@ -1091,7 +1075,7 @@ test('proxy bypass preserves the checked and pinned direct image connection', as
   });
   try {
     const local = `http://127.0.0.1:${(server.address() as import('node:net').AddressInfo).port}/image.png`;
-    const source = publicImageOrigin(t, local, 'http:', '198.18.0.2');
+    const source = publicImageOrigin(t, local, 'http:');
     assert.deepEqual(
       await downloadChatImage(source, AbortSignal.timeout(2000), { fetch: transport.fetch }),
       checkedChatImage(PNG),
diff --git a/packages/runtime-host/src/__tests__/execution-composition.test.ts b/packages/runtime-host/src/__tests__/execution-composition.test.ts
index 4015b0f029..8cfb027ac1 100644
--- a/packages/runtime-host/src/__tests__/execution-composition.test.ts
+++ b/packages/runtime-host/src/__tests__/execution-composition.test.ts
@@ -20,7 +20,8 @@
 import assert from 'node:assert/strict';
 import { execFileSync } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
-import http, { createServer } from 'node:http';
+import { createServer } from 'node:http';
+import net from 'node:net';
 import dns from 'node:dns/promises';
 import { syncBuiltinESMExports } from 'node:module';
 import { WORKHUB_COORDINATION_SESSION_ID } from '@maka/core/session';
@@ -4835,32 +4836,20 @@ test('production Host loads visible remote media independently of agent sandbox
   });
   await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
   const origin = `http://127.0.0.1:${(server.address() as import('node:net').AddressInfo).port}`;
-  const realRequest = http.request;
+  const realConnect = net.connect;
   t.mock.method(dns, 'lookup', async (host: string) => {
     assert.equal(host, 'image.example');
-    return [{ address: '198.18.0.2', family: 4 }];
+    return [{ address: '93.184.216.34', family: 4 }];
+  });
+  t.mock.method(net, 'connect', (options: net.TcpNetConnectOpts) => {
+    assert.equal(options.host, 'image.example');
+    assert.ok(options.lookup);
+    options.lookup(options.host, { all: true }, (error, addresses) => {
+      assert.equal(error, null);
+      assert.deepEqual(addresses, [{ address: '93.184.216.34', family: 4 }]);
+    });
+    return realConnect({ host: '127.0.0.1', port: Number(new URL(origin).port) });
   });
-  t.mock.method(
-    http,
-    'request',
-    (
-      url: URL,
-      options: import('node:http').RequestOptions,
-      callback: (response: import('node:http').IncomingMessage) => void,
-    ) => {
-      assert.equal(url.hostname, 'image.example');
-      assert.ok(options.lookup);
-      options.lookup(url.hostname, { all: true }, (error, addresses) => {
-        assert.equal(error, null);
-        assert.deepEqual(addresses, [{ address: '198.18.0.2', family: 4 }]);
-      });
-      return realRequest(
-        new URL(url.pathname, origin),
-        { ...options, lookup: undefined },
-        callback,
-      );
-    },
-  );
   syncBuiltinESMExports();
   try {
     await withCompositionRoot(async ({ root, owner }) => {
diff --git a/packages/runtime-host/src/server/chat-image-source.ts b/packages/runtime-host/src/server/chat-image-source.ts
index 43aa34a999..36b09f119b 100644
--- a/packages/runtime-host/src/server/chat-image-source.ts
+++ b/packages/runtime-host/src/server/chat-image-source.ts
@@ -17,10 +17,6 @@
  * under the License.
  */
 
-import { lookup } from 'node:dns/promises';
-import { request as httpRequest } from 'node:http';
-import { request as httpsRequest } from 'node:https';
-import { isIP } from 'node:net';
 import { fileURLToPath } from 'node:url';
 import { ARTIFACT_IMAGE_PREVIEW_MAX_BYTES } from '@maka/core/artifacts';
 import {
@@ -33,8 +29,11 @@ import {
   isRemoteImageSource,
   type ImageDeliveryFailure,
 } from '@maka/core/image-delivery';
-import { abortable } from '../client/wait-for-ready.js';
-import { usesFetchProxy } from '@maka/runtime/network/scoped-fetch-transport';
+import {
+  createProxiedFetchTransport,
+  PublicNetworkPolicyError,
+  type ScopedFetch,
+} from '@maka/runtime/network/scoped-fetch-transport';
 export class ImageSourceError extends Error {
   constructor(readonly reason: ImageDeliveryFailure) {
     super(reason);
@@ -78,169 +77,67 @@ export function decodedLocalImagePath(source: string): string | undefined {
     return undefined;
   }
 }
-/** Pin direct DNS and check each redirect; never send cookies, auth or referer.
- * A configured proxy resolves the original hostname and is trusted to enforce
- * its own egress boundary; local DNS checks cannot pin the proxy's destination. */
+/** Network routing and public destination checks belong to the transport.
+ * Only validated image bytes cross the archive boundary. */
 export async function downloadChatImage(
   source: string,
   signal: AbortSignal,
-  options: { readonly fetch?: typeof globalThis.fetch } = {},
+  options: { readonly fetch?: ScopedFetch } = {},
 ): Promise<ChatImageBytes> {
-  let url = new URL(source);
-  for (let redirect = 0; redirect <= 3; redirect++) {
-    signal.throwIfAborted();
-    if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password)
-      throw new ImageSourceError('not_allowed');
-    const host = url.hostname.replace(/^\[|\]$/g, '');
-    // Fake DNS addresses are routing handles for a named destination, never
-    // authority to load a literal private address or a local/metadata hostname.
-    // This compatibility exception assumes trusted VPN/TUN routing: a fake-IP
-    // answer alone does not prove that the eventual destination is public.
-    const namedHost = !isIP(host) && publicHostname(host);
-    if (!isIP(host) && !namedHost) throw new ImageSourceError('not_allowed');
-    const addresses = isIP(host)
-      ? [{ address: host, family: isIP(host) }]
-      : await abortable(() => lookup(host, { all: true }), signal);
-    if (
-      !addresses.length ||
-      addresses.some((a) => !publicAddress(a.address) && !(namedHost && fakeAddress(a.address)))
-    )
-      throw new ImageSourceError('not_allowed');
-    const target = addresses[0]!;
-    const headers = { accept: 'image/png,image/jpeg,image/webp,image/gif' };
-    const proxyFetch =
-      options.fetch && usesFetchProxy(options.fetch, url) ? options.fetch : undefined;
-    const response = proxyFetch
-      ? proxyImageResponse(
-          await proxyFetch(url, { signal, headers, redirect: 'manual', credentials: 'omit' }),
-        )
-      : directImageResponse(
-          await new Promise<import('node:http').IncomingMessage>((resolve, reject) => {
-            const req = (url.protocol === 'https:' ? httpsRequest : httpRequest)(
-              url,
-              {
-                signal,
-                headers,
-                lookup: (_host, options, callback) =>
-                  options.all
-                    ? callback(null, [target])
-                    : callback(null, target.address, target.family),
-              },
-              resolve,
-            );
-            req.on('error', reject);
-            req.end();
-          }),
-        );
-    const location = response.header('location');
-    if ([301, 302, 303, 307, 308].includes(response.status) && location) {
-      await response.close();
-      const next = new URL(location, url);
-      if (url.protocol === 'https:' && next.protocol !== 'https:')
-        throw new ImageSourceError('not_allowed');
-      url = next;
-      continue;
-    }
-    if (response.status !== 200) {
-      await response.close();
-      throw new ImageSourceError('download_failed');
-    }
-    const length = Number(response.header('content-length'));
-    if (length > ARTIFACT_IMAGE_PREVIEW_MAX_BYTES) {
-      await response.close();
-      throw new ImageSourceError('too_large');
-    }
-    const chunks: Buffer[] = [];
-    let size = 0;
-    for await (const chunk of response.chunks) {
-      size += chunk.length;
-      if (size > ARTIFACT_IMAGE_PREVIEW_MAX_BYTES) {
-        await response.close();
+  const owned = options.fetch ? undefined : createProxiedFetchTransport(null);
+  const fetch = options.fetch ?? owned!.fetch;
+  try {
+    let url = new URL(source);
+    for (let redirect = 0; redirect <= 3; redirect++) {
+      signal.throwIfAborted();
+      const response = await fetch(url, {
+        targetPolicy: 'public',
+        signal,
+        headers: { accept: 'image/png,image/jpeg,image/webp,image/gif' },
+        redirect: 'manual',
+        credentials: 'omit',
+      });
+      const location = response.headers.get('location');
+      if ([301, 302, 303, 307, 308].includes(response.status) && location) {
+        await response.body?.cancel();
+        const next = new URL(location, url);
+        if (url.protocol === 'https:' && next.protocol !== 'https:')
+          throw new ImageSourceError('not_allowed');
+        url = next;
+        continue;
+      }
+      if (response.status !== 200) {
+        await response.body?.cancel();
+        throw new ImageSourceError('download_failed');
+      }
+      if (Number(response.headers.get('content-length')) > ARTIFACT_IMAGE_PREVIEW_MAX_BYTES) {
+        await response.body?.cancel();
         throw new ImageSourceError('too_large');
       }
-      chunks.push(Buffer.from(chunk));
-    }
-    return checkedChatImage(Buffer.concat(chunks, size));
-  }
-  throw new ImageSourceError('download_failed');
-}
-interface ImageResponse {
-  readonly status: number;
-  readonly chunks: AsyncIterable<Uint8Array>;
-  header(name: string): string | undefined;
-  close(): void | Promise<void>;
-}
-function directImageResponse(response: import('node:http').IncomingMessage): ImageResponse {
-  return {
-    status: response.statusCode ?? 0,
-    chunks: response,
-    header: (name) => {
-      const value = response.headers[name];
-      return typeof value === 'string' ? value : undefined;
-    },
-    close: () => {
-      response.destroy();
-    },
-  };
-}
-function proxyImageResponse(response: Response): ImageResponse {
-  return {
-    status: response.status,
-    header: (name) => response.headers.get(name) ?? undefined,
-    close: async () => {
-      await response.body?.cancel().catch(() => {});
-    },
-    chunks: (async function* () {
+      const chunks: Buffer[] = [];
+      let size = 0;
       const reader = response.body?.getReader();
-      if (!reader) return;
-      try {
-        while (true) {
-          const chunk = await reader.read();
-          if (chunk.done) break;
-          yield chunk.value;
+      if (reader) {
+        try {
+          while (true) {
+            const chunk = await reader.read();
+            if (chunk.done) break;
+            size += chunk.value.length;
+            if (size > ARTIFACT_IMAGE_PREVIEW_MAX_BYTES) throw new ImageSourceError('too_large');
+            chunks.push(Buffer.from(chunk.value));
+          }
+        } finally {
+          await reader.cancel().catch(() => {});
+          reader.releaseLock();
         }
-      } finally {
-        await reader.cancel().catch(() => {});
-        reader.releaseLock();
       }
-    })(),
-  };
-}
-function publicHostname(host: string): boolean {
-  const name = host.toLowerCase().replace(/\.$/, '');
-  return (
-    name.includes('.') &&
-    !/(^|\.)(localhost|local|lan|internal|home|arpa|test|invalid)$/.test(name) &&
-    ![
-      'metadata.google.internal',
-      'metadata.goog',
-      'metadata.tencentyun.com',
-      'instance-data.ec2.internal',
-    ].includes(name)
-  );
-}
-function fakeAddress(address: string): boolean {
-  if (isIP(address) === 4) return /^198\.(18|19)\./.test(address);
-  if (isIP(address) !== 6) return false;
-  // RFC 5180's benchmarking prefix is also used by VPN fake DNS for IPv6.
-  const normalized = new URL(`http://[${address}]`).hostname;
-  return /^\[2001:2:(?::|0:)/i.test(normalized);
-}
-function publicAddress(address: string): boolean {
-  if (isIP(address) === 4) {
-    const [a = 0, b = 0] = address.split('.').map(Number);
-    return (
-      a > 0 &&
-      a !== 10 &&
-      a !== 127 &&
-      a < 224 &&
-      !(a === 169 && b === 254) &&
-      !(a === 172 && b >= 16 && b <= 31) &&
-      !(a === 192 && b === 168) &&
-      !(a === 100 && b >= 64 && b <= 127) &&
-      !(a === 198 && (b === 18 || b === 19))
-    );
+      return checkedChatImage(Buffer.concat(chunks, size));
+    }
+    throw new ImageSourceError('download_failed');
+  } catch (error) {
+    if (error instanceof PublicNetworkPolicyError) throw new ImageSourceError('not_allowed');
+    throw error;
+  } finally {
+    await owned?.close();
   }
-  // Only global-unicast IPv6 is eligible. Mapped IPv4/ULA/link-local are excluded.
-  return /^[23][0-9a-f]{3}:/i.test(address) && !fakeAddress(address);
 }
diff --git a/packages/runtime-host/src/server/execution-composition.ts b/packages/runtime-host/src/server/execution-composition.ts
index 330f1a5104..2e8f8a682f 100644
--- a/packages/runtime-host/src/server/execution-composition.ts
+++ b/packages/runtime-host/src/server/execution-composition.ts
@@ -611,7 +611,6 @@ export async function createExecutionRuntimeHostComposition(
           resolved.networkProxy,
           resolved.secretMaterial.networkProxy?.secret,
         );
-        if (!proxy) return downloadChatImage(source, signal);
         const transport = createProxiedFetchTransport(proxy);
         try {
           return await downloadChatImage(source, signal, { fetch: transport.fetch });
diff --git a/packages/runtime/src/network/__tests__/public-network-policy.test.ts b/packages/runtime/src/network/__tests__/public-network-policy.test.ts
new file mode 100644
index 0000000000..1378bd8fd3
--- /dev/null
+++ b/packages/runtime/src/network/__tests__/public-network-policy.test.ts
@@ -0,0 +1,327 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import assert from 'node:assert/strict';
+import dns from 'node:dns/promises';
+import { getEventListeners } from 'node:events';
+import { createServer } from 'node:http';
+import { syncBuiltinESMExports } from 'node:module';
+import net from 'node:net';
+import tls from 'node:tls';
+import { test, type TestContext } from 'node:test';
+import { withTimeout } from '@maka/core/test-only/async-primitives';
+import {
+  createProxiedFetchTransport,
+  PublicNetworkPolicyError,
+} from '../scoped-fetch-transport.js';
+import { preparePublicNetworkTarget } from '../public-network-policy.js';
+
+const policy = { targetPolicy: 'public', redirect: 'manual' } as const;
+function restore(t: TestContext) {
+  t.after(() => {
+    t.mock.restoreAll();
+    syncBuiltinESMExports();
+  });
+  syncBuiltinESMExports();
+}
+
+test('public policy is per request; ordinary private requests and automatic redirects still work', async () => {
+  let hits = 0;
+  const server = createServer((req, res) => {
+    hits++;
+    if (req.url === '/redirect') res.writeHead(302, { location: '/image' }).end();
+    else res.end('ok');
+  });
+  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+  const url = `http://127.0.0.1:${(server.address() as net.AddressInfo).port}`;
+  const transport = createProxiedFetchTransport(null);
+  try {
+    assert.equal(await (await transport.fetch(url + '/redirect')).text(), 'ok');
+    await assert.rejects(transport.fetch(url, policy), PublicNetworkPolicyError);
+    assert.equal(hits, 2);
+    assert.equal(await (await transport.fetch(url)).text(), 'ok');
+    assert.equal(hits, 3);
+    await assert.rejects(
+      transport.fetch('http://image.example', { targetPolicy: 'public' }),
+      /manual redirects/,
+    );
+  } finally {
+    await transport.close();
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+  }
+});
+
+for (const address of ['198.18.0.2', '198.19.255.254', '2001:2::6', '2001:2:0:1::2']) {
+  test(`public policy rejects benchmark DNS and literal ${address} without exceptions`, async (t) => {
+    const benchmark = { address, family: address.includes(':') ? 6 : 4 };
+    let answers = [benchmark];
+    const lookup = t.mock.method(dns, 'lookup', async () => answers);
+    const connect = t.mock.method(net, 'connect', () =>
+      assert.fail('blocked target reached transport'),
+    );
+    restore(t);
+    const direct = createProxiedFetchTransport(null);
+    const proxy = createProxiedFetchTransport({
+      enabled: true,
+      type: 'http',
+      host: '127.0.0.1',
+      port: 1,
+      bypassList: [],
+    });
+    try {
+      for (const resolved of [[benchmark], [{ address: '93.184.216.34', family: 4 }, benchmark]]) {
+        answers = resolved;
+        await assert.rejects(
+          direct.fetch('http://image.example', policy),
+          PublicNetworkPolicyError,
+        );
+      }
+      assert.equal(lookup.mock.callCount(), 2);
+      const literal = `http://${benchmark.family === 6 ? `[${address}]` : address}/`;
+      for (const transport of [direct, proxy]) {
+        await assert.rejects(transport.fetch(literal, policy), PublicNetworkPolicyError);
+      }
+      assert.equal(lookup.mock.callCount(), 2);
+      assert.equal(connect.mock.callCount(), 0);
+    } finally {
+      await direct.close();
+      await proxy.close();
+    }
+  });
+}
+
+test('public policy rejects local names and private literals before DNS on either route', async (t) => {
+  const lookup = t.mock.method(dns, 'lookup', async () => assert.fail('forbidden URL reached DNS'));
+  restore(t);
+  for (const proxy of [
+    null,
+    { enabled: true, type: 'http' as const, host: '127.0.0.1', port: 1, bypassList: [] },
+  ]) {
+    const transport = createProxiedFetchTransport(proxy);
+    try {
+      for (const url of [
+        'http://127.0.0.1',
+        'http://0x7f000001',
+        'http://10.0.0.1',
+        'http://192.168.0.1',
+        'http://169.254.169.254',
+        'http://100.64.0.1',
+        'http://[::1]',
+        'http://[::ffff:127.0.0.1]',
+        'http://[fd00::1]',
+        'http://localhost.',
+        'http://router.lan',
+        'http://metadata.goog',
+        'http://user:password@image.example',
+        'file:///tmp/image.png',
+      ]) {
+        await assert.rejects(transport.fetch(url, policy), PublicNetworkPolicyError);
+      }
+    } finally {
+      await transport.close();
+    }
+  }
+  assert.equal(lookup.mock.callCount(), 0);
+});
+
+test('public direct requests pin admitted DNS, isolate ordinary sockets, and recheck each request', async (t) => {
+  let hits = 0;
+  const server = createServer((req, res) => {
+    assert.equal(req.headers.host, 'image.example');
+    hits++;
+    res.end('ok');
+  });
+  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+  const port = (server.address() as net.AddressInfo).port;
+  const realConnect = net.connect;
+  let answers = [{ address: '93.184.216.34', family: 4 }];
+  const lookup = t.mock.method(dns, 'lookup', async () => answers);
+  let pinnedConnections = 0;
+  t.mock.method(net, 'connect', (options: net.TcpNetConnectOpts) => {
+    assert.equal(options.host, 'image.example');
+    if (options.lookup) {
+      pinnedConnections++;
+      // A fresh lookup would now resolve privately. The connector must use
+      // the admitted answer, not re-resolve or reuse an ordinary socket.
+      answers = [{ address: '127.0.0.1', family: 4 }];
+      options.lookup(options.host, { all: true }, (error, addresses) => {
+        assert.equal(error, null);
+        assert.deepEqual(addresses, [{ address: '93.184.216.34', family: 4 }]);
+      });
+      options.lookup(options.host, {}, (error, address, family) => {
+        assert.equal(error, null);
+        assert.equal(address, '93.184.216.34');
+        assert.equal(family, 4);
+      });
+    }
+    return realConnect({ host: '127.0.0.1', port });
+  });
+  restore(t);
+  const transport = createProxiedFetchTransport(null);
+  try {
+    assert.equal(await (await transport.fetch('http://image.example')).text(), 'ok');
+    const mutableUrl = new URL('http://image.example');
+    const checked = transport.fetch(mutableUrl, policy);
+    mutableUrl.hostname = '127.0.0.1';
+    assert.equal(await (await checked).text(), 'ok');
+    assert.equal(pinnedConnections, 1);
+    assert.equal(lookup.mock.callCount(), 1);
+    await assert.rejects(transport.fetch('http://image.example', policy), PublicNetworkPolicyError);
+    assert.equal(hits, 2);
+    // The policy on the previous requests did not alter this transport's default.
+    assert.equal(await (await transport.fetch('http://image.example')).text(), 'ok');
+  } finally {
+    await transport.close();
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+  }
+});
+
+test('proxy bypass applies public DNS checks only to the direct route', async (t) => {
+  const lookup = t.mock.method(dns, 'lookup', async () => [{ address: '127.0.0.1', family: 4 }]);
+  const connect = t.mock.method(net, 'connect', () => assert.fail('blocked bypass reached socket'));
+  restore(t);
+  const transport = createProxiedFetchTransport({
+    enabled: true,
+    type: 'http',
+    host: '127.0.0.1',
+    port: 1,
+    bypassList: ['image.example'],
+  });
+  try {
+    await assert.rejects(transport.fetch('http://image.example', policy), PublicNetworkPolicyError);
+    assert.equal(lookup.mock.callCount(), 1);
+    assert.equal(connect.mock.callCount(), 0);
+  } finally {
+    await transport.close();
+  }
+});
+
+for (const cancel of ['request', 'transport'] as const) {
+  test(`public DNS lookup is interruptible by ${cancel} cancellation`, async (t) => {
+    let entered!: () => void;
+    const started = new Promise<void>((resolve) => {
+      entered = resolve;
+    });
+    let finish!: (addresses: { address: string; family: number }[]) => void;
+    t.mock.method(dns, 'lookup', () => {
+      entered();
+      return new Promise((resolve) => {
+        finish = resolve;
+      });
+    });
+    const connect = t.mock.method(net, 'connect', () => assert.fail('canceled DNS reached socket'));
+    restore(t);
+    const transport = createProxiedFetchTransport(null);
+    const controller = new AbortController();
+    const pending = assert.rejects(
+      transport.fetch('http://image.example', { ...policy, signal: controller.signal }),
+      /stopped|transport closed/,
+    );
+    try {
+      await started;
+      if (cancel === 'request') controller.abort(new Error('stopped'));
+      else await transport.close();
+      await withTimeout(pending, 1000, 'DNS cancellation did not settle');
+      finish([{ address: '93.184.216.34', family: 4 }]);
+      await new Promise((resolve) => setImmediate(resolve));
+      assert.equal(connect.mock.callCount(), 0);
+    } finally {
+      await transport.close();
+    }
+  });
+}
+
+test('public DNS validation cleans abort listeners on success and failure', async (t) => {
+  let answers = [{ address: '2606:4700:4700::1111', family: 6 }];
+  t.mock.method(dns, 'lookup', async () => answers);
+  restore(t);
+  const controller = new AbortController();
+  assert.deepEqual(
+    await preparePublicNetworkTarget(new URL('https://image.example'), false, controller.signal),
+    answers[0],
+  );
+  answers = [];
+  await assert.rejects(
+    preparePublicNetworkTarget(new URL('https://image.example'), false, controller.signal),
+    PublicNetworkPolicyError,
+  );
+  assert.equal(getEventListeners(controller.signal, 'abort').length, 0);
+});
+
+for (const cancel of ['request', 'transport'] as const) {
+  test(`public direct TLS handshake preserves SNI and closes on ${cancel} cancellation`, async (t) => {
+    let entered!: () => void;
+    const started = new Promise<void>((resolve) => {
+      entered = resolve;
+    });
+    let disconnected!: () => void;
+    const closed = new Promise<void>((resolve) => {
+      disconnected = resolve;
+    });
+    const sockets = new Set<net.Socket>();
+    const server = net.createServer((socket) => {
+      sockets.add(socket);
+      socket.on('error', () => {});
+      socket.on('close', () => {
+        sockets.delete(socket);
+        disconnected();
+      });
+      socket.once('data', (chunk) => {
+        assert.equal(chunk[0], 22, 'expected a real TLS ClientHello');
+        entered();
+      });
+    });
+    await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+    const port = (server.address() as net.AddressInfo).port;
+    const realConnect = tls.connect;
+    t.mock.method(dns, 'lookup', async () => [{ address: '93.184.216.34', family: 4 }]);
+    t.mock.method(
+      tls,
+      'connect',
+      (options: tls.ConnectionOptions & { lookup?: net.TcpNetConnectOpts['lookup'] }) => {
+        assert.equal(options.host, 'image.example');
+        assert.equal(options.servername, 'image.example');
+        assert.notEqual(options.rejectUnauthorized, false);
+        assert.ok(options.lookup);
+        options.lookup(options.host!, { all: true }, (error, addresses) => {
+          assert.equal(error, null);
+          assert.deepEqual(addresses, [{ address: '93.184.216.34', family: 4 }]);
+        });
+        return realConnect({ ...options, host: '127.0.0.1', port, lookup: undefined });
+      },
+    );
+    restore(t);
+    const transport = createProxiedFetchTransport(null);
+    const controller = new AbortController();
+    const pending = assert.rejects(
+      transport.fetch('https://image.example', { ...policy, signal: controller.signal }),
+    );
+    try {
+      await withTimeout(started, 2000, 'TLS handshake did not start');
+      if (cancel === 'request') controller.abort();
+      else await transport.close();
+      await withTimeout(pending, 1000, 'fetch did not stop');
+      await withTimeout(closed, 1000, 'TLS socket survived cancellation');
+    } finally {
+      await transport.close();
+      for (const socket of sockets) socket.destroy();
+      await new Promise<void>((resolve) => server.close(() => resolve()));
+    }
+  });
+}
diff --git a/packages/runtime/src/network/__tests__/scoped-fetch-transport.test.ts b/packages/runtime/src/network/__tests__/scoped-fetch-transport.test.ts
index 9063ced052..6da5182a0e 100644
--- a/packages/runtime/src/network/__tests__/scoped-fetch-transport.test.ts
+++ b/packages/runtime/src/network/__tests__/scoped-fetch-transport.test.ts
@@ -36,7 +36,10 @@ import {
 } from '../../connection-effect-fetch.js';
 import { runConnectionModelDiscoveryEffect } from '../../model-fetcher.js';
 import { runConnectionTestEffect, testConnection } from '../../test-connection.js';
-import { createConnectionEffectFetchTransport } from '../scoped-fetch-transport.js';
+import {
+  createConnectionEffectFetchTransport,
+  createProxiedFetchTransport,
+} from '../scoped-fetch-transport.js';
 import { testProxyConnection } from '../proxy-test.js';
 import { proxiedFetch } from '../../bots/proxied-fetch.js';
 import { setActiveProxy } from '../active-proxy-state.js';
@@ -229,6 +232,37 @@ describe('connection effect network transport', () => {
     });
   }
 
+  for (const authenticated of [false, true]) {
+    test(`public requests preserve SOCKS remote DNS (auth: ${authenticated})`, async () => {
+      const proxy = await startStalledProxy(
+        authenticated ? 'socks-auth-http' : 'socks-http',
+        false,
+        'image.example',
+      );
+      const transport = createProxiedFetchTransport({
+        ...PROXY_DEFAULTS,
+        enabled: true,
+        type: 'socks5',
+        host: '127.0.0.1',
+        port: proxy.port,
+        username: authenticated ? 'proxy-user' : '',
+        password: authenticated ? 'proxy-password' : '',
+        bypassList: [],
+      });
+      try {
+        const response = await transport.fetch('http://image.example/models', {
+          targetPolicy: 'public',
+          redirect: 'manual',
+          signal: AbortSignal.timeout(2000),
+        });
+        assert.equal(await response.text(), 'proxy-ok');
+      } finally {
+        await transport.close();
+        await proxy.close();
+      }
+    });
+  }
+
   for (const type of ['http', 'https', 'socks5'] as const) {
     test(`immediate close rejects pending and subsequent requests (${type})`, async () => {
       const proxy = await startStalledProxy(
@@ -904,7 +938,11 @@ async function startSuccessfulTlsConnectProxy(body: string, protocol: 'http/1.1'
   };
 }
 
-async function startStalledProxy(stage: string, rejectTls = false) {
+async function startStalledProxy(
+  stage: string,
+  rejectTls = false,
+  targetHost = 'provider.invalid',
+) {
   const sockets = new Set<net.Socket>();
   let started!: () => void;
   const reachedStage = new Promise<void>((resolve) => {
@@ -965,7 +1003,7 @@ async function startStalledProxy(stage: string, rejectTls = false) {
       } else if (phase === 'socks-connect' && buffer.length >= 5) {
         assert.equal(buffer[3], 3, 'the destination hostname must be resolved by the proxy');
         if (buffer.length < 7 + buffer[4]!) return;
-        assert.equal(buffer.subarray(5, 5 + buffer[4]!).toString(), 'provider.invalid');
+        assert.equal(buffer.subarray(5, 5 + buffer[4]!).toString(), targetHost);
         buffer = Buffer.alloc(0);
         if (stage === 'socks-connect') {
           phase = 'stalled';
diff --git a/packages/runtime/src/network/public-network-policy.ts b/packages/runtime/src/network/public-network-policy.ts
new file mode 100644
index 0000000000..9d1e4e98e8
--- /dev/null
+++ b/packages/runtime/src/network/public-network-policy.ts
@@ -0,0 +1,107 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { lookup } from 'node:dns/promises';
+import type { LookupAddress } from 'node:dns';
+import { isIP } from 'node:net';
+
+export class PublicNetworkPolicyError extends Error {
+  readonly name = 'PublicNetworkPolicyError';
+  constructor() {
+    super('Network target is not allowed by the public network policy');
+  }
+}
+
+/** Validate every URL, then resolve and pin direct destinations. Configured
+ * proxies resolve named destinations themselves and are trusted to enforce
+ * their egress boundary. Local DNS cannot establish a proxy's final address. */
+export async function preparePublicNetworkTarget(
+  url: URL,
+  useProxy: boolean,
+  signal: AbortSignal,
+): Promise<LookupAddress | undefined> {
+  signal.throwIfAborted();
+  if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password)
+    throw new PublicNetworkPolicyError();
+  const host = url.hostname.replace(/^\[|\]$/g, '');
+  const family = isIP(host);
+  if (family) {
+    if (!publicAddress(host)) throw new PublicNetworkPolicyError();
+    return useProxy ? undefined : { address: host, family };
+  }
+  if (!publicHostname(host)) throw new PublicNetworkPolicyError();
+  if (useProxy) return undefined;
+  const addresses = await lookupWithSignal(host, signal);
+  signal.throwIfAborted();
+  if (!addresses.length || addresses.some(({ address }) => !publicAddress(address)))
+    throw new PublicNetworkPolicyError();
+  return addresses[0];
+}
+
+function lookupWithSignal(host: string, signal: AbortSignal): Promise<LookupAddress[]> {
+  return new Promise((resolve, reject) => {
+    const abort = () => {
+      signal.removeEventListener('abort', abort);
+      reject(signal.reason);
+    };
+    signal.addEventListener('abort', abort, { once: true });
+    if (signal.aborted) abort();
+    else
+      void lookup(host, { all: true })
+        .then(resolve, reject)
+        .finally(() => {
+          signal.removeEventListener('abort', abort);
+        });
+  });
+}
+
+function publicHostname(host: string): boolean {
+  const name = host.toLowerCase().replace(/\.$/, '');
+  return (
+    name.includes('.') &&
+    !/(^|\.)(localhost|local|lan|internal|home|arpa|test|invalid)$/.test(name) &&
+    ![
+      'metadata.google.internal',
+      'metadata.goog',
+      'metadata.tencentyun.com',
+      'instance-data.ec2.internal',
+    ].includes(name)
+  );
+}
+
+function publicAddress(address: string): boolean {
+  if (isIP(address) === 4) {
+    const [a = 0, b = 0] = address.split('.').map(Number);
+    return (
+      a > 0 &&
+      a !== 10 &&
+      a !== 127 &&
+      a < 224 &&
+      !(a === 169 && b === 254) &&
+      !(a === 172 && b >= 16 && b <= 31) &&
+      !(a === 192 && b === 168) &&
+      !(a === 100 && b >= 64 && b <= 127) &&
+      !(a === 198 && (b === 18 || b === 19))
+    );
+  }
+  if (isIP(address) !== 6) return false;
+  // Only global-unicast IPv6 is eligible, excluding the benchmarking prefix.
+  const normalized = new URL(`http://[${address}]`).hostname;
+  return /^[23][0-9a-f]{3}:/i.test(address) && !/^\[2001:2:(?::|0:)/i.test(normalized);
+}
diff --git a/packages/runtime/src/network/scoped-fetch-transport.ts b/packages/runtime/src/network/scoped-fetch-transport.ts
index e9ee4bb920..7ad80feae6 100644
--- a/packages/runtime/src/network/scoped-fetch-transport.ts
+++ b/packages/runtime/src/network/scoped-fetch-transport.ts
@@ -23,6 +23,8 @@ import type { ConnectionEffectFetch } from '../connection-effect-fetch.js';
 import { matchesBypassList } from './bypass-matcher.js';
 import { buildProxyDispatcher } from './proxy-dispatcher.js';
 import { buildAbortableConnector } from './abortable-connector.js';
+import { preparePublicNetworkTarget } from './public-network-policy.js';
+export { PublicNetworkPolicyError } from './public-network-policy.js';
 
 export const FETCH_PROXY_SNAPSHOT = Symbol.for('maka.fetch.proxy-snapshot');
 
@@ -45,17 +47,20 @@ export interface ConnectionEffectFetchTransport {
 
 export type ProxiedFetchProxy = ConnectionEffectProxySnapshot;
 
-/** Use the same immutable route decision when a caller also owns a pinned direct connection. */
-export function usesFetchProxy(fetch: typeof globalThis.fetch, url: URL): boolean {
-  const proxy = Object.getOwnPropertyDescriptor(fetch, FETCH_PROXY_SNAPSHOT)?.value as
-    | ProxySettings
-    | null
-    | undefined;
-  return !!proxy?.enabled && !matchesBypassList(url.hostname, proxy.bypassList);
+export interface ScopedFetchInit extends RequestInit {
+  /** Opt-in public destination policy. Direct DNS is checked and pinned;
+   * configured proxies own final resolution/egress. Redirects must be manual
+   * (each next URL is a new checked request) or error. Defaults stay unchanged. */
+  readonly targetPolicy?: 'public';
 }
 
+export type ScopedFetch = (
+  input: Parameters<typeof globalThis.fetch>[0],
+  init?: ScopedFetchInit,
+) => Promise<Response>;
+
 export interface ProxiedFetchTransport {
-  readonly fetch: typeof globalThis.fetch;
+  readonly fetch: ScopedFetch;
   close(): Promise<void>;
 }
 
@@ -85,27 +90,78 @@ export function createProxiedFetchTransport(
   // direct and proxy connection establishment too, including TLS handshakes.
   const connections = new AbortController();
   const directDispatcher = new Agent({ connect: buildAbortableConnector(connections.signal) });
+  const publicDispatchers = new Set<Agent>();
   let proxyDispatcher: Dispatcher | undefined;
   let closePromise: Promise<void> | undefined;
   let closed = false;
 
-  const fetch: typeof globalThis.fetch = async (input, init) => {
+  const fetch: ScopedFetch = async (input, init) => {
     if (closed) throw new Error('Proxied fetch transport is closed');
 
     const url =
       typeof input === 'string' ? input : input instanceof URL ? input.toString() : input.url;
     const useProxy =
       proxySnapshot !== null && !matchesBypassList(new URL(url).hostname, proxySnapshot.bypassList);
+    const { targetPolicy, ...requestInit } = init ?? {};
+    let publicDispatcher: Agent | undefined;
+    if (targetPolicy !== undefined) {
+      if (targetPolicy !== 'public') throw new Error('Unknown network target policy');
+      const inputRequest = typeof input === 'string' || input instanceof URL ? undefined : input;
+      const redirect = requestInit.redirect ?? inputRequest?.redirect ?? 'follow';
+      if (redirect !== 'manual' && redirect !== 'error')
+        throw new Error('Public network requests require manual redirects or redirect: error');
+      const requestSignal =
+        requestInit.signal === undefined ? inputRequest?.signal : requestInit.signal;
+      const signal = requestSignal
+        ? AbortSignal.any([connections.signal, requestSignal])
+        : connections.signal;
+      const target = await preparePublicNetworkTarget(new URL(url), useProxy, signal);
+      signal.throwIfAborted();
+      requestInit.signal = signal;
+      if (target) {
+        // A separate dispatcher prevents reuse of an unchecked connection and
+        // binds this request to exactly the DNS answer admitted above.
+        publicDispatcher = new Agent({
+          connect: buildAbortableConnector(signal, {
+            lookup: (_host, options, callback) =>
+              options.all
+                ? callback(null, [target])
+                : callback(null, target.address, target.family),
+          }),
+        });
+        publicDispatchers.add(publicDispatcher);
+      }
+    }
     if (useProxy)
       proxyDispatcher ??= buildProxyDispatcher(proxySnapshot, connections.signal) as Dispatcher;
 
-    return (await undiciFetch(
-      input as Parameters<typeof undiciFetch>[0],
-      {
-        ...init,
-        dispatcher: useProxy ? proxyDispatcher : directDispatcher,
-      } as Parameters<typeof undiciFetch>[1],
-    )) as unknown as Response;
+    try {
+      const response = (await undiciFetch(
+        // Keep a mutable URL object bound to the destination checked before DNS awaited.
+        (targetPolicy === 'public' && input instanceof URL ? url : input) as Parameters<
+          typeof undiciFetch
+        >[0],
+        {
+          ...requestInit,
+          dispatcher: publicDispatcher ?? (useProxy ? proxyDispatcher : directDispatcher),
+        } as Parameters<typeof undiciFetch>[1],
+      )) as unknown as Response;
+      if (publicDispatcher) {
+        const dispatcher = publicDispatcher;
+        // Graceful close waits for the body, without delaying delivery of headers.
+        void dispatcher
+          .close()
+          .catch(() => {})
+          .finally(() => publicDispatchers.delete(dispatcher));
+      }
+      return response;
+    } catch (error) {
+      if (publicDispatcher) {
+        await publicDispatcher.destroy().catch(() => {});
+        publicDispatchers.delete(publicDispatcher);
+      }
+      throw error;
+    }
   };
   Object.defineProperty(fetch, FETCH_PROXY_SNAPSHOT, {
     value: proxySnapshot,
@@ -115,7 +171,11 @@ export function createProxiedFetchTransport(
   const close = (): Promise<void> => {
     if (closePromise) return closePromise;
     closed = true;
+    connections.abort(new Error('Connection effect fetch transport closed'));
     const destroyed = Promise.all([
+      ...[...publicDispatchers].map((dispatcher) =>
+        dispatcher.destroy(new Error('Connection effect fetch transport closed')).catch(() => {}),
+      ),
       directDispatcher
         .destroy(new Error('Connection effect fetch transport closed'))
         .catch(() => {}),

From 951fdf1858e3a7113d659baaf54cd1dfc26a9f0b Mon Sep 17 00:00:00 2001
From: Sun-GLiang <81428141+Sun-GLiang@users.noreply.github.com>
Date: Sat, 10 Oct 2026 16:14:37 +0800
Subject: [PATCH 27/35] fix(ui): render reasoning images as links

Generated-by: Codex (GPT-6)
---
 .../scripts/markdown-images.browser.test.mjs  | 60 ++++++++++++++++++-
 packages/ui/src/chat-turn.tsx                 |  1 +
 packages/ui/src/markdown-body.tsx             | 26 +++++++-
 packages/ui/src/markdown.tsx                  |  2 +
 4 files changed, 86 insertions(+), 3 deletions(-)

diff --git a/packages/ui/scripts/markdown-images.browser.test.mjs b/packages/ui/scripts/markdown-images.browser.test.mjs
index 0374c29bad..c16a930b8c 100644
--- a/packages/ui/scripts/markdown-images.browser.test.mjs
+++ b/packages/ui/scripts/markdown-images.browser.test.mjs
@@ -90,6 +90,17 @@ before(async () => {
   await new Promise(resolve => imageServer.listen(0, '127.0.0.1', resolve));
   imageUrl = `http://127.0.0.1:${imageServer.address().port}`;
   const destinations = {
+    'links-formats': [
+      `![Screenshot](${imageUrl}/image.png)`,
+      '![Reference][picture]',
+      `[picture]: <${imageUrl}/reference.png>`,
+      `Build ![Badge](${imageUrl}/badge.png) passing.`,
+      `![](${imageUrl}/empty.png)`,
+      '![Local](/tmp/private.png)',
+      '`![Example](https://example.com/code.png)`',
+    ].join('\n\n'),
+    'links-redacted': `![Signed](${imageUrl}/image.png?token=reasoning-secret)\n\n![Blocked](javascript:alert)`,
+    'links-streaming': `![Streaming](${imageUrl}/stream`,
     'badge-remote': `Build ![Badge](${imageUrl}/badge.png) passing.`,
     'badge-saved': `Build ![Badge](${imageUrl}/badge.png) passing.`,
     'badge-saving': `Build ![Badge](${imageUrl}/badge.png) passing.`,
@@ -188,12 +199,12 @@ before(async () => {
         await new Promise(resolve=>setTimeout(resolve,100));
         return mode.endsWith('saving') && window.deliveryQueries===1 ? {status:'pending'} : {status:'ready',artifactId:mode.startsWith('layout-') ? request.source : 'saved-image'};
       };
-      const markdown=(streaming)=>React.createElement(Markdown,{text,streaming,settledText:race ? text : undefined,density:'compact',imageIdentity:{turnId:'turn',messageId}});
+      const markdown=(streaming)=>React.createElement(Markdown,{text,streaming,settledText:race ? text : undefined,density:'compact',imageIdentity:{turnId:'turn',messageId},imageDisplay:mode.startsWith('links-') ? 'link' : undefined});
       const surface=(streaming)=>mode.startsWith('layout-') ? React.createElement('section',{className:mode==='layout-side' ? 'maka-quote-companion' : '',style:{width:mode==='layout-side' ? '360px' : '100%',maxWidth:'100%'}},
         React.createElement(ChatMessageList,{className:'maka-chat-message-list maka-chatContent',align:'top'},
           React.createElement('div',{className:'maka-transcript-turn maka-turn',style:{width:'100%',maxWidth:'var(--maka-reading-measure)',marginInline:'auto'}},
             React.createElement(ChatMessage,{sender:'assistant'},React.createElement(ChatMessageBubble,{variant:'ghost',width:'100%',className:'maka-chat-message-bubble maka-chat-message-bubble-assistant'},markdown(streaming)))))) : markdown(streaming);
-      const render=(streaming=race)=>root.render(
+      const render=(streaming=race || mode==='links-streaming')=>root.render(
         React.createElement(Theme,{theme:makaTheme,mode:'light'},
           React.createElement(LocaleProvider,{locale:'en'},
             React.createElement(SessionAttachmentProvider,{sessionId:'session',readBytes},
@@ -253,6 +264,51 @@ async function loaded(page) {
   await page.waitForFunction(() => [...document.images].some(image => image.naturalWidth === 1));
 }
 
+test('image links preserve Markdown destinations without loading image or attachment bytes', async () => {
+  requests = [];
+  const page = await pageFor('links-formats');
+  try {
+    await page.getByRole('link', {name:/^Screenshot/}).waitFor();
+    assert.equal(await page.getByRole('link', {name:/^Screenshot/}).getAttribute('href'), `${imageUrl}/image.png`);
+    assert.equal(await page.getByRole('link', {name:/^Reference/}).getAttribute('href'), `${imageUrl}/reference.png`);
+    assert.equal(await page.getByRole('link', {name:/^Badge/}).getAttribute('href'), `${imageUrl}/badge.png`);
+    assert.equal(await page.locator('a').filter({hasText:`${imageUrl}/empty.png`}).getAttribute('href'), `${imageUrl}/empty.png`);
+    assert.equal(await page.locator('a a').count(), 0);
+    assert.equal(await page.getByRole('link', {name:'Local', exact:true}).count(), 0);
+    assert.equal(await page.locator('code').innerText(), '![Example](https://example.com/code.png)');
+    assert.equal(await page.locator('img, .maka-markdown-image-resource').count(), 0);
+    assert.deepEqual(await page.evaluate(() => [window.deliveryQueries, window.imageReads]), [0, 0]);
+    assert.deepEqual(requests, []);
+  } finally { await page.close(); }
+});
+
+test('image links do not expose signed destinations or enable unsafe schemes', async () => {
+  requests = [];
+  const page = await pageFor('links-redacted');
+  try {
+    await page.getByText('Signed', {exact:true}).waitFor();
+    assert.equal(await page.locator('a, img, .maka-markdown-image-resource').count(), 0);
+    assert.doesNotMatch(await page.locator('#root').innerHTML(), /reasoning-secret|maka-image-display:/);
+    assert.deepEqual(await page.evaluate(() => [window.deliveryQueries, window.imageReads]), [0, 0]);
+    assert.deepEqual(requests, []);
+  } finally { await page.close(); }
+});
+
+test('streaming reasoning completes image syntax as a link without fetching it', async () => {
+  requests = [];
+  const page = await pageFor('links-streaming');
+  try {
+    await page.waitForFunction(() => typeof window.appendText === 'function');
+    await page.evaluate(() => window.appendText('.png)'));
+    await page.getByRole('link', {name:/^Streaming/}).waitFor();
+    await page.evaluate(() => window.finishStream());
+    assert.equal(await page.getByRole('link', {name:/^Streaming/}).getAttribute('href'), `${imageUrl}/stream.png`);
+    assert.equal(await page.locator('img, .maka-markdown-image-resource').count(), 0);
+    assert.deepEqual(await page.evaluate(() => [window.deliveryQueries, window.imageReads]), [0, 0]);
+    assert.deepEqual(requests, []);
+  } finally { await page.close(); }
+});
+
 test('a remote image loads automatically and renders Host-owned bytes', async () => {
   requests = [];
   const page = await pageFor('remote');
diff --git a/packages/ui/src/chat-turn.tsx b/packages/ui/src/chat-turn.tsx
index 902de62a67..d4130b2228 100644
--- a/packages/ui/src/chat-turn.tsx
+++ b/packages/ui/src/chat-turn.tsx
@@ -1516,6 +1516,7 @@ function DeepThinking(props: { text: string; live: boolean; settledText?: string
       <Markdown
         text={props.text}
         streaming={props.live}
+        imageDisplay="link"
         // A truncated reasoning buffer slides at the head. It is a current
         // snapshot, not an append-only prefix for the reveal cursor to replay.
         settledText={props.truncated ? props.text : props.settledText}
diff --git a/packages/ui/src/markdown-body.tsx b/packages/ui/src/markdown-body.tsx
index f9ecab9d3f..553c3369f4 100644
--- a/packages/ui/src/markdown-body.tsx
+++ b/packages/ui/src/markdown-body.tsx
@@ -31,8 +31,11 @@
 
 import { MarkdownImage, MarkdownImageSourceProvider, MARKDOWN_IMAGE_PLUGINS } from './markdown-image.js';
 import { ImageMessageScope } from './image-delivery.js';
+import { createMarkdownPlugin } from '@astryxdesign/core/Markdown/plugins';
+import type { MarkdownAstNode, MarkdownAstRoot } from '@astryxdesign/core/Markdown';
 import { useCallback, useContext, useMemo, useRef, type ReactNode } from 'react';
 import { redactMarkdownImages } from './markdown-image-redaction.js';
+import { redactSecrets } from './redact.js';
 import {
   Markdown as AstryxMarkdown,
   type MarkdownComponents,
@@ -148,6 +151,7 @@ export function MarkdownBody(props: {
   /** The lazy entry redacts its fallback; the body also preserves image identities. */
   redact?: boolean;
   imageIdentity?: { turnId: string; messageId: string };
+  imageDisplay?: 'image' | 'link';
   streaming?: boolean;
   settledText?: string;
   density?: 'default' | 'compact';
@@ -161,6 +165,26 @@ export function MarkdownBody(props: {
     ? redactMarkdownImages(props.text, props.settledText)
     : { text: props.text, settledText: props.settledText, sources: undefined },
   [props.redact, props.text, props.settledText]);
+  const plugins = useMemo(() => props.imageDisplay === 'link' ? [createMarkdownPlugin({
+    name: 'maka-image-links', apiVersion: 1,
+    transform(document) {
+      // Use parsed nodes so references and code examples retain their semantics.
+      // No image component mounts in this mode, so display cannot load bytes.
+      const rewrite = (node: MarkdownAstNode, insideLink = false, phrasing = false): MarkdownAstNode => {
+        if (node.type === 'image') {
+          const source = presentation.sources?.get(node.url) ?? node.url;
+          const text = { type: 'text' as const, value: node.alt || redactSecrets(source) };
+          const link = insideLink || source !== redactSecrets(source) ? text
+            : { type: 'link' as const, url: source, children: [text] };
+          return phrasing ? link : { type: 'paragraph', children: [link] };
+        }
+        if (!('children' in node)) return node;
+        const childPhrasing = ['paragraph', 'heading', 'tableCell', 'link', 'strong', 'emphasis', 'delete'].includes(node.type);
+        return { ...node, children: node.children.map(child => rewrite(child, insideLink || node.type === 'link', childPhrasing)) } as MarkdownAstNode;
+      };
+      return rewrite(document) as MarkdownAstRoot;
+    },
+  })] : MARKDOWN_IMAGE_PLUGINS, [props.imageDisplay, presentation.sources]);
   const budgetedText = props.streaming ? presentation.text : applyMermaidRenderBudget(presentation.text);
   const density = props.density ?? 'default';
   const components = props.streaming
@@ -205,7 +229,7 @@ export function MarkdownBody(props: {
             // the one combination neither half of the argument asks for.
             density={density}
             components={components}
-            plugins={MARKDOWN_IMAGE_PLUGINS}
+            plugins={plugins}
             isStreaming={props.streaming}
             settledText={presentation.settledText}
             transformSource={transformMathSource}
diff --git a/packages/ui/src/markdown.tsx b/packages/ui/src/markdown.tsx
index 57ef8fb3de..2205890951 100644
--- a/packages/ui/src/markdown.tsx
+++ b/packages/ui/src/markdown.tsx
@@ -58,6 +58,7 @@ const MarkdownBody = lazy(() => import('./markdown-body.js').then((m) => ({ defa
 export function Markdown(props: {
   text: string;
   imageIdentity?: { turnId: string; messageId: string };
+  imageDisplay?: 'image' | 'link';
   streaming?: boolean;
   settledText?: string;
   /** Block rhythm. Transcript turns pass `compact`; documents leave it. */
@@ -80,6 +81,7 @@ export function Markdown(props: {
         text={props.text}
         redact
         imageIdentity={props.imageIdentity}
+        imageDisplay={props.imageDisplay}
         streaming={streaming}
         settledText={props.settledText}
         density={props.density}

From dca546b400738a2758abb7712df2f3117f9f7df5 Mon Sep 17 00:00:00 2001
From: Sun-GLiang <81428141+Sun-GLiang@users.noreply.github.com>
Date: Sat, 10 Oct 2026 16:25:59 +0800
Subject: [PATCH 28/35] fix(ui): keep execution process images as links

Generated-by: Codex (GPT-6)
---
 .../chat-turn-answer-identity.test.tsx        | 55 +++++++++++++++++++
 packages/ui/src/chat-turn.tsx                 | 10 +++-
 2 files changed, 63 insertions(+), 2 deletions(-)

diff --git a/packages/ui/src/__tests__/chat-turn-answer-identity.test.tsx b/packages/ui/src/__tests__/chat-turn-answer-identity.test.tsx
index 5c9a4ce7cc..8473762e13 100644
--- a/packages/ui/src/__tests__/chat-turn-answer-identity.test.tsx
+++ b/packages/ui/src/__tests__/chat-turn-answer-identity.test.tsx
@@ -28,6 +28,8 @@ import { LocalizedChatMessage, TurnView } from '../chat-turn.js';
 import { LocaleProvider } from '../locale-context.js';
 import type { TurnTimelineItem, TurnViewModel } from '../materialize.js';
 import { applyThinkingDelta } from '../thinking-stream.js';
+import { ImageDeliveryProvider, type ResolveImageDelivery } from '../image-delivery.js';
+import { SessionAttachmentProvider } from '../attachment-image.js';
 
 const originalGlobals = {
   document: globalThis.document,
@@ -208,6 +210,59 @@ test('keeps reasoning expanded when its last neighboring tool is projected away'
   assert.equal(after.getAttribute('aria-expanded'), 'true');
 });
 
+test('process image links never load bytes while the completed final reply still displays an image', async () => {
+  const { container, root } = domRoot();
+  const sources: string[] = [];
+  let reads = 0;
+  const resolve: ResolveImageDelivery = async (_session, request) => {
+    sources.push(request.source);
+    return { status: 'ready', artifactId: 'final-image' };
+  };
+  const readBytes = async () => {
+    reads++;
+    return { ok: true as const, mimeType: 'image/png', base64: 'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8DwHwAFBQIAX8jx0gAAAABJRU5ErkJggg==' };
+  };
+  const thinking: TurnTimelineItem = { kind: 'thinking', messageId: 'reasoning', text: '![Reasoning](https://example.com/reasoning.png)' };
+  const commentary: TurnTimelineItem = { kind: 'text', messageId: 'commentary', text: '![Intermediate](https://example.com/commentary.png)', live: true, complete: true };
+  const final: TurnTimelineItem = { kind: 'text', messageId: 'final', text: '![Final](https://example.com/final.png)' };
+  const render = async (timeline: TurnTimelineItem[], completed = false) => {
+    await act(async () => {
+      root.render(<LocaleProvider locale="en">
+        <SessionAttachmentProvider sessionId="session" readBytes={readBytes}>
+          <ImageDeliveryProvider sessionId="session" resolve={resolve}>
+            <TurnView turn={{ ...turnWith(timeline), status: completed ? 'completed' : 'running' }}
+              liveStreaming={completed ? undefined : { runningStatus: true }} />
+          </ImageDeliveryProvider>
+        </SessionAttachmentProvider>
+      </LocaleProvider>);
+    });
+  };
+
+  // The live last text step is provisional: the next tool can move it into the process.
+  await render([thinking, commentary]);
+  assert.ok(container.querySelector('a[href="https://example.com/commentary.png"]'));
+  assert.equal(container.querySelectorAll('img, .maka-markdown-image-resource').length, 0);
+  assert.deepEqual(sources, []);
+  assert.equal(reads, 0);
+
+  await render([thinking, commentary, RUNNING_TOOL]);
+  assert.ok(container.querySelector('.maka-processing-body a[href="https://example.com/commentary.png"]'));
+  assert.deepEqual(sources, []);
+  assert.equal(reads, 0);
+
+  await render([thinking, commentary, { ...RUNNING_TOOL, items: RUNNING_TOOL.items.map(item => ({ ...item, status: 'completed' })) }, final], true);
+  assert.deepEqual(sources, ['https://example.com/final.png']);
+  assert.equal(reads, 1);
+  assert.equal(container.querySelectorAll('img').length, 1);
+  await act(() => { container.querySelector('.maka-processing-summary')?.dispatchEvent(new window.Event('click', { bubbles: true })); });
+  await act(() => { container.querySelector('.maka-deep-thinking [data-slot="activity-card-header"]')?.dispatchEvent(new window.Event('click', { bubbles: true })); });
+  assert.ok(container.querySelector('.maka-processing-body a[href="https://example.com/reasoning.png"]'));
+  assert.ok(container.querySelector('.maka-processing-body a[href="https://example.com/commentary.png"]'));
+  assert.equal(container.querySelectorAll('.maka-processing-body img, .maka-processing-body .maka-markdown-image-resource').length, 0);
+  assert.deepEqual(sources, ['https://example.com/final.png']);
+  assert.equal(reads, 1);
+});
+
 test('redacts secrets before rendering a settled collapsed reasoning preview', async () => {
   const { container, root } = domRoot();
   await renderTurn(root, turnWith([
diff --git a/packages/ui/src/chat-turn.tsx b/packages/ui/src/chat-turn.tsx
index d4130b2228..67efa6b43c 100644
--- a/packages/ui/src/chat-turn.tsx
+++ b/packages/ui/src/chat-turn.tsx
@@ -783,6 +783,8 @@ export const TurnView = memo(function TurnView(props: {
                   <TurnTimelineEntry
                     key={timelineEntryKey(item, index)}
                     activityObserved={props.activityObserved}
+                    // The next tool can still turn a live reply into process commentary.
+                    imageDisplay={statusBarStatus === 'running' ? 'link' : undefined}
                     item={item}
                     turnId={turn.turnId}
                     onStreamingSettled={props.liveStreaming?.onStreamingSettled}
@@ -1305,7 +1307,7 @@ export function ModelProviderRetryIndicator(props: { retry: LiveProviderRetry })
  */
 type AssistantAnswerPhase = 'historical' | 'streaming' | 'settled';
 
-type AssistantAnswerBubbleProps = { imageIdentity?: { turnId: string; messageId: string } } & (
+type AssistantAnswerBubbleProps = { imageIdentity?: { turnId: string; messageId: string }; imageDisplay?: 'image' | 'link' } & (
   | { text: string; phase: 'historical'; interrupted?: true }
   | {
       text: string;
@@ -1364,6 +1366,7 @@ const AssistantAnswerBubble = memo(function AssistantAnswerBubble(props: Assista
       <Markdown
         text={props.text}
         imageIdentity={props.imageIdentity}
+        imageDisplay={props.imageDisplay}
         streaming={props.phase === 'streaming'}
         settledText={settledText}
         // Names the surface, and not exclusively: the desktop Artifact
@@ -1420,6 +1423,7 @@ const TurnTimelineEntry = memo(function TurnTimelineEntry(props: {
   turnId?: string;
   activityObserved?: boolean;
   item: Exclude<TurnTimelineItem, { kind: 'user' }>;
+  imageDisplay?: 'image' | 'link';
   onStreamingSettled?: (messageId?: string) => void;
   onOpenLinkedSession?(sessionId: string): void;
   initialLiveContent?: ReadonlyMap<string, string>;
@@ -1445,10 +1449,11 @@ const TurnTimelineEntry = memo(function TurnTimelineEntry(props: {
     );
   }
   // Same component either way — a type swap here would remount the answer.
-  if (item.live !== true) return <AssistantAnswerBubble imageIdentity={props.turnId ? { turnId: props.turnId, messageId: item.messageId } : undefined} text={item.text} interrupted={item.interrupted} phase="historical" />;
+  if (item.live !== true) return <AssistantAnswerBubble imageIdentity={props.turnId ? { turnId: props.turnId, messageId: item.messageId } : undefined} imageDisplay={props.imageDisplay} text={item.text} interrupted={item.interrupted} phase="historical" />;
   return (
     <AssistantAnswerBubble
       imageIdentity={props.turnId ? { turnId: props.turnId, messageId: item.messageId } : undefined}
+      imageDisplay={props.imageDisplay}
       text={item.text}
       interrupted={item.interrupted}
       phase={item.complete === true ? 'settled' : 'streaming'}
@@ -1489,6 +1494,7 @@ const ProcessingBlock = memo(function ProcessingBlock(props: {
           <TurnTimelineEntry
             key={timelineEntryKey(entry, index)}
             activityObserved={open && props.activityObserved !== false}
+            imageDisplay="link"
             item={entry}
             turnId={props.turnId}
             onStreamingSettled={props.onStreamingSettled}

From 92989323a2ffb7979b0c7281fb356f9d5b6ca23e Mon Sep 17 00:00:00 2001
From: Sun-GLiang <81428141+Sun-GLiang@users.noreply.github.com>
Date: Sat, 10 Oct 2026 16:41:54 +0800
Subject: [PATCH 29/35] refactor(ui): unify chat image rendering and service
 contracts

Share image AST traversal and canonical destination handling across image and link modes. Move message identity scope into assistant bubbles and reuse narrow chat image service contracts across desktop surfaces.

Cover canonical image links and the renamed WorkHub preload capability. Validate 164 related Node tests, 57 browser scenarios, 166 architecture fixtures, desktop typechecks and Biome checks.

Generated-by: Codex (GPT-6)
---
 ...ub-coordination-transcript-preload.test.ts |  12 +-
 apps/desktop/src/preload/bridge-contract.d.ts |   4 +-
 apps/desktop/src/preload/preload.ts           |   2 +-
 .../features/conversation/staging-services.ts |   7 +-
 .../ui/staged-quote-chat-view.tsx             |   4 +-
 .../src/renderer/features/workbar/ports.ts    |   5 +-
 .../tools/side-chat/quote-companion-panel.tsx |   2 +-
 .../src/renderer/features/workhub/ports.ts    |   6 +-
 .../features/workhub/ui/workhub-root.tsx      |   2 +-
 .../desktop/create-workhub-services.ts        |   4 +-
 apps/desktop/stories/workhub.stories.tsx      |   2 +-
 packages/core/src/image-delivery.ts           |  17 +++
 .../scripts/markdown-images.browser.test.mjs  |  11 +-
 .../src/__tests__/attachment-image.test.tsx   |   6 +-
 .../ui/src/__tests__/markdown-body.test.ts    |  15 +++
 packages/ui/src/attachment-image.tsx          |   7 +-
 packages/ui/src/chat-turn.tsx                 |  40 +++---
 packages/ui/src/chat-view.tsx                 |   2 +-
 packages/ui/src/image-delivery.tsx            |  17 ++-
 packages/ui/src/markdown-body.tsx             | 115 +++++++-----------
 packages/ui/src/markdown-image.tsx            |  88 +++++++-------
 packages/ui/src/markdown.tsx                  |   2 -
 22 files changed, 198 insertions(+), 172 deletions(-)

diff --git a/apps/desktop/src/main/__tests__/workhub-coordination-transcript-preload.test.ts b/apps/desktop/src/main/__tests__/workhub-coordination-transcript-preload.test.ts
index 3545fcf398..e312f5594b 100644
--- a/apps/desktop/src/main/__tests__/workhub-coordination-transcript-preload.test.ts
+++ b/apps/desktop/src/main/__tests__/workhub-coordination-transcript-preload.test.ts
@@ -84,6 +84,12 @@ test('WorkHub upload references round-trip through idle answers, both queue mode
             return { ok: true, disposition: args[2] === 'current_turn' ? 'steering' : 'followup', attachments: [uploaded] };
           }
           if (channel === 'attachments:readBytes') return { ok: true, base64: 'aGVsbG8=' };
+          if (channel === 'attachments:resolveImage') {
+            assert.deepEqual(structuredClone(args[2]), {
+              turnId: 'image-turn', messageId: 'image-message', source: '/tmp/image.png',
+            });
+            return { status: 'ready', artifactId: 'image-1' };
+          }
           throw new Error(`Unexpected channel: ${channel}`);
         },
       },
@@ -108,7 +114,11 @@ test('WorkHub upload references round-trip through idle answers, both queue mode
     assert.equal(await services.enqueueMessage(sessionId, `message-${placement}`, 'read this', attachments, placement), 'admitted');
   }
   assert.deepEqual(structuredClone(sent.map(({ attachments }) => attachments)), [[uploaded], [uploaded], [uploaded]]);
-  assert.equal((await services.readAttachmentBytes(sessionId, 'brief.txt')).ok, true);
+  assert.equal((await services.readBytes(sessionId, 'brief.txt')).ok, true);
+  assert.ok(services.resolveImageDelivery);
+  assert.deepEqual(await services.resolveImageDelivery(sessionId, {
+    turnId: 'image-turn', messageId: 'image-message', source: '/tmp/image.png',
+  }), { status: 'ready', artifactId: 'image-1' });
   preparationResult = { ok: false, code: 'item_too_large' };
   await assert.rejects(
     services.prepareAttachments(sessionId, [
diff --git a/apps/desktop/src/preload/bridge-contract.d.ts b/apps/desktop/src/preload/bridge-contract.d.ts
index 2b29352396..63cb82951b 100644
--- a/apps/desktop/src/preload/bridge-contract.d.ts
+++ b/apps/desktop/src/preload/bridge-contract.d.ts
@@ -1745,8 +1745,8 @@ export interface MakaBridge {
       | { ok: true; base64: string; mimeType: string }
       | { ok: false; reason: string }
     >;
-    resolveImage(sessionId: string, request: import('@maka/core/image-delivery').ImageDeliveryRequest): Promise<import('@maka/core/image-delivery').ImageDeliveryResult>;
-    readBytes(sessionId: string, artifactId: string): Promise<ArtifactBinaryReadResult>;
+    resolveImageDelivery: import('@maka/core/image-delivery').ResolveImageDelivery;
+    readBytes: import('@maka/core/image-delivery').ReadAttachmentBytes;
   };
   search: {
     recall(
diff --git a/apps/desktop/src/preload/preload.ts b/apps/desktop/src/preload/preload.ts
index be090c0163..1b978bf054 100644
--- a/apps/desktop/src/preload/preload.ts
+++ b/apps/desktop/src/preload/preload.ts
@@ -3422,7 +3422,7 @@ const makaBridge = {
     },
   },
   attachments: {
-    resolveImage: (sessionId, request) => invokeSessionRuntimeHost('attachments:resolveImage', sessionId, request),
+    resolveImageDelivery: (sessionId, request) => invokeSessionRuntimeHost('attachments:resolveImage', sessionId, request),
     pickDirectory: () => invokeWhenReady('directories:pick'),
     // The renderer hands over the dropped or pasted File objects, never paths:
     // only a File backed by something the user dropped or pasted has a path,
diff --git a/apps/desktop/src/renderer/features/conversation/staging-services.ts b/apps/desktop/src/renderer/features/conversation/staging-services.ts
index d8bfc67874..643871d9bc 100644
--- a/apps/desktop/src/renderer/features/conversation/staging-services.ts
+++ b/apps/desktop/src/renderer/features/conversation/staging-services.ts
@@ -19,13 +19,10 @@
 
 import { createServicesContext } from '../../application/contracts/feature-services.js';
 import type { ComposerAttachmentService } from '@maka/ui/use-composer-attachments';
-import type { ArtifactBinaryReadResult } from '@maka/core/artifacts';
+import type { ChatImageServices } from '@maka/core/image-delivery';
 
 /** One attachment port: the Composer stages through it and the transcript reads image bytes through it. */
-export interface ComposerStagingServices extends ComposerAttachmentService {
-  resolveImage?: (sessionId: string, request: import('@maka/core/image-delivery').ImageDeliveryRequest) => Promise<import('@maka/core/image-delivery').ImageDeliveryResult>;
-  readBytes(sessionId: string, artifactId: string): Promise<ArtifactBinaryReadResult>;
-}
+export type ComposerStagingServices = ComposerAttachmentService & ChatImageServices;
 const context = createServicesContext<ComposerStagingServices>('ComposerStagingServicesProvider');
 export const ComposerStagingServicesProvider = context.Provider;
 export const useComposerStagingServices = context.useServices;
diff --git a/apps/desktop/src/renderer/features/conversation/ui/staged-quote-chat-view.tsx b/apps/desktop/src/renderer/features/conversation/ui/staged-quote-chat-view.tsx
index b81e97d929..78366070d5 100644
--- a/apps/desktop/src/renderer/features/conversation/ui/staged-quote-chat-view.tsx
+++ b/apps/desktop/src/renderer/features/conversation/ui/staged-quote-chat-view.tsx
@@ -26,6 +26,6 @@ import { useComposerStagingServices } from '../staging-services.js';
 export function StagedQuoteChatView(props: Omit<ComponentProps<typeof PlanChatView>,
   'handleRef' | 'pendingQuotes' | 'onQuoteAnnotationSubmit' | 'onReadAttachmentBytes' | 'onResolveImageDelivery'>) {
   const staging = useComposerStaging();
-  const { readBytes, resolveImage } = useComposerStagingServices();
-  return <PlanChatView {...props} {...staging.chatViewQuoteProps} onReadAttachmentBytes={readBytes} onResolveImageDelivery={resolveImage} />;
+  const { readBytes, resolveImageDelivery } = useComposerStagingServices();
+  return <PlanChatView {...props} {...staging.chatViewQuoteProps} onReadAttachmentBytes={readBytes} onResolveImageDelivery={resolveImageDelivery} />;
 }
diff --git a/apps/desktop/src/renderer/features/workbar/ports.ts b/apps/desktop/src/renderer/features/workbar/ports.ts
index 8e8ed1af9b..b3c1e41891 100644
--- a/apps/desktop/src/renderer/features/workbar/ports.ts
+++ b/apps/desktop/src/renderer/features/workbar/ports.ts
@@ -17,6 +17,7 @@
  * under the License.
  */
 
+import type { ChatImageServices } from '@maka/core/image-delivery';
 import type { SessionInspectorService } from '../../application/contracts/session-inspector/service.js';
 export type { SessionInspectorService, SessionTracePage, SessionUsageSummary } from '../../application/contracts/session-inspector/service.js';
 
@@ -164,9 +165,7 @@ export interface WorkbarArtifactsService {
   saveAs(sessionId: string, artifactId: string): Promise<ArtifactSaveResult>;
 }
 
-export interface WorkbarAttachmentsService {
-  resolveImage?: (sessionId: string, request: import('@maka/core/image-delivery').ImageDeliveryRequest) => Promise<import('@maka/core/image-delivery').ImageDeliveryResult>;
-  readBytes(sessionId: string, artifactId: string): Promise<ArtifactBinaryReadResult>;
+export interface WorkbarAttachmentsService extends ChatImageServices {
   pickFiles(): Promise<
     | {
         ok: true;
diff --git a/apps/desktop/src/renderer/features/workbar/tools/side-chat/quote-companion-panel.tsx b/apps/desktop/src/renderer/features/workbar/tools/side-chat/quote-companion-panel.tsx
index 2e278a21bf..0a4b8e8af2 100644
--- a/apps/desktop/src/renderer/features/workbar/tools/side-chat/quote-companion-panel.tsx
+++ b/apps/desktop/src/renderer/features/workbar/tools/side-chat/quote-companion-panel.tsx
@@ -404,7 +404,7 @@ export function QuoteCompanionPanel(props: {
           liveTurns={companion.liveTurns}
           activeTurn={companion.activeTurn}
           activeSession={companion.companionSession}
-          onReadAttachmentBytes={attachments.readBytes} onResolveImageDelivery={attachments.resolveImage}
+          onReadAttachmentBytes={attachments.readBytes} onResolveImageDelivery={attachments.resolveImageDelivery}
           deriveTurnPresentation={deriveTurnPresentation}
           onEditUserMessage={(turnId) => {
             const message = companion.messages.find(
diff --git a/apps/desktop/src/renderer/features/workhub/ports.ts b/apps/desktop/src/renderer/features/workhub/ports.ts
index 93f1774831..9d9bc69a32 100644
--- a/apps/desktop/src/renderer/features/workhub/ports.ts
+++ b/apps/desktop/src/renderer/features/workhub/ports.ts
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-import type { ArtifactBinaryReadResult } from '@maka/core/artifacts';
+import type { ChatImageServices } from '@maka/core/image-delivery';
 import type { ChatModelChoice } from '@maka/core/chat-model-choice';
 import type { UiLocale } from '@maka/core/ui-locale';
 import type { StoredMessage, SessionSummary } from '@maka/core/session';
@@ -39,7 +39,7 @@ export interface WorkHubTranscript {
   loadEarlier(): Promise<void>;
   close(): Promise<void>;
 }
-export interface WorkHubServices extends WorkHubWorkspaceServices {
+export interface WorkHubServices extends WorkHubWorkspaceServices, ChatImageServices {
   readonly inspector: import('../../application/contracts/session-inspector/service.js').SessionInspectorService;
   readonly surface: 'main' | 'workhub';
   readonly initialLocale: UiLocale;
@@ -56,8 +56,6 @@ export interface WorkHubServices extends WorkHubWorkspaceServices {
     model: string;
   }): Promise<void>;
   readonly attachments: ComposerAttachmentService;
-  resolveImageDelivery?: (sessionId: string, request: import('@maka/core/image-delivery').ImageDeliveryRequest) => Promise<import('@maka/core/image-delivery').ImageDeliveryResult>;
-  readAttachmentBytes(sessionId: string, artifactId: string): Promise<ArtifactBinaryReadResult>;
   prepareAttachments(sessionId: string, items: Array<{ approvalId: string; name: string; mimeType?: string } | { file: File }>): Promise<AttachmentRef[]>;
   listActiveInteractions(sessionId: string): Promise<import('@maka/core/events').ActiveInteractionRequestEvent[]>;
   subscribeActiveInteractions(handler: (event: { sessionId: string; interactions: import('@maka/core/events').ActiveInteractionRequestEvent[] }) => void): () => void;
diff --git a/apps/desktop/src/renderer/features/workhub/ui/workhub-root.tsx b/apps/desktop/src/renderer/features/workhub/ui/workhub-root.tsx
index f87510db54..3a1f0d8aa8 100644
--- a/apps/desktop/src/renderer/features/workhub/ui/workhub-root.tsx
+++ b/apps/desktop/src/renderer/features/workhub/ui/workhub-root.tsx
@@ -408,7 +408,7 @@ export function WorkHubRoot() {
         <div ref={history} className="workHubHistory" aria-hidden={!showConversation} inert={!showConversation}>
         <WorkHubConversation
           workLinks={links}
-          onReadAttachmentBytes={services.readAttachmentBytes} onResolveImageDelivery={services.resolveImageDelivery}
+          onReadAttachmentBytes={services.readBytes} onResolveImageDelivery={services.resolveImageDelivery}
           onOpenWork={(id) => call(services.presentation.openSession(id))}
           scrollBehavior="auto"
           onNew={() => composer.current?.focus()}
diff --git a/apps/desktop/src/renderer/platform/desktop/create-workhub-services.ts b/apps/desktop/src/renderer/platform/desktop/create-workhub-services.ts
index de3e8b0d53..d68513bd39 100644
--- a/apps/desktop/src/renderer/platform/desktop/create-workhub-services.ts
+++ b/apps/desktop/src/renderer/platform/desktop/create-workhub-services.ts
@@ -92,8 +92,8 @@ export function createDesktopWorkHubServices(
     setDefaultModel: ({ llmConnectionSlug, model }) =>
       bridge.connections.setDefaultModel({ slug: llmConnectionSlug, model }),
     attachments: bridge.attachments,
-    readAttachmentBytes: bridge.attachments.readBytes,
-    resolveImageDelivery: bridge.attachments.resolveImage,
+    readBytes: bridge.attachments.readBytes,
+    resolveImageDelivery: bridge.attachments.resolveImageDelivery,
     prepareAttachments: async (sessionId, items) => {
       const result = await bridge.workHub.prepareAttachments(sessionId, items);
       if (!result.ok) throw new AttachmentIngestBlockedError(result.code);
diff --git a/apps/desktop/stories/workhub.stories.tsx b/apps/desktop/stories/workhub.stories.tsx
index 7475765cbb..15a8926d87 100644
--- a/apps/desktop/stories/workhub.stories.tsx
+++ b/apps/desktop/stories/workhub.stories.tsx
@@ -101,7 +101,7 @@ function makeServices(failFirst: boolean, withHistory: boolean | 'usage', colore
     listSessions: async () => coloredHistory ? [target, secondTarget] : [target], subscribeSessions: (handler) => { updateSessions = handler; return () => { updateSessions = undefined; }; }, modelChoices: async () => choices,
     setDefaultModel: async () => {},
     attachments: { pickFiles: async () => ({ ok: true, files: [{ approvalId: 'file-1', name: 'requirements.txt', size: 12, mimeType: 'text/plain' }] }), previewApproval: async () => ({ ok: false, reason: 'not-image' }) },
-    readAttachmentBytes: async () => { throw new Error('Not an image'); },
+    readBytes: async () => { throw new Error('Not an image'); },
     prepareAttachments: async (id, items) => { writes.upload(id, items); return [{ name: 'requirements.txt', kind: 'other', mimeType: 'text/plain', bytes: 12, ref: { kind: 'session_file', sessionId: 'maka_workhub_coordination', relativePath: 'artifact-1' } }]; },
     listActiveInteractions: async () => pendingForm ? [pendingForm] : questionPending ? [questionRequest] : [],
     subscribeActiveInteractions: (handler) => { interactionUpdate = handler; return () => { interactionUpdate = undefined; }; },
diff --git a/packages/core/src/image-delivery.ts b/packages/core/src/image-delivery.ts
index da283ea307..23ec235260 100644
--- a/packages/core/src/image-delivery.ts
+++ b/packages/core/src/image-delivery.ts
@@ -17,6 +17,8 @@
  * under the License.
  */
 
+import type { ArtifactBinaryReadResult } from './artifacts.js';
+
 /** Client-safe delivery contract. No filesystem or networking capabilities live here. */
 export const IMAGE_DELIVERY_IDENTITY_MAX_LENGTH = 512;
 export const IMAGE_DELIVERY_SOURCE_MAX_LENGTH = 4096;
@@ -89,6 +91,21 @@ export type ImageDeliveryResult =
   | { readonly status: 'ready'; readonly artifactId: string }
   | { readonly status: 'failed'; readonly reason: ImageDeliveryFailure }
   | { readonly status: 'unavailable' };
+
+export type ResolveImageDelivery = (
+  sessionId: string,
+  request: ImageDeliveryRequest,
+) => Promise<ImageDeliveryResult>;
+export type ReadAttachmentBytes = (
+  sessionId: string,
+  artifactId: string,
+) => Promise<ArtifactBinaryReadResult>;
+
+/** Narrow transcript image capabilities shared by the UI and desktop adapters. */
+export interface ChatImageServices {
+  readBytes: ReadAttachmentBytes;
+  resolveImageDelivery?: ResolveImageDelivery;
+}
 /** Stored with its Artifact, so session copy/export carries both provenance and bytes. */
 export interface ImageDeliveryMetadata {
   readonly messageId: string;
diff --git a/packages/ui/scripts/markdown-images.browser.test.mjs b/packages/ui/scripts/markdown-images.browser.test.mjs
index c16a930b8c..61a45be918 100644
--- a/packages/ui/scripts/markdown-images.browser.test.mjs
+++ b/packages/ui/scripts/markdown-images.browser.test.mjs
@@ -92,6 +92,9 @@ before(async () => {
   const destinations = {
     'links-formats': [
       `![Screenshot](${imageUrl}/image.png)`,
+      `![Title](${imageUrl}/title.png "Screenshot title")`,
+      `![Angle](<${imageUrl}/angle.png>)`,
+      '![Escaped](' + imageUrl + String.raw`/a\(1\).png)`,
       '![Reference][picture]',
       `[picture]: <${imageUrl}/reference.png>`,
       `Build ![Badge](${imageUrl}/badge.png) passing.`,
@@ -156,7 +159,7 @@ before(async () => {
       import {makaTheme} from './apps/desktop/src/renderer/astryx-theme/maka.js';
       import {Markdown} from './packages/ui/dist/markdown.js';
       import {LocaleProvider} from './packages/ui/dist/locale-context.js';
-      import {ImageDeliveryProvider} from './packages/ui/dist/image-delivery.js';
+      import {ImageDeliveryProvider, ImageMessageProvider} from './packages/ui/dist/image-delivery.js';
       import {SessionAttachmentProvider} from './packages/ui/dist/attachment-image.js';
       import './apps/desktop/src/renderer/styles.css';
       const mode=new URLSearchParams(location.search).get('case') || 'remote';
@@ -199,7 +202,8 @@ before(async () => {
         await new Promise(resolve=>setTimeout(resolve,100));
         return mode.endsWith('saving') && window.deliveryQueries===1 ? {status:'pending'} : {status:'ready',artifactId:mode.startsWith('layout-') ? request.source : 'saved-image'};
       };
-      const markdown=(streaming)=>React.createElement(Markdown,{text,streaming,settledText:race ? text : undefined,density:'compact',imageIdentity:{turnId:'turn',messageId},imageDisplay:mode.startsWith('links-') ? 'link' : undefined});
+      const markdown=(streaming)=>React.createElement(ImageMessageProvider,{identity:{turnId:'turn',messageId},streaming},
+        React.createElement(Markdown,{text,streaming,settledText:race ? text : undefined,density:'compact',imageDisplay:mode.startsWith('links-') ? 'link' : undefined}));
       const surface=(streaming)=>mode.startsWith('layout-') ? React.createElement('section',{className:mode==='layout-side' ? 'maka-quote-companion' : '',style:{width:mode==='layout-side' ? '360px' : '100%',maxWidth:'100%'}},
         React.createElement(ChatMessageList,{className:'maka-chat-message-list maka-chatContent',align:'top'},
           React.createElement('div',{className:'maka-transcript-turn maka-turn',style:{width:'100%',maxWidth:'var(--maka-reading-measure)',marginInline:'auto'}},
@@ -270,6 +274,9 @@ test('image links preserve Markdown destinations without loading image or attach
   try {
     await page.getByRole('link', {name:/^Screenshot/}).waitFor();
     assert.equal(await page.getByRole('link', {name:/^Screenshot/}).getAttribute('href'), `${imageUrl}/image.png`);
+    assert.equal(await page.getByRole('link', {name:/^Title/}).getAttribute('href'), `${imageUrl}/title.png`);
+    assert.equal(await page.getByRole('link', {name:/^Angle/}).getAttribute('href'), `${imageUrl}/angle.png`);
+    assert.equal(await page.getByRole('link', {name:/^Escaped/}).getAttribute('href'), `${imageUrl}/a(1).png`);
     assert.equal(await page.getByRole('link', {name:/^Reference/}).getAttribute('href'), `${imageUrl}/reference.png`);
     assert.equal(await page.getByRole('link', {name:/^Badge/}).getAttribute('href'), `${imageUrl}/badge.png`);
     assert.equal(await page.locator('a').filter({hasText:`${imageUrl}/empty.png`}).getAttribute('href'), `${imageUrl}/empty.png`);
diff --git a/packages/ui/src/__tests__/attachment-image.test.tsx b/packages/ui/src/__tests__/attachment-image.test.tsx
index ad59683d76..e9e327ed90 100644
--- a/packages/ui/src/__tests__/attachment-image.test.tsx
+++ b/packages/ui/src/__tests__/attachment-image.test.tsx
@@ -30,7 +30,7 @@ import {
 import { LocaleProvider } from '../locale-context.js';
 import { MarkdownBody } from '../markdown-body.js';
 import { Markdown } from '../markdown.js';
-import { ImageDeliveryProvider } from '../image-delivery.js';
+import { ImageDeliveryProvider, ImageMessageProvider } from '../image-delivery.js';
 import type { TurnViewModel } from '../materialize.js';
 
 const originalGlobals = {
@@ -104,7 +104,9 @@ test('the complete Markdown entry resolves original signed and hashed destinatio
             assert.ok(sources.includes(request.source));
             return { status: 'ready', artifactId: `saved-${sources.indexOf(request.source)}` };
           }}>
-            <Markdown text={sources.map(source => `![Screenshot](${source})`).join('\n\n') + '\n\nAuthorization: Bearer prose-secret'} imageIdentity={{ turnId: 'turn-1', messageId: 'message-1' }} />
+            <ImageMessageProvider identity={{ turnId: 'turn-1', messageId: 'message-1' }}>
+              <Markdown text={sources.map(source => `![Screenshot](${source})`).join('\n\n') + '\n\nAuthorization: Bearer prose-secret'} />
+            </ImageMessageProvider>
           </ImageDeliveryProvider>
         </SessionAttachmentProvider>
       </LocaleProvider>,
diff --git a/packages/ui/src/__tests__/markdown-body.test.ts b/packages/ui/src/__tests__/markdown-body.test.ts
index 60082e7917..c8c9bc88b1 100644
--- a/packages/ui/src/__tests__/markdown-body.test.ts
+++ b/packages/ui/src/__tests__/markdown-body.test.ts
@@ -37,6 +37,21 @@ import {
   MAX_MERMAID_SOURCE_LENGTH,
 } from '../mermaid-diagram.js';
 
+it('image links use canonical destinations for titles, angle brackets and escaped parentheses', () => {
+  for (const [text, destination] of [
+    ['![Title](https://example.com/image.png "Screenshot title")', 'https://example.com/image.png'],
+    ['![Angle](<https://example.com/image.png>)', 'https://example.com/image.png'],
+    [String.raw`![Escaped](https://example.com/a\(1\).png)`, 'https://example.com/a(1).png'],
+  ]) {
+    const markup = renderToStaticMarkup(createElement(LocaleProvider, {
+      locale: 'en',
+      children: createElement(MarkdownBody, { text, imageDisplay: 'link' }),
+    }));
+    assert.ok(markup.includes(`href="${destination}"`), markup);
+    assert.doesNotMatch(markup, /<img\b|maka-markdown-image-resource|unsafe-scheme/);
+  }
+});
+
 it('keeps raw HTML inert instead of expanding the Markdown trust surface', () => {
   const markup = renderToStaticMarkup(createElement(MarkdownBody, {
     text: '<details open><summary>Click</summary>payload</details>',
diff --git a/packages/ui/src/attachment-image.tsx b/packages/ui/src/attachment-image.tsx
index 66511959f6..460966dbca 100644
--- a/packages/ui/src/attachment-image.tsx
+++ b/packages/ui/src/attachment-image.tsx
@@ -26,14 +26,11 @@ import {
   useState,
   type ReactNode,
 } from 'react';
-import type { ArtifactBinaryReadResult } from '@maka/core/artifacts';
+import type { ReadAttachmentBytes } from '@maka/core/image-delivery';
 import { decideImageReadOutcome } from './artifact-preview-registry.js';
 
 /** Host capability for reading bytes from the Runtime Host attachment authority. */
-export type ReadAttachmentBytes = (
-  sessionId: string,
-  artifactId: string,
-) => Promise<ArtifactBinaryReadResult>;
+export type { ReadAttachmentBytes } from '@maka/core/image-delivery';
 
 type SessionAttachmentContextValue = {
   sessionId: string;
diff --git a/packages/ui/src/chat-turn.tsx b/packages/ui/src/chat-turn.tsx
index 67efa6b43c..537326da1f 100644
--- a/packages/ui/src/chat-turn.tsx
+++ b/packages/ui/src/chat-turn.tsx
@@ -24,7 +24,8 @@ import { TranscriptDisclosure } from './transcript-disclosure.js';
 import { Markdown } from './markdown.js';
 import { formatTurnDuration } from './chat-display-helpers.js';
 import { formatAbsoluteTimestamp } from '@maka/core/relative-time';
-import { isTimeDrivenMotionEnabled } from './streaming-presentation.js';
+import { isTimeDrivenMotionEnabled, isProgressiveStreamingEnabled } from './streaming-presentation.js';
+import { ImageMessageProvider } from './image-delivery.js';
 import { computerRunningLabel } from './tool-activity/computer-action-label.js';
 import {
   Badge,
@@ -1363,24 +1364,25 @@ const AssistantAnswerBubble = memo(function AssistantAnswerBubble(props: Assista
           : 'maka-chat-message-bubble maka-chat-message-bubble-assistant maka-bubble-streaming'
       }
     >
-      <Markdown
-        text={props.text}
-        imageIdentity={props.imageIdentity}
-        imageDisplay={props.imageDisplay}
-        streaming={props.phase === 'streaming'}
-        settledText={settledText}
-        // Names the surface, and not exclusively: the desktop Artifact
-        // Preview asks for compact too and takes the same rules, so retuning
-        // them here is retuning them there. What this prop does NOT do is set
-        // this turn's block spacing. Every top-level gap in a transcript turn
-        // comes from the rhythm table in styles.css, which keys on the
-        // `data-density="compact"` this prop reflects and overrides Astryx's
-        // own margins outright. So `compact` still buys the transcript
-        // heading scale and the tighter rhythm inside a list item or a quote,
-        // and reading it as "paragraphs are squeezed here" is the wrong
-        // file — retune `--md-gap-block` instead.
-        density="compact"
-      />
+      <ImageMessageProvider identity={props.imageIdentity} streaming={isProgressiveStreamingEnabled(props.phase === 'streaming')}>
+        <Markdown
+          text={props.text}
+          imageDisplay={props.imageDisplay}
+          streaming={props.phase === 'streaming'}
+          settledText={settledText}
+          // Names the surface, and not exclusively: the desktop Artifact
+          // Preview asks for compact too and takes the same rules, so retuning
+          // them here is retuning them there. What this prop does NOT do is set
+          // this turn's block spacing. Every top-level gap in a transcript turn
+          // comes from the rhythm table in styles.css, which keys on the
+          // `data-density="compact"` this prop reflects and overrides Astryx's
+          // own margins outright. So `compact` still buys the transcript
+          // heading scale and the tighter rhythm inside a list item or a quote,
+          // and reading it as "paragraphs are squeezed here" is the wrong
+          // file — retune `--md-gap-block` instead.
+          density="compact"
+        />
+      </ImageMessageProvider>
       {truncated && (
         <Tooltip content={copy.outputTruncatedTitle}>
           {/* Colour-name archive, not the semantic one: Astryx paints
diff --git a/packages/ui/src/chat-view.tsx b/packages/ui/src/chat-view.tsx
index 12013363b7..3d235bf98a 100644
--- a/packages/ui/src/chat-view.tsx
+++ b/packages/ui/src/chat-view.tsx
@@ -298,7 +298,7 @@ export function ChatView(props: {
    * host-agnostic with no direct host-global access.
    */
   onReadAttachmentBytes?: ReadAttachmentBytes;
-  onResolveImageDelivery?: import('./image-delivery.js').ResolveImageDelivery;
+  onResolveImageDelivery?: import('@maka/core/image-delivery').ResolveImageDelivery;
   /**
    * Open a linked subagent child session in the main chat column (option A).
    * Threaded into linked subagent rows inside ToolTrow.
diff --git a/packages/ui/src/image-delivery.tsx b/packages/ui/src/image-delivery.tsx
index b2fd1c0a76..388677b658 100644
--- a/packages/ui/src/image-delivery.tsx
+++ b/packages/ui/src/image-delivery.tsx
@@ -18,10 +18,21 @@
  */
 
 import { createContext, useCallback, useContext, useEffect, useMemo, useState, type ReactNode } from 'react';
-import type { ImageDeliveryRequest, ImageDeliveryResult } from '@maka/core/image-delivery';
+import type { ImageDeliveryRequest, ImageDeliveryResult, ResolveImageDelivery } from '@maka/core/image-delivery';
 import { isRemoteImageSource } from '@maka/core/image-delivery';
-export type ResolveImageDelivery = (sessionId: string, request: ImageDeliveryRequest) => Promise<ImageDeliveryResult>;
-export const ImageMessageScope = createContext<{ turnId: string; messageId: string; streaming?: boolean } | undefined>(undefined);
+export type { ResolveImageDelivery } from '@maka/core/image-delivery';
+const ImageMessageScope = createContext<{ turnId: string; messageId: string; streaming?: boolean } | undefined>(undefined);
+/** Installed by assistant messages, outside the generic Markdown renderer. */
+export function ImageMessageProvider(props: {
+  identity?: { turnId: string; messageId: string };
+  streaming?: boolean;
+  children: ReactNode;
+}) {
+  const value = useMemo(() => props.identity
+    ? { turnId: props.identity.turnId, messageId: props.identity.messageId, streaming: props.streaming }
+    : undefined, [props.identity?.turnId, props.identity?.messageId, props.streaming]);
+  return <ImageMessageScope.Provider value={value}>{props.children}</ImageMessageScope.Provider>;
+}
 const DeliveryContext = createContext<{ resolve(request: ImageDeliveryRequest): Promise<ImageDeliveryResult> } | undefined>(undefined);
 export function ImageDeliveryProvider(props: { sessionId: string; resolve?: ResolveImageDelivery; children: ReactNode }) {
   const value = useMemo(() => {
diff --git a/packages/ui/src/markdown-body.tsx b/packages/ui/src/markdown-body.tsx
index 553c3369f4..c0670d2dbc 100644
--- a/packages/ui/src/markdown-body.tsx
+++ b/packages/ui/src/markdown-body.tsx
@@ -29,13 +29,9 @@
  * product-specific trust boundaries around that renderer.
  */
 
-import { MarkdownImage, MarkdownImageSourceProvider, MARKDOWN_IMAGE_PLUGINS } from './markdown-image.js';
-import { ImageMessageScope } from './image-delivery.js';
-import { createMarkdownPlugin } from '@astryxdesign/core/Markdown/plugins';
-import type { MarkdownAstNode, MarkdownAstRoot } from '@astryxdesign/core/Markdown';
+import { MarkdownImage, createMarkdownImagePlugins } from './markdown-image.js';
 import { useCallback, useContext, useMemo, useRef, type ReactNode } from 'react';
 import { redactMarkdownImages } from './markdown-image-redaction.js';
-import { redactSecrets } from './redact.js';
 import {
   Markdown as AstryxMarkdown,
   type MarkdownComponents,
@@ -150,7 +146,6 @@ export function MarkdownBody(props: {
   text: string;
   /** The lazy entry redacts its fallback; the body also preserves image identities. */
   redact?: boolean;
-  imageIdentity?: { turnId: string; messageId: string };
   imageDisplay?: 'image' | 'link';
   streaming?: boolean;
   settledText?: string;
@@ -165,26 +160,8 @@ export function MarkdownBody(props: {
     ? redactMarkdownImages(props.text, props.settledText)
     : { text: props.text, settledText: props.settledText, sources: undefined },
   [props.redact, props.text, props.settledText]);
-  const plugins = useMemo(() => props.imageDisplay === 'link' ? [createMarkdownPlugin({
-    name: 'maka-image-links', apiVersion: 1,
-    transform(document) {
-      // Use parsed nodes so references and code examples retain their semantics.
-      // No image component mounts in this mode, so display cannot load bytes.
-      const rewrite = (node: MarkdownAstNode, insideLink = false, phrasing = false): MarkdownAstNode => {
-        if (node.type === 'image') {
-          const source = presentation.sources?.get(node.url) ?? node.url;
-          const text = { type: 'text' as const, value: node.alt || redactSecrets(source) };
-          const link = insideLink || source !== redactSecrets(source) ? text
-            : { type: 'link' as const, url: source, children: [text] };
-          return phrasing ? link : { type: 'paragraph', children: [link] };
-        }
-        if (!('children' in node)) return node;
-        const childPhrasing = ['paragraph', 'heading', 'tableCell', 'link', 'strong', 'emphasis', 'delete'].includes(node.type);
-        return { ...node, children: node.children.map(child => rewrite(child, insideLink || node.type === 'link', childPhrasing)) } as MarkdownAstNode;
-      };
-      return rewrite(document) as MarkdownAstRoot;
-    },
-  })] : MARKDOWN_IMAGE_PLUGINS, [props.imageDisplay, presentation.sources]);
+  const plugins = useMemo(() => createMarkdownImagePlugins(props.imageDisplay, presentation.sources),
+    [props.imageDisplay, presentation.sources]);
   const budgetedText = props.streaming ? presentation.text : applyMermaidRenderBudget(presentation.text);
   const density = props.density ?? 'default';
   const components = props.streaming
@@ -194,51 +171,47 @@ export function MarkdownBody(props: {
     : MARKDOWN_COMPONENTS[density];
 
   return (
-    <MarkdownImageSourceProvider text={budgetedText} sources={presentation.sources}>
-      <ImageMessageScope.Provider value={props.imageIdentity ? { ...props.imageIdentity, streaming: props.streaming } : undefined}>
-        <div
-          data-maka-contract="markdown"
-          data-maka-script={hasHanProse(props.text) ? 'han' : undefined}
-          // Migration-only identity wrapper. `display: contents` gives the
-          // contract harness a stable declared subtree without adding a layout
-          // box or interfering with Astryx's document root.
-          style={{ display: 'contents' }}
-        >
-          <AstryxMarkdown
-            autolink="gfm"
-            // Markdown holds no reading measure; the container it lands in does.
-            //
-            // Astryx caps prose at 680px by default but renders a supplied
-            // `components.code` bare — no spacing, no width, no alignment. Maka
-            // always supplies one, so any container that leans on the default gets
-            // prose at 680 and code blocks at whatever the container is: two right
-            // edges, which is the defect this whole change exists to remove. One
-            // authority per column, and it is the container.
-            contentWidth="100%"
-            // Chosen by the caller, and defaulting to document rhythm.
-            //
-            // The transcript passes `compact`: Astryx's default heading spacing
-            // assumes a page with a handful of sections, while an agent turn
-            // emits headings every few lines, so the default margins push each
-            // one into its own visual slab. That is the same argument that
-            // flattens transcript heading SIZES in styles/chat-message.css — and
-            // that rule is scoped to `.maka-turn` precisely because the other
-            // caller, the Daily Review panel, renders a report, which is a
-            // document. Hardcoding `compact` here contradicted that scoping: the
-            // review kept full heading sizes but got transcript block spacing,
-            // the one combination neither half of the argument asks for.
-            density={density}
-            components={components}
-            plugins={plugins}
-            isStreaming={props.streaming}
-            settledText={presentation.settledText}
-            transformSource={transformMathSource}
-          >
-            {budgetedText}
-          </AstryxMarkdown>
-        </div>
-      </ImageMessageScope.Provider>
-    </MarkdownImageSourceProvider>
+    <div
+      data-maka-contract="markdown"
+      data-maka-script={hasHanProse(props.text) ? 'han' : undefined}
+      // Migration-only identity wrapper. `display: contents` gives the
+      // contract harness a stable declared subtree without adding a layout
+      // box or interfering with Astryx's document root.
+      style={{ display: 'contents' }}
+    >
+      <AstryxMarkdown
+        autolink="gfm"
+        // Markdown holds no reading measure; the container it lands in does.
+        //
+        // Astryx caps prose at 680px by default but renders a supplied
+        // `components.code` bare — no spacing, no width, no alignment. Maka
+        // always supplies one, so any container that leans on the default gets
+        // prose at 680 and code blocks at whatever the container is: two right
+        // edges, which is the defect this whole change exists to remove. One
+        // authority per column, and it is the container.
+        contentWidth="100%"
+        // Chosen by the caller, and defaulting to document rhythm.
+        //
+        // The transcript passes `compact`: Astryx's default heading spacing
+        // assumes a page with a handful of sections, while an agent turn
+        // emits headings every few lines, so the default margins push each
+        // one into its own visual slab. That is the same argument that
+        // flattens transcript heading SIZES in styles/chat-message.css — and
+        // that rule is scoped to `.maka-turn` precisely because the other
+        // caller, the Daily Review panel, renders a report, which is a
+        // document. Hardcoding `compact` here contradicted that scoping: the
+        // review kept full heading sizes but got transcript block spacing,
+        // the one combination neither half of the argument asks for.
+        density={density}
+        components={components}
+        plugins={plugins}
+        isStreaming={props.streaming}
+        settledText={presentation.settledText}
+        transformSource={transformMathSource}
+      >
+        {budgetedText}
+      </AstryxMarkdown>
+    </div>
   );
 }
 
diff --git a/packages/ui/src/markdown-image.tsx b/packages/ui/src/markdown-image.tsx
index fdba5971dd..bee94ba165 100644
--- a/packages/ui/src/markdown-image.tsx
+++ b/packages/ui/src/markdown-image.tsx
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-import { createContext, useContext, useEffect, useMemo, useRef, useState, type ReactNode } from 'react';
+import { useEffect, useRef, useState } from 'react';
 import { Button, IconButton, Spinner, Tooltip, useLightbox } from '@astryxdesign/core';
 import { createMarkdownPlugin, type MarkdownExtensionNode } from '@astryxdesign/core/Markdown/plugins';
 import type { MarkdownAstNode, MarkdownAstRoot } from '@astryxdesign/core/Markdown';
@@ -29,36 +29,49 @@ import { useUiLocale } from './locale-context.js';
 import { createMarkdownImageSourceResolver } from './markdown-image-source.js';
 import { redactSecrets } from './redact.js';
 
-const ImageSourceContext = createContext<(source: string) => { source: string; redacted: boolean }>(
-  (source) => ({ source, redacted: false }),
-);
-
-type PlacedImage = MarkdownExtensionNode<'maka-images', 'image', { src: string; alt: string; inline: boolean }>;
+type PlacedImage = MarkdownExtensionNode<'maka-images', 'image', { src: string; alt: string; inline: boolean; redacted: boolean }>;
 // Placement comes from Markdown structure before bytes arrive. Never change a
 // message's geometry in response to network/decode timing or archive resolution.
-export const MARKDOWN_IMAGE_PLUGINS = [createMarkdownPlugin<'maka-images', PlacedImage>({
-  name: 'maka-images', apiVersion: 1,
-  transform(document, context) {
-    if (!context.source.includes('![')) return document;
-    const rewrite = (node: MarkdownAstNode, inline = false, phrasing = false): MarkdownAstNode => {
-      if (node.type === 'image') return {
-        type: 'extension', plugin: 'maka-images', name: 'image',
-        display: phrasing ? 'inline' : 'block',
-        data: { src: node.url, alt: node.alt, inline },
-      } satisfies PlacedImage;
-      if (!('children' in node)) return node;
-      const childInline = node.type === 'paragraph' ? !isSingleImage(node.children)
-        : node.type === 'heading' || node.type === 'tableCell' ? true : inline;
-      const childPhrasing = ['paragraph', 'heading', 'tableCell', 'link', 'strong', 'emphasis', 'delete'].includes(node.type);
-      return { ...node, children: node.children.map(child => rewrite(child, childInline, childPhrasing)) } as MarkdownAstNode;
-    };
-    return rewrite(document) as MarkdownAstRoot<MarkdownExtensionNode>;
-  },
-  renderers: { image: {
-    render: ({ node }) => <MarkdownImage {...node.data} />,
-    toText: node => node.data.alt,
-  } },
-})];
+export function createMarkdownImagePlugins(
+  display: 'image' | 'link' = 'image',
+  sources?: ReadonlyMap<string, string>,
+) {
+  return [createMarkdownPlugin<'maka-images', PlacedImage>({
+    name: 'maka-images', apiVersion: 1,
+    transform(document, context) {
+      if (!context.source.includes('![')) return document;
+      const canonical = createMarkdownImageSourceResolver(context.source);
+      const rewrite = (node: MarkdownAstNode, inline = false, phrasing = false, insideLink = false): MarkdownAstNode => {
+        if (node.type === 'image') {
+          const destination = canonical(node.url);
+          const source = sources?.get(destination) ?? destination;
+          const redacted = source !== redactSecrets(source);
+          if (display === 'link') {
+            const text = { type: 'text' as const, value: node.alt || redactSecrets(source) };
+            const link = insideLink || redacted ? text
+              : { type: 'link' as const, url: source, children: [text] };
+            return phrasing ? link : { type: 'paragraph', children: [link] };
+          }
+          return {
+            type: 'extension', plugin: 'maka-images', name: 'image',
+            display: phrasing ? 'inline' : 'block',
+            data: { src: source, alt: node.alt, inline, redacted: sources?.has(destination) === true && redacted },
+          } satisfies PlacedImage;
+        }
+        if (!('children' in node)) return node;
+        const childInline = node.type === 'paragraph' ? !isSingleImage(node.children)
+          : node.type === 'heading' || node.type === 'tableCell' ? true : inline;
+        const childPhrasing = ['paragraph', 'heading', 'tableCell', 'link', 'strong', 'emphasis', 'delete'].includes(node.type);
+        return { ...node, children: node.children.map(child => rewrite(child, childInline, childPhrasing, insideLink || node.type === 'link')) } as MarkdownAstNode;
+      };
+      return rewrite(document) as MarkdownAstRoot<MarkdownExtensionNode>;
+    },
+    renderers: { image: {
+      render: ({ node }) => <MarkdownImage {...node.data} />,
+      toText: node => node.data.alt,
+    } },
+  })];
+}
 
 function isSingleImage(nodes: readonly MarkdownAstNode[]): boolean {
   const meaningful = nodes.filter(node => node.type !== 'text' || node.value.trim());
@@ -67,22 +80,9 @@ function isSingleImage(nodes: readonly MarkdownAstNode[]): boolean {
   return node.type === 'image' || (['link', 'strong', 'emphasis', 'delete'].includes(node.type)
     && 'children' in node && isSingleImage(node.children));
 }
-export function MarkdownImageSourceProvider(props: { text: string; sources?: ReadonlyMap<string, string>; children: ReactNode }) {
-  const resolve = useMemo(() => {
-    const canonical = createMarkdownImageSourceResolver(props.text);
-    return (source: string) => {
-      const resolved = canonical(source);
-      const original = props.sources?.get(resolved) ?? resolved;
-      return { source: original, redacted: props.sources?.has(resolved) === true && original !== redactSecrets(original) };
-    };
-  }, [props.text, props.sources]);
-  return <ImageSourceContext.Provider value={resolve}>{props.children}</ImageSourceContext.Provider>;
-}
-
 /** Presentation only: Host resolves local addresses and archives; UI receives artifact identities. */
-export function MarkdownImage(props: { src: string; alt: string; inline?: boolean }) {
-  const { source, redacted } = useContext(ImageSourceContext)(props.src);
-  return <ImageResource key={source} src={source} redacted={redacted} alt={props.alt} inline={props.inline} />;
+export function MarkdownImage(props: { src: string; alt: string; inline?: boolean; redacted?: boolean }) {
+  return <ImageResource key={props.src} {...props} redacted={props.redacted === true} />;
 }
 function ImageResource(props: { src: string; redacted: boolean; alt: string; inline?: boolean }) {
   const copy = getSharedUiCopy(useUiLocale()).markdown;
diff --git a/packages/ui/src/markdown.tsx b/packages/ui/src/markdown.tsx
index 2205890951..79ad4f977d 100644
--- a/packages/ui/src/markdown.tsx
+++ b/packages/ui/src/markdown.tsx
@@ -57,7 +57,6 @@ const MarkdownBody = lazy(() => import('./markdown-body.js').then((m) => ({ defa
 
 export function Markdown(props: {
   text: string;
-  imageIdentity?: { turnId: string; messageId: string };
   imageDisplay?: 'image' | 'link';
   streaming?: boolean;
   settledText?: string;
@@ -80,7 +79,6 @@ export function Markdown(props: {
       <MarkdownBody
         text={props.text}
         redact
-        imageIdentity={props.imageIdentity}
         imageDisplay={props.imageDisplay}
         streaming={streaming}
         settledText={props.settledText}

From 431e49316a7e3fd77db701cd8fc9afc557cec659 Mon Sep 17 00:00:00 2001
From: Sun-GLiang <81428141+Sun-GLiang@users.noreply.github.com>
Date: Sat, 10 Oct 2026 17:16:25 +0800
Subject: [PATCH 30/35] fix(ui): size markdown image previews to natural
 dimensions

---
 .../scripts/markdown-images.browser.test.mjs  | 79 +++++++++++++++----
 packages/ui/src/markdown-image.tsx            | 11 ++-
 packages/ui/src/styles.css                    | 52 ++++++------
 3 files changed, 90 insertions(+), 52 deletions(-)

diff --git a/packages/ui/scripts/markdown-images.browser.test.mjs b/packages/ui/scripts/markdown-images.browser.test.mjs
index 61a45be918..a23780ce4b 100644
--- a/packages/ui/scripts/markdown-images.browser.test.mjs
+++ b/packages/ui/scripts/markdown-images.browser.test.mjs
@@ -33,6 +33,10 @@ import { chromium } from '@playwright/test';
 const root = fileURLToPath(new URL('../../../', import.meta.url));
 const png = Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8DwHwAFBQIAX8jx0gAAAABJRU5ErkJggg==', 'base64');
 const badge = Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAFAAAAAUCAYAAAAa2LrXAAAATklEQVR4nO3OsQ0AIAzAsJ7O5/QIhsgSg3fPnLnfgzygywO6PKDLA7o8oMsDujygywO6PKDLA7o8oMsDujygywO6PKDLA7o8oMsDujyAW5KWWkgoVkkSAAAAAElFTkSuQmCC', 'base64');
+const dimensions = [
+  ['small', 80, 20], ['square', 1000, 1000], ['landscape', 1600, 900],
+  ['portrait', 900, 1600], ['panorama', 2000, 100], ['tall', 100, 2000], ['pixel', 1, 1],
+];
 let appServer, imageServer, browser, appUrl, imageUrl;
 let requests = [], failedOnce = false;
 let releaseImage;
@@ -41,8 +45,7 @@ const delayedImage = new Promise(resolve => { releaseImage = resolve; });
 const delayedAttachment = new Promise(resolve => { releaseAttachment = resolve; });
 
 // Keep the screenshot's original dimensions without committing evidence images.
-function screenshotFixture() {
-  const width = 900, height = 730;
+function screenshotFixture(width = 900, height = 730) {
   const header = Buffer.alloc(13);
   header.writeUInt32BE(width, 0); header.writeUInt32BE(height, 4);
   header[8] = 8; header[9] = 2; // 8-bit RGB.
@@ -67,8 +70,12 @@ function screenshotFixture() {
 
 before(async () => {
   const screenshot = screenshotFixture();
+  const sizedImages = new Map(dimensions.map(([name, width, height]) => [`/${name}.png`, screenshotFixture(width, height)]));
   imageServer = createServer((req, res) => {
     requests.push({ path: req.url, referer: req.headers.referer });
+    if (sizedImages.has(req.url)) {
+      res.setHeader('Content-Type', 'image/png'); res.end(sizedImages.get(req.url)); return;
+    }
     if (req.url === '/delayed.png') {
       void delayedImage.then(() => { res.setHeader('Content-Type', 'image/png'); res.end(screenshot); });
       return;
@@ -90,6 +97,7 @@ before(async () => {
   await new Promise(resolve => imageServer.listen(0, '127.0.0.1', resolve));
   imageUrl = `http://127.0.0.1:${imageServer.address().port}`;
   const destinations = {
+    ...Object.fromEntries(dimensions.map(([name]) => [`size-${name}`, `![Screenshot](${imageUrl}/${name}.png)`])),
     'links-formats': [
       `![Screenshot](${imageUrl}/image.png)`,
       `![Title](${imageUrl}/title.png "Screenshot title")`,
@@ -110,8 +118,8 @@ before(async () => {
     'badge-list': `- Build ![Badge](${imageUrl}/badge.png) passing.`,
     'badge-table': `| Build | Result |\n| --- | --- |\n| ![Badge](${imageUrl}/badge.png) | passing |`,
     'badge-strip': `![Badge](${imageUrl}/badge.png) ![Badge](${imageUrl}/badge.png)`,
-    'layout-main': `## Image delivery\n\nBuild ![Badge](${imageUrl}/badge.png) passing.\n\n![Screenshot](${imageUrl}/screenshot.png)\n\nFollowing paragraph stays in place.`,
-    'layout-side': `## Image delivery\n\nBuild ![Badge](${imageUrl}/badge.png) passing.\n\n![Screenshot](${imageUrl}/screenshot.png)\n\nFollowing paragraph stays in place.`,
+    'layout-main': `## Image delivery\n\nBuild ![Badge](${imageUrl}/badge.png) passing.\n\n![Screenshot](${imageUrl}/screenshot.png)\n\nFollowing paragraph.`,
+    'layout-side': `## Image delivery\n\nBuild ![Badge](${imageUrl}/badge.png) passing.\n\n![Screenshot](${imageUrl}/screenshot.png)\n\nFollowing paragraph.`,
     'screenshot-saved': '![Screenshot](/tmp/screenshot.png)',
     'angle-saved': '![Screenshot](</tmp/my image.png>)',
     'title-saved': `![Screenshot](${imageUrl}/image.png "Screenshot title")`,
@@ -623,7 +631,7 @@ for (const scenario of ['angle-saved', 'title-saved', 'escaped-saved', 'referenc
 }
 
 for (const scenario of ['geometry-remote', 'geometry-saved']) {
-  test(`${scenario}: loading and ready images preserve the position of subsequent content`, async () => {
+  test(`${scenario}: a compact placeholder expands to the decoded image's natural proportions`, async () => {
     const page = await pageFor(scenario);
     try {
       await page.getByText('Loading image…', { exact: true }).waitFor();
@@ -632,7 +640,10 @@ for (const scenario of ['geometry-remote', 'geometry-saved']) {
       await page.waitForFunction(() => [...document.images].some(image => image.naturalWidth > 1));
       await page.getByText('Loading image…', { exact: true }).waitFor({ state: 'hidden' });
       const after = await page.getByText('Following paragraph', { exact: true }).boundingBox();
-      assert.equal(after.y, before.y);
+      assert.ok(after.y > before.y);
+      const block = await page.locator('.maka-markdown-image-block').boundingBox();
+      const image = await page.locator('.maka-markdown-image-preview img').boundingBox();
+      assert.ok(Math.abs(block.width - image.width) < 1 && Math.abs(block.height - image.height) < 1);
     } finally {
       if (scenario === 'geometry-remote') releaseImage(); else releaseAttachment();
       await page.close();
@@ -640,14 +651,14 @@ for (const scenario of ['geometry-remote', 'geometry-saved']) {
   });
 }
 
-test('image frames fit narrow viewports without distorting screenshots or limiting the enlarged preview', async () => {
+test('natural image containers fit narrow viewports without distorting screenshots or limiting the enlarged preview', async () => {
   const page = await pageFor('screenshot');
   try {
     await page.waitForFunction(() => [...document.images].some(image => image.naturalWidth > 1));
     for (const width of [720, 360]) {
       await page.setViewportSize({ width, height: 600 });
       const geometry = await page.locator('.maka-markdown-image-preview img').evaluate(image => {
-        const frame = image.closest('.maka-markdown-image-frame').getBoundingClientRect();
+        const frame = image.closest('.maka-markdown-image-block').getBoundingClientRect();
         const box = image.getBoundingClientRect();
         return { frame: { x: frame.x, y: frame.y, right: frame.right, bottom: frame.bottom },
           box: { x: box.x, y: box.y, right: box.right, bottom: box.bottom, width: box.width, height: box.height },
@@ -662,12 +673,42 @@ test('image frames fit narrow viewports without distorting screenshots or limiti
     await page.waitForFunction(() => document.images.length > 1);
     assert.equal(await page.locator('.maka-markdown-image-preview img').count(), 1);
     const dialog = await page.getByRole('dialog').boundingBox();
-    const frame = await page.locator('.maka-markdown-image-frame').boundingBox();
+    const frame = await page.locator('.maka-markdown-image-block').boundingBox();
     assert.ok(dialog.height > frame.height);
     assert.equal(await page.getByRole('dialog').locator('img').getAttribute('src'), await page.locator('.maka-markdown-image-preview img').getAttribute('src'));
   } finally { await page.close(); }
 });
 
+for (const [name, naturalWidth, naturalHeight] of dimensions) {
+  test(`${name}: body images shrink proportionally without upscaling or empty frames`, async () => {
+    const page = await pageFor(`size-${name}`);
+    try {
+      await page.waitForFunction(() => [...document.images].some(image => image.complete && image.naturalWidth > 0));
+      for (const [width, height] of [[1280, 900], [320, 600]]) {
+        await page.setViewportSize({ width, height });
+        const geometry = await page.locator('.maka-markdown-image-preview img').evaluate(image => {
+          const block = image.closest('.maka-markdown-image-block');
+          const column = block.parentElement;
+          const style = getComputedStyle(column);
+          const availableWidth = column.clientWidth - parseFloat(style.paddingLeft) - parseFloat(style.paddingRight);
+          const box = image.getBoundingClientRect();
+          const container = block.getBoundingClientRect();
+          return { width: box.width, height: box.height, right: box.right, availableWidth,
+            containerWidth: container.width, containerHeight: container.height };
+        });
+        const scale = Math.min(1, 640 / naturalWidth, geometry.availableWidth / naturalWidth,
+          Math.min(480, height * 0.6) / naturalHeight);
+        assert.ok(Math.abs(geometry.width - naturalWidth * scale) < 1, JSON.stringify(geometry));
+        assert.ok(Math.abs(geometry.height - naturalHeight * scale) < 1, JSON.stringify(geometry));
+        assert.ok(Math.abs(geometry.containerWidth - geometry.width) < 1, JSON.stringify(geometry));
+        assert.ok(Math.abs(geometry.containerHeight - geometry.height) < 1, JSON.stringify(geometry));
+        assert.ok(geometry.right <= width);
+        assert.equal(await page.evaluate(() => document.documentElement.scrollWidth > innerWidth), false);
+      }
+    } finally { await page.close(); }
+  });
+}
+
 for (const scenario of ['badge-remote', 'badge-saved', 'badge-saving']) {
   test(`${scenario}: a badge keeps its intrinsic size and surrounding text on one line`, async () => {
     requests = [];
@@ -737,7 +778,7 @@ for (const scenario of ['badge-list', 'badge-table', 'badge-strip']) {
     try {
       await page.goto(`${appUrl}/?case=${scenario}`, { waitUntil: 'domcontentloaded' });
       await page.locator('.maka-markdown-image-inline').first().waitFor();
-      assert.equal(await page.locator('.maka-markdown-image-frame').count(), 0);
+      assert.equal(await page.locator('.maka-markdown-image-block').count(), 0);
       const before = await page.locator('.maka-markdown-image-resource').first().boundingBox();
       assert.ok(before.width <= 120 && before.height <= 32);
       release();
@@ -751,7 +792,7 @@ for (const [scenario, width, height] of [
   ['layout-main', 1280, 900], ['layout-main', 480, 700],
   ['layout-side', 720, 700], ['layout-side', 320, 600],
 ]) {
-  test(`${scenario} ${width}x${height}: production chat columns preserve image geometry through loading`, async () => {
+  test(`${scenario} ${width}x${height}: production chat columns fit natural image dimensions`, async () => {
     const page = await browser.newPage({ viewport: { width, height } });
     page.setDefaultTimeout(5000);
     let release;
@@ -764,12 +805,11 @@ for (const [scenario, width, height] of [
     try {
       await page.goto(`${appUrl}/?case=${scenario}`, { waitUntil: 'domcontentloaded' });
       await page.waitForFunction(() => document.querySelectorAll('.maka-markdown-image-resource').length === 2);
-      await page.getByText('Following paragraph stays in place.').waitFor();
+      await page.getByText('Following paragraph.').waitFor();
       const before = await measure();
-      const followingBefore = await page.getByText('Following paragraph stays in place.').boundingBox();
       assert.equal(before.length, 2);
       assert.ok(before[0].width <= 120 && before[0].height <= 32);
-      assert.ok(before[1].width <= 800 && before[1].height <= Math.min(480, height * 0.6));
+      assert.ok(before[1].width <= 640 && before[1].height < 100);
       for (const box of before) assert.ok(box.x >= 0 && box.x + box.width <= width);
       const evidence = process.env.MAKA_IMAGE_LAYOUT_EVIDENCE_DIR;
       if (evidence) {
@@ -778,12 +818,17 @@ for (const [scenario, width, height] of [
       }
       release();
       await page.waitForFunction(() => document.images.length === 2 && [...document.images].every(image => image.complete && image.naturalWidth > 0));
-      assert.deepEqual(await measure(), before);
-      assert.deepEqual(await page.getByText('Following paragraph stays in place.').boundingBox(), followingBefore);
+      const ready = await measure();
+      assert.deepEqual(ready[0], before[0]);
+      const image = await page.locator('.maka-markdown-image-block img').boundingBox();
+      assert.ok(ready[1].width <= 640 && ready[1].height <= Math.min(480, height * 0.6));
+      assert.ok(Math.abs(ready[1].width - image.width) < 1 && Math.abs(ready[1].height - image.height) < 1);
+      assert.ok(Math.abs(image.width / image.height - 900 / 730) < 0.01);
+      assert.ok((await page.getByText('Following paragraph.').boundingBox()).y >= image.y + image.height);
       assert.equal(await page.evaluate(() => document.documentElement.scrollWidth > innerWidth), false);
       if (evidence) {
         await page.screenshot({ path: join(evidence, `${scenario}-${width}-ready.png`), fullPage: true });
-        console.log(JSON.stringify({ scenario, viewport: { width, height }, images: before, layoutShift: 0 }));
+        console.log(JSON.stringify({ scenario, viewport: { width, height }, loading: before, ready }));
       }
     } finally { release(); await page.close(); }
   });
diff --git a/packages/ui/src/markdown-image.tsx b/packages/ui/src/markdown-image.tsx
index bee94ba165..9d34b90f43 100644
--- a/packages/ui/src/markdown-image.tsx
+++ b/packages/ui/src/markdown-image.tsx
@@ -30,8 +30,8 @@ import { createMarkdownImageSourceResolver } from './markdown-image-source.js';
 import { redactSecrets } from './redact.js';
 
 type PlacedImage = MarkdownExtensionNode<'maka-images', 'image', { src: string; alt: string; inline: boolean; redacted: boolean }>;
-// Placement comes from Markdown structure before bytes arrive. Never change a
-// message's geometry in response to network/decode timing or archive resolution.
+// Markdown structure determines inline/block placement; decoded images supply
+// their natural dimensions within the presentation's CSS bounds.
 export function createMarkdownImagePlugins(
   display: 'image' | 'link' = 'image',
   sources?: ReadonlyMap<string, string>,
@@ -105,12 +105,11 @@ function ImageResource(props: { src: string; redacted: boolean; alt: string; inl
       redacted: copy.imageRemoteRedacted,
       unsupported: copy.imageUnsupported,
     }[state.reason] : undefined;
-  const hasFrame = props.inline || resource.framed;
   const actions = <span className="maka-markdown-image-actions">
     {resource.retry && <Button variant="ghost" size="sm" label={copy.imageRetry} onClick={resource.retry} />}
     {resource.openSource && <Link href={resource.openSource} isExternalLink type="inherit" hasUnderline>{copy.imageOpen}</Link>}
   </span>;
-  return <span ref={anchor} className={`maka-markdown-image-resource${hasFrame ? props.inline ? ' maka-markdown-image-inline' : ' maka-markdown-image-frame' : ''}`}
+  return <span ref={anchor} className={`maka-markdown-image-resource ${props.inline ? 'maka-markdown-image-inline' : 'maka-markdown-image-block'}`}
     data-maka-image-state={state.kind === 'failed' ? 'failed' : state.kind === 'ready' ? 'ready' : 'loading'}>
     {message && props.inline ? <Tooltip content={message}>
       <span className="maka-markdown-image-placeholder" role="status" aria-label={message}>
@@ -121,7 +120,7 @@ function ImageResource(props: { src: string; redacted: boolean; alt: string; inl
       </span>
     </Tooltip> : message ? <span className="maka-markdown-image-placeholder">
       {props.alt && <span className="maka-markdown-image-caption">{props.alt}</span>}
-      <span role="status">{hasFrame && state.kind === 'loading' && <Spinner size="sm" shade="subtle" aria-hidden="true" />} {message}</span>
+      <span role="status">{state.kind === 'loading' && <Spinner size="sm" shade="subtle" aria-hidden="true" />} {message}</span>
       {state.kind === 'failed' && actions}
     </span> : state.kind === 'ready' && <DisplayImage key={`${state.src}\0${resource.attempt}`} src={state.src} alt={props.alt} onError={resource.onDecodeError} />}
     {state.kind === 'unavailable' && resource.openSource && actions}
@@ -144,7 +143,7 @@ function DisplayImage(props: { src: string; alt: string; onError(): void }) {
   return <>
     <Button ref={trigger} variant="ghost" className="maka-markdown-image-preview maka-markdown-image-trigger"
         label={copy.imageExpand(props.alt)} aria-haspopup="dialog" isDisabled={!loaded}
-        style={{ width: '100%', height: '100%', padding: 0, background: 'transparent' }}
+        style={{ padding: 0, background: 'transparent' }}
         onClick={event => { event.preventDefault(); event.stopPropagation(); if (loaded) lightbox.open(); }}>
       {content}
     </Button>
diff --git a/packages/ui/src/styles.css b/packages/ui/src/styles.css
index 1d5debe250..3b06dfd72f 100644
--- a/packages/ui/src/styles.css
+++ b/packages/ui/src/styles.css
@@ -614,15 +614,15 @@
   color: var(--muted-foreground);
 }
 
-/* Astryx hands custom images no inline/block placement or spacing wrapper.
-   Session artifacts are content previews rather than sentence badges, so they
-   own a bounded block presentation; compact transcript rhythm resets the
-   top-level margin above through the shared adjacency rules. */
+/* Preserve natural dimensions and aspect ratio; only shrink images that exceed
+   the message column or preview bounds. The lightbox owns enlarged viewing. */
 .maka-markdown-attachment-image {
   display: block;
   max-width: 100%;
+  max-height: min(480px, 60vh);
+  width: auto;
   height: auto;
-  margin-block: var(--space-3) var(--space-4);
+  margin: 0;
 }
 
 .maka-markdown-image-placeholder {
@@ -644,14 +644,13 @@
   gap: var(--space-3);
 }
 .maka-markdown-image-resource { display: inline-block; position: relative; max-width: 100%; }
-/* The conversation owns the width (up to the 800px reading measure). A preview
-   fits that column, but cannot consume more than 60% of a short viewport.
-   Markdown placement, not decoded dimensions, fixes the loading/ready box. */
-.maka-markdown-image-frame {
-  display: block;
-  width: 100%;
-  aspect-ratio: 16 / 10;
-  max-height: min(480px, 60vh);
+/* Hug the content instead of reserving a fixed aspect-ratio frame. */
+.maka-markdown-image-block {
+  display: flex;
+  flex-direction: column;
+  align-items: flex-start;
+  width: fit-content;
+  max-width: min(100%, 640px);
 }
 /* Six text ems leave room for a typical badge; one inherited line keeps it in
    the prose rhythm. Scale down wider images and use the lightbox for detail. */
@@ -660,7 +659,6 @@
   height: 1lh;
   vertical-align: middle;
 }
-.maka-markdown-image-frame > .maka-markdown-image-placeholder,
 .maka-markdown-image-inline .maka-markdown-image-placeholder {
   position: absolute;
   inset: 0;
@@ -668,25 +666,21 @@
   justify-content: center;
   border: 0;
 }
-.maka-markdown-image-preview {
-  display: flex;
-  position: absolute;
-  inset: 0;
-  align-items: center;
-  justify-content: center;
+.maka-markdown-image-resource .maka-markdown-image-preview {
+  max-width: 100%;
+  height: auto;
+  vertical-align: top;
+  cursor: default;
 }
-.maka-markdown-image-inline .maka-markdown-image-placeholder { padding: 0; }
-.maka-markdown-image-inline .maka-markdown-image-loading-label { display: none; }
-/* The image is the lightbox trigger, including keyboard and touch activation. */
-.maka-markdown-image-trigger { cursor: default; }
-.maka-markdown-image-trigger > span > span {
-  display: flex;
-  align-items: center;
-  justify-content: center;
+.maka-markdown-image-inline .maka-markdown-image-preview {
   width: 100%;
   height: 100%;
 }
-.maka-markdown-image-preview img { margin: 0; max-height: 100%; max-width: 100%; object-fit: contain; }
+.maka-markdown-image-inline .maka-markdown-attachment-image {
+  max-height: 1lh;
+}
+.maka-markdown-image-inline .maka-markdown-image-placeholder { padding: 0; }
+.maka-markdown-image-inline .maka-markdown-image-loading-label { display: none; }
 .maka-markdown-image-loading {
   position: absolute;
   inset: 0;

From 722cba0fb60a51c415c3fcd31997ca049ade5545 Mon Sep 17 00:00:00 2001
From: sungl <81428141+Sun-GLiang@users.noreply.github.com>
Date: Sun, 11 Oct 2026 15:15:45 +0800
Subject: [PATCH 31/35] test(images): trim redundant PR image coverage

Consolidate overlapping image delivery, saved preview, and DNS cases while preserving their unique assertions. Remove obsolete test-only expectations and require decoded images before checking inline layout.

Generated-by: Codex (GPT-6)
---
 .../src/__tests__/chat-image-delivery.test.ts | 41 ++---------
 .../scripts/markdown-images.browser.test.mjs  | 68 ++++++-------------
 2 files changed, 27 insertions(+), 82 deletions(-)

diff --git a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
index 5b720eeeae..9b535e75c0 100644
--- a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
+++ b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
@@ -252,7 +252,7 @@ test('parses real Markdown image nodes, including references and balanced destin
     '/tmp/a(1).png',
   ]);
 });
-test('automatically saves a local delivery without any UI request; deletion and Host restart do not break replay', async () => {
+test('automatically saves a local delivery without any UI request; deletion and ArtifactStore reopen do not break replay', async () => {
   const f = await fixture();
   try {
     const source = join(f.root, 'original.png');
@@ -804,8 +804,7 @@ test('copying a conversation carries delivery provenance and saved bytes; it doe
     await f.close();
   }
 });
-test('source readers reject oversized payloads, unsafe MIME and redirects to private networks', async (t) => {
-  assert.throws(() => checkedChatImage(Buffer.alloc(2 * 1024 * 1024 + 1)), /too_large/);
+test('source readers reject unsafe MIME and redirects to private networks', async (t) => {
   assert.throws(() => checkedChatImage(Buffer.from('<svg/>')), /unsupported_mime/);
   const server = createServer((_req, res) => {
     res.writeHead(302, { location: 'http://169.254.169.254/latest/meta-data/' });
@@ -888,32 +887,9 @@ test('HTTPS download cannot redirect to HTTP', async (t) => {
   }
 });
 
-test('DNS answers containing any private address are denied before a request', async (t) => {
-  const answers = [
-    { address: '93.184.216.34', family: 4 },
-    { address: '127.0.0.1', family: 4 },
-  ];
-  const lookup = t.mock.method(dns, 'lookup', async () => answers);
-  const request = t.mock.method(net, 'connect', () => {
-    assert.fail('unsafe DNS must not reach transport');
-  });
-  syncBuiltinESMExports();
-  try {
-    await assert.rejects(
-      downloadChatImage('http://image.example/image.png', AbortSignal.timeout(1000)),
-      /not_allowed/,
-    );
-    assert.equal(lookup.mock.callCount(), 1);
-    assert.equal(request.mock.callCount(), 0);
-  } finally {
-    t.mock.restoreAll();
-    syncBuiltinESMExports();
-  }
-});
-
 test('literal benchmark addresses, local names and mixed private answers are denied', async (t) => {
   let answers = [{ address: '93.184.216.34', family: 4 }];
-  t.mock.method(dns, 'lookup', async () => answers);
+  const lookup = t.mock.method(dns, 'lookup', async () => answers);
   const request = t.mock.method(net, 'connect', () =>
     assert.fail('blocked source reached transport'),
   );
@@ -938,10 +914,12 @@ test('literal benchmark addresses, local names and mixed private answers are den
         { address: '93.184.216.34', family: 4 },
         { address, family: address.includes(':') ? 6 : 4 },
       ];
+      const previousLookups = lookup.mock.callCount();
       await assert.rejects(
         downloadChatImage('http://image.example/a.png', AbortSignal.timeout(1000)),
         /not_allowed/,
       );
+      assert.equal(lookup.mock.callCount(), previousLookups + 1);
     }
     assert.equal(request.mock.callCount(), 0);
   } finally {
@@ -1236,15 +1214,6 @@ test('loopback is denied before GET, including redirects from a public origin',
   });
   await new Promise<void>((resolve) => origin.listen(0, '127.0.0.1', resolve));
   try {
-    // An untyped caller passing the former fixture option cannot grant access.
-    await assert.rejects(
-      Reflect.apply(downloadChatImage, undefined, [
-        targetUrl,
-        AbortSignal.timeout(1000),
-        { loopbackOrigin: new URL(targetUrl).origin },
-      ]),
-      /not_allowed/,
-    );
     const source = publicImageOrigin(
       t,
       `http://127.0.0.1:${(origin.address() as import('node:net').AddressInfo).port}/redirect`,
diff --git a/packages/ui/scripts/markdown-images.browser.test.mjs b/packages/ui/scripts/markdown-images.browser.test.mjs
index a23780ce4b..04517d3f8a 100644
--- a/packages/ui/scripts/markdown-images.browser.test.mjs
+++ b/packages/ui/scripts/markdown-images.browser.test.mjs
@@ -112,7 +112,6 @@ before(async () => {
     ].join('\n\n'),
     'links-redacted': `![Signed](${imageUrl}/image.png?token=reasoning-secret)\n\n![Blocked](javascript:alert)`,
     'links-streaming': `![Streaming](${imageUrl}/stream`,
-    'badge-remote': `Build ![Badge](${imageUrl}/badge.png) passing.`,
     'badge-saved': `Build ![Badge](${imageUrl}/badge.png) passing.`,
     'badge-saving': `Build ![Badge](${imageUrl}/badge.png) passing.`,
     'badge-list': `- Build ![Badge](${imageUrl}/badge.png) passing.`,
@@ -324,7 +323,7 @@ test('streaming reasoning completes image syntax as a link without fetching it',
   } finally { await page.close(); }
 });
 
-test('a remote image loads automatically and renders Host-owned bytes', async () => {
+test('remote images load automatically as Host-owned bytes with a separate identity per message', async () => {
   requests = [];
   const page = await pageFor('remote');
   try {
@@ -332,15 +331,6 @@ test('a remote image loads automatically and renders Host-owned bytes', async ()
     assert.equal(await page.getByRole('button', { name: 'Load image', exact: true }).count(), 0);
     assert.deepEqual(requests, [{ path: '/image.png', referer: undefined }]);
     assert.match(await page.locator('img').getAttribute('src'), /^data:/);
-  } finally { await page.close(); }
-});
-
-test('each message automatically resolves its own remote image identity', async () => {
-  requests = [];
-  const page = await pageFor('remote');
-  try {
-    await loaded(page);
-    assert.equal(requests.length, 1);
     await page.evaluate(() => window.nextMessage());
     await page.waitForFunction(() => window.deliveryQueries >= 2);
     await loaded(page);
@@ -364,12 +354,14 @@ for (const scenario of ['preview', 'signed-preview']) {
       assert.equal(await page.locator('img').count(), 0);
       assert.equal(await page.getByRole('button', { name: 'Load image', exact: true }).count(), 0);
       assert.ok(!(await page.locator('body').innerText()).includes('preview-secret'));
-      // Prove the production CSP blocks a bypass of the Markdown component too.
-      await page.evaluate(url => {
-        const img=document.createElement('img'); img.src=url; document.body.append(img);
-        return new Promise(resolve=> { img.onerror=resolve; img.onload=()=>resolve(); });
-      }, `${imageUrl}/blocked.png`);
-      assert.deepEqual(requests, []);
+      if (scenario === 'preview') {
+        // Prove the production CSP blocks a bypass of the Markdown component too.
+        await page.evaluate(url => {
+          const img=document.createElement('img'); img.src=url; document.body.append(img);
+          return new Promise(resolve=> { img.onerror=resolve; img.onload=()=>resolve(); });
+        }, `${imageUrl}/blocked.png`);
+        assert.deepEqual(requests, []);
+      }
     } finally { await page.close(); }
   });
 }
@@ -502,22 +494,6 @@ test('a transient saved attachment read retries its bytes without invalidating a
   } finally { await page.close(); }
 });
 
-for (const scenario of ['remote-saved', 'local-saved']) {
-  test(`${scenario}: saved mapping avoids the original source and the image supports zoom`, async () => {
-    requests = [];
-    const page = await pageFor(scenario);
-    try {
-      await loaded(page);
-      assert.deepEqual(requests, []);
-      assert.equal(await page.evaluate(() => window.imageReads), 1);
-      assert.equal(await page.locator('img').count(), 1);
-      assert.match(await page.locator('img').getAttribute('src'), /^data:image\/png;base64,/);
-      await page.getByRole('button', { name: 'Enlarge image: Screenshot', exact: true }).focus();
-      await page.keyboard.press('Enter');
-      await page.waitForFunction(() => document.images.length > 1);
-    } finally { await page.close(); }
-  });
-}
 for (const scenario of ['local-saved', 'remote-saved', 'badge-saved', 'screenshot-saved']) {
   test(`${scenario}: clicking the image itself opens the enlarged preview`, async () => {
     requests = [];
@@ -526,6 +502,9 @@ for (const scenario of ['local-saved', 'remote-saved', 'badge-saved', 'screensho
       const image = page.locator('.maka-markdown-image-preview img');
       await image.waitFor();
       await image.evaluate(image => image.decode());
+      assert.equal(await page.evaluate(() => window.imageReads), 1);
+      assert.equal(await page.locator('img').count(), 1);
+      assert.match(await image.getAttribute('src'), /^data:image\/png;base64,/);
       assert.equal(await page.locator('.maka-markdown-image-expand').count(), 0);
       assert.equal(await page.getByRole('button', { name: /^Enlarge image:/ }).count(), 1);
       const source = await image.getAttribute('src');
@@ -550,11 +529,13 @@ for (const scenario of ['local-saved', 'remote-saved', 'badge-saved', 'screensho
   });
 }
 
-for (const key of ['Enter', 'Space']) {
-  test(`the image itself supports keyboard enlargement with ${key}`, async () => {
-    const page = await pageFor('local-saved');
+for (const [scenario, key] of [['local-saved', 'Enter'], ['local-saved', 'Space'], ['remote-saved', 'Enter']]) {
+  test(`${scenario}: the image itself supports keyboard enlargement with ${key}`, async () => {
+    requests = [];
+    const page = await pageFor(scenario);
     try {
       await loaded(page);
+      assert.deepEqual(requests, []);
       const trigger = page.locator('.maka-markdown-image-trigger');
       await trigger.focus();
       await page.keyboard.press(key);
@@ -589,7 +570,6 @@ test('a pending archive stays a placeholder until saved bytes are available', as
     assert.equal(await page.locator('img').count(), 0);
     await page.waitForFunction(() => [...document.images].some(img=>img.src.startsWith('data:image/png;') && img.naturalWidth===1));
     await page.getByText('Loading image…', { exact: true }).waitFor({ state: 'hidden' });
-    await page.getByText('Saving image…', { exact: true }).waitFor({ state: 'hidden' });
     assert.equal(await page.getByRole('status').filter({ hasText: /\S/ }).count(), 0);
     assert.equal(await page.evaluate(() => window.deliveryQueries), 2);
     assert.equal(requests.length, 0);
@@ -709,7 +689,7 @@ for (const [name, naturalWidth, naturalHeight] of dimensions) {
   });
 }
 
-for (const scenario of ['badge-remote', 'badge-saved', 'badge-saving']) {
+for (const scenario of ['badge-saved', 'badge-saving']) {
   test(`${scenario}: a badge keeps its intrinsic size and surrounding text on one line`, async () => {
     requests = [];
     const page = await pageFor(scenario);
@@ -735,13 +715,8 @@ for (const scenario of ['badge-remote', 'badge-saved', 'badge-saving']) {
       assert.equal(geometry.textBoxes.length, 2);
       assert.equal(geometry.textBoxes[0], geometry.textBoxes[1]);
       if (scenario === 'badge-saved') assert.deepEqual(requests, []);
-      if (scenario === 'badge-remote') {
-        await page.locator('.maka-markdown-image-preview').hover();
-        await page.getByRole('button', { name: 'Enlarge image: Badge', exact: true }).click();
-      } else {
-        await page.getByRole('button', { name: 'Enlarge image: Badge', exact: true }).focus();
-        await page.keyboard.press('Enter');
-      }
+      await page.getByRole('button', { name: 'Enlarge image: Badge', exact: true }).focus();
+      await page.keyboard.press('Enter');
       await page.getByRole('dialog').waitFor();
     } finally { await page.close(); }
   });
@@ -782,7 +757,8 @@ for (const scenario of ['badge-list', 'badge-table', 'badge-strip']) {
       const before = await page.locator('.maka-markdown-image-resource').first().boundingBox();
       assert.ok(before.width <= 120 && before.height <= 32);
       release();
-      await page.waitForFunction(() => [...document.images].every(image => image.naturalWidth === 80));
+      await page.waitForFunction(expected => document.images.length === expected &&
+        [...document.images].every(image => image.naturalWidth === 80), scenario === 'badge-strip' ? 2 : 1);
       assert.deepEqual(await page.locator('.maka-markdown-image-resource').first().boundingBox(), before);
     } finally { release(); await page.close(); }
   });

From 021ca67e918fd49538187aea1bbcd096b6dce069 Mon Sep 17 00:00:00 2001
From: Sun-GLiang <81428141+Sun-GLiang@users.noreply.github.com>
Date: Tue, 13 Oct 2026 11:23:24 +0800
Subject: [PATCH 32/35] refactor(images): trim image redaction and unrelated
 changes

Generated-by: Codex (GPT-6)
---
 .../licenses/npm/THIRD_PARTY_NOTICES.txt      | 1088 +----------------
 ...ub-coordination-transcript-preload.test.ts |    2 +-
 apps/desktop/src/preload/bridge-contract.d.ts |    2 +-
 .../features/conversation/staging-services.ts |    8 +-
 .../src/renderer/features/workbar/ports.ts    |    6 +-
 .../src/renderer/features/workhub/ports.ts    |    7 +-
 .../features/workhub/ui/workhub-root.tsx      |    2 +-
 .../desktop/create-workhub-services.ts        |    2 +-
 apps/desktop/stories/workhub.stories.tsx      |    2 +-
 package-lock.json                             |  449 +------
 packages/cli/THIRD_PARTY_NOTICES.txt          | 1084 +---------------
 packages/core/package.json                    |    3 +-
 .../core/src/__tests__/image-markdown.test.ts |   29 +-
 packages/core/src/image-delivery.ts           |   12 -
 packages/core/src/image-markdown.ts           |   29 -
 .../scripts/markdown-images.browser.test.mjs  |   72 +-
 .../src/__tests__/attachment-image.test.tsx   |   37 -
 .../ui/src/__tests__/markdown-body.test.ts    |   11 -
 .../markdown-image-redaction.test.ts          |  114 --
 packages/ui/src/attachment-image.tsx          |    7 +-
 packages/ui/src/markdown-body.tsx             |   14 +-
 packages/ui/src/markdown-image-redaction.ts   |   57 -
 packages/ui/src/markdown-image.tsx            |    8 +-
 packages/ui/src/markdown.tsx                  |   12 +-
 scripts/verify-linux.mjs                      |   10 +-
 25 files changed, 99 insertions(+), 2968 deletions(-)
 delete mode 100644 packages/ui/src/__tests__/markdown-image-redaction.test.ts
 delete mode 100644 packages/ui/src/markdown-image-redaction.ts

diff --git a/apps/desktop/resources/licenses/npm/THIRD_PARTY_NOTICES.txt b/apps/desktop/resources/licenses/npm/THIRD_PARTY_NOTICES.txt
index d5b17eab68..8c44d4a49d 100644
--- a/apps/desktop/resources/licenses/npm/THIRD_PARTY_NOTICES.txt
+++ b/apps/desktop/resources/licenses/npm/THIRD_PARTY_NOTICES.txt
@@ -5395,36 +5395,6 @@ MIT License
 
 ================================================================================
 
-Package: @types/debug@4.1.13
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/DefinitelyTyped/DefinitelyTyped.git#types/debug
-
---- LICENSE ---
-MIT License
-
-    Copyright (c) Microsoft Corporation.
-
-    Permission is hereby granted, free of charge, to any person obtaining a copy
-    of this software and associated documentation files (the "Software"), to deal
-    in the Software without restriction, including without limitation the rights
-    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-    copies of the Software, and to permit persons to whom the Software is
-    furnished to do so, subject to the following conditions:
-
-    The above copyright notice and this permission notice shall be included in all
-    copies or substantial portions of the Software.
-
-    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-    SOFTWARE
-
-================================================================================
-
 Package: @types/geojson@7946.0.16
 Declared license: MIT
 Selected license: MIT
@@ -5455,66 +5425,6 @@ MIT License
 
 ================================================================================
 
-Package: @types/mdast@4.0.4
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/DefinitelyTyped/DefinitelyTyped.git#types/mdast
-
---- LICENSE ---
-MIT License
-
-    Copyright (c) Microsoft Corporation.
-
-    Permission is hereby granted, free of charge, to any person obtaining a copy
-    of this software and associated documentation files (the "Software"), to deal
-    in the Software without restriction, including without limitation the rights
-    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-    copies of the Software, and to permit persons to whom the Software is
-    furnished to do so, subject to the following conditions:
-
-    The above copyright notice and this permission notice shall be included in all
-    copies or substantial portions of the Software.
-
-    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-    SOFTWARE
-
-================================================================================
-
-Package: @types/ms@2.1.0
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/DefinitelyTyped/DefinitelyTyped.git#types/ms
-
---- LICENSE ---
-MIT License
-
-    Copyright (c) Microsoft Corporation.
-
-    Permission is hereby granted, free of charge, to any person obtaining a copy
-    of this software and associated documentation files (the "Software"), to deal
-    in the Software without restriction, including without limitation the rights
-    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-    copies of the Software, and to permit persons to whom the Software is
-    furnished to do so, subject to the following conditions:
-
-    The above copyright notice and this permission notice shall be included in all
-    copies or substantial portions of the Software.
-
-    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-    SOFTWARE
-
-================================================================================
-
 Package: @types/node@26.6.3
 Declared license: MIT
 Selected license: MIT
@@ -5635,36 +5545,6 @@ MIT License
 
 ================================================================================
 
-Package: @types/unist@3.0.3
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/DefinitelyTyped/DefinitelyTyped.git#types/unist
-
---- LICENSE ---
-MIT License
-
-    Copyright (c) Microsoft Corporation.
-
-    Permission is hereby granted, free of charge, to any person obtaining a copy
-    of this software and associated documentation files (the "Software"), to deal
-    in the Software without restriction, including without limitation the rights
-    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-    copies of the Software, and to permit persons to whom the Software is
-    furnished to do so, subject to the following conditions:
-
-    The above copyright notice and this permission notice shall be included in all
-    copies or substantial portions of the Software.
-
-    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-    SOFTWARE
-
-================================================================================
-
 Package: @upsetjs/venn.js@2.0.0
 Declared license: MIT
 Selected license: MIT
@@ -7376,37 +7256,6 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 
 ================================================================================
 
-Package: character-entities@2.0.2
-Declared license: MIT
-Selected license: MIT
-Repository: wooorm/character-entities
-
---- license ---
-(The MIT License)
-
-Copyright (c) 2015 Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
 Package: cli-table3@0.6.5
 Declared license: MIT
 Selected license: MIT
@@ -8987,37 +8836,6 @@ THE SOFTWARE.
 
 ================================================================================
 
-Package: decode-named-character-reference@1.3.0
-Declared license: MIT
-Selected license: MIT
-Repository: wooorm/decode-named-character-reference
-
---- license ---
-(The MIT License)
-
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
 Package: delaunator@5.1.0
 Declared license: ISC
 Selected license: ISC
@@ -9070,67 +8888,6 @@ THE SOFTWARE.
 
 ================================================================================
 
-Package: dequal@2.0.3
-Declared license: MIT
-Selected license: MIT
-Repository: lukeed/dequal
-
---- license ---
-The MIT License (MIT)
-
-Copyright (c) Luke Edwards <luke.edwards05@gmail.com> (lukeed.com)
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.
-
-================================================================================
-
-Package: devlop@1.1.0
-Declared license: MIT
-Selected license: MIT
-Repository: wooorm/devlop
-
---- license ---
-(The MIT License)
-
-Copyright (c) 2023 Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
 Package: dijkstrajs@1.0.3
 Declared license: MIT
 Selected license: MIT
@@ -13022,777 +12779,33 @@ SOFTWARE.
 
 ================================================================================
 
-Package: mdast-util-from-markdown@2.1.0
+Package: mermaid@11.17.2
 Declared license: MIT
 Selected license: MIT
-Repository: syntax-tree/mdast-util-from-markdown
-
---- license ---
-(The MIT License)
+Repository: https://github.com/mermaid-js/mermaid
 
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
+--- LICENSE ---
+The MIT License (MIT)
 
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
+Copyright (c) 2014 - 2022 Knut Sveidqvist
 
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
 
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
 
-================================================================================
-
-Package: mdast-util-to-string@4.0.0
-Declared license: MIT
-Selected license: MIT
-Repository: syntax-tree/mdast-util-to-string
-
---- license ---
-(The MIT License)
-
-Copyright (c) 2015 Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
-Package: mermaid@11.17.2
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/mermaid-js/mermaid
-
---- LICENSE ---
-The MIT License (MIT)
-
-Copyright (c) 2014 - 2022 Knut Sveidqvist
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-
-================================================================================
-
-Package: micromark@4.0.3
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/micromark/micromark/tree/main/packages/micromark
-
---- license ---
-(The MIT License)
-
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
-Package: micromark-core-commonmark@2.0.4
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-core-commonmark
-
---- license ---
-(The MIT License)
-
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
-Package: micromark-factory-destination@2.0.1
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-factory-destination
-
---- license ---
-(The MIT License)
-
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
-Package: micromark-factory-label@2.0.1
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-factory-label
-
---- license ---
-(The MIT License)
-
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
-Package: micromark-factory-space@2.1.0
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-factory-space
-
---- license ---
-(The MIT License)
-
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
-Package: micromark-factory-title@2.0.1
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-factory-title
-
---- license ---
-(The MIT License)
-
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
-Package: micromark-factory-whitespace@2.0.1
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-factory-whitespace
-
---- license ---
-(The MIT License)
-
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
-Package: micromark-util-character@2.1.1
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-character
-
---- license ---
-(The MIT License)
-
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
-Package: micromark-util-chunked@2.0.1
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-chunked
-
---- license ---
-(The MIT License)
-
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
-Package: micromark-util-classify-character@2.0.1
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-classify-character
-
---- license ---
-(The MIT License)
-
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
-Package: micromark-util-combine-extensions@2.0.1
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-combine-extensions
-
---- license ---
-(The MIT License)
-
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
-Package: micromark-util-decode-numeric-character-reference@2.0.2
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-decode-numeric-character-reference
-
---- license ---
-(The MIT License)
-
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
-Package: micromark-util-decode-string@2.0.1
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-decode-string
-
---- license ---
-(The MIT License)
-
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
-Package: micromark-util-edit-map@1.0.0
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-edit-map
-
---- license ---
-(The MIT License)
-
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
-Package: micromark-util-encode@2.0.1
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-encode
-
---- license ---
-(The MIT License)
-
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
-Package: micromark-util-html-tag-name@2.0.1
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-html-tag-name
-
---- license ---
-(The MIT License)
-
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
-Package: micromark-util-normalize-identifier@2.0.1
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-normalize-identifier
-
---- license ---
-(The MIT License)
-
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
-Package: micromark-util-resolve-all@2.0.1
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-resolve-all
-
---- license ---
-(The MIT License)
-
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
-Package: micromark-util-sanitize-uri@2.0.1
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-sanitize-uri
-
---- license ---
-(The MIT License)
-
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
-Package: micromark-util-subtokenize@2.1.0
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-subtokenize
-
---- license ---
-(The MIT License)
-
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
-Package: micromark-util-symbol@2.0.1
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-symbol
-
---- license ---
-(The MIT License)
-
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
-Package: micromark-util-types@2.0.3
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-types
-
---- license ---
-(The MIT License)
-
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
 
 ================================================================================
 
@@ -14004,36 +13017,6 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 
 ================================================================================
 
-Package: ms@2.1.3
-Declared license: MIT
-Selected license: MIT
-Repository: vercel/ms
-
---- license.md ---
-The MIT License (MIT)
-
-Copyright (c) 2020 Vercel, Inc.
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-
-================================================================================
-
 Package: node-addon-api@7.1.1
 Declared license: MIT
 Selected license: MIT
@@ -16684,37 +15667,6 @@ SOFTWARE.
 
 ================================================================================
 
-Package: unist-util-stringify-position@4.0.0
-Declared license: MIT
-Selected license: MIT
-Repository: syntax-tree/unist-util-stringify-position
-
---- license ---
-(The MIT License)
-
-Copyright (c) 2016 Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
 Package: universalify@2.0.1
 Declared license: MIT
 Selected license: MIT
diff --git a/apps/desktop/src/main/__tests__/workhub-coordination-transcript-preload.test.ts b/apps/desktop/src/main/__tests__/workhub-coordination-transcript-preload.test.ts
index e312f5594b..3b33ac1c8e 100644
--- a/apps/desktop/src/main/__tests__/workhub-coordination-transcript-preload.test.ts
+++ b/apps/desktop/src/main/__tests__/workhub-coordination-transcript-preload.test.ts
@@ -114,7 +114,7 @@ test('WorkHub upload references round-trip through idle answers, both queue mode
     assert.equal(await services.enqueueMessage(sessionId, `message-${placement}`, 'read this', attachments, placement), 'admitted');
   }
   assert.deepEqual(structuredClone(sent.map(({ attachments }) => attachments)), [[uploaded], [uploaded], [uploaded]]);
-  assert.equal((await services.readBytes(sessionId, 'brief.txt')).ok, true);
+  assert.equal((await services.readAttachmentBytes(sessionId, 'brief.txt')).ok, true);
   assert.ok(services.resolveImageDelivery);
   assert.deepEqual(await services.resolveImageDelivery(sessionId, {
     turnId: 'image-turn', messageId: 'image-message', source: '/tmp/image.png',
diff --git a/apps/desktop/src/preload/bridge-contract.d.ts b/apps/desktop/src/preload/bridge-contract.d.ts
index 63cb82951b..9a99b44739 100644
--- a/apps/desktop/src/preload/bridge-contract.d.ts
+++ b/apps/desktop/src/preload/bridge-contract.d.ts
@@ -1746,7 +1746,7 @@ export interface MakaBridge {
       | { ok: false; reason: string }
     >;
     resolveImageDelivery: import('@maka/core/image-delivery').ResolveImageDelivery;
-    readBytes: import('@maka/core/image-delivery').ReadAttachmentBytes;
+    readBytes(sessionId: string, artifactId: string): Promise<ArtifactBinaryReadResult>;
   };
   search: {
     recall(
diff --git a/apps/desktop/src/renderer/features/conversation/staging-services.ts b/apps/desktop/src/renderer/features/conversation/staging-services.ts
index 643871d9bc..9cbfb55c76 100644
--- a/apps/desktop/src/renderer/features/conversation/staging-services.ts
+++ b/apps/desktop/src/renderer/features/conversation/staging-services.ts
@@ -19,10 +19,14 @@
 
 import { createServicesContext } from '../../application/contracts/feature-services.js';
 import type { ComposerAttachmentService } from '@maka/ui/use-composer-attachments';
-import type { ChatImageServices } from '@maka/core/image-delivery';
+import type { ArtifactBinaryReadResult } from '@maka/core/artifacts';
+import type { ResolveImageDelivery } from '@maka/core/image-delivery';
 
 /** One attachment port: the Composer stages through it and the transcript reads image bytes through it. */
-export type ComposerStagingServices = ComposerAttachmentService & ChatImageServices;
+export interface ComposerStagingServices extends ComposerAttachmentService {
+  readBytes(sessionId: string, artifactId: string): Promise<ArtifactBinaryReadResult>;
+  resolveImageDelivery?: ResolveImageDelivery;
+}
 const context = createServicesContext<ComposerStagingServices>('ComposerStagingServicesProvider');
 export const ComposerStagingServicesProvider = context.Provider;
 export const useComposerStagingServices = context.useServices;
diff --git a/apps/desktop/src/renderer/features/workbar/ports.ts b/apps/desktop/src/renderer/features/workbar/ports.ts
index b3c1e41891..1c5aa70672 100644
--- a/apps/desktop/src/renderer/features/workbar/ports.ts
+++ b/apps/desktop/src/renderer/features/workbar/ports.ts
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-import type { ChatImageServices } from '@maka/core/image-delivery';
+import type { ResolveImageDelivery } from '@maka/core/image-delivery';
 import type { SessionInspectorService } from '../../application/contracts/session-inspector/service.js';
 export type { SessionInspectorService, SessionTracePage, SessionUsageSummary } from '../../application/contracts/session-inspector/service.js';
 
@@ -165,7 +165,9 @@ export interface WorkbarArtifactsService {
   saveAs(sessionId: string, artifactId: string): Promise<ArtifactSaveResult>;
 }
 
-export interface WorkbarAttachmentsService extends ChatImageServices {
+export interface WorkbarAttachmentsService {
+  readBytes(sessionId: string, artifactId: string): Promise<ArtifactBinaryReadResult>;
+  resolveImageDelivery?: ResolveImageDelivery;
   pickFiles(): Promise<
     | {
         ok: true;
diff --git a/apps/desktop/src/renderer/features/workhub/ports.ts b/apps/desktop/src/renderer/features/workhub/ports.ts
index 9d9bc69a32..62017d11b8 100644
--- a/apps/desktop/src/renderer/features/workhub/ports.ts
+++ b/apps/desktop/src/renderer/features/workhub/ports.ts
@@ -17,7 +17,8 @@
  * under the License.
  */
 
-import type { ChatImageServices } from '@maka/core/image-delivery';
+import type { ArtifactBinaryReadResult } from '@maka/core/artifacts';
+import type { ResolveImageDelivery } from '@maka/core/image-delivery';
 import type { ChatModelChoice } from '@maka/core/chat-model-choice';
 import type { UiLocale } from '@maka/core/ui-locale';
 import type { StoredMessage, SessionSummary } from '@maka/core/session';
@@ -39,7 +40,7 @@ export interface WorkHubTranscript {
   loadEarlier(): Promise<void>;
   close(): Promise<void>;
 }
-export interface WorkHubServices extends WorkHubWorkspaceServices, ChatImageServices {
+export interface WorkHubServices extends WorkHubWorkspaceServices {
   readonly inspector: import('../../application/contracts/session-inspector/service.js').SessionInspectorService;
   readonly surface: 'main' | 'workhub';
   readonly initialLocale: UiLocale;
@@ -56,6 +57,8 @@ export interface WorkHubServices extends WorkHubWorkspaceServices, ChatImageServ
     model: string;
   }): Promise<void>;
   readonly attachments: ComposerAttachmentService;
+  readAttachmentBytes(sessionId: string, artifactId: string): Promise<ArtifactBinaryReadResult>;
+  resolveImageDelivery?: ResolveImageDelivery;
   prepareAttachments(sessionId: string, items: Array<{ approvalId: string; name: string; mimeType?: string } | { file: File }>): Promise<AttachmentRef[]>;
   listActiveInteractions(sessionId: string): Promise<import('@maka/core/events').ActiveInteractionRequestEvent[]>;
   subscribeActiveInteractions(handler: (event: { sessionId: string; interactions: import('@maka/core/events').ActiveInteractionRequestEvent[] }) => void): () => void;
diff --git a/apps/desktop/src/renderer/features/workhub/ui/workhub-root.tsx b/apps/desktop/src/renderer/features/workhub/ui/workhub-root.tsx
index 3a1f0d8aa8..f87510db54 100644
--- a/apps/desktop/src/renderer/features/workhub/ui/workhub-root.tsx
+++ b/apps/desktop/src/renderer/features/workhub/ui/workhub-root.tsx
@@ -408,7 +408,7 @@ export function WorkHubRoot() {
         <div ref={history} className="workHubHistory" aria-hidden={!showConversation} inert={!showConversation}>
         <WorkHubConversation
           workLinks={links}
-          onReadAttachmentBytes={services.readBytes} onResolveImageDelivery={services.resolveImageDelivery}
+          onReadAttachmentBytes={services.readAttachmentBytes} onResolveImageDelivery={services.resolveImageDelivery}
           onOpenWork={(id) => call(services.presentation.openSession(id))}
           scrollBehavior="auto"
           onNew={() => composer.current?.focus()}
diff --git a/apps/desktop/src/renderer/platform/desktop/create-workhub-services.ts b/apps/desktop/src/renderer/platform/desktop/create-workhub-services.ts
index d68513bd39..807bcb5b55 100644
--- a/apps/desktop/src/renderer/platform/desktop/create-workhub-services.ts
+++ b/apps/desktop/src/renderer/platform/desktop/create-workhub-services.ts
@@ -92,7 +92,7 @@ export function createDesktopWorkHubServices(
     setDefaultModel: ({ llmConnectionSlug, model }) =>
       bridge.connections.setDefaultModel({ slug: llmConnectionSlug, model }),
     attachments: bridge.attachments,
-    readBytes: bridge.attachments.readBytes,
+    readAttachmentBytes: bridge.attachments.readBytes,
     resolveImageDelivery: bridge.attachments.resolveImageDelivery,
     prepareAttachments: async (sessionId, items) => {
       const result = await bridge.workHub.prepareAttachments(sessionId, items);
diff --git a/apps/desktop/stories/workhub.stories.tsx b/apps/desktop/stories/workhub.stories.tsx
index 15a8926d87..7475765cbb 100644
--- a/apps/desktop/stories/workhub.stories.tsx
+++ b/apps/desktop/stories/workhub.stories.tsx
@@ -101,7 +101,7 @@ function makeServices(failFirst: boolean, withHistory: boolean | 'usage', colore
     listSessions: async () => coloredHistory ? [target, secondTarget] : [target], subscribeSessions: (handler) => { updateSessions = handler; return () => { updateSessions = undefined; }; }, modelChoices: async () => choices,
     setDefaultModel: async () => {},
     attachments: { pickFiles: async () => ({ ok: true, files: [{ approvalId: 'file-1', name: 'requirements.txt', size: 12, mimeType: 'text/plain' }] }), previewApproval: async () => ({ ok: false, reason: 'not-image' }) },
-    readBytes: async () => { throw new Error('Not an image'); },
+    readAttachmentBytes: async () => { throw new Error('Not an image'); },
     prepareAttachments: async (id, items) => { writes.upload(id, items); return [{ name: 'requirements.txt', kind: 'other', mimeType: 'text/plain', bytes: 12, ref: { kind: 'session_file', sessionId: 'maka_workhub_coordination', relativePath: 'artifact-1' } }]; },
     listActiveInteractions: async () => pendingForm ? [pendingForm] : questionPending ? [questionRequest] : [],
     subscribeActiveInteractions: (handler) => { interactionUpdate = handler; return () => { interactionUpdate = undefined; }; },
diff --git a/package-lock.json b/package-lock.json
index e3aef6ac2f..31e6e65c54 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -5715,6 +5715,7 @@
       "version": "4.1.13",
       "resolved": "https://registry.npmjs.org/@types/debug/-/debug-4.1.13.tgz",
       "integrity": "sha512-KSVgmQmzMwPlmtljOomayoR89W4FynCAi3E8PPs7vmDVPe84hT+vGPKkJfThkmXs0x0jAaa9U8uW8bbfyS2fWw==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/ms": "*"
@@ -5798,6 +5799,7 @@
       "version": "4.0.4",
       "resolved": "https://registry.npmjs.org/@types/mdast/-/mdast-4.0.4.tgz",
       "integrity": "sha512-kGaNbPh1k7AFzgpud/gMdvIm5xuECykRR+JnWKQno9TAXVa6WIVCGTPvYGekIDL4uwCZQSYbUxNBSb1aUo79oA==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/unist": "*"
@@ -5807,6 +5809,7 @@
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/@types/ms/-/ms-2.1.0.tgz",
       "integrity": "sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA==",
+      "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/nlcst": {
@@ -5889,6 +5892,7 @@
       "version": "3.0.3",
       "resolved": "https://registry.npmjs.org/@types/unist/-/unist-3.0.3.tgz",
       "integrity": "sha512-ko/gIFJRv177XgZsZcBwnqJN5x/Gien8qNOn0D5bQU/zAzVf9Zt3BlcUiLqhV9y4ARk0GbT3tnUiPNgnTXzc/Q==",
+      "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/ws": {
@@ -7646,16 +7650,6 @@
         "url": "https://github.com/chalk/chalk?sponsor=1"
       }
     },
-    "node_modules/character-entities": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/character-entities/-/character-entities-2.0.2.tgz",
-      "integrity": "sha512-shx7oQ0Awen/BRIdkjkvz54PnEEI/EjwXDSIZp86/KKdbafHh1Df/RYGBhn4hbe2+uKC9FnT5UCEdyPz3ai9hQ==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
     "node_modules/character-entities-html4": {
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/character-entities-html4/-/character-entities-html4-2.1.0.tgz",
@@ -8672,19 +8666,6 @@
         "node": ">=0.10.0"
       }
     },
-    "node_modules/decode-named-character-reference": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/decode-named-character-reference/-/decode-named-character-reference-1.3.0.tgz",
-      "integrity": "sha512-GtpQYB283KrPp6nRw50q3U9/VfOutZOe103qlN7BPP6Ad27xYnOIWv4lPzo8HCAL+mMZofJ9KEy30fq6MfaK6Q==",
-      "license": "MIT",
-      "dependencies": {
-        "character-entities": "^2.0.0"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
     "node_modules/decompress-response": {
       "version": "6.0.0",
       "resolved": "https://registry.npmjs.org/decompress-response/-/decompress-response-6.0.0.tgz",
@@ -8853,6 +8834,7 @@
       "version": "2.0.3",
       "resolved": "https://registry.npmjs.org/dequal/-/dequal-2.0.3.tgz",
       "integrity": "sha512-0je+qPKHEMohvfRTCEo3CrPG6cAzAYgmzKyxRiYSSDkS6eGJdyVJm7WaYA5ECaAD9wLB2T4EEeymA5aFVcYXCA==",
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=6"
@@ -8894,6 +8876,7 @@
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/devlop/-/devlop-1.1.0.tgz",
       "integrity": "sha512-RWmIqhcFf1lRYBvNmr7qTNuyCt/7/ns2jbpp1+PalgE/rDQcBT0fioSMUpJ93irlUhC5hrg4cYqe6U+0ImW0rA==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "dequal": "^2.0.0"
@@ -12391,30 +12374,6 @@
         "node": ">= 0.4"
       }
     },
-    "node_modules/mdast-util-from-markdown": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/mdast-util-from-markdown/-/mdast-util-from-markdown-2.1.0.tgz",
-      "integrity": "sha512-KRLgmPaP2H1ul2bpoJkOS+9pAcDAAj9Nu1mqLnh8NLeJG5tlvj42TH80PIGBpROWlRXLk0lDrWNuZCFy/tsB4A==",
-      "license": "MIT",
-      "dependencies": {
-        "@types/mdast": "^4.0.0",
-        "@types/unist": "^3.0.0",
-        "decode-named-character-reference": "^1.0.0",
-        "devlop": "^1.0.0",
-        "mdast-util-to-string": "^4.0.0",
-        "micromark": "^4.0.0",
-        "micromark-util-decode-numeric-character-reference": "^2.0.0",
-        "micromark-util-decode-string": "^2.0.0",
-        "micromark-util-normalize-identifier": "^2.0.0",
-        "micromark-util-symbol": "^2.0.0",
-        "micromark-util-types": "^2.0.0",
-        "unist-util-stringify-position": "^4.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
     "node_modules/mdast-util-to-hast": {
       "version": "13.2.1",
       "resolved": "https://registry.npmjs.org/mdast-util-to-hast/-/mdast-util-to-hast-13.2.1.tgz",
@@ -12437,19 +12396,6 @@
         "url": "https://opencollective.com/unified"
       }
     },
-    "node_modules/mdast-util-to-string": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/mdast-util-to-string/-/mdast-util-to-string-4.0.0.tgz",
-      "integrity": "sha512-0H44vDimn51F0YwvxSJSm0eCDOJTRlmN0R1yBh4HLj9wiV1Dn0QoXGbvFAWj2hSItVTlCmBF1hqKlIyUBVFLPg==",
-      "license": "MIT",
-      "dependencies": {
-        "@types/mdast": "^4.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
     "node_modules/mdn-data": {
       "version": "2.27.1",
       "resolved": "https://registry.npmjs.org/mdn-data/-/mdn-data-2.27.1.tgz",
@@ -12522,188 +12468,11 @@
         "node": ">= 20"
       }
     },
-    "node_modules/micromark": {
-      "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/micromark/-/micromark-4.0.3.tgz",
-      "integrity": "sha512-oGYfQzHSG5dOMovQcJ3fyTmZlWAWpi0XA0sJwJs+i6OT88o1+Jtw/8z0CmdowSLxGhhFK89rQ/oXph/wN02PNw==",
-      "funding": [
-        {
-          "type": "GitHub Sponsors",
-          "url": "https://github.com/sponsors/unifiedjs"
-        },
-        {
-          "type": "OpenCollective",
-          "url": "https://opencollective.com/unified"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "@types/debug": "^4.0.0",
-        "debug": "^4.0.0",
-        "decode-named-character-reference": "^1.0.0",
-        "devlop": "^1.0.0",
-        "micromark-core-commonmark": "^2.0.0",
-        "micromark-factory-space": "^2.0.0",
-        "micromark-util-character": "^2.0.0",
-        "micromark-util-chunked": "^2.0.0",
-        "micromark-util-combine-extensions": "^2.0.0",
-        "micromark-util-decode-numeric-character-reference": "^2.0.0",
-        "micromark-util-edit-map": "^1.0.0",
-        "micromark-util-encode": "^2.0.0",
-        "micromark-util-normalize-identifier": "^2.0.0",
-        "micromark-util-resolve-all": "^2.0.0",
-        "micromark-util-sanitize-uri": "^2.0.0",
-        "micromark-util-subtokenize": "^2.0.0",
-        "micromark-util-symbol": "^2.0.0",
-        "micromark-util-types": "^2.0.0"
-      }
-    },
-    "node_modules/micromark-core-commonmark": {
-      "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/micromark-core-commonmark/-/micromark-core-commonmark-2.0.4.tgz",
-      "integrity": "sha512-wxEeE8v8XVvOrxn1TZj74qYhAtTQsSqufHVS3uNVyT1MupXxhyaHk8/9xDNPh9BmL77QNDgWTkZ3RsYHB2ry7w==",
-      "funding": [
-        {
-          "type": "GitHub Sponsors",
-          "url": "https://github.com/sponsors/unifiedjs"
-        },
-        {
-          "type": "OpenCollective",
-          "url": "https://opencollective.com/unified"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "decode-named-character-reference": "^1.0.0",
-        "devlop": "^1.0.0",
-        "micromark-factory-destination": "^2.0.0",
-        "micromark-factory-label": "^2.0.0",
-        "micromark-factory-space": "^2.1.0",
-        "micromark-factory-title": "^2.0.0",
-        "micromark-factory-whitespace": "^2.0.0",
-        "micromark-util-character": "^2.0.0",
-        "micromark-util-chunked": "^2.0.0",
-        "micromark-util-classify-character": "^2.0.0",
-        "micromark-util-edit-map": "^1.0.0",
-        "micromark-util-html-tag-name": "^2.0.0",
-        "micromark-util-normalize-identifier": "^2.0.0",
-        "micromark-util-resolve-all": "^2.0.0",
-        "micromark-util-subtokenize": "^2.0.0",
-        "micromark-util-symbol": "^2.0.0",
-        "micromark-util-types": "^2.0.3"
-      }
-    },
-    "node_modules/micromark-factory-destination": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/micromark-factory-destination/-/micromark-factory-destination-2.0.1.tgz",
-      "integrity": "sha512-Xe6rDdJlkmbFRExpTOmRj9N3MaWmbAgdpSrBQvCFqhezUn4AHqJHbaEnfbVYYiexVSs//tqOdY/DxhjdCiJnIA==",
-      "funding": [
-        {
-          "type": "GitHub Sponsors",
-          "url": "https://github.com/sponsors/unifiedjs"
-        },
-        {
-          "type": "OpenCollective",
-          "url": "https://opencollective.com/unified"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "micromark-util-character": "^2.0.0",
-        "micromark-util-symbol": "^2.0.0",
-        "micromark-util-types": "^2.0.0"
-      }
-    },
-    "node_modules/micromark-factory-label": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/micromark-factory-label/-/micromark-factory-label-2.0.1.tgz",
-      "integrity": "sha512-VFMekyQExqIW7xIChcXn4ok29YE3rnuyveW3wZQWWqF4Nv9Wk5rgJ99KzPvHjkmPXF93FXIbBp6YdW3t71/7Vg==",
-      "funding": [
-        {
-          "type": "GitHub Sponsors",
-          "url": "https://github.com/sponsors/unifiedjs"
-        },
-        {
-          "type": "OpenCollective",
-          "url": "https://opencollective.com/unified"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "devlop": "^1.0.0",
-        "micromark-util-character": "^2.0.0",
-        "micromark-util-symbol": "^2.0.0",
-        "micromark-util-types": "^2.0.0"
-      }
-    },
-    "node_modules/micromark-factory-space": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/micromark-factory-space/-/micromark-factory-space-2.1.0.tgz",
-      "integrity": "sha512-fS8hnLIjnjvdQIj39Geug8wWsR0HrYZ43KShKxNfwT7t2LOHo/LbWZEzEaSOjwtjdCsjoE6syHhonEzW0zv0+Q==",
-      "funding": [
-        {
-          "type": "GitHub Sponsors",
-          "url": "https://github.com/sponsors/unifiedjs"
-        },
-        {
-          "type": "OpenCollective",
-          "url": "https://opencollective.com/unified"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "micromark-util-character": "^2.0.0",
-        "micromark-util-types": "^2.0.0"
-      }
-    },
-    "node_modules/micromark-factory-title": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/micromark-factory-title/-/micromark-factory-title-2.0.1.tgz",
-      "integrity": "sha512-5bZ+3CjhAd9eChYTHsjy6TGxpOFSKgKKJPJxr293jTbfry2KDoWkhBb6TcPVB4NmzaPhMs1Frm9AZH7OD4Cjzw==",
-      "funding": [
-        {
-          "type": "GitHub Sponsors",
-          "url": "https://github.com/sponsors/unifiedjs"
-        },
-        {
-          "type": "OpenCollective",
-          "url": "https://opencollective.com/unified"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "micromark-factory-space": "^2.0.0",
-        "micromark-util-character": "^2.0.0",
-        "micromark-util-symbol": "^2.0.0",
-        "micromark-util-types": "^2.0.0"
-      }
-    },
-    "node_modules/micromark-factory-whitespace": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/micromark-factory-whitespace/-/micromark-factory-whitespace-2.0.1.tgz",
-      "integrity": "sha512-Ob0nuZ3PKt/n0hORHyvoD9uZhr+Za8sFoP+OnMcnWK5lngSzALgQYKMr9RJVOWLqQYuyn6ulqGWSXdwf6F80lQ==",
-      "funding": [
-        {
-          "type": "GitHub Sponsors",
-          "url": "https://github.com/sponsors/unifiedjs"
-        },
-        {
-          "type": "OpenCollective",
-          "url": "https://opencollective.com/unified"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "micromark-factory-space": "^2.0.0",
-        "micromark-util-character": "^2.0.0",
-        "micromark-util-symbol": "^2.0.0",
-        "micromark-util-types": "^2.0.0"
-      }
-    },
     "node_modules/micromark-util-character": {
       "version": "2.1.1",
       "resolved": "https://registry.npmjs.org/micromark-util-character/-/micromark-util-character-2.1.1.tgz",
       "integrity": "sha512-wv8tdUTJ3thSFFFJKtpYKOYiGP2+v96Hvk4Tu8KpCAsTMs6yi+nVmGh1syvSCsaxz45J6Jbw+9DD6g97+NV67Q==",
+      "dev": true,
       "funding": [
         {
           "type": "GitHub Sponsors",
@@ -12720,130 +12489,11 @@
         "micromark-util-types": "^2.0.0"
       }
     },
-    "node_modules/micromark-util-chunked": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/micromark-util-chunked/-/micromark-util-chunked-2.0.1.tgz",
-      "integrity": "sha512-QUNFEOPELfmvv+4xiNg2sRYeS/P84pTW0TCgP5zc9FpXetHY0ab7SxKyAQCNCc1eK0459uoLI1y5oO5Vc1dbhA==",
-      "funding": [
-        {
-          "type": "GitHub Sponsors",
-          "url": "https://github.com/sponsors/unifiedjs"
-        },
-        {
-          "type": "OpenCollective",
-          "url": "https://opencollective.com/unified"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "micromark-util-symbol": "^2.0.0"
-      }
-    },
-    "node_modules/micromark-util-classify-character": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/micromark-util-classify-character/-/micromark-util-classify-character-2.0.1.tgz",
-      "integrity": "sha512-K0kHzM6afW/MbeWYWLjoHQv1sgg2Q9EccHEDzSkxiP/EaagNzCm7T/WMKZ3rjMbvIpvBiZgwR3dKMygtA4mG1Q==",
-      "funding": [
-        {
-          "type": "GitHub Sponsors",
-          "url": "https://github.com/sponsors/unifiedjs"
-        },
-        {
-          "type": "OpenCollective",
-          "url": "https://opencollective.com/unified"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "micromark-util-character": "^2.0.0",
-        "micromark-util-symbol": "^2.0.0",
-        "micromark-util-types": "^2.0.0"
-      }
-    },
-    "node_modules/micromark-util-combine-extensions": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/micromark-util-combine-extensions/-/micromark-util-combine-extensions-2.0.1.tgz",
-      "integrity": "sha512-OnAnH8Ujmy59JcyZw8JSbK9cGpdVY44NKgSM7E9Eh7DiLS2E9RNQf0dONaGDzEG9yjEl5hcqeIsj4hfRkLH/Bg==",
-      "funding": [
-        {
-          "type": "GitHub Sponsors",
-          "url": "https://github.com/sponsors/unifiedjs"
-        },
-        {
-          "type": "OpenCollective",
-          "url": "https://opencollective.com/unified"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "micromark-util-chunked": "^2.0.0",
-        "micromark-util-types": "^2.0.0"
-      }
-    },
-    "node_modules/micromark-util-decode-numeric-character-reference": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/micromark-util-decode-numeric-character-reference/-/micromark-util-decode-numeric-character-reference-2.0.2.tgz",
-      "integrity": "sha512-ccUbYk6CwVdkmCQMyr64dXz42EfHGkPQlBj5p7YVGzq8I7CtjXZJrubAYezf7Rp+bjPseiROqe7G6foFd+lEuw==",
-      "funding": [
-        {
-          "type": "GitHub Sponsors",
-          "url": "https://github.com/sponsors/unifiedjs"
-        },
-        {
-          "type": "OpenCollective",
-          "url": "https://opencollective.com/unified"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "micromark-util-symbol": "^2.0.0"
-      }
-    },
-    "node_modules/micromark-util-decode-string": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/micromark-util-decode-string/-/micromark-util-decode-string-2.0.1.tgz",
-      "integrity": "sha512-nDV/77Fj6eH1ynwscYTOsbK7rR//Uj0bZXBwJZRfaLEJ1iGBR6kIfNmlNqaqJf649EP0F3NWNdeJi03elllNUQ==",
-      "funding": [
-        {
-          "type": "GitHub Sponsors",
-          "url": "https://github.com/sponsors/unifiedjs"
-        },
-        {
-          "type": "OpenCollective",
-          "url": "https://opencollective.com/unified"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "decode-named-character-reference": "^1.0.0",
-        "micromark-util-character": "^2.0.0",
-        "micromark-util-decode-numeric-character-reference": "^2.0.0",
-        "micromark-util-symbol": "^2.0.0"
-      }
-    },
-    "node_modules/micromark-util-edit-map": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/micromark-util-edit-map/-/micromark-util-edit-map-1.0.0.tgz",
-      "integrity": "sha512-Pa2ljlsEL6sVwFaYeyrOLSYbQt73JvGbPOYFq+9AElXiSnfI5Q4465RRZ1sHv7lDjDOnGRDDaqPXqClqWK/q1Q==",
-      "funding": [
-        {
-          "type": "GitHub Sponsors",
-          "url": "https://github.com/sponsors/unifiedjs"
-        },
-        {
-          "type": "OpenCollective",
-          "url": "https://opencollective.com/unified"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "micromark-util-types": "^2.0.0"
-      }
-    },
     "node_modules/micromark-util-encode": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/micromark-util-encode/-/micromark-util-encode-2.0.1.tgz",
       "integrity": "sha512-c3cVx2y4KqUnwopcO9b/SCdo2O67LwJJ/UyqGfbigahfegL9myoEFoDYZgkT7f36T0bLrM9hZTAaAyH+PCAXjw==",
+      "dev": true,
       "funding": [
         {
           "type": "GitHub Sponsors",
@@ -12856,64 +12506,11 @@
       ],
       "license": "MIT"
     },
-    "node_modules/micromark-util-html-tag-name": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/micromark-util-html-tag-name/-/micromark-util-html-tag-name-2.0.1.tgz",
-      "integrity": "sha512-2cNEiYDhCWKI+Gs9T0Tiysk136SnR13hhO8yW6BGNyhOC4qYFnwF1nKfD3HFAIXA5c45RrIG1ub11GiXeYd1xA==",
-      "funding": [
-        {
-          "type": "GitHub Sponsors",
-          "url": "https://github.com/sponsors/unifiedjs"
-        },
-        {
-          "type": "OpenCollective",
-          "url": "https://opencollective.com/unified"
-        }
-      ],
-      "license": "MIT"
-    },
-    "node_modules/micromark-util-normalize-identifier": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/micromark-util-normalize-identifier/-/micromark-util-normalize-identifier-2.0.1.tgz",
-      "integrity": "sha512-sxPqmo70LyARJs0w2UclACPUUEqltCkJ6PhKdMIDuJ3gSf/Q+/GIe3WKl0Ijb/GyH9lOpUkRAO2wp0GVkLvS9Q==",
-      "funding": [
-        {
-          "type": "GitHub Sponsors",
-          "url": "https://github.com/sponsors/unifiedjs"
-        },
-        {
-          "type": "OpenCollective",
-          "url": "https://opencollective.com/unified"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "micromark-util-symbol": "^2.0.0"
-      }
-    },
-    "node_modules/micromark-util-resolve-all": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/micromark-util-resolve-all/-/micromark-util-resolve-all-2.0.1.tgz",
-      "integrity": "sha512-VdQyxFWFT2/FGJgwQnJYbe1jjQoNTS4RjglmSjTUlpUMa95Htx9NHeYW4rGDJzbjvCsl9eLjMQwGeElsqmzcHg==",
-      "funding": [
-        {
-          "type": "GitHub Sponsors",
-          "url": "https://github.com/sponsors/unifiedjs"
-        },
-        {
-          "type": "OpenCollective",
-          "url": "https://opencollective.com/unified"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "micromark-util-types": "^2.0.0"
-      }
-    },
     "node_modules/micromark-util-sanitize-uri": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/micromark-util-sanitize-uri/-/micromark-util-sanitize-uri-2.0.1.tgz",
       "integrity": "sha512-9N9IomZ/YuGGZZmQec1MbgxtlgougxTodVwDzzEouPKo3qFWvymFHWcnDi2vzV1ff6kas9ucW+o3yzJK9YB1AQ==",
+      "dev": true,
       "funding": [
         {
           "type": "GitHub Sponsors",
@@ -12931,32 +12528,11 @@
         "micromark-util-symbol": "^2.0.0"
       }
     },
-    "node_modules/micromark-util-subtokenize": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/micromark-util-subtokenize/-/micromark-util-subtokenize-2.1.0.tgz",
-      "integrity": "sha512-XQLu552iSctvnEcgXw6+Sx75GflAPNED1qx7eBJ+wydBb2KCbRZe+NwvIEEMM83uml1+2WSXpBAcp9IUCgCYWA==",
-      "funding": [
-        {
-          "type": "GitHub Sponsors",
-          "url": "https://github.com/sponsors/unifiedjs"
-        },
-        {
-          "type": "OpenCollective",
-          "url": "https://opencollective.com/unified"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "devlop": "^1.0.0",
-        "micromark-util-chunked": "^2.0.0",
-        "micromark-util-symbol": "^2.0.0",
-        "micromark-util-types": "^2.0.0"
-      }
-    },
     "node_modules/micromark-util-symbol": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/micromark-util-symbol/-/micromark-util-symbol-2.0.1.tgz",
       "integrity": "sha512-vs5t8Apaud9N28kgCrRUdEed4UJ+wWNvicHLPxCa9ENlYuAY31M0ETy5y1vA33YoNPDFTghEbnh6efaE8h4x0Q==",
+      "dev": true,
       "funding": [
         {
           "type": "GitHub Sponsors",
@@ -12973,6 +12549,7 @@
       "version": "2.0.3",
       "resolved": "https://registry.npmjs.org/micromark-util-types/-/micromark-util-types-2.0.3.tgz",
       "integrity": "sha512-oxB2Ik03hI0gv+VNn9tnh1t1YEe9MDPptViAEgfdf3YQHsn0pzGTgCdlSCJXcwhqm8phaEuM7zeEu3QQzVBrPg==",
+      "dev": true,
       "funding": [
         {
           "type": "GitHub Sponsors",
@@ -16952,6 +16529,7 @@
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/unist-util-stringify-position/-/unist-util-stringify-position-4.0.0.tgz",
       "integrity": "sha512-0ASV06AAoKCDkS2+xw5RXJywruurpbC4JZSm7nr7MOt1ojAzvyyaO+UxZf18j8FCF6kmzCZKcAgN/yu2gm2XgQ==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/unist": "^3.0.0"
@@ -17727,8 +17305,7 @@
       "license": "Apache-2.0",
       "dependencies": {
         "intl-messageformat": "11.2.15",
-        "marked": "18.0.11",
-        "mdast-util-from-markdown": "^2.1.0"
+        "marked": "18.0.11"
       }
     },
     "packages/core/node_modules/@formatjs/icu-messageformat-parser": {
diff --git a/packages/cli/THIRD_PARTY_NOTICES.txt b/packages/cli/THIRD_PARTY_NOTICES.txt
index 009d0f561c..3f9fe4fb2c 100644
--- a/packages/cli/THIRD_PARTY_NOTICES.txt
+++ b/packages/cli/THIRD_PARTY_NOTICES.txt
@@ -1723,96 +1723,6 @@ SOFTWARE.
 
 ================================================================================
 
-Package: @types/debug@4.1.13
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/DefinitelyTyped/DefinitelyTyped.git#types/debug
-
---- LICENSE ---
-MIT License
-
-    Copyright (c) Microsoft Corporation.
-
-    Permission is hereby granted, free of charge, to any person obtaining a copy
-    of this software and associated documentation files (the "Software"), to deal
-    in the Software without restriction, including without limitation the rights
-    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-    copies of the Software, and to permit persons to whom the Software is
-    furnished to do so, subject to the following conditions:
-
-    The above copyright notice and this permission notice shall be included in all
-    copies or substantial portions of the Software.
-
-    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-    SOFTWARE
-
-================================================================================
-
-Package: @types/mdast@4.0.4
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/DefinitelyTyped/DefinitelyTyped.git#types/mdast
-
---- LICENSE ---
-MIT License
-
-    Copyright (c) Microsoft Corporation.
-
-    Permission is hereby granted, free of charge, to any person obtaining a copy
-    of this software and associated documentation files (the "Software"), to deal
-    in the Software without restriction, including without limitation the rights
-    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-    copies of the Software, and to permit persons to whom the Software is
-    furnished to do so, subject to the following conditions:
-
-    The above copyright notice and this permission notice shall be included in all
-    copies or substantial portions of the Software.
-
-    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-    SOFTWARE
-
-================================================================================
-
-Package: @types/ms@2.1.0
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/DefinitelyTyped/DefinitelyTyped.git#types/ms
-
---- LICENSE ---
-MIT License
-
-    Copyright (c) Microsoft Corporation.
-
-    Permission is hereby granted, free of charge, to any person obtaining a copy
-    of this software and associated documentation files (the "Software"), to deal
-    in the Software without restriction, including without limitation the rights
-    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-    copies of the Software, and to permit persons to whom the Software is
-    furnished to do so, subject to the following conditions:
-
-    The above copyright notice and this permission notice shall be included in all
-    copies or substantial portions of the Software.
-
-    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-    SOFTWARE
-
-================================================================================
-
 Package: @types/node@26.6.3
 Declared license: MIT
 Selected license: MIT
@@ -1903,36 +1813,6 @@ MIT License
 
 ================================================================================
 
-Package: @types/unist@3.0.3
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/DefinitelyTyped/DefinitelyTyped.git#types/unist
-
---- LICENSE ---
-MIT License
-
-    Copyright (c) Microsoft Corporation.
-
-    Permission is hereby granted, free of charge, to any person obtaining a copy
-    of this software and associated documentation files (the "Software"), to deal
-    in the Software without restriction, including without limitation the rights
-    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-    copies of the Software, and to permit persons to whom the Software is
-    furnished to do so, subject to the following conditions:
-
-    The above copyright notice and this permission notice shall be included in all
-    copies or substantial portions of the Software.
-
-    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-    SOFTWARE
-
-================================================================================
-
 Package: @vercel/oidc@3.2.0
 Declared license: Apache-2.0
 Selected license: Apache-2.0
@@ -3234,37 +3114,6 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 
 ================================================================================
 
-Package: character-entities@2.0.2
-Declared license: MIT
-Selected license: MIT
-Repository: wooorm/character-entities
-
---- license ---
-(The MIT License)
-
-Copyright (c) 2015 Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
 Package: cliui@6.0.0
 Declared license: ISC
 Selected license: ISC
@@ -3519,37 +3368,6 @@ THE SOFTWARE.
 
 ================================================================================
 
-Package: decode-named-character-reference@1.3.0
-Declared license: MIT
-Selected license: MIT
-Repository: wooorm/decode-named-character-reference
-
---- license ---
-(The MIT License)
-
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
 Package: delayed-stream@1.0.0
 Declared license: MIT
 Selected license: MIT
@@ -3578,67 +3396,6 @@ THE SOFTWARE.
 
 ================================================================================
 
-Package: dequal@2.0.3
-Declared license: MIT
-Selected license: MIT
-Repository: lukeed/dequal
-
---- license ---
-The MIT License (MIT)
-
-Copyright (c) Luke Edwards <luke.edwards05@gmail.com> (lukeed.com)
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.
-
-================================================================================
-
-Package: devlop@1.1.0
-Declared license: MIT
-Selected license: MIT
-Repository: wooorm/devlop
-
---- license ---
-(The MIT License)
-
-Copyright (c) 2023 Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
 Package: dijkstrajs@1.0.3
 Declared license: MIT
 Selected license: MIT
@@ -5900,15 +5657,16 @@ SOFTWARE.
 
 ================================================================================
 
-Package: mdast-util-from-markdown@2.1.0
+Package: mime-db@1.52.0
 Declared license: MIT
 Selected license: MIT
-Repository: syntax-tree/mdast-util-from-markdown
+Repository: jshttp/mime-db
 
---- license ---
+--- LICENSE ---
 (The MIT License)
 
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
+Copyright (c) 2014 Jonathan Ong <me@jongleberry.com>
+Copyright (c) 2015-2022 Douglas Christopher Wilson <doug@somethingdoug.com>
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the
@@ -5931,15 +5689,16 @@ SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ================================================================================
 
-Package: mdast-util-to-string@4.0.0
+Package: mime-types@2.1.35
 Declared license: MIT
 Selected license: MIT
-Repository: syntax-tree/mdast-util-to-string
+Repository: jshttp/mime-types
 
---- license ---
+--- LICENSE ---
 (The MIT License)
 
-Copyright (c) 2015 Titus Wormer <tituswormer@gmail.com>
+Copyright (c) 2014 Jonathan Ong <me@jongleberry.com>
+Copyright (c) 2015 Douglas Christopher Wilson <doug@somethingdoug.com>
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the
@@ -5962,763 +5721,17 @@ SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ================================================================================
 
-Package: micromark@4.0.3
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/micromark/micromark/tree/main/packages/micromark
+Package: minimatch@10.2.5
+Declared license: BlueOak-1.0.0
+Selected license: BlueOak-1.0.0
+Repository: git@github.com:isaacs/minimatch
 
---- license ---
-(The MIT License)
+--- LICENSE.md ---
+# Blue Oak Model License
 
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
+Version 1.0.0
 
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
-Package: micromark-core-commonmark@2.0.4
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-core-commonmark
-
---- license ---
-(The MIT License)
-
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
-Package: micromark-factory-destination@2.0.1
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-factory-destination
-
---- license ---
-(The MIT License)
-
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
-Package: micromark-factory-label@2.0.1
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-factory-label
-
---- license ---
-(The MIT License)
-
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
-Package: micromark-factory-space@2.1.0
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-factory-space
-
---- license ---
-(The MIT License)
-
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
-Package: micromark-factory-title@2.0.1
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-factory-title
-
---- license ---
-(The MIT License)
-
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
-Package: micromark-factory-whitespace@2.0.1
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-factory-whitespace
-
---- license ---
-(The MIT License)
-
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
-Package: micromark-util-character@2.1.1
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-character
-
---- license ---
-(The MIT License)
-
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
-Package: micromark-util-chunked@2.0.1
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-chunked
-
---- license ---
-(The MIT License)
-
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
-Package: micromark-util-classify-character@2.0.1
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-classify-character
-
---- license ---
-(The MIT License)
-
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
-Package: micromark-util-combine-extensions@2.0.1
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-combine-extensions
-
---- license ---
-(The MIT License)
-
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
-Package: micromark-util-decode-numeric-character-reference@2.0.2
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-decode-numeric-character-reference
-
---- license ---
-(The MIT License)
-
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
-Package: micromark-util-decode-string@2.0.1
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-decode-string
-
---- license ---
-(The MIT License)
-
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
-Package: micromark-util-edit-map@1.0.0
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-edit-map
-
---- license ---
-(The MIT License)
-
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
-Package: micromark-util-encode@2.0.1
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-encode
-
---- license ---
-(The MIT License)
-
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
-Package: micromark-util-html-tag-name@2.0.1
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-html-tag-name
-
---- license ---
-(The MIT License)
-
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
-Package: micromark-util-normalize-identifier@2.0.1
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-normalize-identifier
-
---- license ---
-(The MIT License)
-
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
-Package: micromark-util-resolve-all@2.0.1
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-resolve-all
-
---- license ---
-(The MIT License)
-
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
-Package: micromark-util-sanitize-uri@2.0.1
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-sanitize-uri
-
---- license ---
-(The MIT License)
-
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
-Package: micromark-util-subtokenize@2.1.0
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-subtokenize
-
---- license ---
-(The MIT License)
-
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
-Package: micromark-util-symbol@2.0.1
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-symbol
-
---- license ---
-(The MIT License)
-
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
-Package: micromark-util-types@2.0.3
-Declared license: MIT
-Selected license: MIT
-Repository: https://github.com/micromark/micromark/tree/main/packages/micromark-util-types
-
---- license ---
-(The MIT License)
-
-Copyright (c) Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
-Package: mime-db@1.52.0
-Declared license: MIT
-Selected license: MIT
-Repository: jshttp/mime-db
-
---- LICENSE ---
-(The MIT License)
-
-Copyright (c) 2014 Jonathan Ong <me@jongleberry.com>
-Copyright (c) 2015-2022 Douglas Christopher Wilson <doug@somethingdoug.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
-Package: mime-types@2.1.35
-Declared license: MIT
-Selected license: MIT
-Repository: jshttp/mime-types
-
---- LICENSE ---
-(The MIT License)
-
-Copyright (c) 2014 Jonathan Ong <me@jongleberry.com>
-Copyright (c) 2015 Douglas Christopher Wilson <doug@somethingdoug.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
-Package: minimatch@10.2.5
-Declared license: BlueOak-1.0.0
-Selected license: BlueOak-1.0.0
-Repository: git@github.com:isaacs/minimatch
-
---- LICENSE.md ---
-# Blue Oak Model License
-
-Version 1.0.0
-
-## Purpose
+## Purpose
 
 This license gives everyone as much permission to work with
 this software as possible, while protecting contributors
@@ -6852,36 +5865,6 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 
 ================================================================================
 
-Package: ms@2.1.3
-Declared license: MIT
-Selected license: MIT
-Repository: vercel/ms
-
---- license.md ---
-The MIT License (MIT)
-
-Copyright (c) 2020 Vercel, Inc.
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-
-================================================================================
-
 Package: node-addon-api@7.1.1
 Declared license: MIT
 Selected license: MIT
@@ -8521,37 +7504,6 @@ SOFTWARE.
 
 ================================================================================
 
-Package: unist-util-stringify-position@4.0.0
-Declared license: MIT
-Selected license: MIT
-Repository: syntax-tree/unist-util-stringify-position
-
---- license ---
-(The MIT License)
-
-Copyright (c) 2016 Titus Wormer <tituswormer@gmail.com>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-================================================================================
-
 Package: which@2.0.2
 Declared license: ISC
 Selected license: ISC
diff --git a/packages/core/package.json b/packages/core/package.json
index f0b1c42e00..cdfa244469 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -2,7 +2,7 @@
   "name": "@maka/core",
   "version": "0.1.0",
   "license": "Apache-2.0",
-  "description": "Pure types for Maka \u2014 events, session, permission, connections.",
+  "description": "Pure types for Maka — events, session, permission, connections.",
   "type": "module",
   "sideEffects": false,
   "private": true,
@@ -182,7 +182,6 @@
   },
   "dependencies": {
     "intl-messageformat": "11.2.15",
-    "mdast-util-from-markdown": "^2.1.0",
     "marked": "18.0.11"
   }
 }
diff --git a/packages/core/src/__tests__/image-markdown.test.ts b/packages/core/src/__tests__/image-markdown.test.ts
index b383995701..f65102d253 100644
--- a/packages/core/src/__tests__/image-markdown.test.ts
+++ b/packages/core/src/__tests__/image-markdown.test.ts
@@ -19,11 +19,7 @@
 
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
-import {
-  positionedMarkdownImages,
-  markdownImageSources,
-  parseMarkdownImageDestination,
-} from '../image-markdown.js';
+import { markdownImageSources, parseMarkdownImageDestination } from '../image-markdown.js';
 import { IMAGE_MARKDOWN_MAX_LENGTH } from '../image-delivery.js';
 
 test('canonical destinations retain document order, references and explicit attachments', () => {
@@ -73,31 +69,10 @@ test('inline destinations require one complete image token with no trailing synt
     assert.equal(parseMarkdownImageDestination(source), undefined);
 });
 
-test('canonical image ranges address exact occurrences without touching shared definitions or examples', () => {
-  const text =
-    '`![code][p]`\n\n> ![one][p]\n\n![two][p]\n\n[p]: <https://example.com/a.png?token=secret>\n';
-  const refs = positionedMarkdownImages(text);
-  assert.deepEqual(
-    refs.map((ref) => ref.raw),
-    ['![one][p]', '![two][p]'],
-  );
-  assert.deepEqual(
-    refs.map((ref) => text.slice(ref.start, ref.end)),
-    refs.map((ref) => ref.raw),
-  );
-  assert.deepEqual(
-    refs.map((ref) => ref.alt),
-    ['one', 'two'],
-  );
-  assert.ok(refs.every((ref) => ref.source === 'https://example.com/a.png?token=secret'));
-});
-
-test('position adapters preserve existing GFM exclusions and archived entity identities', () => {
+test('canonical destinations preserve GFM exclusions and archived entity identities', () => {
   for (const text of ['https://example.com/![x](/tmp/a.png)', 'www.example.com/![x](/tmp/a.png)']) {
     assert.deepEqual(markdownImageSources(text), []);
-    assert.deepEqual(positionedMarkdownImages(text), []);
   }
   const text = '![x](https://example.com/a?token=secret&amp;v=1)';
   assert.deepEqual(markdownImageSources(text), ['https://example.com/a?token=secret&amp;v=1']);
-  assert.equal(positionedMarkdownImages(text)[0]?.source, markdownImageSources(text)[0]);
 });
diff --git a/packages/core/src/image-delivery.ts b/packages/core/src/image-delivery.ts
index 23ec235260..ef71bfeaa7 100644
--- a/packages/core/src/image-delivery.ts
+++ b/packages/core/src/image-delivery.ts
@@ -17,8 +17,6 @@
  * under the License.
  */
 
-import type { ArtifactBinaryReadResult } from './artifacts.js';
-
 /** Client-safe delivery contract. No filesystem or networking capabilities live here. */
 export const IMAGE_DELIVERY_IDENTITY_MAX_LENGTH = 512;
 export const IMAGE_DELIVERY_SOURCE_MAX_LENGTH = 4096;
@@ -96,16 +94,6 @@ export type ResolveImageDelivery = (
   sessionId: string,
   request: ImageDeliveryRequest,
 ) => Promise<ImageDeliveryResult>;
-export type ReadAttachmentBytes = (
-  sessionId: string,
-  artifactId: string,
-) => Promise<ArtifactBinaryReadResult>;
-
-/** Narrow transcript image capabilities shared by the UI and desktop adapters. */
-export interface ChatImageServices {
-  readBytes: ReadAttachmentBytes;
-  resolveImageDelivery?: ResolveImageDelivery;
-}
 /** Stored with its Artifact, so session copy/export carries both provenance and bytes. */
 export interface ImageDeliveryMetadata {
   readonly messageId: string;
diff --git a/packages/core/src/image-markdown.ts b/packages/core/src/image-markdown.ts
index ae27460cfe..5d823080c6 100644
--- a/packages/core/src/image-markdown.ts
+++ b/packages/core/src/image-markdown.ts
@@ -18,8 +18,6 @@
  */
 
 import { Lexer, Marked } from 'marked';
-import { fromMarkdown } from 'mdast-util-from-markdown';
-import type { Nodes } from 'mdast';
 import { IMAGE_MARKDOWN_MAX_LENGTH } from './image-delivery.js';
 
 const parser = new Marked({ gfm: true });
@@ -47,30 +45,3 @@ export function parseMarkdownImageDestination(source: string): string | undefine
   const [token] = Lexer.lexInline(markdown, { gfm: true });
   return token?.type === 'image' && token.raw === markdown ? token.href : undefined;
 }
-
-/** Source ranges are an adapter detail; canonical destinations retain Marked's
- * existing GFM and entity semantics, including identities saved by older Hosts. */
-export function positionedMarkdownImages(text: string) {
-  const images = markdownImages(text);
-  if (!images.length) return [];
-  const destinations = new Map(images.map((image) => [image.raw, image.source]));
-  const canonical = new Set(images.map((image) => image.source));
-  const positioned: { raw: string; source: string; alt: string; start: number; end: number }[] = [];
-  const pending: Nodes[] = [fromMarkdown(text)];
-  while (pending.length) {
-    const node = pending.pop()!;
-    if (node.type === 'image' || node.type === 'imageReference') {
-      const start = node.position?.start.offset;
-      const end = node.position?.end.offset;
-      if (start === undefined || end === undefined) continue;
-      const raw = text.slice(start, end);
-      const source =
-        destinations.get(raw) ??
-        (node.type === 'image' && canonical.has(node.url) ? node.url : undefined);
-      if (source !== undefined) positioned.push({ raw, source, alt: node.alt ?? '', start, end });
-    } else if ('children' in node) {
-      for (let i = node.children.length - 1; i >= 0; i--) pending.push(node.children[i]!);
-    }
-  }
-  return positioned;
-}
diff --git a/packages/ui/scripts/markdown-images.browser.test.mjs b/packages/ui/scripts/markdown-images.browser.test.mjs
index 04517d3f8a..07f1ac33fb 100644
--- a/packages/ui/scripts/markdown-images.browser.test.mjs
+++ b/packages/ui/scripts/markdown-images.browser.test.mjs
@@ -128,19 +128,10 @@ before(async () => {
     'geometry-remote': `![Screenshot](${imageUrl}/delayed.png)\n\nFollowing paragraph`,
     'geometry-saved': '![Screenshot](/tmp/private.png)\n\nFollowing paragraph',
     'streaming-angle-race': '![Screenshot](</tmp/my image.png>)',
-    'signed-saved': `![Screenshot](${imageUrl}/image.png?token=first-secret)`,
-    'signature-saved': `![Screenshot](${imageUrl}/image.png?signature=second-secret&expires=123)`,
-    'hash-saved': `![Screenshot](/tmp/${'a'.repeat(48)}.png)`,
-    'secret-reference-saved': `![Screenshot][picture]\n\n[picture]: ${imageUrl}/image.png?token=reference-secret`,
-    'signed-streaming-race': `![Screenshot](${imageUrl}/image.png?token=stream-secret)`,
-    'signed-corrupt-saved': `![Screenshot](${imageUrl}/image.png?token=corrupt-secret)`,
     'signed-remote': `![Screenshot](${imageUrl}/image.png?token=remote-secret)`,
     'signed-inline': `Build ![Badge](${imageUrl}/image.png?token=inline-secret) passing.`,
     'signed-failed': `![Screenshot](${imageUrl}/image.png?token=failed-secret)`,
-    'secret-alt': `![https://example.invalid/?token=alt-secret](${imageUrl}/image.png)`,
     'signed-preview': `![Screenshot](${imageUrl}/image.png?token=preview-secret)`,
-    'signed-duplicates-saved': `![First](${imageUrl}/image.png?token=first-secret) ![Second](${imageUrl}/image.png?token=second-secret)`,
-    'signed-live-saved': `![Screenshot](${imageUrl}/image.png?token=live-`,
     screenshot: `![Screenshot](${imageUrl}/screenshot.png)`,
   };
   const canonicalSources = {
@@ -150,13 +141,6 @@ before(async () => {
     'reference-saved': ['/tmp/my "image".png'],
     'geometry-saved': ['/tmp/private.png'],
     'streaming-angle-race': ['/tmp/my image.png'],
-    'signed-saved': [`${imageUrl}/image.png?token=first-secret`],
-    'signature-saved': [`${imageUrl}/image.png?signature=second-secret&expires=123`],
-    'hash-saved': [`/tmp/${'a'.repeat(48)}.png`],
-    'secret-reference-saved': [`${imageUrl}/image.png?token=reference-secret`],
-    'signed-streaming-race': [`${imageUrl}/image.png?token=stream-secret`],
-    'signed-duplicates-saved': [`${imageUrl}/image.png?token=first-secret`, `${imageUrl}/image.png?token=second-secret`],
-    'signed-live-saved': [`${imageUrl}/image.png?token=live-secret`],
   };
   const bundle = await build({
     stdin: { contents: `
@@ -300,9 +284,9 @@ test('image links do not expose signed destinations or enable unsafe schemes', a
   requests = [];
   const page = await pageFor('links-redacted');
   try {
-    await page.getByText('Signed', {exact:true}).waitFor();
+    await page.locator('[data-maka-contract="markdown"]').waitFor();
     assert.equal(await page.locator('a, img, .maka-markdown-image-resource').count(), 0);
-    assert.doesNotMatch(await page.locator('#root').innerHTML(), /reasoning-secret|maka-image-display:/);
+    assert.doesNotMatch(await page.locator('#root').innerHTML(), /reasoning-secret/);
     assert.deepEqual(await page.evaluate(() => [window.deliveryQueries, window.imageReads]), [0, 0]);
     assert.deepEqual(requests, []);
   } finally { await page.close(); }
@@ -344,7 +328,7 @@ for (const scenario of ['preview', 'signed-preview']) {
     const page = await pageFor(scenario);
     try {
       if(scenario==='signed-preview') {
-        await page.getByText('The image address contains hidden sensitive information. Loading and opening it are disabled.', {exact:true}).waitFor();
+        await page.locator('[data-maka-contract="markdown"]').waitFor();
         assert.equal(await page.getByText('Open in browser', {exact:true}).count(), 0);
       } else {
         await page.getByText('Remote images cannot be loaded here. You can open this image in your browser.', {exact:true}).waitFor();
@@ -371,9 +355,7 @@ for (const scenario of ['signed-remote', 'signed-inline', 'signed-failed']) {
     requests = [];
     const page = await pageFor(scenario);
     try {
-      const message = 'The image address contains hidden sensitive information. Loading and opening it are disabled.';
-      if (scenario === 'signed-inline') await page.getByRole('status', {name: message, exact: true}).waitFor();
-      else await page.getByText(message, {exact: true}).waitFor();
+      await page.locator('[data-maka-contract="markdown"]').waitFor();
       assert.equal(await page.getByRole('button', {name: 'Load image', exact: true}).count(), 0);
       assert.equal(await page.getByRole('button', {name: 'Retry', exact: true}).count(), 0);
       assert.equal(await page.getByText('Open in browser', {exact: true}).count(), 0);
@@ -385,16 +367,6 @@ for (const scenario of ['signed-remote', 'signed-inline', 'signed-failed']) {
   });
 }
 
-test('redacting only image alt text does not disable a safe destination', async () => {
-  requests = [];
-  const page = await pageFor('secret-alt');
-  try {
-    assert.doesNotMatch(await page.locator('body').innerText(), /alt-secret/);
-    await loaded(page);
-    assert.equal(requests.length, 1);
-  } finally { await page.close(); }
-});
-
 test('application privacy policy prevents automatic image loading and can be rechecked', async () => {
   requests = [];
   const page = await pageFor('privacy');
@@ -408,35 +380,6 @@ test('application privacy policy prevents automatic image loading and can be rec
   } finally { await page.close(); }
 });
 
-test('two signed destinations which redact alike replay their own saved attachments', async () => {
-  requests = [];
-  const page = await pageFor('signed-duplicates-saved');
-  try {
-    await page.waitForFunction(() => document.images.length === 2 && [...document.images].every(image => image.src.startsWith('data:') && image.naturalWidth === 1));
-    assert.deepEqual(await page.evaluate(() => window.deliverySources), [
-      `${imageUrl}/image.png?token=first-secret`, `${imageUrl}/image.png?token=second-secret`,
-    ]);
-    assert.deepEqual(requests, []);
-    assert.doesNotMatch(await page.locator('body').innerText(), /first-secret|second-secret/);
-  } finally { await page.close(); }
-});
-
-test('a signed image completed by a later text delta resolves its original destination', async () => {
-  requests = [];
-  const page = await pageFor('signed-live-saved');
-  try {
-    await page.waitForFunction(() => typeof window.appendText === 'function');
-    assert.equal(await page.locator('img').count(), 0);
-    await page.evaluate(() => window.appendText('secret)'));
-    await loaded(page);
-    assert.equal(await page.evaluate(() => window.deliverySource), `${imageUrl}/image.png?token=live-secret`);
-    await page.evaluate(() => window.finishStream());
-    await loaded(page);
-    assert.deepEqual(requests, []);
-    assert.doesNotMatch(await page.locator('body').innerText(), /live-secret/);
-  } finally { await page.close(); }
-});
-
 test('failed remote image has a working retry control instead of a broken image icon', async () => {
   failedOnce = false;
   const page = await pageFor('retry');
@@ -461,7 +404,7 @@ test('attachment read failure recovers in place, and local paths explain how to
   } finally { await page.close(); }
 });
 
-for (const scenario of ['corrupt-saved', 'signed-corrupt-saved']) {
+for (const scenario of ['corrupt-saved']) {
   test(`${scenario}: a saved image decode failure retries archived bytes without touching its source`, async () => {
     requests = [];
     const page = await pageFor(scenario);
@@ -474,7 +417,6 @@ for (const scenario of ['corrupt-saved', 'signed-corrupt-saved']) {
       assert.equal(await page.evaluate(() => window.deliveryQueries), 1);
       assert.equal(await page.evaluate(() => window.imageReads), 2);
       assert.deepEqual(requests, []);
-      if(scenario==='signed-corrupt-saved') assert.equal(await page.getByText('Open in browser', {exact:true}).count(), 0);
     } finally { await page.close(); }
   });
 
@@ -576,7 +518,7 @@ test('a pending archive stays a placeholder until saved bytes are available', as
   } finally { await page.close(); }
 });
 
-for (const scenario of ['streaming-race', 'settled-race', 'streaming-angle-race', 'signed-streaming-race']) {
+for (const scenario of ['streaming-race', 'settled-race', 'streaming-angle-race']) {
   test(`${scenario}: an unavailable live source recovers in place once Host archival completes`, async () => {
     const page = await pageFor(scenario);
     try {
@@ -594,7 +536,7 @@ for (const scenario of ['streaming-race', 'settled-race', 'streaming-angle-race'
   });
 }
 
-for (const scenario of ['angle-saved', 'title-saved', 'escaped-saved', 'reference-saved', 'attachment-title', 'signed-saved', 'signature-saved', 'hash-saved', 'secret-reference-saved']) {
+for (const scenario of ['angle-saved', 'title-saved', 'escaped-saved', 'reference-saved', 'attachment-title']) {
   test(`${scenario}: standard Markdown destinations resolve to saved bytes without origin requests`, async () => {
     requests = [];
     const page = await pageFor(scenario);
diff --git a/packages/ui/src/__tests__/attachment-image.test.tsx b/packages/ui/src/__tests__/attachment-image.test.tsx
index e9e327ed90..1203e69db4 100644
--- a/packages/ui/src/__tests__/attachment-image.test.tsx
+++ b/packages/ui/src/__tests__/attachment-image.test.tsx
@@ -29,8 +29,6 @@ import {
 } from '../attachment-image.js';
 import { LocaleProvider } from '../locale-context.js';
 import { MarkdownBody } from '../markdown-body.js';
-import { Markdown } from '../markdown.js';
-import { ImageDeliveryProvider, ImageMessageProvider } from '../image-delivery.js';
 import type { TurnViewModel } from '../materialize.js';
 
 const originalGlobals = {
@@ -84,41 +82,6 @@ async function renderAttachmentMarkdown(text: string, readBytes: ReadAttachmentB
   return { container, root };
 }
 
-test('the complete Markdown entry resolves original signed and hashed destinations after redacting display text', async () => {
-  const sources = [
-    'https://example.com/image.png?token=first-secret',
-    'https://example.com/image.png?token=second-secret',
-    `/tmp/${'a'.repeat(48)}.png`,
-  ];
-  const { container, root } = domRoot();
-  const requested: string[] = [];
-  await act(async () => {
-    root.render(
-      <LocaleProvider locale="en">
-        <SessionAttachmentProvider sessionId="session-1" readBytes={async () => ({ ok: true, base64: 'aW1n', mimeType: 'image/png' })}>
-          <ImageDeliveryProvider sessionId="session-1" resolve={async (sessionId, request) => {
-            assert.equal(sessionId, 'session-1');
-            assert.equal(request.turnId, 'turn-1');
-            assert.equal(request.messageId, 'message-1');
-            requested.push(request.source);
-            assert.ok(sources.includes(request.source));
-            return { status: 'ready', artifactId: `saved-${sources.indexOf(request.source)}` };
-          }}>
-            <ImageMessageProvider identity={{ turnId: 'turn-1', messageId: 'message-1' }}>
-              <Markdown text={sources.map(source => `![Screenshot](${source})`).join('\n\n') + '\n\nAuthorization: Bearer prose-secret'} />
-            </ImageMessageProvider>
-          </ImageDeliveryProvider>
-        </SessionAttachmentProvider>
-      </LocaleProvider>,
-    );
-  });
-  await act(async () => { await import('../markdown-body.js'); });
-  assert.deepEqual(requested, sources);
-  assert.equal(container.querySelectorAll('img').length, sources.length);
-  for (const image of container.querySelectorAll('img')) assert.equal(image.getAttribute('src'), 'data:image/png;base64,aW1n');
-  assert.doesNotMatch(container.textContent ?? '', /first-secret|second-secret|prose-secret|a{48}/);
-});
-
 const TURN_WITH_IMAGE: TurnViewModel = {
   turnId: 'turn-1',
   status: 'completed',
diff --git a/packages/ui/src/__tests__/markdown-body.test.ts b/packages/ui/src/__tests__/markdown-body.test.ts
index c8c9bc88b1..f9f0752c15 100644
--- a/packages/ui/src/__tests__/markdown-body.test.ts
+++ b/packages/ui/src/__tests__/markdown-body.test.ts
@@ -395,17 +395,6 @@ it('redacts secrets before even the lazy Markdown fallback reaches the rendered
   assert.match(markup, /&lt;redacted&gt;/);
 });
 
-it('keeps signed image destinations out of the lazy fallback and rendered prose', () => {
-  const text = '![Screenshot](https://example.com/image.png?token=image-secret)\n\nAuthorization: Bearer prose-secret';
-  for (const markup of [
-    renderToStaticMarkup(createElement(Markdown, { text })),
-    renderToStaticMarkup(createElement(MarkdownBody, { text, redact: true })),
-  ]) {
-    assert.doesNotMatch(markup, /image-secret|prose-secret/);
-    assert.match(markup, /&lt;redacted&gt;/);
-  }
-});
-
 
 
 it('preserves allowlisted Maka navigation links through sanitization', () => {
diff --git a/packages/ui/src/__tests__/markdown-image-redaction.test.ts b/packages/ui/src/__tests__/markdown-image-redaction.test.ts
deleted file mode 100644
index 74b10f9d78..0000000000
--- a/packages/ui/src/__tests__/markdown-image-redaction.test.ts
+++ /dev/null
@@ -1,114 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import assert from 'node:assert/strict';
-import { test } from 'node:test';
-import { markdownImageSources } from '@maka/core/image-markdown';
-import { IMAGE_MARKDOWN_MAX_LENGTH } from '@maka/core/image-delivery';
-import { redactMarkdownImages } from '../markdown-image-redaction.js';
-import { redactSecrets } from '../redact.js';
-
-const signed = 'https://example.com/image.png?token=private-value';
-function resolved(text: string) {
-  const result = redactMarkdownImages(text);
-  return { ...result, destinations: markdownImageSources(result.text).map(source => result.sources.get(source) ?? source) };
-}
-
-test('signed URLs and hashed paths retain their exact Host identities without exposing them as text', () => {
-  for (const source of [signed, signed + '&expires=123', signed.replace('token=', 'signature='), `/tmp/${'a'.repeat(48)}.png`]) {
-    const result = resolved(`![Screenshot](${source})`);
-    assert.deepEqual(result.destinations, [source]);
-    assert.ok(!result.text.includes(source));
-  }
-});
-
-test('destinations which redact to the same text retain separate identities', () => {
-  const other = signed.replace('private-value', 'another-value');
-  const result = resolved(`![one](${signed}) ![two](${other}) ![one again](${signed})`);
-  assert.deepEqual(result.destinations, [signed, other]);
-  assert.equal(result.sources.size, 2);
-});
-
-test('reference images retain original identity while shared ordinary links stay redacted', () => {
-  const result = resolved(`![Screenshot][pic]\n\n[ordinary link][pic]\n\n[pic]: ${signed}`);
-  assert.deepEqual(result.destinations, [signed]);
-  assert.ok(!result.text.includes('private-value'));
-  assert.ok(result.text.includes('[ordinary link][pic]'));
-  assert.ok(result.text.includes(redactSecrets(`[pic]: ${signed}`)));
-});
-
-test('code, HTML, prose and ordinary links remain identical to normal display redaction', () => {
-  const example = `![Screenshot](${signed})`;
-  const nonImages = [
-    '`' + example + '`',
-    '```md\n' + example + '\n```',
-    '<pre>\n' + example + '\n</pre>',
-    `<img src="${signed}">`,
-    `[ordinary](${signed})`,
-    `Prose ${signed}`,
-  ];
-  for (const text of nonImages) {
-    const result = redactMarkdownImages(text);
-    assert.equal(result.text, redactSecrets(text));
-    assert.equal(result.sources.size, 0);
-    const together = redactMarkdownImages(text + '\n\n' + example);
-    assert.ok(together.text.startsWith(redactSecrets(text) + '\n\n'));
-    assert.equal(together.sources.size, 1);
-  }
-});
-
-test('nested Markdown, escaped paths, entities, angle destinations and CRLF keep canonical identities', () => {
-  for (const text of [
-    `> ![Screenshot](${signed})`,
-    `- **![Screenshot](${signed})**`,
-    `| Image |\n| --- |\n| ![Screenshot](${signed}) |`,
-    `[![Screenshot](${signed})](https://example.com)`,
-    `![Screenshot](<${signed}> "title")`,
-    `![Screenshot](https://example.com/i?token=a&amp;expires=123)`,
-    String.raw`![Screenshot](/tmp/a\(1\)-${'a'.repeat(48)}.png)`,
-    `Before\r\n\r\n![Screenshot](${signed})\r\n`,
-  ]) {
-    assert.deepEqual(resolved(text).destinations, markdownImageSources(text), text);
-  }
-});
-
-test('image labels, titles and surrounding secrets are still redacted', () => {
-  const result = resolved(`Authorization: Bearer prose-secret\n\n![sk-1234567890abcdef](${signed} "token=title")`);
-  assert.deepEqual(result.destinations, [signed]);
-  assert.ok(!result.text.includes('prose-secret'));
-  assert.ok(!result.text.includes('sk-1234567890abcdef'));
-  assert.ok(!result.text.includes('private-value'));
-});
-
-test('settled and live sources share aliases without accepting source-authored aliases', () => {
-  const settled = `![Screenshot](${signed})`;
-  const authored = '![fake](maka-image-display:0)';
-  const result = redactMarkdownImages(`${settled}\n\n${authored}`, settled);
-  assert.equal(result.sources.has('maka-image-display:0'), false);
-  assert.equal(markdownImageSources(result.text)[0], markdownImageSources(result.settledText!)[0]);
-  assert.ok(!result.text.includes('private-value'));
-});
-
-test('plain messages and oversized or incomplete images retain existing redaction', () => {
-  for (const text of ['Plain **text**', `![x](${signed}`, 'x'.repeat(IMAGE_MARKDOWN_MAX_LENGTH) + `![x](${signed})`]) {
-    const result = redactMarkdownImages(text);
-    assert.equal(result.text, redactSecrets(text));
-    assert.equal(result.sources.size, 0);
-  }
-});
diff --git a/packages/ui/src/attachment-image.tsx b/packages/ui/src/attachment-image.tsx
index 460966dbca..66511959f6 100644
--- a/packages/ui/src/attachment-image.tsx
+++ b/packages/ui/src/attachment-image.tsx
@@ -26,11 +26,14 @@ import {
   useState,
   type ReactNode,
 } from 'react';
-import type { ReadAttachmentBytes } from '@maka/core/image-delivery';
+import type { ArtifactBinaryReadResult } from '@maka/core/artifacts';
 import { decideImageReadOutcome } from './artifact-preview-registry.js';
 
 /** Host capability for reading bytes from the Runtime Host attachment authority. */
-export type { ReadAttachmentBytes } from '@maka/core/image-delivery';
+export type ReadAttachmentBytes = (
+  sessionId: string,
+  artifactId: string,
+) => Promise<ArtifactBinaryReadResult>;
 
 type SessionAttachmentContextValue = {
   sessionId: string;
diff --git a/packages/ui/src/markdown-body.tsx b/packages/ui/src/markdown-body.tsx
index c0670d2dbc..df683852d5 100644
--- a/packages/ui/src/markdown-body.tsx
+++ b/packages/ui/src/markdown-body.tsx
@@ -31,7 +31,6 @@
 
 import { MarkdownImage, createMarkdownImagePlugins } from './markdown-image.js';
 import { useCallback, useContext, useMemo, useRef, type ReactNode } from 'react';
-import { redactMarkdownImages } from './markdown-image-redaction.js';
 import {
   Markdown as AstryxMarkdown,
   type MarkdownComponents,
@@ -144,8 +143,6 @@ const MARKDOWN_COMPONENTS = {
 
 export function MarkdownBody(props: {
   text: string;
-  /** The lazy entry redacts its fallback; the body also preserves image identities. */
-  redact?: boolean;
   imageDisplay?: 'image' | 'link';
   streaming?: boolean;
   settledText?: string;
@@ -156,13 +153,8 @@ export function MarkdownBody(props: {
     (source: string) => prepareMarkdownMath(source, mathCache.current),
     [],
   );
-  const presentation = useMemo(() => props.redact
-    ? redactMarkdownImages(props.text, props.settledText)
-    : { text: props.text, settledText: props.settledText, sources: undefined },
-  [props.redact, props.text, props.settledText]);
-  const plugins = useMemo(() => createMarkdownImagePlugins(props.imageDisplay, presentation.sources),
-    [props.imageDisplay, presentation.sources]);
-  const budgetedText = props.streaming ? presentation.text : applyMermaidRenderBudget(presentation.text);
+  const plugins = useMemo(() => createMarkdownImagePlugins(props.imageDisplay), [props.imageDisplay]);
+  const budgetedText = props.streaming ? props.text : applyMermaidRenderBudget(props.text);
   const density = props.density ?? 'default';
   const components = props.streaming
     ? density === 'compact'
@@ -206,7 +198,7 @@ export function MarkdownBody(props: {
         components={components}
         plugins={plugins}
         isStreaming={props.streaming}
-        settledText={presentation.settledText}
+        settledText={props.settledText}
         transformSource={transformMathSource}
       >
         {budgetedText}
diff --git a/packages/ui/src/markdown-image-redaction.ts b/packages/ui/src/markdown-image-redaction.ts
deleted file mode 100644
index d274ed9e3d..0000000000
--- a/packages/ui/src/markdown-image-redaction.ts
+++ /dev/null
@@ -1,57 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { positionedMarkdownImages } from '@maka/core/image-markdown';
-import { redactSecrets } from './redact.js';
-
-/** Preserve resource identities using the canonical parser's exact source ranges.
- * The alias map is presentation-only and never grants source loading. */
-export function redactMarkdownImages(text: string, settledText?: string) {
-  let prefix = 'maka-image-display:';
-  while (text.includes(prefix) || settledText?.includes(prefix)) prefix += 'x';
-  const sources = new Map<string, string>();
-  const aliases = new Map<string, string>();
-  const prepare = (original: string): string => {
-    const redacted = redactSecrets(original);
-    if (redacted === original) return redacted;
-    const images = positionedMarkdownImages(original).filter(image =>
-      redactSecrets(image.source) !== image.source || redactSecrets(image.raw) !== image.raw);
-    if (!images.length) return redacted;
-    const replacements = images.map(image => {
-      let alias = aliases.get(image.source);
-      if (!alias) {
-        alias = `${prefix}${aliases.size}`;
-        aliases.set(image.source, alias);
-        sources.set(alias, image.source);
-      }
-      const alt = redactSecrets(image.alt).replace(/[\\[\]`*_<>|]/g, '\\$&');
-      return { start: image.start, end: image.end, value: `![${alt}](${alias})` };
-    });
-    let protectedText = original;
-    for (const replacement of replacements.sort((a, b) => b.start - a.start)) {
-      protectedText = protectedText.slice(0, replacement.start) + replacement.value + protectedText.slice(replacement.end);
-    }
-    return redactSecrets(protectedText);
-  };
-  return {
-    text: prepare(text),
-    settledText: settledText === undefined ? undefined : prepare(settledText),
-    sources,
-  };
-}
diff --git a/packages/ui/src/markdown-image.tsx b/packages/ui/src/markdown-image.tsx
index 9d34b90f43..378e9a90fb 100644
--- a/packages/ui/src/markdown-image.tsx
+++ b/packages/ui/src/markdown-image.tsx
@@ -34,7 +34,6 @@ type PlacedImage = MarkdownExtensionNode<'maka-images', 'image', { src: string;
 // their natural dimensions within the presentation's CSS bounds.
 export function createMarkdownImagePlugins(
   display: 'image' | 'link' = 'image',
-  sources?: ReadonlyMap<string, string>,
 ) {
   return [createMarkdownPlugin<'maka-images', PlacedImage>({
     name: 'maka-images', apiVersion: 1,
@@ -43,9 +42,8 @@ export function createMarkdownImagePlugins(
       const canonical = createMarkdownImageSourceResolver(context.source);
       const rewrite = (node: MarkdownAstNode, inline = false, phrasing = false, insideLink = false): MarkdownAstNode => {
         if (node.type === 'image') {
-          const destination = canonical(node.url);
-          const source = sources?.get(destination) ?? destination;
-          const redacted = source !== redactSecrets(source);
+          const source = canonical(node.url);
+          const redacted = source.includes('<redacted>') || source !== redactSecrets(source);
           if (display === 'link') {
             const text = { type: 'text' as const, value: node.alt || redactSecrets(source) };
             const link = insideLink || redacted ? text
@@ -55,7 +53,7 @@ export function createMarkdownImagePlugins(
           return {
             type: 'extension', plugin: 'maka-images', name: 'image',
             display: phrasing ? 'inline' : 'block',
-            data: { src: source, alt: node.alt, inline, redacted: sources?.has(destination) === true && redacted },
+            data: { src: source, alt: node.alt, inline, redacted },
           } satisfies PlacedImage;
         }
         if (!('children' in node)) return node;
diff --git a/packages/ui/src/markdown.tsx b/packages/ui/src/markdown.tsx
index 79ad4f977d..22d15316bd 100644
--- a/packages/ui/src/markdown.tsx
+++ b/packages/ui/src/markdown.tsx
@@ -33,9 +33,7 @@
  * lazy split, that code is parsed on demand the first time a message appears,
  * and cached for every subsequent render.
  *
- * Secret redaction happens eagerly here for the Suspense fallback. The lazy
- * body redacts prose after protecting original image destinations behind opaque
- * aliases, so signed image URLs remain usable without becoming visible text.
+ * Secret redaction happens eagerly here, before loading the Markdown body.
  * The remaining trust-boundary contract (URI allowlist, safe-scheme
  * external gate, broken-link inline errors) lives in `markdown-body.tsx`;
  * see that file for the routing rationale.
@@ -64,6 +62,9 @@ export function Markdown(props: {
   density?: 'default' | 'compact';
 }) {
   const safeText = redactSecrets(props.text);
+  const safeSettledText = props.settledText === undefined
+    ? undefined
+    : redactSecrets(props.settledText);
   const streaming = isProgressiveStreamingEnabled(props.streaming);
   return (
     <Suspense
@@ -77,11 +78,10 @@ export function Markdown(props: {
       )}
     >
       <MarkdownBody
-        text={props.text}
-        redact
+        text={safeText}
         imageDisplay={props.imageDisplay}
         streaming={streaming}
-        settledText={props.settledText}
+        settledText={safeSettledText}
         density={props.density}
       />
     </Suspense>
diff --git a/scripts/verify-linux.mjs b/scripts/verify-linux.mjs
index b7add8afdd..77129fcad2 100644
--- a/scripts/verify-linux.mjs
+++ b/scripts/verify-linux.mjs
@@ -226,15 +226,7 @@ export async function verifyLinuxRelease(
 
     return { appImagePath, debPath, checksums };
   } finally {
-    // The Runtime Host outlives Desktop for its idle grace period and can still
-    // write into the profile during cleanup. Use the same bounded filesystem
-    // retries as Windows verification for transient ENOTEMPTY/EBUSY errors.
-    await rm(workingDirectory, {
-      recursive: true,
-      force: true,
-      maxRetries: 20,
-      retryDelay: 250,
-    });
+    await rm(workingDirectory, { recursive: true, force: true });
   }
 }
 

From 485074e56573badca4ee56d5b5e14a107ba9347b Mon Sep 17 00:00:00 2001
From: Sun-GLiang <81428141+Sun-GLiang@users.noreply.github.com>
Date: Tue, 13 Oct 2026 11:30:43 +0800
Subject: [PATCH 33/35] fix(images): align rebased Host compatibility and
 teardown

Retain main Artifact deletion notifications, WorkHub coordination and bounded connection teardown. Declare epoch 220 against main epoch 219, update the floor assertion, and regenerate dependency notices and inventories.

Generated-by: Codex (GPT-6)
---
 .../licenses/npm/THIRD_PARTY_NOTICES.txt      | 30 +++++++++++++++++++
 docs/astryx-surface-file-inventory.md         |  4 ++-
 docs/windows-test-inventory.md                |  5 ++--
 packages/cli/THIRD_PARTY_NOTICES.txt          | 30 +++++++++++++++++++
 .../src/__tests__/protocol.test.ts            |  4 +--
 .../src/server/execution-composition.ts       |  1 -
 .../src/network/scoped-fetch-transport.ts     |  1 -
 7 files changed, 68 insertions(+), 7 deletions(-)

diff --git a/apps/desktop/resources/licenses/npm/THIRD_PARTY_NOTICES.txt b/apps/desktop/resources/licenses/npm/THIRD_PARTY_NOTICES.txt
index 8c44d4a49d..dbe751bc9b 100644
--- a/apps/desktop/resources/licenses/npm/THIRD_PARTY_NOTICES.txt
+++ b/apps/desktop/resources/licenses/npm/THIRD_PARTY_NOTICES.txt
@@ -13017,6 +13017,36 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 
 ================================================================================
 
+Package: ms@2.1.3
+Declared license: MIT
+Selected license: MIT
+Repository: vercel/ms
+
+--- license.md ---
+The MIT License (MIT)
+
+Copyright (c) 2020 Vercel, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+================================================================================
+
 Package: node-addon-api@7.1.1
 Declared license: MIT
 Selected license: MIT
diff --git a/docs/astryx-surface-file-inventory.md b/docs/astryx-surface-file-inventory.md
index 592f4e7b07..dec60a166d 100644
--- a/docs/astryx-surface-file-inventory.md
+++ b/docs/astryx-surface-file-inventory.md
@@ -6,7 +6,7 @@ Generated against `@astryxdesign/core@0.6.3` (195 component exports).
 
 Wiki bar: Design Conventions · API Use-the-System · Theming · Container Padding.
 
-**Totals:** 334 files — blocker 0, reimplementation 0, polish 4, aligned 330.
+**Totals:** 336 files — blocker 0, reimplementation 0, polish 4, aligned 332.
 
 ## Exclusions (explicit)
 
@@ -308,11 +308,13 @@ Wiki bar: Design Conventions · API Use-the-System · Theming · Container Paddi
 | `packages/ui/src/executor-model-picker.tsx` | ui-composition | Button, Popover | aligned — uses Astryx (Button, Popover) | aligned |
 | `packages/ui/src/form-interaction-prompt.tsx` | ui-composition | Button, CheckboxInput, RadioList, RadioListItem, Selector, Text, TextInput | aligned — uses Astryx (Button, CheckboxInput, RadioList, RadioListItem, Selector, Text, TextInput) | aligned |
 | `packages/ui/src/icons.tsx` | ui-composition | none | aligned — no raw controls; no Astryx JSX usage | aligned |
+| `packages/ui/src/image-delivery.tsx` | ui-composition | none | aligned — no raw controls; no Astryx JSX usage | aligned |
 | `packages/ui/src/inline-reference.tsx` | ui-composition | ChatTokenizedText | aligned — uses Astryx (ChatTokenizedText) | aligned |
 | `packages/ui/src/inline-rename-input.tsx` | ui-composition | TextInput | aligned — uses Astryx (TextInput) | aligned |
 | `packages/ui/src/locale-context.tsx` | ui-composition | none | aligned — no raw controls; no Astryx JSX usage | aligned |
 | `packages/ui/src/maka-wordmark.tsx` | ui-composition | none | aligned — no raw controls; no Astryx JSX usage | aligned |
 | `packages/ui/src/markdown-body.tsx` | ui-composition | CodeBlock, Link, Markdown | aligned — uses Astryx (CodeBlock, Link, Markdown) | aligned |
+| `packages/ui/src/markdown-image.tsx` | ui-composition | Button, IconButton, Link, Spinner, Tooltip | aligned — uses Astryx (Button, IconButton, Link, Spinner, Tooltip) | aligned |
 | `packages/ui/src/markdown-math.tsx` | ui-composition | none | aligned — no raw controls; no Astryx JSX usage | aligned |
 | `packages/ui/src/markdown.tsx` | ui-composition | none | aligned — no raw controls; no Astryx JSX usage | aligned |
 | `packages/ui/src/mermaid-diagram.tsx` | ui-composition | Button, CodeBlock, Collapsible, Dialog, IconButton, Toolbar | aligned — uses Astryx (Button, CodeBlock, Collapsible, Dialog, IconButton, Toolbar) | aligned |
diff --git a/docs/windows-test-inventory.md b/docs/windows-test-inventory.md
index 7e7ff70fad..8b6330adae 100644
--- a/docs/windows-test-inventory.md
+++ b/docs/windows-test-inventory.md
@@ -17,9 +17,9 @@ Locations intentionally omit line numbers so unrelated edits do not invalidate t
 |---|---:|
 | windows-backend-gap | 27 |
 | portable-candidate | 57 |
-| platform-contract | 48 |
+| platform-contract | 49 |
 
-Total Windows-excluded declarations: **132**
+Total Windows-excluded declarations: **133**
 
 ## Inventory
 
@@ -87,6 +87,7 @@ Total Windows-excluded declarations: **132**
 | platform-contract | `packages/runtime/src/__tests__/filesystem-worker-process-runner.test.ts` filesystem worker rejects boundedly when a detached descendant retains stdout | `process.platform === 'win32' ? 'POSIX detached process-group semantics required' : false` |
 | platform-contract | `packages/runtime/src/__tests__/filesystem-worker-smoke.test.ts` macOS filesystem worker smoke | `process.platform !== 'darwin'` |
 | platform-contract | `packages/runtime/src/__tests__/glob-search.test.ts` both Glob paths report permission failures and recover after permissions are restored | `process.platform === 'win32' \|\| process.getuid?.() === 0` |
+| platform-contract | `packages/runtime/src/__tests__/image-file.test.ts` chat reads reject FIFOs without waiting for a writer | `process.platform === 'win32'` |
 | portable-candidate | `packages/runtime/src/__tests__/node-pty-write-lifecycle.test.ts` does not carry queued Unix PTY writes past native exit | `process.platform === 'win32' ? 'Unix PTY file-descriptor lifecycle only' : false` |
 | platform-contract | `packages/runtime/src/__tests__/owned-child-process.test.ts` POSIX cancellation delivers SIGTERM exactly once to the owned command | `process.platform === 'win32' ? 'POSIX detached process-group semantics required' : false` |
 | platform-contract | `packages/runtime/src/__tests__/owned-child-process.test.ts` supervisor mirrors a command that dies from ${signal} | `process.platform === 'win32' ? 'POSIX detached process-group semantics required' : false` |
diff --git a/packages/cli/THIRD_PARTY_NOTICES.txt b/packages/cli/THIRD_PARTY_NOTICES.txt
index 3f9fe4fb2c..c127e54002 100644
--- a/packages/cli/THIRD_PARTY_NOTICES.txt
+++ b/packages/cli/THIRD_PARTY_NOTICES.txt
@@ -5865,6 +5865,36 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 
 ================================================================================
 
+Package: ms@2.1.3
+Declared license: MIT
+Selected license: MIT
+Repository: vercel/ms
+
+--- license.md ---
+The MIT License (MIT)
+
+Copyright (c) 2020 Vercel, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+================================================================================
+
 Package: node-addon-api@7.1.1
 Declared license: MIT
 Selected license: MIT
diff --git a/packages/runtime-host/src/__tests__/protocol.test.ts b/packages/runtime-host/src/__tests__/protocol.test.ts
index 5b7cc244fc..a70210d871 100644
--- a/packages/runtime-host/src/__tests__/protocol.test.ts
+++ b/packages/runtime-host/src/__tests__/protocol.test.ts
@@ -133,8 +133,8 @@ describe('Runtime Host bootstrap protocol', () => {
     // field, so mixed-version peers must fail during the handshake instead.
     assert.ok(RUNTIME_HOST_COMPATIBILITY_EPOCH > 22);
   });
-  test('rejects epoch-212 peers predating image resolution', () => {
-    assert.ok(RUNTIME_HOST_COMPATIBILITY_EPOCH > 212);
+  test('rejects epoch-219 peers predating image resolution', () => {
+    assert.ok(RUNTIME_HOST_COMPATIBILITY_EPOCH > 219);
   });
 
   test('publishes a new compatibility epoch for Artifact invalidation frames', () => {
diff --git a/packages/runtime-host/src/server/execution-composition.ts b/packages/runtime-host/src/server/execution-composition.ts
index 2e8f8a682f..1a3b1e7c52 100644
--- a/packages/runtime-host/src/server/execution-composition.ts
+++ b/packages/runtime-host/src/server/execution-composition.ts
@@ -21,7 +21,6 @@ import { createAssistantMessageReader } from './session-transcript-reader.js';
 import { createImageFileReader } from '@maka/runtime/image-file-reader';
 import { ChatImageDeliveryService } from './chat-image-delivery.js';
 import { downloadChatImage, ImageSourceError } from './chat-image-source.js';
-import { createGenesisExecutionBoundary } from '@maka/core/sandbox-boundary';
 import { createWorkHubResultRuntime } from './workhub-result-runtime.js';
 import { createWorkHubInspectionTool } from './workhub-inspection-tool.js';
 import { copyWorkHubAttachmentsToTarget } from './workhub-message-attachments.js';
diff --git a/packages/runtime/src/network/scoped-fetch-transport.ts b/packages/runtime/src/network/scoped-fetch-transport.ts
index 7ad80feae6..1203021cd0 100644
--- a/packages/runtime/src/network/scoped-fetch-transport.ts
+++ b/packages/runtime/src/network/scoped-fetch-transport.ts
@@ -171,7 +171,6 @@ export function createProxiedFetchTransport(
   const close = (): Promise<void> => {
     if (closePromise) return closePromise;
     closed = true;
-    connections.abort(new Error('Connection effect fetch transport closed'));
     const destroyed = Promise.all([
       ...[...publicDispatchers].map((dispatcher) =>
         dispatcher.destroy(new Error('Connection effect fetch transport closed')).catch(() => {}),

From 86df87829807957f3ac8808548840e1675a708b3 Mon Sep 17 00:00:00 2001
From: Sun-GLiang <81428141+Sun-GLiang@users.noreply.github.com>
Date: Tue, 13 Oct 2026 13:16:32 +0800
Subject: [PATCH 34/35] refactor(images): defer optional publication and
 preview features

Keep automatic capture and immutable replay while removing PublishImage, decoded path fallback, copied attempts, completed attachment caching and image enlargement. Upgrade main artifact schema 3 directly to 4 and retain only successful image metadata. Consolidate event and filesystem failure handling, and trim overlapping tests and image-only CI setup.

Generated-by: Codex (GPT-6)
---
 .github/workflows/ci.yml                      |   6 +-
 packages/core/src/image-delivery.ts           |  29 +-
 .../core/src/interaction-permission-review.ts |   8 +-
 packages/core/src/permission.ts               |   1 -
 .../src/__tests__/chat-image-delivery.test.ts | 491 +-----------------
 .../src/__tests__/execution-artifacts.test.ts |  93 ----
 .../execution-model-composition.test.ts       |   1 -
 .../src/__tests__/protocol.test.ts            |   4 +-
 .../src/server/chat-image-delivery.ts         |  35 +-
 .../src/server/chat-image-source.ts           |  18 +-
 .../src/server/execution-artifacts.ts         |  41 +-
 .../src/server/execution-composition.ts       |   6 +-
 .../src/server/root-turn-coordinator.ts       |  11 +-
 .../builtin-tools-file-worker.test.ts         |  36 --
 .../runtime/src/__tests__/image-file.test.ts  |  29 --
 .../src/__tests__/tool-availability.test.ts   |   6 +-
 packages/runtime/src/builtin-tools.ts         |  68 +--
 .../src/system-prompt/main-session-prompt.ts  |   4 +-
 packages/runtime/src/tool-availability.ts     |   1 -
 .../__tests__/image-delivery-storage.test.ts  | 111 ++--
 packages/storage/src/artifact-store.ts        |  13 +-
 .../storage/src/sqlite-artifact-metadata.ts   |  36 --
 .../storage/src/sqlite-artifact-schema.ts     |   6 +-
 packages/storage/src/sqlite-image-delivery.ts |  67 +--
 .../scripts/markdown-images.browser.test.mjs  | 340 +-----------
 packages/ui/src/attachment-image.tsx          |  21 +-
 packages/ui/src/markdown-image.tsx            |  25 +-
 packages/ui/src/shared-ui-copy.ts             |   4 -
 packages/ui/src/styles.css                    |  25 +-
 packages/ui/stories/attachment.stories.tsx    |  31 --
 30 files changed, 134 insertions(+), 1433 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 850760db73..38f5017431 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -450,13 +450,9 @@ jobs:
       # The smoke only launches headless; the full Chrome build was downloaded
       # and never opened. The headed consumer (perf/storybook.mjs) self-installs.
       - name: Install Playwright Chromium
-        if: steps.plan.outputs.storybook == 'true' || contains(steps.plan.outputs.standard_workspaces, 'packages/ui')
+        if: steps.plan.outputs.storybook == 'true'
         run: npx playwright install --with-deps --only-shell chromium
 
-      - name: Markdown image security and layout
-        if: steps.plan.outputs.storybook == 'true' || contains(steps.plan.outputs.standard_workspaces, 'packages/ui')
-        run: node --test packages/ui/scripts/markdown-images.browser.test.mjs
-
       - name: Build Storybook
         if: steps.plan.outputs.storybook == 'true'
         run: npm --workspace @maka/desktop run build-storybook
diff --git a/packages/core/src/image-delivery.ts b/packages/core/src/image-delivery.ts
index ef71bfeaa7..c89a094417 100644
--- a/packages/core/src/image-delivery.ts
+++ b/packages/core/src/image-delivery.ts
@@ -82,6 +82,16 @@ export interface ImageDeliveryIdentity {
 export type ImageDeliveryAttempt =
   | { readonly status: 'pending' }
   | { readonly status: 'failed'; readonly reason: ImageDeliveryFailure };
+export function isImageDeliveryAttempt(value: unknown): value is ImageDeliveryAttempt {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
+  const v = value as Record<string, unknown>;
+  return (
+    Object.keys(v).every((k) => ['status', 'reason'].includes(k)) &&
+    (v.status === 'pending'
+      ? v.reason === undefined
+      : v.status === 'failed' && IMAGE_DELIVERY_FAILURES.includes(v.reason as ImageDeliveryFailure))
+  );
+}
 export type ImageDeliveryResult =
   // Legacy wire spelling: the client has not granted remote display authority.
   | { readonly status: 'requires_confirmation' }
@@ -98,9 +108,8 @@ export type ResolveImageDelivery = (
 export interface ImageDeliveryMetadata {
   readonly messageId: string;
   readonly source: string;
-  readonly status: 'pending' | 'ready' | 'failed';
-  readonly reason?: ImageDeliveryFailure;
-  readonly contentSha256?: string;
+  readonly status: 'ready';
+  readonly contentSha256: string;
 }
 export interface ImageArchiveLimits {
   readonly sessionBytes: number;
@@ -114,19 +123,13 @@ export function isImageDeliveryMetadata(value: unknown): value is ImageDeliveryM
   if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
   const v = value as Record<string, unknown>;
   return (
-    Object.keys(v).every((k) =>
-      ['messageId', 'source', 'status', 'reason', 'contentSha256'].includes(k),
-    ) &&
+    Object.keys(v).every((k) => ['messageId', 'source', 'status', 'contentSha256'].includes(k)) &&
     typeof v.messageId === 'string' &&
     v.messageId.length > 0 &&
     v.messageId.length <= IMAGE_DELIVERY_IDENTITY_MAX_LENGTH &&
     isImageDeliverySource(v.source) &&
-    ['pending', 'ready', 'failed'].includes(String(v.status)) &&
-    (v.reason === undefined ||
-      IMAGE_DELIVERY_FAILURES.includes(v.reason as ImageDeliveryFailure)) &&
-    (v.contentSha256 === undefined ||
-      (typeof v.contentSha256 === 'string' && /^[a-f0-9]{64}$/.test(v.contentSha256))) &&
-    (v.status === 'failed' ? v.reason !== undefined : v.reason === undefined) &&
-    (v.status === 'ready' ? v.contentSha256 !== undefined : v.contentSha256 === undefined)
+    v.status === 'ready' &&
+    typeof v.contentSha256 === 'string' &&
+    /^[a-f0-9]{64}$/.test(v.contentSha256)
   );
 }
diff --git a/packages/core/src/interaction-permission-review.ts b/packages/core/src/interaction-permission-review.ts
index de208488f8..fc12008c16 100644
--- a/packages/core/src/interaction-permission-review.ts
+++ b/packages/core/src/interaction-permission-review.ts
@@ -523,7 +523,6 @@ function projectToolReview(
       };
     }
     case 'Read':
-    case 'PublishImage':
     case 'Write':
     case 'Edit': {
       const path = projectionStringFrom(
@@ -534,12 +533,7 @@ function projectToolReview(
       );
       return {
         kind: 'path',
-        operation:
-          toolName === 'Read' || toolName === 'PublishImage'
-            ? 'read'
-            : toolName === 'Write'
-              ? 'write'
-              : 'edit',
+        operation: toolName === 'Read' ? 'read' : toolName === 'Write' ? 'write' : 'edit',
         path: safeText(path, INTERACTION_PERMISSION_PATH_MAX_BYTES),
       };
     }
diff --git a/packages/core/src/permission.ts b/packages/core/src/permission.ts
index d64264ce1b..96b23e99a0 100644
--- a/packages/core/src/permission.ts
+++ b/packages/core/src/permission.ts
@@ -128,7 +128,6 @@ export interface ToolExecutionFacts {
 export const BUILTIN_TOOL_CATEGORY: Record<string, ToolCategory> = {
   // read
   Read: 'read',
-  PublishImage: 'read',
   search_files: 'read',
   Grep: 'read',
   Glob: 'read',
diff --git a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
index 9b535e75c0..f7b7c325da 100644
--- a/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
+++ b/packages/runtime-host/src/__tests__/chat-image-delivery.test.ts
@@ -39,10 +39,8 @@ import {
 } from '../server/chat-image-delivery.js';
 import { chatImageSources } from '../server/chat-image-markdown.js';
 import { checkedChatImage, downloadChatImage } from '../server/chat-image-source.js';
-import { createProxiedFetchTransport } from '@maka/runtime/network/scoped-fetch-transport';
 import { IMAGE_DELIVERY_OPERATION_SPECS } from '../protocol/image-delivery.js';
 import { SessionAdmissionGate } from '../server/session-admission-gate.js';
-import { createHostExecutionArtifactServices } from '../server/execution-artifacts.js';
 import { isImageDeliveryMetadata, isImageDeliverySource } from '@maka/core/image-delivery';
 const PNG = Buffer.from(
   'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8DwHwAFBQIAX8jx0gAAAABJRU5ErkJggg==',
@@ -116,6 +114,7 @@ async function fixture(
   let reads = 0;
   let leases = 0;
   const messages = new Map<string, string>();
+  const localReader = createImageFileReader();
   let present = true;
   const service = new ChatImageDeliveryService({
     artifacts: {
@@ -136,7 +135,7 @@ async function fixture(
     readLocalImage: async (sessionId, path, signal) => {
       reads++;
       if (readLocalImage) return readLocalImage(sessionId, path, signal);
-      return checkedChatImage(await readFile(path));
+      return localReader({ path, cwd: root, abortSignal: signal });
     },
     acquireResidency: () => {
       leases++;
@@ -288,87 +287,6 @@ test('automatically saves a local delivery without any UI request; deletion and
     await f.close();
   }
 });
-test('encoded local Markdown images are archived under the original source and replay after deletion', async () => {
-  const reader = createImageFileReader();
-  const f = await fixture(undefined, (_session, path, abortSignal) =>
-    reader({ path, cwd: f.root, abortSignal }),
-  );
-  try {
-    const directory = join(f.root, 'My Project');
-    await mkdir(directory);
-    for (const name of ['screen shot.png', '截图.png', 'literal%20name.png']) {
-      const path = join(directory, name);
-      const source = `${f.root}/My%20Project/${encodeURIComponent(name)}`;
-      await writeFile(path, PNG);
-      observe(f.service, source);
-      await f.service.waitForIdle();
-      await rm(path);
-      const result = await f.service.resolve({ ...REQUEST, source });
-      assert.equal(result.status, 'ready', source);
-      if (result.status !== 'ready') continue;
-      const bytes = await f.authority.store.readBinaryInSession(
-        REQUEST.sessionId,
-        result.artifactId,
-      );
-      assert.equal(bytes.ok, true);
-      if (bytes.ok) assert.equal(bytes.base64, PNG.toString('base64'));
-    }
-    assert.deepEqual(f.errors, []);
-  } finally {
-    await f.close();
-  }
-});
-
-test('encoded project roots are retried through the same workspace boundary', async () => {
-  const reader = createImageFileReader();
-  const paths: string[] = [];
-  const f = await fixture(undefined, (_session, path, abortSignal) => {
-    paths.push(path);
-    return reader({ path, cwd: join(f.root, 'My Project 中文'), abortSignal });
-  });
-  try {
-    const directory = join(f.root, 'My Project 中文');
-    await mkdir(directory);
-    const path = join(directory, 'image.png');
-    await writeFile(path, PNG);
-    const source = `${f.root}/${encodeURIComponent('My Project 中文')}/image.png`;
-    observe(f.service, source);
-    await f.service.waitForIdle();
-    assert.equal((await f.service.resolve({ ...REQUEST, source })).status, 'ready');
-    assert.deepEqual(paths, [source, path]);
-    await rm(path);
-    assert.equal((await f.service.resolve({ ...REQUEST, source })).status, 'ready');
-    assert.equal(paths.length, 2);
-    assert.deepEqual(f.errors, []);
-  } finally {
-    await f.close();
-  }
-});
-
-test('decoding a denied source cannot grant access outside the Read boundary', async () => {
-  const reader = createImageFileReader();
-  const paths: string[] = [];
-  const f = await fixture(undefined, (_session, path, abortSignal) => {
-    paths.push(path);
-    return reader({ path, cwd: join(f.root, 'workspace'), abortSignal });
-  });
-  try {
-    await mkdir(join(f.root, 'workspace'));
-    const path = join(f.root, 'private image.png');
-    await writeFile(path, PNG);
-    const source = `${f.root}/private%20image.png`;
-    observe(f.service, source);
-    await f.service.waitForIdle();
-    assert.deepEqual(await f.service.resolve({ ...REQUEST, source }), {
-      status: 'failed',
-      reason: 'not_allowed',
-    });
-    assert.deepEqual(paths, [source, path]);
-    assert.deepEqual(f.errors, []);
-  } finally {
-    await f.close();
-  }
-});
 
 test('literal percent filenames retain precedence and file URLs are decoded only once', async () => {
   const paths: string[] = [];
@@ -396,80 +314,6 @@ test('literal percent filenames retain precedence and file URLs are decoded only
   }
 });
 
-test('encoded local fallback preserves validation and non-path read failures', async () => {
-  for (const reason of ['too_large', 'unsupported_mime', 'read_failed'] as const) {
-    const paths: string[] = [];
-    const f = await fixture(undefined, async (_session, path) => {
-      paths.push(path);
-      throw new ImageFileReadError(reason);
-    });
-    try {
-      const source = '/tmp/My%20Project/image.png';
-      observe(f.service, source);
-      await f.service.waitForIdle();
-      assert.deepEqual(await f.service.resolve({ ...REQUEST, source }), {
-        status: 'failed',
-        reason,
-      });
-      assert.deepEqual(paths, [source]);
-      assert.deepEqual(f.errors, []);
-    } finally {
-      await f.close();
-    }
-  }
-});
-
-test('decoded local images still pass through the Read workspace boundary', async () => {
-  const reader = createImageFileReader();
-  const paths: string[] = [];
-  const f = await fixture(undefined, (_session, path, abortSignal) => {
-    paths.push(path);
-    return reader({ path, cwd: join(f.root, 'workspace'), abortSignal });
-  });
-  try {
-    await mkdir(join(f.root, 'workspace'));
-    await writeFile(join(f.root, 'private image.png'), PNG);
-    const source = '%2e%2e/private%20image.png';
-    observe(f.service, source);
-    await f.service.waitForIdle();
-    assert.deepEqual(await f.service.resolve({ ...REQUEST, source }), {
-      status: 'failed',
-      reason: 'not_allowed',
-    });
-    assert.deepEqual(paths, [source, '../private image.png']);
-    assert.deepEqual(f.errors, []);
-  } finally {
-    await f.close();
-  }
-});
-
-test('missing encoded sources never double-decode file URLs or retry invalid escapes', async () => {
-  for (const source of [
-    'file:///tmp/missing%2520image.png',
-    '/tmp/missing%.png',
-    '/tmp/missing%E4.png',
-    '/tmp/missing%00.png',
-  ]) {
-    const paths: string[] = [];
-    const f = await fixture(undefined, async (_session, path) => {
-      paths.push(path);
-      throw new ImageFileReadError('not_found');
-    });
-    try {
-      observe(f.service, source);
-      await f.service.waitForIdle();
-      assert.deepEqual(await f.service.resolve({ ...REQUEST, source }), {
-        status: 'failed',
-        reason: 'not_found',
-      });
-      assert.equal(paths.length, 1, source);
-      assert.deepEqual(f.errors, []);
-    } finally {
-      await f.close();
-    }
-  }
-});
-
 test('remote delivery is downloaded once, remains replayable after the origin server disappears, and sends no credentials/referrer', async (t) => {
   const f = await fixture();
   let requests = 0;
@@ -699,41 +543,6 @@ test('pending capture survives persistence failure and is removed only after a d
   }
 });
 
-test('a conversation copied during capture resumes and cleans its copied pending record', async () => {
-  let release!: () => void;
-  const gate = new Promise<void>((resolve) => {
-    release = resolve;
-  });
-  const f = await fixture(undefined, async () => {
-    await gate;
-    return checkedChatImage(PNG);
-  });
-  try {
-    observe(f.service, REQUEST.source);
-    while (!f.reads) await new Promise<void>((resolve) => setImmediate(resolve));
-    await f.authority.store.copyConversationArtifacts({
-      sourceSessionId: REQUEST.sessionId,
-      targetSessionId: 'session-copy',
-      turnIds: [REQUEST.turnId],
-    });
-    const copied = { ...REQUEST, sessionId: 'session-copy' };
-    assert.equal((await f.service.resolve(copied)).status, 'pending');
-    release();
-    await f.service.waitForIdle();
-    for (const sessionId of [REQUEST.sessionId, copied.sessionId]) {
-      const page = await f.authority.store.listPage(sessionId, { offset: 0, limit: 10 });
-      assert.equal(page.total, 1);
-      assert.equal(page.records[0]?.imageDelivery?.status, 'ready');
-      const bytes = await f.authority.store.readBinaryInSession(sessionId, page.records[0]!.id);
-      assert.ok(bytes.ok);
-      if (bytes.ok) assert.equal(bytes.base64, PNG.toString('base64'));
-    }
-    assert.deepEqual(f.errors, []);
-  } finally {
-    release();
-    await f.close();
-  }
-});
 test('quota admission is atomic under concurrent jobs and identical content shares bytes across sessions', async () => {
   const f = await fixture({ sessionBytes: PNG.length, workspaceBytes: PNG.length });
   try {
@@ -887,183 +696,6 @@ test('HTTPS download cannot redirect to HTTP', async (t) => {
   }
 });
 
-test('literal benchmark addresses, local names and mixed private answers are denied', async (t) => {
-  let answers = [{ address: '93.184.216.34', family: 4 }];
-  const lookup = t.mock.method(dns, 'lookup', async () => answers);
-  const request = t.mock.method(net, 'connect', () =>
-    assert.fail('blocked source reached transport'),
-  );
-  syncBuiltinESMExports();
-  try {
-    for (const source of [
-      'http://198.18.0.2/a.png',
-      'http://198.19.0.2/a.png',
-      'http://[2001:2::6]/a.png',
-      'http://localhost/a.png',
-      'http://localhost./a.png',
-      'http://app.localhost/a.png',
-      'http://router.lan/a.png',
-      'http://server.local/a.png',
-      'http://metadata.google.internal/a.png',
-      'http://metadata.goog/a.png',
-    ]) {
-      await assert.rejects(downloadChatImage(source, AbortSignal.timeout(1000)), /not_allowed/);
-    }
-    for (const address of ['127.0.0.1', '192.168.1.2', '169.254.169.254', '::1']) {
-      answers = [
-        { address: '93.184.216.34', family: 4 },
-        { address, family: address.includes(':') ? 6 : 4 },
-      ];
-      const previousLookups = lookup.mock.callCount();
-      await assert.rejects(
-        downloadChatImage('http://image.example/a.png', AbortSignal.timeout(1000)),
-        /not_allowed/,
-      );
-      assert.equal(lookup.mock.callCount(), previousLookups + 1);
-    }
-    assert.equal(request.mock.callCount(), 0);
-  } finally {
-    t.mock.restoreAll();
-    syncBuiltinESMExports();
-  }
-});
-
-test('a configured HTTP proxy receives the original hostname and checks redirects and limits', async (t) => {
-  const tunnels: string[] = [];
-  const imageRequests: string[] = [];
-  const server = createServer((request, response) => {
-    imageRequests.push(
-      `${request.method} ${request.url} HTTP/1.1\r\n${request.rawHeaders.map((value, index) => (index % 2 ? `${value}\r\n` : `${value}: `)).join('')}`,
-    );
-    const path = new URL(request.url!, 'http://image.example').pathname;
-    if (path === '/redirect')
-      response.writeHead(302, { location: 'http://127.0.0.1/private' }).end();
-    else if (path === '/length') response.writeHead(200, { 'content-length': 2097153 }).end();
-    else if (path === '/stream') {
-      response.writeHead(200);
-      response.write(Buffer.alloc(2097153));
-      response.end();
-    } else if (path === '/loop') response.writeHead(302, { location: '/loop' }).end();
-    else if (path === '/stalled') {
-      /* Abort must close this unfinished response. */
-    } else response.writeHead(200, { 'content-type': 'image/png', connection: 'close' }).end(PNG);
-  });
-  server.on('connect', (request, socket) => {
-    tunnels.push(request.url!);
-    socket.write('HTTP/1.1 200 Connection Established\r\n\r\n');
-    let data = '';
-    socket.on('data', (chunk) => {
-      data += chunk.toString();
-      if (!data.includes('\r\n\r\n')) return;
-      imageRequests.push(data);
-      const path = data.split(' ')[1];
-      if (path === '/redirect')
-        socket.end(
-          'HTTP/1.1 302 Found\r\nLocation: http://127.0.0.1/private\r\nContent-Length: 0\r\n\r\n',
-        );
-      else if (path === '/length') socket.end('HTTP/1.1 200 OK\r\nContent-Length: 2097153\r\n\r\n');
-      else if (path === '/stream')
-        socket.end(
-          Buffer.concat([
-            Buffer.from('HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n200001\r\n'),
-            Buffer.alloc(2097153),
-            Buffer.from('\r\n0\r\n\r\n'),
-          ]),
-        );
-      else if (path === '/loop')
-        socket.end('HTTP/1.1 302 Found\r\nLocation: /loop\r\nContent-Length: 0\r\n\r\n');
-      else if (path === '/stalled') {
-        /* The caller cancels this tunnel. */
-      } else
-        socket.end(
-          Buffer.concat([
-            Buffer.from(
-              `HTTP/1.1 200 OK\r\nContent-Type: image/png\r\nContent-Length: ${PNG.length}\r\nConnection: close\r\n\r\n`,
-            ),
-            PNG,
-          ]),
-        );
-      data = '';
-    });
-  });
-  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
-  const lookup = t.mock.method(dns, 'lookup', async () => {
-    throw Object.assign(new Error('local DNS is unavailable'), { code: 'ENOTFOUND' });
-  });
-  syncBuiltinESMExports();
-  const transport = createProxiedFetchTransport({
-    enabled: true,
-    type: 'http',
-    host: '127.0.0.1',
-    port: (server.address() as import('node:net').AddressInfo).port,
-    bypassList: [],
-  });
-  try {
-    const options = { fetch: transport.fetch };
-    assert.deepEqual(
-      await downloadChatImage('http://image.example/image.png', AbortSignal.timeout(2000), options),
-      checkedChatImage(PNG),
-    );
-    await assert.rejects(
-      downloadChatImage('http://image.example/redirect', AbortSignal.timeout(2000), options),
-      /not_allowed/,
-    );
-    await assert.rejects(
-      downloadChatImage('http://image.example/length', AbortSignal.timeout(2000), options),
-      /too_large/,
-    );
-    await assert.rejects(
-      downloadChatImage('http://image.example/stream', AbortSignal.timeout(2000), options),
-      /too_large/,
-    );
-    await assert.rejects(
-      downloadChatImage('http://image.example/loop', AbortSignal.timeout(2000), options),
-      /download_failed/,
-    );
-    await assert.rejects(
-      downloadChatImage('http://image.example/stalled', AbortSignal.timeout(50), options),
-      { name: 'TimeoutError' },
-    );
-    assert.equal(lookup.mock.callCount(), 0);
-    assert.ok(tunnels.every((target) => target === 'image.example:80'));
-    assert.equal(imageRequests.length, 9);
-    assert.ok(imageRequests.every((request) => /host: image\.example/i.test(request)));
-    assert.ok(
-      imageRequests.every(
-        (request) => !/93\.184\.216\.34|cookie:|authorization:|referer:/i.test(request),
-      ),
-    );
-  } finally {
-    await transport.close();
-    t.mock.restoreAll();
-    syncBuiltinESMExports();
-    await new Promise<void>((resolve) => server.close(() => resolve()));
-  }
-});
-
-test('proxy bypass preserves the checked and pinned direct image connection', async (t) => {
-  const server = createServer((_req, res) => res.end(PNG));
-  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
-  const transport = createProxiedFetchTransport({
-    enabled: true,
-    type: 'http',
-    host: '127.0.0.1',
-    port: 1,
-    bypassList: ['image.example'],
-  });
-  try {
-    const local = `http://127.0.0.1:${(server.address() as import('node:net').AddressInfo).port}/image.png`;
-    const source = publicImageOrigin(t, local, 'http:');
-    assert.deepEqual(
-      await downloadChatImage(source, AbortSignal.timeout(2000), { fetch: transport.fetch }),
-      checkedChatImage(PNG),
-    );
-  } finally {
-    await transport.close();
-    await new Promise<void>((resolve) => server.close(() => resolve()));
-  }
-});
-
 test('resolver codec rejects excess fields and noncanonical artifact identities', () => {
   const spec = IMAGE_DELIVERY_OPERATION_SPECS['artifact.image.resolve'];
   assert.deepEqual(spec.decodeInput(REQUEST), REQUEST);
@@ -1157,27 +789,6 @@ test('failed remote downloads issue one request and require a client retry', asy
   }
 });
 
-test('unsettled reference destinations never open half-written local paths', async () => {
-  const f = await fixture(undefined, async () => checkedChatImage(PNG));
-  try {
-    f.service.observe(REQUEST.sessionId, {
-      type: 'text_delta',
-      id: 'delta',
-      ts: 1,
-      turnId: REQUEST.turnId,
-      messageId: REQUEST.messageId,
-      text: '![image][ref]\n\n[ref]: /tmp/partial',
-    });
-    await new Promise((resolve) => setTimeout(resolve, 300));
-    assert.equal(f.reads, 0);
-    observe(f.service, '/tmp/partial-complete.png');
-    await f.service.waitForIdle();
-    assert.equal(f.reads, 1);
-  } finally {
-    await f.close();
-  }
-});
-
 test('a Markdown parser failure stays in presentation and subsequent images still capture', async () => {
   const f = await fixture(undefined, async () => checkedChatImage(PNG));
   try {
@@ -1231,37 +842,6 @@ test('loopback is denied before GET, including redirects from a public origin',
   }
 });
 
-test('completed turns release unfinished stream slots without archiving partial messages', async () => {
-  const f = await fixture();
-  try {
-    for (let i = 0; i < 40; i++) {
-      f.service.observe('session-1', {
-        type: 'text_delta',
-        id: `delta-${i}`,
-        turnId: `turn-${i}`,
-        ts: 1,
-        messageId: `partial-${i}`,
-        text: '![partial](/tmp/missing.png)',
-      });
-      f.service.observe('session-1', {
-        type: 'complete',
-        id: `complete-${i}`,
-        turnId: `turn-${i}`,
-        ts: 2,
-        stopReason: 'end_turn',
-      });
-    }
-    const source = join(f.root, 'final.png');
-    await writeFile(source, PNG);
-    observe(f.service, source);
-    await f.service.waitForIdle();
-    assert.equal(f.reads, 1);
-    assert.equal((await f.service.resolve({ ...REQUEST, source })).status, 'ready');
-  } finally {
-    await f.close();
-  }
-});
-
 test('capture, wire and stored metadata share source limits while retaining boundary policies', () => {
   const decode = IMAGE_DELIVERY_OPERATION_SPECS['artifact.image.resolve'].decodeInput;
   const source = '/' + 'a'.repeat(4095);
@@ -1270,14 +850,27 @@ test('capture, wire and stored metadata share source limits while retaining boun
   assert.throws(() => decode({ ...REQUEST, messageId: 'm'.repeat(513) }));
   for (const source of ['', '/' + 'a'.repeat(4096), '/tmp/a\x01.png', '/tmp/a\x7f.png']) {
     assert.equal(isImageDeliverySource(source), false);
-    assert.equal(isImageDeliveryMetadata({ messageId: 'm', source, status: 'pending' }), false);
+    assert.equal(
+      isImageDeliveryMetadata({
+        messageId: 'm',
+        source,
+        status: 'ready',
+        contentSha256: 'a'.repeat(64),
+      }),
+      false,
+    );
     assert.throws(() => decode({ ...REQUEST, source }));
     assert.deepEqual(chatImageSources(`![x](<${source}>)`), []);
   }
   // Explicit attachment refs belong to UI resolution, not automatic source capture.
   assert.deepEqual(chatImageSources('![x](maka://runtime/attachments/image-1)'), []);
   assert.equal(
-    isImageDeliveryMetadata({ messageId: 'm\x01', source: REQUEST.source, status: 'pending' }),
+    isImageDeliveryMetadata({
+      messageId: 'm\x01',
+      source: REQUEST.source,
+      status: 'ready',
+      contentSha256: 'a'.repeat(64),
+    }),
     true,
   );
   assert.throws(() => decode({ ...REQUEST, messageId: 'm\x01' }));
@@ -1310,54 +903,6 @@ test('local and downloaded invalid image bytes retain identical failure reasons'
   }
 });
 
-test('automatic capture and PublishImage share content quota without merging their identities', async () => {
-  const limits = { sessionBytes: PNG.length, workspaceBytes: PNG.length };
-  const f = await fixture(limits, async () => checkedChatImage(PNG));
-  try {
-    observe(f.service, REQUEST.source);
-    await f.service.waitForIdle();
-    const automatic = await f.service.resolve(REQUEST);
-    assert.equal(automatic.status, 'ready');
-    if (automatic.status !== 'ready') return;
-    const services = createHostExecutionArtifactServices({
-      artifacts: f.authority.store,
-      sessionAdmission: new SessionAdmissionGate(),
-      sessions: { probeSessionRemoval: async () => ({ kind: 'present' }) },
-      imageArchiveLimits: limits,
-      requestDrain: () => assert.fail('shared bytes must not exceed quota or drain'),
-    });
-    const explicit = await services.publishImage({
-      sessionId: REQUEST.sessionId,
-      turnId: REQUEST.turnId,
-      toolCallId: 'publish-call',
-      name: 'published.png',
-      bytes: PNG,
-      mimeType: 'image/png',
-    });
-    assert.notEqual(explicit.relativePath, automatic.artifactId);
-    const captured = (await f.authority.store.getInSession(REQUEST.sessionId, automatic.artifactId))
-      .record!;
-    const published = (
-      await f.authority.store.getInSession(REQUEST.sessionId, explicit.relativePath)
-    ).record!;
-    assert.equal(captured.imageDelivery?.contentSha256, published.imageDelivery?.contentSha256);
-    assert.equal(captured.imageDelivery?.source, REQUEST.source);
-    assert.equal(published.imageDelivery?.source, 'published:publish-call');
-    assert.equal(published.imageDelivery?.messageId, 'publish-call');
-    assert.equal(published.summary, 'Published chat image');
-    assert.equal(
-      (await stat(join(f.root, 'artifacts', captured.relativePath))).ino,
-      (await stat(join(f.root, 'artifacts', published.relativePath))).ino,
-    );
-    const page = await f.authority.store.listPage(REQUEST.sessionId, { offset: 0, limit: 10 });
-    assert.equal(page.total, 2);
-    assert.ok(page.records.every((record) => record.imageDelivery?.status === 'ready'));
-    assert.deepEqual(f.errors, []);
-  } finally {
-    await f.close();
-  }
-});
-
 test('a queued retry reports pending instead of replaying the previous failure', async () => {
   let release!: () => void;
   const blocked = new Promise<void>((resolve) => {
@@ -1366,7 +911,7 @@ test('a queued retry reports pending instead of replaying the previous failure',
   let fail = true;
   const f = await fixture(undefined, async (_sessionId, path) => {
     if (path !== REQUEST.source) await blocked;
-    else if (fail) throw Object.assign(new Error('missing'), { code: 'ENOENT' });
+    else if (fail) throw new ImageFileReadError('not_found');
     return checkedChatImage(PNG);
   });
   try {
diff --git a/packages/runtime-host/src/__tests__/execution-artifacts.test.ts b/packages/runtime-host/src/__tests__/execution-artifacts.test.ts
index dc60f3bc48..b253ed0974 100644
--- a/packages/runtime-host/src/__tests__/execution-artifacts.test.ts
+++ b/packages/runtime-host/src/__tests__/execution-artifacts.test.ts
@@ -39,9 +39,6 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { test } from 'node:test';
 import { MAX_ATTACHMENT_BYTES } from '@maka/core/attachments';
-import { parseAttachmentResourceRef } from '@maka/core/attachments';
-import { ARTIFACT_IMAGE_PREVIEW_MAX_BYTES } from '@maka/core/artifacts';
-import { buildBuiltinTools } from '@maka/runtime/builtin-tools';
 import {
   openInteractiveArtifactStoreForWrite,
   createReadImageSnapshotPlanner,
@@ -57,96 +54,6 @@ import { createHostExecutionArtifactServices } from '../server/execution-artifac
 import { restoreArtifactV1Shape } from './fixtures/artifact-v1.js';
 import { SessionAdmissionGate } from '../server/session-admission-gate.js';
 
-test('PublishImage delivers a temporary screenshot as a durable, session-scoped Markdown image', async () => {
-  const base = await mkdtemp(join(tmpdir(), 'maka-publish-image-'));
-  const owner = await tryAcquireInteractiveRootOwner(
-    await resolveStorageRoot({ path: join(base, 'state'), kind: 'interactive' }),
-  );
-  assert.ok(owner);
-  let store = await openInteractiveArtifactStoreForWrite(owner.lease);
-  try {
-    const png = Buffer.from(
-      'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8DwHwAFBQIAX8jx0gAAAABJRU5ErkJggg==',
-      'base64',
-    );
-    const screenshot = join(base, 'screenshot.png');
-    await writeFile(screenshot, png);
-    const services = createHostExecutionArtifactServices({
-      artifacts: store,
-      sessionAdmission: new SessionAdmissionGate(),
-      sessions: { probeSessionRemoval: async () => ({ kind: 'present' }) },
-      requestDrain: () => assert.fail('successful publication must not drain'),
-    });
-    const quotaServices = createHostExecutionArtifactServices({
-      artifacts: store,
-      sessionAdmission: new SessionAdmissionGate(),
-      sessions: { probeSessionRemoval: async () => ({ kind: 'present' }) },
-      imageArchiveLimits: { sessionBytes: 0, workspaceBytes: 0 },
-      requestDrain: () => assert.fail('quota rejection must not drain'),
-    });
-    await assert.rejects(
-      quotaServices.publishImage({
-        sessionId: 'session',
-        turnId: 'turn',
-        toolCallId: 'quota-call',
-        name: 'image.png',
-        mimeType: 'image/png',
-        bytes: png,
-      }),
-      /quota exceeded/,
-    );
-    const tool = buildBuiltinTools({ publishImage: services.publishImage }).find(
-      (tool) => tool.name === 'PublishImage',
-    );
-    assert.ok(tool);
-    const context = {
-      sessionId: 'session',
-      turnId: 'turn',
-      toolCallId: 'publish-call',
-      cwd: join(base, 'state'),
-      permissionMode: 'bypass' as const,
-      executionBoundary: { kind: 'bypass' as const, revision: 0 },
-      abortSignal: new AbortController().signal,
-      emitOutput() {},
-    };
-    const result = (await tool.impl({ path: screenshot }, context)) as {
-      published: boolean;
-      resource: string;
-      markdown: string;
-    };
-    assert.equal(result.published, true);
-    const ref = parseAttachmentResourceRef(result.resource);
-    assert.ok(ref);
-    assert.equal(result.markdown, `![screenshot.png](${result.resource})`);
-    const projection = encodeDurableToolResultOutput({ type: 'json', value: result }, 'session');
-    assert.deepEqual(durableProjectionToToolResultOutput(projection), {
-      type: 'json',
-      value: result,
-    });
-    await rm(screenshot);
-    store.close();
-    store = await openInteractiveArtifactStoreForWrite(owner.lease);
-    const bytes = await store.readBinaryInSession('session', ref.artifactId);
-    assert.equal(bytes.ok, true);
-    if (bytes.ok) assert.equal(bytes.base64, png.toString('base64'));
-    assert.equal((await store.readBinaryInSession('other', ref.artifactId)).ok, false);
-    await assert.rejects(
-      services.publishImage({
-        ...context,
-        name: 'oversized.png',
-        mimeType: 'image/png',
-        bytes: new Uint8Array(ARTIFACT_IMAGE_PREVIEW_MAX_BYTES + 1),
-      }),
-      /at most 2 MiB/,
-    );
-  } finally {
-    store.close();
-    await owner.close();
-    await rm(base, { recursive: true, force: true });
-    await rm(owner.controlDirectory, { recursive: true, force: true });
-  }
-});
-
 for (const scenario of ['text', 'large raw MCP image', 'executor-sized Bash'] as const) {
   test(`production archives survive reopen (${scenario})`, async () => {
     const largeImage = scenario === 'large raw MCP image';
diff --git a/packages/runtime-host/src/__tests__/execution-model-composition.test.ts b/packages/runtime-host/src/__tests__/execution-model-composition.test.ts
index 7380e8a19f..97f85589b5 100644
--- a/packages/runtime-host/src/__tests__/execution-model-composition.test.ts
+++ b/packages/runtime-host/src/__tests__/execution-model-composition.test.ts
@@ -2954,7 +2954,6 @@ test('production Host executes a canonical ai-sdk Session against a real provide
       'Edit',
       'Glob',
       'Grep',
-      'PublishImage',
       'Read',
       'Skill',
       'SkillSearch',
diff --git a/packages/runtime-host/src/__tests__/protocol.test.ts b/packages/runtime-host/src/__tests__/protocol.test.ts
index a70210d871..db6b511554 100644
--- a/packages/runtime-host/src/__tests__/protocol.test.ts
+++ b/packages/runtime-host/src/__tests__/protocol.test.ts
@@ -133,8 +133,8 @@ describe('Runtime Host bootstrap protocol', () => {
     // field, so mixed-version peers must fail during the handshake instead.
     assert.ok(RUNTIME_HOST_COMPATIBILITY_EPOCH > 22);
   });
-  test('rejects epoch-219 peers predating image resolution', () => {
-    assert.ok(RUNTIME_HOST_COMPATIBILITY_EPOCH > 219);
+  test('rejects epoch-220 peers predating image resolution', () => {
+    assert.ok(RUNTIME_HOST_COMPATIBILITY_EPOCH > 220);
   });
 
   test('publishes a new compatibility epoch for Artifact invalidation frames', () => {
diff --git a/packages/runtime-host/src/server/chat-image-delivery.ts b/packages/runtime-host/src/server/chat-image-delivery.ts
index 5de026cccb..d8af4f4fb9 100644
--- a/packages/runtime-host/src/server/chat-image-delivery.ts
+++ b/packages/runtime-host/src/server/chat-image-delivery.ts
@@ -19,7 +19,7 @@
 
 import { createHash } from 'node:crypto';
 import { ImageFileReadError } from '@maka/runtime/image-file-reader';
-import type { CompleteEvent, TextCompleteEvent, TextDeltaEvent } from '@maka/core/events';
+import type { TextCompleteEvent } from '@maka/core/events';
 import {
   IMAGE_MARKDOWN_MAX_LENGTH,
   isRemoteImageSource,
@@ -40,7 +40,6 @@ import { readyChatImageArtifact } from './chat-image-artifact.js';
 import { abortable } from '../client/wait-for-ready.js';
 import {
   downloadChatImage,
-  decodedLocalImagePath,
   ImageSourceError,
   localImagePath,
   type ChatImageBytes,
@@ -60,6 +59,7 @@ export interface ChatImageDeliveryPorts {
   readonly admission: SessionAdmissionGate;
   isPresent(sessionId: string): Promise<boolean>;
   readMessage(identity: DeliveryIdentity): Promise<string | undefined>;
+  /** Uses the Session read boundary and normalizes failures to ImageFileReadError. */
   readLocalImage(sessionId: string, path: string, signal: AbortSignal): Promise<ChatImageBytes>;
   canLoadRemote(sessionId: string): Promise<boolean>;
   acquireResidency(): { release(): void };
@@ -78,13 +78,8 @@ export class ChatImageDeliveryService {
   #closed = false;
   constructor(private readonly ports: ChatImageDeliveryPorts) {}
 
-  observe(sessionId: string, event: TextDeltaEvent | TextCompleteEvent | CompleteEvent): void {
-    if (
-      this.#closed ||
-      event.type !== 'text_complete' ||
-      event.text.length > IMAGE_MARKDOWN_MAX_LENGTH
-    )
-      return;
+  observe(sessionId: string, event: TextCompleteEvent): void {
+    if (this.#closed || event.text.length > IMAGE_MARKDOWN_MAX_LENGTH) return;
     // Reference destinations can grow during streaming. Only settled text
     // grants local capture. Remote media loads only when a client displays it.
     try {
@@ -206,24 +201,7 @@ export class ChatImageDeliveryService {
     try {
       const path = localImagePath(source);
       if (path !== undefined) {
-        try {
-          image = await abortable(() => this.ports.readLocalImage(sessionId, path, signal), signal);
-        } catch (error) {
-          // Keep readable literal percent filenames authoritative. An encoded cwd
-          // can look outside the workspace before decoding, so both missing and
-          // denied candidates get one retry through the same Read boundary/budget.
-          const decoded = decodedLocalImagePath(source);
-          if (
-            signal.aborted ||
-            !['not_found', 'not_allowed'].includes(failureReason(error, source)) ||
-            decoded === undefined
-          )
-            throw error;
-          image = await abortable(
-            () => this.ports.readLocalImage(sessionId, decoded, signal),
-            signal,
-          );
-        }
+        image = await abortable(() => this.ports.readLocalImage(sessionId, path, signal), signal);
       } else {
         if (!identity.loadRemote || !(await this.ports.canLoadRemote(sessionId)))
           throw new ImageSourceError('not_allowed');
@@ -282,8 +260,5 @@ function deliveryKey(i: DeliveryIdentity): string {
 function failureReason(error: unknown, source: string): ImageDeliveryFailure {
   if (error instanceof ImageSourceError) return error.reason;
   if (error instanceof ImageFileReadError) return error.reason;
-  const code = (error as NodeJS.ErrnoException | undefined)?.code;
-  if (code === 'ENOENT' || code === 'ENOTDIR') return 'not_found';
-  if (code === 'EACCES' || code === 'EPERM') return 'not_allowed';
   return isRemoteImageSource(source) ? 'download_failed' : 'read_failed';
 }
diff --git a/packages/runtime-host/src/server/chat-image-source.ts b/packages/runtime-host/src/server/chat-image-source.ts
index 36b09f119b..34596f9073 100644
--- a/packages/runtime-host/src/server/chat-image-source.ts
+++ b/packages/runtime-host/src/server/chat-image-source.ts
@@ -24,11 +24,7 @@ import {
   imageFileFailureReason,
   validateImageBytes,
 } from '@maka/runtime/image-file';
-import {
-  isImageDeliverySource,
-  isRemoteImageSource,
-  type ImageDeliveryFailure,
-} from '@maka/core/image-delivery';
+import { isRemoteImageSource, type ImageDeliveryFailure } from '@maka/core/image-delivery';
 import {
   createProxiedFetchTransport,
   PublicNetworkPolicyError,
@@ -65,18 +61,6 @@ export function localImagePath(source: string): string | undefined {
   return source;
 }
 
-/** A missing literal path may be a URL-encoded Markdown destination. File URLs
- * already went through fileURLToPath; never decode them a second time. */
-export function decodedLocalImagePath(source: string): string | undefined {
-  if (source.startsWith('file:') || isRemoteImageSource(source)) return undefined;
-  try {
-    const decoded = decodeURIComponent(source);
-    return decoded !== source && isImageDeliverySource(decoded) ? decoded : undefined;
-  } catch {
-    // A literal percent sign or incomplete escape is a valid filesystem name.
-    return undefined;
-  }
-}
 /** Network routing and public destination checks belong to the transport.
  * Only validated image bytes cross the archive boundary. */
 export async function downloadChatImage(
diff --git a/packages/runtime-host/src/server/execution-artifacts.ts b/packages/runtime-host/src/server/execution-artifacts.ts
index b3a08d8d81..9e63f59e94 100644
--- a/packages/runtime-host/src/server/execution-artifacts.ts
+++ b/packages/runtime-host/src/server/execution-artifacts.ts
@@ -21,11 +21,6 @@ import { createHash } from 'node:crypto';
 import { open, realpath, stat } from 'node:fs/promises';
 import { isAbsolute, resolve } from 'node:path';
 import { MAX_ATTACHMENT_BYTES } from '@maka/core/attachments';
-import {
-  ARTIFACT_IMAGE_PREVIEW_MAX_BYTES,
-  normalizeArtifactImagePreviewMime,
-} from '@maka/core/artifacts';
-import type { BuildBuiltinToolsOptions } from '@maka/runtime/builtin-tools';
 import {
   createToolResultArchiveCapability,
   type ToolResultArchiveCapability,
@@ -40,18 +35,13 @@ import type { ToolResultArchiveEvidenceReader } from '@maka/core/tool-result-arc
 import { type ToolArtifactRecorderInput } from '@maka/runtime/tool-artifacts';
 import type { ToolResultArchiveReaderInput } from '@maka/runtime/context-budget';
 import { type ToolResultArchiveResourceReadInput } from '@maka/runtime/tool-result-archive-resource';
-import {
-  ImageArchiveQuotaError,
-  type InteractiveArtifactStoreWriter,
-} from '@maka/storage/artifact-stores';
+import type { InteractiveArtifactStoreWriter } from '@maka/storage/artifact-stores';
 import type { SessionManagerDeps } from '@maka/runtime/session-manager';
 import type { SessionAdmissionGate } from './session-admission-gate.js';
 import type { SessionPresenceReader } from './session-presence.js';
-import { readyChatImageArtifact } from './chat-image-artifact.js';
 
 export interface HostExecutionArtifactServices {
   recordToolArtifacts(event: ToolArtifactRecorderInput): Promise<void>;
-  publishImage: NonNullable<BuildBuiltinToolsOptions['publishImage']>;
   publishChildWorkspacePatch: NonNullable<SessionManagerDeps['publishChildWorkspacePatch']>;
   /**
    * New archives use the Session ledger. Legacy Artifact refs are retained as
@@ -66,13 +56,12 @@ export function createHostExecutionArtifactServices(input: {
   sessionAdmission: SessionAdmissionGate;
   sessions: SessionPresenceReader;
   archiveEvidence?: ToolResultArchiveEvidenceReader;
-  imageArchiveLimits?: import('@maka/core/image-delivery').ImageArchiveLimits;
 }): HostExecutionArtifactServices {
   const runWrite = async <T>(operation: () => Promise<T>): Promise<T> => {
     try {
       return await operation();
     } catch (error) {
-      if (!(error instanceof ImageArchiveQuotaError)) input.requestDrain();
+      input.requestDrain();
       throw error;
     }
   };
@@ -129,32 +118,6 @@ export function createHostExecutionArtifactServices(input: {
   };
   const services: HostExecutionArtifactServices = {
     recordToolArtifacts,
-    publishImage: async (image) => {
-      const mimeType = normalizeArtifactImagePreviewMime(image.mimeType);
-      if (!mimeType || image.bytes.byteLength > ARTIFACT_IMAGE_PREVIEW_MAX_BYTES)
-        throw new Error(
-          'Image cannot be displayed in chat; use a PNG/JPEG/GIF/WebP of at most 2 MiB.',
-        );
-      const id = `published_image_${createHash('sha256')
-        .update(JSON.stringify([image.sessionId, image.turnId, image.toolCallId]))
-        .digest('hex')}`;
-      const artifact = await publish(
-        readyChatImageArtifact({
-          id,
-          sessionId: image.sessionId,
-          turnId: image.turnId,
-          name: image.name,
-          messageId: image.toolCallId,
-          source: `published:${image.toolCallId}`,
-          image: { bytes: image.bytes, mimeType },
-          summary: 'Published chat image',
-          limits: input.imageArchiveLimits,
-        }),
-      );
-      if (!artifact)
-        throw new Error('The session was removed before the image could be published.');
-      return { kind: 'session_file', sessionId: image.sessionId, relativePath: artifact.id };
-    },
     publishChildWorkspacePatch: async ({ sessionId, turnId, binding, patch }) => {
       const artifact = await publish({
         id: subagentWritebackArtifactId(sessionId, turnId),
diff --git a/packages/runtime-host/src/server/execution-composition.ts b/packages/runtime-host/src/server/execution-composition.ts
index 1a3b1e7c52..f7df7c4364 100644
--- a/packages/runtime-host/src/server/execution-composition.ts
+++ b/packages/runtime-host/src/server/execution-composition.ts
@@ -571,7 +571,6 @@ export async function createExecutionRuntimeHostComposition(
     });
     archiveEvidence = await openToolResultArchiveEvidenceReader(context.owner.lease);
     const executionArtifacts = createHostExecutionArtifactServices({
-      ...(options.imageArchiveLimits ? { imageArchiveLimits: options.imageArchiveLimits } : {}),
       archiveEvidence,
       artifacts: openedArtifactStore,
       requestDrain: context.requestDrain,
@@ -643,7 +642,6 @@ export async function createExecutionRuntimeHostComposition(
       artifactStore: openedArtifactStore,
     });
     const builtinTools = {
-      publishImage: executionArtifacts.publishImage,
       shellRuns: runtimeResources,
       runtimeResources,
       attachmentResources,
@@ -1896,9 +1894,7 @@ export async function createExecutionRuntimeHostComposition(
       // Fresh WorkHub Turns use the coordinating Agent directly. Persisted
       // routing decisions remain readable for recovery of historical Turns.
       undefined,
-      (sessionId, event) => {
-        if (event.type === 'text_complete') imageDelivery?.observe(sessionId, event);
-      },
+      (sessionId, event) => imageDelivery?.observe(sessionId, event),
     );
     const coordinator = rootCoordinator;
     const pluginModel = createHostPluginModel({
diff --git a/packages/runtime-host/src/server/root-turn-coordinator.ts b/packages/runtime-host/src/server/root-turn-coordinator.ts
index 782b013711..895ea56612 100644
--- a/packages/runtime-host/src/server/root-turn-coordinator.ts
+++ b/packages/runtime-host/src/server/root-turn-coordinator.ts
@@ -389,10 +389,7 @@ export class RootTurnCoordinator implements HostedExecutionAuthority {
     ) => Promise<WorkHubRoutingDecision | undefined>,
     private readonly observeAssistantText?: (
       sessionId: string,
-      event:
-        | import('@maka/core/events').TextDeltaEvent
-        | import('@maka/core/events').TextCompleteEvent
-        | import('@maka/core/events').CompleteEvent,
+      event: import('@maka/core/events').TextCompleteEvent,
     ) => void,
   ) {
     this.stores = authenticateExecutionStoresWriter(stores, 'interactive');
@@ -3234,11 +3231,7 @@ export class RootTurnCoordinator implements HostedExecutionAuthority {
               // Presentation observers do not participate in execution authority.
             }
           }
-          if (
-            event.type === 'text_delta' ||
-            event.type === 'text_complete' ||
-            event.type === 'complete'
-          ) {
+          if (event.type === 'text_complete') {
             try {
               this.observeAssistantText?.(input.sessionId, event);
             } catch {
diff --git a/packages/runtime/src/__tests__/builtin-tools-file-worker.test.ts b/packages/runtime/src/__tests__/builtin-tools-file-worker.test.ts
index b7d34f4e57..420b06b75b 100644
--- a/packages/runtime/src/__tests__/builtin-tools-file-worker.test.ts
+++ b/packages/runtime/src/__tests__/builtin-tools-file-worker.test.ts
@@ -42,42 +42,6 @@ afterEach(async () => {
 });
 
 describe('builtin file tools use the sandboxed worker', () => {
-  test('PublishImage never publishes when the image read is refused or invalid', async () => {
-    const cwd = await temporaryDirectory('maka-publish-image-admission-');
-    let published = 0;
-    const tools = buildBuiltinTools({
-      publishImage: async () => {
-        published++;
-        return { kind: 'session_file', sessionId: 'session-1', relativePath: 'image-1' };
-      },
-    });
-    // The same managed boundary as Read: no fallback to an unsandboxed host read.
-    await assert.rejects(
-      runTool(tools, 'PublishImage', { path: 'private.png' }, cwd),
-      /worker|sandbox/i,
-    );
-    assert.equal(published, 0);
-    await writeFile(join(cwd, 'text.txt'), 'not an image');
-    const tool = tools.find((tool) => tool.name === 'PublishImage')!;
-    await assert.rejects(
-      async () =>
-        tool.impl(
-          { path: 'text.txt' },
-          {
-            sessionId: 'session-1',
-            turnId: 'turn-1',
-            toolCallId: 'publish',
-            cwd,
-            permissionMode: 'bypass',
-            executionBoundary: { kind: 'bypass', revision: 0 },
-            abortSignal: new AbortController().signal,
-            emitOutput() {},
-          },
-        ),
-      /not a supported.*PNG/,
-    );
-    assert.equal(published, 0);
-  });
   test('direct Read rejects invalid coordinates before selecting any backend', async () => {
     const cwd = await temporaryDirectory('maka-read-coordinates-');
     await writeFile(join(cwd, 'sample.txt'), 'one\ntwo\nthree');
diff --git a/packages/runtime/src/__tests__/image-file.test.ts b/packages/runtime/src/__tests__/image-file.test.ts
index 194ae70c55..77010595bb 100644
--- a/packages/runtime/src/__tests__/image-file.test.ts
+++ b/packages/runtime/src/__tests__/image-file.test.ts
@@ -32,7 +32,6 @@ import { createImageFileReader, ImageFileReadError } from '../image-file-reader.
 import { FilesystemWorkerClientError } from '../filesystem-worker/client.js';
 import { executeFilesystemWorkerRequest } from '../filesystem-worker/operations.js';
 import { FILESYSTEM_WORKER_PROTOCOL_VERSION } from '../filesystem-worker/protocol.js';
-import { buildBuiltinTools } from '../builtin-tools.js';
 
 const ONE_PIXEL_PNG = Buffer.from(
   'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8DwHwAFBQIAX8jx0gAAAABJRU5ErkJggg==',
@@ -160,34 +159,6 @@ for (const route of ['workspace', 'worker'] as const) {
   });
 }
 
-test('PublishImage saves a wide screenshot through the same chat read policy', async (t) => {
-  const cwd = await mkdtemp(join(tmpdir(), 'maka-publish-wide-'));
-  t.after(() => rm(cwd, { recursive: true, force: true }));
-  await writeFile(join(cwd, 'wide.png'), WIDE_PNG);
-  let published = false;
-  const tool = buildBuiltinTools({
-    publishImage: async ({ bytes }) => {
-      assert.deepEqual(Buffer.from(bytes), WIDE_PNG);
-      published = true;
-      return { kind: 'session_file', sessionId: 'session', relativePath: 'saved-image' };
-    },
-  }).find((tool) => tool.name === 'PublishImage')!;
-  await tool.impl(
-    { path: 'wide.png' },
-    {
-      sessionId: 'session',
-      turnId: 'turn',
-      toolCallId: 'publish',
-      cwd,
-      permissionMode: 'bypass',
-      executionBoundary: { kind: 'bypass', revision: 0 },
-      abortSignal: new AbortController().signal,
-      emitOutput() {},
-    },
-  );
-  assert.equal(published, true);
-});
-
 test('chat reads reject FIFOs without waiting for a writer', {
   skip: process.platform === 'win32',
   timeout: 1000,
diff --git a/packages/runtime/src/__tests__/tool-availability.test.ts b/packages/runtime/src/__tests__/tool-availability.test.ts
index d7240b362e..433ba95708 100644
--- a/packages/runtime/src/__tests__/tool-availability.test.ts
+++ b/packages/runtime/src/__tests__/tool-availability.test.ts
@@ -124,15 +124,13 @@ describe('ToolAvailabilityRuntime — search activation', () => {
 
   test('a group cannot defer the fixed direct baseline', () => {
     const plan = new ToolAvailabilityRuntime(
-      [tool('Read'), tool('PublishImage'), tool('browser_click')],
-      { groups: [{ id: 'bad-source', toolNames: ['Read', 'PublishImage', 'browser_click'] }] },
+      [tool('Read'), tool('browser_click')],
+      { groups: [{ id: 'bad-source', toolNames: ['Read', 'browser_click'] }] },
       invalid,
     ).prepare(new Map());
     assert.ok(plan.activeTools.includes('Read'));
-    assert.ok(plan.activeTools.includes('PublishImage'));
     assert.ok(!plan.activeTools.includes('browser_click'));
     assert.doesNotMatch(searchTool(plan).description, /- Read/);
-    assert.doesNotMatch(searchTool(plan).description, /- PublishImage/);
   });
 
   test('skill discovery tools stay direct while search is enabled', () => {
diff --git a/packages/runtime/src/builtin-tools.ts b/packages/runtime/src/builtin-tools.ts
index 7fc6492405..df4d176468 100644
--- a/packages/runtime/src/builtin-tools.ts
+++ b/packages/runtime/src/builtin-tools.ts
@@ -43,11 +43,7 @@ import {
 import { tmpdir } from 'node:os';
 import { basename, dirname, isAbsolute } from 'node:path';
 import { compilePermissionProfile } from '@maka/core/permission-profile-compiler';
-import { formatAttachmentResourceRef, parseAttachmentResourceRef } from '@maka/core/attachments';
-import {
-  ARTIFACT_IMAGE_PREVIEW_MAX_BYTES,
-  normalizeArtifactImagePreviewMime,
-} from '@maka/core/artifacts';
+import { parseAttachmentResourceRef } from '@maka/core/attachments';
 import { type SandboxBoundaryExpansion } from '@maka/core/sandbox-boundary';
 import { isStorageRef, type StorageRef, type ToolResultContent } from '@maka/core/events';
 import { type PermissionProfile } from '@maka/core/permission-profile';
@@ -209,15 +205,6 @@ export interface BuildBuiltinToolsOptions {
     mimeType: string;
   }) => Promise<Extract<StorageRef, { kind: 'session_context' }>>;
   releaseImageSnapshot?: (input: { sessionId: string; refId: string }) => Promise<void>;
-  /** Publish bytes already admitted by the filesystem read boundary. */
-  publishImage?: (input: {
-    sessionId: string;
-    turnId: string;
-    toolCallId: string;
-    name: string;
-    bytes: Uint8Array;
-    mimeType: string;
-  }) => Promise<Extract<StorageRef, { kind: 'session_file' }>>;
 }
 
 export function buildBuiltinTools(options: BuildBuiltinToolsOptions = {}): MakaTool[] {
@@ -308,59 +295,6 @@ export function buildBuiltinTools(options: BuildBuiltinToolsOptions = {}): MakaT
   const tools: MakaTool[] = [
     ...bashTools,
     ...backgroundTools,
-    ...(options.publishImage
-      ? [
-          {
-            name: 'PublishImage',
-            activityKind: 'read' as const,
-            description:
-              'Publish a local PNG/JPEG/GIF/WebP image as a durable attachment in the current chat. ' +
-              'Use this after generating a screenshot or image to show it to the user. ' +
-              'Returns a resource URL and ready-to-use Markdown. Use this to save a copy before deleting or replacing the source; ordinary image Markdown is captured automatically by the Host. ' +
-              'Images must be at most 2 MiB; resize larger images first. File access uses the same permissions as Read.',
-            parameters: z.object({
-              path: z
-                .string()
-                .describe('Local image path; relative paths resolve from the session cwd.'),
-            }),
-            executionFacts,
-            impl: async ({ path }: { path: string }, ctx: MakaToolContext) => {
-              const result = await filesystem.execute({
-                operation: { kind: 'read', path, imagePurpose: 'chat' },
-                ...filesystemCall(ctx),
-              });
-              if (
-                result.kind !== 'read_image' ||
-                !normalizeArtifactImagePreviewMime(result.mimeType)
-              )
-                throw new Error('PublishImage requires a PNG, JPEG, GIF, or WebP image.');
-              if (result.bytes.byteLength > ARTIFACT_IMAGE_PREVIEW_MAX_BYTES)
-                throw new Error(
-                  'Image exceeds the 2 MiB chat preview limit; resize it before publishing.',
-                );
-              ctx.abortSignal.throwIfAborted();
-              const ref = await options.publishImage!({
-                sessionId: ctx.sessionId,
-                turnId: ctx.turnId,
-                toolCallId: ctx.toolCallId,
-                name: basename(path),
-                bytes: result.bytes,
-                mimeType: result.mimeType,
-              });
-              const resource =
-                ref.sessionId === ctx.sessionId ? formatAttachmentResourceRef(ref) : null;
-              if (!resource)
-                throw new Error('Image publication did not return a valid session attachment.');
-              const name = basename(path).replace(/[\[\]\\\r\n]/g, '_');
-              return {
-                published: true,
-                resource,
-                markdown: `![${name}](${resource})`,
-              };
-            },
-          } satisfies MakaTool,
-        ]
-      : []),
     {
       name: 'Read',
       activityKind: 'read',
diff --git a/packages/runtime/src/system-prompt/main-session-prompt.ts b/packages/runtime/src/system-prompt/main-session-prompt.ts
index 517e984f9b..0059d45694 100644
--- a/packages/runtime/src/system-prompt/main-session-prompt.ts
+++ b/packages/runtime/src/system-prompt/main-session-prompt.ts
@@ -53,8 +53,8 @@ Use short headings and flat lists to organize longer answers.
 Use fenced code blocks for multiline code and backticks for inline commands, paths, identifiers, and literal values.
 Prefer descriptive link text for external sources when it is available.
 To deliver a generated screenshot or local image, include a Markdown image with its absolute path. The Host automatically saves supported local images after the assistant message completes. Supported remote images in completed assistant messages load automatically near the viewport, subject to the application's outbound/privacy policy and proxy settings. This media loading is independent of session subprocess network restrictions; include remote images only when relevant to the user's request. Reading an image for your own inspection does not deliver it.
-If you need to delete or replace the source file immediately, use PublishImage when available first and include its returned Markdown. Keep source files available until capture finishes. Images above the save limits cannot be previewed automatically.
-Only claim an image was saved after publication succeeds. Saving does not confirm that the client displayed it.
+Keep source files available until capture finishes. Images above the save limits cannot be previewed automatically.
+Including image Markdown does not confirm that capture succeeded or that the client displayed it.
 Follow a more specific format requested by the user or task.`;
 }
 
diff --git a/packages/runtime/src/tool-availability.ts b/packages/runtime/src/tool-availability.ts
index 12d9803c9c..182a854d03 100644
--- a/packages/runtime/src/tool-availability.ts
+++ b/packages/runtime/src/tool-availability.ts
@@ -39,7 +39,6 @@ export const TOOL_SEARCH_MAX_SCHEMA_CHARS = 64 * 1024;
 const DIRECT_TOOL_NAMES: ReadonlySet<string> = new Set([
   'Bash',
   'Read',
-  'PublishImage',
   'Write',
   'Edit',
   'Glob',
diff --git a/packages/storage/src/__tests__/image-delivery-storage.test.ts b/packages/storage/src/__tests__/image-delivery-storage.test.ts
index 86972386ad..f3a10a734a 100644
--- a/packages/storage/src/__tests__/image-delivery-storage.test.ts
+++ b/packages/storage/src/__tests__/image-delivery-storage.test.ts
@@ -25,7 +25,6 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { createHash } from 'node:crypto';
 import { createSqliteArtifactStoreWriteAuthority } from '../artifact-store.js';
-import { migrateSqliteArtifactDatabase } from '../sqlite-artifact-schema.js';
 import { assertImageArchiveQuota, ImageArchiveQuotaError } from '../artifact-image-storage.js';
 import { DEFAULT_IMAGE_ARCHIVE_LIMITS } from '@maka/core/image-delivery';
 import { readImageDeliveryAttempt } from '../sqlite-image-delivery.js';
@@ -41,7 +40,56 @@ const lookup = (
   i = identity,
 ) => store.findImageDelivery(i.sessionId, i.turnId, i.messageId, i.source);
 
-test('attempts survive reopen and copy, never appear as files, and purge without an artifact', async () => {
+test('schema 3 upgrades directly to 4 without rewriting existing artifacts', async () => {
+  const root = await mkdtemp(join(tmpdir(), 'maka-image-schema-'));
+  let authority = createSqliteArtifactStoreWriteAuthority(root);
+  try {
+    const record = await authority.store.create({
+      sessionId: identity.sessionId,
+      turnId: identity.turnId,
+      id: 'existing-file',
+      name: 'note.txt',
+      kind: 'file',
+      source: 'tool_result',
+      content: 'retained',
+    });
+    authority.close();
+    const db = new DatabaseSync(join(root, 'runtime.sqlite'));
+    try {
+      db.exec(`DROP TABLE image_delivery_attempts; DROP INDEX artifact_image_delivery_lookup;
+        UPDATE operational_schema_migrations SET version = 3 WHERE scope = 'artifact';`);
+    } finally {
+      db.close();
+    }
+    authority = createSqliteArtifactStoreWriteAuthority(root);
+    assert.deepEqual(await authority.store.listTurnArtifacts(identity.sessionId, identity.turnId), [
+      record,
+    ]);
+    const text = await authority.store.readTextInSession(identity.sessionId, record.id);
+    assert.ok(text.ok);
+    if (text.ok) assert.equal(text.text, 'retained');
+    const reopened = new DatabaseSync(join(root, 'runtime.sqlite'), { readOnly: true });
+    try {
+      assert.equal(
+        reopened
+          .prepare("SELECT version FROM operational_schema_migrations WHERE scope = 'artifact'")
+          .get()?.version,
+        4,
+      );
+      assert.equal(
+        reopened.prepare('SELECT COUNT(*) AS n FROM image_delivery_attempts').get()?.n,
+        0,
+      );
+    } finally {
+      reopened.close();
+    }
+  } finally {
+    authority.close();
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test('attempts survive reopen, stay out of conversation copies, and purge without an artifact', async () => {
   const root = await mkdtemp(join(tmpdir(), 'maka-image-attempt-'));
   let authority = createSqliteArtifactStoreWriteAuthority(root);
   try {
@@ -66,16 +114,10 @@ test('attempts survive reopen and copy, never appear as files, and purge without
       turnIds: [identity.turnId],
     });
     const copied = { ...identity, sessionId: 'session-2' };
-    assert.deepEqual(await lookup(authority.store, copied), {
-      status: 'failed',
-      reason: 'not_found',
-    });
+    assert.equal(await lookup(authority.store, copied), undefined);
     await authority.store.purgeSessionArtifacts(identity.sessionId);
     assert.equal(await lookup(authority.store), undefined);
-    assert.deepEqual(await lookup(authority.store, copied), {
-      status: 'failed',
-      reason: 'not_found',
-    });
+    assert.equal(await lookup(authority.store, copied), undefined);
   } finally {
     authority.close();
     await rm(root, { recursive: true, force: true });
@@ -125,7 +167,7 @@ test('successful publication atomically supersedes attempts and cannot be downgr
           messageId: identity.messageId,
           source: identity.source,
           status: 'pending',
-        },
+        } as never,
       }),
       /Invalid image delivery metadata/,
     );
@@ -135,53 +177,6 @@ test('successful publication atomically supersedes attempts and cannot be downgr
   }
 });
 
-test('v4 placeholder migration preserves terminal precedence and schedules safe file cleanup', () => {
-  const db = new DatabaseSync(':memory:');
-  try {
-    migrateSqliteArtifactDatabase(db);
-    for (const status of ['pending', 'failed'] as const) {
-      const record = {
-        sessionId: identity.sessionId,
-        turnId: identity.turnId,
-        id: status,
-        name: 'chat-image',
-        kind: 'file',
-        sizeBytes: 0,
-        createdAt: 1,
-        relativePath: `session-1/${status}-chat-image`,
-        source: 'tool_result_projection',
-        imageDelivery: {
-          messageId: identity.messageId,
-          source: identity.source,
-          status,
-          ...(status === 'failed' ? { reason: 'not_found' } : {}),
-        },
-      };
-      db.prepare('INSERT INTO artifact_records VALUES (?, ?, ?, ?, ?)').run(
-        record.id,
-        record.sessionId,
-        record.createdAt,
-        record.relativePath,
-        JSON.stringify(record),
-      );
-    }
-    migrateSqliteArtifactDatabase(db);
-    assert.deepEqual(readImageDeliveryAttempt(db, identity), {
-      status: 'failed',
-      reason: 'not_found',
-    });
-    assert.equal(db.prepare('SELECT COUNT(*) AS n FROM artifact_records').get()?.n, 0);
-    assert.equal(db.prepare('SELECT COUNT(*) AS n FROM artifact_upgrade_orphan_paths').get()?.n, 2);
-    migrateSqliteArtifactDatabase(db);
-    assert.deepEqual(readImageDeliveryAttempt(db, identity), {
-      status: 'failed',
-      reason: 'not_found',
-    });
-  } finally {
-    db.close();
-  }
-});
-
 test('archive policy enforces defaults even when a caller omits its limits', () => {
   const existing = {
     id: 'existing',
diff --git a/packages/storage/src/artifact-store.ts b/packages/storage/src/artifact-store.ts
index 8202c1b6c7..745c94db5b 100644
--- a/packages/storage/src/artifact-store.ts
+++ b/packages/storage/src/artifact-store.ts
@@ -423,7 +423,7 @@ class SqliteArtifactStore implements ArtifactAuthorityStore {
       }
       requestedLinkedArtifactIds.set(linked.sessionId, artifactIds);
     }
-    const { records, attempts } = await this.enqueue(async () => {
+    const records = await this.enqueue(async () => {
       await this.load();
       const selected = this.records
         .filter(
@@ -454,12 +454,7 @@ class SqliteArtifactStore implements ArtifactAuthorityStore {
           selectedIds.add(record.id);
         }
       }
-      return {
-        records: selected,
-        attempts: this.metadataRepository.readImageDeliveryAttempts(input.sourceSessionId, [
-          ...turnIds,
-        ]),
-      };
+      return selected;
     });
 
     const artifactIds = new Map<string, string>();
@@ -484,9 +479,7 @@ class SqliteArtifactStore implements ArtifactAuthorityStore {
       artifactIds.set(record.id, created.id);
       relativePaths.set(record.relativePath, created.relativePath);
     }
-    await this.enqueueMutation(async () =>
-      this.metadataRepository.copyImageDeliveryAttempts(attempts, input.targetSessionId),
-    );
+
     return { artifactIds, relativePaths };
   }
 
diff --git a/packages/storage/src/sqlite-artifact-metadata.ts b/packages/storage/src/sqlite-artifact-metadata.ts
index 2184a1617b..569f9c551f 100644
--- a/packages/storage/src/sqlite-artifact-metadata.ts
+++ b/packages/storage/src/sqlite-artifact-metadata.ts
@@ -27,8 +27,6 @@ import {
   readImageDeliveryAttempt,
   writeImageDeliveryAttempt,
   removeImageDeliveryAttempt,
-  readImageDeliveryAttempts,
-  type StoredImageDeliveryAttempt,
 } from './sqlite-image-delivery.js';
 import type { ArtifactRecord } from '@maka/core/artifacts';
 import { decodeArtifactRecordJsons } from './artifact-metadata-codec.js';
@@ -96,40 +94,6 @@ class SqliteArtifactMetadataRepository {
     });
   }
 
-  readImageDeliveryAttempts(
-    sessionId: string,
-    turnIds: readonly string[],
-  ): StoredImageDeliveryAttempt[] {
-    this.assertOpen();
-    return readImageDeliveryAttempts(this.#lease.database, sessionId, turnIds);
-  }
-
-  copyImageDeliveryAttempts(
-    attempts: readonly StoredImageDeliveryAttempt[],
-    targetSessionId: string,
-  ): void {
-    this.assertOpen();
-    this.#lease.transaction('write', () => {
-      for (const record of attempts) {
-        const identity = { ...record.identity, sessionId: targetSessionId };
-        if (
-          !this.findImageDelivery(
-            identity.sessionId,
-            identity.turnId,
-            identity.messageId,
-            identity.source,
-          )
-        )
-          writeImageDeliveryAttempt(
-            this.#lease.database,
-            identity,
-            record.attempt,
-            record.createdAt,
-          );
-      }
-    });
-  }
-
   purgeImageDeliveryAttempts(sessionId: string): void {
     this.assertOpen();
     this.#lease.transaction('write', () => {
diff --git a/packages/storage/src/sqlite-artifact-schema.ts b/packages/storage/src/sqlite-artifact-schema.ts
index f272553be6..3ad1819785 100644
--- a/packages/storage/src/sqlite-artifact-schema.ts
+++ b/packages/storage/src/sqlite-artifact-schema.ts
@@ -23,9 +23,9 @@ import {
   isSafeRelativeArtifactPath,
 } from './artifact-metadata-codec.js';
 
-import { migrateImageDeliveryAttempts } from './sqlite-image-delivery.js';
+import { createImageDeliveryAttemptTable } from './sqlite-image-delivery.js';
 
-export const SQLITE_ARTIFACT_SCHEMA_VERSION = 5;
+export const SQLITE_ARTIFACT_SCHEMA_VERSION = 4;
 
 export function migrateSqliteArtifactDatabase(db: DatabaseSync): void {
   const columns = db.prepare('PRAGMA table_info(artifact_records)').all() as Array<{
@@ -109,5 +109,5 @@ export function migrateSqliteArtifactDatabase(db: DatabaseSync): void {
       JSON.stringify(record),
     );
   }
-  migrateImageDeliveryAttempts(db);
+  createImageDeliveryAttemptTable(db);
 }
diff --git a/packages/storage/src/sqlite-image-delivery.ts b/packages/storage/src/sqlite-image-delivery.ts
index 0b846653ec..678d46926a 100644
--- a/packages/storage/src/sqlite-image-delivery.ts
+++ b/packages/storage/src/sqlite-image-delivery.ts
@@ -19,11 +19,14 @@
 
 import type { DatabaseSync } from 'node:sqlite';
 import type { ImageDeliveryIdentity, ImageDeliveryAttempt } from '@maka/core/image-delivery';
-import { isImageDeliveryMetadata, IMAGE_DELIVERY_FAILURES } from '@maka/core/image-delivery';
-import { decodeArtifactRecordJsons } from './artifact-metadata-codec.js';
+import {
+  isImageDeliveryAttempt,
+  isImageDeliveryRequest,
+  IMAGE_DELIVERY_FAILURES,
+} from '@maka/core/image-delivery';
 
 /** Shares the Artifact writer's transaction and lock; no payload files for attempts. */
-export function migrateImageDeliveryAttempts(db: DatabaseSync): void {
+export function createImageDeliveryAttemptTable(db: DatabaseSync): void {
   db.exec(`CREATE TABLE IF NOT EXISTS image_delivery_attempts (
     session_id TEXT NOT NULL, turn_id TEXT NOT NULL, message_id TEXT NOT NULL,
     source TEXT NOT NULL, status TEXT NOT NULL CHECK (status IN ('pending', 'failed')),
@@ -31,24 +34,6 @@ export function migrateImageDeliveryAttempts(db: DatabaseSync): void {
     CHECK ((status = 'pending' AND reason IS NULL) OR (status = 'failed' AND reason IS NOT NULL)),
     PRIMARY KEY (session_id, turn_id, message_id, source)
   )`);
-  const rows = db
-    .prepare(`SELECT record_json FROM artifact_records
-    WHERE json_valid(record_json) AND json_extract(record_json, '$.imageDelivery.status') IN ('pending', 'failed')
-    ORDER BY CASE json_extract(record_json, '$.imageDelivery.status') WHEN 'pending' THEN 1 ELSE 0 END,
-      created_at DESC, artifact_id DESC`)
-    .all() as { record_json: string }[];
-  for (const record of decodeArtifactRecordJsons(rows.map((row) => row.record_json))) {
-    const metadata = record.imageDelivery!;
-    const identity = { sessionId: record.sessionId, turnId: record.turnId, ...metadata };
-    // An interrupted older capture can leave both a pending and a terminal row.
-    if (!readImageDeliveryAttempt(db, identity)) {
-      writeImageDeliveryAttempt(db, identity, metadata as ImageDeliveryAttempt, record.createdAt);
-    }
-    db.prepare('INSERT OR IGNORE INTO artifact_upgrade_orphan_paths VALUES (?)').run(
-      record.relativePath,
-    );
-    db.prepare('DELETE FROM artifact_records WHERE artifact_id = ?').run(record.id);
-  }
 }
 
 export function readImageDeliveryAttempt(
@@ -79,12 +64,12 @@ export function writeImageDeliveryAttempt(
   now = Date.now(),
 ): void {
   if (
-    !isImageDeliveryMetadata({
+    !isImageDeliveryRequest({
+      turnId: identity.turnId,
       messageId: identity.messageId,
       source: identity.source,
-      ...attempt,
     }) ||
-    (attempt.status !== 'pending' && attempt.status !== 'failed')
+    !isImageDeliveryAttempt(attempt)
   )
     throw new Error('Invalid image delivery attempt');
   db.prepare(`INSERT INTO image_delivery_attempts VALUES (?, ?, ?, ?, ?, ?, ?)
@@ -105,40 +90,6 @@ export function removeImageDeliveryAttempt(
   ).run(...identityValues(identity));
 }
 
-export interface StoredImageDeliveryAttempt {
-  readonly identity: ImageDeliveryIdentity;
-  readonly attempt: ImageDeliveryAttempt;
-  readonly createdAt: number;
-}
-
-export function readImageDeliveryAttempts(
-  db: DatabaseSync,
-  sessionId: string,
-  turnIds: readonly string[],
-): StoredImageDeliveryAttempt[] {
-  const query = db.prepare(
-    'SELECT message_id, source, status, reason, created_at FROM image_delivery_attempts WHERE session_id = ? AND turn_id = ?',
-  );
-  return turnIds.flatMap((turnId) =>
-    (
-      query.all(sessionId, turnId) as {
-        message_id: string;
-        source: string;
-        status: string;
-        reason: unknown;
-        created_at: number;
-      }[]
-    ).map((row) => {
-      const identity = { sessionId, turnId, messageId: row.message_id, source: row.source };
-      return {
-        identity,
-        attempt: decodeAttempt(row),
-        createdAt: row.created_at,
-      };
-    }),
-  );
-}
-
 function identityValues(identity: ImageDeliveryIdentity): [string, string, string, string] {
   return [identity.sessionId, identity.turnId, identity.messageId, identity.source];
 }
diff --git a/packages/ui/scripts/markdown-images.browser.test.mjs b/packages/ui/scripts/markdown-images.browser.test.mjs
index 07f1ac33fb..4f0d873537 100644
--- a/packages/ui/scripts/markdown-images.browser.test.mjs
+++ b/packages/ui/scripts/markdown-images.browser.test.mjs
@@ -23,69 +23,18 @@
 import assert from 'node:assert/strict';
 import { before, after, test } from 'node:test';
 import { createServer } from 'node:http';
-import { readFile, mkdir } from 'node:fs/promises';
-import { join } from 'node:path';
+import { readFile } from 'node:fs/promises';
 import { fileURLToPath } from 'node:url';
-import { crc32, deflateSync } from 'node:zlib';
 import { build } from 'esbuild';
 import { chromium } from '@playwright/test';
 
 const root = fileURLToPath(new URL('../../../', import.meta.url));
 const png = Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8DwHwAFBQIAX8jx0gAAAABJRU5ErkJggg==', 'base64');
-const badge = Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAFAAAAAUCAYAAAAa2LrXAAAATklEQVR4nO3OsQ0AIAzAsJ7O5/QIhsgSg3fPnLnfgzygywO6PKDLA7o8oMsDujygywO6PKDLA7o8oMsDujygywO6PKDLA7o8oMsDujyAW5KWWkgoVkkSAAAAAElFTkSuQmCC', 'base64');
-const dimensions = [
-  ['small', 80, 20], ['square', 1000, 1000], ['landscape', 1600, 900],
-  ['portrait', 900, 1600], ['panorama', 2000, 100], ['tall', 100, 2000], ['pixel', 1, 1],
-];
 let appServer, imageServer, browser, appUrl, imageUrl;
 let requests = [], failedOnce = false;
-let releaseImage;
-let releaseAttachment;
-const delayedImage = new Promise(resolve => { releaseImage = resolve; });
-const delayedAttachment = new Promise(resolve => { releaseAttachment = resolve; });
-
-// Keep the screenshot's original dimensions without committing evidence images.
-function screenshotFixture(width = 900, height = 730) {
-  const header = Buffer.alloc(13);
-  header.writeUInt32BE(width, 0); header.writeUInt32BE(height, 4);
-  header[8] = 8; header[9] = 2; // 8-bit RGB.
-  const stride = 1 + width * 3;
-  const pixels = Buffer.alloc(stride * height, 220);
-  for (let row = 0; row < height; row++) {
-    pixels.fill(row < height / 2 ? 120 : 220, row * stride, (row + 1) * stride);
-    pixels[row * stride] = 0; // PNG filter: None.
-  }
-  const chunk = (type, data) => {
-    const result = Buffer.alloc(data.length + 12);
-    result.writeUInt32BE(data.length, 0); result.write(type, 4, 'ascii');
-    data.copy(result, 8);
-    result.writeUInt32BE(crc32(result.subarray(4, data.length + 8)), data.length + 8);
-    return result;
-  };
-  return Buffer.concat([
-    Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]),
-    chunk('IHDR', header), chunk('IDAT', deflateSync(pixels)), chunk('IEND', Buffer.alloc(0)),
-  ]);
-}
-
 before(async () => {
-  const screenshot = screenshotFixture();
-  const sizedImages = new Map(dimensions.map(([name, width, height]) => [`/${name}.png`, screenshotFixture(width, height)]));
   imageServer = createServer((req, res) => {
     requests.push({ path: req.url, referer: req.headers.referer });
-    if (sizedImages.has(req.url)) {
-      res.setHeader('Content-Type', 'image/png'); res.end(sizedImages.get(req.url)); return;
-    }
-    if (req.url === '/delayed.png') {
-      void delayedImage.then(() => { res.setHeader('Content-Type', 'image/png'); res.end(screenshot); });
-      return;
-    }
-    if (req.url === '/screenshot.png') {
-      res.setHeader('Content-Type', 'image/png'); res.end(screenshot); return;
-    }
-    if (req.url === '/badge.png') {
-      res.setHeader('Content-Type', 'image/png'); res.end(badge); return;
-    }
     if (req.url === '/retry.png' && !failedOnce) {
       failedOnce = true;
       res.writeHead(404).end();
@@ -97,7 +46,6 @@ before(async () => {
   await new Promise(resolve => imageServer.listen(0, '127.0.0.1', resolve));
   imageUrl = `http://127.0.0.1:${imageServer.address().port}`;
   const destinations = {
-    ...Object.fromEntries(dimensions.map(([name]) => [`size-${name}`, `![Screenshot](${imageUrl}/${name}.png)`])),
     'links-formats': [
       `![Screenshot](${imageUrl}/image.png)`,
       `![Title](${imageUrl}/title.png "Screenshot title")`,
@@ -112,41 +60,29 @@ before(async () => {
     ].join('\n\n'),
     'links-redacted': `![Signed](${imageUrl}/image.png?token=reasoning-secret)\n\n![Blocked](javascript:alert)`,
     'links-streaming': `![Streaming](${imageUrl}/stream`,
-    'badge-saved': `Build ![Badge](${imageUrl}/badge.png) passing.`,
-    'badge-saving': `Build ![Badge](${imageUrl}/badge.png) passing.`,
-    'badge-list': `- Build ![Badge](${imageUrl}/badge.png) passing.`,
-    'badge-table': `| Build | Result |\n| --- | --- |\n| ![Badge](${imageUrl}/badge.png) | passing |`,
-    'badge-strip': `![Badge](${imageUrl}/badge.png) ![Badge](${imageUrl}/badge.png)`,
-    'layout-main': `## Image delivery\n\nBuild ![Badge](${imageUrl}/badge.png) passing.\n\n![Screenshot](${imageUrl}/screenshot.png)\n\nFollowing paragraph.`,
-    'layout-side': `## Image delivery\n\nBuild ![Badge](${imageUrl}/badge.png) passing.\n\n![Screenshot](${imageUrl}/screenshot.png)\n\nFollowing paragraph.`,
-    'screenshot-saved': '![Screenshot](/tmp/screenshot.png)',
     'angle-saved': '![Screenshot](</tmp/my image.png>)',
     'title-saved': `![Screenshot](${imageUrl}/image.png "Screenshot title")`,
     'escaped-saved': String.raw`![Screenshot](/tmp/a\(1\).png)`,
     'reference-saved': '![Screenshot][picture]\n\n[picture]: </tmp/my "image".png>',
     'attachment-title': '![Screenshot](maka://runtime/attachments/image-1 "Screenshot title")',
-    'geometry-remote': `![Screenshot](${imageUrl}/delayed.png)\n\nFollowing paragraph`,
-    'geometry-saved': '![Screenshot](/tmp/private.png)\n\nFollowing paragraph',
     'streaming-angle-race': '![Screenshot](</tmp/my image.png>)',
     'signed-remote': `![Screenshot](${imageUrl}/image.png?token=remote-secret)`,
     'signed-inline': `Build ![Badge](${imageUrl}/image.png?token=inline-secret) passing.`,
     'signed-failed': `![Screenshot](${imageUrl}/image.png?token=failed-secret)`,
     'signed-preview': `![Screenshot](${imageUrl}/image.png?token=preview-secret)`,
-    screenshot: `![Screenshot](${imageUrl}/screenshot.png)`,
   };
   const canonicalSources = {
     'angle-saved': ['/tmp/my image.png'],
     'title-saved': [`${imageUrl}/image.png`],
     'escaped-saved': ['/tmp/a(1).png'],
     'reference-saved': ['/tmp/my "image".png'],
-    'geometry-saved': ['/tmp/private.png'],
     'streaming-angle-race': ['/tmp/my image.png'],
   };
   const bundle = await build({
     stdin: { contents: `
       import React from 'react';
       import {createRoot} from 'react-dom/client';
-      import {Theme, ChatMessageList, ChatMessage, ChatMessageBubble} from '@astryxdesign/core';
+      import {Theme} from '@astryxdesign/core';
       import {makaTheme} from './apps/desktop/src/renderer/astryx-theme/maka.js';
       import {Markdown} from './packages/ui/dist/markdown.js';
       import {LocaleProvider} from './packages/ui/dist/locale-context.js';
@@ -165,14 +101,11 @@ before(async () => {
       const root=createRoot(document.getElementById('root'));
       const readBytes=async(_session,artifactId)=>{
         if(captured.has(artifactId)) return captured.get(artifactId);
-        if(mode.startsWith('layout-')) await fetch('/fixture/'+encodeURIComponent(artifactId));
-        if(mode.startsWith('badge-')) await fetch('/badge-attachment');
-        if(mode==='geometry-saved') await fetch('/release-attachment');
         reads++; window.imageReads=reads; return (mode==='attachment' || mode==='read-retry-saved') && reads===1 ? {ok:false,reason:'read_failed'} :
-          {ok:true,base64:mode.startsWith('badge-') || artifactId.endsWith('badge.png') ? '${badge.toString('base64')}' : mode==='geometry-saved' || mode==='screenshot-saved' || artifactId.endsWith('screenshot.png') ? '${screenshot.toString('base64')}' : mode.endsWith('corrupt-saved') && reads===1 ? 'iVBORw0KGgo=' : '${png.toString('base64')}',mimeType:'image/png'};
+          {ok:true,base64:mode.endsWith('corrupt-saved') && reads===1 ? 'iVBORw0KGgo=' : '${png.toString('base64')}',mimeType:'image/png'};
       };
       const preview=mode==='preview' || mode==='signed-preview' || mode==='local';
-      const seeded=mode.endsWith('saved') || mode.endsWith('saving') || race || mode.startsWith('badge-') || mode.startsWith('layout-');
+      const seeded=mode.endsWith('saved') || mode.endsWith('saving') || race;
       const resolveDelivery=preview ? undefined : async(_session,request)=>{
         window.deliveryQueries++;
         window.deliverySource=request.source;
@@ -191,21 +124,17 @@ before(async () => {
         }
         if(race) return window.deliveryReady ? {status:'ready',artifactId:'saved-image'} : {status:'unavailable'};
         await new Promise(resolve=>setTimeout(resolve,100));
-        return mode.endsWith('saving') && window.deliveryQueries===1 ? {status:'pending'} : {status:'ready',artifactId:mode.startsWith('layout-') ? request.source : 'saved-image'};
+        return mode.endsWith('saving') && window.deliveryQueries===1 ? {status:'pending'} : {status:'ready',artifactId:'saved-image'};
       };
       const markdown=(streaming)=>React.createElement(ImageMessageProvider,{identity:{turnId:'turn',messageId},streaming},
         React.createElement(Markdown,{text,streaming,settledText:race ? text : undefined,density:'compact',imageDisplay:mode.startsWith('links-') ? 'link' : undefined}));
-      const surface=(streaming)=>mode.startsWith('layout-') ? React.createElement('section',{className:mode==='layout-side' ? 'maka-quote-companion' : '',style:{width:mode==='layout-side' ? '360px' : '100%',maxWidth:'100%'}},
-        React.createElement(ChatMessageList,{className:'maka-chat-message-list maka-chatContent',align:'top'},
-          React.createElement('div',{className:'maka-transcript-turn maka-turn',style:{width:'100%',maxWidth:'var(--maka-reading-measure)',marginInline:'auto'}},
-            React.createElement(ChatMessage,{sender:'assistant'},React.createElement(ChatMessageBubble,{variant:'ghost',width:'100%',className:'maka-chat-message-bubble maka-chat-message-bubble-assistant'},markdown(streaming)))))) : markdown(streaming);
       const render=(streaming=race || mode==='links-streaming')=>root.render(
         React.createElement(Theme,{theme:makaTheme,mode:'light'},
           React.createElement(LocaleProvider,{locale:'en'},
             React.createElement(SessionAttachmentProvider,{sessionId:'session',readBytes},
               React.createElement(ImageDeliveryProvider,{sessionId:'session',resolve:resolveDelivery},
               React.createElement('div',{style:mode==='offscreen' ? {paddingTop:'2500px'} : {}},
-                surface(streaming)))))));
+                markdown(streaming)))))));
       window.nextMessage=()=>{messageId='next-message'; render(false);};
       window.finishStream=()=>render(false);
       window.appendText=value=>{text+=value; render(true);};
@@ -227,9 +156,6 @@ before(async () => {
         res.setHeader('Content-Type','application/json'); res.end(JSON.stringify(payload));
       }).catch(()=>res.end(JSON.stringify({ok:false}))); return;
     }
-    if (req.url.startsWith('/fixture/')) { res.end(); return; }
-    if (req.url === '/badge-attachment') { res.end(); return; }
-    if (req.url === '/release-attachment') { void delayedAttachment.then(() => res.end()); return; }
     if (req.url === '/app.js') { res.setHeader('Content-Type', 'text/javascript'); res.end(js); }
     else if (req.url === '/app.css') { res.setHeader('Content-Type', 'text/css'); res.end(css); }
     else {
@@ -243,7 +169,6 @@ before(async () => {
 });
 
 after(async () => {
-  releaseImage(); releaseAttachment();
   await browser?.close();
   for (const server of [appServer, imageServer]) if (server) await new Promise(resolve => server.close(resolve));
 });
@@ -436,59 +361,6 @@ test('a transient saved attachment read retries its bytes without invalidating a
   } finally { await page.close(); }
 });
 
-for (const scenario of ['local-saved', 'remote-saved', 'badge-saved', 'screenshot-saved']) {
-  test(`${scenario}: clicking the image itself opens the enlarged preview`, async () => {
-    requests = [];
-    const page = await pageFor(scenario);
-    try {
-      const image = page.locator('.maka-markdown-image-preview img');
-      await image.waitFor();
-      await image.evaluate(image => image.decode());
-      assert.equal(await page.evaluate(() => window.imageReads), 1);
-      assert.equal(await page.locator('img').count(), 1);
-      assert.match(await image.getAttribute('src'), /^data:image\/png;base64,/);
-      assert.equal(await page.locator('.maka-markdown-image-expand').count(), 0);
-      assert.equal(await page.getByRole('button', { name: /^Enlarge image:/ }).count(), 1);
-      const source = await image.getAttribute('src');
-      const url = page.url();
-      await image.hover();
-      assert.equal(await image.evaluate(element => getComputedStyle(element).cursor), 'default');
-      const evidence = scenario === 'screenshot-saved' && process.env.MAKA_IMAGE_LAYOUT_EVIDENCE_DIR;
-      if (evidence) {
-        await mkdir(evidence, { recursive: true });
-        await page.screenshot({ path: join(evidence, 'click-image-ready.png'), fullPage: true });
-      }
-      await image.click();
-      const dialog = page.getByRole('dialog');
-      await dialog.waitFor();
-      assert.equal(await dialog.locator('img').getAttribute('src'), source);
-      if (evidence) await page.screenshot({ path: join(evidence, 'click-image-enlarged.png'), fullPage: true });
-      assert.equal(page.url(), url);
-      assert.deepEqual(requests, []);
-      await page.keyboard.press('Escape');
-      await dialog.waitFor({ state: 'hidden' });
-    } finally { await page.close(); }
-  });
-}
-
-for (const [scenario, key] of [['local-saved', 'Enter'], ['local-saved', 'Space'], ['remote-saved', 'Enter']]) {
-  test(`${scenario}: the image itself supports keyboard enlargement with ${key}`, async () => {
-    requests = [];
-    const page = await pageFor(scenario);
-    try {
-      await loaded(page);
-      assert.deepEqual(requests, []);
-      const trigger = page.locator('.maka-markdown-image-trigger');
-      await trigger.focus();
-      await page.keyboard.press(key);
-      await page.getByRole('dialog').waitFor();
-      await page.keyboard.press('Escape');
-      await page.getByRole('dialog').waitFor({ state: 'hidden' });
-      await page.waitForFunction(() => document.activeElement?.classList.contains('maka-markdown-image-trigger'));
-    } finally { await page.close(); }
-  });
-}
-
 test('offscreen image performs no image request until it approaches the viewport', async () => {
   requests = [];
   const page = await pageFor('offscreen');
@@ -551,203 +423,3 @@ for (const scenario of ['angle-saved', 'title-saved', 'escaped-saved', 'referenc
     } finally { await page.close(); }
   });
 }
-
-for (const scenario of ['geometry-remote', 'geometry-saved']) {
-  test(`${scenario}: a compact placeholder expands to the decoded image's natural proportions`, async () => {
-    const page = await pageFor(scenario);
-    try {
-      await page.getByText('Loading image…', { exact: true }).waitFor();
-      const before = await page.getByText('Following paragraph', { exact: true }).boundingBox();
-      if (scenario === 'geometry-remote') releaseImage(); else releaseAttachment();
-      await page.waitForFunction(() => [...document.images].some(image => image.naturalWidth > 1));
-      await page.getByText('Loading image…', { exact: true }).waitFor({ state: 'hidden' });
-      const after = await page.getByText('Following paragraph', { exact: true }).boundingBox();
-      assert.ok(after.y > before.y);
-      const block = await page.locator('.maka-markdown-image-block').boundingBox();
-      const image = await page.locator('.maka-markdown-image-preview img').boundingBox();
-      assert.ok(Math.abs(block.width - image.width) < 1 && Math.abs(block.height - image.height) < 1);
-    } finally {
-      if (scenario === 'geometry-remote') releaseImage(); else releaseAttachment();
-      await page.close();
-    }
-  });
-}
-
-test('natural image containers fit narrow viewports without distorting screenshots or limiting the enlarged preview', async () => {
-  const page = await pageFor('screenshot');
-  try {
-    await page.waitForFunction(() => [...document.images].some(image => image.naturalWidth > 1));
-    for (const width of [720, 360]) {
-      await page.setViewportSize({ width, height: 600 });
-      const geometry = await page.locator('.maka-markdown-image-preview img').evaluate(image => {
-        const frame = image.closest('.maka-markdown-image-block').getBoundingClientRect();
-        const box = image.getBoundingClientRect();
-        return { frame: { x: frame.x, y: frame.y, right: frame.right, bottom: frame.bottom },
-          box: { x: box.x, y: box.y, right: box.right, bottom: box.bottom, width: box.width, height: box.height },
-          ratio: image.naturalWidth / image.naturalHeight };
-      });
-      assert.ok(Math.abs(geometry.box.width / geometry.box.height - geometry.ratio) < 0.01);
-      assert.ok(geometry.box.x >= geometry.frame.x && geometry.box.right <= geometry.frame.right + 1);
-      assert.ok(geometry.box.y >= geometry.frame.y && geometry.box.bottom <= geometry.frame.bottom + 1, JSON.stringify(geometry));
-      assert.ok(geometry.frame.right <= width);
-    }
-    await page.getByRole('button', { name: 'Enlarge image: Screenshot', exact: true }).click();
-    await page.waitForFunction(() => document.images.length > 1);
-    assert.equal(await page.locator('.maka-markdown-image-preview img').count(), 1);
-    const dialog = await page.getByRole('dialog').boundingBox();
-    const frame = await page.locator('.maka-markdown-image-block').boundingBox();
-    assert.ok(dialog.height > frame.height);
-    assert.equal(await page.getByRole('dialog').locator('img').getAttribute('src'), await page.locator('.maka-markdown-image-preview img').getAttribute('src'));
-  } finally { await page.close(); }
-});
-
-for (const [name, naturalWidth, naturalHeight] of dimensions) {
-  test(`${name}: body images shrink proportionally without upscaling or empty frames`, async () => {
-    const page = await pageFor(`size-${name}`);
-    try {
-      await page.waitForFunction(() => [...document.images].some(image => image.complete && image.naturalWidth > 0));
-      for (const [width, height] of [[1280, 900], [320, 600]]) {
-        await page.setViewportSize({ width, height });
-        const geometry = await page.locator('.maka-markdown-image-preview img').evaluate(image => {
-          const block = image.closest('.maka-markdown-image-block');
-          const column = block.parentElement;
-          const style = getComputedStyle(column);
-          const availableWidth = column.clientWidth - parseFloat(style.paddingLeft) - parseFloat(style.paddingRight);
-          const box = image.getBoundingClientRect();
-          const container = block.getBoundingClientRect();
-          return { width: box.width, height: box.height, right: box.right, availableWidth,
-            containerWidth: container.width, containerHeight: container.height };
-        });
-        const scale = Math.min(1, 640 / naturalWidth, geometry.availableWidth / naturalWidth,
-          Math.min(480, height * 0.6) / naturalHeight);
-        assert.ok(Math.abs(geometry.width - naturalWidth * scale) < 1, JSON.stringify(geometry));
-        assert.ok(Math.abs(geometry.height - naturalHeight * scale) < 1, JSON.stringify(geometry));
-        assert.ok(Math.abs(geometry.containerWidth - geometry.width) < 1, JSON.stringify(geometry));
-        assert.ok(Math.abs(geometry.containerHeight - geometry.height) < 1, JSON.stringify(geometry));
-        assert.ok(geometry.right <= width);
-        assert.equal(await page.evaluate(() => document.documentElement.scrollWidth > innerWidth), false);
-      }
-    } finally { await page.close(); }
-  });
-}
-
-for (const scenario of ['badge-saved', 'badge-saving']) {
-  test(`${scenario}: a badge keeps its intrinsic size and surrounding text on one line`, async () => {
-    requests = [];
-    const page = await pageFor(scenario);
-    try {
-      await page.waitForFunction(() => [...document.images].some(image => image.naturalWidth === 80));
-      if (scenario === 'badge-saving') {
-        await page.waitForFunction(() => [...document.images].some(image => image.src.startsWith('data:') && image.naturalWidth === 80));
-      }
-      const geometry = await page.locator('.maka-markdown-image-resource').evaluate(element => {
-        const box = element.getBoundingClientRect();
-        const paragraph = element.closest('[role="paragraph"]');
-        const textBoxes = [...paragraph.childNodes].filter(node => node.nodeType === Node.TEXT_NODE && node.textContent.trim()).map(node => {
-          const range = document.createRange(); range.selectNodeContents(node);
-          return range.getBoundingClientRect().y;
-        });
-        return { width: box.width, height: box.height, textBoxes };
-      });
-      assert.ok(geometry.width <= 120);
-      assert.ok(geometry.height <= 32);
-      const pixels = await page.locator('img').boundingBox();
-      assert.equal(pixels.width, 80);
-      assert.equal(pixels.height, 20);
-      assert.equal(geometry.textBoxes.length, 2);
-      assert.equal(geometry.textBoxes[0], geometry.textBoxes[1]);
-      if (scenario === 'badge-saved') assert.deepEqual(requests, []);
-      await page.getByRole('button', { name: 'Enlarge image: Badge', exact: true }).focus();
-      await page.keyboard.press('Enter');
-      await page.getByRole('dialog').waitFor();
-    } finally { await page.close(); }
-  });
-}
-
-for (const scenario of ['badge-saved', 'badge-saving']) {
-  test(`${scenario}: delayed saved bytes never change the inline placeholder geometry`, async () => {
-    const page = await browser.newPage({ viewport: { width: 720, height: 600 } });
-    page.setDefaultTimeout(5000);
-    let release;
-    const gate = new Promise(resolve => { release = resolve; });
-    await page.route('**/badge-attachment', async route => { await gate; await route.continue(); });
-    try {
-      await page.goto(`${appUrl}/?case=${scenario}`, { waitUntil: 'domcontentloaded' });
-      await page.waitForFunction(() => window.imageReads === 0 && !!document.querySelector('.maka-markdown-image-inline'));
-      const before = await page.locator('[role="paragraph"]').boundingBox();
-      const slotBefore = await page.locator('.maka-markdown-image-resource').boundingBox();
-      await page.waitForFunction(() => window.deliveryQueries >= (new URLSearchParams(location.search).get('case') === 'badge-saving' ? 2 : 1));
-      release();
-      await page.waitForFunction(() => [...document.images].some(image => image.src.startsWith('data:') && image.naturalWidth === 80));
-      assert.deepEqual(await page.locator('.maka-markdown-image-resource').boundingBox(), slotBefore);
-      assert.deepEqual(await page.locator('[role="paragraph"]').boundingBox(), before);
-    } finally { release(); await page.close(); }
-  });
-}
-
-for (const scenario of ['badge-list', 'badge-table', 'badge-strip']) {
-  test(`${scenario}: inline Markdown context is known before the image arrives`, async () => {
-    const page = await browser.newPage({ viewport: { width: 360, height: 600 } });
-    page.setDefaultTimeout(5000);
-    let release;
-    const gate = new Promise(resolve => { release = resolve; });
-    await page.route('**/badge-attachment', async route => { await gate; await route.continue(); });
-    try {
-      await page.goto(`${appUrl}/?case=${scenario}`, { waitUntil: 'domcontentloaded' });
-      await page.locator('.maka-markdown-image-inline').first().waitFor();
-      assert.equal(await page.locator('.maka-markdown-image-block').count(), 0);
-      const before = await page.locator('.maka-markdown-image-resource').first().boundingBox();
-      assert.ok(before.width <= 120 && before.height <= 32);
-      release();
-      await page.waitForFunction(expected => document.images.length === expected &&
-        [...document.images].every(image => image.naturalWidth === 80), scenario === 'badge-strip' ? 2 : 1);
-      assert.deepEqual(await page.locator('.maka-markdown-image-resource').first().boundingBox(), before);
-    } finally { release(); await page.close(); }
-  });
-}
-
-for (const [scenario, width, height] of [
-  ['layout-main', 1280, 900], ['layout-main', 480, 700],
-  ['layout-side', 720, 700], ['layout-side', 320, 600],
-]) {
-  test(`${scenario} ${width}x${height}: production chat columns fit natural image dimensions`, async () => {
-    const page = await browser.newPage({ viewport: { width, height } });
-    page.setDefaultTimeout(5000);
-    let release;
-    const gate = new Promise(resolve => { release = resolve; });
-    await page.route('**/fixture/**', async route => { await gate; await route.continue(); });
-    const measure = () => page.locator('.maka-markdown-image-resource').evaluateAll(elements => elements.map(element => {
-      const r = element.getBoundingClientRect();
-      return { x: r.x, y: r.y, width: r.width, height: r.height };
-    }));
-    try {
-      await page.goto(`${appUrl}/?case=${scenario}`, { waitUntil: 'domcontentloaded' });
-      await page.waitForFunction(() => document.querySelectorAll('.maka-markdown-image-resource').length === 2);
-      await page.getByText('Following paragraph.').waitFor();
-      const before = await measure();
-      assert.equal(before.length, 2);
-      assert.ok(before[0].width <= 120 && before[0].height <= 32);
-      assert.ok(before[1].width <= 640 && before[1].height < 100);
-      for (const box of before) assert.ok(box.x >= 0 && box.x + box.width <= width);
-      const evidence = process.env.MAKA_IMAGE_LAYOUT_EVIDENCE_DIR;
-      if (evidence) {
-        await mkdir(evidence, { recursive: true });
-        await page.screenshot({ path: join(evidence, `${scenario}-${width}-loading.png`), fullPage: true });
-      }
-      release();
-      await page.waitForFunction(() => document.images.length === 2 && [...document.images].every(image => image.complete && image.naturalWidth > 0));
-      const ready = await measure();
-      assert.deepEqual(ready[0], before[0]);
-      const image = await page.locator('.maka-markdown-image-block img').boundingBox();
-      assert.ok(ready[1].width <= 640 && ready[1].height <= Math.min(480, height * 0.6));
-      assert.ok(Math.abs(ready[1].width - image.width) < 1 && Math.abs(ready[1].height - image.height) < 1);
-      assert.ok(Math.abs(image.width / image.height - 900 / 730) < 0.01);
-      assert.ok((await page.getByText('Following paragraph.').boundingBox()).y >= image.y + image.height);
-      assert.equal(await page.evaluate(() => document.documentElement.scrollWidth > innerWidth), false);
-      if (evidence) {
-        await page.screenshot({ path: join(evidence, `${scenario}-${width}-ready.png`), fullPage: true });
-        console.log(JSON.stringify({ scenario, viewport: { width, height }, loading: before, ready }));
-      }
-    } finally { release(); await page.close(); }
-  });
-}
diff --git a/packages/ui/src/attachment-image.tsx b/packages/ui/src/attachment-image.tsx
index 66511959f6..dc52a3b331 100644
--- a/packages/ui/src/attachment-image.tsx
+++ b/packages/ui/src/attachment-image.tsx
@@ -38,7 +38,6 @@ export type ReadAttachmentBytes = (
 type SessionAttachmentContextValue = {
   sessionId: string;
   loadImage: (sessionId: string, artifactId: string) => Promise<string | undefined>;
-  invalidate(sessionId: string, artifactId: string): void;
 };
 
 const SessionAttachmentContext = createContext<SessionAttachmentContextValue | undefined>(undefined);
@@ -54,19 +53,10 @@ export function SessionAttachmentProvider(props: {
       const readBytes = props.readBytes;
       if (!readBytes) return undefined;
       const pending = new Map<string, Promise<string | undefined>>();
-      const ready = new Map<string, string>();
-      let cachedBytes = 0;
       return {
         sessionId: props.sessionId,
-        invalidate(sessionId: string, artifactId: string) {
-          const key = `${sessionId}\0${artifactId}`;
-          const cached = ready.get(key);
-          if (cached) { cachedBytes -= cached.length * 2; ready.delete(key); }
-        },
         loadImage(sessionId: string, artifactId: string) {
           const key = `${sessionId}\0${artifactId}`;
-          const cached = ready.get(key);
-          if (cached) { ready.delete(key); ready.set(key, cached); return Promise.resolve(cached); }
           const existing = pending.get(key);
           if (existing) return existing;
           const loaded = readBytes(sessionId, artifactId)
@@ -78,14 +68,6 @@ export function SessionAttachmentProvider(props: {
             })
             .catch(() => undefined);
           pending.set(key, loaded);
-          void loaded.then(src => {
-            if (!src) return;
-            ready.set(key, src); cachedBytes += src.length * 2;
-            while (cachedBytes > 32 * 1024 * 1024 && ready.size) {
-              const oldest = ready.keys().next().value!;
-              cachedBytes -= ready.get(oldest)!.length * 2; ready.delete(oldest);
-            }
-          });
           void loaded.finally(() => {
             if (pending.get(key) === loaded) pending.delete(key);
           });
@@ -120,9 +102,8 @@ export function useAttachmentImage(ref: {
   const loadImage = context?.loadImage;
   const [attempt, setAttempt] = useState(0);
   const retry = useCallback(() => {
-    if (artifactId && sessionId) context?.invalidate(sessionId, artifactId);
     setAttempt((value) => value + 1);
-  }, [artifactId, sessionId, context]);
+  }, []);
   const request = useMemo(
     () => artifactId && sessionId && loadImage
       ? { artifactId, sessionId, loadImage, attempt }
diff --git a/packages/ui/src/markdown-image.tsx b/packages/ui/src/markdown-image.tsx
index 378e9a90fb..5b66689ad3 100644
--- a/packages/ui/src/markdown-image.tsx
+++ b/packages/ui/src/markdown-image.tsx
@@ -18,7 +18,7 @@
  */
 
 import { useEffect, useRef, useState } from 'react';
-import { Button, IconButton, Spinner, Tooltip, useLightbox } from '@astryxdesign/core';
+import { Button, IconButton, Spinner, Tooltip } from '@astryxdesign/core';
 import { createMarkdownPlugin, type MarkdownExtensionNode } from '@astryxdesign/core/Markdown/plugins';
 import type { MarkdownAstNode, MarkdownAstRoot } from '@astryxdesign/core/Markdown';
 import { RotateCw, AlertTriangle } from './icons.js';
@@ -126,25 +126,6 @@ function ImageResource(props: { src: string; redacted: boolean; alt: string; inl
 }
 
 function DisplayImage(props: { src: string; alt: string; onError(): void }) {
-  const copy = getSharedUiCopy(useUiLocale()).markdown;
-  const [loaded, setLoaded] = useState(false);
-  const lightbox = useLightbox({ media: { src: props.src, alt: props.alt }, hasZoom: true });
-  const trigger = useRef<HTMLButtonElement>(null);
-  useEffect(() => {
-    if (lightbox.isOpen) return () => trigger.current?.focus();
-  }, [lightbox.isOpen]);
-  const content = <>
-    {!loaded && <span className="maka-markdown-image-loading" role="status" aria-label={copy.imageLoading}><Spinner size="sm" shade="subtle" aria-hidden="true" /> <span className="maka-markdown-image-loading-label">{copy.imageLoading}</span></span>}
-    <img src={props.src} alt={props.alt} loading="lazy" decoding="async" referrerPolicy="no-referrer"
-        className="maka-markdown-attachment-image" onLoad={() => setLoaded(true)} onError={props.onError} />
-  </>;
-  return <>
-    <Button ref={trigger} variant="ghost" className="maka-markdown-image-preview maka-markdown-image-trigger"
-        label={copy.imageExpand(props.alt)} aria-haspopup="dialog" isDisabled={!loaded}
-        style={{ padding: 0, background: 'transparent' }}
-        onClick={event => { event.preventDefault(); event.stopPropagation(); if (loaded) lightbox.open(); }}>
-      {content}
-    </Button>
-    {lightbox.isOpen && lightbox.element}
-  </>;
+  return <img src={props.src} alt={props.alt} loading="lazy" decoding="async" referrerPolicy="no-referrer"
+    className="maka-markdown-attachment-image" onError={props.onError} />;
 }
diff --git a/packages/ui/src/shared-ui-copy.ts b/packages/ui/src/shared-ui-copy.ts
index c656c375ca..621a6a3902 100644
--- a/packages/ui/src/shared-ui-copy.ts
+++ b/packages/ui/src/shared-ui-copy.ts
@@ -33,7 +33,6 @@ export interface SharedUiCopy {
     imageLoading: string;
     imageRemoteRedacted: string;
     imageRemoteUnavailable: string;
-    imageExpand: (alt: string) => string;
     imageArchiveFailure: (reason: import('@maka/core/image-delivery').ImageDeliveryFailure) => string;
     imageUnavailable: string;
     imageLoadFailed: string;
@@ -138,7 +137,6 @@ const SHARED_UI_COPY = {
       imageLoading: '正在加载图片…',
       imageRemoteRedacted: '图片地址含已隐藏的敏感信息，无法加载或在浏览器中打开。',
       imageRemoteUnavailable: '此处无法加载远程图片，可在浏览器中打开。',
-      imageExpand: (alt) => alt ? `放大图片：${alt}` : '放大图片',
       imageArchiveFailure: (reason) => ({
         quota_exceeded: '图片未保存：存储配额已满（每个会话 100 MiB，工作区 1 GiB）。删除不再需要的会话可释放空间，仅归档不会释放。',
         too_large: '图片未保存：超过自动保存的大小或像素上限。',
@@ -237,7 +235,6 @@ const SHARED_UI_COPY = {
       imageLoading: '正在載入圖片…',
       imageRemoteRedacted: '圖片位址含已隱藏的敏感資訊，無法載入或在瀏覽器中開啟。',
       imageRemoteUnavailable: '此處無法載入遠端圖片，可在瀏覽器中開啟。',
-      imageExpand: (alt) => alt ? `放大圖片：${alt}` : '放大圖片',
       imageArchiveFailure: (reason) => ({
         quota_exceeded: '圖片未儲存：儲存配額已滿（每個對話 100 MiB，工作區 1 GiB）。刪除不再需要的對話可釋放空間，僅封存不會釋放。',
         too_large: '圖片未儲存：超過自動儲存的大小或像素上限。',
@@ -336,7 +333,6 @@ const SHARED_UI_COPY = {
       imageLoading: 'Loading image…',
       imageRemoteRedacted: 'The image address contains hidden sensitive information. Loading and opening it are disabled.',
       imageRemoteUnavailable: 'Remote images cannot be loaded here. You can open this image in your browser.',
-      imageExpand: (alt) => alt ? `Enlarge image: ${alt}` : 'Enlarge image',
       imageArchiveFailure: (reason) => ({
         quota_exceeded: 'Image not saved: storage quota reached (100 MiB per session, 1 GiB per workspace). Delete unneeded sessions to free space; archiving does not free space.',
         too_large: 'Image not saved: exceeds the automatic save size or pixel limit.',
diff --git a/packages/ui/src/styles.css b/packages/ui/src/styles.css
index 3b06dfd72f..df03c07d6e 100644
--- a/packages/ui/src/styles.css
+++ b/packages/ui/src/styles.css
@@ -615,7 +615,7 @@
 }
 
 /* Preserve natural dimensions and aspect ratio; only shrink images that exceed
-   the message column or preview bounds. The lightbox owns enlarged viewing. */
+   the message column or preview bounds. Preserve the decoded image aspect ratio. */
 .maka-markdown-attachment-image {
   display: block;
   max-width: 100%;
@@ -653,7 +653,7 @@
   max-width: min(100%, 640px);
 }
 /* Six text ems leave room for a typical badge; one inherited line keeps it in
-   the prose rhythm. Scale down wider images and use the lightbox for detail. */
+   the prose rhythm. Scale down wider images to fit the prose. */
 .maka-markdown-image-inline {
   width: 6em;
   height: 1lh;
@@ -666,31 +666,10 @@
   justify-content: center;
   border: 0;
 }
-.maka-markdown-image-resource .maka-markdown-image-preview {
-  max-width: 100%;
-  height: auto;
-  vertical-align: top;
-  cursor: default;
-}
-.maka-markdown-image-inline .maka-markdown-image-preview {
-  width: 100%;
-  height: 100%;
-}
 .maka-markdown-image-inline .maka-markdown-attachment-image {
   max-height: 1lh;
 }
 .maka-markdown-image-inline .maka-markdown-image-placeholder { padding: 0; }
-.maka-markdown-image-inline .maka-markdown-image-loading-label { display: none; }
-.maka-markdown-image-loading {
-  position: absolute;
-  inset: 0;
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  gap: var(--space-2);
-  color: var(--muted-foreground);
-  font-size: var(--maka-font-size-sm);
-}
 
 /* Markdown code renderers are custom components so Mermaid can be loaded only
    for settled Mermaid fences. Astryx skips its own spacing wrapper when
diff --git a/packages/ui/stories/attachment.stories.tsx b/packages/ui/stories/attachment.stories.tsx
index e74aef2f2b..878c33509c 100644
--- a/packages/ui/stories/attachment.stories.tsx
+++ b/packages/ui/stories/attachment.stories.tsx
@@ -24,8 +24,6 @@ import type { AttachmentRef } from '@maka/core/events';
 import type { SessionSummary, StoredMessage } from '@maka/core/session';
 import { ChatSurfaceLayout, ChatView, Composer } from '../src/components.js';
 import type { ChatModelChoice } from '../src/chat-model-helpers.js';
-import type { ImageDeliveryResult } from '@maka/core/image-delivery';
-import { LocaleProvider } from '../src/locale-context.js';
 
 const NOW = Date.UTC(2026, 6, 1, 9, 30, 0);
 
@@ -153,35 +151,6 @@ function AttachmentChat(props: ComponentProps<typeof ChatView>) {
   );
 }
 
-function imageDeliveryStory(result: ImageDeliveryResult): Story {
-  return {
-    render: () => <LocaleProvider locale="en"><Frame><AttachmentChat {...baseChat}
-      messages={[{ type: 'assistant', id: 'image-message', turnId: 'image-turn', ts: NOW,
-        modelId: 'claude-sonnet-4-5', text: '![Dashboard](https://example.invalid/dashboard.png)' }]}
-      onResolveImageDelivery={async () => result}
-    /></Frame></LocaleProvider>,
-    play: async ({ canvasElement }) => {
-      await waitFor(() => {
-        const image = canvasElement.querySelector('.maka-markdown-image-resource');
-        if (!image) throw new Error('assistant image has not mounted');
-        if (result.status === 'ready') expect(image.querySelector('img')?.getAttribute('src')).toMatch(/^data:/);
-        else if (result.status === 'requires_confirmation') expect(image.textContent).toContain('Remote images cannot be loaded here');
-        else if (result.status === 'failed') expect(image.textContent).toContain('download failed');
-        else expect(image.textContent).toContain('Loading image');
-      });
-    },
-  };
-}
-
-// Real path: assistant chat bubble → an older Host cannot deliver the remote image.
-export const AssistantImageUnavailable = imageDeliveryStory({ status: 'requires_confirmation' });
-// Real path: assistant chat bubble → Host is saving bytes; the image remains a placeholder.
-export const AssistantImageSaving = imageDeliveryStory({ status: 'pending' });
-// Real path: assistant chat bubble → saved attachment is read through the production byte reader.
-export const AssistantImageSaved = imageDeliveryStory({ status: 'ready', artifactId: 'dashboard-image' });
-// Real path: assistant chat bubble → failed download offers Retry with the failure reason.
-export const AssistantImageFailed = imageDeliveryStory({ status: 'failed', reason: 'download_failed' });
-
 // Real path: composer → ＋ → attach files → the pending chips before the message is sent.
 export const ComposerPendingChips: Story = {
   render: () => (

From f78d1c85c74f83cec64d42c85f2c69febedfe2c3 Mon Sep 17 00:00:00 2001
From: Sun-GLiang <81428141+Sun-GLiang@users.noreply.github.com>
Date: Tue, 13 Oct 2026 13:26:54 +0800
Subject: [PATCH 35/35] refactor(ui): remove unused image framing field

Generated-by: Codex (GPT-6)
---
 packages/ui/src/chat-image-resource.ts | 1 -
 1 file changed, 1 deletion(-)

diff --git a/packages/ui/src/chat-image-resource.ts b/packages/ui/src/chat-image-resource.ts
index c2fc49bf2c..50eb098563 100644
--- a/packages/ui/src/chat-image-resource.ts
+++ b/packages/ui/src/chat-image-resource.ts
@@ -65,7 +65,6 @@ export function useChatImageResource(input: { source: string; redacted: boolean;
     presentation.kind === 'unavailable' && presentation.reason === 'remote') ? input.source : undefined;
   return {
     presentation, attempt, retry, openSource,
-    framed: !input.visible || !!source || !!artifactId || delivery.status === 'pending',
     onDecodeError: () => { if (source) setFailedSource(source); },
   };
 }